From 931c3dc7ffa62875abe29b74fddfa7937e384dbb Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 29 Mar 2018 16:33:05 -0700 Subject: [PATCH 001/215] combined steps --- ...reate-and-verify-an-efs-dra-certificate.md | 50 ++++++------------- 1 file changed, 14 insertions(+), 36 deletions(-) diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 862200bf00..f92f0b2830 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -72,7 +72,7 @@ The recovery process included in this topic only works for desktop devices. WIP Where *encryptedfile.extension* is the name of your encrypted file. For example, corporatedata.docx. -**To quickly recover WIP-protected desktop data after unenrollment** +**To quickly recover WIP-protected after unenrollment** It's possible that you might revoke data from an unenrolled device only to later want to restore it all. This can happen in the case of a missing device being returned or if an unenrolled employee enrolls again. If the employee enrolls again using the original user profile, and the revoked key store is still on the device, all of the revoked data can be restored at once, by following these steps. @@ -81,51 +81,29 @@ It's possible that you might revoke data from an unenrolled device only to later 1. Have your employee sign in to the unenrolled device, open a command prompt, and type: - Robocopy “%localappdata%\Microsoft\EDP\Recovery” “new_location” /EFSRAW + `Robocopy` `"%localappdata%\Microsoft\EDP\Recovery"` `"`*`new_location`*`"` `/EFSRAW` - Where ”*new_location*" is in a different directory. This can be on the employee’s device or on a Windows 8 or Windows Server 2012 or newer server file share that can be accessed while you're logged in as a data recovery agent. + -or- + + If the employee performed a clean installation and there is no user profile, you need to recover the keys from the System Volume folder in each drive. Type: + + `Robocopy` `"`*`drive_letter`*`:\System Volume Information\EDP\Recovery\"` `"`*`new_location`*`"` `*` `/EFSRAW` + + Where "*new_location*" is in a different directory. This can be on the employee’s device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent. + + To start Robocopy in S mode, click Windows key + R. 2. Sign in to a different device with administrator credentials that have access to your organization's DRA certificate, and perform the file decryption and recovery by typing: - cipher.exe /D "new_location" + `cipher.exe /D` `"`*`new_location`*`"` 3. Have your employee sign in to the unenrolled device, and type: - Robocopy "new_location" “%localappdata%\Microsoft\EDP\Recovery\Input” + `Robocopy` `"`*`new_location`*`"` `"%localappdata%\Microsoft\EDP\Recovery\Input"` 4. Ask the employee to lock and unlock the device. - The Windows Credential service automatically recovers the employee’s previously revoked keys from the Recovery\Input location. - -**To quickly recover WIP-protected desktop data in a cloud-based environment** - -If you use a cloud environment in your organization, you may still want to restore an employee's data after revocation. While much of the process is the same as when you're not in a cloud environment, there are a couple of differences. - ->[!IMPORTANT] ->To maintain control over your enterprise data, and to be able to revoke again in the future, you must only perform this process after the employee has re-enrolled the device. - -1. Have your employee sign in to the device that has revoked data for you to restore, open the **Run** command (Windows logo key + R), and type one of the following commands: - - - If the keys are still stored within the employee's profile, type: Robocopy “%localappdata%\Microsoft\EDP\Recovery” “new_location” * /EFSRAW - - -or- - - - If the employee performed a clean installation over the operating system and you need to recover the keys from the System Volume folder, type: Robocopy “drive_letter:\System Volume Information\EDP\Recovery\” "new_location” * /EFSRAW> - - >[!Important] - >The “*new_location*” must be in a different directory, either on the employee’s device or on a Windows 8 or Windows Server 2012 or newer server file share, which can be accessed while you're logged in as a data recovery agent. - -2. Sign in to a different device with administrator credentials that have access to your organization's DRA certificate private key, and perform the file decryption and recovery by typing: - - cipher.exe /D “new_location” - -3. Have your employee sign in to the device again, open the **Run** command, and type: - - Robocopy “new_location” “%localappdata%\Microsoft\EDP\Recovery\Input” - -4. Ask the employee to lock and unlock the device. - - The Windows Credential service automatically recovers the employee’s previously revoked keys from the Recovery\Input location. All your company’s previously revoked files should be accessible to the employee again. + The Windows Credential service automatically recovers the employee’s previously revoked keys from the `Recovery\Input` location. ## Auto-recovery of encryption keys Starting with Windows 10, version 1709, WIP includes a data recovery feature that lets your employees auto-recover access to work files if the encryption key is lost and the files are no longer accessible. This typically happens if an employee reimages the operating system partition, removing the WIP key info, or if a device is reported as lost and you mistakenly target the wrong device for unenrollment. From 209b20bf68e8afc1736f4555d99b246d355f9dcd Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 30 Mar 2018 14:26:22 -0700 Subject: [PATCH 002/215] fixed headings --- .../create-and-verify-an-efs-dra-certificate.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index f92f0b2830..bad47f39e6 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -24,7 +24,7 @@ The recovery process included in this topic only works for desktop devices. WIP >[!IMPORTANT] >If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. For more info about when to use a PKI and the general strategy you should use to deploy DRA certificates, see the [Security Watch Deploying EFS: Part 1](https://technet.microsoft.com/magazine/2007.02.securitywatch.aspx) article on TechNet. For more general info about EFS protection, see [Protecting Data by Using EFS to Encrypt Hard Drives](https://msdn.microsoft.com/library/cc875821.aspx).

If your DRA certificate has expired, you won’t be able to encrypt your files with it. To fix this, you'll need to create a new certificate, using the steps in this topic, and then deploy it through policy. -**To manually create an EFS DRA certificate** +## Manually create an EFS DRA certificate 1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. @@ -46,7 +46,7 @@ The recovery process included in this topic only works for desktop devices. WIP >[!Note] >To add your EFS DRA certificate to your policy by using Microsoft Intune, see the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) topic. To add your EFS DRA certificate to your policy by using System Center Configuration Manager, see the [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) topic. -**To verify your data recovery certificate is correctly set up on a WIP client computer** +## Verify your data recovery certificate is correctly set up on a WIP client computer 1. Find or create a file that's encrypted using Windows Information Protection. For example, you could open an app on your allowed app list, and then create and save a file so it’s encrypted by WIP. @@ -60,7 +60,7 @@ The recovery process included in this topic only works for desktop devices. WIP 4. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. -**To recover your data using the EFS DRA certificate in a test environment** +## Recover your data using the EFS DRA certificate in a test environment 1. Copy your WIP-encrypted file to a location where you have admin access. @@ -72,17 +72,19 @@ The recovery process included in this topic only works for desktop devices. WIP Where *encryptedfile.extension* is the name of your encrypted file. For example, corporatedata.docx. -**To quickly recover WIP-protected after unenrollment** +## Recover WIP-protected after unenrollment -It's possible that you might revoke data from an unenrolled device only to later want to restore it all. This can happen in the case of a missing device being returned or if an unenrolled employee enrolls again. If the employee enrolls again using the original user profile, and the revoked key store is still on the device, all of the revoked data can be restored at once, by following these steps. +It's possible that you might revoke data from an unenrolled device only to later want to restore it all. This can happen in the case of a missing device being returned or if an unenrolled employee enrolls again. If the employee enrolls again using the original user profile, and the revoked key store is still on the device, all of the revoked data can be restored at once,. >[!IMPORTANT] >To maintain control over your enterprise data, and to be able to revoke again in the future, you must only perform this process after the employee has re-enrolled the device. -1. Have your employee sign in to the unenrolled device, open a command prompt, and type: +1. Have the employee sign in to the unenrolled device, open a command prompt, and type: `Robocopy` `"%localappdata%\Microsoft\EDP\Recovery"` `"`*`new_location`*`"` `/EFSRAW` + To start Robocopy in S mode, press the Windows key + R. + -or- If the employee performed a clean installation and there is no user profile, you need to recover the keys from the System Volume folder in each drive. Type: @@ -91,7 +93,6 @@ It's possible that you might revoke data from an unenrolled device only to later Where "*new_location*" is in a different directory. This can be on the employee’s device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent. - To start Robocopy in S mode, click Windows key + R. 2. Sign in to a different device with administrator credentials that have access to your organization's DRA certificate, and perform the file decryption and recovery by typing: From 0471800f74fcbc2cd649db8bbbeba9fd6d7286da Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 30 Mar 2018 14:46:19 -0700 Subject: [PATCH 003/215] fixed syntax formatting --- .../create-and-verify-an-efs-dra-certificate.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index bad47f39e6..aebfe5a064 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -74,14 +74,16 @@ The recovery process included in this topic only works for desktop devices. WIP ## Recover WIP-protected after unenrollment -It's possible that you might revoke data from an unenrolled device only to later want to restore it all. This can happen in the case of a missing device being returned or if an unenrolled employee enrolls again. If the employee enrolls again using the original user profile, and the revoked key store is still on the device, all of the revoked data can be restored at once,. +It's possible that you might revoke data from an unenrolled device only to later want to restore it all. This can happen in the case of a missing device being returned or if an unenrolled employee enrolls again. If the employee enrolls again using the original user profile, and the revoked key store is still on the device, all of the revoked data can be restored at once. >[!IMPORTANT] >To maintain control over your enterprise data, and to be able to revoke again in the future, you must only perform this process after the employee has re-enrolled the device. 1. Have the employee sign in to the unenrolled device, open a command prompt, and type: - `Robocopy` `"%localappdata%\Microsoft\EDP\Recovery"` `"`*`new_location`*`"` `/EFSRAW` + ``` + Robocopy "%localappdata%\Microsoft\EDP\Recovery" "new_location" /EFSRAW + ``` To start Robocopy in S mode, press the Windows key + R. From dbff31ad15e14d3c544c199b0349139c6e80b2c4 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 30 Mar 2018 15:13:01 -0700 Subject: [PATCH 004/215] fixed formatting --- .../create-and-verify-an-efs-dra-certificate.md | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index aebfe5a064..d7631db8b9 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -80,10 +80,8 @@ It's possible that you might revoke data from an unenrolled device only to later >To maintain control over your enterprise data, and to be able to revoke again in the future, you must only perform this process after the employee has re-enrolled the device. 1. Have the employee sign in to the unenrolled device, open a command prompt, and type: - - ``` - Robocopy "%localappdata%\Microsoft\EDP\Recovery" "new_location" /EFSRAW - ``` + + Robocopy "%localappdata%\Microsoft\EDP\Recovery" "new_location" /EFSRAW To start Robocopy in S mode, press the Windows key + R. @@ -91,18 +89,18 @@ It's possible that you might revoke data from an unenrolled device only to later If the employee performed a clean installation and there is no user profile, you need to recover the keys from the System Volume folder in each drive. Type: - `Robocopy` `"`*`drive_letter`*`:\System Volume Information\EDP\Recovery\"` `"`*`new_location`*`"` `*` `/EFSRAW` + Robocopy "drive_letter:\System Volume Information\EDP\Recovery\" "new_location" * /EFSRAW Where "*new_location*" is in a different directory. This can be on the employee’s device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent. 2. Sign in to a different device with administrator credentials that have access to your organization's DRA certificate, and perform the file decryption and recovery by typing: - `cipher.exe /D` `"`*`new_location`*`"` + cipher.exe /D "new_location" 3. Have your employee sign in to the unenrolled device, and type: - `Robocopy` `"`*`new_location`*`"` `"%localappdata%\Microsoft\EDP\Recovery\Input"` + Robocopy "new_location" "%localappdata%\Microsoft\EDP\Recovery\Input" 4. Ask the employee to lock and unlock the device. From d90ed66543aaede0156b90493a134ca3583ad128 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 3 Apr 2018 11:36:55 -0700 Subject: [PATCH 005/215] split requirements faq --- .../bitlocker-frequently-asked-questions.md | 56 +-------------- ...bitlocker-overview-and-requirements-faq.md | 70 +++++++++++++++++++ 2 files changed, 72 insertions(+), 54 deletions(-) create mode 100644 windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index b56af7542a..63b40b694c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: high author: brianlic-msft -ms.date: 10/16/2017 +ms.date: 04/03/2018 --- # BitLocker frequently asked questions (FAQ) @@ -20,7 +20,7 @@ This topic for the IT professional answers frequently asked questions concerning BitLocker is a data protection feature that encrypts the hard drives on your computer to provide enhanced protection against data theft or exposure on computers and removable drives that are lost or stolen, and more secure data deletion when BitLocker-protected computers are decommissioned as it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive. -- [Overview and requirements](#bkmk-overview) +- [Overview and requirements](bitlocker-overview-and-requirements-faq.md) - [Upgrading](#bkmk-upgrading) - [Deployment and administration](#bkmk-deploy) - [Key management](#bkmk-keymanagement) @@ -30,59 +30,7 @@ BitLocker is a data protection feature that encrypts the hard drives on your com - [BitLocker Network Unlock](#bkmk-bnusect) - [Other questions](#bkmk-other) -## Overview and requirements -### How does BitLocker work? - -**How BitLocker works with operating system drives** - -You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data. - -**How BitLocker works with fixed and removable data drives** - -You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods. - -### Does BitLocker support multifactor authentication? - -Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection. - -### What are the BitLocker hardware and software requirements? - -For requirements, see [System requirements](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview#system-requirements). - -> **Note:**  Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it is cannot be protected by BitLocker. -  -### Why are two partitions required? Why does the system drive have to be so large? - -Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive. - -### Which Trusted Platform Modules (TPMs) does BitLocker support? - -BitLocker supports TPM version 1.2 or higher. - -### How can I tell if a TPM is on my computer? - -Open the TPM MMC console (tpm.msc) and look under the **Status** heading. - -### Can I use BitLocker on an operating system drive without a TPM? - -Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide. -To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements. - -### How do I obtain BIOS support for the TPM on my computer? - -Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements: - -- It is compliant with the TCG standards for a client computer. -- It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer. - -### What credentials are required to use BitLocker? - -To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives. - -### What is the recommended boot order for computers that are going to be BitLocker-protected? - -You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such ach as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.  ## Upgrading diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md new file mode 100644 index 0000000000..71e1fdb876 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md @@ -0,0 +1,70 @@ +--- +title: BitLocker overview and requirements FAQ (Windows 10) +description: This topic for the IT professional answers frequently asked questions concerning the requirements to use BitLocker. +ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.date: 04/03/2018 +--- + +# BitLocker overview and requirements FAQ + +**Applies to** +- Windows 10 + +## How does BitLocker work? + +**How BitLocker works with operating system drives** + +You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data. + +**How BitLocker works with fixed and removable data drives** + +You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods. + +## Does BitLocker support multifactor authentication? + +Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection. + +## What are the BitLocker hardware and software requirements? + +For requirements, see [System requirements](bitlocker-overview.md#system-requirements). + +> [!NOTE]   +> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it is cannot be protected by BitLocker. +  +## Why are two partitions required? Why does the system drive have to be so large? + +Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive. + +## Which Trusted Platform Modules (TPMs) does BitLocker support? + +BitLocker supports TPM version 1.2 or higher. + +## How can I tell if a TPM is on my computer? + +Open the TPM MMC console (tpm.msc) and look under the **Status** heading. + +## Can I use BitLocker on an operating system drive without a TPM? + +Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide. +To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements. + +## How do I obtain BIOS support for the TPM on my computer? + +Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements: + +- It is compliant with the TCG standards for a client computer. +- It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer. + +## What credentials are required to use BitLocker? + +To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives. + +## What is the recommended boot order for computers that are going to be BitLocker-protected? + +You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such ach as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.  \ No newline at end of file From 4317cf9976e631e4c5d74664788e25c608c703ea Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 3 Apr 2018 11:50:27 -0700 Subject: [PATCH 006/215] split upgrade FAQ --- .../bitlocker/bitlocker-upgrading-faq.md | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md new file mode 100644 index 0000000000..55f1188cda --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md @@ -0,0 +1,40 @@ +--- +title: BitLocker Upgrading FAQ (Windows 10) +description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.date: 04/03/2018 +--- + +# BitLocker Upgrading FAQ + +**Applies to** +- Windows 10 + +## Can I upgrade to Windows 10 with BitLocker enabled? + +Yes. + +## What is the difference between suspending and decrypting BitLocker? + +**Decrypt** completely removes BitLocker protection and fully decrypts the drive. + +**Suspend** keeps the data encrypted but encrypts the BitLocker volume master key with a clear key. The clear key is a cryptographic key stored unencrypted and unprotected on the disk drive. By storing this key unencrypted, the **Suspend** option allows for changes or upgrades to the computer without the time and cost of decrypting and re-encrypting the entire drive. After the changes are made and BitLocker is again enabled, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade, the volume master key is changed, the protectors are updated to match and the clear key is erased. + +## Do I have to decrypt my BitLocker-protected drive to download and install system updates and upgrades? + +No user action is required for BitLocker in order to apply updates from Microsoft, including [Windows quality updates and feature updates](https://technet.microsoft.com/itpro/windows/manage/waas-quick-start). +Users need to suspend BitLocker for Non-Microsoft software updates, such as: + +- Computer manufacturer firmware updates +- TPM firmware updates +- Non-Microsoft application updates that modify boot components + +> [!NOTE]   +> If you have suspended BitLocker, you can resume BitLocker protection after you have installed the upgrade or update. Upon resuming protection, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade or update. If these types of upgrades or updates are applied without suspending BitLocker, your computer will enter recovery mode when restarting and will require a recovery key or password to access the computer. +  From 24fae1c96eed5977bb4e78da6c493f6d770ddba0 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 3 Apr 2018 12:38:39 -0700 Subject: [PATCH 007/215] split key mgmt FAQ --- ...ocker-deployment-and-administration-faq.md | 86 ++++++++ .../bitlocker-frequently-asked-questions.md | 191 +----------------- .../bitlocker/bitlocker-key-management-faq.md | 112 ++++++++++ 3 files changed, 200 insertions(+), 189 deletions(-) create mode 100644 windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md create mode 100644 windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md new file mode 100644 index 0000000000..9d12f4246d --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md @@ -0,0 +1,86 @@ +--- +title: BitLocker frequently asked questions (FAQ) (Windows 10) +description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.date: 04/03/2018 +--- + +# BitLocker Deployment and Administration FAQ + +**Applies to** +- Windows 10 + +## Can BitLocker deployment be automated in an enterprise environment? + +Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](https://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/bitlocker/index?view=win10-ps). + +## Can BitLocker encrypt more than just the operating system drive? + +Yes. + +## Is there a noticeable performance impact when BitLocker is enabled on a computer? + +Generally it imposes a single-digit percentage performance overhead. + +## How long will initial encryption take when BitLocker is turned on? + +Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting very large drives, you may want to set encryption to occur during times when you will not be using the drive. + +You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted. + +## What happens if the computer is turned off during encryption or decryption? + +If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable. + +## Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data? + +No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive. + +## How can I prevent users on a network from storing data on an unencrypted drive? + +You can can Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). +When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only. + +## What system changes would cause the integrity check on my operating system drive to fail? + +The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive: + +- Moving the BitLocker-protected drive into a new computer. +- Installing a new motherboard with a new TPM. +- Turning off, disabling, or clearing the TPM. +- Changing any boot configuration settings. +- Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data. + +## What causes BitLocker to start into recovery mode when attempting to start the operating system drive? + +Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode. +For example: + +- Changing the BIOS boot order to boot another drive in advance of the hard drive. +- Adding or removing hardware, such as inserting a new card in the computer, including some PCMIA wireless cards. +- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. + +In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password. +The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed. + +## Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive? + +Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive, so if you want to prepare a backup operating system or data drive for use in case of disk failure, you need to make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts. + +## Can I access my BitLocker-protected drive if I insert the hard disk into a different computer? + +Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key. + +## Why is "Turn BitLocker on" not available when I right-click a drive? +Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted. + +## What type of disk configurations are supported by BitLocker? +Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported. + + diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 63b40b694c..0f59f82df1 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -21,8 +21,8 @@ This topic for the IT professional answers frequently asked questions concerning BitLocker is a data protection feature that encrypts the hard drives on your computer to provide enhanced protection against data theft or exposure on computers and removable drives that are lost or stolen, and more secure data deletion when BitLocker-protected computers are decommissioned as it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive. - [Overview and requirements](bitlocker-overview-and-requirements-faq.md) -- [Upgrading](#bkmk-upgrading) -- [Deployment and administration](#bkmk-deploy) +- [Upgrading](bitlocker-upgrading-faq.md) +- [Deployment and administration](bitlocker-deployment-and-administration-faq.md) - [Key management](#bkmk-keymanagement) - [BitLocker To Go](#bkmk-btgsect) - [Active Directory Domain Services (AD DS)](#bkmk-adds) @@ -32,193 +32,6 @@ BitLocker is a data protection feature that encrypts the hard drives on your com -## Upgrading - -### Can I upgrade to Windows 10 with BitLocker enabled? - -Yes. - -### What is the difference between suspending and decrypting BitLocker? - -**Decrypt** completely removes BitLocker protection and fully decrypts the drive. - -**Suspend** keeps the data encrypted but encrypts the BitLocker volume master key with a clear key. The clear key is a cryptographic key stored unencrypted and unprotected on the disk drive. By storing this key unencrypted, the **Suspend** option allows for changes or upgrades to the computer without the time and cost of decrypting and re-encrypting the entire drive. After the changes are made and BitLocker is again enabled, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade, the volume master key is changed, the protectors are updated to match and the clear key is erased. - -### Do I have to decrypt my BitLocker-protected drive to download and install system updates and upgrades? - -No user action is required for BitLocker in order to apply updates from Microsoft, including [Windows quality updates and feature updates](https://technet.microsoft.com/itpro/windows/manage/waas-quick-start). -Users need to suspend BitLocker for Non-Microsoft software updates, such as: - -- Computer manufacturer firmware updates -- TPM firmware updates -- Non-Microsoft application updates that modify boot components - -> **Note:**  If you have suspended BitLocker, you can resume BitLocker protection after you have installed the upgrade or update. Upon resuming protection, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade or update. If these types of upgrades or updates are applied without suspending BitLocker, your computer will enter recovery mode when restarting and will require a recovery key or password to access the computer. -  -## Deployment and administration - -### Can BitLocker deployment be automated in an enterprise environment? - -Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](https://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj649829.aspx). - -### Can BitLocker encrypt more than just the operating system drive? - -Yes. - -### Is there a noticeable performance impact when BitLocker is enabled on a computer? - -Generally it imposes a single-digit percentage performance overhead. - -### How long will initial encryption take when BitLocker is turned on? - -Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting very large drives, you may want to set encryption to occur during times when you will not be using the drive. - -You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted. - -### What happens if the computer is turned off during encryption or decryption? - -If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable. - -### Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data? - -No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive. - -### How can I prevent users on a network from storing data on an unencrypted drive? - -You can can Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). -When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only. - -### What system changes would cause the integrity check on my operating system drive to fail? - -The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive: - -- Moving the BitLocker-protected drive into a new computer. -- Installing a new motherboard with a new TPM. -- Turning off, disabling, or clearing the TPM. -- Changing any boot configuration settings. -- Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data. - -### What causes BitLocker to start into recovery mode when attempting to start the operating system drive? - -Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode. -For example: - -- Changing the BIOS boot order to boot another drive in advance of the hard drive. -- Adding or removing hardware, such as inserting a new card in the computer, including some PCMIA wireless cards. -- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. - -In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password. -The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed. - -### Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive? - -Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive, so if you want to prepare a backup operating system or data drive for use in case of disk failure, you need to make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts. - -### Can I access my BitLocker-protected drive if I insert the hard disk into a different computer? - -Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key. - -### Why is "Turn BitLocker on" not available when I right-click a drive? -Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted. - -### What type of disk configurations are supported by BitLocker? -Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported. - -## Key management - -### What is the difference between a recovery password, recovery key, PIN, enhanced PIN, and startup key? - -For tables that list and describe elements such as a recovery password, recovery key, and PIN, see [BitLocker key protectors](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-key-protectors) and [BitLocker authentication methods](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-authentication-methods). - -### How can the recovery password and recovery key be stored? - -The recovery password and recovery key for an operating system drive or a fixed data drive can be saved to a folder, saved to one or more USB devices, saved to your Microsoft Account, or printed. - -For removable data drives, the recovery password and recovery key can be saved to a folder, saved to your Microsoft Account, or printed. By default, you cannot store a recovery key for a removable drive on a removable drive. - -A domain administrator can additionally configure Group Policy to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) for any BitLocker-protected drive. - -### Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled? - -You can use the Manage-bde.exe command-line tool to replace your TPM-only authentication mode with a multifactor authentication mode. For example, if BitLocker is enabled with TPM authentication only and you want to add PIN authentication, use the following commands from an elevated command prompt, replacing *<4-20 digit numeric PIN>* with the numeric PIN you want to use: - -`manage-bde –protectors –delete %systemdrive% -type tpm` - -`manage-bde –protectors –add %systemdrive% -tpmandpin <4-20 digit numeric PIN>` - - -### When should an additional method of authentication be considered? - -New hardware that meets [Windows Hardware Compatibility Program](https://docs.microsoft.com/windows-hardware/design/compatibility/) requirements make a PIN less critical as a mitigation, and having a TPM-only protector is likely sufficient when combined with policies like device lockout. For example, Surface Pro and Surface Book do not have external DMA ports to attack. -For older hardware, where a PIN may be needed, it’s recommended to enable [enhanced PINs](bitlocker-group-policy-settings.md#bkmk-unlockpol2) that allow non-numeric characters such as letters and punctuation marks, and to set the PIN length based on your risk tolerance and the hardware anti-hammering capabilities available to the TPMs in your computers. - -### If I lose my recovery information, will the BitLocker-protected data be unrecoverable? - -BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive. - ->**Important:**  Store the recovery information in AD DS, along with your Microsoft Account, or another safe location. -  -### Can the USB flash drive that is used as the startup key also be used to store the recovery key? - -While this is technically possible, it is not a best practice to use one USB flash drive to store both keys. If the USB flash drive that contains your startup key is lost or stolen, you also lose access to your recovery key. In addition, inserting this key would cause your computer to automatically boot from the recovery key even if TPM-measured files have changed, which circumvents the TPM's system integrity check. - -### Can I save the startup key on multiple USB flash drives? - -Yes, you can save a computer's startup key on multiple USB flash drives. Right-clicking a BitLocker-protected drive and selecting **Manage BitLocker** will provide you the options to duplicate the recovery keys as needed. - -### Can I save multiple (different) startup keys on the same USB flash drive? - -Yes, you can save BitLocker startup keys for different computers on the same USB flash drive. - -### Can I generate multiple (different) startup keys for the same computer? - -You can generate different startup keys for the same computer through scripting. However, for computers that have a TPM, creating different startup keys prevents BitLocker from using the TPM's system integrity check. - -### Can I generate multiple PIN combinations? - -You cannot generate multiple PIN combinations. - -### What encryption keys are used in BitLocker? How do they work together? - -Raw data is encrypted with the full volume encryption key, which is then encrypted with the volume master key. The volume master key is in turn encrypted by one of several possible methods depending on your authentication (that is, key protectors or TPM) and recovery scenarios. - -### Where are the encryption keys stored? - -The full volume encryption key is encrypted by the volume master key and stored in the encrypted drive. The volume master key is encrypted by the appropriate key protector and stored in the encrypted drive. If BitLocker has been suspended, the clear key that is used to encrypt the volume master key is also stored in the encrypted drive, along with the encrypted volume master key. - -This storage process ensures that the volume master key is never stored unencrypted and is protected unless you disable BitLocker. The keys are also saved to two additional locations on the drive for redundancy. The keys can be read and processed by the boot manager. - -### Why do I have to use the function keys to enter the PIN or the 48-character recovery password? - -The F1 through F10 keys are universally mapped scan codes available in the pre-boot environment on all computers and in all languages. The numeric keys 0 through 9 are not usable in the pre-boot environment on all keyboards. - -When using an enhanced PIN, users should run the optional system check during the BitLocker setup process to ensure that the PIN can be entered correctly in the pre-boot environment. - -### How does BitLocker help prevent an attacker from discovering the PIN that unlocks my operating system drive? - -It is possible that a personal identification number (PIN) can be discovered by an attacker performing a brute force attack. A brute force attack occurs when an attacker uses an automated tool to try different PIN combinations until the correct one is discovered. For BitLocker-protected computers, this type of attack, also known as a dictionary attack, requires that the attacker have physical access to the computer. - -The TPM has the built-in ability to detect and react to these types of attacks. Because different manufacturers' TPMs may support different PIN and attack mitigations, contact your TPM's manufacturer to determine how your computer's TPM mitigates PIN brute force attacks. -After you have determined your TPM's manufacturer, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset. - -### How can I determine the manufacturer of my TPM? - -You can determine your TPM manufacturer in the TPM MMC console (tpm.msc) under the **TPM Manufacturer Information** heading. - -### How can I evaluate a TPM's dictionary attack mitigation mechanism? - -The following questions can assist you when asking a TPM manufacturer about the design of a dictionary attack mitigation mechanism: - -- How many failed authorization attempts can occur before lockout? -- What is the algorithm for determining the duration of a lockout based on the number of failed attempts and any other relevant parameters? -- What actions can cause the failure count and lockout duration to be decreased or reset? - -### Can PIN length and complexity be managed with Group Policy? - -Yes and No. You can configure the minimum personal identification number (PIN) length by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** Group Policy setting. However, you cannot require PIN complexity by Group Policy. - -For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - ## BitLocker To Go BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md new file mode 100644 index 0000000000..a46414f9a7 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md @@ -0,0 +1,112 @@ +--- +title: BitLocker Key Management FAQ (Windows 10) +description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.date: 04/03/2018 +--- + +# BitLocker Key Management FAQ + +**Applies to** +- Windows 10 + +## What is the difference between a recovery password, recovery key, PIN, enhanced PIN, and startup key? + +For tables that list and describe elements such as a recovery password, recovery key, and PIN, see [BitLocker key protectors](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-key-protectors) and [BitLocker authentication methods](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-authentication-methods). + +## How can the recovery password and recovery key be stored? + +The recovery password and recovery key for an operating system drive or a fixed data drive can be saved to a folder, saved to one or more USB devices, saved to your Microsoft Account, or printed. + +For removable data drives, the recovery password and recovery key can be saved to a folder, saved to your Microsoft Account, or printed. By default, you cannot store a recovery key for a removable drive on a removable drive. + +A domain administrator can additionally configure Group Policy to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) for any BitLocker-protected drive. + +## Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled? + +You can use the Manage-bde.exe command-line tool to replace your TPM-only authentication mode with a multifactor authentication mode. For example, if BitLocker is enabled with TPM authentication only and you want to add PIN authentication, use the following commands from an elevated command prompt, replacing *<4-20 digit numeric PIN>* with the numeric PIN you want to use: + +manage-bde –protectors –delete %systemdrive% -type tpm + +manage-bde –protectors –add %systemdrive% -tpmandpin 4-20 digit