mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge branch 'main' into patch-2
This commit is contained in:
Paolo Matarazzo
GitHub
commit
c8def16f10
39
.github/pull_request_template.md
vendored
Normal file
39
.github/pull_request_template.md
vendored
Normal file
@ -0,0 +1,39 @@
|
||||
<!--
|
||||
Fill out the following information to help us review this pull request.
|
||||
You can delete these comments once you are done.
|
||||
-->
|
||||
<!--
|
||||
## Description
|
||||
|
||||
If your changes are extensive:
|
||||
- Uncomment this heading and provide a brief description here.
|
||||
- List more detailed changes below under the changes heading.
|
||||
-->
|
||||
|
||||
## Why
|
||||
|
||||
<!--
|
||||
- Briefly describe _why_ you made this pull request.
|
||||
- If this pull request relates to an issue, provide the issue number or link.
|
||||
- If this pull request closes an issue, use a keyword (`Closes #123`).
|
||||
- Using a keyword will ensure the issue is automatically closed once this pull request is merged.
|
||||
- For more information, see [Linking a pull request to an issue using a keyword](https://docs.github.com/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword).
|
||||
-->
|
||||
|
||||
- Closes #[Issue Number]
|
||||
|
||||
## Changes
|
||||
|
||||
<!--
|
||||
- Briefly describe or list _what_ this PR changes.
|
||||
- Share any important highlights regarding your changes, such as screenshots, code snippets, or formatting.
|
||||
-->
|
||||
|
||||
<!--
|
||||
Thanks for contributing to Microsoft docs content!
|
||||
|
||||
Here are some resources that might be helpful while contributing:
|
||||
- [Microsoft Docs contributor guide](https://docs.microsoft.com/contribute/)
|
||||
- [Docs Markdown reference](https://docs.microsoft.com/contribute/markdown-reference)
|
||||
- [Microsoft Writing Style Guide](https://docs.microsoft.com/style-guide/welcome/)
|
||||
-->
|
||||
@ -7,6 +7,7 @@ ms.reviewer:
|
||||
audience: itpro
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: ie11
|
||||
---
|
||||
|
||||
# Full-sized flowchart detailing how document modes are chosen in IE11
|
||||
|
||||
@ -9,6 +9,7 @@ metadata:
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
ms.date: 07/29/2022
|
||||
ms.prod: ie11
|
||||
|
||||
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
|
||||
|
||||
|
||||
@ -2,6 +2,27 @@
|
||||
|
||||
|
||||
|
||||
## Week of August 29, 2022
|
||||
|
||||
|
||||
| Published On |Topic title | Change |
|
||||
|------|------------|--------|
|
||||
| 8/31/2022 | [Configure applications with Microsoft Intune](/education/windows/tutorial-school-deployment/configure-device-apps) | added |
|
||||
| 8/31/2022 | [Configure and secure devices with Microsoft Intune](/education/windows/tutorial-school-deployment/configure-device-settings) | added |
|
||||
| 8/31/2022 | [Configure devices with Microsoft Intune](/education/windows/tutorial-school-deployment/configure-devices-overview) | added |
|
||||
| 8/31/2022 | [Enrollment in Intune with standard out-of-box experience (OOBE)](/education/windows/tutorial-school-deployment/enroll-aadj) | added |
|
||||
| 8/31/2022 | [Enrollment in Intune with Windows Autopilot](/education/windows/tutorial-school-deployment/enroll-autopilot) | added |
|
||||
| 8/31/2022 | [Device enrollment overview](/education/windows/tutorial-school-deployment/enroll-overview) | added |
|
||||
| 8/31/2022 | [Enrollment of Windows devices with provisioning packages](/education/windows/tutorial-school-deployment/enroll-package) | added |
|
||||
| 8/31/2022 | [Introduction](/education/windows/tutorial-school-deployment/index) | added |
|
||||
| 8/31/2022 | [Manage devices with Microsoft Intune](/education/windows/tutorial-school-deployment/manage-overview) | added |