numeric PIN + + +## When should an additional method of authentication be considered? + +New hardware that meets [Windows Hardware Compatibility Program](https://docs.microsoft.com/windows-hardware/design/compatibility/) requirements make a PIN less critical as a mitigation, and having a TPM-only protector is likely sufficient when combined with policies like device lockout. For example, Surface Pro and Surface Book do not have external DMA ports to attack. +For older hardware, where a PIN may be needed, it’s recommended to enable [enhanced PINs](bitlocker-group-policy-settings.md#bkmk-unlockpol2) that allow non-numeric characters such as letters and punctuation marks, and to set the PIN length based on your risk tolerance and the hardware anti-hammering capabilities available to the TPMs in your computers. + +## If I lose my recovery information, will the BitLocker-protected data be unrecoverable? + +BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive. + +> [!IMPORTANT]   +> Store the recovery information in AD DS, along with your Microsoft Account, or another safe location. +  +## Can the USB flash drive that is used as the startup key also be used to store the recovery key? + +While this is technically possible, it is not a best practice to use one USB flash drive to store both keys. If the USB flash drive that contains your startup key is lost or stolen, you also lose access to your recovery key. In addition, inserting this key would cause your computer to automatically boot from the recovery key even if TPM-measured files have changed, which circumvents the TPM's system integrity check. + +## Can I save the startup key on multiple USB flash drives? + +Yes, you can save a computer's startup key on multiple USB flash drives. Right-clicking a BitLocker-protected drive and selecting **Manage BitLocker** will provide you the options to duplicate the recovery keys as needed. + +## Can I save multiple (different) startup keys on the same USB flash drive? + +Yes, you can save BitLocker startup keys for different computers on the same USB flash drive. + +## Can I generate multiple (different) startup keys for the same computer? + +You can generate different startup keys for the same computer through scripting. However, for computers that have a TPM, creating different startup keys prevents BitLocker from using the TPM's system integrity check. + +## Can I generate multiple PIN combinations? + +You cannot generate multiple PIN combinations. + +## What encryption keys are used in BitLocker? How do they work together? + +Raw data is encrypted with the full volume encryption key, which is then encrypted with the volume master key. The volume master key is in turn encrypted by one of several possible methods depending on your authentication (that is, key protectors or TPM) and recovery scenarios. + +## Where are the encryption keys stored? + +The full volume encryption key is encrypted by the volume master key and stored in the encrypted drive. The volume master key is encrypted by the appropriate key protector and stored in the encrypted drive. If BitLocker has been suspended, the clear key that is used to encrypt the volume master key is also stored in the encrypted drive, along with the encrypted volume master key. + +This storage process ensures that the volume master key is never stored unencrypted and is protected unless you disable BitLocker. The keys are also saved to two additional locations on the drive for redundancy. The keys can be read and processed by the boot manager. + +## Why do I have to use the function keys to enter the PIN or the 48-character recovery password? + +The F1 through F10 keys are universally mapped scan codes available in the pre-boot environment on all computers and in all languages. The numeric keys 0 through 9 are not usable in the pre-boot environment on all keyboards. + +When using an enhanced PIN, users should run the optional system check during the BitLocker setup process to ensure that the PIN can be entered correctly in the pre-boot environment. + +## How does BitLocker help prevent an attacker from discovering the PIN that unlocks my operating system drive? + +It is possible that a personal identification number (PIN) can be discovered by an attacker performing a brute force attack. A brute force attack occurs when an attacker uses an automated tool to try different PIN combinations until the correct one is discovered. For BitLocker-protected computers, this type of attack, also known as a dictionary attack, requires that the attacker have physical access to the computer. + +The TPM has the built-in ability to detect and react to these types of attacks. Because different manufacturers' TPMs may support different PIN and attack mitigations, contact your TPM's manufacturer to determine how your computer's TPM mitigates PIN brute force attacks. +After you have determined your TPM's manufacturer, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset. + +## How can I determine the manufacturer of my TPM? + +You can determine your TPM manufacturer in **Windows Defender Security Center** > **Device Security** > **Security processor details**. + +## How can I evaluate a TPM's dictionary attack mitigation mechanism? + +The following questions can assist you when asking a TPM manufacturer about the design of a dictionary attack mitigation mechanism: + +- How many failed authorization attempts can occur before lockout? +- What is the algorithm for determining the duration of a lockout based on the number of failed attempts and any other relevant parameters? +- What actions can cause the failure count and lockout duration to be decreased or reset? + +## Can PIN length and complexity be managed with Group Policy? + +Yes and No. You can configure the minimum personal identification number (PIN) length by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** Group Policy setting. However, you cannot require PIN complexity by Group Policy. + +For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + From 4fa90e58fab297926d16c021c3d13313ab1f1d4c Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 3 Apr 2018 15:50:27 -0700 Subject: [PATCH 008/215] split FAQ --- .../bitlocker/bitlocker-and-adds-faq.md | 50 +++++++++++++++++++ ...r-device-encryption-overview-windows-10.md | 11 ++-- .../bitlocker-frequently-asked-questions.md | 36 ------------- .../bitlocker/bitlocker-to-go-faq.md | 25 ++++++++++ 4 files changed, 78 insertions(+), 44 deletions(-) create mode 100644 windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md create mode 100644 windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md new file mode 100644 index 0000000000..892b96b9d0 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md @@ -0,0 +1,50 @@ +--- +title: BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10) +description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.date: 04/03/2018 +--- + +# BitLocker and Active Directory Domain Services (AD DS) FAQ + +**Applies to** +- Windows 10 + + +## What if BitLocker is enabled on a computer before the computer has joined the domain? + +If BitLocker is enabled on a drive before Group Policy has been applied to enforce backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered** and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require that the computer be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. + +For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + +The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the C: drive to AD DS, you would use the following command from an elevated command prompt: **manage-bde -protectors -adbackup C:**. + +> [!IMPORTANT]   +> Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy). +  +## Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup? + +Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it is also possible that the log entry could be spoofed. + +Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool. + +## If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password? + +No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object. + +## What happens if the backup initially fails? Will BitLocker retry the backup? + +If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS. + +When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, **Choose how BitLocker-protected removable data drives can be recovered** policy settings, this prevents users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. + +For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + +When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored. + diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index bb2ff3ed96..13a5587141 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -31,14 +31,9 @@ Table 2 lists specific data-protection concerns and how they are addressed in Wi | When BitLocker is enabled, the provisioning process can take several hours. | BitLocker pre-provisioning, encrypting hard drives, and Used Space Only encryption allow administrators to enable BitLocker quickly on new computers. | | There is no support for using BitLocker with self-encrypting drives (SEDs). | BitLocker supports offloading encryption to encrypted hard drives. | | Administrators have to use separate tools to manage encrypted hard drives. | BitLocker supports encrypted hard drives with onboard encryption hardware built in, which allows administrators to use the familiar BitLocker administrative tools to manage them. | -| Encrypting a new flash drive can take more than 20 minutes. | Used Space Only encryption in BitLocker To Go allows users to encrypt drives in seconds. | +| Encrypting a new flash drive can take more than 20 minutes. | Used Space Only encryption in BitLocker To Go allows users to encrypt removable data drives in seconds. | | BitLocker could require users to enter a recovery key when system configuration changes occur. | BitLocker requires the user to enter a recovery key only when disk corruption occurs or when he or she loses the PIN or password. | -| Users need to enter a PIN to start the PC, and then their password to sign in to Windows. | Modern Windows devices are increasingly protected with BitLocker Device Encryption out of the box and support SSO to help protect the BitLocker encryption keys from cold boot attacks. | - -The sections that follow describe these improvements in more detail. Also see: - -- Additional description of improvements in BitLocker: see the [BitLocker](https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511#bitlocker) section in "What's new in Windows 10, versions 1507 and 1511." -- Introduction and requirements for BitLocker: see [BitLocker](bitlocker-overview.md). +| Users need to enter a PIN to start the PC, and then their password to sign in to Windows. | Modern Windows devices are increasingly protected with BitLocker Device Encryption out of the box and support SSO to help protect the BitLocker encryption keys from cold boot attacks. | ## Prepare for drive and file encryption @@ -81,7 +76,7 @@ Administrators can manage domain-joined devices that have BitLocker Device Encry ## Used Disk Space Only encryption -BitLocker in earlier Windows versions could take a long time to encrypt a drive, because it encrypted every byte on the volume (including parts that did not have data). That is still the most secure way to encrypt a drive, especially if a drive has previously contained confidential data that has since been moved or deleted, in which case traces of the confidential data could remain on portions of the drive marked as unused. +BitLocker in earlier Windows versions could take a long time to encrypt a drive, because it encrypted every byte on the volume (including parts that did not have data). That is still the most secure way to encrypt a drive, especially if a drive has previously contained confidential data that has since been moved or deleted. In that case, traces of the confidential data could remain on portions of the drive marked as unused. But why encrypt a new drive when you can simply encrypt the data as it is being written? To reduce encryption time, BitLocker in Windows 10 lets users choose to encrypt just their data. Depending on the amount of data on the drive, this option can reduce encryption time by more than 99 percent. Exercise caution when encrypting only used space on an existing volume on which confidential data may have already been stored in an unencrypted state, however, because those sectors can be recovered through disk-recovery tools until they are overwritten by new encrypted data. In contrast, encrypting only used space on a brand-new volume can significantly decrease deployment time without the security risk because all new data will be encrypted as it is written to the disk. diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 0f59f82df1..f67a251bc7 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -32,42 +32,6 @@ BitLocker is a data protection feature that encrypts the hard drives on your com -## BitLocker To Go - -BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. - -## Active Directory Domain Services (AD DS) - -### What if BitLocker is enabled on a computer before the computer has joined the domain? - -If BitLocker is enabled on a drive before Group Policy has been applied to enforce backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered** and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require that the computer be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. - -For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - -The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the C: drive to AD DS, you would use the following command from an elevated command prompt: **manage-bde -protectors -adbackup C:**. - ->**Important:**  Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy). -  -### Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup? - -Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it is also possible that the log entry could be spoofed. - -Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool. - -### If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password? - -No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object. - -### What happens if the backup initially fails? Will BitLocker retry the backup? - -If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS. - -When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, **Choose how BitLocker-protected removable data drives can be recovered** policy settings, this prevents users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. - -For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - -When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored. - ## Security ### What form of encryption does BitLocker use? Is it configurable? diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md new file mode 100644 index 0000000000..e640b3d3e0 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md @@ -0,0 +1,25 @@ +--- +title: BitLocker To Go FAQ (Windows 10) +description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.date: 04/03/2018 +--- + +# BitLocker To Go FAQ + +**Applies to** +- Windows 10 + +## What is BitLocker To Go? + +BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. + +## What is Used Disk Space Only encryption? + +BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to beencrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption). \ No newline at end of file From 40e10e077101b3f933b0311d97b9852b54ac0c39 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 3 Apr 2018 17:06:51 -0700 Subject: [PATCH 009/215] split FAQ --- .../bitlocker-frequently-asked-questions.md | 33 ---------------- .../bitlocker/bitlocker-network-unlock-faq.md | 30 +++++++++++++++ .../bitlocker/bitlocker-security-faq.md | 38 +++++++++++++++++++ 3 files changed, 68 insertions(+), 33 deletions(-) create mode 100644 windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md create mode 100644 windows/security/information-protection/bitlocker/bitlocker-security-faq.md diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index f67a251bc7..3f6b435e5d 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -32,39 +32,6 @@ BitLocker is a data protection feature that encrypts the hard drives on your com -## Security - -### What form of encryption does BitLocker use? Is it configurable? - -BitLocker uses Advanced Encryption Standard (AES) as its encryption algorithm with configurable key lengths of 128 or 256 bits. The default encryption setting is AES-128, but the options are configurable by using Group Policy. - -### What is the best practice for using BitLocker on an operating system drive? - -The recommended practice for BitLocker configuration on an operating system drive is to implement BitLocker on a computer with a TPM version 1.2 or higher and a Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware implementation, plus a PIN. By requiring a PIN that was set by the user in addition to the TPM validation, a malicious user that has physical access to the computer cannot simply start the computer. - -### What are the implications of using the sleep or hibernate power management options? - -BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires BitLocker authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. - -### What are the advantages of a TPM? - -Most operating systems use a shared memory space and rely on the operating system to manage physical memory. A TPM is a hardware component that uses its own internal firmware and logic circuits for processing instructions, thus shielding it from external software vulnerabilities. Attacking the TPM requires physical access to the computer. Additionally, the tools and skills necessary to attack hardware are often more expensive, and usually are not as available as the ones used to attack software. And because each TPM is unique to the computer that contains it, attacking multiple TPM computers would be difficult and time-consuming. - ->**Note:**  Configuring BitLocker with an additional factor of authentication provides even more protection against TPM hardware attacks. -  -## BitLocker Network Unlock - -BitLocker Network Unlock enables easier management for BitLocker-enabled desktops and servers that use the TPM+PIN protection method in a domain environment. When a computer that is connected to a wired corporate network is rebooted, Network Unlock allows the PIN entry prompt to be bypassed. It automatically unlocks BitLocker-protected operating system volumes by using a trusted key that is provided by the Windows Deployment Services server as its secondary authentication method. - -To use Network Unlock you must also have a PIN configured for your computer. When your computer is not connected to the network you will need to provide the PIN to unlock it. - -BitLocker Network Unlock has software and hardware requirements for both client computers, Windows Deployment services, and domain controllers that must be met before you can use it. - -Network Unlock uses two protectors, the TPM protector and the one provided by the network or by your PIN, whereas automatic unlock uses a single protector, the one stored in the TPM. If the computer is joined to a network without the key protector it will prompt you to enter your PIN. If the PIN is -not available you will need to use the recovery key to unlock the computer if it can ot be connected to the network. - -For more info, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). - ## Other questions ### Can I run a kernel debugger with BitLocker? diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md new file mode 100644 index 0000000000..d4169a8450 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md @@ -0,0 +1,30 @@ +--- +title: BitLocker frequently asked questions (FAQ) (Windows 10) +description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.date: 04/03/2018 +--- + +# BitLocker Network Unlock FAQ + +**Applies to** +- Windows 10 + +BitLocker Network Unlock enables easier management for BitLocker-enabled desktops and servers that use the TPM+PIN protection method in a domain environment. When a computer that is connected to a wired corporate network is rebooted, Network Unlock allows the PIN entry prompt to be bypassed. It automatically unlocks BitLocker-protected operating system volumes by using a trusted key that is provided by the Windows Deployment Services server as its secondary authentication method. + +To use Network Unlock you must also have a PIN configured for your computer. When your computer is not connected to the network you will need to provide the PIN to unlock it. + +BitLocker Network Unlock has software and hardware requirements for both client computers, Windows Deployment services, and domain controllers that must be met before you can use it. + +Network Unlock uses two protectors, the TPM protector and the one provided by the network or by your PIN, whereas automatic unlock uses a single protector, the one stored in the TPM. If the computer is joined to a network without the key protector it will prompt you to enter your PIN. If the PIN is +not available you will need to use the recovery key to unlock the computer if it can ot be connected to the network. + +For more info, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). + + diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md new file mode 100644 index 0000000000..122fcce059 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -0,0 +1,38 @@ +--- +title: BitLocker Security FAQ (Windows 10) +description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.date: 04/03/2018 +--- + +# BitLocker Security FAQ + +**Applies to** +- Windows 10 + + +## What form of encryption does BitLocker use? Is it configurable? + +BitLocker uses Advanced Encryption Standard (AES) as its encryption algorithm with configurable key lengths of 128 or 256 bits. The default encryption setting is AES-128, but the options are configurable by using Group Policy. + +## What is the best practice for using BitLocker on an operating system drive? + +The recommended practice for BitLocker configuration on an operating system drive is to implement BitLocker on a computer with a TPM version 1.2 or higher and a Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware implementation, plus a PIN. By requiring a PIN that was set by the user in addition to the TPM validation, a malicious user that has physical access to the computer cannot simply start the computer. + +## What are the implications of using the sleep or hibernate power management options? + +BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires BitLocker authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. + +## What are the advantages of a TPM? + +Most operating systems use a shared memory space and rely on the operating system to manage physical memory. A TPM is a hardware component that uses its own internal firmware and logic circuits for processing instructions, thus shielding it from external software vulnerabilities. Attacking the TPM requires physical access to the computer. Additionally, the tools and skills necessary to attack hardware are often more expensive, and usually are not as available as the ones used to attack software. And because each TPM is unique to the computer that contains it, attacking multiple TPM computers would be difficult and time-consuming. + +> [!NOTE]   +> Configuring BitLocker with an additional factor of authentication provides even more protection against TPM hardware attacks. +  From e71bfcb0845cc14b0259cd128c156d1ab068c958 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 4 Apr 2018 13:05:15 -0700 Subject: [PATCH 010/215] split FAQ --- .../bitlocker-frequently-asked-questions.md | 88 ++---------------- ...bitlocker-using-with-other-programs-faq.md | 91 +++++++++++++++++++ 2 files changed, 98 insertions(+), 81 deletions(-) create mode 100644 windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 3f6b435e5d..d3ba3c69d7 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -23,89 +23,15 @@ BitLocker is a data protection feature that encrypts the hard drives on your com - [Overview and requirements](bitlocker-overview-and-requirements-faq.md) - [Upgrading](bitlocker-upgrading-faq.md) - [Deployment and administration](bitlocker-deployment-and-administration-faq.md) -- [Key management](#bkmk-keymanagement) -- [BitLocker To Go](#bkmk-btgsect) -- [Active Directory Domain Services (AD DS)](#bkmk-adds) -- [Security](#bkmk-security) -- [BitLocker Network Unlock](#bkmk-bnusect) -- [Other questions](#bkmk-other) +- [Key management](bitlocker-key-management-faq.md) +- [BitLocker To Go](bitlocker-to-go-faq.md) +- [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md +- [Security](bitlocker-security-faq.md) +- [BitLocker Network Unlock](bitlocker-network-unlock-faq.md) +- [Using BitLocker with other programs](bitlocker-using-with-other-programs-faq.md) -## Other questions - -### Can I run a kernel debugger with BitLocker? - -Yes. However, the debugger should be turned on before enabling BitLocker. Turning on the debugger ensures that the correct measurements are calculated when sealing to the TPM, allowing the computer to start properly. If you need to turn debugging on or off when using BitLocker, be sure to suspend BitLocker first to avoid putting your computer into recovery mode. - -### How does BitLocker handle memory dumps? - -BitLocker has a storage driver stack that ensures memory dumps are encrypted when BitLocker is enabled. - -### Can BitLocker support smart cards for pre-boot authentication? - -BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them very difficult. - -### Can I use a non-Microsoft TPM driver? - -Microsoft does not support non-Microsoft TPM drivers and strongly recommends against using them with BitLocker. Attempting to use a non-Microsoft TPM driver with BitLocker may cause BitLocker to report that a TPM is not present on the computer and not allow the TPM to be used with BitLocker. - -### Can other tools that manage or modify the master boot record work with BitLocker? - -We do not recommend modifying the master boot record on computers whose operating system drives are BitLocker-protected for a number of security, reliability, and product support reasons. Changes to the master boot record (MBR) could change the security environment and prevent the computer from starting normally, as well as complicate any efforts to recover from a corrupted MBR. Changes made to the MBR by anything other than Windows might force the computer into recovery mode or prevent it from booting entirely. - -### Why is the system check failing when I am encrypting my operating system drive? - -The system check is designed to ensure your computer's BIOS or UEFI firmware is compatible with BitLocker and that the TPM is working correctly. The system check can fail for several reasons: - -- The computer's BIOS or UEFI firmware cannot read USB flash drives. -- The computer's BIOS, uEFI firmware, or boot menu does not have reading USB flash drives enabled. -- There are multiple USB flash drives inserted into the computer. -- The PIN was not entered correctly. -- The computer's BIOS or UEFI firmware only supports using the function keys (F1–F10) to enter numerals in the pre-boot environment. -- The startup key was removed before the computer finished rebooting. -- The TPM has malfunctioned and fails to unseal the keys. - -### What can I do if the recovery key on my USB flash drive cannot be read? - -Some computers cannot read USB flash drives in the pre-boot environment. First, check your BIOS or UEFI firmware and boot settings to ensure that the use of USB drives is enabled. If it is not enabled, enable the use of USB drives in the BIOS or UEFI firmware and boot settings and then try to read the recovery key from the USB flash drive again. If it still cannot be read, you will have to mount the hard drive as a data drive on another computer so that there is an operating system to attempt to read the recovery key from the USB flash drive. If the USB flash drive has been corrupted or damaged, you may need to supply a recovery password or use the recovery information that was backed up to AD DS. Also, if you are using the recovery key in the pre-boot environment, ensure that the drive is formatted by using the NTFS, FAT16, or FAT32 file system. - -### Why am I unable to save my recovery key to my USB flash drive? - -The **Save to USB** option is not shown by default for removable drives. If the option is unavailable, it means that a system administrator has disallowed the use of recovery keys. - -### Why am I unable to automatically unlock my drive? - -Automatic unlocking for fixed data drives requires that the operating system drive also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers. - -### Can I use BitLocker in Safe Mode? - -Limited BitLocker functionality is available in Safe Mode. BitLocker-protected drives can be unlocked and decrypted by using the **BitLocker Drive Encryption** Control Panel item. Right-clicking to access BitLocker options from Windows Explorer is not available in Safe Mode. - -### How do I "lock" a data drive? - -Both fixed and removable data drives can be locked by using the Manage-bde command-line tool and the –lock command. - ->**Note:**  Ensure all data is saved to the drive before locking it. Once locked, the drive will become inaccessible. -  -The syntax of this command is: - -`manage-bde -lock` - -Outside of using this command, data drives will be locked on shutdown and restart of the operating system. A removable data drive will also be locked automatically when the drive is removed from the computer. - -### Can I use BitLocker with the Volume Shadow Copy Service? - -Yes. However, shadow copies made prior to enabling BitLocker will be automatically deleted when BitLocker is enabled on software-encrypted drives. If you are using a hardware encrypted drive, the shadow copies are retained. - -### Does BitLocker support virtual hard disks (VHDs)? - -BitLocker is not supported on bootable VHDs, but BitLocker is supported on data volume VHDs, such as those used by clusters, if you are running Windows 10, Windows 8.1, Windows 8, Windows Server 2012, or Windows Server 2012 R2. - -### Can I use BitLocker with virtual machines (VMs)? - -Yes. Password protectors and virtual TPMs can be used with BitLocker to protect virtual machines. VMs can be domain joined, Azure AD-joined, or workplace-joined (in **Settings** under **Accounts** > **Access work or school** > **Connect to work or school** to receive policy. You can enable encryption either while creating the VM or by using other existing management tools such as the BitLocker CSP, or even by using a startup script or logon script delivered by Group Policy. Windows Server 2016 also supports [Shielded VMs and guarded fabric](https://docs.microsoft.com/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-and-shielded-vms-top-node) to protect VMs from malicious administrators. - ## More information @@ -116,4 +42,4 @@ Yes. Password protectors and virtual TPMs can be used with BitLocker to protect - [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) - [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md) - [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md) -- [BitLocker Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/6f49f904-e04d-4b90-afbc-84bc45d4d30d) +- [BitLocker Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/bitlocker/index?view=win10-ps) diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md new file mode 100644 index 0000000000..b1a964494e --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md @@ -0,0 +1,91 @@ +--- +title: Using BitLocker with other programs FAQ (Windows 10) +description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.date: 04/03/2018 +--- + +# Using BitLocker with other programs FAQ + +**Applies to** +- Windows 10 + +## Can I run a kernel debugger with BitLocker? + +Yes. However, the debugger should be turned on before enabling BitLocker. Turning on the debugger ensures that the correct measurements are calculated when sealing to the TPM, allowing the computer to start properly. If you need to turn debugging on or off when using BitLocker, be sure to suspend BitLocker first to avoid putting your computer into recovery mode. + +## How does BitLocker handle memory dumps? + +BitLocker has a storage driver stack that ensures memory dumps are encrypted when BitLocker is enabled. + +## Can BitLocker support smart cards for pre-boot authentication? + +BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them very difficult. + +## Can I use a non-Microsoft TPM driver? + +Microsoft does not support non-Microsoft TPM drivers and strongly recommends against using them with BitLocker. Attempting to use a non-Microsoft TPM driver with BitLocker may cause BitLocker to report that a TPM is not present on the computer and not allow the TPM to be used with BitLocker. + +## Can other tools that manage or modify the master boot record work with BitLocker? + +We do not recommend modifying the master boot record on computers whose operating system drives are BitLocker-protected for a number of security, reliability, and product support reasons. Changes to the master boot record (MBR) could change the security environment and prevent the computer from starting normally, as well as complicate any efforts to recover from a corrupted MBR. Changes made to the MBR by anything other than Windows might force the computer into recovery mode or prevent it from booting entirely. + +## Why is the system check failing when I am encrypting my operating system drive? + +The system check is designed to ensure your computer's BIOS or UEFI firmware is compatible with BitLocker and that the TPM is working correctly. The system check can fail for several reasons: + +- The computer's BIOS or UEFI firmware cannot read USB flash drives. +- The computer's BIOS, uEFI firmware, or boot menu does not have reading USB flash drives enabled. +- There are multiple USB flash drives inserted into the computer. +- The PIN was not entered correctly. +- The computer's BIOS or UEFI firmware only supports using the function keys (F1–F10) to enter numerals in the pre-boot environment. +- The startup key was removed before the computer finished rebooting. +- The TPM has malfunctioned and fails to unseal the keys. + +## What can I do if the recovery key on my USB flash drive cannot be read? + +Some computers cannot read USB flash drives in the pre-boot environment. First, check your BIOS or UEFI firmware and boot settings to ensure that the use of USB drives is enabled. If it is not enabled, enable the use of USB drives in the BIOS or UEFI firmware and boot settings and then try to read the recovery key from the USB flash drive again. If it still cannot be read, you will have to mount the hard drive as a data drive on another computer so that there is an operating system to attempt to read the recovery key from the USB flash drive. If the USB flash drive has been corrupted or damaged, you may need to supply a recovery password or use the recovery information that was backed up to AD DS. Also, if you are using the recovery key in the pre-boot environment, ensure that the drive is formatted by using the NTFS, FAT16, or FAT32 file system. + +## Why am I unable to save my recovery key to my USB flash drive? + +The **Save to USB** option is not shown by default for removable drives. If the option is unavailable, it means that a system administrator has disallowed the use of recovery keys. + +## Why am I unable to automatically unlock my drive? + +Automatic unlocking for fixed data drives requires that the operating system drive also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers. + +## Can I use BitLocker in Safe Mode? + +Limited BitLocker functionality is available in Safe Mode. BitLocker-protected drives can be unlocked and decrypted by using the **BitLocker Drive Encryption** Control Panel item. Right-clicking to access BitLocker options from Windows Explorer is not available in Safe Mode. + +## How do I "lock" a data drive? + +Both fixed and removable data drives can be locked by using the Manage-bde command-line tool and the –lock command. + +> [!NOTE]   +> Ensure all data is saved to the drive before locking it. Once locked, the drive will become inaccessible. +  +The syntax of this command is: + +manage-bde driveletter -lock + +Outside of using this command, data drives will be locked on shutdown and restart of the operating system. A removable data drive will also be locked automatically when the drive is removed from the computer. + +## Can I use BitLocker with the Volume Shadow Copy Service? + +Yes. However, shadow copies made prior to enabling BitLocker will be automatically deleted when BitLocker is enabled on software-encrypted drives. If you are using a hardware encrypted drive, the shadow copies are retained. + +## Does BitLocker support virtual hard disks (VHDs)? + +BitLocker is not supported on bootable VHDs, but BitLocker is supported on data volume VHDs, such as those used by clusters, if you are running Windows 10, Windows 8.1, Windows 8, Windows Server 2012, or Windows Server 2012 R2. + +## Can I use BitLocker with virtual machines (VMs)? + +Yes. Password protectors and virtual TPMs can be used with BitLocker to protect virtual machines. VMs can be domain joined, Azure AD-joined, or workplace-joined (in **Settings** under **Accounts** > **Access work or school** > **Connect to work or school** to receive policy. You can enable encryption either while creating the VM or by using other existing management tools such as the BitLocker CSP, or even by using a startup script or logon script delivered by Group Policy. Windows Server 2016 also supports [Shielded VMs and guarded fabric](https://docs.microsoft.com/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-and-shielded-vms-top-node) to protect VMs from malicious administrators. + From 6354344892800b1acd42b73df4e799cd7a7f809d Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 4 Apr 2018 13:07:57 -0700 Subject: [PATCH 011/215] split FAQ --- .../bitlocker/bitlocker-frequently-asked-questions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index d3ba3c69d7..52e757b6c5 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -25,7 +25,7 @@ BitLocker is a data protection feature that encrypts the hard drives on your com - [Deployment and administration](bitlocker-deployment-and-administration-faq.md) - [Key management](bitlocker-key-management-faq.md) - [BitLocker To Go](bitlocker-to-go-faq.md) -- [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md +- [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md) - [Security](bitlocker-security-faq.md) - [BitLocker Network Unlock](bitlocker-network-unlock-faq.md) - [Using BitLocker with other programs](bitlocker-using-with-other-programs-faq.md) From d11704c77ee7847d8038e0f1ee88318e4c1fbfce Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 4 Apr 2018 15:13:36 -0700 Subject: [PATCH 012/215] added toc entries --- windows/security/information-protection/TOC.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index ab9300961a..b42aabd44f 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -3,6 +3,15 @@ ## [BitLocker](bitlocker\bitlocker-overview.md) ### [Overview of BitLocker Device Encryption in Windows 10](bitlocker\bitlocker-device-encryption-overview-windows-10.md) ### [BitLocker frequently asked questions (FAQ)](bitlocker\bitlocker-frequently-asked-questions.md) +#### [Overview and requirements](bitlocker-overview-and-requirements-faq.md) +#### [Upgrading](bitlocker-upgrading-faq.md) +#### [Deployment and administration](bitlocker-deployment-and-administration-faq.md) +#### [Key management](bitlocker-key-management-faq.md) +#### [BitLocker To Go](bitlocker-to-go-faq.md) +#### [Active Directory Domain Services](bitlocker-and-adds-faq.md) +#### [Security](bitlocker-security-faq.md) +#### [BitLocker Network Unlock](bitlocker-network-unlock-faq.md) +#### [General](bitlocker-using-with-other-programs-faq.md) ### [Prepare your organization for BitLocker: Planning and policies](bitlocker\prepare-your-organization-for-bitlocker-planning-and-policies.md) ### [BitLocker basic deployment](bitlocker\bitlocker-basic-deployment.md) ### [BitLocker: How to deploy on Windows Server 2012 and later](bitlocker\bitlocker-how-to-deploy-on-windows-server.md) From 8df16f5562b35acce7ad64e9e6b1f2ffa745112d Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 4 Apr 2018 15:15:25 -0700 Subject: [PATCH 013/215] added toc entries --- .../bitlocker/bitlocker-frequently-asked-questions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 52e757b6c5..0ea875725d 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -28,7 +28,7 @@ BitLocker is a data protection feature that encrypts the hard drives on your com - [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md) - [Security](bitlocker-security-faq.md) - [BitLocker Network Unlock](bitlocker-network-unlock-faq.md) -- [Using BitLocker with other programs](bitlocker-using-with-other-programs-faq.md) +- [Using BitLocker with other programs and general questions](bitlocker-using-with-other-programs-faq.md) From ada598600b39dea40ddb76bbf0f7ce0f86732731 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 4 Apr 2018 17:05:03 -0700 Subject: [PATCH 014/215] fixed toc --- windows/security/information-protection/TOC.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index b42aabd44f..aa050873f5 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -3,15 +3,15 @@ ## [BitLocker](bitlocker\bitlocker-overview.md) ### [Overview of BitLocker Device Encryption in Windows 10](bitlocker\bitlocker-device-encryption-overview-windows-10.md) ### [BitLocker frequently asked questions (FAQ)](bitlocker\bitlocker-frequently-asked-questions.md) -#### [Overview and requirements](bitlocker-overview-and-requirements-faq.md) -#### [Upgrading](bitlocker-upgrading-faq.md) -#### [Deployment and administration](bitlocker-deployment-and-administration-faq.md) -#### [Key management](bitlocker-key-management-faq.md) -#### [BitLocker To Go](bitlocker-to-go-faq.md) -#### [Active Directory Domain Services](bitlocker-and-adds-faq.md) -#### [Security](bitlocker-security-faq.md) -#### [BitLocker Network Unlock](bitlocker-network-unlock-faq.md) -#### [General](bitlocker-using-with-other-programs-faq.md) +#### [Overview and requirements](bitlocker\bitlocker-overview-and-requirements-faq.md) +#### [Upgrading](bitlocker\bitlocker-upgrading-faq.md) +#### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.md) +#### [Key management](bitlocker\bitlocker-key-management-faq.md) +#### [BitLocker To Go](bitlocker\bitlocker-to-go-faq.md) +#### [Active Directory Domain Services](bitlocker\bitlocker-and-adds-faq.md) +#### [Security](bitlocker\bitlocker-security-faq.md) +#### [BitLocker Network Unlock](bitlocker\bitlocker-network-unlock-faq.md) +#### [General](bitlocker\bitlocker-using-with-other-programs-faq.md) ### [Prepare your organization for BitLocker: Planning and policies](bitlocker\prepare-your-organization-for-bitlocker-planning-and-policies.md) ### [BitLocker basic deployment](bitlocker\bitlocker-basic-deployment.md) ### [BitLocker: How to deploy on Windows Server 2012 and later](bitlocker\bitlocker-how-to-deploy-on-windows-server.md) From 88baa752432f91a55296f87c42f17f26e7f98ade Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 5 Apr 2018 09:04:33 -0700 Subject: [PATCH 015/215] revised parent topic --- .../bitlocker/bitlocker-frequently-asked-questions.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 0ea875725d..6e4da85685 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -16,9 +16,7 @@ ms.date: 04/03/2018 **Applies to** - Windows 10 -This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. - -BitLocker is a data protection feature that encrypts the hard drives on your computer to provide enhanced protection against data theft or exposure on computers and removable drives that are lost or stolen, and more secure data deletion when BitLocker-protected computers are decommissioned as it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive. +This topic links to frequently asked questions about BitLocker. BitLocker is a data protection feature that encrypts drives on your computer to help prevent data theft or exposure. BitLocker-protected computers can also delete data more securely when they are decommissioned because it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive. - [Overview and requirements](bitlocker-overview-and-requirements-faq.md) - [Upgrading](bitlocker-upgrading-faq.md) @@ -31,8 +29,6 @@ BitLocker is a data protection feature that encrypts the hard drives on your com - [Using BitLocker with other programs and general questions](bitlocker-using-with-other-programs-faq.md) - - ## More information - [Prepare your organization for BitLocker: Planning and Policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) From 36cc0fcb2e431fe619562a7b5168ff4d00c07f26 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 5 Apr 2018 09:20:33 -0700 Subject: [PATCH 016/215] added how to check TPM in RS4 --- .../bitlocker/bitlocker-overview-and-requirements-faq.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md index 71e1fdb876..3461111acd 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md @@ -11,7 +11,7 @@ author: brianlic-msft ms.date: 04/03/2018 --- -# BitLocker overview and requirements FAQ +# BitLocker Overview and Requirements FAQ **Applies to** - Windows 10 @@ -47,7 +47,7 @@ BitLocker supports TPM version 1.2 or higher. ## How can I tell if a TPM is on my computer? -Open the TPM MMC console (tpm.msc) and look under the **Status** heading. +Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading. ## Can I use BitLocker on an operating system drive without a TPM? From 3e8714c2fd85ca5b50e3f25b086557ac59d4e90c Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 5 Apr 2018 14:54:57 -0700 Subject: [PATCH 017/215] added italic --- .../bitlocker/bitlocker-key-management-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md index a46414f9a7..6766506328 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md @@ -30,7 +30,7 @@ A domain administrator can additionally configure Group Policy to automatically ## Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled? -You can use the Manage-bde.exe command-line tool to replace your TPM-only authentication mode with a multifactor authentication mode. For example, if BitLocker is enabled with TPM authentication only and you want to add PIN authentication, use the following commands from an elevated command prompt, replacing *<4-20 digit numeric PIN>* with the numeric PIN you want to use: +You can use the Manage-bde.exe command-line tool to replace your TPM-only authentication mode with a multifactor authentication mode. For example, if BitLocker is enabled with TPM authentication only and you want to add PIN authentication, use the following commands from an elevated command prompt, replacing *4-20 digit numeric PIN* with the numeric PIN you want to use: manage-bde –protectors –delete %systemdrive% -type tpm From fcd9a0eb6fb9da32a1eb1da6fa0d29287129ea56 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Mon, 9 Apr 2018 10:16:07 -0700 Subject: [PATCH 018/215] copyedits --- .../bitlocker/bitlocker-using-with-other-programs-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md index b1a964494e..ca6c64ca9c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md @@ -87,5 +87,5 @@ BitLocker is not supported on bootable VHDs, but BitLocker is supported on data ## Can I use BitLocker with virtual machines (VMs)? -Yes. Password protectors and virtual TPMs can be used with BitLocker to protect virtual machines. VMs can be domain joined, Azure AD-joined, or workplace-joined (in **Settings** under **Accounts** > **Access work or school** > **Connect to work or school** to receive policy. You can enable encryption either while creating the VM or by using other existing management tools such as the BitLocker CSP, or even by using a startup script or logon script delivered by Group Policy. Windows Server 2016 also supports [Shielded VMs and guarded fabric](https://docs.microsoft.com/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-and-shielded-vms-top-node) to protect VMs from malicious administrators. +Yes. Password protectors and virtual TPMs can be used with BitLocker to protect virtual machines. VMs can be domain joined, Azure AD-joined, or workplace-joined (in **Settings** under **Accounts** > **Access work or school** > **Connect** to receive policy. You can enable encryption either while creating the VM or by using other existing management tools such as the BitLocker CSP, or even by using a startup script or logon script delivered by Group Policy. Windows Server 2016 also supports [Shielded VMs and guarded fabric](https://docs.microsoft.com/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-and-shielded-vms-top-node) to protect VMs from malicious administrators. From bf178978bfc1d8ed0c8fe63e331b164e320a394d Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Mon, 9 Apr 2018 13:43:56 -0700 Subject: [PATCH 019/215] added why PCR7 binding is not possible --- .../bitlocker/bitlocker-deployment-and-administration-faq.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md index 9d12f4246d..2e97a6555d 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md @@ -69,6 +69,10 @@ For example: In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password. The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed. +## What can prevent BitLocker from binding to PCR[7]? + +This happens if if a non-Windows OS booted prior to Windows or Secure Boot is not available to the device, either because it has been disabled or the hardware does not suppoprt it. + ## Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive? Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive, so if you want to prepare a backup operating system or data drive for use in case of disk failure, you need to make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts. From 76b6dacf8b38f266d1e7dddb4e6e4764d09c82ef Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Mon, 9 Apr 2018 17:17:36 -0700 Subject: [PATCH 020/215] added edits per Derek --- .../bitlocker-deployment-and-administration-faq.md | 8 ++++++-- .../bitlocker/bitlocker-to-go-faq.md | 3 --- .../bitlocker/bitlocker-using-with-other-programs-faq.md | 4 ++++ 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md index 2e97a6555d..0ab9b33596 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md @@ -47,6 +47,10 @@ No, BitLocker does not encrypt and decrypt the entire drive when reading and wri You can can Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only. +## What is Used Disk Space Only encryption? + +BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to beencrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption). + ## What system changes would cause the integrity check on my operating system drive to fail? The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive: @@ -69,9 +73,9 @@ For example: In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password. The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed. -## What can prevent BitLocker from binding to PCR[7]? +## What can prevent BitLocker from binding to PCR 7? -This happens if if a non-Windows OS booted prior to Windows or Secure Boot is not available to the device, either because it has been disabled or the hardware does not suppoprt it. +This happens if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it. ## Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive? diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md index e640b3d3e0..45b5bba76d 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md @@ -20,6 +20,3 @@ ms.date: 04/03/2018 BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. -## What is Used Disk Space Only encryption? - -BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to beencrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption). \ No newline at end of file diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md index ca6c64ca9c..d95246d56d 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md @@ -16,6 +16,10 @@ ms.date: 04/03/2018 **Applies to** - Windows 10 +## Can I use EFS with BitLocker? + +Yes, you can use Encrypting File System (EFS) to encrypt files on a BitLocker-protected drive. BitLocker helps protect the entire operating system drive against offline attacks, whereas EFS can provide additional user-based file level encryption for security separation between multiple users of the same computer. You can also use EFS in Windows to encrypt files on other drives that are not encrypted by BitLocker. The root secrets of EFS are stored by default on the operating system drive; therefore, if BitLocker is enabled for the operating system drive, data that is encrypted by EFS on other drives is also indirectly protected by BitLocker. + ## Can I run a kernel debugger with BitLocker? Yes. However, the debugger should be turned on before enabling BitLocker. Turning on the debugger ensures that the correct measurements are calculated when sealing to the TPM, allowing the computer to start properly. If you need to turn debugging on or off when using BitLocker, be sure to suspend BitLocker first to avoid putting your computer into recovery mode. From a71cef22bb131236180df1afd2c1595ebed4d1f6 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Mon, 9 Apr 2018 18:08:19 -0700 Subject: [PATCH 021/215] added FAQs to adds --- .../bitlocker/bitlocker-and-adds-faq.md | 8 ++++++++ .../bitlocker/bitlocker-key-management-faq.md | 6 ++++++ 2 files changed, 14 insertions(+) diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md index 892b96b9d0..cf6854a98b 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md @@ -17,6 +17,14 @@ ms.date: 04/03/2018 - Windows 10 +## What type of information is stored in AD DS? + +Stored information | Description +-------------------|------------ +Hash of the TPM owner password | Beginning with Windows 10, the password hash is not stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in. +BitLocker recovery password | The recovery password allows you to unlock and access the drive in the event of a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md). +BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, Repair-bde. + ## What if BitLocker is enabled on a computer before the computer has joined the domain? If BitLocker is enabled on a drive before Group Policy has been applied to enforce backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered** and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require that the computer be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md index 6766506328..a7daabfc34 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md @@ -16,6 +16,12 @@ ms.date: 04/03/2018 **Applies to** - Windows 10 +## How can I authenticate or unlock my removable data drive? + +You can unlock removable data drives by using a password, a smart card, or you can configure a SID protector to unlock a drive by using your domain credentials. After you've started encryption, the drive can also be automatically unlocked on a specific computer for a specific user account. System administrators can configure which options are available for users, as well as password complexity and minimum length requirements. To unlock by using a SID protector, use Manage-bde: + +Manage-bde -protectors -add e: -sid domain\username + ## What is the difference between a recovery password, recovery key, PIN, enhanced PIN, and startup key? For tables that list and describe elements such as a recovery password, recovery key, and PIN, see [BitLocker key protectors](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-key-protectors) and [BitLocker authentication methods](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-authentication-methods). From cf0f39ed2220ef53e55d574591c7b9e19b441e45 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 11 Apr 2018 14:29:27 -0700 Subject: [PATCH 022/215] added image --- .../create-and-verify-an-efs-dra-certificate.md | 13 ++++++------- .../images/robocopy-s-mode.png | Bin 0 -> 13301 bytes 2 files changed, 6 insertions(+), 7 deletions(-) create mode 100644 windows/security/information-protection/windows-information-protection/images/robocopy-s-mode.png diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index d7631db8b9..4e8e4aeaea 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -79,21 +79,20 @@ It's possible that you might revoke data from an unenrolled device only to later >[!IMPORTANT] >To maintain control over your enterprise data, and to be able to revoke again in the future, you must only perform this process after the employee has re-enrolled the device. -1. Have the employee sign in to the unenrolled device, open a command prompt, and type: +1. Have the employee sign in to the unenrolled device, open an elevated command prompt, and type: - Robocopy "%localappdata%\Microsoft\EDP\Recovery" "new_location" /EFSRAW + Robocopy "%localappdata%\Microsoft\EDP\Recovery" "new_location" * /EFSRAW - To start Robocopy in S mode, press the Windows key + R. + Where "*new_location*" is in a different directory. This can be on the employee’s device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent. + + To start Robocopy in S mode, open **Task Manager**. Click **File** > **Run new task** and type the command. - -or- + ![Robocopy in S mode](images\robocopy-s-mode.png) If the employee performed a clean installation and there is no user profile, you need to recover the keys from the System Volume folder in each drive. Type: Robocopy "drive_letter:\System Volume Information\EDP\Recovery\" "new_location" * /EFSRAW - Where "*new_location*" is in a different directory. This can be on the employee’s device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent. - - 2. Sign in to a different device with administrator credentials that have access to your organization's DRA certificate, and perform the file decryption and recovery by typing: cipher.exe /D "new_location" diff --git a/windows/security/information-protection/windows-information-protection/images/robocopy-s-mode.png b/windows/security/information-protection/windows-information-protection/images/robocopy-s-mode.png new file mode 100644 index 0000000000000000000000000000000000000000..3b81bebd76bf6e906ce24b3e4f19b1d6ae5a2520 GIT binary patch literal 13301 zcmch;Rd5_Zuq`NABW4B*M$9aWnVFdxEwGrGnVFf%0*jg1k}PJ)VrG8hd-v_$z46}u z?8Zh+S5MbeRd;1~pOcw&CPGnO0uc@m4h#$oQA$!&84L`(2DCxLd;!%Y{){~W?ZBOs zC4|9hr}2+L2LKBpIUz8xhB){)BS_FOtb?SM6BroMz`qTA#J=1V42(5WN>oVIUH?1> z-ca>E=W<4t;u1`16asLN;t#tWNGurIf}zw3`yE?n>fEz+w|%YtT#x*hjD1H`6Ko{QLLsbWoR3PKkE;LJerzX&)`$zjQKRsg;xx z#7!h6VV;T7@rm5Z8mM`A!k$5=jdltx3Ob~j{#-P8$DFC+^lEwgJEdc@^Z_}ea)N}7 zU%6u??)}#!jv;mr*EV0#qq7CO#(rAFqsrn3M9KZxntcuyuSPTwrqEDyD@*EAYi#EP zD>tEj&6fSELe!*oj)aFL5~^S#UW5A3NNZ}I?E$XzM#g;QH0abv!$C;;-QLfm38WS? zxy|sdr8#veTb|A;b_Bl5x?T!oW{>-7q_Xh zsd_sqdWnu+DaHr{`cC|*(b4J`;a$dF!fAgD8a?yWyblctdH-uab%lIJEI!~AM;8cr zQ$@bCbFZOb)>r6mXy~8f7}u#;TR^L;xiri-C>wd}n=cp!VB*PzE1t~cD=Te@rO>Hc zfN?UH=B}vCo^@b7EPh(}U_25ot z9ko!;I>v2Q4q4Kr%pU$i~fMQ9{9t3P6AgVj#fS>+I|tVcDx7x4SMP>n7=U zP8YKgh98Y7=g}UV$|haVt>Dqw93P4*s?|l$u?yx}h}o4+K?Php@gC&^j<)ZP=PCZ= zWGHG7s_0BCr^`Mt($)>IMAK|ZfK||*qKhDU9z^RQ`cBhQ(M$;SM|9z zUR-Z;%J|7+C`UWn{C6jn6D#VP+`3OE)@EI+iYQCvRy|-oQ0vP{MBZK##h-Frbi`Ir zeWr?2xbt2;P|qin!9k)u0J;h$5P(D2E%AQQaXCCRw9)P&^Ne`%@$mtA^nE{`u_GcP zY?f-}BqhO$%zyM0-=Fc=x2}Kk=|Yi8`lF-u_b}}VLB|pDd0woybzFA8W^KJu{A6Qe z)9vycvTk;EacOOBb#r@6pZc4ejM4H9Y@z;QZ_9Tf^ZBS1duI^^0Q+5*0$t|Uyionw z>U|WC8(vZ(8i$>CC@wP52aG;3S#@0%M5IF7uj%}C{67I^ntqB$|SjqsM(y(P3QveXuJqi8pJ36vVb(j?@ zag?%3b?|fZYDW3vg>G8)J z1^kncr0cAE(c^#9?F6fWo{rI9ff2w?`5f*Pon<00j2QA{;lBVCKH89yofPtH!yzl5 zf3ty+g0`4U@1s9M26Kd}OAMw)N1*V?_s5C~>0*KJ<-?FvBL+b;eIk|=+^Bwuj;YlV zkahq~x;J2q=*j}}DV!7ZN@cChlr#jlAX$Gw%J&aSj^-n{*SRo*1ex{?6$>X3@Cs3X zKu?x_qSXC1P|9~u_+vcpbC1=^;N$yiMibHZr?Nu31tCylyfkhY!A$b+EsP&mXV5C_ zpL-BeH-$KXeW1td!0$+mKon)LF2PxGulr3F03H?%14AN606NPTaJLysaB=|s{)1b60N{K zc4pu}4XDva-0LYB+l$F6r8ZEEG4EILjPWI2{kO;E*aa7&U+dRGE{B`&1YXlE=iD0) z^NB6CBWr%ztJk;lIX(Pq&ufhB{FSFWL!hz6L;DP=7#R<7Aq|teNs1y`kRtnAx3AA< z_~QrZlf8QG>%LAVZ5(g=4{dH*^lX^fUNkJUx;-G?tP%-{>`)h+p{8|Jb20%cbrK6ghXPH+w6wJTMAmUi5u5hGWV!3ZyIq5D zj7UK#yHS1_U^HuNb8&Rss%btVVYZ2G51+NLj_uJ+eK&7IEK!TY-+}8{%1_2jQ9WYZ zL#ch52tU`mFix-P9cKt@VhboXQ-O>Ig7BfdOHm-%Z!s8$Gr zdV<}9Y|`|sDFcfB{WhtHv32$Pl#eWH#`zy#Ho#-7`@c7gwhwnEF(jQ zvA4n3c{J=Y@=1l5oN-j+T73sXtG#IV}nuD%w=Ua$>`*m$8~E`#hRVO%}lM4!{uWAQL3qpZu8Y$ zRCQno@wDUUlRSN4fKIO!YOrG`TC=d}tT*Q-U{1nu%j%UKl@dK5h$OGfG>1CIA{3l9N5VH|TCYPY`*2qr{*6^Q z_t(;0&};vPht}Zdv*+DqH}lT9gt37(-*J?Yw?q4G7U@tU)3|0iLwk}e?4AJDPj4Z5YV zH`)13f)7+7n*stj1mPW3y`M4Mx;`PcT5S=~Ad z>voZOm~%v^1tmd19Gx3DM+}R}O1E>z#G&LictFc4Mnxr^QI(aWXF>)>`TIuEjzWmT zdlWE;noO_3-m9d;a#qYw5J3pr$`m%;$v{A#j1xKnCJ+JnJ_I#Knd)@gOgcrfSyE08 z(F@Yr#^&_oq*k}Bf5OrTC3x}}HFfjDG>M5%H67PnA*Q}eV)Y`b(R@%dO`+b~YZ=gin7T%e+qai-NM6EVwOZ#z;e$(X zL_d;Xa^0736f8w4XTiC`c7a`&q=h#~9rkg^f|B)q)qzMo-ZgI1$ygfakE7S0HL z#)jB$WYxO)w-_)W2Qe8e${GDnKtMouclV-KjNQcm+{ZR-9dDhOq-3}Z2+{%9d?;!4 z!H-KrU<-s;SXdWW7$7njhUK3F?N9{1xS$Bd8$$m_IZ}i~I35=h6BQ*RDVfes8J%OQee4%w-}{O0nb8&%MMI6HnCk2|dB2Dv&P zMwrsosaFzb=(IzbbMGJ4VA)Nr?@{)4cux3*sT^^LmtZ?O z25Hmk*T$b!&yE6+*V$U+l;2R%_2DX_rY3jr%&3sZt)%SObobPdRFap&t@Sd5ZJ_&0 z(c|`SOzCjx$A@p!P=D^v?>|?zQ#3f7LD+W4wib00Tuq=xrk0r3--<}&_r`=_KT17H zdo%qsk|~HcA&HaoK6_ddeJ}!=%q(!Z$b>>RhnbYuJdl`7lqr*r-OJw3UPi}lAm{Ig z@0!2Z(K+_ZOHEFWUQ7&qbF&76Ubk~;=b7m7byCTQfWWJVh6W}6lZVS__^7nZ0re+k z{BU42p-FyFJ(Zn}&G99Xq;z^GnaOqHLnZPAF#Jk(NBy4tdSwC zYcnbh#O-VqV6vUGT6&dpDx{?j&$FZ64K!_72ahxCcV!>$Ohr56wSE4HA?iw3a(r%J zD#4M}+v9QqIQf6i7-mM>WnH%x(uTBv@bSrID0L|(&ai*k(A;@ z%8fUYja9lDsPB-wgpgtu+f^19hVM%yo=~`VWe&^^{cMsP_4CX@ihg-u&~k~> zSvllBhGG)!V58zshYK`(NWSE$-5Ti+Fno#(jwz+&Me~E&lCu6gHX-(d8k4=m&^@>q zS8`P+;h0X!%o=|seEf#F7>ouCriFy|k$1yyuOgAR;XYuF|e3F=|Us>IlC{-_^vE0y!4KzfL!Vh&^tX8g-y)P zh9?3hR6qX-_DUqbRljN*&y0siEM7!Ch=YfQhJ}X*{@LG8GBD6DM=@dO7d|(;wKYGt zNq~nZu5*R8lI51Y*7CF6^RUGU&kNwOCAthA)0lOx_<}2~rOCMuvycac?};n*NaeYv zHa#|q^H;KKI=pQ9FnWy;smNr{l8%3=4}C-)vrEJG=>3K@FR$DAc(>VR3F_t5Hqa0* z4{`J(IJWOMoZRgA1}Il!%Dj!h}t6^%N#t zt34wI28*WluROxnBjOxBFE;%DI7Y-To*m$1u}F|sg?=h>n!KJYq70#xD+TBEi>>&6^7^YTDY z#3wiW(H`08S$7TMRZ6+cLHLfpX>)pMX~dq(z2oEU&VzSNk-%Abp`b%E~;43)jQIeVii^Kfh0CBEnpLdXF2?J#1`y zzK3%OO>}*LYnIPxF_6G-dxhyukTGIXK)T z8h;$L909BoKNXC?r-QxhxnPf3zJ0GXfu-$vqqfnH@Aj7j0BWcb`WmYUIF7~UJEm(0 zYKjxfp9a6?pU3BDRWoX^3WtK&2+#7^U1+MdvU*vBx`hLuf_Klep3vMydyRj8h3D>y zc68e8SLon_0^R!o69g$GH@7Wzt^SvqAoi$5G*rSr%j!otvk_d`6c4 z)#LmQcYffIuG_t)t+I`F(liqT_aS9r@Rnmurt+&vk!)7CtAcKE#jfj8)kvKJ0`gQF zhu!lAGh$5+HVtF(WcnY6SL2)Hrn@_~O(;-mVm1JRRpyD8kPQbBbqAe8?N{7E|p~+I5moE5FA*;#AY9(d;Nak8L{l~Ro&DhQ+3xPm zt9pkHptDv;8j;@H%$6>S9USo?{P~wobH?l!WaQ%9ww075esU*sZ*SG*kkAW*oL}!j zYF4S>w5rQ%YeWPD162|z09@SeC83TVy~Y8CvxYwrkr0Fnw~Tpy?7Hjeo%f#82AxmU z|As;ZNPNW+mZLk@AIms7om`@`G z);(PW?5VfJWY;-8)}TX9r@W%HX($(&{BDQOXY93ffyR~dt_@Pp@-eKR`Lb%xsy${U zemZrU<9BO%QT!|X=LkR7)vEp0>%EM{mRHyDdc=p$Hy^qCKOg#3UoI4jXK4H%`UIkK zPKpTh0YQe%nuw^VsGZ=VVl8**LjE8A5q`HBe@7Qrliw15xVu$0oTsd}mp<*vb$!9j zI|UwT`q}4=8Tz|iZyWj<7NL!s80_)(Ri5 z@}Uidi>Ck7jm*M-?ZYd1$!5|j6mJn89VsO(JwB3q8OzY;eMiQ3A&wRuPu!4~c zX0$!;4B_RkZdYt~$Q2o7O&(WE0t*>3lEhTzFkU3ATqA*t`l`CI4av7f9MfI_Jz-Qc zQ1t?(*qD&!I0rqVqk&2p#;s|j@qW0WRGOgF|9G80^~au|bKZHx5=Hs2R5r_XsUnH; z^Jzrj;o+fL_j&QEewNxz&fqq!EsB*WIzpzR;*{pS>1`L=Opm^KtlVMIc!Y+omH7B65B!2?r^W4Y`03$+Zm*^dBA2FW-9?#o?d$O8@n^aoLP$ur*i6kC!qxALyju+i+Y-$C3)dJ`rJIyUkzxl;7w{ zN%u^T$MW9xDJ=v(y)QaF3Q$pFBpgTbf$5MM!9^?Q%Kw zZu=w*y1O1{8;VMnP8lT9JwMO7GvfGK9&)`dA|m8LD>Hk|aWL22f+sp)eeI2c4Pj`| zN&=(Z=N}A0%FX-i03S904+&z)$AK^;=wv=sFI8+9E$?)@ zwflXvd9`x<*5Ko~>v4X5-oSk)T&Jvr6U&P=tS zmywc_lasQtv%9#wwD=Z{f!zugh|D618iCtnuLh7NC7dKaEA%5!+_IIL=?Zn;42Y!j zR^#wd7Tz~knWp&B2Kxb-#eSU>lsj9k>xEWc$=AofAJ5-v&!ZQv!YG(4f{QH1o4!0V9@>e@Q4#(0gfi77Y6A>guY#o@sXEO49KKc{e;g zJv})&nOr7y-DOEHCnpC*Qh0xPe%|T*#RX+5AOKu_AY5tVOL(2^SWd}Nzxu7Zn5o*{ z!yhT&7kM|G-`1m68cSZ#GzxBwBt*S*L&7oD5G9Zqly_T7k-pP1&tci++5tF^oHGT{ z6C~}k7f{twVUA&JkG;BFdXzu<)rgw>HwJgi?J~{yE@Z;(ub(fY_#BUB3o2B~0&DyD z!TLcwZp((ZwzgIvCKLxGYdW|>L4R8pUY$vh@tvIosa3RLuL<#&gFX< zA9{K73z992e3+l`?PaM4$rzi6hzJ`S8x<9t&tw-q%a}SpG~cHlE|=M4IP;rLukCm; zbrPk*gBxlvGR!6x^;N(SB4jx`6D3n%Ffv7S;;emkwy``fkoV@s{lPF;Q zrC&MhsEF)b1F1Gz&_KP1q47G1Vp#p>x z-e*03W-ynAQhKHZ5}zjB^!fibyEKSONkuFgpI;n9nFW_HhXbo)$Iv*bJ%%*Y9VkJ` z7DnQlD87^Jk)_gavNJ0;kMJNO1m)k0#!#k_&1)LB! z^V5eJ-)6E89m1?+^ZX~!WZM2o^G4w$H zwut~*u8o;~MRx2Zp$7W;f$~PZz-5=&tGy`Ds(g5lk>9a?E*@@q5O&wM6i`N&LjUb* z_fiV9iojX^FK@;3e=pI7z9O)EjcikcztU}}%Cr~`+(j&YKhdLg=O8{*l9Y0spKfgR+ za;)x~7yn1F%hh9H?gV+8M75b~(4R#8HEu1=UUr9zNU@W+3|KcR|21K_WJ95QZ{>Wq zgF-73Yrl-G#xmk|;(u$|KR06}Fbz%(@271YBbA2 zX^JA(4vxguR9YO1LcbznMW$e)QMRES0;#E2~ z5?gt7rVonSv>Sv6wyX?NW;aDZ#4)4-#}?Dwf1LH3kB?7JPmcfuFSfQdH8mi3ZnfX) z_I>x1lbd?JJuLg)0p^Oe*H&aLkt(PT1=pJ_HZV}gOKc;7%88O5AsES|DRj~jMAYB* zwK)PZH0Y`bo|haVC2~}cLOeHUfW_d4qC%=OTP5#7a`**YABC$(!kwg2u8CJu(|Tkq zp)?gdcN^zIMdesYLbLq$b*h5uSu6DI{-eHOnLZ+qh4tRf;$TlS!z5E;t3!_@S~JV% z(R-c}scB+}`5_}0PVRZUW2lvjSrd)sF+Nq*(VXV6GhRS_L`t}ni&`;|!|Dk+0OUvY ze4O_99_F~Y=YG**>ZizE`nWrtRJ|T7we9~pn?nPGmX|+qu!~sn zh7jK+xjd{fTav|4U6k6XyfvJ7w-KBp$o-;jP>XW&r$Gc;FH-d;H_NSCeuhp;TyEwB zB81#SC%G*DPJ=4%nR*jiDEeV%K4TY=v9t#%08PMf0@^~*0vVh$5giz;RL~%`=p;wl zWcRlS$bOTyTT0)1uYR6jUZ=BNk3bQhLW-Ck*?P$6Ku9Czga%+v{+->r;Orz6OS0f{ z-_qXOmRHy)Sq7bx@MnpwoDE0$78^tAko}vD(`Jl^P`b=-t{ksYPfAq{F_c4VO`e*; z!3cB%pZi6(Eg!eb&92EWu%m&f?95SdS6xWbg_NXHCVyf%jv~3pKihauG<=Tn%X2v= zjOVHezKf4N$2z5LBhGBvrlqdxQ=09az6BLQHyXHORtSGQliP6p_^}7>I0yD%yEqg~ z3|^IsA3!)NrMm5(B?p+QaNrTRpmknD$0mi8icjmq*W`i=fsQ=RbPvyyO^dgodsqs& zug~Mg|9)4vsGxx|rOlLf37#2Q!DU^xp^2K^hNgqa<|fRchUin~B1#=nL=os8=fY%W zYnSS*TBv%-NTvzcbDR9tAs~8Z{g1{wG?u?Cm^2@1?ssR9^X=K9@>W%c}!A|-P#vj zI~NY+np3E|_sKCguDBB^#oZfvQezl6xmwX*4?jZG1-=Dfq7C{I^225}bDa;zz7}lq zsjR~eNown*kczBZeTy%4SP-2B&&wtPjIKaPtxAgX{w$N6C__y_La3L7VyT#4bUz*DaNu?8v5mYujov|XKbg8 zxSFNPx5PGnp6+(xtXFU(7HRbzvX{n86j_Y+#l6vQrn;%Xf(wCcH+C%7SEf0^k!tn2DbxD#xdAYecLwnuvAIM;rnRfZc z%Pb$(4;;i{!%m_0a4sL5)}vRKc+Q`G$^V}96b;|E$}zqCJ5{OPZj~jIeNO$n4nV28 z(alePIDYQChM-gEbeE=eH#Atp`E+m1+cRDGXq!jUf|fzrM8lfe#~sv|y|gUB`rBAl z3$qLTbS=-b@LIp=u>-Af;p;kW&;Rw=M>C28r=>(KMou^E(MSwMzzlyq?0(`ea_Nv6 z`StoJOyUqdNdAyhaJ+3{p>xO(n>FnOawP(K6`ijhVzzQ(b-NtGvH#KOFoy`IfTq{> zS?h!As%?<#sXx69EPox6P&~5{LY~Ib{cDW{zh<_2JqsCFu0|M$_3uu}TC)T?QSWDc zeu0*!K;B4I&YN=HSzz z@eU@yzDpv=7rjc>86O{ahZ92aGsjtq3KE9qv(6?Y0xdHI?tIiD&G~J?BTLqKUm|ya>D87`whvjrvugzR8w2CfX!KfRAf>DOr!7iV9zPAy(Nj{EYHCVUu&z!F_rqi8oGi3Eh{xJnYY2?vVI~D(zye;6}V z_l-B&Cow5$P?_%Dwn~Y+awvqD2a-Z#d{XSiZ;FGMv-_u?P0LVHjb96*Kt%aEeKd|o zrki5ydcy{HI8LT;L@a27K`CM_EM4E!-fEp})`o7SZ=_0z*^M-0mNl>bbUNFu8d-7> z9lpQ4f2^C8uKLTWGsqai)R0ar+7Wzau@aq(8f)(W|8Qy!5yALC2&wZcLNv5Q=mhj4 zO`fkz5R9PbCN2J|R<0@j+})D6w>XnWHnoRkX7v2Li{8!xVvTah>DX;?PF^ZhZd2c` z4`!Rrs0eeF)c3OwRI^$yc+PtOh0v|h2vQ1FZbnrt3h#kM7m}6Zpfxy$eG*_{Chz9& z2W$`8YMhsAF1Jgw^#Y>Rbk?fe;RUK}K2j{$%asTLvVkhTw~&&d((VOyuYb`e6Yy{W zDq?)oa*;rzd~4uc3XILOr+g?ysXz6Kbc6(~&5E z%b8$^1K(@7aJ%u=!}yLsz4``vI^cdFwktAh41B#u4sMY0;l#VY?(bgiH-}pFn0DeR z52rbzAq2}D4+IuPXbJHLI~Z&l$L&#REyn5}n?HYo^4Sf}Fk-q$eOd&%do$B!8?r{1)Y&$-6aDm#n zeJN#n^+*;T2M+1U+-0rW4Fz-Rc{B89Cr1+&Yum6F{S4WkJG_Tc+9G5h}4f7&RbnMm{2 zH5qAXK|oScQX0KZC<#a}?7yS6fB+?;tBW7L4a#OH0sdW}^YJQZ8dK)1k)R2JN9bE6 z*-iR`pwZAUJnX+ojQ^|L`2YDkYvJLq+e8qK`$~TQPA6l?``^{d|FwIO2K2cr&wn?n zw>J;SBHXX#e8{`UjvxzF*{&HyiFb+vw1W|`{t{;v%D9LdK62?BgCMd*#AZ4mvqQ#?`8 z(mK@zadPpp>MBBypvpqm`3gju1x4caTm)z=2+4t(ZtD>Y-u^E_&i@QT`$iIoW>B90 zKJni3(vv(^nRhs=xfjHmUb&23BVU0n0ztYTaa_z%KCQB}0unQitB-svJ> zuYv+aywx1&fs-1H8{LMe0_v$zjsqsi7~UIH zt^34ZXmCu+%b15%wP!03$L*DlSSU#%U)J&=QnF z8i+CbEeybMv!#BgAzjoOvy6f<2b03W;(jw1=PoIikA}ZH$=|R$q#mr(y8pen6ij)X z7?O+MUfIotz{3U$2cZCGbSAp@yluft%L_(ysrEG&`v~u1rPAYKSBRgsnhI0JanMkV zJn0iyt1}kCd(Y5|6q*PTcNC72>U2yh{6vu=>Yt~X-r#u3>v_`qX)eC>Zcal(lbMyp z%F5aYeaW%sa^=hF-h(R#+S%cpzfSqnwY0Rbv$17!{`kU{pz{yhA!oQPnQ$h}og5um zBzMM=D3$)fJCkz`5!?S4K(5CaDwpT;uu`MbN}-V3>3+Qn%5-+>pNU;@$+>rFqJzFd zUFtJFR0qidPESwK(a=~}Sm?0eeeH)k@{x9(c=UGkp*?6can%R_SFis-fKbFsf8#%p z{pVcyqbUhUYeiI`v5El2EaL5h&pR6TA0BA^xZ~XorT3+Vt+aRiNP)oE` z?s9c*G(?(hbx_Lib3~7K^jjQ>R#d2==%KWsDS7~?g#&x{kM;w d7|O?2G0l^w0ClT)&|h`Hq{QS!YlRI1{|Bl6g}eX& literal 0 HcmV?d00001 From 703ea41df35b5ee579e57c2b86ffdd14df20d260 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 11 Apr 2018 14:59:19 -0700 Subject: [PATCH 023/215] cropped image --- .../images/robocopy-s-mode.png | Bin 13301 -> 10160 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/security/information-protection/windows-information-protection/images/robocopy-s-mode.png b/windows/security/information-protection/windows-information-protection/images/robocopy-s-mode.png index 3b81bebd76bf6e906ce24b3e4f19b1d6ae5a2520..15df1b540e368d65e7fe77d94d60b0d96e77aff0 100644 GIT binary patch literal 10160 zcmb_?1yEdFw`IrB27*f<1oz)afA=x7%Cn@XfK}=PuQuuQhoyT^i%6V z%W0$!ag~Dr@95j=XqpJN(09k^8MCK>?jnu{H{VDoe+C;MeX}sq@Ansd-8Q>7?|VI0 zA?^0XB_)3@FXEXwy76-5SZIH)3)7RNPBqj z{)qfC^?yB-*!4G*C;mV{Y;)s{Q!U5sORFl$AR(ZWOl16JO|Kjg0AG<}*#Z9I{?Jzd z;s7{4Cqh7+A27VWo5g_=AK9+KkX$#zH+Z*GGh$G5{1W_^v%O;66B z9}~`x(mV)#x&|L~9l1O6N0-iU!ssAHwGH~cz~Jh6R9YOs2J+Yl(e<-zl|@Z*+$4|L zH1_eLb_h)c{{iyb$A-~yL0>9jyAJRlLM=|FMpymKt`GSKN0oi-Q%ZUyGHy*(6D|=P zM7BEfnz(b4^-19-bbdVuoIn6zZU=X)Fc~x1F*$2%SkA5P8sYQh+p3W(=rL*w!kZDh zwA;fzc6$SX4ZPzEc1;BP^tkrtTn3(B*-1%s@g=o~6}H7%*0}~YM{3%#pkH!an$viB z53$myso$c9t@1zjU)SXz{6= z;avW~g+slrJSl-o-FB-PYu})`KG(c~7}nAxQMxkX_~~y_ZF+wqff}h?W7-%m@9*9O zOWiaH^Gsv_OTX4|T9x2U|73gDpFdN)9@2bbDR<;6iync~MQ%!2zvI|%b7{7>w9`m^ zW;3?NTWzBU4!J&a$?Ai>$#KMGZ>`!V!Aqy+9v>wVXOY}kNpk7pU#a;;#qZHHrpH>y zjt$6qMn0`lQ3-_1ls}X>Rzl>*Bz)w`d&C5V^%j*$U=KXh@_6rk2 zvsy|hMdgeiWMr8NJ^)ypFD6E2zCgqzVTrKi$l8y77M^x<%)$?Mq-(c#9gn9EejfMT zYaK49MSeGh>ti549lu*?m&44g-H4h8ZEbT$srg4WTu!s*B3WCVhW=umr?KGp)*!W$ zI*vh*`qhpC*DlN5z(8;I{^FfNzWFWVa;ujUsI@6g(nn@mX7xrOhL&!vsY5Y5v*r~b zB=mH#L*ZpA>?xE?9b^m($JvK*b}}h=<`S*iaa4UE z$`ttab)gEqUBi;<3zQkk{~$!TXCUpJX9NIJ2L~O^n-*S>Y3B8RLAckOK)|2(pCAB0 zD1i43famRhf}!XG{hz(rGRJ=~GP*>qXv*MW5E&4A_D5O~0FZw5U#$NtbpCHT{(mzi zh=aa+{cS?%zIJybL_CxzJsrKa)_Zb`-}mX^wz9HPnU)qRm2fAg38b2}CI8H;j65{% zm>7FcE=ix^|JIgOkWQ9Yt;DH06u?v{(bWxBLcrtzsd2hF+^J0PxJau!ARyd zv+l*MVlDCQ`bG>o2giZ+@^e>Lzp#(<&(re>VPVf&_;OR#XM^U0>-)eiLt3103G%;R z-6^YX7+0i9!kSS^+#_OwiAv8TmrrE-SoI9FHPlp6pjR>6idG{s1Q`yg7pnc|XM}Ok zrhFN@)%+$@Jku=&$EFq4bQ*%_i~D>2$}9bc!j)qT41@yT4vs$O)lp=6U zgRf)puE@qyVAQ?v{RJ#5%dQzM;-K?8t^NUS&dh+U?JJXk6L_RXx@MK@&0`?UT(_Zo z=gMp(WljI$uzSf)r{HdieTH}AxWm5U{`En zR+`tw!-p6W%l5CQxr408wO>+psOQ#&x}HmlQg?8H=Sh=FeM3#vyaURWa_a9A)kn3oWx0+>bWo&O&!mQTb5#lD zBI&=|P%}jZJmf7IgVAs+getnlEMzxvCJ))-KVkdSq?UW^OYqP9jH1q%W$|2y?PEbV zVJRUS8E7uxl4C7Pjn84_rJ)Za>v8zTyoe>v(A(bLzO}X0+}w6~=~BU@aNK_V#C>?! zrOfjl1q~tasY^uo-u|b3=i18J+U$~FFl9MxdmohILo-2acggAfu&Z6^!#+( z^0~p_c0;E_*cV!bB^^}1U@BU#Jc+n#(7bl;zLso^87`L_Wa_MPSIbBXArY<^2UUcN zC=9LuMfI>|6W&Ehe)m?$FbQByHY2xDNh|i%C_tisrRA%V<>6Ta_Z-=B3zK>rh|2n; z=A~snH%B+oQB!E75sb`=p)}XjvVdM}YGw+iW|bp2n$v#VN?u2@q7l}WZzSiUW;pBR zZi2D;*g}+Nky>CdLl*a^?pqAu>5JnA}l`-9p>Uf zz+P*Ho?x(4Gyh0JR?^?0A(@FGx$N{5e#lkiyYsEjbb|)%2lY)(=G&WF!2#bYD_1S2 z3x_2sL#OI+Ia}Z#Mvi)PvS{H_duu7TfvFFrMGQnScRR^bo?7jp@69-uO@rfKZg=#C zDM32X-^MDXdrH3)Kv!GR#6IC5#o=|1Ei+qMMyi$JIZBNxGrhGqZ1hnk zTpx#2R58VEExp&d=W2x*!>ae4IU~E+uuaadXSg&3#xml+8$oqpM%akcL~P|c!{2q} z)+^a5xs}-L7Ls6YPdDRpez%wK5zQm*y3!v%{wy~+4MdaVrGdfe89#POo=Gup*GT=e@*$OsQd94TvS^RtT?Sy^2m8N31|8{P+9 z7ag5Tr%(k&#(m#+w^!YZ)G?^{Kq{uO{t?Qf3HxVPLfK0m*OA%lp+N$3P{R247Q30W zpPa-}ebmZ22g8fsFoa6IHhwKVJM1J(2-(>Rx^9i8iFODx%4Rv=W$Vn=eC0VS!X_!= zN9e{pqyXJ&3ukl{G)?V1f7Y~D!U!`o{NctzAft5swJJZZqfobWrL{?8szlr5@S`uy zI=7aq(g?E_{cP;s=>i$sOl^B!)LEXbMzf8a1eDx8QQ(>K*1b}yN%DiNa%GOvMQXBG ze}7a)Q{1AvDNc{Ye{8qF(EIUd7wV9$Dmv!qp~aR)t+cqAW3G(X8LTrz>Bit5Ot#2y zssg5=o=PZu6csLb5n9`XU(@5X{E?2GJ;85U%(19R(0LRmLiRTzP1R_2mRD|D%E*Vu z>}Lv71@xcHkPD0(y3nr{EMp1@_0GIpmcN$0EEUF7A8UTN?@op;dM~s%SY~=7(yeSQ zk%wtJj+%hdWzTP6aM&o1<=Btg+=IuH$pY7H#?w-1mC%vKl^4$o)=oxEJHJ5VDG#Ds z(a==siNXNEoBIm8S-`{D%sK{Wrys1r*^Q8ae4Y_`Abd-cbB5`Q;}#*zEDJhUr^B}U z-f4YKS)3bPq0H8afKo*Gx2=YJ46AJS2m}YyAYK`ws`21?&)o9yF6Cegmtp+Db1&P? z#r5JBJsUGOtPS=Y&3|;#sAt1PEt%zaKT>dB=sUf5pM9Jvoi?p2kIA}w5`5IX=%F6F zcIq< zwbZV6F+`&PGarMpnW?(DO=L4cA9o=Jt3UsQjAqygyB4m@uO|FGl^+_viFVtHbIL@s zO)1=R=X!!aST1I5p$ak|3iI=_w;kwAAGNX`uO}VlF-f1}kG8n~T{z&4NMY1w90maV zjYJ!??yTKhx8$76%oK;mhjW|0*elt)xiwG*-`(8{e&m+)_4?~_zr-hG)8@StuuB=) zFq)y-MDORQvDNdueR3S5`}_2?>B}uU$Ues(h<;Hm9wtY3LmP1oXiG_wn2j|6$ zqIfwzvZ@Q2)J-c#-y@iC5fKq-;Q1K93y8VtRBI&-<>MJ*!*h=tD!ZWF6(bY*6_OEvr(8xS|ujk9o;Ox~l9v*^R;Qjq$Q$|#FT)07-Gr0ufeFr;e$OP`2k^-CGF_?vCr~6p5vzhvFG`tN=6lmmV8p5|z@DFLx1-k5^8YxP8yNi|h|t zy>I-V_p#rkOoTo>CI&6j4T;E*Bj-H_V19Ob5X}Ukyc4f1FK1K%uqc;4=|}wOpvE-t zhD#qf^*xk^AU8&h-^|G|tf-4u-^V6YGe9V%pPpXDj7Ua|iF69H{1NtTJuIsl&xc(3 zyf{7`!jC(`ZOUKnH2vcKqLA=A8$M_K=5~8(&bexUWC-o>IOOj?q=^_{gk|tKfUX;5 z@Zkoi08nd0MAF)9-C>DdvsnaX`!_}DyEOrSvbZ4TRR6HB!$rb15Cv8tT?zv~js0A? z_DF;#PRc{kbo=V_>D2S%n7x6Y@AUJ-W?rH8wBGe2yy4@+Q6?N?rNa?Uvbb9bf-FT7 zyFagJy0$()yK;0q&y_Hv>+yI%>2!E_%+5^X?oW)|3}J${n_s{O)#E=ZH!iNfauR3S zwt6Sp0G07x|LtaPST&%saw8&qa$*u9Gr6mCSLjk@)j21z)dj!jd_^d?6{7f~SB`xK z*z^IG&dq6ul}UvjV)Z>Jtif^JuD>5;b85HBp@?XVR#kh3%rk~$3nwWQx={L*%Xh~@ zKw&d6-fiSZdol*MpVE!L-g@vjuYBJ5)3x?^O7KX)bjK-M80zoQF3scQD(7 zpTZIZqewsUU3sV}4Wz(|LXKMYuUz)qpF7`NGeL!08a5u{VuVtKpZggyeR!K>Z?#~j zC+jJU80C19ivK5-}-9Pu=GvzP0#Ib&h%OQyMmO)uAMrHo%$3VMR`G8z+Tx_mb@)MSi$6 z`%>`!7WxIulC_Y;-mv6zR0iYrz{khMC9x5>c{rc&yIX{CJM?c^F?$D25cE6{G z)@8y>&8qNa>7bf#VGdPT;PTlW1R^J8Q-8F{o29hk#To+(XX5DVF|tHg|mhP^-RWD z{i|FYt^`{1Wc9czFJW@MJZe97i{n+>v9S9V$Y3On+4s5Mk5Rj3b6fcNwxVH`2>5pH zacoUpT|G87ZX!$2%X}==VIUlr-FzG>Xx*Rbw(4=d9xyab<9B&^t7)+GIDFLnh!~T} z3w(#1d!|nJw|5=;9y|1sASIgRQiW31Ho>$VZOPTQQ zqd!|-rLl&z4I1fhPyO;(>`+Z0YB(7>@Sn5!Ms7rc@|;}Bw(4_VHw|D8dG246k)}t- z_`gL=_ng(q{q1StKA&Z}Ca)Emk%^^zwKe-GzBx(Fn{nUpwS9%%Jl%P1p$Rg^WIuX~ zWAgiSTfJ8IIJ@k$v@}9OLQ1E!#e+$LmD%&Nv$ON_6eb z7S-VgV&X(60@jc=xn9Q@+iyLZ5rtl*KMTZ`1@(8p(TjNfg%E8#l`OtO+<#Us*p-j=cd!AY}@y+0!`ue z?xnfk>KOIyN(3VZ-e?z;pW4zTFQCcw84}>%l1@dH^Rv=fEM+0zLJT%6CHLvQA{c#3rCQI(YG#Xw zL<(0t_<4_Domv?oS{7KQ%QeJQtuzOfI=_;M!jnvOu7$f_xzhdpSCd%N1Zk? z(*;ZWHJU6rXUu4!V;RItZ)@n%Xhlsl7;{+CZZN)$kB^f+orG4k-<9%g{URfzlOv9a zhA!&c;4yQ_H++b>lQ7(Hni@$gu#c!cHEKtwsJaL*qKM<$<*jD4U3Pb7YEb8}TNX&4 zczq+A<5V(!xD?F|!nKCa0<+f|zNe?CA8#t@sppkImR5g^TWfFB^we%gFc)(LqN`^@czRAF@a0rm;RRA*9yIZwsq~zmkxkaSn5FgFmmPd0k%ZEQSZekj zX5SF@SAjnf$`Q0(S{TTps3A^TJGp~vJ6aq0lLm5YJsdIX^|r`X$#!EZU?GH!P>n#p zg9f{q7x!!;D*qt^m8#&$Iov97DW#XR2kYVUKxAQ-Gg;D%glzaD(8H?4^?VCFwAv|i zf$TppMdOY?Md{!f5q_vDFpufKy=5$`IgmD?*{K#V zlb@EcSnP4NCS@4ivqY)Tw4hG@BgZnvWKJL*Bi=%xMi?~QI+yx|L!7vlx;UK699&4| zOoMJ?RzZ)$ubkz%+x?q@t1S?ytsaOqw-h275c7KT*55mS3^=2;HI(hc#&OAcN;#ZHSVDD@-|V_rnzP<(McGoqn<`CcW%q&ulRh|xqsphoL-NMRHKmB* zp_MpH`W5vy>U!!etD+^)K{?U_1}V<|Mr^6<9eD|qirhO-tFH;Gx$yT1MjV9|TS@UT zwR2qNngm>U^7mDd1>MOI$_yUF;yex>IaEEFMB9hkWGQ;RS6ly z`2%!k9v+m)&JrE@^n(PA_rq}2>&{q96VgQw>k;?_;wza~s_ws{z3=<)K(SP007r6W9_(zC^y%Z~v21 z{Wmc{e52A?V>Ti|`&mIjf&48%#)0^LhWXK%&kkY{Buv(IAx~HK3 zr=LE)mnaoC?)^C*kb&XbVeM%~_VT!_qb5V|kVXWNEabJ*CkQduU@Mc-BxMpz?YA`~ zbW+O({g;GYm;o{Goo0YWC~L>wI`ANeGQ}2O&uQn{(W3*cd!T@Qdz>Izd)4 z8~>q5Di8ZUM%GLeQyPH@#-6p^QEL%qW!@v8jbZ8qX79XoG!S3NMlSd zwE9zD_fpl(K(qGTF<6?hhFDZZB@Rg&8*b8cYOW_aQ+Wnv`K=cxMT;-y% z@$Opj*{r&w7QeDGiLro*lUe{DcLIAcPA3s{XsQY*mPg0L|6P(Pxt?=}WJ{dr5b-Z$ zG8X;~t#)OV=VU2g5Y5ar)>M>+kU8RH>Rm=&>&Vp2(Nk)J2pCfh4W?eVzv!i8vPL11 z)!KQtG6q+wZfLKoPP2MQxz?Ib{$7IY60i&6&10KvTbfKI^RQxOCsy62UBq%wOhAD% zulnIUD3NN&mBwqc%8QrKsL)-_u040IY z+NS;I)RuCXD{S%2JXS1wz{+duVP}(E+x@xJQzLI?qlXj_wP#F@kHxR4U<+si5@RW5 zW@*0n_7mTb`%B8EUcY^c_8&TNJ7v-*8ukxoC<1D@Eu~_e-*yvkJ|6xTXK0(9 zjOWeU={)(TD#tA%LW`ERU z(nXoTf&MDyweU!Vq0-)jc9h5KmT$QKf`V8$kn}}SLj3=oCj6H}{eRZ$`zo|{&&yKc zmlR;4$=*!K1^$bB{~yYa|Fa(cF9!R!Dc8Irk=pZaE0SKB?&G2^X86`iB#oJ4o#b`g zrWpkM;k51??Xx*nM+T97 z*jgwy;R@2%J&%v%v9OsSsWXa-i39$z#Rl^U`i;x$)r7LE@6GPSd;p^1p ztLY*?sy44f{UJ$X;DJ}+B_Z*UL%aZ>_2;X_l3lddqYuWzQe1AEA((N^evnzGp z;%&Uu>Op8^(-KgBfi;cOZod4vym_&#UKuwUL45CYRi|Z6u-{(4d{#-QM8ND9(=fbV zrFKeYRoJmA_5-ZYdqQMfHG%w?98;Bdlb`POgiu+et+er!YyS%KiP`)v$-Zk_vBi82 z#OHdXUflRf4xiQ_(5dlHge0#?XnvtQCc0otco~{PUtP<5j>d77`$n;)4fTj&nF_VO z+ggX+yiP04s#jT^%nKxzu8|lQeyTq+9f@+r+Fwr%Xn}8Au+3< zmuU(Qb$C|ECO)rT?-@8!=_ohSNOAtegsv+>>nHnVfgU5on?3 z#6uGAS#TvxcbNnR8!S%XAZOUlh4CWCZlP|0cAHpIs!Lw!J996sVvcgtKd(2d3dMBil`YW|y zo{$|o!i!S?o7p_VS3HjW_;(-h^k=j7R9v1Y#U^}9Kr*kMy#z1H;H1$RL$AP1Q;6a; zcygmXz#Yau$>6A3876-N&o8BOQN{~AAWLyT8ocJ16&A$eS*W?l_pTjTr ztoN@PP^*Ic%#)hxj3!!8>A^WD#zZ_Qe(_qU|69e^YoSGXBKJ#Vp+$~&**5)TP1!bL zhv|9@3mym&@0Ppm2B?(-WU6rrZ%M}XTu OEwYk|5|v_x0sjL|e4yk2 literal 13301 zcmch;Rd5_Zuq`NABW4B*M$9aWnVFdxEwGrGnVFf%0*jg1k}PJ)VrG8hd-v_$z46}u z?8Zh+S5MbeRd;1~pOcw&CPGnO0uc@m4h#$oQA$!&84L`(2DCxLd;!%Y{){~W?ZBOs zC4|9hr}2+L2LKBpIUz8xhB){)BS_FOtb?SM6BroMz`qTA#J=1V42(5WN>oVIUH?1> z-ca>E=W<4t;u1`16asLN;t#tWNGurIf}zw3`yE?n>fEz+w|%YtT#x*hjD1H`6Ko{QLLsbWoR3PKkE;LJerzX&)`$zjQKRsg;xx z#7!h6VV;T7@rm5Z8mM`A!k$5=jdltx3Ob~j{#-P8$DFC+^lEwgJEdc@^Z_}ea)N}7 zU%6u??)}#!jv;mr*EV0#qq7CO#(rAFqsrn3M9KZxntcuyuSPTwrqEDyD@*EAYi#EP zD>tEj&6fSELe!*oj)aFL5~^S#UW5A3NNZ}I?E$XzM#g;QH0abv!$C;;-QLfm38WS? zxy|sdr8#veTb|A;b_Bl5x?T!oW{>-7q_Xh zsd_sqdWnu+DaHr{`cC|*(b4J`;a$dF!fAgD8a?yWyblctdH-uab%lIJEI!~AM;8cr zQ$@bCbFZOb)>r6mXy~8f7}u#;TR^L;xiri-C>wd}n=cp!VB*PzE1t~cD=Te@rO>Hc zfN?UH=B}vCo^@b7EPh(}U_25ot z9ko!;I>v2Q4q4Kr%pU$i~fMQ9{9t3P6AgVj#fS>+I|tVcDx7x4SMP>n7=U zP8YKgh98Y7=g}UV$|haVt>Dqw93P4*s?|l$u?yx}h}o4+K?Php@gC&^j<)ZP=PCZ= zWGHG7s_0BCr^`Mt($)>IMAK|ZfK||*qKhDU9z^RQ`cBhQ(M$;SM|9z zUR-Z;%J|7+C`UWn{C6jn6D#VP+`3OE)@EI+iYQCvRy|-oQ0vP{MBZK##h-Frbi`Ir zeWr?2xbt2;P|qin!9k)u0J;h$5P(D2E%AQQaXCCRw9)P&^Ne`%@$mtA^nE{`u_GcP zY?f-}BqhO$%zyM0-=Fc=x2}Kk=|Yi8`lF-u_b}}VLB|pDd0woybzFA8W^KJu{A6Qe z)9vycvTk;EacOOBb#r@6pZc4ejM4H9Y@z;QZ_9Tf^ZBS1duI^^0Q+5*0$t|Uyionw z>U|WC8(vZ(8i$>CC@wP52aG;3S#@0%M5IF7uj%}C{67I^ntqB$|SjqsM(y(P3QveXuJqi8pJ36vVb(j?@ zag?%3b?|fZYDW3vg>G8)J z1^kncr0cAE(c^#9?F6fWo{rI9ff2w?`5f*Pon<00j2QA{;lBVCKH89yofPtH!yzl5 zf3ty+g0`4U@1s9M26Kd}OAMw)N1*V?_s5C~>0*KJ<-?FvBL+b;eIk|=+^Bwuj;YlV zkahq~x;J2q=*j}}DV!7ZN@cChlr#jlAX$Gw%J&aSj^-n{*SRo*1ex{?6$>X3@Cs3X zKu?x_qSXC1P|9~u_+vcpbC1=^;N$yiMibHZr?Nu31tCylyfkhY!A$b+EsP&mXV5C_ zpL-BeH-$KXeW1td!0$+mKon)LF2PxGulr3F03H?%14AN606NPTaJLysaB=|s{)1b60N{K zc4pu}4XDva-0LYB+l$F6r8ZEEG4EILjPWI2{kO;E*aa7&U+dRGE{B`&1YXlE=iD0) z^NB6CBWr%ztJk;lIX(Pq&ufhB{FSFWL!hz6L;DP=7#R<7Aq|teNs1y`kRtnAx3AA< z_~QrZlf8QG>%LAVZ5(g=4{dH*^lX^fUNkJUx;-G?tP%-{>`)h+p{8|Jb20%cbrK6ghXPH+w6wJTMAmUi5u5hGWV!3ZyIq5D zj7UK#yHS1_U^HuNb8&Rss%btVVYZ2G51+NLj_uJ+eK&7IEK!TY-+}8{%1_2jQ9WYZ zL#ch52tU`mFix-P9cKt@VhboXQ-O>Ig7BfdOHm-%Z!s8$Gr zdV<}9Y|`|sDFcfB{WhtHv32$Pl#eWH#`zy#Ho#-7`@c7gwhwnEF(jQ zvA4n3c{J=Y@=1l5oN-j+T73sXtG#IV}nuD%w=Ua$>`*m$8~E`#hRVO%}lM4!{uWAQL3qpZu8Y$ zRCQno@wDUUlRSN4fKIO!YOrG`TC=d}tT*Q-U{1nu%j%UKl@dK5h$OGfG>1CIA{3l9N5VH|TCYPY`*2qr{*6^Q z_t(;0&};vPht}Zdv*+DqH}lT9gt37(-*J?Yw?q4G7U@tU)3|0iLwk}e?4AJDPj4Z5YV zH`)13f)7+7n*stj1mPW3y`M4Mx;`PcT5S=~Ad z>voZOm~%v^1tmd19Gx3DM+}R}O1E>z#G&LictFc4Mnxr^QI(aWXF>)>`TIuEjzWmT zdlWE;noO_3-m9d;a#qYw5J3pr$`m%;$v{A#j1xKnCJ+JnJ_I#Knd)@gOgcrfSyE08 z(F@Yr#^&_oq*k}Bf5OrTC3x}}HFfjDG>M5%H67PnA*Q}eV)Y`b(R@%dO`+b~YZ=gin7T%e+qai-NM6EVwOZ#z;e$(X zL_d;Xa^0736f8w4XTiC`c7a`&q=h#~9rkg^f|B)q)qzMo-ZgI1$ygfakE7S0HL z#)jB$WYxO)w-_)W2Qe8e${GDnKtMouclV-KjNQcm+{ZR-9dDhOq-3}Z2+{%9d?;!4 z!H-KrU<-s;SXdWW7$7njhUK3F?N9{1xS$Bd8$$m_IZ}i~I35=h6BQ*RDVfes8J%OQee4%w-}{O0nb8&%MMI6HnCk2|dB2Dv&P zMwrsosaFzb=(IzbbMGJ4VA)Nr?@{)4cux3*sT^^LmtZ?O z25Hmk*T$b!&yE6+*V$U+l;2R%_2DX_rY3jr%&3sZt)%SObobPdRFap&t@Sd5ZJ_&0 z(c|`SOzCjx$A@p!P=D^v?>|?zQ#3f7LD+W4wib00Tuq=xrk0r3--<}&_r`=_KT17H zdo%qsk|~HcA&HaoK6_ddeJ}!=%q(!Z$b>>RhnbYuJdl`7lqr*r-OJw3UPi}lAm{Ig z@0!2Z(K+_ZOHEFWUQ7&qbF&76Ubk~;=b7m7byCTQfWWJVh6W}6lZVS__^7nZ0re+k z{BU42p-FyFJ(Zn}&G99Xq;z^GnaOqHLnZPAF#Jk(NBy4tdSwC zYcnbh#O-VqV6vUGT6&dpDx{?j&$FZ64K!_72ahxCcV!>$Ohr56wSE4HA?iw3a(r%J zD#4M}+v9QqIQf6i7-mM>WnH%x(uTBv@bSrID0L|(&ai*k(A;@ z%8fUYja9lDsPB-wgpgtu+f^19hVM%yo=~`VWe&^^{cMsP_4CX@ihg-u&~k~> zSvllBhGG)!V58zshYK`(NWSE$-5Ti+Fno#(jwz+&Me~E&lCu6gHX-(d8k4=m&^@>q zS8`P+;h0X!%o=|seEf#F7>ouCriFy|k$1yyuOgAR;XYuF|e3F=|Us>IlC{-_^vE0y!4KzfL!Vh&^tX8g-y)P zh9?3hR6qX-_DUqbRljN*&y0siEM7!Ch=YfQhJ}X*{@LG8GBD6DM=@dO7d|(;wKYGt zNq~nZu5*R8lI51Y*7CF6^RUGU&kNwOCAthA)0lOx_<}2~rOCMuvycac?};n*NaeYv zHa#|q^H;KKI=pQ9FnWy;smNr{l8%3=4}C-)vrEJG=>3K@FR$DAc(>VR3F_t5Hqa0* z4{`J(IJWOMoZRgA1}Il!%Dj!h}t6^%N#t zt34wI28*WluROxnBjOxBFE;%DI7Y-To*m$1u}F|sg?=h>n!KJYq70#xD+TBEi>>&6^7^YTDY z#3wiW(H`08S$7TMRZ6+cLHLfpX>)pMX~dq(z2oEU&VzSNk-%Abp`b%E~;43)jQIeVii^Kfh0CBEnpLdXF2?J#1`y zzK3%OO>}*LYnIPxF_6G-dxhyukTGIXK)T z8h;$L909BoKNXC?r-QxhxnPf3zJ0GXfu-$vqqfnH@Aj7j0BWcb`WmYUIF7~UJEm(0 zYKjxfp9a6?pU3BDRWoX^3WtK&2+#7^U1+MdvU*vBx`hLuf_Klep3vMydyRj8h3D>y zc68e8SLon_0^R!o69g$GH@7Wzt^SvqAoi$5G*rSr%j!otvk_d`6c4 z)#LmQcYffIuG_t)t+I`F(liqT_aS9r@Rnmurt+&vk!)7CtAcKE#jfj8)kvKJ0`gQF zhu!lAGh$5+HVtF(WcnY6SL2)Hrn@_~O(;-mVm1JRRpyD8kPQbBbqAe8?N{7E|p~+I5moE5FA*;#AY9(d;Nak8L{l~Ro&DhQ+3xPm zt9pkHptDv;8j;@H%$6>S9USo?{P~wobH?l!WaQ%9ww075esU*sZ*SG*kkAW*oL}!j zYF4S>w5rQ%YeWPD162|z09@SeC83TVy~Y8CvxYwrkr0Fnw~Tpy?7Hjeo%f#82AxmU z|As;ZNPNW+mZLk@AIms7om`@`G z);(PW?5VfJWY;-8)}TX9r@W%HX($(&{BDQOXY93ffyR~dt_@Pp@-eKR`Lb%xsy${U zemZrU<9BO%QT!|X=LkR7)vEp0>%EM{mRHyDdc=p$Hy^qCKOg#3UoI4jXK4H%`UIkK zPKpTh0YQe%nuw^VsGZ=VVl8**LjE8A5q`HBe@7Qrliw15xVu$0oTsd}mp<*vb$!9j zI|UwT`q}4=8Tz|iZyWj<7NL!s80_)(Ri5 z@}Uidi>Ck7jm*M-?ZYd1$!5|j6mJn89VsO(JwB3q8OzY;eMiQ3A&wRuPu!4~c zX0$!;4B_RkZdYt~$Q2o7O&(WE0t*>3lEhTzFkU3ATqA*t`l`CI4av7f9MfI_Jz-Qc zQ1t?(*qD&!I0rqVqk&2p#;s|j@qW0WRGOgF|9G80^~au|bKZHx5=Hs2R5r_XsUnH; z^Jzrj;o+fL_j&QEewNxz&fqq!EsB*WIzpzR;*{pS>1`L=Opm^KtlVMIc!Y+omH7B65B!2?r^W4Y`03$+Zm*^dBA2FW-9?#o?d$O8@n^aoLP$ur*i6kC!qxALyju+i+Y-$C3)dJ`rJIyUkzxl;7w{ zN%u^T$MW9xDJ=v(y)QaF3Q$pFBpgTbf$5MM!9^?Q%Kw zZu=w*y1O1{8;VMnP8lT9JwMO7GvfGK9&)`dA|m8LD>Hk|aWL22f+sp)eeI2c4Pj`| zN&=(Z=N}A0%FX-i03S904+&z)$AK^;=wv=sFI8+9E$?)@ zwflXvd9`x<*5Ko~>v4X5-oSk)T&Jvr6U&P=tS zmywc_lasQtv%9#wwD=Z{f!zugh|D618iCtnuLh7NC7dKaEA%5!+_IIL=?Zn;42Y!j zR^#wd7Tz~knWp&B2Kxb-#eSU>lsj9k>xEWc$=AofAJ5-v&!ZQv!YG(4f{QH1o4!0V9@>e@Q4#(0gfi77Y6A>guY#o@sXEO49KKc{e;g zJv})&nOr7y-DOEHCnpC*Qh0xPe%|T*#RX+5AOKu_AY5tVOL(2^SWd}Nzxu7Zn5o*{ z!yhT&7kM|G-`1m68cSZ#GzxBwBt*S*L&7oD5G9Zqly_T7k-pP1&tci++5tF^oHGT{ z6C~}k7f{twVUA&JkG;BFdXzu<)rgw>HwJgi?J~{yE@Z;(ub(fY_#BUB3o2B~0&DyD z!TLcwZp((ZwzgIvCKLxGYdW|>L4R8pUY$vh@tvIosa3RLuL<#&gFX< zA9{K73z992e3+l`?PaM4$rzi6hzJ`S8x<9t&tw-q%a}SpG~cHlE|=M4IP;rLukCm; zbrPk*gBxlvGR!6x^;N(SB4jx`6D3n%Ffv7S;;emkwy``fkoV@s{lPF;Q zrC&MhsEF)b1F1Gz&_KP1q47G1Vp#p>x z-e*03W-ynAQhKHZ5}zjB^!fibyEKSONkuFgpI;n9nFW_HhXbo)$Iv*bJ%%*Y9VkJ` z7DnQlD87^Jk)_gavNJ0;kMJNO1m)k0#!#k_&1)LB! z^V5eJ-)6E89m1?+^ZX~!WZM2o^G4w$H zwut~*u8o;~MRx2Zp$7W;f$~PZz-5=&tGy`Ds(g5lk>9a?E*@@q5O&wM6i`N&LjUb* z_fiV9iojX^FK@;3e=pI7z9O)EjcikcztU}}%Cr~`+(j&YKhdLg=O8{*l9Y0spKfgR+ za;)x~7yn1F%hh9H?gV+8M75b~(4R#8HEu1=UUr9zNU@W+3|KcR|21K_WJ95QZ{>Wq zgF-73Yrl-G#xmk|;(u$|KR06}Fbz%(@271YBbA2 zX^JA(4vxguR9YO1LcbznMW$e)QMRES0;#E2~ z5?gt7rVonSv>Sv6wyX?NW;aDZ#4)4-#}?Dwf1LH3kB?7JPmcfuFSfQdH8mi3ZnfX) z_I>x1lbd?JJuLg)0p^Oe*H&aLkt(PT1=pJ_HZV}gOKc;7%88O5AsES|DRj~jMAYB* zwK)PZH0Y`bo|haVC2~}cLOeHUfW_d4qC%=OTP5#7a`**YABC$(!kwg2u8CJu(|Tkq zp)?gdcN^zIMdesYLbLq$b*h5uSu6DI{-eHOnLZ+qh4tRf;$TlS!z5E;t3!_@S~JV% z(R-c}scB+}`5_}0PVRZUW2lvjSrd)sF+Nq*(VXV6GhRS_L`t}ni&`;|!|Dk+0OUvY ze4O_99_F~Y=YG**>ZizE`nWrtRJ|T7we9~pn?nPGmX|+qu!~sn zh7jK+xjd{fTav|4U6k6XyfvJ7w-KBp$o-;jP>XW&r$Gc;FH-d;H_NSCeuhp;TyEwB zB81#SC%G*DPJ=4%nR*jiDEeV%K4TY=v9t#%08PMf0@^~*0vVh$5giz;RL~%`=p;wl zWcRlS$bOTyTT0)1uYR6jUZ=BNk3bQhLW-Ck*?P$6Ku9Czga%+v{+->r;Orz6OS0f{ z-_qXOmRHy)Sq7bx@MnpwoDE0$78^tAko}vD(`Jl^P`b=-t{ksYPfAq{F_c4VO`e*; z!3cB%pZi6(Eg!eb&92EWu%m&f?95SdS6xWbg_NXHCVyf%jv~3pKihauG<=Tn%X2v= zjOVHezKf4N$2z5LBhGBvrlqdxQ=09az6BLQHyXHORtSGQliP6p_^}7>I0yD%yEqg~ z3|^IsA3!)NrMm5(B?p+QaNrTRpmknD$0mi8icjmq*W`i=fsQ=RbPvyyO^dgodsqs& zug~Mg|9)4vsGxx|rOlLf37#2Q!DU^xp^2K^hNgqa<|fRchUin~B1#=nL=os8=fY%W zYnSS*TBv%-NTvzcbDR9tAs~8Z{g1{wG?u?Cm^2@1?ssR9^X=K9@>W%c}!A|-P#vj zI~NY+np3E|_sKCguDBB^#oZfvQezl6xmwX*4?jZG1-=Dfq7C{I^225}bDa;zz7}lq zsjR~eNown*kczBZeTy%4SP-2B&&wtPjIKaPtxAgX{w$N6C__y_La3L7VyT#4bUz*DaNu?8v5mYujov|XKbg8 zxSFNPx5PGnp6+(xtXFU(7HRbzvX{n86j_Y+#l6vQrn;%Xf(wCcH+C%7SEf0^k!tn2DbxD#xdAYecLwnuvAIM;rnRfZc z%Pb$(4;;i{!