|
||||
| 8/31/2022 | [Management functionalities for Surface devices](/education/windows/tutorial-school-deployment/manage-surface-devices) | added |
|
||||
| 8/31/2022 | [Reset and wipe Windows devices](/education/windows/tutorial-school-deployment/reset-wipe) | added |
|
||||
| 8/31/2022 | [Set up Azure Active Directory](/education/windows/tutorial-school-deployment/set-up-azure-ad) | added |
|
||||
| 8/31/2022 | [Set up device management](/education/windows/tutorial-school-deployment/set-up-microsoft-intune) | added |
|
||||
| 8/31/2022 | [Troubleshoot Windows devices](/education/windows/tutorial-school-deployment/troubleshoot-overview) | added |
|
||||
|
||||
|
||||
## Week of August 15, 2022
|
||||
|
||||
|
||||
@ -47,14 +68,3 @@
|
||||
| 8/10/2022 | [What is Windows 11 SE](/education/windows/windows-11-se-overview) | modified |
|
||||
| 8/10/2022 | [Windows 11 SE settings list](/education/windows/windows-11-se-settings-list) | modified |
|
||||
| 8/10/2022 | [Windows 10 editions for education customers](/education/windows/windows-editions-for-education-customers) | modified |
|
||||
|
||||
|
||||
## Week of July 25, 2022
|
||||
|
||||
|
||||
| Published On |Topic title | Change |
|
||||
|------|------------|--------|
|
||||
| 7/26/2022 | [Upgrade Windows Home to Windows Education on student-owned devices](/education/windows/change-home-to-edu) | added |
|
||||
| 7/26/2022 | [Secure the Windows boot process](/education/windows/change-home-to-edu) | modified |
|
||||
| 7/25/2022 | Edit an existing topic using the Edit link | removed |
|
||||
| 7/26/2022 | [Windows Hello for Business Videos](/education/windows/change-home-to-edu) | modified |
|
||||
|
||||
@ -16,6 +16,8 @@ ms.reviewer:
|
||||
manager: aaroncz
|
||||
appliesto:
|
||||
- ✅ <b>Windows 10</b>
|
||||
- ✅ <b>Windows 11</b>
|
||||
- ✅ <b>Windows 11 SE</b>
|
||||
---
|
||||
|
||||
# Working with Microsoft Store for Education
|
||||
@ -133,18 +135,10 @@ Teachers can:
|
||||
|
||||
## Distribute apps
|
||||
|
||||
Manage and distribute apps to students and others in your organization. Different options are available for admins and teachers.
|
||||
|
||||
Applies to: IT admins
|
||||
|
||||
**To manage and distribute apps**
|
||||
- For info on how to distribute **Minecraft: Education Edition**, see [For IT admins – Minecraft: Education Edition](./school-get-minecraft.md#distribute-minecraft)
|
||||
- For info on how to manage and distribute other apps, see [App inventory management - Microsoft Store for Business](/microsoft-store/app-inventory-management-windows-store-for-business)
|
||||
|
||||
Applies to: Teachers
|
||||
|
||||
For info on how to distribute **Minecraft: Education Edition**, see [For teachers – Minecraft: Education Edition](./teacher-get-minecraft.md#distribute-minecraft).
|
||||
|
||||
**To assign an app to a student**
|
||||
|
||||
1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
|
||||
@ -16,6 +16,8 @@ ms.reviewer:
|
||||
manager: aaroncz
|
||||
appliesto:
|
||||
- ✅ <b>Windows 10</b>
|
||||
- ✅ <b>Windows 11</b>
|
||||
- ✅ <b>Windows 11 SE</b>
|
||||
---
|
||||
|
||||
# Get Minecraft: Education Edition
|
||||
@ -24,13 +26,11 @@ appliesto:
|
||||
|
||||
<iframe width="501" height="282" src="https://www.youtube-nocookie.com/embed/hl9ZQiektJE" frameborder="0" allowfullscreen></iframe>
|
||||
|
||||
Teachers and IT administrators can now get early access to **Minecraft: Education Edition** and add it their Microsoft Store for Business for distribution.
|
||||
|
||||
<!--  -->
|
||||
Teachers and IT administrators can now get access to **Minecraft: Education Edition** and add it their Microsoft Admin Center for distribution.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- **Minecraft: Education Edition** requires Windows 10.