%m_0a4sL5)}vRKc+Q`G$^V}96b;|E$}zqCJ5{OPZj~jIeNO$n4nV28 z(alePIDYQChM-gEbeE=eH#Atp`E+m1+cRDGXq!jUf|fzrM8lfe#~sv|y|gUB`rBAl z3$qLTbS=-b@LIp=u>-Af;p;kW&;Rw=M>C28r=>(KMou^E(MSwMzzlyq?0(`ea_Nv6 z`StoJOyUqdNdAyhaJ+3{p>xO(n>FnOawP(K6`ijhVzzQ(b-NtGvH#KOFoy`IfTq{> zS?h!As%?<#sXx69EPox6P&~5{LY~Ib{cDW{zh<_2JqsCFu0|M$_3uu}TC)T?QSWDc zeu0*!K;B4I&YN=HSzz z@eU@yzDpv=7rjc>86O{ahZ92aGsjtq3KE9qv(6?Y0xdHI?tIiD&G~J?BTLqKUm|ya>D87`whvjrvugzR8w2CfX!KfRAf>DOr!7iV9zPAy(Nj{EYHCVUu&z!F_rqi8oGi3Eh{xJnYY2?vVI~D(zye;6}V z_l-B&Cow5$P?_%Dwn~Y+awvqD2a-Z#d{XSiZ;FGMv-_u?P0LVHjb96*Kt%aEeKd|o zrki5ydcy{HI8LT;L@a27K`CM_EM4E!-fEp})`o7SZ=_0z*^M-0mNl>bbUNFu8d-7> z9lpQ4f2^C8uKLTWGsqai)R0ar+7Wzau@aq(8f)(W|8Qy!5yALC2&wZcLNv5Q=mhj4 zO`fkz5R9PbCN2J|R<0@j+})D6w>XnWHnoRkX7v2Li{8!xVvTah>DX;?PF^ZhZd2c` z4`!Rrs0eeF)c3OwRI^$yc+PtOh0v|h2vQ1FZbnrt3h#kM7m}6Zpfxy$eG*_{Chz9& z2W$`8YMhsAF1Jgw^#Y>Rbk?fe;RUK}K2j{$%asTLvVkhTw~&&d((VOyuYb`e6Yy{W zDq?)oa*;rzd~4uc3XILOr+g?ysXz6Kbc6(~&5E z%b8$^1K(@7aJ%u=!}yLsz4``vI^cdFwktAh41B#u4sMY0;l#VY?(bgiH-}pFn0DeR z52rbzAq2}D4+IuPXbJHLI~Z&l$L&#REyn5}n?HYo^4Sf}Fk-q$eOd&%do$B!8?r{1)Y&$-6aDm#n zeJN#n^+*;T2M+1U+-0rW4Fz-Rc{B89Cr1+&Yum6F{S4WkJG_Tc+9G5h}4f7&RbnMm{2 zH5qAXK|oScQX0KZC<#a}?7yS6fB+?;tBW7L4a#OH0sdW}^YJQZ8dK)1k)R2JN9bE6 z*-iR`pwZAUJnX+ojQ^|L`2YDkYvJLq+e8qK`$~TQPA6l?``^{d|FwIO2K2cr&wn?n zw>J;SBHXX#e8{`UjvxzF*{&HyiFb+vw1W|`{t{;v%D9LdK62?BgCMd*#AZ4mvqQ#?`8 z(mK@zadPpp>MBBypvpqm`3gju1x4caTm)z=2+4t(ZtD>Y-u^E_&i@QT`$iIoW>B90 zKJni3(vv(^nRhs=xfjHmUb&23BVU0n0ztYTaa_z%KCQB}0unQitB-svJ> zuYv+aywx1&fs-1H8{LMe0_v$zjsqsi7~UIH zt^34ZXmCu+%b15%wP!03$L*DlSSU#%U)J&=QnF z8i+CbEeybMv!#BgAzjoOvy6f<2b03W;(jw1=PoIikA}ZH$=|R$q#mr(y8pen6ij)X z7?O+MUfIotz{3U$2cZCGbSAp@yluft%L_(ysrEG&`v~u1rPAYKSBRgsnhI0JanMkV zJn0iyt1}kCd(Y5|6q*PTcNC72>U2yh{6vu=>Yt~X-r#u3>v_`qX)eC>Zcal(lbMyp z%F5aYeaW%sa^=hF-h(R#+S%cpzfSqnwY0Rbv$17!{`kU{pz{yhA!oQPnQ$h}og5um zBzMM=D3$)fJCkz`5!?S4K(5CaDwpT;uu`MbN}-V3>3+Qn%5-+>pNU;@$+>rFqJzFd zUFtJFR0qidPESwK(a=~}Sm?0eeeH)k@{x9(c=UGkp*?6can%R_SFis-fKbFsf8#%p z{pVcyqbUhUYeiI`v5El2EaL5h&pR6TA0BA^xZ~XorT3+Vt+aRiNP)oE` z?s9c*G(?(hbx_Lib3~7K^jjQ>R#d2==%KWsDS7~?g#&x{kM;w d7|O?2G0l^w0ClT)&|h`Hq{QS!YlRI1{|Bl6g}eX& From 29b7b7119d53a120c3c1fd05ae0323260b30a943 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 11 Apr 2018 15:22:07 -0700 Subject: [PATCH 024/215] cropped image --- .../images/robocopy-s-mode.png | Bin 10160 -> 9729 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/security/information-protection/windows-information-protection/images/robocopy-s-mode.png b/windows/security/information-protection/windows-information-protection/images/robocopy-s-mode.png index 15df1b540e368d65e7fe77d94d60b0d96e77aff0..141e7a181933ce6b8e213774fe39ee1f87ae7860 100644 GIT binary patch literal 9729 zcmch72T)T{w{AqFid5;n2neWv^ri@*2kA-`=_Q03dX*|2q)CU+q(cZDq(~Kz8VCZ? zdkeka_`m!9H}mGryZ6qW`)B5yoRgEi*V=Qw_3gdCwIbev6o?3D2><{9k&>dECIE0R z3v<1ShlM%sMB(gVzV5kbD#!vVhUqskH`rFM)m{St)v<)vrVlXp_>PM2T>yYbU4M^z zy^vya0DvP|N$$0_hw*OajEi1>()xCR*&0)7_$}cYIO|&bM1Y*1e-wJGDs$W|*ZW~) zDaP6}9l@~6t>?X2vZcRMZT3*xv>5BNFW;+xckI=Q)^D)Din7hq>@0!UPvOk?U=NUG zmf>FOg~9Rcul=nn{D;O`e%JlxeQ8-5*P+u98($?q)v2Na>#Mjfca@#P?F8A;I>Fua_Mm{Rv0p zG8L(pCzDn>XN9*WN0IZ@m10Bk1Nus0CZnrRv&v7McD+rO!SH)=-mFR##XUfJog z3X4ZDqJW|BctNv+0OF|{jCZSJ+a)1&Z+4&inFzMjG(pSmCiR5!1y>Axq#CP)1!~bI z?!>=o)9z*mm;H;gJx;bB7tw^0ai{+ZN+7$D=Io@PSM7>&oaSMS?Y4t;+pjzF2zPi8 zjM)en%WFjOQD%)AyQmi5*HXYii30-cZIbemHIaBHiex1PyW1gkoGztI#{M;Dr-|Or zb)QSWLoK{GoF(jPf988Uo=AMRH=Tdyx^bAP;Gk! zeVdS^9@O8)|EyGfcI~dwbdM8Rcy|?2(tc@+wt74QU7)>7k95f-<`nJaSnS%v3k!F8 z;oMzZrF|GhZnA4b4(&TJmm-2&;qmtS{P*jz6(+dC)%Mns%Qe01-I{oc;czB{v z8_9F52`sZt7LsWZMb8mx2?~xrhm*d+hYyj)Scjj)6?7)_7#K>8AvlebbSfRqQ@*5o z^3K!Tcj_D(Q|{25B|CWlcqdc-T8z*LsG$kOfE4L}IX>02-uyM|c5CavTMy``D|Wez z9%VB0yLM0Mxm^#bhNMK_4P9_9RCru0P97E%a17(KWO=Q}ueY-h*~GPyq`qch98ji( z;D@CBc9eV!mHC|fC0Kfz48(1Q@}t&JFmwq{ybtL6teYK&!7qn}oUIMp7E{Z0nOCac zZZYHG?PZy5gRiwc7#vNW7Y8_C2bu-3{=va}Jb_$-(Ao!mZ;|ZhdHqMepKp75)ML>} zA=C2Za8$gXN7UQZpN0bH%-v30Kp&P@lfEw*5JbBa$&8MtfN_8;P1*}ZYV?$HM~di) z00788FpjzSj5Q_jmm@&`HEzJMxew^Z|7X(>7#I`wpJ}E9TI&8^RPulQ{lCIO|6@%X z6A-Jbs}k-ggRc+-V&2}yW@~eko|c}Pi77iR?Y)uFVvdidai_|QmR4|huk-z(xa|Z_ z*O>qS5~nATBER_v0+1qhvBo z^s|iKeSPmCBqk+@Hb>9*O=o5W7EZ-%H5Gogn@r)UG^!x+QfMC-c&4qbJ>Q`5CgFT% zrgk=(NIgq>^>dmT)Wv#sb{K44f1RHJ#D*f}%Q{;RDauIq+*Zj1{OFJ`4iQ{oxC03z z6Dno|?uyYfXkjC=G$e`jD=T~}CHxC>R}abv=z#pUmRGvwJ>TV4j>=vJ@O{6RC2X#i zw7c1>ra=?6GUglN zdp11$yv;*QM(D`-dgdrMjLjW4l-6L+u)L!At>5l+_3}uOv0=NuuxRlam&;0Fset*G z)MVjr2cc&UpK7qUPo?oQSVZ(vzqz6fIiLD?tK~h6Oa*<8ps;i$sMt1&3EL><>TG*O zN}gg(2^~119}n7{!ddH7mHZ>udYHFHVYHHvuEe&vZRfA}K)r%|i>haF+ z$eEes(+ZdM=c=lzSyC<;^K%mv@Bi#QneiH*p_;a1OfH(v6G(kq7oPe0Sy~jD9ZwLN zz}+3!T8QnrNa@5ZLQYH6?fu!qip7dq$p~9Hg6E0&*S<%K4>?TA>Y3t~n8^};Cc(lX z7cp8(y21$L<}|nX@l?d0-Cx;xxcBpWpc$LOYt!7C1h^t`fp8sN?Y6Uaf6q15&9P2N zqesNVXD26fbPZZs1~O7-V;i*GC`cs{Z}~4mdL!=OU!?3Y$28Cga|hGhP3T|Pi}yO$SGE&f5^9Bi(T@TA$bA^%ctL&o>qA=j=_1lf~bSd+>sDu<8m7Liq{lW;Z-!Z2d zAEy4cS@$Nmvjv>GH18){Fc+jjMj7$bPOqTaY#6@hYCIciOBV7VA1jmK3 z#LB}}Z!JR!PvylAe1or0es{fR3%8R7GUvVRyVe^_O-SVL-@oUlgn#)LZR#G4p$UAM zIgHpUh(Wi1wDsio$-Q2)vADQKlQaP<9bgtz&-IMkjfE!M*9V`UX|a#Qi!IJkTn*J{ zlH{XRascw1}JqoJASGABkhtt9ShUnBaRL4O=tOdgpuMu;4xC~>xrId%=DINg_eA4 z&EEx1M)#!G5xKdE*lwrj>b7P1%R|8Imi~vmg`WdUvQyj=gX3dHCBAy78yN4=UR^dT z%%&t8^F4d!bF=j0kh}Q`F5^|DDk-mQZhEKJ>QQcQn|1@md7fhQU1XBQJk?J}c2 zOUE;9ZS#Z{CQ?43U`6$ZBvng+bE8am8=jDtp(~1`MG$ zXt?mWom#&57FHW=9yLVg#;%OK^qx05DVG`zFW?r)vrIhYK|7WXYIEUz!Lg57pR zhK_nBAmWE4`y zOY0VDvW5rw96XEIo^!w3oOAbYGh449e5@n#wb@pDUr5TsZ~IWCz`;H1r@Lg@zL)rd z6#s$*|ALTo^Zxhv+cpH7g1Vy{bGYQ)$_vz!_8>^;rfuek<-H$2K0fiSt!<7Y_rFi} z<{v>K<$XGDZ!Ha7>7E%ARETAquU?MzhVDvN`75~Hlw94fr?O(ID34iacCW8NZ>?wV zU#ui9wA|g|8q_;Tc;_zZ`?`R=O$KiwVmMut=frz0iJ8Pu3rOcF~dtc__ zP`&=vbUTdcI$Nuk7%pN$w^g#;YA`oG=Wzu!lb2t`V9tH_^4h)qYVLGbA|_kXeN%rf zDRk;h*rT(PmqslfX{A;%q9y1%o##wm7q)B~v?Og%`Zbxkz4s!}D*GDoCROaG9gg9= zS?AuJ*teAj52Lwb1&V{dthrS1XMl1@EB5dHU6yPMG~7&U7G%c+%%L% zy!mT+3qlCU_DUJHlxTex$?HJcr(zm+zhmq^wRE|&-nW^pb3qn-wqrN7Qc-DcYNn;7 zh58@`ckt7lp6aj`u=!l9*_AT7|^DD%;yD ztE=Ose>%)Ho%BT0MMvxCOiq6DpbYQ&rXJ^#I^ll9943_zjAt1pn(}m7DyWAt9%c7N z2=w{llocO;Vr4Ug2CYl9Bzzx~X@_Jo%IoNsh@eDnvg3N=6~(Ko=MBjh?_q)Zp1)uBD>U@O?oiBAFdM9Udj0_Ad{&#+QR_imhGj}{Z>wpOIwO8vPubm6B zl*?e8Ve4bj&;b%1Ci@h9v(60s>rcq2C zuyc=AMCFn`&IdP`inCI4J9V)pm2-;Ai4IRly_;B?*!Rg~MVjEQ;Fp*Oxv3Z^D~_UO zXEzg{yzWGfj*iYvx~&g0T$1P;8L6?J_j6|ZTp#ux_b5mvse(Y#7~#ypAx6bqcH_l` zdZKhZYrsgp)YoB_x(B~&Sef4mFUnDBeYb2Disn9Oc2w z-k5^;_U+r}&jgzMV*;A+j*gDpTo!?^m`{3ozvt>e(#_QwWUeVGcz^JDyU)R&*9Hc& z`3kXxg@p}rPq0U#MfGXLKQ4K2pSOtJ10~}h`J2$PYI2EdoF8xDT}d{)jw!dhx}|;1 zOd#e!TA{Z*@m}3&|4GAm1ES*3@Bq8=q3bH#`~c3FcUH{lQcae<6gpZ2X+^B zpOcdl%+~nWG+DYdOWOBq)bKFK%YE=ieV$L(uf=G|Gv@okaDqS2Am;A|(JbJ>!9kee z{RHo`z0qyz5;|XA4x4=9tm7aclip^6@pfNrRn@QASqXmr>Ke`P?CuOJ$2FH9ILX3Z z3SG@eoX|R6rm;e1H;nSMy}8+l5jp$%@LDV5gX70WOX*unjG9~{mRE>-2YwLi;W&LX zQ%=8J!8e`##l_8r<^W^+j+K>`mlhW{_}z%N=8yJ{U|2ILIazo@#1S*guTV_Yv?$X7 z02I{!)GGe9;zP}};_UN#0C_^0p2mPWUeH(%B_O9b0M2oL4ChrmmW>JyMlfW3FqZrf zqr%7&!1!n|n(Su^MFRn!W-a5+K{EE6l0Axx;ZuD+iahdG-g1BT4oJUuasa@+e5lfFRa> z3Ng8#tFBi1XU8-)V;*v(nICR|$%#7TB^@0iuQtkP1@`T_6w{|o*sR~o&d-xBF5D53`h5J?a>R!{PXRgk{`I9&9i_J3$3mdS2ieU)bObWF&?&p~@Iq zsPh(khP5Q7m|Kb4T%wj7RAXh^>6Mg7M*XPf@%5X<@&oZ*$$k5Utel)y%@ek94ij#% z9sA!sBsUIu+5zbC0{)4(r}mbVHGO)}7pU;lV6$Q@He@NO**Bsz4#(NI!IF9K3Y+U5 zkl_$f?D4kK`!IB>C&yl}!x#EEZ~4l;w(}Fmt5Yz7UUoQ|1v??gL#=dn)lAxF&C&_2b!ngE z8W2&x#3=mV!ityZ?z6G!6V>ulNLvK7Bv9nVs&+3Jw+# z*r0%!ywzXPX&=nhep}r4vPhYxslk0KN9%)><(hR!ABn_d)rgG%_U7Z`DBC_3pe&CL z<+^Brxw!8u;f|eHgy{i-#c^wp)J^e*9~2+J=eQLd*2!ofN!#yHs*zQfaf)3cS(x)Q zp-j7~)baX~e`{@0=%bmUf%a_KCusM^ms4QpC)0||$NdFE)&0MSX40Q#(9^mCSwkMT z^lnmpfv#--iO97!iWUqSTg%pe7l^Ogz%cskj>G^o6bzEEs0qs0qSN_RSJCgl1BSlP z9)O$Q;B(@w446OT#+uQNd(-1-CMzE#=y7E(8(}$M4eK!(n$A;vq2)?*EJ{AZp=dxa z>$}OlI&8i4iDg@^BwY^~PQ(fhWYD70&!Cscac4PURhL5rMEA-;y0Fc1Mh@{(LAf`Cd<-VT;-OmD+>5w=kE=@!{obAz64%44F-q zMo`O|tb%Cmw9`1k`76n?`+Zjz!vO~8LjK{mqNLIIl#35%i)V}En+#*iNuE-7H`~s9 zX{y;xW8C50Ip7V9GoFRQwHtUekkKP}WI~k{q;xt-`$g&SS?-+T*jgBrS;BW9Xemzka%36k z4-|pH14R^XiTN;ON@t9kP`T@&!c(MsL9y{m7L`!lfyr{kJ)<*0&9nb+s>LL{D7fPg z=C4oyE=^`|f6m-J%n#Sp>sV75{>DrnB>zFGj1ppV1@v-!3CKA&<%?{ES0_BY3U3=mT@l{eqt=QtUZ&igW*zexpz>H{_C9FL z{1cp%{N12%F1)b`m=c&8Jn-aE_Vpu_vv%8zl4xou&0>|FBx6KMaOcX!=`G-`sh3JH zXAP2`VnATh{6ke-n*hInfk%=;Ay<^(WulUhFzRQXw^Q4!M-JYDuTZzwLUqE&#CK6q zO@na3bm^h!TC)xwa&G^Yh!#yQCYrs6w&C%lZOw(8YMN8pBB2o0T_^u(J9b`E|8$c1 z@M#q~-xYQiHZiTNxC&BJoAEGCJO*i(vW!pEx0EAoU0-!uYEI}owH35+e`VhaZtK2a zAJFtWqz;ZuQ{0M+dwgP<${m%vV_mQD+wf6>dafH#jZ-+z!8cdqQt(B4zb2yfS8Bjp z^MxK%{KvRgG8Z&JmhkAki!AF_o#d$bYC_3;^)-IU#2`7aB>?xuRe zloppwU7H0kh{N>iunmDxFVmE!R8S^dg3& zye#n=l>smjL@>fWB2{2Iq8tb_dEp7${^EkN0Dkf{;t1F7LRh3z|0w^kG{$2W1}Dwz zivUqRA>BJToR0eSgiH7b67{7?-YptWIbBj_@8VB8OC7GZ{PYnp^|e#Om!y~TWCW3@ z3M~@REiBIOsR$yVm6KdUv0S$(le~)ZadQZf`w`g;*>Y88T%^0sdD*x@_p}CEycUUm zVRv;j&Bg!~H^J!T5O)p>9aT3CnT3w>rNv~N-Lz`N!TBj4MNc?Q@B+o}D9jR1c+P|^ z_@KM*P4@vle%51=R~Zt%e2*&BNJNVg_;C%Ef*ZA{4e00o6Ibd3tE@)v;?5Z$hM!>$mSGgS=0v=$%wJ zxa~qSQa9vYaw#1k@dQ+RMa3+~)NuE)VSJg?0J68QNJ*V7-ALJk>UdAbk{{6%eQ)B< zfJcbb4qZJ(JbE{{#0Lhfr1_{AbgFkUleQTAf0OI~V`;7bzEwh{*_W6Vv*3TgdH=Ez z@G-TV#QLURQ$gf{$JB@+!Nf7s-3LH(Tui|NA5(DFk=l8r2rCxD!lIfgx`-;hi!Po4 z<2%A9hY`|dmi|!DfQ%We6aasGFHU$q9M8kclg;OYiw9fHCrlkgGBGo_g_QK*7!5rC zzV^>vU!gqMSpRIUMjr$YEk^e}!t5RlqyylGK)LVZgLI4c|BsQk);1CiA^Qsk5Z~n+ zeJDX?<2TG zr#h|vd3gWpmmp;W#cI0+f0^!a+e#4PANngn$KX zE?zocBj1ih70lE*<)nj5JJX%5oQeM$D29hHNjc%HZss37?L#W5zIt827qXMesp}Ae z!ZUrUVy|5la1_k+o0YFOkr2%d#&PKi8L#MlnCh0OzTYo`N7J8f8%o`TNP;JsF@xp* zHuu2Ea;_KkI`4^xIB{cj{!Esa z!^cNl!SERi(cwR1)~}3dT zA5VAf^cTTtT6o-2D4n-dkTLeEOaJVJ4@?&!t74!LFJcpUALArotcQ;Dp89hP#O)tJ zn(V<6dfK=lp@lJD;y@mD)G1O=Ysh-1JY@N35bnz2WJm9AII(|q5uBuA2mV$qM(1T uh^bRzX2h(=0Q}g0Yn531Z#5R~Z~^m&Jx<`nIZW9WKuI1XS0Vc$=-&WiPr^0; literal 10160 zcmb_?1yEdFw`IrB27*f<1oz)afA=x7%Cn@XfK}=PuQuuQhoyT^i%6V z%W0$!ag~Dr@95j=XqpJN(09k^8MCK>?jnu{H{VDoe+C;MeX}sq@Ansd-8Q>7?|VI0 zA?^0XB_)3@FXEXwy76-5SZIH)3)7RNPBqj z{)qfC^?yB-*!4G*C;mV{Y;)s{Q!U5sORFl$AR(ZWOl16JO|Kjg0AG<}*#Z9I{?Jzd z;s7{4Cqh7+A27VWo5g_=AK9+KkX$#zH+Z*GGh$G5{1W_^v%O;66B z9}~`x(mV)#x&|L~9l1O6N0-iU!ssAHwGH~cz~Jh6R9YOs2J+Yl(e<-zl|@Z*+$4|L zH1_eLb_h)c{{iyb$A-~yL0>9jyAJRlLM=|FMpymKt`GSKN0oi-Q%ZUyGHy*(6D|=P zM7BEfnz(b4^-19-bbdVuoIn6zZU=X)Fc~x1F*$2%SkA5P8sYQh+p3W(=rL*w!kZDh zwA;fzc6$SX4ZPzEc1;BP^tkrtTn3(B*-1%s@g=o~6}H7%*0}~YM{3%#pkH!an$viB z53$myso$c9t@1zjU)SXz{6= z;avW~g+slrJSl-o-FB-PYu})`KG(c~7}nAxQMxkX_~~y_ZF+wqff}h?W7-%m@9*9O zOWiaH^Gsv_OTX4|T9x2U|73gDpFdN)9@2bbDR<;6iync~MQ%!2zvI|%b7{7>w9`m^ zW;3?NTWzBU4!J&a$?Ai>$#KMGZ>`!V!Aqy+9v>wVXOY}kNpk7pU#a;;#qZHHrpH>y zjt$6qMn0`lQ3-_1ls}X>Rzl>*Bz)w`d&C5V^%j*$U=KXh@_6rk2 zvsy|hMdgeiWMr8NJ^)ypFD6E2zCgqzVTrKi$l8y77M^x<%)$?Mq-(c#9gn9EejfMT zYaK49MSeGh>ti549lu*?m&44g-H4h8ZEbT$srg4WTu!s*B3WCVhW=umr?KGp)*!W$ zI*vh*`qhpC*DlN5z(8;I{^FfNzWFWVa;ujUsI@6g(nn@mX7xrOhL&!vsY5Y5v*r~b zB=mH#L*ZpA>?xE?9b^m($JvK*b}}h=<`S*iaa4UE z$`ttab)gEqUBi;<3zQkk{~$!TXCUpJX9NIJ2L~O^n-*S>Y3B8RLAckOK)|2(pCAB0 zD1i43famRhf}!XG{hz(rGRJ=~GP*>qXv*MW5E&4A_D5O~0FZw5U#$NtbpCHT{(mzi zh=aa+{cS?%zIJybL_CxzJsrKa)_Zb`-}mX^wz9HPnU)qRm2fAg38b2}CI8H;j65{% zm>7FcE=ix^|JIgOkWQ9Yt;DH06u?v{(bWxBLcrtzsd2hF+^J0PxJau!ARyd zv+l*MVlDCQ`bG>o2giZ+@^e>Lzp#(<&(re>VPVf&_;OR#XM^U0>-)eiLt3103G%;R z-6^YX7+0i9!kSS^+#_OwiAv8TmrrE-SoI9FHPlp6pjR>6idG{s1Q`yg7pnc|XM}Ok zrhFN@)%+$@Jku=&$EFq4bQ*%_i~D>2$}9bc!j)qT41@yT4vs$O)lp=6U zgRf)puE@qyVAQ?v{RJ#5%dQzM;-K?8t^NUS&dh+U?JJXk6L_RXx@MK@&0`?UT(_Zo z=gMp(WljI$uzSf)r{HdieTH}AxWm5U{`En zR+`tw!-p6W%l5CQxr408wO>+psOQ#&x}HmlQg?8H=Sh=FeM3#vyaURWa_a9A)kn3oWx0+>bWo&O&!mQTb5#lD zBI&=|P%}jZJmf7IgVAs+getnlEMzxvCJ))-KVkdSq?UW^OYqP9jH1q%W$|2y?PEbV zVJRUS8E7uxl4C7Pjn84_rJ)Za>v8zTyoe>v(A(bLzO}X0+}w6~=~BU@aNK_V#C>?! zrOfjl1q~tasY^uo-u|b3=i18J+U$~FFl9MxdmohILo-2acggAfu&Z6^!#+( z^0~p_c0;E_*cV!bB^^}1U@BU#Jc+n#(7bl;zLso^87`L_Wa_MPSIbBXArY<^2UUcN zC=9LuMfI>|6W&Ehe)m?$FbQByHY2xDNh|i%C_tisrRA%V<>6Ta_Z-=B3zK>rh|2n; z=A~snH%B+oQB!E75sb`=p)}XjvVdM}YGw+iW|bp2n$v#VN?u2@q7l}WZzSiUW;pBR zZi2D;*g}+Nky>CdLl*a^?pqAu>5JnA}l`-9p>Uf zz+P*Ho?x(4Gyh0JR?^?0A(@FGx$N{5e#lkiyYsEjbb|)%2lY)(=G&WF!2#bYD_1S2 z3x_2sL#OI+Ia}Z#Mvi)PvS{H_duu7TfvFFrMGQnScRR^bo?7jp@69-uO@rfKZg=#C zDM32X-^MDXdrH3)Kv!GR#6IC5#o=|1Ei+qMMyi$JIZBNxGrhGqZ1hnk zTpx#2R58VEExp&d=W2x*!>ae4IU~E+uuaadXSg&3#xml+8$oqpM%akcL~P|c!{2q} z)+^a5xs}-L7Ls6YPdDRpez%wK5zQm*y3!v%{wy~+4MdaVrGdfe89#POo=Gup*GT=e@*$OsQd94TvS^RtT?Sy^2m8N31|8{P+9 z7ag5Tr%(k&#(m#+w^!YZ)G?^{Kq{uO{t?Qf3HxVPLfK0m*OA%lp+N$3P{R247Q30W zpPa-}ebmZ22g8fsFoa6IHhwKVJM1J(2-(>Rx^9i8iFODx%4Rv=W$Vn=eC0VS!X_!= zN9e{pqyXJ&3ukl{G)?V1f7Y~D!U!`o{NctzAft5swJJZZqfobWrL{?8szlr5@S`uy zI=7aq(g?E_{cP;s=>i$sOl^B!)LEXbMzf8a1eDx8QQ(>K*1b}yN%DiNa%GOvMQXBG ze}7a)Q{1AvDNc{Ye{8qF(EIUd7wV9$Dmv!qp~aR)t+cqAW3G(X8LTrz>Bit5Ot#2y zssg5=o=PZu6csLb5n9`XU(@5X{E?2GJ;85U%(19R(0LRmLiRTzP1R_2mRD|D%E*Vu z>}Lv71@xcHkPD0(y3nr{EMp1@_0GIpmcN$0EEUF7A8UTN?@op;dM~s%SY~=7(yeSQ zk%wtJj+%hdWzTP6aM&o1<=Btg+=IuH$pY7H#?w-1mC%vKl^4$o)=oxEJHJ5VDG#Ds z(a==siNXNEoBIm8S-`{D%sK{Wrys1r*^Q8ae4Y_`Abd-cbB5`Q;}#*zEDJhUr^B}U z-f4YKS)3bPq0H8afKo*Gx2=YJ46AJS2m}YyAYK`ws`21?&)o9yF6Cegmtp+Db1&P? z#r5JBJsUGOtPS=Y&3|;#sAt1PEt%zaKT>dB=sUf5pM9Jvoi?p2kIA}w5`5IX=%F6F zcIq< zwbZV6F+`&PGarMpnW?(DO=L4cA9o=Jt3UsQjAqygyB4m@uO|FGl^+_viFVtHbIL@s zO)1=R=X!!aST1I5p$ak|3iI=_w;kwAAGNX`uO}VlF-f1}kG8n~T{z&4NMY1w90maV zjYJ!??yTKhx8$76%oK;mhjW|0*elt)xiwG*-`(8{e&m+)_4?~_zr-hG)8@StuuB=) zFq)y-MDORQvDNdueR3S5`}_2?>B}uU$Ues(h<;Hm9wtY3LmP1oXiG_wn2j|6$ zqIfwzvZ@Q2)J-c#-y@iC5fKq-;Q1K93y8VtRBI&-<>MJ*!*h=tD!ZWF6(bY*6_OEvr(8xS|ujk9o;Ox~l9v*^R;Qjq$Q$|#FT)07-Gr0ufeFr;e$OP`2k^-CGF_?vCr~6p5vzhvFG`tN=6lmmV8p5|z@DFLx1-k5^8YxP8yNi|h|t zy>I-V_p#rkOoTo>CI&6j4T;E*Bj-H_V19Ob5X}Ukyc4f1FK1K%uqc;4=|}wOpvE-t zhD#qf^*xk^AU8&h-^|G|tf-4u-^V6YGe9V%pPpXDj7Ua|iF69H{1NtTJuIsl&xc(3 zyf{7`!jC(`ZOUKnH2vcKqLA=A8$M_K=5~8(&bexUWC-o>IOOj?q=^_{gk|tKfUX;5 z@Zkoi08nd0MAF)9-C>DdvsnaX`!_}DyEOrSvbZ4TRR6HB!$rb15Cv8tT?zv~js0A? z_DF;#PRc{kbo=V_>D2S%n7x6Y@AUJ-W?rH8wBGe2yy4@+Q6?N?rNa?Uvbb9bf-FT7 zyFagJy0$()yK;0q&y_Hv>+yI%>2!E_%+5^X?oW)|3}J${n_s{O)#E=ZH!iNfauR3S zwt6Sp0G07x|LtaPST&%saw8&qa$*u9Gr6mCSLjk@)j21z)dj!jd_^d?6{7f~SB`xK z*z^IG&dq6ul}UvjV)Z>Jtif^JuD>5;b85HBp@?XVR#kh3%rk~$3nwWQx={L*%Xh~@ zKw&d6-fiSZdol*MpVE!L-g@vjuYBJ5)3x?^O7KX)bjK-M80zoQF3scQD(7 zpTZIZqewsUU3sV}4Wz(|LXKMYuUz)qpF7`NGeL!08a5u{VuVtKpZggyeR!K>Z?#~j zC+jJU80C19ivK5-}-9Pu=GvzP0#Ib&h%OQyMmO)uAMrHo%$3VMR`G8z+Tx_mb@)MSi$6 z`%>`!7WxIulC_Y;-mv6zR0iYrz{khMC9x5>c{rc&yIX{CJM?c^F?$D25cE6{G z)@8y>&8qNa>7bf#VGdPT;PTlW1R^J8Q-8F{o29hk#To+(XX5DVF|tHg|mhP^-RWD z{i|FYt^`{1Wc9czFJW@MJZe97i{n+>v9S9V$Y3On+4s5Mk5Rj3b6fcNwxVH`2>5pH zacoUpT|G87ZX!$2%X}==VIUlr-FzG>Xx*Rbw(4=d9xyab<9B&^t7)+GIDFLnh!~T} z3w(#1d!|nJw|5=;9y|1sASIgRQiW31Ho>$VZOPTQQ zqd!|-rLl&z4I1fhPyO;(>`+Z0YB(7>@Sn5!Ms7rc@|;}Bw(4_VHw|D8dG246k)}t- z_`gL=_ng(q{q1StKA&Z}Ca)Emk%^^zwKe-GzBx(Fn{nUpwS9%%Jl%P1p$Rg^WIuX~ zWAgiSTfJ8IIJ@k$v@}9OLQ1E!#e+$LmD%&Nv$ON_6eb z7S-VgV&X(60@jc=xn9Q@+iyLZ5rtl*KMTZ`1@(8p(TjNfg%E8#l`OtO+<#Us*p-j=cd!AY}@y+0!`ue z?xnfk>KOIyN(3VZ-e?z;pW4zTFQCcw84}>%l1@dH^Rv=fEM+0zLJT%6CHLvQA{c#3rCQI(YG#Xw zL<(0t_<4_Domv?oS{7KQ%QeJQtuzOfI=_;M!jnvOu7$f_xzhdpSCd%N1Zk? z(*;ZWHJU6rXUu4!V;RItZ)@n%Xhlsl7;{+CZZN)$kB^f+orG4k-<9%g{URfzlOv9a zhA!&c;4yQ_H++b>lQ7(Hni@$gu#c!cHEKtwsJaL*qKM<$<*jD4U3Pb7YEb8}TNX&4 zczq+A<5V(!xD?F|!nKCa0<+f|zNe?CA8#t@sppkImR5g^TWfFB^we%gFc)(LqN`^@czRAF@a0rm;RRA*9yIZwsq~zmkxkaSn5FgFmmPd0k%ZEQSZekj zX5SF@SAjnf$`Q0(S{TTps3A^TJGp~vJ6aq0lLm5YJsdIX^|r`X$#!EZU?GH!P>n#p zg9f{q7x!!;D*qt^m8#&$Iov97DW#XR2kYVUKxAQ-Gg;D%glzaD(8H?4^?VCFwAv|i zf$TppMdOY?Md{!f5q_vDFpufKy=5$`IgmD?*{K#V zlb@EcSnP4NCS@4ivqY)Tw4hG@BgZnvWKJL*Bi=%xMi?~QI+yx|L!7vlx;UK699&4| zOoMJ?RzZ)$ubkz%+x?q@t1S?ytsaOqw-h275c7KT*55mS3^=2;HI(hc#&OAcN;#ZHSVDD@-|V_rnzP<(McGoqn<`CcW%q&ulRh|xqsphoL-NMRHKmB* zp_MpH`W5vy>U!!etD+^)K{?U_1}V<|Mr^6<9eD|qirhO-tFH;Gx$yT1MjV9|TS@UT zwR2qNngm>U^7mDd1>MOI$_yUF;yex>IaEEFMB9hkWGQ;RS6ly z`2%!k9v+m)&JrE@^n(PA_rq}2>&{q96VgQw>k;?_;wza~s_ws{z3=<)K(SP007r6W9_(zC^y%Z~v21 z{Wmc{e52A?V>Ti|`&mIjf&48%#)0^LhWXK%&kkY{Buv(IAx~HK3 zr=LE)mnaoC?)^C*kb&XbVeM%~_VT!_qb5V|kVXWNEabJ*CkQduU@Mc-BxMpz?YA`~ zbW+O({g;GYm;o{Goo0YWC~L>wI`ANeGQ}2O&uQn{(W3*cd!T@Qdz>Izd)4 z8~>q5Di8ZUM%GLeQyPH@#-6p^QEL%qW!@v8jbZ8qX79XoG!S3NMlSd zwE9zD_fpl(K(qGTF<6?hhFDZZB@Rg&8*b8cYOW_aQ+Wnv`K=cxMT;-y% z@$Opj*{r&w7QeDGiLro*lUe{DcLIAcPA3s{XsQY*mPg0L|6P(Pxt?=}WJ{dr5b-Z$ zG8X;~t#)OV=VU2g5Y5ar)>M>+kU8RH>Rm=&>&Vp2(Nk)J2pCfh4W?eVzv!i8vPL11 z)!KQtG6q+wZfLKoPP2MQxz?Ib{$7IY60i&6&10KvTbfKI^RQxOCsy62UBq%wOhAD% zulnIUD3NN&mBwqc%8QrKsL)-_u040IY z+NS;I)RuCXD{S%2JXS1wz{+duVP}(E+x@xJQzLI?qlXj_wP#F@kHxR4U<+si5@RW5 zW@*0n_7mTb`%B8EUcY^c_8&TNJ7v-*8ukxoC<1D@Eu~_e-*yvkJ|6xTXK0(9 zjOWeU={)(TD#tA%LW`ERU z(nXoTf&MDyweU!Vq0-)jc9h5KmT$QKf`V8$kn}}SLj3=oCj6H}{eRZ$`zo|{&&yKc zmlR;4$=*!K1^$bB{~yYa|Fa(cF9!R!Dc8Irk=pZaE0SKB?&G2^X86`iB#oJ4o#b`g zrWpkM;k51??Xx*nM+T97 z*jgwy;R@2%J&%v%v9OsSsWXa-i39$z#Rl^U`i;x$)r7LE@6GPSd;p^1p ztLY*?sy44f{UJ$X;DJ}+B_Z*UL%aZ>_2;X_l3lddqYuWzQe1AEA((N^evnzGp z;%&Uu>Op8^(-KgBfi;cOZod4vym_&#UKuwUL45CYRi|Z6u-{(4d{#-QM8ND9(=fbV zrFKeYRoJmA_5-ZYdqQMfHG%w?98;Bdlb`POgiu+et+er!YyS%KiP`)v$-Zk_vBi82 z#OHdXUflRf4xiQ_(5dlHge0#?XnvtQCc0otco~{PUtP<5j>d77`$n;)4fTj&nF_VO z+ggX+yiP04s#jT^%nKxzu8|lQeyTq+9f@+r+Fwr%Xn}8Au+3< zmuU(Qb$C|ECO)rT?-@8!=_ohSNOAtegsv+>>nHnVfgU5on?3 z#6uGAS#TvxcbNnR8!S%XAZOUlh4CWCZlP|0cAHpIs!Lw!J996sVvcgtKd(2d3dMBil`YW|y zo{$|o!i!S?o7p_VS3HjW_;(-h^k=j7R9v1Y#U^}9Kr*kMy#z1H;H1$RL$AP1Q;6a; zcygmXz#Yau$>6A3876-N&o8BOQN{~AAWLyT8ocJ16&A$eS*W?l_pTjTr ztoN@PP^*Ic%#)hxj3!!8>A^WD#zZ_Qe(_qU|69e^YoSGXBKJ#Vp+$~&**5)TP1!bL zhv|9@3mym&@0Ppm2B?(-WU6rrZ%M}XTu OEwYk|5|v_x0sjL|e4yk2 From b10a36ba67f947009d694f71459ba3f797a6d25f Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 11 Apr 2018 15:34:39 -0700 Subject: [PATCH 025/215] added checkbox --- .../create-and-verify-an-efs-dra-certificate.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 4e8e4aeaea..51a816a4fa 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -85,7 +85,7 @@ It's possible that you might revoke data from an unenrolled device only to later Where "*new_location*" is in a different directory. This can be on the employee’s device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent. - To start Robocopy in S mode, open **Task Manager**. Click **File** > **Run new task** and type the command. + To start Robocopy in S mode, open Task Manager. Click **File** > **Run new task**, type the command, and click **Create this task with administrative privileges**. ![Robocopy in S mode](images\robocopy-s-mode.png) From f875ba523cf782a8dc6195224d222d72ef9569e8 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Fri, 20 Apr 2018 16:08:27 -0700 Subject: [PATCH 026/215] Converted lists of apps into tables --- .../remove-provisioned-apps-during-update.md | 220 ++++++++++++++++++ 1 file changed, 220 insertions(+) create mode 100644 windows/application-management/remove-provisioned-apps-during-update.md diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md new file mode 100644 index 0000000000..8fcf556e1c --- /dev/null +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -0,0 +1,220 @@ +--- +title: How to keep apps removed from Windows 10 from returning during an upgrade +description: How to keep provisioned apps that were removed from your machine from returning during an upgrade. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.author: helohr +author: HeidiLohr +ms.date: 04/20/2018 +--- +# How to keep apps removed from Windows 10 from returning during an upgrade + +>Applies to: Windows 10, version 1703; Windows 10 version 1709 + +If you upgrade a Windows 10, version 1703 computer to Windows 10, version 1709 or Windows 10, version 1803 (or a Windows 10, version 1709 to Windows 10, version 1803 upgrade), provisioned apps that you've removed before the upgrade may return. This can happen if the apps were removed while the computer was offline. If the provisioned apps were removed while online, the apps should not return after the upgrade. + +When you remove a provisioned package from a Windows installation, there are two points where this can occur: + +* Offline is when the packages are removed while the wim file is mounted. +* Online state is where the provisioned package is removed while inside of Windows. + +When this happens, we write a registry key for a deprovisioned app when each app is deprovisioned, so that when we upgrade setup can use that key as an indicator as to whether to install or not to install the app during the upgrade. + +The registry keys where this is written is under the following location. The keys listed serve as the list of apps to not be installed during the upgrade. + +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] + +There is a new registry key written for each app that is deprovisioned. There is no data fields under that registry key. The registry key is the package name of app to be removed. +Example Registry key for Calculator: +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe] + +This functionality was built into Windows 10, version 1703 to capture the removal of the deprovisioned app and write the registry key. The setup code in Windows 10, version 1709 knows to look for the registry key and not reinstall the app. +However, the offline scenario was not working in Windows 10, version 1703 and Windows 10, version 1703 so the registry keys were not written when the apps were removed while Offline, this was addressed in Windows 10, version 1803 so the registry key will be written when the app is deprovisioned while offline, so that RS5 setup can properly identify de-provisioned apps and not reinstall them. +The offline scenario was also released in a monthly quality update for Windows 10, version 1709 to properly write the registry key when the app is deprovisoned so when you upgrade to a future version the apps should not return. + +There will be scenarios where the apps were deprovisoned while offline prior to any changes being installed to Windows that would have corrected the behavior when removing the apps. + +The following is how to generate the registry keys of the deprovisoned apps so that setup will honor the state when upgrading. +The registry keys can be added that show the app that were deprovisioned so that when you upgrade to the next version the deprovisioned apps should not return. + +The location in the registry where the keys are written is below +\microsoft\windows\currentversion\appx\appxalluserstore\deprovisioned\ + is HKLM\Software on an online running system. In the offline case, it's wherever you mounted the Software hive. +A new registry key is created for each de-provisioned app, there are no data values under the registry keys. The existence of the key is all that needed. + +Below are the lists of Provisioned apps with Windows 10, version 1703 and Windows 10, version 1709 including the Names of the apps as well as package names which can be used to generate the registry keys if they are not present in your installations that you wish to upgrade and do not want the deprovisioned apps to return + +List from Windows 10, version 1709. +This is the list of apps that are provisioned with Windows 10 1709, listed by app name (DisplayName) and by the package name (PackageName) which is used when generating the registry key. + +|DisplayName|PackageName| +|---|---| +|Microsoft.BingWeather|Microsoft.BingWeather_4.21.2492.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.DesktopAppInstaller|Microsoft.DesktopAppInstaller_1.8.4001.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.GetHelp|Microsoft.GetHelp_10.1706.1811.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Getstarted|Microsoft.Getstarted_5.11.1641.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Messaging|Microsoft.Messaging_2017.815.2052.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Microsoft3DViewer|Microsoft.Microsoft3DViewer_1.1707.26019.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MicrosoftOfficeHub|Microsoft.MicrosoftOfficeHub_2017.715.118.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MicrosoftSolitaireCollection|Microsoft.MicrosoftSolitaireCollection_3.17.8162.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MicrosoftStickyNotes|Microsoft.MicrosoftStickyNotes_1.8.2.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MSPaint|Microsoft.MSPaint_2.1709.4027.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Office.OneNote|Microsoft.Office.OneNote_2015.8366.57611.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.OneConnect|Microsoft.OneConnect_3.1708.2224.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.People|Microsoft.People_2017.823.2207.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Print3D|Microsoft.Print3D_1.0.2422.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.SkypeApp|Microsoft.SkypeApp_11.18.596.0_neutral_~_kzf8qxf38zg5c| +|Microsoft.StorePurchaseApp|Microsoft.StorePurchaseApp_11706.1707.7104.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Wallet|Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Windows.Photos|Microsoft.Windows.Photos_2017.37071.16410.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsAlarms|Microsoft.WindowsAlarms_2017.828.2050.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsCalculator|Microsoft.WindowsCalculator_2017.828.2012.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsCamera|Microsoft.WindowsCamera_2017.727.20.0_neutral_~_8wekyb3d8bbwe| +|microsoft.windowscommunicationsapps|microsoft.windowscommunicationsapps_2015.8241.41275.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsFeedbackHub|Microsoft.WindowsFeedbackHub_1.1705.2121.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsMaps|Microsoft.WindowsMaps_2017.814.2249.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsSoundRecorder|Microsoft.WindowsSoundRecorder_2017.605.2103.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsStore|Microsoft.WindowsStore_11706.1002.94.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Xbox.TCUI|Microsoft.Xbox.TCUI_1.8.24001.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxApp|Microsoft.XboxApp_31.32.16002.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxGameOverlay|Microsoft.XboxGameOverlay_1.20.25002.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxIdentityProvider|Microsoft.XboxIdentityProvider_2017.605.1240.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxSpeechToTextOverlay|Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.ZuneMusic|Microsoft.ZuneMusic_2019.17063.24021.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17063.24021.0_neutral_~_8wekyb3d8bbwe| + +Below is this the list of registry keys created after removing all the provisioned apps in Windows 10 1709. This registry list shows all the values for each of the provisioned apps that were deprovisioned. +The indented lines can be copied into notepad and saved as .reg file so they can be imported into a Windows 10 registry that has deprovisioned some or all of the apps and is missing these values, so the apps will not return after an upgrade. +This is the complete list, you would need to remove the lines for the apps you wish to retain during the upgrade. +1709 Registry Keys +Windows Registry Editor Version 5.00 +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.GetHelp_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Getstarted_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MSPaint_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.OneNote_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.OneConnect_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.People_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Print3D_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SkypeApp_kzf8qxf38zg5c] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.StorePurchaseApp_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Wallet_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Photos_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsAlarms_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCamera_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\microsoft.windowscommunicationsapps_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsMaps_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsStore_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Xbox.TCUI_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxApp_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxGameOverlay_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] + + + + +List from Windows 10 1709 (Windows 10, version 1709) . +This is the list of apps that are provisioned with Windows 10 1709, listed by app name (DisplayName) and by the package name (PackageName) which is used when generating the registry key. Packages can contain one of more apps. + +|DisplayName|PackageName| +|---|---| +|Microsoft.3DBuilder|Microsoft.3DBuilder_15.2.10821.1000_neutral_~_8wekyb3d8bbwe| +|Microsoft.BingWeather|Microsoft.BingWeather_4.23.10923.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.DesktopAppInstaller|Microsoft.DesktopAppInstaller_1.10.16004.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.GetHelp|Microsoft.GetHelp_10.1706.1811.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Getstarted|Microsoft.Getstarted_5.12.2691.1000_neutral_~_8wekyb3d8bbwe| +|Microsoft.HEVCVideoExtension|Microsoft.HEVCVideoExtension_1.0.2512.0_x64__8wekyb3d8bbwe| +|Microsoft.Messaging|Microsoft.Messaging_2018.124.707.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Microsoft3DViewer|Microsoft.Microsoft3DViewer_3.1803.29012.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MicrosoftOfficeHub|Microsoft.MicrosoftOfficeHub_2017.715.118.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MicrosoftSolitaireCollection|Microsoft.MicrosoftSolitaireCollection_3.18.12091.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MicrosoftStickyNotes|Microsoft.MicrosoftStickyNotes_2.1.18.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MSPaint|Microsoft.MSPaint_4.1803.21027.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Office.OneNote|Microsoft.Office.OneNote_2015.9126.21251.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.OneConnect|Microsoft.OneConnect_3.1708.2224.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.People|Microsoft.People_2017.1006.1846.1000_neutral_~_8wekyb3d8bbwe| +|Microsoft.Print3D|Microsoft.Print3D_1.0.2422.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.SkypeApp|Microsoft.SkypeApp_12.1811.248.1000_neutral_~_kzf8qxf38zg5c| +|Microsoft.StorePurchaseApp|Microsoft.StorePurchaseApp_11802.1802.23014.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Wallet|Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Windows.Photos|Microsoft.Windows.Photos_2018.18022.15810.1000_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsAlarms|Microsoft.WindowsAlarms_2017.920.157.1000_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsCalculator|Microsoft.WindowsCalculator_2017.928.0.1000_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsCamera|Microsoft.WindowsCamera_2017.1117.10.1000_neutral_~_8wekyb3d8bbwe| +|microsoft.windowscommunicationsapps|microsoft.windowscommunicationsapps_2015.9126.21425.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsFeedbackHub|Microsoft.WindowsFeedbackHub_2018.323.50.1000_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsMaps|Microsoft.WindowsMaps_2017.1003.1829.1000_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsSoundRecorder|Microsoft.WindowsSoundRecorder_2017.928.5.1000_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsStore|Microsoft.WindowsStore_11803.1001.613.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Xbox.TCUI|Microsoft.Xbox.TCUI_1.8.24001.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxApp|Microsoft.XboxApp_39.39.21002.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxGameOverlay|Microsoft.XboxGameOverlay_1.24.5001.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxIdentityProvider|Microsoft.XboxIdentityProvider_2017.605.1240.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxSpeechToTextOverlay|Microsoft.XboxSpeechToTextOverlay_1.21.13002.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.ZuneMusic|Microsoft.ZuneMusic_2019.18011.13411.1000_neutral_~_8wekyb3d8bbwe| +|Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17122.16211.1000_neutral_~_8wekyb3d8bbwe| + +Below is this the list of registry keys created after removing all the provisioned apps in Windows 10 1703. +The indented lines can be copied into notepad and saved as .reg file so they can be imported into a Windows 10 installation that has removed the apps and is missing these values, so the apps will not return after an upgrade. This is the complete list, you would need to remove the lines for the apps you wish to retain. + +Windows 10 1703 Registry keys for removed provisioned apps + +Windows Registry Editor Version 5.00 +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.3DBuilder_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.GetHelp_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Getstarted_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Messaging_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MSPaint_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.OneNote_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.OneConnect_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.People_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SkypeApp_kzf8qxf38zg5c] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.StorePurchaseApp_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Wallet_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Photos_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsAlarms_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCamera_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\microsoft.windowscommunicationsapps_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsMaps_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsStore_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Xbox.TCUI_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxApp_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxGameOverlay_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] + + +Notes: +If you remove the provisioned apps while online, the account that you logged on with will contain the apps, they were installed for that user. Therefore, if you do an upgrade, that user will retain the apps. Users that were created after the apps were removed, or after the upgrade will not get the Apps installed, the removed status is honored. + +This setting only applies to 1st party apps that shipped with Windows 10, this does not apply to 3rd party apps or apps that were acquired from the Microsoft Store, nor does it apply to LOB apps. + +The list of apps may vary with each feature release of Windows 10, apps may also change in Status for instance go from Provisioned Status to System app or Vice Versus. This only applies to apps that are provisioned for the host OS and the OS you are upgrading to. + +This does not apply to upgrades to Windows 10, version 1703; the setup code to honor the removal for all users was enabled in Windows 10, version 1709 From f75fefdd1378387ce4e4cde469d8aa99a80ab602 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Fri, 20 Apr 2018 16:40:01 -0700 Subject: [PATCH 027/215] Began editorial fixes, put lists in code blocks --- .../remove-provisioned-apps-during-update.md | 36 ++++++++++--------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index 8fcf556e1c..e4e8b6f4da 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -14,20 +14,21 @@ ms.date: 04/20/2018 If you upgrade a Windows 10, version 1703 computer to Windows 10, version 1709 or Windows 10, version 1803 (or a Windows 10, version 1709 to Windows 10, version 1803 upgrade), provisioned apps that you've removed before the upgrade may return. This can happen if the apps were removed while the computer was offline. If the provisioned apps were removed while online, the apps should not return after the upgrade. -When you remove a provisioned package from a Windows installation, there are two points where this can occur: +There are two points during removing a provisioned package from a Windows installation where this problem can occur: -* Offline is when the packages are removed while the wim file is mounted. -* Online state is where the provisioned package is removed while inside of Windows. +* If the packages are removed while the wim file is mounted when the device is offline. +* If the provisioned package is removed while inside of Windows when the device is online. When this happens, we write a registry key for a deprovisioned app when each app is deprovisioned, so that when we upgrade setup can use that key as an indicator as to whether to install or not to install the app during the upgrade. The registry keys where this is written is under the following location. The keys listed serve as the list of apps to not be installed during the upgrade. -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] +```[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned]``` -There is a new registry key written for each app that is deprovisioned. There is no data fields under that registry key. The registry key is the package name of app to be removed. +There is a new registry key written for each app that is deprovisioned. There are no data fields under that registry key. The registry key is the package name of app to be removed. Example Registry key for Calculator: -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe] + +```[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe]``` This functionality was built into Windows 10, version 1703 to capture the removal of the deprovisioned app and write the registry key. The setup code in Windows 10, version 1709 knows to look for the registry key and not reinstall the app. However, the offline scenario was not working in Windows 10, version 1703 and Windows 10, version 1703 so the registry keys were not written when the apps were removed while Offline, this was addressed in Windows 10, version 1803 so the registry key will be written when the app is deprovisioned while offline, so that RS5 setup can properly identify de-provisioned apps and not reinstall them. @@ -39,8 +40,10 @@ The following is how to generate the registry keys of the deprovisoned apps so t The registry keys can be added that show the app that were deprovisioned so that when you upgrade to the next version the deprovisioned apps should not return. The location in the registry where the keys are written is below -\microsoft\windows\currentversion\appx\appxalluserstore\deprovisioned\ - is HKLM\Software on an online running system. In the offline case, it's wherever you mounted the Software hive. + +```\microsoft\windows\currentversion\appx\appxalluserstore\deprovisioned\``` + +Where `````` is HKLM\Software on an online running system. In the offline case, it's wherever you mounted the Software hive. A new registry key is created for each de-provisioned app, there are no data values under the registry keys. The existence of the key is all that needed. Below are the lists of Provisioned apps with Windows 10, version 1703 and Windows 10, version 1709 including the Names of the apps as well as package names which can be used to generate the registry keys if they are not present in your installations that you wish to upgrade and do not want the deprovisioned apps to return @@ -84,9 +87,11 @@ This is the list of apps that are provisioned with Windows 10 1709, listed by ap |Microsoft.ZuneMusic|Microsoft.ZuneMusic_2019.17063.24021.0_neutral_~_8wekyb3d8bbwe| |Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17063.24021.0_neutral_~_8wekyb3d8bbwe| -Below is this the list of registry keys created after removing all the provisioned apps in Windows 10 1709. This registry list shows all the values for each of the provisioned apps that were deprovisioned. -The indented lines can be copied into notepad and saved as .reg file so they can be imported into a Windows 10 registry that has deprovisioned some or all of the apps and is missing these values, so the apps will not return after an upgrade. +Below is this the list of registry keys created after removing all the provisioned apps in Windows 10 1709. This registry list shows all the values for each of the provisioned apps that were deprovisioned. +The indented lines can be copied into notepad and saved as .reg file so they can be imported into a Windows 10 registry that has deprovisioned some or all of the apps and is missing these values, so the apps will not return after an upgrade. This is the complete list, you would need to remove the lines for the apps you wish to retain during the upgrade. + +```syntax 1709 Registry Keys Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] @@ -122,11 +127,9 @@ Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] +``` - - - -List from Windows 10 1709 (Windows 10, version 1709) . +List from Windows 10 1709 (Windows 10, version 1709). This is the list of apps that are provisioned with Windows 10 1709, listed by app name (DisplayName) and by the package name (PackageName) which is used when generating the registry key. Packages can contain one of more apps. |DisplayName|PackageName| @@ -168,10 +171,11 @@ This is the list of apps that are provisioned with Windows 10 1709, listed by ap |Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17122.16211.1000_neutral_~_8wekyb3d8bbwe| Below is this the list of registry keys created after removing all the provisioned apps in Windows 10 1703. -The indented lines can be copied into notepad and saved as .reg file so they can be imported into a Windows 10 installation that has removed the apps and is missing these values, so the apps will not return after an upgrade. This is the complete list, you would need to remove the lines for the apps you wish to retain. +The indented lines can be copied into notepad and saved as .reg file so they can be imported into a Windows 10 installation that has removed the apps and is missing these values, so the apps will not return after an upgrade. This is the complete list, you would need to remove the lines for the apps you wish to retain. Windows 10 1703 Registry keys for removed provisioned apps +```syntax Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.3DBuilder_8wekyb3d8bbwe] @@ -208,7 +212,7 @@ Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] - +``` Notes: If you remove the provisioned apps while online, the account that you logged on with will contain the apps, they were installed for that user. Therefore, if you do an upgrade, that user will retain the apps. Users that were created after the apps were removed, or after the upgrade will not get the Apps installed, the removed status is honored. From 9ce7907c98436d837a61e2e31a9fbc0ec1679405 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 23 Apr 2018 11:48:11 -0700 Subject: [PATCH 028/215] Continued translating document into more readable language --- .../remove-provisioned-apps-during-update.md | 207 +++++++++--------- 1 file changed, 104 insertions(+), 103 deletions(-) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index e4e8b6f4da..ffc041219b 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -10,127 +10,47 @@ ms.date: 04/20/2018 --- # How to keep apps removed from Windows 10 from returning during an upgrade ->Applies to: Windows 10, version 1703; Windows 10 version 1709 +>Applies to: Windows 10, version 1703; Windows 10 version 1709; Windows 10, version 1803 -If you upgrade a Windows 10, version 1703 computer to Windows 10, version 1709 or Windows 10, version 1803 (or a Windows 10, version 1709 to Windows 10, version 1803 upgrade), provisioned apps that you've removed before the upgrade may return. This can happen if the apps were removed while the computer was offline. If the provisioned apps were removed while online, the apps should not return after the upgrade. +If you upgrade a Windows 10, version 1703 computer to Windows 10, version 1709 or Windows 10, version 1803 (or a Windows 10, version 1709 to Windows 10, version 1803 upgrade), provisioned apps that you've removed before the upgrade may return. This can happen if the apps were removed while the computer was offline. If the provisioned (added) apps were removed while online, the apps should not return after the upgrade. There are two points during removing a provisioned package from a Windows installation where this problem can occur: * If the packages are removed while the wim file is mounted when the device is offline. * If the provisioned package is removed while inside of Windows when the device is online. -When this happens, we write a registry key for a deprovisioned app when each app is deprovisioned, so that when we upgrade setup can use that key as an indicator as to whether to install or not to install the app during the upgrade. +When this happens, write a registry key for the removed app when removing each one. This way, you can use the registry key to indicate to your deployment whether to install or not install the app while you're upgrading it. -The registry keys where this is written is under the following location. The keys listed serve as the list of apps to not be installed during the upgrade. +Registry keys for removed apps are listed as "deprovisioned" and written to the following location. The keys listed here are for apps that should not be installed during the upgrade. ```[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned]``` -There is a new registry key written for each app that is deprovisioned. There are no data fields under that registry key. The registry key is the package name of app to be removed. -Example Registry key for Calculator: +Each deprovisioned app gets a registry key with no data fields under it, just the package name of the app to be removed. For example, the following registry key is for the Calculator app: ```[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe]``` -This functionality was built into Windows 10, version 1703 to capture the removal of the deprovisioned app and write the registry key. The setup code in Windows 10, version 1709 knows to look for the registry key and not reinstall the app. -However, the offline scenario was not working in Windows 10, version 1703 and Windows 10, version 1703 so the registry keys were not written when the apps were removed while Offline, this was addressed in Windows 10, version 1803 so the registry key will be written when the app is deprovisioned while offline, so that RS5 setup can properly identify de-provisioned apps and not reinstall them. -The offline scenario was also released in a monthly quality update for Windows 10, version 1709 to properly write the registry key when the app is deprovisoned so when you upgrade to a future version the apps should not return. +Starting with Windows 10, version 1703, the setup code knows to look for registry keys in this folder and will not reinstall the apps listed here. However, in offline mode, the registry keys were not written when the apps were removed. This issue was addressed in Windows 10, version 1803, which ensures registry keys will be written for apps deprovisioned while offline so that setup can properly identify deprovisioned apps and not reinstall them during updates. Windows 10, version 1709 was also patched to correct this issue. There will be scenarios where the apps were deprovisoned while offline prior to any changes being installed to Windows that would have corrected the behavior when removing the apps. -The following is how to generate the registry keys of the deprovisoned apps so that setup will honor the state when upgrading. -The registry keys can be added that show the app that were deprovisioned so that when you upgrade to the next version the deprovisioned apps should not return. +## How to generate registry keys for deprovisioned apps -The location in the registry where the keys are written is below +The following registry is where the registry keys for deprovisioned apps will be written to: ```\microsoft\windows\currentversion\appx\appxalluserstore\deprovisioned\``` -Where `````` is HKLM\Software on an online running system. In the offline case, it's wherever you mounted the Software hive. -A new registry key is created for each de-provisioned app, there are no data values under the registry keys. The existence of the key is all that needed. +Where `````` is HKLM\\Software on an online running system. For an offline scenario, this location is wherever you mounted the Software hive. -Below are the lists of Provisioned apps with Windows 10, version 1703 and Windows 10, version 1709 including the Names of the apps as well as package names which can be used to generate the registry keys if they are not present in your installations that you wish to upgrade and do not want the deprovisioned apps to return +The key won't have any data values, as all the system needs to understand that the deprovisioned app should remain uninstalled is the existence of the key within the proper registry folder. -List from Windows 10, version 1709. -This is the list of apps that are provisioned with Windows 10 1709, listed by app name (DisplayName) and by the package name (PackageName) which is used when generating the registry key. +The following tables list the display and package names for provisioned apps for Windows 10, version 1703 and Windows 10, version 1709 that can be used to generate the registry keys if they are not already present in your installation. -|DisplayName|PackageName| -|---|---| -|Microsoft.BingWeather|Microsoft.BingWeather_4.21.2492.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.DesktopAppInstaller|Microsoft.DesktopAppInstaller_1.8.4001.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.GetHelp|Microsoft.GetHelp_10.1706.1811.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Getstarted|Microsoft.Getstarted_5.11.1641.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Messaging|Microsoft.Messaging_2017.815.2052.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Microsoft3DViewer|Microsoft.Microsoft3DViewer_1.1707.26019.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MicrosoftOfficeHub|Microsoft.MicrosoftOfficeHub_2017.715.118.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MicrosoftSolitaireCollection|Microsoft.MicrosoftSolitaireCollection_3.17.8162.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MicrosoftStickyNotes|Microsoft.MicrosoftStickyNotes_1.8.2.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MSPaint|Microsoft.MSPaint_2.1709.4027.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Office.OneNote|Microsoft.Office.OneNote_2015.8366.57611.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.OneConnect|Microsoft.OneConnect_3.1708.2224.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.People|Microsoft.People_2017.823.2207.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Print3D|Microsoft.Print3D_1.0.2422.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.SkypeApp|Microsoft.SkypeApp_11.18.596.0_neutral_~_kzf8qxf38zg5c| -|Microsoft.StorePurchaseApp|Microsoft.StorePurchaseApp_11706.1707.7104.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Wallet|Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Windows.Photos|Microsoft.Windows.Photos_2017.37071.16410.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsAlarms|Microsoft.WindowsAlarms_2017.828.2050.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsCalculator|Microsoft.WindowsCalculator_2017.828.2012.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsCamera|Microsoft.WindowsCamera_2017.727.20.0_neutral_~_8wekyb3d8bbwe| -|microsoft.windowscommunicationsapps|microsoft.windowscommunicationsapps_2015.8241.41275.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsFeedbackHub|Microsoft.WindowsFeedbackHub_1.1705.2121.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsMaps|Microsoft.WindowsMaps_2017.814.2249.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsSoundRecorder|Microsoft.WindowsSoundRecorder_2017.605.2103.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsStore|Microsoft.WindowsStore_11706.1002.94.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Xbox.TCUI|Microsoft.Xbox.TCUI_1.8.24001.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxApp|Microsoft.XboxApp_31.32.16002.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxGameOverlay|Microsoft.XboxGameOverlay_1.20.25002.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxIdentityProvider|Microsoft.XboxIdentityProvider_2017.605.1240.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxSpeechToTextOverlay|Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.ZuneMusic|Microsoft.ZuneMusic_2019.17063.24021.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17063.24021.0_neutral_~_8wekyb3d8bbwe| +### Windows 10, version 1703 provisioned apps -Below is this the list of registry keys created after removing all the provisioned apps in Windows 10 1709. This registry list shows all the values for each of the provisioned apps that were deprovisioned. -The indented lines can be copied into notepad and saved as .reg file so they can be imported into a Windows 10 registry that has deprovisioned some or all of the apps and is missing these values, so the apps will not return after an upgrade. -This is the complete list, you would need to remove the lines for the apps you wish to retain during the upgrade. +The following table is a list of provisioned apps for Windows 10, version 1703, listed by app name (DisplayName) and by the package name (PackageName) used for generating the registry key. -```syntax -1709 Registry Keys -Windows Registry Editor Version 5.00 -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.GetHelp_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Getstarted_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MSPaint_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.OneNote_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.OneConnect_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.People_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Print3D_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SkypeApp_kzf8qxf38zg5c] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.StorePurchaseApp_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Wallet_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Photos_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsAlarms_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCamera_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\microsoft.windowscommunicationsapps_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsMaps_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsStore_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Xbox.TCUI_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxApp_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxGameOverlay_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] -``` - -List from Windows 10 1709 (Windows 10, version 1709). -This is the list of apps that are provisioned with Windows 10 1709, listed by app name (DisplayName) and by the package name (PackageName) which is used when generating the registry key. Packages can contain one of more apps. +>[!NOTE] +>The list of apps may vary with each feature release of Windows 10, apps may also change in Status for instance go from Provisioned Status to System app or Vice Versus. This only applies to apps provisioned for the host OS and the OS you are upgrading to. |DisplayName|PackageName| |---|---| @@ -170,10 +90,9 @@ This is the list of apps that are provisioned with Windows 10 1709, listed by ap |Microsoft.ZuneMusic|Microsoft.ZuneMusic_2019.18011.13411.1000_neutral_~_8wekyb3d8bbwe| |Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17122.16211.1000_neutral_~_8wekyb3d8bbwe| -Below is this the list of registry keys created after removing all the provisioned apps in Windows 10 1703. -The indented lines can be copied into notepad and saved as .reg file so they can be imported into a Windows 10 installation that has removed the apps and is missing these values, so the apps will not return after an upgrade. This is the complete list, you would need to remove the lines for the apps you wish to retain. +The following is a list of registry keys created after removing all the provisioned apps in Windows 10 1709. This list can be copied into Notepad and saved as .reg file for importing into a Windows 10 registry for deprovisioned apps that's missing these values, preventing the removed apps from returning after an upgrade. -Windows 10 1703 Registry keys for removed provisioned apps +Before importing this list, make sure you remove the lines for any apps you wish to retain. ```syntax Windows Registry Editor Version 5.00 @@ -214,11 +133,93 @@ Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] ``` -Notes: -If you remove the provisioned apps while online, the account that you logged on with will contain the apps, they were installed for that user. Therefore, if you do an upgrade, that user will retain the apps. Users that were created after the apps were removed, or after the upgrade will not get the Apps installed, the removed status is honored. +### Windows 10, version 1709 provisioned apps -This setting only applies to 1st party apps that shipped with Windows 10, this does not apply to 3rd party apps or apps that were acquired from the Microsoft Store, nor does it apply to LOB apps. +The following table is a list of provisioned apps for Windows 10 1709, listed by app name (DisplayName) and by the package name (PackageName) used for generating the registry key. -The list of apps may vary with each feature release of Windows 10, apps may also change in Status for instance go from Provisioned Status to System app or Vice Versus. This only applies to apps that are provisioned for the host OS and the OS you are upgrading to. +|DisplayName|PackageName| +|---|---| +|Microsoft.BingWeather|Microsoft.BingWeather_4.21.2492.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.DesktopAppInstaller|Microsoft.DesktopAppInstaller_1.8.4001.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.GetHelp|Microsoft.GetHelp_10.1706.1811.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Getstarted|Microsoft.Getstarted_5.11.1641.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Messaging|Microsoft.Messaging_2017.815.2052.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Microsoft3DViewer|Microsoft.Microsoft3DViewer_1.1707.26019.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MicrosoftOfficeHub|Microsoft.MicrosoftOfficeHub_2017.715.118.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MicrosoftSolitaireCollection|Microsoft.MicrosoftSolitaireCollection_3.17.8162.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MicrosoftStickyNotes|Microsoft.MicrosoftStickyNotes_1.8.2.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.MSPaint|Microsoft.MSPaint_2.1709.4027.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Office.OneNote|Microsoft.Office.OneNote_2015.8366.57611.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.OneConnect|Microsoft.OneConnect_3.1708.2224.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.People|Microsoft.People_2017.823.2207.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Print3D|Microsoft.Print3D_1.0.2422.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.SkypeApp|Microsoft.SkypeApp_11.18.596.0_neutral_~_kzf8qxf38zg5c| +|Microsoft.StorePurchaseApp|Microsoft.StorePurchaseApp_11706.1707.7104.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Wallet|Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Windows.Photos|Microsoft.Windows.Photos_2017.37071.16410.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsAlarms|Microsoft.WindowsAlarms_2017.828.2050.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsCalculator|Microsoft.WindowsCalculator_2017.828.2012.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsCamera|Microsoft.WindowsCamera_2017.727.20.0_neutral_~_8wekyb3d8bbwe| +|microsoft.windowscommunicationsapps|microsoft.windowscommunicationsapps_2015.8241.41275.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsFeedbackHub|Microsoft.WindowsFeedbackHub_1.1705.2121.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsMaps|Microsoft.WindowsMaps_2017.814.2249.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsSoundRecorder|Microsoft.WindowsSoundRecorder_2017.605.2103.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.WindowsStore|Microsoft.WindowsStore_11706.1002.94.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.Xbox.TCUI|Microsoft.Xbox.TCUI_1.8.24001.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxApp|Microsoft.XboxApp_31.32.16002.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxGameOverlay|Microsoft.XboxGameOverlay_1.20.25002.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxIdentityProvider|Microsoft.XboxIdentityProvider_2017.605.1240.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.XboxSpeechToTextOverlay|Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.ZuneMusic|Microsoft.ZuneMusic_2019.17063.24021.0_neutral_~_8wekyb3d8bbwe| +|Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17063.24021.0_neutral_~_8wekyb3d8bbwe| -This does not apply to upgrades to Windows 10, version 1703; the setup code to honor the removal for all users was enabled in Windows 10, version 1709 +The following list is a list of registry keys created after removing all the provisioned apps in Windows 10 1709. This list can be copied into notepad and saved as .reg file for importing into a Windows 10 registry for deprovisioned apps that's missing these values, preventing the removed apps from returning after an upgrade. + +Before importing this list, make sure you remove the lines for any apps you wish to retain. + +```syntax +1709 Registry Keys +Windows Registry Editor Version 5.00 +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.GetHelp_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Getstarted_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MSPaint_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.OneNote_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.OneConnect_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.People_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Print3D_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SkypeApp_kzf8qxf38zg5c] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.StorePurchaseApp_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Wallet_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Photos_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsAlarms_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCamera_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\microsoft.windowscommunicationsapps_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsMaps_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsStore_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Xbox.TCUI_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxApp_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxGameOverlay_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] +``` + +>[!NOTE] +>If you remove the provisioned apps while online, the account that you logged on with will contain the apps, they were installed for that user. Therefore, if you do an upgrade, that user will retain the apps. Users that were created after the apps were removed, or after the upgrade will not get the Apps installed, the removed status is honored. +> +>This setting only applies to first-party apps that shipped with Windows 10, this does not apply to third-party apps or apps that were acquired from the Microsoft Store, nor does it apply to LOB apps. +> +>This does not apply to upgrades to Windows 10, version 1703; the setup code to honor the removal for all users was enabled in Windows 10, version 1709 + +**How do you create a registry key from the information listed in the previous sections?** \ No newline at end of file From 3fd951a4200c921ee84708d4c2ff8259ccf1172c Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 23 Apr 2018 14:08:04 -0700 Subject: [PATCH 029/215] Reorganized notes into relevant sections --- .../remove-provisioned-apps-during-update.md | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index ffc041219b..ae255734e9 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -14,6 +14,9 @@ ms.date: 04/20/2018 If you upgrade a Windows 10, version 1703 computer to Windows 10, version 1709 or Windows 10, version 1803 (or a Windows 10, version 1709 to Windows 10, version 1803 upgrade), provisioned apps that you've removed before the upgrade may return. This can happen if the apps were removed while the computer was offline. If the provisioned (added) apps were removed while online, the apps should not return after the upgrade. +>[!NOTE] +>This setting only applies to first-party apps that shipped with Windows 10, this does not apply to third-party apps or apps that were acquired from the Microsoft Store, nor does it apply to LOB apps. + There are two points during removing a provisioned package from a Windows installation where this problem can occur: * If the packages are removed while the wim file is mounted when the device is offline. @@ -33,6 +36,9 @@ Starting with Windows 10, version 1703, the setup code knows to look for registr There will be scenarios where the apps were deprovisoned while offline prior to any changes being installed to Windows that would have corrected the behavior when removing the apps. +>[!NOTE] +>If you remove the provisioned apps while online, the account you used to sign in will contain the apps installed for that user. Therefore, if you do an upgrade, the signed-in user will retain the apps. User accounts created after the apps were removed or after an upgrade will not have the apps reinstalled. + ## How to generate registry keys for deprovisioned apps The following registry is where the registry keys for deprovisioned apps will be written to: @@ -45,12 +51,17 @@ The key won't have any data values, as all the system needs to understand that t The following tables list the display and package names for provisioned apps for Windows 10, version 1703 and Windows 10, version 1709 that can be used to generate the registry keys if they are not already present in your installation. +>[!NOTE] +>The list of apps may vary with each feature release of Windows 10, apps may also change in Status for instance go from Provisioned Status to System app or Vice Versus. This only applies to apps provisioned for the host OS and the OS you are upgrading to. + ### Windows 10, version 1703 provisioned apps The following table is a list of provisioned apps for Windows 10, version 1703, listed by app name (DisplayName) and by the package name (PackageName) used for generating the registry key. +**Note to self: If the setting doesn't apply to upgrates to 1703, then why are we listing the provisioned apps here?** + >[!NOTE] ->The list of apps may vary with each feature release of Windows 10, apps may also change in Status for instance go from Provisioned Status to System app or Vice Versus. This only applies to apps provisioned for the host OS and the OS you are upgrading to. +>This does not apply to upgrades to Windows 10, version 1703; the setup code to honor the removal for all users was enabled in Windows 10, version 1709 |DisplayName|PackageName| |---|---| @@ -215,11 +226,5 @@ Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] ``` ->[!NOTE] ->If you remove the provisioned apps while online, the account that you logged on with will contain the apps, they were installed for that user. Therefore, if you do an upgrade, that user will retain the apps. Users that were created after the apps were removed, or after the upgrade will not get the Apps installed, the removed status is honored. -> ->This setting only applies to first-party apps that shipped with Windows 10, this does not apply to third-party apps or apps that were acquired from the Microsoft Store, nor does it apply to LOB apps. -> ->This does not apply to upgrades to Windows 10, version 1703; the setup code to honor the removal for all users was enabled in Windows 10, version 1709 -**How do you create a registry key from the information listed in the previous sections?** \ No newline at end of file +**Note to self: How do you create a registry key from the information listed in the previous sections?** \ No newline at end of file From 2a346f7be8291ec32e9302927918707a53cdd5ce Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 23 Apr 2018 14:19:54 -0700 Subject: [PATCH 030/215] Updated TOC --- windows/application-management/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/application-management/TOC.md b/windows/application-management/TOC.md index 5adf6e1def..c515c2244a 100644 --- a/windows/application-management/TOC.md +++ b/windows/application-management/TOC.md @@ -107,3 +107,4 @@ ## [Understand apps in Windows 10](apps-in-windows-10.md) ## [Deploy app upgrades on Windows 10 Mobile](deploy-app-upgrades-windows-10-mobile.md) ## [Change history for Application management](change-history-for-application-management.md) +## [How to keep apps removed from Windows 10 from returning during an upgrade](remove-provisioned-apps-during-update.md) \ No newline at end of file From 2b34b91611e897c1b504a4725209c702900b7832 Mon Sep 17 00:00:00 2001 From: Patti Short Date: Mon, 23 Apr 2018 15:15:32 -0700 Subject: [PATCH 031/215] migrating technet content to the main library --- ...rosoft-browser-extension-policy-include.md | 1 + .../out-of-date-activex-control-blocking.md | 2 +- .../ie11-faq/faq-for-it-pros-ie11.md | 58 +++++++++++- .../before-you-create-custom-pkgs-ieak11.md | 13 +-- browsers/internet-explorer/ie11-ieak/index.md | 43 ++++++++- .../licensing-version-and-features-ieak11.md | 88 ++++++++++++------- ...oubleshooting-custom-browser-pkg-ieak11.md | 52 +++++++++-- 7 files changed, 206 insertions(+), 51 deletions(-) create mode 100644 browsers/edge/microsoft-browser-extension-policy-include.md diff --git a/browsers/edge/microsoft-browser-extension-policy-include.md b/browsers/edge/microsoft-browser-extension-policy-include.md new file mode 100644 index 0000000000..03aabcbbff --- /dev/null +++ b/browsers/edge/microsoft-browser-extension-policy-include.md @@ -0,0 +1 @@ +[Microsoft browser extention policy](https://docs.microsoft.com/en-us/legal/windows/agreements/microsoft-browser-extension-policy) \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md index 7bd0c006f9..9bcd6e6ec8 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md +++ b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md @@ -101,7 +101,7 @@ reg add "HKCU\Software\Microsoft\Internet Explorer\VersionManager" /v DownloadVe Turning off this automatic download breaks the out-of-date ActiveX control blocking feature by not letting the version list update with newly outdated controls, potentially compromising the security of your computer. Use this configuration option at your own risk. ## Out-of-date ActiveX control blocking on managed devices -Out-of-date ActiveX control blocking includes 4 new Group Policy settings that you can use to manage your web browser configuration, based on your domain controller. You can download the administrative templates, including the new settings, from the [Administrative templates (.admx) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=746579) page or the [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) page, depending on your operating system. +Out-of-date ActiveX control blocking includes four new Group Policy settings that you can use to manage your web browser configuration, based on your domain controller. You can download the administrative templates, including the new settings, from the [Administrative templates (.admx) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=746579) page or the [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) page, depending on your operating system. ### Group Policy settings Here’s a list of the new Group Policy info, including the settings, location, requirements, and Help text strings. All of these settings can be set in either the Computer Configuration or User Configuration scope, but Computer Configuration takes precedence over User Configuration. diff --git a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md index 9d9574cd8a..d9b27be715 100644 --- a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md +++ b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md @@ -145,8 +145,62 @@ Group Policy settings can be set to open either IE or Internet Explorer for the |Always in IE11 |Links always open in IE. | |Always in Internet Explorer for the desktop |Links always open in Internet Explorer for the desktop. | + + +**Q. Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?** +Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. + +IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center: +| | | | +|---------|---------|---------| +|[English](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) | +|[Arabic](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) | +|[Czech](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) | +|[Finnish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) | +|[Hebrew](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) | +|[Japanese](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) | +|[Portuguese (Brazil)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) | +|[Spanish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) | + + + +**Q. What are the different modes available for the Internet Explorer Customization Wizard?** +The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [Determine the licensing version and features to use in IEAK 11](../ie11-ieak/licensing-version-and-features-ieak11.md). + +The following table displays which pages are available in IEAK 11, based on the licensing mode: + +| **Wizard Pages** | **External** | **Internal** | +|-------------------------------------------|--------------|--------------| +| Welcome to the IEAK | Yes | Yes | +| File Locations | Yes | Yes | +| Platform Selection | Yes | Yes | +| Language Selection | Yes | Yes | +| Package Type Selection | Yes | Yes | +| Feature Selection | Yes | Yes | +| Automatic Version Synchronization | Yes | Yes | +| Custom Components | Yes | Yes | +| Corporate Install | No | Yes | +| User Experience | No | Yes | +| Browser User Interface | Yes | Yes | +| Search Providers | Yes | Yes | +| Important URLs - Home page and Support | Yes | Yes | +| Accelerators | Yes | Yes | +| Favorites, Favorites Bar, and Feeds | Yes | Yes | +| Browsing Options | No | Yes | +| First Run Wizard and Welcome Page Options | Yes | Yes | +| Compatibility View | Yes | Yes | +| Connection Manager | Yes | Yes | +| Connection Settings | Yes | Yes | +| Automatic Configuration | No | Yes | +| Proxy Settings | Yes | Yes | +| Security and Privacy Settings | No | Yes | +| Add a Root Certificate | Yes | No | +| Programs | Yes | Yes | +| Additional Settings | No | Yes | +| Wizard Complete | Yes | Yes | + + ## Related topics - [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643) - [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) - +- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md index d8c5cb0595..3894e97e38 100644 --- a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md @@ -2,25 +2,28 @@ ms.localizationpriority: low ms.mktglfcycl: plan description: A list of steps to follow before you start to create your custom browser installation packages. -author: eross-msft +author: shortpatti +ms.author: pashort +ms.manager: elizapo ms.prod: ie11 ms.assetid: 6ed182b0-46cb-4865-9563-70825be9a5e4 title: Before you start using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) ms.sitesec: library -ms.date: 07/27/2017 +ms.date: 04/24/2018 --- # Before you start using IEAK 11 -Go through this list, making sure you’ve answered all of the questions before you run Internet Explorer Administration Kit 11 (IEAK 11) and the Customization Wizard. + +Before you run IEAK 11 and the Customization Wizard, make sure you have met the following requirements: - Have you determined which licensing version of the Internet Explorer Administration Kit 11 to install? For info, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). - Do you meet the necessary hardware and software requirements? See [Hardware and software requirements for IEAK 11](hardware-and-software-reqs-ieak11.md). -- Have you gotten all of the URLs you’ll need so you can customize your **Home**, **Search**, and **Support** pages? See [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](important-urls-home-page-and-support-ieak11-wizard.md). +- Have you gotten all of the URLs needed to customize your **Home**, **Search**, and **Support** pages? See [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](important-urls-home-page-and-support-ieak11-wizard.md). -- Have you reviewed the security features, determining how you want to set up and manage them? See [Security features and IEAK 11](security-and-ieak11.md). +- Have you reviewed the security features to determine how to set up and manage them? See [Security features and IEAK 11](security-and-ieak11.md). - Have you created a test lab, where you can run the test version of your browser package to make sure it runs properly? diff --git a/browsers/internet-explorer/ie11-ieak/index.md b/browsers/internet-explorer/ie11-ieak/index.md index fcabf300fc..b0edeae7c4 100644 --- a/browsers/internet-explorer/ie11-ieak/index.md +++ b/browsers/internet-explorer/ie11-ieak/index.md @@ -12,15 +12,50 @@ ms.date: 07/27/2017 # Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide + +The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. + Use this guide to learn about the several options and processes you'll need to consider while you're using the Internet Explorer Administration Kit 11 (IEAK 11) to customize, deploy, and manage Internet Explorer 11 for your employee's devices. -**Important**
-Because this content isn't intended to be a step-by-step guide, not all of the steps are necessary. +>[!IMPORTANT} +>Because this content isn't intended to be a step-by-step guide, not all of the steps are necessary. ## IEAK 11 users -IEAK 11 includes programs and tools that enterprises can use to customize, deploy, and administer Internet Explorer 11 for employee devices, while Internet service and content providers can use the same programs and tools to customize, deploy, and administer Internet Explorer 11 for customers. +Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. + +IEAK 10 and newer includes the ability to install using one of the following installation modes: +- Internal +- External + +>[!NOTE] +>IEAK 11 works in network environments, with or without Microsoft Active Directory service. + +### Corporations +IEAK helps corporate administrators establish version control, centrally distribute and manage browser installation, configure automatic connection profiles, and customize large portions of Internet Explorer, including features, security, communications settings, and other important functionality. + +Corporate administrators install IEAK using Internal mode (for Internet Explorer 10 or newer) or Corporate mode (for Internet Explorer 9 or older). + +### Internet service providers +IEAK helps ISPs customize, deploy and distribute, add third-party add-ons, search providers, and custom components, as well as include web slices and accelerators all as part of a custom Internet Explorer installation package. + +ISPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Service Provider (ISP) mode (for Internet Explorer 9 or older). + +### Internet content providers +IEAK helps ICPs customize the appearance of Internet Explorer and its Setup program, including letting you add your company name or specific wording to the Title bar, set up a customer support webpage, set up the user home page and search providers, add links to the Favorites and the Explorer bars, add optional components, web slices and accelerators, and determine which compatibility mode Internet Explorer should use. + +ICPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older) + +### Independent software vendors +IEAK helps ISVs distribute (and redistribute) a custom version of Internet Explorer that can include custom components, programs, and controls (like the web browser control) that you create for your users. ISVs can also determine home pages, search providers, and add websites to the Favorites bar. + +ISVs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older). + +## Included technology +IEAK 11 includes the following technology: +- **Internet Explorer Customization Wizard.** This wizard guides you through the process of creating custom browser packages. After these packages are installed on your user's desktop, the user receives customized versions of Internet Explorer 11, with the settings and options you selected through the wizard. +- **Windows Installer (MSI).** IEAK 11 supports creating an MSI wrapper for your custom Internet Explorer 11 packages, enabling you to use Active Directory to deploy the package to your user's PC. +- **IEAK Help.** IEAK 11 Help includes many conceptual and procedural topics, which you can view from the **Index**, **Contents**, or **Search** tabs. You also have the option to print any topic, or the entire Help library. -IEAK 11 works in network environments, with or without Microsoft Active Directory service. ## Naming conventions IE11 and IEAK 11 offers differing experiences between Windows 7 and Windows 8.1 Update and newer versions of the Windows operating system: diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md index 6a0c89fda8..4859f62894 100644 --- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md @@ -2,51 +2,71 @@ ms.localizationpriority: low ms.mktglfcycl: plan description: Learn about which version of the IEAK 11 you should run, based on your license agreement. -author: eross-msft +author: shortpatti +ms.author: pashort +ms.manager: elizapo ms.prod: ie11 ms.assetid: 69d25451-08af-4db0-9daa-44ab272acc15 title: Determine the licensing version and features to use in IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) ms.sitesec: library -ms.date: 07/27/2017 +ms.date: 04/24/2018 --- # Determine the licensing version and features to use in IEAK 11 -You must pick a version of IEAK 11 to run during installation, either **External** or **Internal**, based on your license agreement. Your version selection decides the options you can pick from, the steps you’ll have to follow to deploy your Internet Explorer 11 package, and how you’ll manage the browser after deployment. +In addition to the Software License Terms for the Internet Explorer Administration Kit 11 (IEAK 11) (IEAK 11, the "software"), these Guidelines further define how you may and may not use the software to create versions of Internet Explorer 11 with optional customizations (the "customized browser") for internal use and distribution in accordance with the IEAK 11 Software License Terms. IEAK 11 is for testing purposes only and is not intended to be used in a production environment. -- **External Distribution as an Internet Service Provider (ISP), Internet Content Provider (ICP), or Developer.** If you’re an ISP or an ICP, your license agreement also says that you have to show the Internet Explorer logo on your packaging and promotional goods, as well as on your website.