|
||||
- For a complete list of Operating Systems supported by **Minecraft: Education Edition**, see [here](https://educommunity.minecraft.net/hc/articles/360047556591-System-Requirements).
|
||||
- Trials or subscriptions of **Minecraft: Education Edition** are offered to education tenants that are managed by Azure Active Directory (Azure AD).
|
||||
- If your school doesn't have an Azure AD tenant, the [IT administrator can set one up](school-get-minecraft.md) as part of the process of getting **Minecraft: Education Edition**.
|
||||
- Office 365 Education, which includes online versions of Office apps plus 1 TB online storage. [Sign up your school for Office 365 Education.](https://www.microsoft.com/education/products/office)
|
||||
@ -38,9 +38,6 @@ Teachers and IT administrators can now get early access to **Minecraft: Educatio
|
||||
|
||||
<!--  -->
|
||||
|
||||
[Learn how teachers can get and distribute **Minecraft: Education Edition**](teacher-get-minecraft.md)
|
||||
|
||||
|
||||
<!--  -->
|
||||
|
||||
[Learn how IT administrators can get and distribute **Minecraft: Education Edition**](school-get-minecraft.md), and how to manage permissions for Minecraft.
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Take tests in Windows 10
|
||||
title: Take tests in Windows
|
||||
description: Learn how to set up and use the Take a Test app.
|
||||
keywords: take a test, test taking, school, how to, use Take a Test
|
||||
ms.prod: windows
|
||||
@ -15,11 +15,13 @@ ms.reviewer:
|
||||
manager: aaroncz
|
||||
appliesto:
|
||||
- ✅ <b>Windows 10</b>
|
||||
- ✅ <b>Windows 11</b>
|
||||
- ✅ <b>Windows 11 SE</b>
|
||||
---
|
||||
|
||||
# Take tests in Windows 10
|
||||
# Take tests in Windows
|
||||
|
||||
Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10 creates the right environment for taking a test:
|
||||
Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows creates the right environment for taking a test:
|
||||
|
||||
- Take a Test shows just the test and nothing else.
|
||||
- Take a Test clears the clipboard.
|
||||
@ -46,7 +48,7 @@ There are several ways to configure devices for assessments, depending on your u
|
||||
|
||||
- **For a single PC**
|
||||
|
||||
You can use the Windows 10 **Settings** application. For more info, see [Set up Take a Test on a single PC](take-a-test-single-pc.md).
|
||||
You can use the Windows **Settings** application. For more info, see [Set up Take a Test on a single PC](take-a-test-single-pc.md).
|
||||
|
||||
- **For multiple PCs**
|
||||
|
||||
@ -55,7 +57,7 @@ There are several ways to configure devices for assessments, depending on your u
|
||||
- A provisioning package created in Windows Configuration Designer
|
||||
- Group Policy to deploy a scheduled task that runs a Powershell script
|
||||
|
||||
Beginning with Windows 10 Creators Update (version 1703), you can also configure Take a Test using these options:
|
||||
You can also configure Take a Test using these options:
|
||||
- Set up School PCs app
|
||||
- Intune for Education
|
||||
|
||||
|
||||
@ -16,160 +16,34 @@ ms.reviewer:
|
||||
manager: aaroncz
|
||||
appliesto:
|
||||
- ✅ <b>Windows 10</b>
|
||||
- ✅ <b>Windows 11</b>
|
||||
- ✅ <b>Windows 11 SE</b>
|
||||
---
|
||||
|
||||
# For teachers - get Minecraft: Education Edition
|
||||
|
||||
The following article describes how teachers can get and distribute Minecraft: Education Edition.
|
||||
Minecraft: Education Edition is available for anyone to trial, and subscriptions can be purchased by qualified educational institutions directly in the Microsoft Store for Education, via volume licensing agreements and through partner resellers.
|
||||
The following article describes how teachers can get and distribute Minecraft: Education Edition at their school. Minecraft: Education Edition is available for anyone to trial, and subscriptions can be purchased by qualified educational institutions directly in the [Microsoft Admin Center by IT Admins](/education/windows/school-get-minecraft), via volume licensing agreements and through partner resellers.
|
||||
|
||||
To get started, go to https://education.minecraft.net/ and select **GET STARTED**.