-**Important**
Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations. +During installation, you must pick a version of IEAK 11, either **External** or **Internal**, based on your license agreement. Your version selection decides the options you can chose, the steps you follow to deploy your Internet Explorer 11 package, and how you manage the browser after deployment. + +- **External Distribution as an Internet Service Provider (ISP), Internet Content Provider (ICP), or Developer.** If you are an ISP or an ICP, your license agreement also states that you must show the Internet Explorer logo on your packaging and promotional goods, as well as on your website. + >[!IMPORTANT] + >Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations. - **Internal Distribution via a Corporate Intranet.** This version is for network admins that plan to directly deploy IE11 into a corporate environment. -## Available features by version -|Internal |External | -|------------------------------------------|------------------------------------------| -|Welcome screen |Welcome screen | -|File locations |File locations | -|Platform selection |Platform selection | -|Language selection |Language selection | -|Package type selection |Package type selection | -|Feature selection |Feature selection | -|Automatic Version Synchronization (AVS) |Automatic Version Synchronization (AVS) | -|Custom components |Custom components | -|Internal install |Not available | -|User experience |Not available | -|Browser user interface |Browser user interface | -|Search providers |Search providers | -|Important URLs – Home page and support |Important URLs – Home page and support | -|Accelerators |Accelerators | -|Favorites, Favorites bar, and feeds |Favorites, Favorites bar, and feeds | -|Browsing options |Not available | -|First Run wizard and Welcome page options |First Run wizard and Welcome page options | -|Connection manager |Connection manager | -|Connection settings |Connection settings | -|Automatic configuration |Not available | -|Proxy settings |Proxy settings | -|Security and privacy settings |Not available | -|Not available |Add a root certificate | -|Programs |Programs | -|Additional settings |Not available | -|Wizard complete |Wizard complete | +## Customization guidelines +Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. + +- **External Distribution** + This mode is available to anyone who wants to create a customized browser for distribution outside their company (for example, websites, magazines, retailers, non-profit organizations, independent hardware vendors, independent software vendors, Internet service providers, Internet content providers, software developers, and marketers). + +- **Internal Distribution** + This mode is available to companies for the creation and distribution of a customized browser only to their employees over a corporate intranet. + +The table below identifies which customizations you may or may not perform based on the mode you selected. + +| **Feature Name** | **External Distribution** | **Internal Distribution** | +|---------------------------------|----------------------|-------------------| +| **Custom Components** | Yes | Yes | +| **Title Bar** | Yes | Yes | +| **Favorites** | One folder, containing any number of links. | Any number of folders/links. | +| **Search Provider URLs** | Yes | Yes | +| **Search Guide URL** | No | Yes | +| **Online Support URL** | Yes | Yes | +| **Web Slice** | Suggested maximum five Web Slices. | Any number of Web Slices. | +| **Accelerator** | Search provider Accelerator must be the same as the search provider set for the Search Toolbox. We recommend that Any number of Accelerators/Accelerator Categories. Feature Name External Internal Accelerator category not exceed seven total categories, and each Accelerator category must be unique. We recommend each Accelerator category not have more than two Accelerators. The Accelerator display name should follow the syntax of verb + noun, such as "Map with Bing." | Any number of Accelerators/Accelerator Categories. | +| **Homepage URLs** | Can add a maximum of three. | Unlimited. | +| **First Run Wizard and Welcome Page Options** | Cannot remove Internet Explorer 11 First Run wizard. Can customize **Welcome** page. | Customizable. | +| **RSS Feeds** | One folder, containing any number of links. | Any number of folders/links. | +| **Browsing Options** | No | Yes | +| **Security and Privacy Settings** | No | Can add any number of sites. | +| **Corporate Options** (Latest Updates, Default Browser, Uninstall Info, Additional Settings) | No | Yes | +| **User Experience** (Setup/Restart) | No | Yes | +| **User Agent String** | Yes | Yes | +| **Compatibility View** | Yes | Yes | +| **Connection Settings and Manage** | Yes | Yes | + + +Support for some of the Internet Explorer settings on the wizard pages varies depending on your target operating system. For more information, see [Internet Explorer Customization Wizard 11 options](https://docs.microsoft.com/internet-explorer/ie11-ieak/ieak11-wizard-custom-options). + +## Distribution guidelines + +Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. + +- **External Distribution** + You shall use commercially reasonable efforts to maintain the quality of (i) any non-Microsoft software distributed with Internet Explorer 11, and (ii) any media used for distribution (for example, optical media, flash drives), at a level that meets or exceeds the highest industry standards. If you distribute add-ons with Internet Explorer 11, those add-ons must comply with the [!INCLUDE [microsoft-browser-extension-policy-include](../../edge/microsoft-browser-extension-policy-include.md)]. + +- **Internal Distribution - corporate intranet** + The software is solely for use by your employees within your company's organization and affiliated companies through your corporate intranet. Neither you nor any of your employees may permit redistribution of the software to or for use by third parties other than for third parties such as consultants, contractors, and temporary staff accessing your corporate intranet. \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md index c762eb1d5a..f08cd39f8b 100644 --- a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md @@ -14,8 +14,8 @@ ms.date: 07/27/2017 # Troubleshoot custom package and IEAK 11 problems While the Internet Explorer Customization Wizard has been around for quite a while, there are still some known issues that you might encounter while deploying or managing your custom IE install package. -## I can’t locate some of the wizard pages -The most common reasons you won’t see certain pages is because: +## I am unable to locate some of the wizard pages +The most common reasons you will not see certain pages is because: - **Your licensing agreement with Microsoft.** Your licensing agreement determines whether you install the **Internal** or **External** version of the Internet Explorer Customization Wizard, and there are different features available for each version. For info about which features are available for each version, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). @@ -23,7 +23,7 @@ The most common reasons you won’t see certain pages is because: - **Your choice of features.** Depending on what you selected from the **Feature Selection** page of the wizard, you might not see all of the pages. You need to make sure that the features you want to customize are all checked. For more information, see [Use the Feature Selection page in the IEAK 11 Wizard](feature-selection-ieak11-wizard.md). -## Internet Explorer Setup fails on employee devices +## Internet Explorer Setup fails on user's devices Various issues can cause problems during Setup, including missing files, trust issues, or URL monikers. You can troubleshoot these issues by reviewing the Setup log file, located at `IE11\_main.log` from the **Windows** folder (typically, `C:\Windows`). The log file covers the entire Setup process from the moment IE11Setup.exe starts until the last .cab file finishes, providing error codes that you can use to help determine the cause of the failure. ### Main.log file codes @@ -61,18 +61,60 @@ To address connection issues (for example, as a result of server problems) where Where `` represents the folder location where you stored IE11setup.exe. -## Employees can’t uninstall IE -If you can’t uninstall IE using **Uninstall or change a program** in the Control Panel, it could be because the uninstall information isn’t on the computer. To fix this issue, you should: +## Users cannot uninstall IE +If you cannot uninstall IE using **Uninstall or change a program** in the Control Panel, it could be because the uninstall information is not on the computer. To fix this issue, you should: 1. Review the uninstall log file, IE11Uninst.log, located in the `C:\Windows` folder. This log file covers the entire uninstallation process, including every file change, every registry change, and any dialog boxes that are shown. 2. Try to manually uninstall IE. Go to the backup folder, `:\Windows\$ie11$`, and run the uninstall file, `Spunist.exe`.   +## The Internet Explorer Customization Wizard 11 does not work with user names that user double-byte character sets +The customization wizard does not work with user names that use double-byte character sets, such as Chinese or Japanese. To fix this, set the **TEMP** and **TMP** environmental variables to a path that does not use these characters (for example, C:\temp). + +1. Open **System Properties**, click the **Advanced** tab, and then click **Environmental Variables**. +2. Click Edit, and then modify the **TEMP** and **TMP** environmental variables to a non-user profile directory.   +## Unicode characters are not supported in IEAK 11 path names +While Unicode characters, such as Emoji, are supported for organization names and other branding items, you must not use Unicode characters in any paths associated with running the Internet Explorer Customization Wizard 11. This includes paths to your IEAK 11 installation and to the storage location for your custom packages after they're built. + +## Internet Explorer branding conflicts when using both Unattend and IEAK 11 to customize Internet Explorer settings +Using both Unattend settings and an IEAK custom package to modify a user's version of Internet Explorer 11 might cause a user to lose personalized settings during an upgrade. For example, many manufacturers configure Internet Explorer using Unattend settings. If a user purchases a laptop, and then signs up for Internet service, their Internet Service Provider (ISP) might provide a version of Internet Explorer that has been branded (for example, with a custom homepage for that ISP) using Internet Explorer Customization Wizard 11. If that user later upgrades to a new version of Internet Explorer, the Unattend settings from the laptop manufacturer will be reapplied, overwriting any settings that the user configured for themselves (such as their homepage). +## IEAK 11 does not correctly apply the Delete all existing items under Favorites, Favorites Bar and Feeds option +The Internet Explorer Customization Wizard 11 does not correctly apply the **Delete all existing items under Favorites**, **Favorites Bar and Feeds** option, available on the **Browsing Options** page. +Selecting to include this feature in your customized Internet Explorer package enables the deletion of existing items in the **Favorites** and **Favorites Bar** areas, but it doesn't enable deletion in the **Feeds** area. In addition, this setting adds a new favorite, titled “Web Slice Gallery” to the **Favorites Bar**. +## F1 does not activate Help on Automatic Version Synchronization page +Pressing the **F1** button on the **Automatic Version Synchronization** page of the Internet Explorer Customization Wizard 11 does not display the **Help** page. Clicking the **Help** button enables you to open the Help system and view information about this page. +## Certificate installation does not work on IEAK 11 +IEAK 11 doesn't install certificates added using the Add a Root Certificate page of the Internet Explorer Customization Wizard 11. Administrators can manually install certificates using the Certificates Microsoft Management Console snap-in (Certmgr.msc) or using the command-line tool, Certificate Manager (Certmgr.exe). + +>[!NOTE] +>This applies only when using the External licensing mode of IEAK 11. + +## The Additional Settings page appears in the wrong language when using a localized version of IEAK 11 +When using IEAK 11 in other languages, the settings on the Additional Settings page appear in the language of the target platform, regardless of the IEAK 11 language. + +>[!NOTE] +>This applies only when using the Internal licensing mode of IEAK 11. + +To work around this issue, run the customization wizard following these steps: +1. On the **Language Selection** page, select the language that matches the language of your installed IEAK 11. +2. Click **Next**, and then click **Synchronize** on the Automatic Version Synchronization page. +3. After synchronization is complete, cancel the wizard. +4. Repeat these steps for each platform on the Platform Selection page. + +After performing these steps, you must still do the following each time you synchronize a new language and platform: +1. Open File Explorer to the Program Files\Windows IEAK 11 or Program Files (x86)\Windows IEAK 11 folder. +2. Open the **Policies** folder, and then open the appropriate platform folder. +3. Copy the contents of the matching-language folder into the new language folder. + +After completing these steps, the Additional Settings page matches your wizard’s language. + +## Unable to access feeds stored in a subfolder +Adding feeds using the **Favorites**, **Favorites Bar**, and **Feeds** page of the Internet Explorer 11 Customization Wizard requires that the feeds be stored in a single folder. Creating two levels of folders, and creating the feed in the subfolder, causes the feed to fail. From acbfaafeb271934ccffbcbaf76c9d51497f024ff Mon Sep 17 00:00:00 2001 From: Patti Short Date: Tue, 24 Apr 2018 09:27:48 -0700 Subject: [PATCH 032/215] brought in missing content from technet --- ...he-internet-explorer-11-blocker-toolkit.md | 179 +++++++++++++++++- 1 file changed, 170 insertions(+), 9 deletions(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md index ea04329097..7cedb8e908 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md +++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md @@ -3,12 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: support ms.pagetype: security description: How to download and use the Internet Explorer 11 Blocker Toolkit to turn off the automatic delivery of IE11 through the Automatic Updates feature of Windows Update. -author: eross-msft +author: shortpatti +ms.author: pashort +ms.manager: elizapo ms.prod: ie11 ms.assetid: fafeaaee-171c-4450-99f7-5cc7f8d7ba91 title: What is the Internet Explorer 11 Blocker Toolkit? (Internet Explorer 11 for IT Pros) ms.sitesec: library -ms.date: 07/27/2017 +ms.date: 04/24/2018 --- @@ -24,14 +26,14 @@ ms.date: 07/27/2017 The Internet Explorer 11 Blocker Toolkit lets you turn off the automatic delivery of IE11 through the **Automatic Updates** feature of Windows Update. -**Important**
-The IE11 Blocker Toolkit doesn't stop users from manually installing IE11 from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?linkid=327753). Also, even if you've installed previous versions of the toolkit before, like for Internet Explorer 10, you still need to install this version to prevent the installation of IE11. +>[!IMPORTANT] +>The IE11 Blocker Toolkit does not stop users from manually installing IE11 from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?linkid=327753). Also, even if you have installed previous versions of the toolkit before, like for Internet Explorer 10, you still need to install this version to prevent the installation of IE11. - **To install the toolkit** +## Install the toolkit 1. Download the IE11 Blocker Toolkit from [Toolkit to Disable Automatic Delivery of Internet Explorer 11](https://go.microsoft.com/fwlink/p/?LinkId=327745). -2. Accept the license agreement and store the included 4 files on your local computer. +2. Accept the license agreement and store the included four files on your local computer. 3. Start an elevated Command Prompt by going to **Start**>**All Programs**>**Accessories**> right-clicking on **Command Prompt**, and then choosing **Run as Administrator**. @@ -44,9 +46,168 @@ Wait for the message, **Blocking deployment of IE11 on the local machine. The op For answers to frequently asked questions, see [Internet Explorer 11 Blocker Toolkit: Frequently Asked Questions](https://go.microsoft.com/fwlink/p/?LinkId=314063). -  - -  +## Automatic updates +Internet Explorer 11 makes browsing the web faster, easier, safer, and more reliable than ever. To help customers become more secure and up-to-date, Microsoft will distribute Internet Explorer 11 through Automatic Updates and the Windows Update and Microsoft Update sites. Internet Explorer 11 will be available for users of the 32-bit and 64-bit versions of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1. This article provides an overview of the delivery process and options available for IT administrators to control how and when Internet Explorer 11 is deployed to their organization through Automatic Updates. +### Automatic delivery process +Internet Explorer 11 only downloads and installs if it’s available for delivery through Automatic Updates; and Automatic Updates only offer Internet Explorer 11 to users with local administrator accounts. User’s without local administrator accounts won’t be prompted to install the update and will continue using their current version of Internet Explorer. + +Internet Explorer 11 replaces Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10. If you decide you don’t want Internet Explorer 11, and you’re running Windows 7 SP1 or Windows Server 2008 R2 with SP1, you can uninstall it from the **View installed updates** section of the **Uninstall an update** page of the Control Panel.  + +### Internet Explorer 11 automatic upgrades + +Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11. + +Users who were automatically upgraded to Internet Explorer 11 can decide to uninstall Internet Explorer 11. However, Internet Explorer 11 will still appear as an optional update through Windows Update. + +### Options for blocking automatic delivery + +If you use Automatic Updates in your company, but want to stop your users from automatically getting Internet Explorer 11, do one of the following: + +- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). + + >[!NOTE] + >The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](#faq). + +- **Use an update management solution to control update deployment.** If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit. + +>[!NOTE] +>If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. + + +### Prevent automatic installation of Internet Explorer 11 with WSUS + +Internet Explorer 11 will be released to WSUS as an Update Rollup package. Therefore, if you’ve configured WSUS to “auto-approve” Update Rollup packages, it’ll be automatically approved and installed. To stop Internet Explorer 11 from being automatically approved for installation, you need to: + +1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. + +2. Expand *ComputerName*, and then click **Options**. + +3. Click **Automatic Approvals**. + +4. Click the rule that automatically approves an update that is classified as Update Rollup, and then click **Edit.** + + >[!NOTE] + >If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else. + +5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. + + >[!NOTE] + >The properties for this rule will resemble the following:

  • When an update is in Update Rollups
  • Approve the update for all computers
+ +6. Clear the **Update Rollup** check box, and then click **OK**. + +7. Click **OK** to close the **Automatic Approvals** dialog box. + +After the new Internet Explorer 11 package is available for download, you should manually synchronize the new package to your WSUS server, so that when you re-enable auto-approval it won’t be automatically installed. + +1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. + +2. Expand *ComputerName*, and then click **Synchronizations**. + +3. Click **Synchronize Now**. + +4. Expand *ComputerName*, expand **Updates**, and then click **All Updates**. + +5. Choose **Unapproved** in the **Approval**drop down box. + +6. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update. + +>[!NOTE] +>There may be multiple updates, depending on the imported language and operating system updates. + +### Optional - Reset update rollups packages to auto-approve + +1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. + +2. Expand *ComputerName*, and then click **Options**. + +3. Click **Automatic Approvals**. + +4. Click the rule that automatically approves updates of different classifications, and then click **Edit**. + +5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. + +6. Check the **Update Rollups** check box, and then click **OK**. + +7. Click **OK** to close the **Automatic Approvals** dialog box. + +>[!NOTE] +>Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved. + +## Frequently Asked Questions  +Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit. + +### Automatic updates delivery process +**Q. What tools can I use to manage Windows Updates and Microsoft Updates in my company?** +A. We encourage anyone who wants full control over their company’s deployment of Windows Updates and Microsoft Updates, to use [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), a free tool for users of Windows Server. You can also use the more advanced configuration management tool, [System Center 2012 Configuration Manager](https://technet.microsoft.com/library/gg682041.aspx). + +**Q. How long does the blocker mechanism work?** +A. The Internet Explorer 11 Blocker Toolkit uses a registry key value to permanently turn off the automatic delivery of Internet Explorer 11. This behavior lasts as long as the registry key value isn’t removed or changed. + +**Q. Why should I use the Internet Explorer 11 Blocker Toolkit to stop delivery of Internet Explorer 11? Why can’t I just disable all of utomatic Updates?** +A. Automatic Updates provide you with ongoing critical security and reliability updates. Turning this feature off can leave your computers more vulnerable. Instead, we suggest that you use an update management solution, such as WSUS, to fully control your environment while leaving this feature running, managing how and when the updates get to your user’s computers. + +The Internet Explorer 11 Blocker Toolkit safely allows Internet Explorer 11 to download and install in companies that can’t use WSUS, Configuration Manager, or other update management solution. + +**Q. Why don’t we just block URL access to Windows Update or Microsoft Update?** +A. Blocking the Windows Update or Microsoft Update URLs also stops delivery of critical security and reliability updates for all of the supported versions of the Windows operating system; leaving your computers more vulnerable. + +### How the Internet Explorer 11 Blocker Toolkit works + +**Q. How should I test the Internet Explorer 11 Blocker Toolkit in my company?** +A. Because the toolkit only sets a registry key to turn on and off the delivery of Internet Explorer 11, there should be no additional impact or side effects to your environment. No additional testing should be necessary. + +**Q. What’s the registry key used to block delivery of Internet Explorer 11?** +A. HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Setup\\11.0 + +**Q. What’s the registry key name and values?** +The registry key name is **DoNotAllowIE11**, where: + +- A value of **1** turns off the automatic delivery of Internet Explorer 11 + using Automatic Updates and turns off the Express install option. + +- Not providing a registry key, or using a value of anything other than **1**, + lets the user install Internet Explorer 11 through Automatic Updates or a + manual update. + +**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from manually installing Internet Explorer 11?** +A. No. The Internet Explorer 11 Blocker Toolkit only stops computers from automatically installing Internet Explorer 11 through Automatic Updates. Users can still download and install Internet Explorer 11 from the Microsoft Download Center or from external media. + +**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from automatically upgrading to Internet Explorer 11?** +A. Yes. The Internet Explorer 11 Blocker Toolkit also prevents Automatic Updates from automatically upgrading a computer from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. + +**Q. How does the provided script work?** +A. The script accepts one of two command line options: + +- **Block:** Creates the registry key that stops Internet Explorer 11 from installing through Automatic Updates. + +- **Unblock:** Removes the registry key that stops Internet Explorer 11 from installing through Automatic Updates. + +**Q. What’s the ADM template file used for?** +A. The Administrative Template (.adm file) lets you import the new Group Policy environment and use Group Policy Objects to centrally manage all of the computers in your company. + +**Q. Is the tool localized?** +A. No. The tool isn’t localized, it’s only available in English (en-us). However, it does work, without any modifications, on any language edition of the supported operating systems. + +### Internet Explorer 11 Blocker Toolkit and other update services + +**Q. Does the Internet Explorer 11 blocking mechanism also block delivery of Internet Explorer 11 through update management solutions, like SUS?** +A. No. You can still deploy Internet Explorer 11 using one of the upgrade management solutions, even if the blocking mechanism is activated. The Internet Explorer 11 Blocker Toolkit is only intended for companies that don’t use upgrade management solutions. + +**Q. If WSUS is set to 'auto-approve' Update Rollup packages (this is not the default configuration), how do I stop Internet Explorer 11 from automatically installing throughout my company?** +A. You only need to change your settings if: + +- You use WSUS to manage updates and allow auto-approvals for Update Rollup installation. + + -and- + +- You have computers running either Windows 7 SP1 or Windows Server 2008 R2 (SP1) with Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 installed. + + -and- + +- You don’t want to upgrade your older versions of Internet Explorer to Internet Explorer 11 right now. + +If these scenarios apply to your company, see [Internet Explorer 11 delivery through automatic updates](https://technet.microsoft.com/microsoft-edge/dn449235) for more information on how to prevent automatic installation. From e4dc78edfaa8f79ebb1cc839bbb6969bd83bc2f6 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 24 Apr 2018 13:23:09 -0700 Subject: [PATCH 033/215] Attempt to fix formatting --- .../remove-provisioned-apps-during-update.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index ae255734e9..5255e9a71a 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -26,11 +26,11 @@ When this happens, write a registry key for the removed app when removing each o Registry keys for removed apps are listed as "deprovisioned" and written to the following location. The keys listed here are for apps that should not be installed during the upgrade. -```[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned]``` +`[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned]` Each deprovisioned app gets a registry key with no data fields under it, just the package name of the app to be removed. For example, the following registry key is for the Calculator app: -```[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe]``` +`[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe]` Starting with Windows 10, version 1703, the setup code knows to look for registry keys in this folder and will not reinstall the apps listed here. However, in offline mode, the registry keys were not written when the apps were removed. This issue was addressed in Windows 10, version 1803, which ensures registry keys will be written for apps deprovisioned while offline so that setup can properly identify deprovisioned apps and not reinstall them during updates. Windows 10, version 1709 was also patched to correct this issue. @@ -43,9 +43,9 @@ There will be scenarios where the apps were deprovisoned while offline prior to The following registry is where the registry keys for deprovisioned apps will be written to: -```\microsoft\windows\currentversion\appx\appxalluserstore\deprovisioned\``` +`\microsoft\windows\currentversion\appx\appxalluserstore\deprovisioned\` -Where `````` is HKLM\\Software on an online running system. For an offline scenario, this location is wherever you mounted the Software hive. +Where `` is HKLM\\Software on an online running system. For an offline scenario, this location is wherever you mounted the Software hive. The key won't have any data values, as all the system needs to understand that the deprovisioned app should remain uninstalled is the existence of the key within the proper registry folder. @@ -226,5 +226,4 @@ Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] ``` - **Note to self: How do you create a registry key from the information listed in the previous sections?** \ No newline at end of file From 370cd3158f0b84617e6136147595e9c6ed4fd54e Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 25 Apr 2018 15:02:44 -0700 Subject: [PATCH 034/215] First attempt at creating a coherent how to --- .../remove-provisioned-apps-during-update.md | 93 ++++++++++++++++++- 1 file changed, 92 insertions(+), 1 deletion(-) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index 5255e9a71a..e0b99333e1 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -54,6 +54,97 @@ The following tables list the display and package names for provisioned apps for >[!NOTE] >The list of apps may vary with each feature release of Windows 10, apps may also change in Status for instance go from Provisioned Status to System app or Vice Versus. This only applies to apps provisioned for the host OS and the OS you are upgrading to. +1. First, you'll need to identify the apps you removed from the Windows 10, version 1703 install image. The following table is a list of provisioned apps for version 1703 that includes their displayed names and package names: + |Displayed app name|Package name| + |---|---| + |Microsoft.3DBuilder|Microsoft.3DBuilder_15.2.10821.1000_neutral_~_8wekyb3d8bbwe| + |Microsoft.BingWeather|Microsoft.BingWeather_4.23.10923.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.DesktopAppInstaller|Microsoft.DesktopAppInstaller_1.10.16004.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.GetHelp|Microsoft.GetHelp_10.1706.1811.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.Getstarted|Microsoft.Getstarted_5.12.2691.1000_neutral_~_8wekyb3d8bbwe| + |Microsoft.HEVCVideoExtension|Microsoft.HEVCVideoExtension_1.0.2512.0_x64__8wekyb3d8bbwe| + |Microsoft.Messaging|Microsoft.Messaging_2018.124.707.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.Microsoft3DViewer|Microsoft.Microsoft3DViewer_3.1803.29012.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.MicrosoftOfficeHub|Microsoft.MicrosoftOfficeHub_2017.715.118.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.MicrosoftSolitaireCollection|Microsoft.MicrosoftSolitaireCollection_3.18.12091.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.MicrosoftStickyNotes|Microsoft.MicrosoftStickyNotes_2.1.18.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.MSPaint|Microsoft.MSPaint_4.1803.21027.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.Office.OneNote|Microsoft.Office.OneNote_2015.9126.21251.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.OneConnect|Microsoft.OneConnect_3.1708.2224.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.People|Microsoft.People_2017.1006.1846.1000_neutral_~_8wekyb3d8bbwe| + |Microsoft.Print3D|Microsoft.Print3D_1.0.2422.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.SkypeApp|Microsoft.SkypeApp_12.1811.248.1000_neutral_~_kzf8qxf38zg5c| + |Microsoft.StorePurchaseApp|Microsoft.StorePurchaseApp_11802.1802.23014.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.Wallet|Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.Windows.Photos|Microsoft.Windows.Photos_2018.18022.15810.1000_neutral_~_8wekyb3d8bbwe| + |Microsoft.WindowsAlarms|Microsoft.WindowsAlarms_2017.920.157.1000_neutral_~_8wekyb3d8bbwe| + |Microsoft.WindowsCalculator|Microsoft.WindowsCalculator_2017.928.0.1000_neutral_~_8wekyb3d8bbwe| + |Microsoft.WindowsCamera|Microsoft.WindowsCamera_2017.1117.10.1000_neutral_~_8wekyb3d8bbwe| + |microsoft.windowscommunicationsapps|microsoft.windowscommunicationsapps_2015.9126.21425.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.WindowsFeedbackHub|Microsoft.WindowsFeedbackHub_2018.323.50.1000_neutral_~_8wekyb3d8bbwe| + |Microsoft.WindowsMaps|Microsoft.WindowsMaps_2017.1003.1829.1000_neutral_~_8wekyb3d8bbwe| + |Microsoft.WindowsSoundRecorder|Microsoft.WindowsSoundRecorder_2017.928.5.1000_neutral_~_8wekyb3d8bbwe| + |Microsoft.WindowsStore|Microsoft.WindowsStore_11803.1001.613.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.Xbox.TCUI|Microsoft.Xbox.TCUI_1.8.24001.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.XboxApp|Microsoft.XboxApp_39.39.21002.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.XboxGameOverlay|Microsoft.XboxGameOverlay_1.24.5001.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.XboxIdentityProvider|Microsoft.XboxIdentityProvider_2017.605.1240.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.XboxSpeechToTextOverlay|Microsoft.XboxSpeechToTextOverlay_1.21.13002.0_neutral_~_8wekyb3d8bbwe| + |Microsoft.ZuneMusic|Microsoft.ZuneMusic_2019.18011.13411.1000_neutral_~_8wekyb3d8bbwe| + |Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17122.16211.1000_neutral_~_8wekyb3d8bbwe| + + After identifying the apps, record their package numbers. +2. Use the list of 1709 registry keys to create a script that will create a registry key for each app you don't want to reprovision. + 1. Copy the 1709 registry keys list and paste them in a text editor. Remove any apps that you do want to provision during the upgrade from version 1703 to version 1709. + The list should look something like the following, minus the apps you do want to add: + + ``` + 1709 Registry Keys + Windows Registry Editor Version 5.00 + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.GetHelp_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Getstarted_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MSPaint_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.OneNote_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.OneConnect_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.People_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Print3D_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SkypeApp_kzf8qxf38zg5c] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.StorePurchaseApp_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Wallet_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Photos_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsAlarms_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCamera_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\microsoft.windowscommunicationsapps_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsMaps_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsStore_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Xbox.TCUI_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxApp_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxGameOverlay_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] + ``` + + 2. Save the text editor file as a .reg file. For more information, see [How to add, modify, or delete registry subkeys and values by using a .reg file](https://support.microsoft.com/en-us/help/310516/how-to-add-modify-or-delete-registry-subkeys-and-values-by-using-a-reg). +3. Import the .reg file into the Deprovisioned foler mentioned previously. +4. Update your Windows 10 deployment from version 1703 to version 1709. + + + + +## Ignore this section + ### Windows 10, version 1703 provisioned apps The following table is a list of provisioned apps for Windows 10, version 1703, listed by app name (DisplayName) and by the package name (PackageName) used for generating the registry key. @@ -63,7 +154,7 @@ The following table is a list of provisioned apps for Windows 10, version 1703, >[!NOTE] >This does not apply to upgrades to Windows 10, version 1703; the setup code to honor the removal for all users was enabled in Windows 10, version 1709 -|DisplayName|PackageName| +|Displayed app name|Package name| |---|---| |Microsoft.3DBuilder|Microsoft.3DBuilder_15.2.10821.1000_neutral_~_8wekyb3d8bbwe| |Microsoft.BingWeather|Microsoft.BingWeather_4.23.10923.0_neutral_~_8wekyb3d8bbwe| From 87c4bc5d04db434fe4466bc6df118307b643fdfc Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 25 Apr 2018 16:41:05 -0700 Subject: [PATCH 035/215] Editorial changes --- .../remove-provisioned-apps-during-update.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index e0b99333e1..d856308125 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -12,17 +12,19 @@ ms.date: 04/20/2018 >Applies to: Windows 10, version 1703; Windows 10 version 1709; Windows 10, version 1803 -If you upgrade a Windows 10, version 1703 computer to Windows 10, version 1709 or Windows 10, version 1803 (or a Windows 10, version 1709 to Windows 10, version 1803 upgrade), provisioned apps that you've removed before the upgrade may return. This can happen if the apps were removed while the computer was offline. If the provisioned (added) apps were removed while online, the apps should not return after the upgrade. +If you upgrade a Windows 10, version 1703 computer to Windows 10, version 1709 or Windows 10, version 1803 (or a Windows 10, version 1709 to Windows 10, version 1803 upgrade), provisioned apps that you've removed before the upgrade may return. This can happen if the apps were removed while the computer was offline. If the provisioned (added) apps were removed while online, the apps should not return after the upgrade. >[!NOTE] ->This setting only applies to first-party apps that shipped with Windows 10, this does not apply to third-party apps or apps that were acquired from the Microsoft Store, nor does it apply to LOB apps. +>This setting only applies to first-party apps that shipped with Windows 10. This does not apply to third-party apps or apps that were acquired from the Microsoft Store, nor does it apply to LOB apps. There are two points during removing a provisioned package from a Windows installation where this problem can occur: * If the packages are removed while the wim file is mounted when the device is offline. * If the provisioned package is removed while inside of Windows when the device is online. -When this happens, write a registry key for the removed app when removing each one. This way, you can use the registry key to indicate to your deployment whether to install or not install the app while you're upgrading it. +When this happens, write a registry key for each app you remove. This way, you can use the registry key to indicate to your deployment whether to install or not install the app while you're upgrading it. + +## Where to store deprovisioned app registration keys Registry keys for removed apps are listed as "deprovisioned" and written to the following location. The keys listed here are for apps that should not be installed during the upgrade. @@ -32,12 +34,12 @@ Each deprovisioned app gets a registry key with no data fields under it, just th `[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe]` -Starting with Windows 10, version 1703, the setup code knows to look for registry keys in this folder and will not reinstall the apps listed here. However, in offline mode, the registry keys were not written when the apps were removed. This issue was addressed in Windows 10, version 1803, which ensures registry keys will be written for apps deprovisioned while offline so that setup can properly identify deprovisioned apps and not reinstall them during updates. Windows 10, version 1709 was also patched to correct this issue. +Starting with Windows 10, version 1703, the setup code knows to look for registry keys in this folder and will not reinstall any apps listed in this registry. However, in offline mode, the registry keys were not written when the apps were removed. This issue was addressed in Windows 10, version 1803, which ensures registry keys will be written for apps deprovisioned while offline so that setup can properly identify deprovisioned apps and not reinstall them during updates. Windows 10, version 1709 was also patched to correct this issue. There will be scenarios where the apps were deprovisoned while offline prior to any changes being installed to Windows that would have corrected the behavior when removing the apps. >[!NOTE] ->If you remove the provisioned apps while online, the account you used to sign in will contain the apps installed for that user. Therefore, if you do an upgrade, the signed-in user will retain the apps. User accounts created after the apps were removed or after an upgrade will not have the apps reinstalled. +>If you remove the provisioned apps while online, the account you used to sign in will contain the apps installed for that user. As a result, when you upgrade, the user you signed in as will retain the apps. User accounts created after the apps were removed or after an upgrade will not have the apps reinstalled. ## How to generate registry keys for deprovisioned apps @@ -45,16 +47,16 @@ The following registry is where the registry keys for deprovisioned apps will be `\microsoft\windows\currentversion\appx\appxalluserstore\deprovisioned\` -Where `` is HKLM\\Software on an online running system. For an offline scenario, this location is wherever you mounted the Software hive. +Where `` is **HKLM\\Software** on an online running system. For an offline scenario, this location is wherever you mounted the Software hive. The key won't have any data values, as all the system needs to understand that the deprovisioned app should remain uninstalled is the existence of the key within the proper registry folder. The following tables list the display and package names for provisioned apps for Windows 10, version 1703 and Windows 10, version 1709 that can be used to generate the registry keys if they are not already present in your installation. >[!NOTE] ->The list of apps may vary with each feature release of Windows 10, apps may also change in Status for instance go from Provisioned Status to System app or Vice Versus. This only applies to apps provisioned for the host OS and the OS you are upgrading to. +>The list of apps may vary with each feature release of Windows 10. Apps may also change in Status; for instance, an app listed as Provisioned in an older release might change to a System app in a newer version, or vice versa. This only applies to apps provisioned for the host OS and the OS you are upgrading to. -1. First, you'll need to identify the apps you removed from the Windows 10, version 1703 install image. The following table is a list of provisioned apps for version 1703 that includes their displayed names and package names: +1. First, you'll need to identify the apps you removed from the Windows 10, version 1703 install image. The following table lists the provisioned apps for version 1703, including their displayed names and package names: |Displayed app name|Package name| |---|---| |Microsoft.3DBuilder|Microsoft.3DBuilder_15.2.10821.1000_neutral_~_8wekyb3d8bbwe| From ed53b97c7a024553fbb1a88b7e2b4dbbc8feb56a Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 26 Apr 2018 09:52:05 -0700 Subject: [PATCH 036/215] Formulating a true first draft --- .../remove-provisioned-apps-during-update.md | 197 +----------------- 1 file changed, 9 insertions(+), 188 deletions(-) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index d856308125..8b466e1be2 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -15,14 +15,14 @@ ms.date: 04/20/2018 If you upgrade a Windows 10, version 1703 computer to Windows 10, version 1709 or Windows 10, version 1803 (or a Windows 10, version 1709 to Windows 10, version 1803 upgrade), provisioned apps that you've removed before the upgrade may return. This can happen if the apps were removed while the computer was offline. If the provisioned (added) apps were removed while online, the apps should not return after the upgrade. >[!NOTE] ->This setting only applies to first-party apps that shipped with Windows 10. This does not apply to third-party apps or apps that were acquired from the Microsoft Store, nor does it apply to LOB apps. +>This setting only applies to first-party apps that shipped with Windows 10. This doesn't apply to third-party apps or apps that were acquired from the Microsoft Store, nor does it apply to LOB apps. There are two points during removing a provisioned package from a Windows installation where this problem can occur: * If the packages are removed while the wim file is mounted when the device is offline. * If the provisioned package is removed while inside of Windows when the device is online. -When this happens, write a registry key for each app you remove. This way, you can use the registry key to indicate to your deployment whether to install or not install the app while you're upgrading it. +When this happens, write a registry key for each app you remove. This way, you can use the registry key to indicate to your deployment whether or not to install the app while you're upgrading it. ## Where to store deprovisioned app registration keys @@ -34,15 +34,13 @@ Each deprovisioned app gets a registry key with no data fields under it, just th `[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe]` -Starting with Windows 10, version 1703, the setup code knows to look for registry keys in this folder and will not reinstall any apps listed in this registry. However, in offline mode, the registry keys were not written when the apps were removed. This issue was addressed in Windows 10, version 1803, which ensures registry keys will be written for apps deprovisioned while offline so that setup can properly identify deprovisioned apps and not reinstall them during updates. Windows 10, version 1709 was also patched to correct this issue. +Starting with Windows 10, version 1703, the setup code knows to look for registry keys in this folder and will not reinstall any apps listed in this registry during upgrades in online mode. However, in offline mode, the registry keys were not written when the apps were removed. This issue was addressed in Windows 10, version 1803, which ensures registry keys will be written for apps deprovisioned while offline so that setup can properly identify deprovisioned apps and not reinstall them during updates. Windows 10, version 1709 was also patched to correct this issue. There will be scenarios where the apps were deprovisoned while offline prior to any changes being installed to Windows that would have corrected the behavior when removing the apps. >[!NOTE] >If you remove the provisioned apps while online, the account you used to sign in will contain the apps installed for that user. As a result, when you upgrade, the user you signed in as will retain the apps. User accounts created after the apps were removed or after an upgrade will not have the apps reinstalled. -## How to generate registry keys for deprovisioned apps - The following registry is where the registry keys for deprovisioned apps will be written to: `\microsoft\windows\currentversion\appx\appxalluserstore\deprovisioned\` @@ -51,10 +49,9 @@ Where `` is **HKLM\\Software** on an online running system. For an The key won't have any data values, as all the system needs to understand that the deprovisioned app should remain uninstalled is the existence of the key within the proper registry folder. -The following tables list the display and package names for provisioned apps for Windows 10, version 1703 and Windows 10, version 1709 that can be used to generate the registry keys if they are not already present in your installation. +## How to generate registry keys for deprovisioned apps + ->[!NOTE] ->The list of apps may vary with each feature release of Windows 10. Apps may also change in Status; for instance, an app listed as Provisioned in an older release might change to a System app in a newer version, or vice versa. This only applies to apps provisioned for the host OS and the OS you are upgrading to. 1. First, you'll need to identify the apps you removed from the Windows 10, version 1703 install image. The following table lists the provisioned apps for version 1703, including their displayed names and package names: |Displayed app name|Package name| @@ -96,6 +93,9 @@ The following tables list the display and package names for provisioned apps for |Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17122.16211.1000_neutral_~_8wekyb3d8bbwe| After identifying the apps, record their package numbers. + + >[!NOTE] + >The list of apps may vary with each feature release of Windows 10, and which applies to your situation depends on which versions your host OS and the OS you're upgrading to are. An app that's a provisioned app in an older release might change to a System app in a newer version, or vice versa. To see which apps are provisioned in your version, see [Understand the different apps included in Windows 10](https://docs.microsoft.com/en-us/windows/application-management/apps-in-windows-10). 2. Use the list of 1709 registry keys to create a script that will create a registry key for each app you don't want to reprovision. 1. Copy the 1709 registry keys list and paste them in a text editor. Remove any apps that you do want to provision during the upgrade from version 1703 to version 1709. The list should look something like the following, minus the apps you do want to add: @@ -140,183 +140,4 @@ The following tables list the display and package names for provisioned apps for 2. Save the text editor file as a .reg file. For more information, see [How to add, modify, or delete registry subkeys and values by using a .reg file](https://support.microsoft.com/en-us/help/310516/how-to-add-modify-or-delete-registry-subkeys-and-values-by-using-a-reg). 3. Import the .reg file into the Deprovisioned foler mentioned previously. -4. Update your Windows 10 deployment from version 1703 to version 1709. - - - - -## Ignore this section - -### Windows 10, version 1703 provisioned apps - -The following table is a list of provisioned apps for Windows 10, version 1703, listed by app name (DisplayName) and by the package name (PackageName) used for generating the registry key. - -**Note to self: If the setting doesn't apply to upgrates to 1703, then why are we listing the provisioned apps here?** - ->[!NOTE] ->This does not apply to upgrades to Windows 10, version 1703; the setup code to honor the removal for all users was enabled in Windows 10, version 1709 - -|Displayed app name|Package name| -|---|---| -|Microsoft.3DBuilder|Microsoft.3DBuilder_15.2.10821.1000_neutral_~_8wekyb3d8bbwe| -|Microsoft.BingWeather|Microsoft.BingWeather_4.23.10923.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.DesktopAppInstaller|Microsoft.DesktopAppInstaller_1.10.16004.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.GetHelp|Microsoft.GetHelp_10.1706.1811.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Getstarted|Microsoft.Getstarted_5.12.2691.1000_neutral_~_8wekyb3d8bbwe| -|Microsoft.HEVCVideoExtension|Microsoft.HEVCVideoExtension_1.0.2512.0_x64__8wekyb3d8bbwe| -|Microsoft.Messaging|Microsoft.Messaging_2018.124.707.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Microsoft3DViewer|Microsoft.Microsoft3DViewer_3.1803.29012.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MicrosoftOfficeHub|Microsoft.MicrosoftOfficeHub_2017.715.118.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MicrosoftSolitaireCollection|Microsoft.MicrosoftSolitaireCollection_3.18.12091.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MicrosoftStickyNotes|Microsoft.MicrosoftStickyNotes_2.1.18.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MSPaint|Microsoft.MSPaint_4.1803.21027.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Office.OneNote|Microsoft.Office.OneNote_2015.9126.21251.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.OneConnect|Microsoft.OneConnect_3.1708.2224.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.People|Microsoft.People_2017.1006.1846.1000_neutral_~_8wekyb3d8bbwe| -|Microsoft.Print3D|Microsoft.Print3D_1.0.2422.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.SkypeApp|Microsoft.SkypeApp_12.1811.248.1000_neutral_~_kzf8qxf38zg5c| -|Microsoft.StorePurchaseApp|Microsoft.StorePurchaseApp_11802.1802.23014.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Wallet|Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Windows.Photos|Microsoft.Windows.Photos_2018.18022.15810.1000_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsAlarms|Microsoft.WindowsAlarms_2017.920.157.1000_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsCalculator|Microsoft.WindowsCalculator_2017.928.0.1000_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsCamera|Microsoft.WindowsCamera_2017.1117.10.1000_neutral_~_8wekyb3d8bbwe| -|microsoft.windowscommunicationsapps|microsoft.windowscommunicationsapps_2015.9126.21425.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsFeedbackHub|Microsoft.WindowsFeedbackHub_2018.323.50.1000_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsMaps|Microsoft.WindowsMaps_2017.1003.1829.1000_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsSoundRecorder|Microsoft.WindowsSoundRecorder_2017.928.5.1000_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsStore|Microsoft.WindowsStore_11803.1001.613.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Xbox.TCUI|Microsoft.Xbox.TCUI_1.8.24001.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxApp|Microsoft.XboxApp_39.39.21002.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxGameOverlay|Microsoft.XboxGameOverlay_1.24.5001.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxIdentityProvider|Microsoft.XboxIdentityProvider_2017.605.1240.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxSpeechToTextOverlay|Microsoft.XboxSpeechToTextOverlay_1.21.13002.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.ZuneMusic|Microsoft.ZuneMusic_2019.18011.13411.1000_neutral_~_8wekyb3d8bbwe| -|Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17122.16211.1000_neutral_~_8wekyb3d8bbwe| - -The following is a list of registry keys created after removing all the provisioned apps in Windows 10 1709. This list can be copied into Notepad and saved as .reg file for importing into a Windows 10 registry for deprovisioned apps that's missing these values, preventing the removed apps from returning after an upgrade. - -Before importing this list, make sure you remove the lines for any apps you wish to retain. - -```syntax -Windows Registry Editor Version 5.00 -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.3DBuilder_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.GetHelp_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Getstarted_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Messaging_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MSPaint_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.OneNote_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.OneConnect_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.People_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SkypeApp_kzf8qxf38zg5c] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.StorePurchaseApp_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Wallet_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Photos_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsAlarms_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCamera_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\microsoft.windowscommunicationsapps_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsMaps_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsStore_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Xbox.TCUI_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxApp_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxGameOverlay_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] -``` - -### Windows 10, version 1709 provisioned apps - -The following table is a list of provisioned apps for Windows 10 1709, listed by app name (DisplayName) and by the package name (PackageName) used for generating the registry key. - -|DisplayName|PackageName| -|---|---| -|Microsoft.BingWeather|Microsoft.BingWeather_4.21.2492.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.DesktopAppInstaller|Microsoft.DesktopAppInstaller_1.8.4001.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.GetHelp|Microsoft.GetHelp_10.1706.1811.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Getstarted|Microsoft.Getstarted_5.11.1641.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Messaging|Microsoft.Messaging_2017.815.2052.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Microsoft3DViewer|Microsoft.Microsoft3DViewer_1.1707.26019.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MicrosoftOfficeHub|Microsoft.MicrosoftOfficeHub_2017.715.118.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MicrosoftSolitaireCollection|Microsoft.MicrosoftSolitaireCollection_3.17.8162.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MicrosoftStickyNotes|Microsoft.MicrosoftStickyNotes_1.8.2.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.MSPaint|Microsoft.MSPaint_2.1709.4027.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Office.OneNote|Microsoft.Office.OneNote_2015.8366.57611.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.OneConnect|Microsoft.OneConnect_3.1708.2224.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.People|Microsoft.People_2017.823.2207.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Print3D|Microsoft.Print3D_1.0.2422.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.SkypeApp|Microsoft.SkypeApp_11.18.596.0_neutral_~_kzf8qxf38zg5c| -|Microsoft.StorePurchaseApp|Microsoft.StorePurchaseApp_11706.1707.7104.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Wallet|Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Windows.Photos|Microsoft.Windows.Photos_2017.37071.16410.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsAlarms|Microsoft.WindowsAlarms_2017.828.2050.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsCalculator|Microsoft.WindowsCalculator_2017.828.2012.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsCamera|Microsoft.WindowsCamera_2017.727.20.0_neutral_~_8wekyb3d8bbwe| -|microsoft.windowscommunicationsapps|microsoft.windowscommunicationsapps_2015.8241.41275.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsFeedbackHub|Microsoft.WindowsFeedbackHub_1.1705.2121.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsMaps|Microsoft.WindowsMaps_2017.814.2249.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsSoundRecorder|Microsoft.WindowsSoundRecorder_2017.605.2103.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.WindowsStore|Microsoft.WindowsStore_11706.1002.94.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.Xbox.TCUI|Microsoft.Xbox.TCUI_1.8.24001.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxApp|Microsoft.XboxApp_31.32.16002.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxGameOverlay|Microsoft.XboxGameOverlay_1.20.25002.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxIdentityProvider|Microsoft.XboxIdentityProvider_2017.605.1240.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.XboxSpeechToTextOverlay|Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.ZuneMusic|Microsoft.ZuneMusic_2019.17063.24021.0_neutral_~_8wekyb3d8bbwe| -|Microsoft.ZuneVideo|Microsoft.ZuneVideo_2019.17063.24021.0_neutral_~_8wekyb3d8bbwe| - -The following list is a list of registry keys created after removing all the provisioned apps in Windows 10 1709. This list can be copied into notepad and saved as .reg file for importing into a Windows 10 registry for deprovisioned apps that's missing these values, preventing the removed apps from returning after an upgrade. - -Before importing this list, make sure you remove the lines for any apps you wish to retain. - -```syntax -1709 Registry Keys -Windows Registry Editor Version 5.00 -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.GetHelp_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Getstarted_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MSPaint_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.OneNote_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.OneConnect_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.People_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Print3D_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SkypeApp_kzf8qxf38zg5c] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.StorePurchaseApp_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Wallet_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Photos_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsAlarms_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCamera_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\microsoft.windowscommunicationsapps_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsMaps_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsStore_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Xbox.TCUI_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxApp_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxGameOverlay_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] -[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] -``` - -**Note to self: How do you create a registry key from the information listed in the previous sections?** \ No newline at end of file +4. Update your Windows 10 deployment from version 1703 to version 1709. \ No newline at end of file From ba9806a877f503963a23a23bdc43c00ec8a5973a Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 26 Apr 2018 09:52:55 -0700 Subject: [PATCH 037/215] Small formatting change Removed extra lines --- .../remove-provisioned-apps-during-update.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index 8b466e1be2..c205210598 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -51,8 +51,6 @@ The key won't have any data values, as all the system needs to understand that t ## How to generate registry keys for deprovisioned apps - - 1. First, you'll need to identify the apps you removed from the Windows 10, version 1703 install image. The following table lists the provisioned apps for version 1703, including their displayed names and package names: |Displayed app name|Package name| |---|---| From 20d938d81acfa84248b780c0e9e7d117656b5f9f Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 26 Apr 2018 10:32:00 -0700 Subject: [PATCH 038/215] Added intro and disclaimer to procedure --- .../remove-provisioned-apps-during-update.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index c205210598..7b88a13af5 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -51,6 +51,8 @@ The key won't have any data values, as all the system needs to understand that t ## How to generate registry keys for deprovisioned apps +Let's say you're upgrading from Windows 10, version 1703 to Windows 10, version 1709. Here's what you'll need to do: + 1. First, you'll need to identify the apps you removed from the Windows 10, version 1703 install image. The following table lists the provisioned apps for version 1703, including their displayed names and package names: |Displayed app name|Package name| |---|---| @@ -138,4 +140,7 @@ The key won't have any data values, as all the system needs to understand that t 2. Save the text editor file as a .reg file. For more information, see [How to add, modify, or delete registry subkeys and values by using a .reg file](https://support.microsoft.com/en-us/help/310516/how-to-add-modify-or-delete-registry-subkeys-and-values-by-using-a-reg). 3. Import the .reg file into the Deprovisioned foler mentioned previously. -4. Update your Windows 10 deployment from version 1703 to version 1709. \ No newline at end of file +4. Update your Windows 10 deployment from version 1703 to version 1709. + +>[!IMPORTANT] +>This example only applies to an upgrade from Windows 10, version 1703 to version 1709. If you're upgrading from Windows 10, version 1706, the general procedure will be the same, but the package names and keys generated may be different. \ No newline at end of file From 61c2d42d7f3e646c7641baae7acc1b501d216f98 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 26 Apr 2018 10:32:42 -0700 Subject: [PATCH 039/215] Editorial change --- .../remove-provisioned-apps-during-update.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index 7b88a13af5..2df935a568 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -143,4 +143,4 @@ Let's say you're upgrading from Windows 10, version 1703 to Windows 10, version 4. Update your Windows 10 deployment from version 1703 to version 1709. >[!IMPORTANT] ->This example only applies to an upgrade from Windows 10, version 1703 to version 1709. If you're upgrading from Windows 10, version 1706, the general procedure will be the same, but the package names and keys generated may be different. \ No newline at end of file +>This example only applies to an upgrade from Windows 10, version 1703 to version 1709. If you're upgrading from Windows 10, version 1706, the general procedure will be the same, but the package names and generated keys may be different. \ No newline at end of file From b64003a11bb4a936265697b819b655d27744cb3e Mon Sep 17 00:00:00 2001 From: Allison Hopper - Microsoft Date: Fri, 27 Apr 2018 14:50:01 -0700 Subject: [PATCH 040/215] Added stub topic for MRMW apps, and links in TOC and index --- devices/hololens/TOC.md | 1 + devices/hololens/hololens-public-preview-apps.md | 12 ++++++++++++ devices/hololens/index.md | 1 + 3 files changed, 14 insertions(+) create mode 100644 devices/hololens/hololens-public-preview-apps.md diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md index 87ef48bb20..98c0323b51 100644 --- a/devices/hololens/TOC.md +++ b/devices/hololens/TOC.md @@ -6,5 +6,6 @@ ## [Set up HoloLens in kiosk mode](hololens-kiosk.md) ## [Configure HoloLens using a provisioning package](hololens-provisioning.md) ## [Install apps on HoloLens](hololens-install-apps.md) +## [Get early access to preview new modern workplace apps](hololens-public-preview-apps.md) ## [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) ## [Change history for Microsoft HoloLens documentation](change-history-hololens.md) \ No newline at end of file diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md new file mode 100644 index 0000000000..4640a0fd4f --- /dev/null +++ b/devices/hololens/hololens-public-preview-apps.md @@ -0,0 +1,12 @@ +--- +title: Get early access to preview new modern workplace apps +description: Distribute and use HoloLens modern workplace apps during public preview +ms.prod: w10 +ms.mktglfcycl: manage +ms.pagetype: hololens, devices +ms.sitesec: library +author: alhopper +ms.localizationpriority: medium +ms.date: 05/22/2018 +--- +# Get early access to preview new modern workplace apps \ No newline at end of file diff --git a/devices/hololens/index.md b/devices/hololens/index.md index ddb5c29aea..664f5fef88 100644 --- a/devices/hololens/index.md +++ b/devices/hololens/index.md @@ -28,6 +28,7 @@ ms.date: 11/29/2017 | [Set up HoloLens in kiosk mode](hololens-kiosk.md) | Enable kiosk mode for HoloLens, which limits the user's ability to launch new apps or change the running app | | [Configure HoloLens using a provisioning package](hololens-provisioning.md) | Provisioning packages make it easy for IT administrators to configure HoloLens devices without imaging | | [Install apps on HoloLens](hololens-install-apps.md) | Use Microsoft Store for Business, mobile device management (MDM), or the Windows Device Portal to install apps on HoloLens| +| [Get early access to preview new modern workplace apps](hololens-public-preview-apps.md) | Distribute and use new HoloLens modern workplace apps during private preview |
## Related resources From 8063c94082fcdab143f9b95542916da843f62482 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Apr 2018 13:55:03 -0700 Subject: [PATCH 041/215] update proxy table --- ...ows-defender-advanced-threat-protection.md | 23 ++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md index cd4942e214..e5c1e8c72f 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -85,10 +85,27 @@ For example: netsh winhttp set proxy 10.0.0.6:8080 ## Enable access to Windows Defender ATP service URLs in the proxy server If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service in port 80 and 443: -Service location | .Microsoft.com DNS record +**For Windows 10, version 1607 to Windows 10, version 1709**: + +Service location | Microsoft.com DNS record :---|:--- - US |```*.blob.core.windows.net```
```crl.microsoft.com```
```ctldl.windowsupdate.com```
```us.vortex-win.data.microsoft.com```
```winatp-gw-cus.microsoft.com```
```winatp-gw-eus.microsoft.com``` -Europe |```*.blob.core.windows.net```
```crl.microsoft.com```
```ctldl.windowsupdate.com```
```eu.vortex-win.data.microsoft.com```
```winatp-gw-neu.microsoft.com```
```winatp-gw-weu.microsoft.com```
+Common URLs for all locations | ```*.blob.core.windows.net```
```crl.microsoft.com```
```ctldl.windowsupdate.com``` +US | ```us.vortex-win.data.microsoft.com```
```winatp-gw-cus.microsoft.com```
```winatp-gw-eus.microsoft.com``` +Europe | ```eu.vortex-win.data.microsoft.com```
```winatp-gw-neu.microsoft.com```
```winatp-gw-weu.microsoft.com``` +UK | ```uk.vortex-win.data.microsoft.com```
```winatp-gw-uks.microsoft.com```
```winatp-gw-ukw.microsoft.com``` +AU | ```au.vortex-win.data.microsoft.com```
```winatp-gw-aue.microsoft.com```
```winatp-gw-aus.microsoft.com``` + + +**For Windows 10, version 1803**: + +Service location | Microsoft.com DNS record +:---|:--- +Common URLs for all locations |```*.blob.core.windows.net```
```crl.microsoft.com```
```ctldl.windowsupdate.com```
```events.data.microsoft.com``` +US | ```us-v20.events.data.microsoft.com```
```winatp-gw-cus.microsoft.com```
```winatp-gw-eus.microsoft.com``` +Europe | ```eu-v20.events.data.microsoft.com```
```winatp-gw-neu.microsoft.com```
```winatp-gw-weu.microsoft.com``` +UK | ```uk-v20.events.data.microsoft.com```
```winatp-gw-uks.microsoft.com```
```winatp-gw-ukw.microsoft.com``` +AU | ```au-v20.events.data.microsoft.com```
```winatp-gw-aue.microsoft.com```
```winatp-gw-aus.microsoft.com``` + If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the above listed URLs. From 75e736ee4216791b42799e0b70e398a97d5e0a27 Mon Sep 17 00:00:00 2001 From: Patti Short Date: Mon, 30 Apr 2018 14:00:00 -0700 Subject: [PATCH 042/215] revised the description --- browsers/edge/available-policies.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 1c19fbbff1..e9cc6f6344 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -167,7 +167,13 @@ For more information, see [Microsoft browser extension policy](https://docs.micr ## Allow web content on New Tab page >*Supported versions: Windows 10* -This policy setting lets you configure what appears when a New Tab page is opened in Microsoft Edge. By default, this setting is disabled or not configured, which means you cannot customize their New Tab page. If enabled, you can customize their New Tab page. +This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. + +If you enable this setting, Microsoft Edge opens a new tab with the New Tab page. + +If you disable this setting, Microsoft Edge opens a new tab with a blank page. If you use this setting, employees can't change it. + +If you don't configure this setting, employees can choose how new tabs appears ## Always Enable book library From 0ae39e9f86b75a96a2224417071db3df4d8525b7 Mon Sep 17 00:00:00 2001 From: Allison Hopper - Microsoft Date: Mon, 30 Apr 2018 14:39:38 -0700 Subject: [PATCH 043/215] Added technical requirements for MRMW apps --- .../hololens/hololens-public-preview-apps.md | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md index d9d569a937..49a0f7a7a1 100644 --- a/devices/hololens/hololens-public-preview-apps.md +++ b/devices/hololens/hololens-public-preview-apps.md @@ -19,4 +19,20 @@ Soon, these apps will be available to download and deploy across your organizati Remote Assist uses Microsoft Teams to facilitate two-way, real time, audio and video communication between a remote HoloLens user, and a user at a PC. The HoloLens user can project their view into Microsoft Teams, where the PC user can use inking annotations to mark it up with text and icons. The HoloLens user will see the inking appear within their device in real time. -## Layout \ No newline at end of file +Here are the requirements you'll need to meet in order to deploy Remote Assist throughout your organization: + +* HoloLens RS4 build: The HoloLens RS4 build is currently available as an Insider Preview. It will become publicly available to align with the public release of the modern workplace apps. +* Azure Active Directory (Azure AD): required for app deployment. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. +* Microsoft Teams: Microsoft Teams is the backbone that facilitates communication in Remote Assist. All devices that will make calls to the HoloLens will need to have Microsoft Teams installed. +* Microsoft Office 365: Because Microsoft Teams is part of Office 365, all users who will make calls from their PC/phone to the HoloLens will need an Office 365 license. See [Office 365 licensing for Microsoft Teams](https://docs.microsoft.com/en-us/MicrosoftTeams/office-365-licensing) to learn more. +* Network requirements: 1.5Mb/s is the required bandwidth to enable the full feature set. If your organization's bandwidth does not meet these requirements, HoloLens will shut down features to adapt to reduced bandwidth, limiting the experience to audio calls only. Please test your company’s network bandwidth by performing the following steps: + 1. Have a mobile Teams user (iOS or Android) video call a desktop Teams user. + 2. Once the video call has been successfully connected between user 1 and 2, add another separate video call between a 3rd and 4th user, and so on for users 5 and 6. + 3. Continue adding video callers to stress test your network bandwidth until confident that multiple users can successfully connect on video calls at the same time. + 4. For more on “Preparing your organization for Microsoft Teams and network bandwidth requirements, read here. + +## Layout + +* HoloLens RS4 build: The HoloLens RS4 build is currently available as an Insider Preview. It will become publicly available to align with the public release of the modern workplace apps. +* Azure Active Directory (Azure AD): required for app deployment. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. +* Network requirements: Internet access is required to download the app, and utilize all of its features. There are no bandwidth requirements. \ No newline at end of file From 7ff939709796c1b07bbdb2d62c47310169f106ce Mon Sep 17 00:00:00 2001 From: Allison Hopper - Microsoft Date: Mon, 30 Apr 2018 14:49:01 -0700 Subject: [PATCH 044/215] Added more info on Layout --- devices/hololens/hololens-public-preview-apps.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md index 49a0f7a7a1..4b07dc92df 100644 --- a/devices/hololens/hololens-public-preview-apps.md +++ b/devices/hololens/hololens-public-preview-apps.md @@ -13,16 +13,16 @@ ms.date: 05/07/2018 Microsoft has just announced two new modern workplace apps coming to HoloLens: Remote Assist and Layout. -Soon, these apps will be available to download and deploy across your organization as part of a public preview. In the meantime, here's what you need to know to prepare for the public preview of each app, to make sure your app roll-out is smooth and seamless. +Soon, these apps will be available to download and distribute across your organization as part of a public preview. In the meantime, here's what you need to know to prepare for the public preview of each app, to make sure your roll-out is smooth and seamless. ## Remote Assist Remote Assist uses Microsoft Teams to facilitate two-way, real time, audio and video communication between a remote HoloLens user, and a user at a PC. The HoloLens user can project their view into Microsoft Teams, where the PC user can use inking annotations to mark it up with text and icons. The HoloLens user will see the inking appear within their device in real time. -Here are the requirements you'll need to meet in order to deploy Remote Assist throughout your organization: +Here are the requirements you'll need to meet in order to distribute Remote Assist throughout your organization: * HoloLens RS4 build: The HoloLens RS4 build is currently available as an Insider Preview. It will become publicly available to align with the public release of the modern workplace apps. -* Azure Active Directory (Azure AD): required for app deployment. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. +* Azure Active Directory (Azure AD): required for app distribution. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. * Microsoft Teams: Microsoft Teams is the backbone that facilitates communication in Remote Assist. All devices that will make calls to the HoloLens will need to have Microsoft Teams installed. * Microsoft Office 365: Because Microsoft Teams is part of Office 365, all users who will make calls from their PC/phone to the HoloLens will need an Office 365 license. See [Office 365 licensing for Microsoft Teams](https://docs.microsoft.com/en-us/MicrosoftTeams/office-365-licensing) to learn more. * Network requirements: 1.5Mb/s is the required bandwidth to enable the full feature set. If your organization's bandwidth does not meet these requirements, HoloLens will shut down features to adapt to reduced bandwidth, limiting the experience to audio calls only. Please test your company’s network bandwidth by performing the following steps: @@ -33,6 +33,10 @@ Here are the requirements you'll need to meet in order to deploy Remote Assist t ## Layout +Layout enables you to scan a space using the HoloLens, or import a space from another app, and design it using preloaded assets. + +Here are the requirements you'll need to meet in order to distribute Layout throughout your organization: + * HoloLens RS4 build: The HoloLens RS4 build is currently available as an Insider Preview. It will become publicly available to align with the public release of the modern workplace apps. -* Azure Active Directory (Azure AD): required for app deployment. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. +* Azure Active Directory (Azure AD): required for app distribution. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. * Network requirements: Internet access is required to download the app, and utilize all of its features. There are no bandwidth requirements. \ No newline at end of file From ec02cf1f960b997bd886347c4d6e85bdbc85fc72 Mon Sep 17 00:00:00 2001 From: Allison Hopper - Microsoft Date: Mon, 30 Apr 2018 16:11:10 -0700 Subject: [PATCH 045/215] Updating requirements --- devices/hololens/hololens-public-preview-apps.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md index 4b07dc92df..61e9a11149 100644 --- a/devices/hololens/hololens-public-preview-apps.md +++ b/devices/hololens/hololens-public-preview-apps.md @@ -21,11 +21,13 @@ Remote Assist uses Microsoft Teams to facilitate two-way, real time, audio and v Here are the requirements you'll need to meet in order to distribute Remote Assist throughout your organization: -* HoloLens RS4 build: The HoloLens RS4 build is currently available as an Insider Preview. It will become publicly available to align with the public release of the modern workplace apps. -* Azure Active Directory (Azure AD): required for app distribution. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. -* Microsoft Teams: Microsoft Teams is the backbone that facilitates communication in Remote Assist. All devices that will make calls to the HoloLens will need to have Microsoft Teams installed. -* Microsoft Office 365: Because Microsoft Teams is part of Office 365, all users who will make calls from their PC/phone to the HoloLens will need an Office 365 license. See [Office 365 licensing for Microsoft Teams](https://docs.microsoft.com/en-us/MicrosoftTeams/office-365-licensing) to learn more. -* Network requirements: 1.5Mb/s is the required bandwidth to enable the full feature set. If your organization's bandwidth does not meet these requirements, HoloLens will shut down features to adapt to reduced bandwidth, limiting the experience to audio calls only. Please test your company’s network bandwidth by performing the following steps: +* **HoloLens, with RS4 build**: The HoloLens RS4 build will become publicly available at the same time as the modern workplace apps. There are two ways to ensure your HoloLen device has the required build: + * On May 22, update the HoloLens device + * Download Insider Preview builds. +* **Azure Active Directory (Azure AD)**: required for app distribution. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. +* **Microsoft Teams**: Microsoft Teams is the backbone that facilitates communication in Remote Assist. All devices that will make calls to the HoloLens will need to have Microsoft Teams installed. +* **Microsoft Office 365**: Because Microsoft Teams is part of Office 365, all users who will make calls from their PC/phone to the HoloLens will need an Office 365 license. See [Office 365 licensing for Microsoft Teams](https://docs.microsoft.com/en-us/MicrosoftTeams/office-365-licensing) to learn more. +* **Network requirements**: 1.5Mb/s is the required bandwidth to enable the full feature set. If your organization's bandwidth does not meet these requirements, HoloLens will shut down features to adapt to reduced bandwidth, limiting the experience to audio calls only. Please test your company’s network bandwidth by performing the following steps: 1. Have a mobile Teams user (iOS or Android) video call a desktop Teams user. 2. Once the video call has been successfully connected between user 1 and 2, add another separate video call between a 3rd and 4th user, and so on for users 5 and 6. 3. Continue adding video callers to stress test your network bandwidth until confident that multiple users can successfully connect on video calls at the same time. @@ -37,6 +39,6 @@ Layout enables you to scan a space using the HoloLens, or import a space from an Here are the requirements you'll need to meet in order to distribute Layout throughout your organization: -* HoloLens RS4 build: The HoloLens RS4 build is currently available as an Insider Preview. It will become publicly available to align with the public release of the modern workplace apps. +* HoloLens, or Windows Mixed Reality headset: * Azure Active Directory (Azure AD): required for app distribution. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. * Network requirements: Internet access is required to download the app, and utilize all of its features. There are no bandwidth requirements. \ No newline at end of file From 79f6c8e233597c0d87148257992e884d8fd5fcf7 Mon Sep 17 00:00:00 2001 From: Allison Hopper - Microsoft Date: Mon, 30 Apr 2018 16:30:55 -0700 Subject: [PATCH 046/215] Adding links for HoloLens RS4 Preview --- devices/hololens/hololens-public-preview-apps.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md index 61e9a11149..5dc15249a2 100644 --- a/devices/hololens/hololens-public-preview-apps.md +++ b/devices/hololens/hololens-public-preview-apps.md @@ -13,7 +13,7 @@ ms.date: 05/07/2018 Microsoft has just announced two new modern workplace apps coming to HoloLens: Remote Assist and Layout. -Soon, these apps will be available to download and distribute across your organization as part of a public preview. In the meantime, here's what you need to know to prepare for the public preview of each app, to make sure your roll-out is smooth and seamless. +On May 22, 2018, these apps will be available to download and distribute across your organization as part of a public preview. In the meantime, here's what you need to know to prepare for the public preview of each app, to make sure your roll-out is smooth and seamless. ## Remote Assist @@ -21,9 +21,9 @@ Remote Assist uses Microsoft Teams to facilitate two-way, real time, audio and v Here are the requirements you'll need to meet in order to distribute Remote Assist throughout your organization: -* **HoloLens, with RS4 build**: The HoloLens RS4 build will become publicly available at the same time as the modern workplace apps. There are two ways to ensure your HoloLen device has the required build: - * On May 22, update the HoloLens device - * Download Insider Preview builds. +* **HoloLens, with RS4 build**: The HoloLens RS4 build will become publicly available at the same time as the modern workplace apps. There are two ways to ensure your HoloLens device has the required build: + * On May 22, update the HoloLens operating system. + * Get started testing out the RS4 build in advance of May 22. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for more information about the preview, and how it will impact your HoloLens device. * **Azure Active Directory (Azure AD)**: required for app distribution. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. * **Microsoft Teams**: Microsoft Teams is the backbone that facilitates communication in Remote Assist. All devices that will make calls to the HoloLens will need to have Microsoft Teams installed. * **Microsoft Office 365**: Because Microsoft Teams is part of Office 365, all users who will make calls from their PC/phone to the HoloLens will need an Office 365 license. See [Office 365 licensing for Microsoft Teams](https://docs.microsoft.com/en-us/MicrosoftTeams/office-365-licensing) to learn more. @@ -39,6 +39,8 @@ Layout enables you to scan a space using the HoloLens, or import a space from an Here are the requirements you'll need to meet in order to distribute Layout throughout your organization: -* HoloLens, or Windows Mixed Reality headset: +* **HoloLens with RS4 build, or Windows Mixed Reality headset**: + * If you're using a HoloLens, it must be running RS4. RS4 will be available as an operating system update on May 22nd, or you can get started testing out the RS4 build in advance of May 22nd. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for more information about the preview, and how it will impact your HoloLens device. + * If you're using a Windows Mixed Reality headset, your PCs will need to be able to support it. See [Windows Mixed Reality PC hardware guidelines](https://support.microsoft.com/en-us/help/4039260/windows-10-mixed-reality-pc-hardware-guidelines) for specific hardware requirements. We recommend following the **Windows Mixed Reality Ultra** hardware guidelines. * Azure Active Directory (Azure AD): required for app distribution. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. * Network requirements: Internet access is required to download the app, and utilize all of its features. There are no bandwidth requirements. \ No newline at end of file From f954fde11553980554a01458879d7bb685f793e1 Mon Sep 17 00:00:00 2001 From: MikeBlodge Date: Tue, 1 May 2018 07:34:37 -0700 Subject: [PATCH 047/215] correcting typos --- education/windows/switch-to-pro-education.md | 132 +++++++++---------- 1 file changed, 66 insertions(+), 66 deletions(-) diff --git a/education/windows/switch-to-pro-education.md b/education/windows/switch-to-pro-education.md index 31b94541f8..813fc180de 100644 --- a/education/windows/switch-to-pro-education.md +++ b/education/windows/switch-to-pro-education.md @@ -1,7 +1,7 @@ --- -title: Switch to Windows 10 Pro Education from Windows 10 Pro -description: Learn how IT Pros can opt into switching to Windows 10 Pro Education from Windows 10 Pro. -keywords: switch, free switch, Windows 10 Pro to Windows 10 Pro Education, Windows 10 Pro to Windows 10 Pro Education, education customers, Windows 10 Pro Education, Windows 10 Pro +title: Change to Windows 10 Education from Windows 10 Pro +description: Learn how IT Pros can opt into changing to Windows 10 Pro Education from Windows 10 Pro. +keywords: change, free change, Windows 10 Pro to Windows 10 Pro Education, Windows 10 Pro to Windows 10 Pro Education, education customers, Windows 10 Pro Education, Windows 10 Pro ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -9,20 +9,20 @@ ms.pagetype: edu ms.localizationpriority: high author: MikeBlodge ms.author: MikeBlodge -ms.date: 10/30/2017 +ms.date: 04/30/2018 --- -# Switch to Windows 10 Pro Education from Windows 10 Pro +# Change to Windows 10 Education from Windows 10 Pro Windows 10 Pro Education is a new offering in Windows 10, version 1607. This edition builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools by providing education-specific default settings. -If you have an education tenant and use devices with Windows 10 Pro, global administrators can opt-in to a free switch to Windows 10 Pro Education depending on your scenario. -- [Switch from Windows 10 Pro in S mode to Windows 10 Pro Education in S mode](https://www.microsoft.com/en-us/education/windows/s-mode-switch-to-edu) -- [Switch from Windows 10 Pro to Windows 10 Pro Education](#switch-from-windows-10-pro-to-windows-10-pro-education) +If you have an education tenant and use devices with Windows 10 Pro, global administrators can opt-in to a free change to Windows 10 Pro Education depending on your scenario. +- [change from Windows 10 Pro in S mode to Windows 10 Pro Education in S mode](https://www.microsoft.com/en-us/education/windows/s-mode-change-to-edu) +- [change from Windows 10 Pro to Windows 10 Pro Education](#change-from-windows-10-pro-to-windows-10-pro-education) -To take advantage of this offering, make sure you meet the [requirements for switching](#requirements-for-switching). For academic customers who are eligible to switch to Windows 10 Pro Education, but are unable to use the above methods, contact Microsoft Support for assistance. +To take advantage of this offering, make sure you meet the [requirements for changing](#requirements-for-changing). For academic customers who are eligible to change to Windows 10 Pro Education, but are unable to use the above methods, contact Microsoft Support for assistance. -## Requirements for switching -Before you switch to Windows 10 Pro Education, make sure you meet these requirements: +## Requirements for changing +Before you change to Windows 10 Pro Education, make sure you meet these requirements: - Devices must be running Windows 10 Pro, version 1607 or higher. - Devices must be Azure Active Directory joined, or domain joined with Azure AD Connect. Customers who are federated with Azure AD are also eligible. For more information, see [Review requirements on devices](#review-requirements-on-devices). @@ -37,129 +37,129 @@ You can [compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsFor For more info about Windows 10 default settings and recommendations for education customers, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). -## Switch from Windows 10 Pro to Windows 10 Pro Education +## change from Windows 10 Pro to Windows 10 Pro Education -For schools that want to standardize all their Windows 10 Pro devices to Windows 10 Pro Education, a global admin for the school can opt-in to a free switch through the Microsoft Store for Education. +For schools that want to standardize all their Windows 10 Pro devices to Windows 10 Pro Education, a global admin for the school can opt-in to a free change through the Microsoft Store for Education. In this scenario: -- The IT admin of the tenant chooses to turn on the switch for all Azure AD joined devices. -- Any device that joins the Azure AD will switch automatically to Windows 10 Pro Education. +- The IT admin of the tenant chooses to turn on the change for all Azure AD joined devices. +- Any device that joins the Azure AD will change automatically to Windows 10 Pro Education. - The IT admin has the option to automatically roll back to Windows 10 Pro, if desired. See [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro). -See [Switch using Microsoft Store for Education](#switch-using-microsoft-store-for-education) for details on how to do this. +See [change using Microsoft Store for Education](#change-using-microsoft-store-for-education) for details on how to do this. -### Switch using Intune for Education +### change using Intune for Education 1. In Intune for Education, select **Groups** and then choose the group that you want to apply the MAK license key to. - For example, to apply the switch for all teachers, select **All Teachers** and then select **Settings**. + For example, to apply the change for all teachers, select **All Teachers** and then select **Settings**. 2. In the settings page, find **Edition upgrade** and then: 1. Select the edition in the **Edition to upgrade to** field 2. Enter the MAK license key in the **Product key** field - **Figure 1** - Enter the details for the Windows edition switch + **Figure 1** - Enter the details for the Windows edition change - ![Enter the details for the Windows edition switch](images/i4e_editionupgrade.png) + ![Enter the details for the Windows edition change](images/i4e_editionupgrade.png) -3. The switch will automatically be applied to the group you selected. +3. The change will automatically be applied to the group you selected. -### Switch using Windows Configuration Designer -You can use Windows Configuration Designer to create a provisioning package that you can use to switch the Windows edition for your device(s). [Install Windows Configuration Designer from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22) to create a provisioning package. +### change using Windows Configuration Designer +You can use Windows Configuration Designer to create a provisioning package that you can use to change the Windows edition for your device(s). [Install Windows Configuration Designer from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22) to create a provisioning package. 1. In Windows Configuration Designer, select **Provision desktop devices** to open the simple editor and create a provisioning package for Windows desktop editions. -2. In the **Set up device** page, enter the MAK license key in the **Enter product key** field to switch to Windows 10 Pro Education. +2. In the **Set up device** page, enter the MAK license key in the **Enter product key** field to change to Windows 10 Pro Education. **Figure 2** - Enter the license key - ![Enter the license key to switch to Windows 10 Pro Education](images/wcd_productkey.png) + ![Enter the license key to change to Windows 10 Pro Education](images/wcd_productkey.png) -3. Complete the rest of the process for creating a provisioning package and then apply the package to the devices you want to switch to Windows 10 Pro Education. +3. Complete the rest of the process for creating a provisioning package and then apply the package to the devices you want to change to Windows 10 Pro Education. For more information about using Windows Configuration Designer, see [Set up student PCs to join domain](https://technet.microsoft.com/en-us/edu/windows/set-up-students-pcs-to-join-domain). -### Switch using the Activation page +### change using the Activation page -1. On the Windows device that you want to switch, open the **Settings** app. +1. On the Windows device that you want to change, open the **Settings** app. 2. Select **Update & security** > **Activation**, and then click **Change product key**. 3. In the **Enter a product key** window, enter the MAK key for Windows 10 Pro Education and click **Next**. ## Education customers with Azure AD joined devices -Academic institutions can easily move from Windows 10 Pro to Windows 10 Pro Education without using activation keys or reboots. When one of your users enters their Azure AD credentials associated with a Windows 10 Pro Education license, the operating system switches to Windows 10 Pro Education and all the appropriate Windows 10 Pro Education features are unlocked. Previously, only schools or organizations purchasing devices as part of the Shape the Future K-12 program or with a Microsoft Volume Licensing Agreement could deploy Windows 10 Pro Education to their users. Now, if you have an Azure AD for your organization, you can take advantage of the Windows 10 Pro Education features. +Academic institutions can easily move from Windows 10 Pro to Windows 10 Pro Education without using activation keys or reboots. When one of your users enters their Azure AD credentials associated with a Windows 10 Pro Education license, the operating system changees to Windows 10 Pro Education and all the appropriate Windows 10 Pro Education features are unlocked. Previously, only schools or organizations purchasing devices as part of the Shape the Future K-12 program or with a Microsoft Volume Licensing Agreement could deploy Windows 10 Pro Education to their users. Now, if you have an Azure AD for your organization, you can take advantage of the Windows 10 Pro Education features. -When you switch to Windows 10 Pro Education, you get the following benefits: +When you change to Windows 10 Pro Education, you get the following benefits: - **Windows 10 Pro Education edition**. Devices currently running Windows 10 Pro, version 1607 or higher, or Windows 10 S mode, version 1703, can get Windows 10 Pro Education Current Branch (CB). This benefit does not include Long Term Service Branch (LTSB). - **Support from one to hundreds of users**. The Windows 10 Pro Education program does not have a limitation on the number of licenses an organization can have. - **Roll back options to Windows 10 Pro** - - When a user leaves the domain or you turn off the setting to automatically switch to Windows 10 Pro Education, the device reverts seamlessly to Windows 10 Pro edition (after a grace period of up to 30 days). + - When a user leaves the domain or you turn off the setting to automatically change to Windows 10 Pro Education, the device reverts seamlessly to Windows 10 Pro edition (after a grace period of up to 30 days). - For devices that originally had Windows 10 Pro edition installed, when a license expires or is transferred to another user, the Windows 10 Pro Education device seamlessly steps back down to Windows 10 Pro. See [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro) for more info. -### Switch using Microsoft Store for Education -Once you enable the setting to switch to Windows 10 Pro Education, the switch will begin only after a user signs in to their device. The setting applies to the entire organization or tenant, so you cannot select which users will receive the switch. The switch will only apply to Windows 10 Pro devices. +### change using Microsoft Store for Education +Once you enable the setting to change to Windows 10 Pro Education, the change will begin only after a user signs in to their device. The setting applies to the entire organization or tenant, so you cannot select which users will receive the change. The change will only apply to Windows 10 Pro devices. -**To turn on the automatic switch to Windows 10 Pro Education** +**To turn on the automatic change to Windows 10 Pro Education** 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your work or school account. If this is the first time you're signing into the Microsoft Store for Education, you'll be prompted to accept the Microsoft Store for Education Terms of Use. 2. Click **Manage** from the top menu and then select the **Benefits tile**. -3. In the **Benefits** tile, look for the **Switch to Windows 10 Pro Education for free** link and then click it. +3. In the **Benefits** tile, look for the **change to Windows 10 Pro Education for free** link and then click it. - You will see the following page informing you that your school is eligible to switch free to Windows 10 Pro Education to Windows 10 Pro. + You will see the following page informing you that your school is eligible to change free to Windows 10 Pro Education to Windows 10 Pro. - **Figure 3** - Switch Windows 10 Pro to Windows 10 Pro Education + **Figure 3** - change Windows 10 Pro to Windows 10 Pro Education - ![Eligible for free Windows 10 Pro to Windows 10 Pro Education switch](images/msfe_manage_benefits_switchtoproedu.png) + ![Eligible for free Windows 10 Pro to Windows 10 Pro Education change](images/msfe_manage_benefits_changetoproedu.png) -4. In the **Switch all your devices to Windows 10 Pro Education for free** page, check box next to **I understand enabling this setting will switch all domain-joined devices running Windows 10 Pro in my organization**. +4. In the **change all your devices to Windows 10 Pro Education for free** page, check box next to **I understand enabling this setting will change all domain-joined devices running Windows 10 Pro in my organization**. **Figure 4** - Check the box to confirm ![Check the box to confirm](images/msfe_manage_benefits_checktoconfirm.png) -5. Click **Switch all my devices**. +5. Click **change all my devices**. - A confirmation window pops up to let you know that an email has been sent to you to enable the switch. + A confirmation window pops up to let you know that an email has been sent to you to enable the change. 6. Close the confirmation window and check the email to proceed to the next step. -7. In the email, click the link to **Switch to Windows 10 Pro Education**. Once you click the link, this will take you back to the Microsoft Store for Education portal. +7. In the email, click the link to **change to Windows 10 Pro Education**. Once you click the link, this will take you back to the Microsoft Store for Education portal. - **Figure 5** - Click the link in the email to switch to Windows 10 Pro Education + **Figure 5** - Click the link in the email to change to Windows 10 Pro Education - ![Click the email link to switch to Windows 10 Pro Education](images/msfe_clickemaillink_switchtoproedu.png) + ![Click the email link to change to Windows 10 Pro Education](images/msfe_clickemaillink_changetoproedu.png) -8. Click **Switch now** in the **Switching your device to Windows 10 Pro Education for free** page in the Microsoft Store. +8. Click **change now** in the **changing your device to Windows 10 Pro Education for free** page in the Microsoft Store. - You will see a window that confirms you've successfully switched all the devices in your organization to Windows 10 Pro Education, and each Azure AD joined device running Windows 10 Pro will automatically switch the next time someone in your organization signs in to the device. + You will see a window that confirms you've successfully changeed all the devices in your organization to Windows 10 Pro Education, and each Azure AD joined device running Windows 10 Pro will automatically change the next time someone in your organization signs in to the device. 9. Click **Close** in the **Success** window. -Enabling the automatic switch also triggers an email message notifying all global administrators in your organization about the switch. It also contains a link that enables any global administrators to cancel the switch if they choose. For more info about rolling back or canceling the switch, see [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro).\ +Enabling the automatic change also triggers an email message notifying all global administrators in your organization about the change. It also contains a link that enables any global administrators to cancel the change if they choose. For more info about rolling back or canceling the change, see [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro).\ -**Figure 6** - Email notifying all global admins about the switch +**Figure 6** - Email notifying all global admins about the change -![Email notifying all global admins about the switch](images/msfe_switchtoproedu_globaladminsemail_cancelswitch.png) +![Email notifying all global admins about the change](images/msfe_changetoproedu_globaladminsemail_cancelchange.png) -## Explore the switch experience +## Explore the change experience -So what will users experience? How will they switch their devices? +So what will users experience? How will they change their devices? ### For existing Azure AD joined devices -Existing Azure AD domain joined devices will be switched to Windows 10 Pro Education the next time the user logs in. That's it! No additional steps are needed. +Existing Azure AD domain joined devices will be changeed to Windows 10 Pro Education the next time the user logs in. That's it! No additional steps are needed. ### For new devices that are not Azure AD joined -Now that you've turned on the setting to automatically switch to Windows 10 Pro Education, the users are ready to switch their devices running Windows 10 Pro, version 1607 or higher, version 1703 to Windows 10 Pro Education edition. +Now that you've turned on the setting to automatically change to Windows 10 Pro Education, the users are ready to change their devices running Windows 10 Pro, version 1607 or higher, version 1703 to Windows 10 Pro Education edition. #### Step 1: Join users’ devices to Azure AD @@ -232,19 +232,19 @@ If there are any problems with the Windows 10 Pro Education license or the acti ### Troubleshoot the user experience -In some instances, users may experience problems with the Windows 10 Pro Education switch. The most common problems that users may experience are as follows: +In some instances, users may experience problems with the Windows 10 Pro Education change. The most common problems that users may experience are as follows: - The existing operating system (Windows 10 Pro, version 1607 or higher, or version 1703) is not activated. -- The Windows 10 Pro Education switch has lapsed or has been removed. +- The Windows 10 Pro Education change has lapsed or has been removed. Use the following figures to help you troubleshoot when users experience these common problems: -**Figure 13** - Illustrates a device in a healthy state, where the existing operating system is activated, and the Windows 10 Pro Education switch is active. +**Figure 13** - Illustrates a device in a healthy state, where the existing operating system is activated, and the Windows 10 Pro Education change is active. Windows 10 activated and subscription active