|
||||
|
||||
## Try Minecraft: Education Edition for Free
|
||||
|
||||
Minecraft: Education Edition is available for anyone to try for free! The free trial is fully functional but limited by the number of logins (25 for teachers and 10 for students) before a paid license will be required to continue playing.
|
||||
|
||||
To learn more and get started, go to https://education.minecraft.net/ and select **GET STARTED**.
|
||||
To learn more and get started, [download the Minecraft: Education Edition app here.](https://aka.ms/download)
|
||||
|
||||
## Purchase Minecraft: Education Edition for Teachers and Students
|
||||
|
||||
Minecraft: Education Edition is licensed via yearly subscriptions that are purchased through the Microsoft Store for Education, via volume licensing agreements and through partner resellers.
|
||||
As a teacher, you will need to have your IT Admin purchase licenses for you and your students directly through the Microsoft Admin Center, or you may already have access to licenses at your school (through a volume license agreement) if you have an Office 365 subscription.
|
||||
|
||||
>[!Note]
|
||||
>M:EE is available on many platforms, but all license purchases can only be done through one of the three methods listed above.
|
||||
M:EE is included in many volume license agreements, however, only the administrators at your school will be able to assign and manage those licenses. If you have an Office 365 account, check with your school administration or IT administrator prior to purchasing M:EE directly.
|
||||
|
||||
As a teacher, you may purchase subscription licenses for you and your students directly through the Microsoft Store for Education, or you may already have access to licenses at your school (through a volume license agreement) if you have an Office 365 account.
|
||||
|
||||
>[!Note]
|
||||
>If you already have Office 365, you may already have Minecraft: Education Edition licenses for your school! M:EE is included in many volume license agreements, however, only the administrators at your school will be able to assign and manage those licenses. If you have an Office 365 account, check with your school administration or IT administrator prior to purchasing M:EE directly.
|
||||
|
||||
You can purchase individual Minecraft: Education Edition subscriptions for you and other teachers and students directly in the Microsoft Store for Education.
|
||||
|
||||
To purchase individual Minecraft: Education Edition subscriptions (that is, direct purchase):
|
||||
|
||||
1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your Office 365 account.
|
||||
2. Click on [Minecraft: Education Edition](https://educationstore.microsoft.com/en-us/store/details/minecraft-education-edition/9nblggh4r2r6) (or use Search the Store to find it)
|
||||
3. Click **Buy**
|
||||
|
||||
>[!Note]
|
||||
>Administrators can restrict the ability for teachers to purchase applications in the Microsoft Store for Education. If you do not have the ability to Buy, contact your school administration or IT administrator.
|
||||
|
||||
|
||||
## Distribute Minecraft
|
||||
|
||||
After Minecraft: Education Edition licenses have been purchased, either directly, through a volume license agreement or through a partner reseller, those licenses will be added to your Microsoft Store for Education. From there you have three options:
|
||||
|
||||
- You can install the app on your PC.
|
||||
- You can assign the app to others.
|
||||
- You can download the app to distribute.
|
||||
|
||||
<!--  -->
|
||||
|
||||
### Install for me
|
||||
You can install the app on your PC. This gives you a chance to work with the app before using it with your students.
|
||||
|
||||
1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
2. Click **Manage**, and then click **Install**.
|
||||
|
||||
<!--  -->
|
||||
|
||||
3. Click **Install**.
|
||||
|
||||
### Assign to others
|
||||
Enter email addresses for your students, and each student will get an email with a link to install the app. This option is best for older, more tech-savvy students who will always use the same PC at school.
|
||||
|
||||
**To assign to others**
|
||||
1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
2. Click **Manage**.
|
||||
|
||||
<!--  -->
|
||||
|
||||
3. Click **Invite people**.
|
||||
|
||||
4. Type the name, or email address of the student or group you want to assign the app to, and then click **Assign**.
|
||||
|
||||
|
||||
|
||||
You can assign the app to students with work or school accounts. </br>
|
||||
If you don't find the student, you can still assign the app to them if self-service sign up is supported for your domain. Students will receive an email with a link to Microsoft 365 admin center where they can create an account, and then install **Minecraft: Education Edition**. Questions about self-service sign up? Check with your admin.
|
||||
|
||||
|
||||
**To finish Minecraft install (for students)**
|
||||
|
||||
Students will receive an email with a link that will install the app on their PC.
|
||||
|
||||
|
||||
|
||||
1. Click **Get the app** to start the app install in Microsoft Store app.
|
||||
2. In Microsoft Store app, click **Install**.
|
||||
|
||||
|
||||
|
||||
After installing the app, students can find Minecraft: Education Edition in Microsoft Store app under **My Library**.
|
||||
|
||||
|
||||
|
||||
When students click **My Library** they'll find apps assigned to them.
|
||||
|
||||
|
||||
|
||||
### Download for others
|
||||
Download for others allows teachers or IT admins to download packages that they can install on student PCs. This option will install Minecraft: Education Edition on the PC, and allows anyone with a Windows account to use the app on that PC. This option is best for students, and for shared computers. Choose this option when:
|
||||
- You have administrative permissions to install apps on the PC.
|
||||
- You want to install this app on each of your student's Windows 10 (at least version 1511) PCs.
|
||||
- Your students share Windows 10 computers, but sign in with their own Windows account.
|
||||
|
||||
#### Requirements
|
||||
- Administrative permissions are required on the PC. If you don't have the correct permissions, you won't be able to install the app.
|
||||
- Windows 10 (at least version 1511) is required for PCs running Minecraft: Education Edition.
|
||||
|
||||
#### Check for updates
|
||||
Minecraft: Education Edition won't install if there are updates pending for other apps on the PC. Before installing Minecraft, check to see if there are pending updates for Microsoft Store apps.
|
||||
|
||||
**To check for app updates**
|
||||
1. Start Microsoft Store app on the PC (click **Start**, and type **Store**).
|
||||
2. Click the account button, and then click **Downloads and updates**.
|
||||
|
||||
|
||||
|
||||
3. Click **Check for updates**, and install all available updates.
|
||||
|
||||
|
||||
|
||||
4. Restart the computer before installing Minecraft: Education Edition.
|
||||
|
||||
#### To download for others
|
||||
You'll download a .zip file, extract the files, and then use one of the files to install Minecraft: Education Edition on each PC.
|
||||
|
||||
1. **Download Minecraft Education Edition.zip**. From the **Minecraft: Education Edition** page, click **Download for others** tab, and then click **Download**.
|
||||
|
||||
|
||||
|
||||
2. **Extract files**. Find the .zip file that you downloaded and extract the files. This downloaded location is usually your **Downloads** folder, unless you chose to save the .zip file to a different location. Right-click the file and choose **Extract all**.
|
||||
3. **Save to USB drive**. After you've extracted the files, save the Minecraft: Education Edition folder to a USB drive, or to a network location that you can access from each PC.
|
||||
4. **Install app**. Use the USB drive to copy the Minecraft folder to each Windows 10 PC where you want to install Minecraft: Education Edition. Open Minecraft: Education Edition folder, right-click **InstallMinecraftEducationEdition.bat** and click **Run as administrator**.
|
||||
5. **Quick check**. The install program checks the PC to make sure it can run Minecraft: Education Edition. If your PC passes this test, the app will automatically install.
|
||||
6. **Restart**. Once installation is complete, restart each PC. Minecraft: Education Edition app is now ready for any student to use.
|
||||
|
||||
#### Troubleshoot
|
||||
|
||||
If you ran **InstallMinecraftEducationEdition.bat** and Minecraft: Education Edition isn't available, there are a few things that might have happened.
|
||||
|
||||
| Problem | Possible cause | Solution |
|
||||
|---------|----------------|----------|
|
||||
| Script ran, but it doesn't look like the app installed. | There might be pending app updates. | Check for app updates (see steps earlier in this topic). </br> Install updates. </br> Restart PC. </br> Run **InstallMinecraftEducationEdition.bat** again. |
|
||||
| App won't install. | AppLocker is configured and preventing app installs. | Contact IT Admin. |
|
||||
| App won't install. | Policy prevents users from installing apps on the PC. | Contact IT Admin. |
|
||||
| Script starts, but stops quickly. | Policy prevents scripts from running on the PC. | Contact IT Admin. |
|
||||
| App isn't available for other users. | No restart after