-**Figure 14** - Illustrates a device on which the existing operating system is not activated, but the Windows 10 Pro Education switch is active. +**Figure 14** - Illustrates a device on which the existing operating system is not activated, but the Windows 10 Pro Education change is active. Windows 10 not activated and subscription active

@@ -274,23 +274,23 @@ Devices must be running Windows 10 Pro, version 1607 or higher, or domain joined A popup window will display the Windows 10 version number and detailed OS build information. > [!NOTE] - > If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be switched to Windows 10 Pro Education when a user signs in, even if the user has been assigned a license. + > If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be changeed to Windows 10 Pro Education when a user signs in, even if the user has been assigned a license. ### Roll back Windows 10 Pro Education to Windows 10 Pro -If your organization has the Windows 10 Pro to Windows 10 Pro Education switch enabled, and you decide to roll back to Windows 10 Pro or to cancel the switch, you can do this by: +If your organization has the Windows 10 Pro to Windows 10 Pro Education change enabled, and you decide to roll back to Windows 10 Pro or to cancel the change, you can do this by: -- Logging into Microsoft Store for Education page and turning off the automatic switch. -- Selecting the link to turn off the automatic switch from the notification email sent to all global administrators. +- Logging into Microsoft Store for Education page and turning off the automatic change. +- Selecting the link to turn off the automatic change from the notification email sent to all global administrators. -Once the automatic switch to Windows 10 Pro Education is turned off, the change is effective immediately. Devices that were switched will revert to Windows 10 Pro only after the license has been refreshed (every 30 days) and the next time the user signs in. This means that a user whose device was switched may not immediately see Windows 10 Pro Education rolled back to Windows 10 Pro for up to 30 days. However, users who haven't signed in during the time that a switch was enabled and then turned off will never see their device change from Windows 10 Pro. +Once the automatic change to Windows 10 Pro Education is turned off, the change is effective immediately. Devices that were changeed will revert to Windows 10 Pro only after the license has been refreshed (every 30 days) and the next time the user signs in. This means that a user whose device was changeed may not immediately see Windows 10 Pro Education rolled back to Windows 10 Pro for up to 30 days. However, users who haven't signed in during the time that a change was enabled and then turned off will never see their device change from Windows 10 Pro. > [!NOTE] -> Devices that were switched from mode to Windows 10 Pro Education cannot roll back to Windows 10 Pro Education S mode. +> Devices that were changeed from mode to Windows 10 Pro Education cannot roll back to Windows 10 Pro Education S mode. **To roll back Windows 10 Pro Education to Windows 10 Pro** -1. Log in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your school or work account, or follow the link from the notification email to turn off the automatic switch. +1. Log in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your school or work account, or follow the link from the notification email to turn off the automatic change. 2. Select **Manage > Benefits** and locate the section **Windows 10 Pro Education** and follow the link. 3. In the **Revert to Windows 10 Pro** page, click **Revert to Windows 10 Pro**. @@ -298,10 +298,10 @@ Once the automatic switch to Windows 10 Pro Education is turned off, the change ![Revert to Windows 10 Pro](images/msfe_manage_reverttowin10pro.png) -4. You will be asked if you're sure that you want to turn off automatic switches to Windows 10 Pro Education. Click **Yes**. +4. You will be asked if you're sure that you want to turn off automatic changees to Windows 10 Pro Education. Click **Yes**. 5. Click **Close** in the **Success** page. - All global admins get a confirmation email that a request was made to roll back your organization to Windows 10 Pro. If you, or another global admin, decide later that you want to turn on automatic switches again, you can do this by selecting **Switch to Windows 10 Pro Education for free** from the **Manage > Benefits** in the Microsoft Store for Education. + All global admins get a confirmation email that a request was made to roll back your organization to Windows 10 Pro. If you, or another global admin, decide later that you want to turn on automatic changees again, you can do this by selecting **change to Windows 10 Pro Education for free** from the **Manage > Benefits** in the Microsoft Store for Education. ## Preparing for deployment of Windows 10 Pro Education licenses From 74d7e88b8d03eafd9fb3b79820bb187fbbda0e68 Mon Sep 17 00:00:00 2001 From: MikeBlodge Date: Tue, 1 May 2018 09:47:25 -0700 Subject: [PATCH 048/215] resolved invalid links/images --- education/windows/switch-to-pro-education.md | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) diff --git a/education/windows/switch-to-pro-education.md b/education/windows/switch-to-pro-education.md index 813fc180de..de07efe44c 100644 --- a/education/windows/switch-to-pro-education.md +++ b/education/windows/switch-to-pro-education.md @@ -115,12 +115,6 @@ Once you enable the setting to change to Windows 10 Pro Education, the change wi 2. Click **Manage** from the top menu and then select the **Benefits tile**. 3. In the **Benefits** tile, look for the **change to Windows 10 Pro Education for free** link and then click it. - You will see the following page informing you that your school is eligible to change free to Windows 10 Pro Education to Windows 10 Pro. - - **Figure 3** - change Windows 10 Pro to Windows 10 Pro Education - - ![Eligible for free Windows 10 Pro to Windows 10 Pro Education change](images/msfe_manage_benefits_changetoproedu.png) - 4. In the **change all your devices to Windows 10 Pro Education for free** page, check box next to **I understand enabling this setting will change all domain-joined devices running Windows 10 Pro in my organization**. **Figure 4** - Check the box to confirm @@ -134,21 +128,13 @@ Once you enable the setting to change to Windows 10 Pro Education, the change wi 6. Close the confirmation window and check the email to proceed to the next step. 7. In the email, click the link to **change to Windows 10 Pro Education**. Once you click the link, this will take you back to the Microsoft Store for Education portal. - **Figure 5** - Click the link in the email to change to Windows 10 Pro Education - - ![Click the email link to change to Windows 10 Pro Education](images/msfe_clickemaillink_changetoproedu.png) - 8. Click **change now** in the **changing your device to Windows 10 Pro Education for free** page in the Microsoft Store. You will see a window that confirms you've successfully changeed all the devices in your organization to Windows 10 Pro Education, and each Azure AD joined device running Windows 10 Pro will automatically change the next time someone in your organization signs in to the device. 9. Click **Close** in the **Success** window. -Enabling the automatic change also triggers an email message notifying all global administrators in your organization about the change. It also contains a link that enables any global administrators to cancel the change if they choose. For more info about rolling back or canceling the change, see [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro).\ - -**Figure 6** - Email notifying all global admins about the change - -![Email notifying all global admins about the change](images/msfe_changetoproedu_globaladminsemail_cancelchange.png) +Enabling the automatic change also triggers an email message notifying all global administrators in your organization about the change. It also contains a link that enables any global administrators to cancel the change if they choose. For more info about rolling back or canceling the change, see [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro). ## Explore the change experience From 23f89f0156bab514749ca339b8cc9e0bec1a97df Mon Sep 17 00:00:00 2001 From: Allison Hopper - Microsoft Date: Tue, 1 May 2018 12:57:03 -0700 Subject: [PATCH 049/215] Clarified how to update HoloLens --- .../hololens/hololens-public-preview-apps.md | 34 ++++++++++++------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md index 5dc15249a2..77ff728228 100644 --- a/devices/hololens/hololens-public-preview-apps.md +++ b/devices/hololens/hololens-public-preview-apps.md @@ -17,30 +17,38 @@ On May 22, 2018, these apps will be available to download and distribute across ## Remote Assist -Remote Assist uses Microsoft Teams to facilitate two-way, real time, audio and video communication between a remote HoloLens user, and a user at a PC. The HoloLens user can project their view into Microsoft Teams, where the PC user can use inking annotations to mark it up with text and icons. The HoloLens user will see the inking appear within their device in real time. +Remote Assist uses Microsoft Teams to facilitate two-way, real time, audio and video communication between a remote HoloLens user, and a user at a PC or mobile device. The HoloLens user can project their view into Microsoft Teams, where the PC user can use inking annotations to mark it up with text and icons. The HoloLens user will see the inking appear within their device in real time. Here are the requirements you'll need to meet in order to distribute Remote Assist throughout your organization: -* **HoloLens, with RS4 build**: The HoloLens RS4 build will become publicly available at the same time as the modern workplace apps. There are two ways to ensure your HoloLens device has the required build: - * On May 22, update the HoloLens operating system. - * Get started testing out the RS4 build in advance of May 22. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for more information about the preview, and how it will impact your HoloLens device. -* **Azure Active Directory (Azure AD)**: required for app distribution. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. -* **Microsoft Teams**: Microsoft Teams is the backbone that facilitates communication in Remote Assist. All devices that will make calls to the HoloLens will need to have Microsoft Teams installed. +* **PC, iOS, and/or Android devices**: To communicate with the HoloLens. The PC must have a minimum Windows OS version of {minimum required version here}. +* **HoloLens with RS4 build**: The HoloLens RS4 build will become publicly available at the same time as the modern workplace apps. There are two ways to ensure your HoloLens has the required build: + * On May 22, update the HoloLens operating system. See [Manage updates to HoloLens](https://docs.microsoft.com/en-us/HoloLens/hololens-updates) for instructions on using Windows Update for Business, MDM, and Windows Server Update Service (WSUS) to deploy updates to HoloLens. + * Get started testing out the RS4 build in advance of May 22. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for instructions on flashing the build to your device, and details on how the preview build will impact content stored on your HoloLens. +* **Azure Active Directory (Azure AD)**: Required for app distribution through the Microsoft Store for Business. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. +* **Microsoft Teams**: Microsoft Teams is the backbone that facilitates communication in Remote Assist. All devices that will make calls to the HoloLens will need to have Microsoft Teams installed. See the [Overview of Microsoft Teams](https://docs.microsoft.com/en-us/MicrosoftTeams/teams-overview) to learn more. * **Microsoft Office 365**: Because Microsoft Teams is part of Office 365, all users who will make calls from their PC/phone to the HoloLens will need an Office 365 license. See [Office 365 licensing for Microsoft Teams](https://docs.microsoft.com/en-us/MicrosoftTeams/office-365-licensing) to learn more. -* **Network requirements**: 1.5Mb/s is the required bandwidth to enable the full feature set. If your organization's bandwidth does not meet these requirements, HoloLens will shut down features to adapt to reduced bandwidth, limiting the experience to audio calls only. Please test your company’s network bandwidth by performing the following steps: +* **Network requirements**: 1.5Mb/s is the bandwidth required to enable the full feature set. If your organization's bandwidth does not meet these requirements, HoloLens will shut down features to adapt to reduced bandwidth, limiting the experience to audio calls only. Please test your company’s network bandwidth by performing the following steps: 1. Have a mobile Teams user (iOS or Android) video call a desktop Teams user. - 2. Once the video call has been successfully connected between user 1 and 2, add another separate video call between a 3rd and 4th user, and so on for users 5 and 6. + 2. Once the video call has been successfully connected between user 1 and 2, add another separate video call between a 3rd and 4th user, and another for a 5th and 6th user. 3. Continue adding video callers to stress test your network bandwidth until confident that multiple users can successfully connect on video calls at the same time. - 4. For more on “Preparing your organization for Microsoft Teams and network bandwidth requirements, read here. + 4. See [Preparing your organization's network for Microsoft Teams](https://docs.microsoft.com/en-us/MicrosoftTeams/prepare-network) to learn more. ## Layout -Layout enables you to scan a space using the HoloLens, or import a space from another app, and design it using preloaded assets. +Layout enables you to scan a space using the HoloLens, or import a space from another app, and design it using pre-loaded assets. Here are the requirements you'll need to meet in order to distribute Layout throughout your organization: +* **PC with Windows OS version {minimum required version here}** * **HoloLens with RS4 build, or Windows Mixed Reality headset**: - * If you're using a HoloLens, it must be running RS4. RS4 will be available as an operating system update on May 22nd, or you can get started testing out the RS4 build in advance of May 22nd. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for more information about the preview, and how it will impact your HoloLens device. + * If you're using a HoloLens, it must be running the RS4 build. There are two ways to ensure your HoloLens has the required build: + * RS4 will be available as an update on May 22nd. See [Manage updates to HoloLens](https://docs.microsoft.com/en-us/HoloLens/hololens-updates) for instructions on using Windows Update for Business, MDM, and Windows Server Update Service (WSUS) to deploy updates to HoloLens on May 22nd. + * You can get started testing out the RS4 build in advance of May 22nd. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for instructions on flashing the build to your device, and details on how the preview build will impact content stored on your HoloLens. * If you're using a Windows Mixed Reality headset, your PCs will need to be able to support it. See [Windows Mixed Reality PC hardware guidelines](https://support.microsoft.com/en-us/help/4039260/windows-10-mixed-reality-pc-hardware-guidelines) for specific hardware requirements. We recommend following the **Windows Mixed Reality Ultra** hardware guidelines. -* Azure Active Directory (Azure AD): required for app distribution. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. -* Network requirements: Internet access is required to download the app, and utilize all of its features. There are no bandwidth requirements. \ No newline at end of file +* **Azure Active Directory (Azure AD)**: Required for app distribution through the Microsoft Store for Business. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. +* **Network requirements**: Internet access is required to download the app, and utilize all of its features. There are no bandwidth requirements. + +## Questions and support + +You can ask questions and engage with our team in the [Mixed Reality Tech Community](https://techcommunity.microsoft.com/t5/Mixed-Reality/ct-p/MixedReality). \ No newline at end of file From da231c3dc3db096798445e554260ac52203cfa68 Mon Sep 17 00:00:00 2001 From: Allison Hopper - Microsoft Date: Tue, 1 May 2018 14:55:56 -0700 Subject: [PATCH 050/215] Updated app descriptions to align with approved messaging --- .../hololens/hololens-public-preview-apps.md | 20 +++++++++---------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md index 77ff728228..79b07bf4f6 100644 --- a/devices/hololens/hololens-public-preview-apps.md +++ b/devices/hololens/hololens-public-preview-apps.md @@ -17,18 +17,18 @@ On May 22, 2018, these apps will be available to download and distribute across ## Remote Assist -Remote Assist uses Microsoft Teams to facilitate two-way, real time, audio and video communication between a remote HoloLens user, and a user at a PC or mobile device. The HoloLens user can project their view into Microsoft Teams, where the PC user can use inking annotations to mark it up with text and icons. The HoloLens user will see the inking appear within their device in real time. +Remote Assist supports collaboration in mixed reality to solve problems faster. Firstline workers can collaborate remotely with heads-up, hands-free video calling, image sharing, and mixed reality annotations. They can share what they see with an expert, while staying hands-on to solve problems and complete tasks together, faster. Here are the requirements you'll need to meet in order to distribute Remote Assist throughout your organization: -* **PC, iOS, and/or Android devices**: To communicate with the HoloLens. The PC must have a minimum Windows OS version of {minimum required version here}. +* **Windows 10 PC, iOS, and/or Android devices**: For communication with the HoloLens. The PC must have a minimum Windows OS version of {minimum required version here}. * **HoloLens with RS4 build**: The HoloLens RS4 build will become publicly available at the same time as the modern workplace apps. There are two ways to ensure your HoloLens has the required build: * On May 22, update the HoloLens operating system. See [Manage updates to HoloLens](https://docs.microsoft.com/en-us/HoloLens/hololens-updates) for instructions on using Windows Update for Business, MDM, and Windows Server Update Service (WSUS) to deploy updates to HoloLens. - * Get started testing out the RS4 build in advance of May 22. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for instructions on flashing the build to your device, and details on how the preview build will impact content stored on your HoloLens. + * Get started testing out the RS4 build in advance of May 22. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for instructions on flashing the RS4 build to your device, and details on how the build will impact content stored on your HoloLens. * **Azure Active Directory (Azure AD)**: Required for app distribution through the Microsoft Store for Business. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. * **Microsoft Teams**: Microsoft Teams is the backbone that facilitates communication in Remote Assist. All devices that will make calls to the HoloLens will need to have Microsoft Teams installed. See the [Overview of Microsoft Teams](https://docs.microsoft.com/en-us/MicrosoftTeams/teams-overview) to learn more. * **Microsoft Office 365**: Because Microsoft Teams is part of Office 365, all users who will make calls from their PC/phone to the HoloLens will need an Office 365 license. See [Office 365 licensing for Microsoft Teams](https://docs.microsoft.com/en-us/MicrosoftTeams/office-365-licensing) to learn more. -* **Network requirements**: 1.5Mb/s is the bandwidth required to enable the full feature set. If your organization's bandwidth does not meet these requirements, HoloLens will shut down features to adapt to reduced bandwidth, limiting the experience to audio calls only. Please test your company’s network bandwidth by performing the following steps: +* **Network requirements**: 1.5Mb/s is the bandwidth required to enable the full feature set. If your organization's bandwidth does not meet these requirements, you may notice HoloLens feature degradation, limiting the user experience. Please test your company’s network bandwidth by performing the following steps: 1. Have a mobile Teams user (iOS or Android) video call a desktop Teams user. 2. Once the video call has been successfully connected between user 1 and 2, add another separate video call between a 3rd and 4th user, and another for a 5th and 6th user. 3. Continue adding video callers to stress test your network bandwidth until confident that multiple users can successfully connect on video calls at the same time. @@ -36,16 +36,14 @@ Here are the requirements you'll need to meet in order to distribute Remote Assi ## Layout -Layout enables you to scan a space using the HoloLens, or import a space from another app, and design it using pre-loaded assets. +Layout enables users to design spaces in context with mixed reality. Bring designs from concept to completion with confidence and speed. Import 3D models to easily create and edit room layouts in real-world scale. Experience designs as high-quality holograms in physical space or in virtual reality and share and edit with stakeholders in real time. Here are the requirements you'll need to meet in order to distribute Layout throughout your organization: -* **PC with Windows OS version {minimum required version here}** -* **HoloLens with RS4 build, or Windows Mixed Reality headset**: - * If you're using a HoloLens, it must be running the RS4 build. There are two ways to ensure your HoloLens has the required build: - * RS4 will be available as an update on May 22nd. See [Manage updates to HoloLens](https://docs.microsoft.com/en-us/HoloLens/hololens-updates) for instructions on using Windows Update for Business, MDM, and Windows Server Update Service (WSUS) to deploy updates to HoloLens on May 22nd. - * You can get started testing out the RS4 build in advance of May 22nd. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for instructions on flashing the build to your device, and details on how the preview build will impact content stored on your HoloLens. - * If you're using a Windows Mixed Reality headset, your PCs will need to be able to support it. See [Windows Mixed Reality PC hardware guidelines](https://support.microsoft.com/en-us/help/4039260/windows-10-mixed-reality-pc-hardware-guidelines) for specific hardware requirements. We recommend following the **Windows Mixed Reality Ultra** hardware guidelines. +* **Windows 10 PC with Windows OS version {minimum required version here}** +* **HoloLens with RS4 build, or a Windows Mixed Reality immersive headset with motion controllers**: + * If you're using a HoloLens, it must be running the RS4 build, which will be publicly released at the same time as the modern workplace apps. To ensure your HoloLens has the required build, you can either [Manage updates to HoloLens](https://docs.microsoft.com/en-us/HoloLens/hololens-updates) on May 22nd when the build is publicly available, or you can get started testing out the RS4 build in advance of May 22nd. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for instructions on flashing the RS4 build to your device, and details on how the build will impact content stored on your HoloLens. + * If you're using a Windows Mixed Reality immersive headset, your PCs will need to be able to support it. See [Windows Mixed Reality PC hardware guidelines](https://support.microsoft.com/en-us/help/4039260/windows-10-mixed-reality-pc-hardware-guidelines) for specific hardware requirements. We recommend following the **Windows Mixed Reality Ultra** hardware guidelines. * **Azure Active Directory (Azure AD)**: Required for app distribution through the Microsoft Store for Business. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. * **Network requirements**: Internet access is required to download the app, and utilize all of its features. There are no bandwidth requirements. From b9f9d8430dbe152eb47eb32b60b5657e9feef72e Mon Sep 17 00:00:00 2001 From: Allison Hopper - Microsoft Date: Tue, 1 May 2018 15:15:01 -0700 Subject: [PATCH 051/215] Added info on Layout Import tool --- devices/hololens/hololens-public-preview-apps.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md index 79b07bf4f6..ce9b84f8f6 100644 --- a/devices/hololens/hololens-public-preview-apps.md +++ b/devices/hololens/hololens-public-preview-apps.md @@ -1,6 +1,6 @@ --- title: Get early access to preview new modern workplace apps -description: Distribute and use HoloLens modern workplace apps during public preview +description: Prepare to meet technical requirements to use HoloLens modern workplace apps during public preview ms.prod: w10 ms.mktglfcycl: manage ms.pagetype: hololens, devices @@ -46,6 +46,7 @@ Here are the requirements you'll need to meet in order to distribute Layout thro * If you're using a Windows Mixed Reality immersive headset, your PCs will need to be able to support it. See [Windows Mixed Reality PC hardware guidelines](https://support.microsoft.com/en-us/help/4039260/windows-10-mixed-reality-pc-hardware-guidelines) for specific hardware requirements. We recommend following the **Windows Mixed Reality Ultra** hardware guidelines. * **Azure Active Directory (Azure AD)**: Required for app distribution through the Microsoft Store for Business. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. * **Network requirements**: Internet access is required to download the app, and utilize all of its features. There are no bandwidth requirements. +* **Download the Import Tool for Microsoft Layout**: This tool is a free companion app for Microsoft Layout that supports importing existing 3D models from a PC into Layout. It also enables users to share and edit the holograms in real time. The Import Tool for Microsoft Layout will be available to download on May 22nd, to align with the public preview of the modern workplace apps. ## Questions and support From c3b649712ba3983811acba271961934b0ec0c5b5 Mon Sep 17 00:00:00 2001 From: Allison Hopper - Microsoft Date: Tue, 1 May 2018 15:18:04 -0700 Subject: [PATCH 052/215] Fixed typos --- devices/hololens/hololens-public-preview-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md index ce9b84f8f6..623a01584a 100644 --- a/devices/hololens/hololens-public-preview-apps.md +++ b/devices/hololens/hololens-public-preview-apps.md @@ -42,7 +42,7 @@ Here are the requirements you'll need to meet in order to distribute Layout thro * **Windows 10 PC with Windows OS version {minimum required version here}** * **HoloLens with RS4 build, or a Windows Mixed Reality immersive headset with motion controllers**: - * If you're using a HoloLens, it must be running the RS4 build, which will be publicly released at the same time as the modern workplace apps. To ensure your HoloLens has the required build, you can either [Manage updates to HoloLens](https://docs.microsoft.com/en-us/HoloLens/hololens-updates) on May 22nd when the build is publicly available, or you can get started testing out the RS4 build in advance of May 22nd. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for instructions on flashing the RS4 build to your device, and details on how the build will impact content stored on your HoloLens. + * If you're using a HoloLens, it must be running the RS4 build, which will be publicly released at the same time as the modern workplace apps. To ensure your HoloLens has the required build, you can either [Manage updates to HoloLens](https://docs.microsoft.com/en-us/HoloLens/hololens-updates) on May 22 when the build is publicly available, or you can get started testing out the RS4 build in advance of May 22. See [HoloLens RS4 Preview](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-rs4-preview) for instructions on flashing the RS4 build to your device, and details on how the build will impact content stored on your HoloLens. * If you're using a Windows Mixed Reality immersive headset, your PCs will need to be able to support it. See [Windows Mixed Reality PC hardware guidelines](https://support.microsoft.com/en-us/help/4039260/windows-10-mixed-reality-pc-hardware-guidelines) for specific hardware requirements. We recommend following the **Windows Mixed Reality Ultra** hardware guidelines. * **Azure Active Directory (Azure AD)**: Required for app distribution through the Microsoft Store for Business. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. * **Network requirements**: Internet access is required to download the app, and utilize all of its features. There are no bandwidth requirements. From 48e9a0ae19ae7e8d1ba6ea0feb3e449f08e279aa Mon Sep 17 00:00:00 2001 From: Allison Hopper - Microsoft Date: Tue, 1 May 2018 15:34:53 -0700 Subject: [PATCH 053/215] Commented out items that are not strict requirements --- devices/hololens/hololens-public-preview-apps.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md index 623a01584a..af5e33b85a 100644 --- a/devices/hololens/hololens-public-preview-apps.md +++ b/devices/hololens/hololens-public-preview-apps.md @@ -46,7 +46,8 @@ Here are the requirements you'll need to meet in order to distribute Layout thro * If you're using a Windows Mixed Reality immersive headset, your PCs will need to be able to support it. See [Windows Mixed Reality PC hardware guidelines](https://support.microsoft.com/en-us/help/4039260/windows-10-mixed-reality-pc-hardware-guidelines) for specific hardware requirements. We recommend following the **Windows Mixed Reality Ultra** hardware guidelines. * **Azure Active Directory (Azure AD)**: Required for app distribution through the Microsoft Store for Business. See [Get started with Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/get-started-azure-ad) to learn more about Azure AD and licensing users. * **Network requirements**: Internet access is required to download the app, and utilize all of its features. There are no bandwidth requirements. -* **Download the Import Tool for Microsoft Layout**: This tool is a free companion app for Microsoft Layout that supports importing existing 3D models from a PC into Layout. It also enables users to share and edit the holograms in real time. The Import Tool for Microsoft Layout will be available to download on May 22nd, to align with the public preview of the modern workplace apps. + + ## Questions and support From a4952355a3c9bc22a1e7fe44a9f39765be32e69c Mon Sep 17 00:00:00 2001 From: Kaushik Ainapure Date: Wed, 2 May 2018 13:43:30 +0530 Subject: [PATCH 054/215] Update windows-version-search.md --- windows/client-management/windows-version-search.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/windows-version-search.md b/windows/client-management/windows-version-search.md index 871658d3ff..c1f35268c3 100644 --- a/windows/client-management/windows-version-search.md +++ b/windows/client-management/windows-version-search.md @@ -5,7 +5,7 @@ keywords: Long-Term Servicing Channel, LTSC, LTSB, Semi-Annual Channel, SAC, Win ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: MikeBlodge +author: kaushika-msft ms.author: MikeBlodge ms.date: 04/30/2018 --- @@ -45,4 +45,4 @@ At the Command Prompt or PowerShell, type **"slmgr /dlv"**, and then press ENTER The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSB edition. This build of Windows doesn’t contain many in-box applications, such as Microsoft Edge, Microsoft Store, Cortana (you do have some limited search capabilities), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. It’s important to remember that the LTSC model is primarily for specialized devices. -In the Semi-Annual Channel, you can set feature updates as soon as Microsoft releases them. This servicing modal is ideal for pilot deployments and to test Windows 10 feature updates and for users like developers who need to work with the latest features immediately. Once you've tested the latest release, you can choose when to roll it out broadly in your deployment. \ No newline at end of file +In the Semi-Annual Channel, you can set feature updates as soon as Microsoft releases them. This servicing modal is ideal for pilot deployments and to test Windows 10 feature updates and for users like developers who need to work with the latest features immediately. Once you've tested the latest release, you can choose when to roll it out broadly in your deployment. From edf76249a66b7aa760bcc82e23015cb6d8c2437c Mon Sep 17 00:00:00 2001 From: Benny Lakunishok Date: Wed, 2 May 2018 13:30:02 +0300 Subject: [PATCH 055/215] Update automated-investigations-windows-defender-advanced-threat-protection.md --- ...vestigations-windows-defender-advanced-threat-protection.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md index 760acda319..94e1a95594 100644 --- a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md @@ -36,7 +36,8 @@ The Automated investigations list shows all the investigations that have been in ## Understand the Automated investigation flow ### How the Automated investigation starts -Entities are the starting point for Automated investigations. When an alert contains a supported entity for Automated investigation (for example, a file) an Automated investigation starts. +Entities are the starting point for Automated investigations. When an alert contains a supported entity for Automated investigation (for example, a file) that resides on a machine that has a *supported operating system for Automated investigation then an Automated investigation can start. +*Currently only Windows 10 version 1803 (spring creators update) and above are supported operating systems for Autoamted Investigation The alerts start by analyzing the supported entities from the alert and also runs a generic machine playbook to see if there is anything else suspicious on that machine. The outcome and details from the investigation is seen in the Automated investigation view. From 5dbb52a6fec12de1956355f2efb7ba40243c34bf Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Wed, 2 May 2018 12:48:05 +0200 Subject: [PATCH 056/215] Update waas-delivery-optimization.md fixed typo --- windows/deployment/update/waas-delivery-optimization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 0d28c1a441..41ce8a4d4c 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -284,7 +284,7 @@ If you suspect this is the problem, try these steps: ### Clients aren't able to connect to peers offered by the cloud service -If you suspect this is the problem, un a Telnet test between two devices on the network to ensure they can connect using port 7680. To do this, follow these steps: +If you suspect this is the problem, run a Telnet test between two devices on the network to ensure they can connect using port 7680. To do this, follow these steps: 1. Install Telnet by running **dism /online /Enable-Feature /FeatureName:TelnetClient** from an elevated command prompt. 2. Run the test. For example, if you are on device with IP 192.168.8.12 and you are trying to test the connection to 192.168.9.17 run **telnet 192.168.9.17 7680** (the syntax is *telnet [destination IP] [port]*. You will either see a connection error or a blinking cursor like this /_. The blinking cursor means success. From b5bca73281d9d7aef7b9dc50c4fddda1114d7ca7 Mon Sep 17 00:00:00 2001 From: Patti Short <35278231+shortpatti@users.noreply.github.com> Date: Wed, 2 May 2018 08:55:15 -0700 Subject: [PATCH 057/215] Update licensing-version-and-features-ieak11.md --- .../ie11-ieak/licensing-version-and-features-ieak11.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md index 6a0c89fda8..8e6a48df9f 100644 --- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md @@ -2,12 +2,14 @@ ms.localizationpriority: low ms.mktglfcycl: plan description: Learn about which version of the IEAK 11 you should run, based on your license agreement. -author: eross-msft -ms.prod: ie11 +author: pashort +ms.author: shortpatti +ms.manager: elizapo +ms.prod: ie11, ieak11 ms.assetid: 69d25451-08af-4db0-9daa-44ab272acc15 title: Determine the licensing version and features to use in IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) ms.sitesec: library -ms.date: 07/27/2017 +ms.date: 05/02/2018 --- @@ -45,7 +47,7 @@ You must pick a version of IEAK 11 to run during installation, either **Externa |Automatic configuration |Not available | |Proxy settings |Proxy settings | |Security and privacy settings |Not available | -|Not available |Add a root certificate | +|Add a root certificate |Not available | |Programs |Programs | |Additional settings |Not available | |Wizard complete |Wizard complete | From c8c484099becaa2311166c19d3dc3f936b91f460 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 2 May 2018 09:44:25 -0700 Subject: [PATCH 058/215] revised password change text --- ...domain-member-maximum-machine-account-password-age.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md index d73cf6dab0..ca04304ac9 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md @@ -19,9 +19,9 @@ Describes the best practices, location, values, and security considerations for ## Reference -The **Domain member: Maximum machine account password age** policy setting determines the maximum allowable age for a machine account password. +The **Domain member: Maximum machine account password age** policy setting determines when a domain member submits a password change. -In Active Directory–based domains, each device has an account and password, just like every user. By default, the domain members automatically change their domain password every 30 days. Increasing this interval significantly, or setting it to **0** so that the device no longer change their passwords, gives a malicious user more time to undertake a brute-force password-guessing attack against one of the machine accounts. +In Active Directory–based domains, each device has an account and password, just like every user. By default, the domain members submit a password change every 30 days. Increasing this interval significantly, or setting it to **0** so that a device no longer submits a password change, gives a malicious user more time to undertake a brute-force password-guessing attack against one of the machine accounts. ### Possible values @@ -31,7 +31,7 @@ In Active Directory–based domains, each device has an account and password, ju ### Best practices 1. It is often advisable to set **Domain member: Maximum machine account password age** to about 30 days. -2. Some organizations pre-build devices and then store them for later use or ship them to remote locations. If the machine's account has expired, it will no longer be able to authenticate with the domain. Devices that cannot authenticate with the domain must be removed from the domain and rejoined to it. For this reason, some organizations might want to create a special organizational unit (OU) for computers that are prebuilt, and configure the value for this policy setting to a larger number of days. +2. If the machine's password has expired, it will no longer be able to authenticate with the domain. In that case, you might need to remove the device and then re-join it to the domain. For this reason, some organizations create a special organizational unit (OU) for computers that are prebuilt and then stored for later use or shipped to remote locations, and change the value to more than 30 days. ### Location @@ -64,8 +64,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -In Active Directory–based domains, each device has an account and password, just as every user does. By default, the domain members automatically change their domain password every 30 days. If you increase this interval significantly, or set it to 0 so that the computers no longer change their -passwords, an attacker has more time to undertake a brute-force attack to guess the password of one or more computer accounts. +By default, the domain members submit a password change every 30 days. If you increase this interval significantly, or set it to 0 so that the computers no longer submit a password change, an attacker has more time to undertake a brute-force attack to guess the password of one or more computer accounts. ### Countermeasure From 80799f0a4cf0fa446bee37eb5cf8b5b3c166259e Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 2 May 2018 09:52:26 -0700 Subject: [PATCH 059/215] revised re-join text --- .../domain-member-maximum-machine-account-password-age.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md index ca04304ac9..bd65aa2236 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md @@ -31,7 +31,7 @@ In Active Directory–based domains, each device has an account and password, ju ### Best practices 1. It is often advisable to set **Domain member: Maximum machine account password age** to about 30 days. -2. If the machine's password has expired, it will no longer be able to authenticate with the domain. In that case, you might need to remove the device and then re-join it to the domain. For this reason, some organizations create a special organizational unit (OU) for computers that are prebuilt and then stored for later use or shipped to remote locations, and change the value to more than 30 days. +2. If the machine's password has expired, it will no longer be able to authenticate with the domain. The easiest way to get authentication working again might require removing the device from the domain and then re-joining it. For this reason, some organizations create a special organizational unit (OU) for computers that are prebuilt and then stored for later use or shipped to remote locations, and change the value to more than 30 days. ### Location From 4743fe3434a5e4fd0362ac4bd3714f8783891094 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Wed, 2 May 2018 10:33:30 -0700 Subject: [PATCH 060/215] Updated Intune instructions. --- ...-first-sight-windows-defender-antivirus.md | 28 +++++++++++++------ 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md index 9acab9ce56..cb413ea7c9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md @@ -11,13 +11,9 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 04/30/2018 +ms.date: 05/02/2018 --- - - - - # Enable the Block at First Sight feature **Applies to** @@ -30,6 +26,7 @@ ms.date: 04/30/2018 **Manageability available with** +- Intune - Group Policy - Windows Defender Security Center app @@ -58,8 +55,6 @@ In Windows 10, version 1803, the Block at First Sight feature can now block non- The Block at First Sight feature only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or originating from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if this is a previously undetected file. - - If the cloud backend is unable to make a determination, the file will be locked by Windows Defender AV while a copy is uploaded to the cloud. The cloud will perform additional analysis to reach a determination before it allows the file to run or blocks it in all future encounters, depending on whether the file is determined to be malicious or safe. In many cases this process can reduce the response time for new malware from hours to seconds. @@ -69,6 +64,23 @@ In many cases this process can reduce the response time for new malware from hou Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work. Usually, these settings are already enabled in most default Windows Defender AV deployments in enterprise networks. +### Confirm Block at First Sight is enabled with Intune + +1. In Intune, navigate to **Device configuration - Profiles | | Device restrictions | Windows Defender Antivirus**. + + > [!NOTE] + > The profile you select must be a Device Restriction profile type, not an Endpoint Protection profile type. + +2. Verify these settings are configured as follows: + + - **Cloud-delivered protection**: **Enable** + - **File Blocking Level**: **High** + - **Time extension for file scanning by the cloud**: **50** + - **Prompt users before sample submission**: **Send all data without prompting** + +For more information about configuring Windows Defender AV device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure). + +For a list of Windows Defender AV device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus). ### Confirm Block at First Sight is enabled with Group Policy @@ -113,7 +125,7 @@ The feature is automatically enabled as long as **Cloud-based protection** and * 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: -![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center app](images/defender/wdav-protection-settings-wdsc.png) + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center app](images/defender/wdav-protection-settings-wdsc.png) 3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. From 85a69a0e6da58ce74b1c51059134b12b005d3382 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Wed, 2 May 2018 11:04:20 -0700 Subject: [PATCH 061/215] Fixed link and formatting. --- ...configure-block-at-first-sight-windows-defender-antivirus.md | 2 +- .../wdsc-windows-10-in-s-mode.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md index cb413ea7c9..c2f08b09d3 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md @@ -66,7 +66,7 @@ Block at First Sight requires a number of Group Policy settings to be configured ### Confirm Block at First Sight is enabled with Intune -1. In Intune, navigate to **Device configuration - Profiles | | Device restrictions | Windows Defender Antivirus**. +1. In Intune, navigate to **Device configuration - Profiles | *Profile name* | Device restrictions | Windows Defender Antivirus**. > [!NOTE] > The profile you select must be a Device Restriction profile type, not an Endpoint Protection profile type. diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md index 658c5331ba..a4423252ca 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md @@ -34,7 +34,7 @@ The Windows Defender Security Center interface is a little different in Windows ![Screen shot of the Windows Defender Security Center app Virus & threat protection area in Windows 10 in S mode](images/security-center-virus-and-threat-protection-windows-10-in-s-mode.png) -For more information about Windows 10 in S mode, including how to switch out of S mode, see Windows 10 Pro in S mode. +For more information about Windows 10 in S mode, including how to switch out of S mode, see [Windows 10 Pro/Enterprise in S mode](https://docs.microsoft.com/en-us/windows/deployment/windows-10-pro-in-s-mode). ##Managing Windows Defender Security Center settings with Intune From 21d8df39d7435db3ecd241d1fc83d385c0945d63 Mon Sep 17 00:00:00 2001 From: "Yinghua Zeng [MVP]" Date: Wed, 2 May 2018 21:13:59 +0300 Subject: [PATCH 062/215] remove duplicated content --- .../mdm/new-in-windows-mdm-enrollment-management.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index d5ddfb84e3..44dd3a5fd2 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1268,10 +1268,6 @@ For details about Microsoft mobile device management protocols for Windows 10 s

Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

-[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) -

Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, version 1803.

- - [DMClient CSP](dmclient-csp.md)

Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803: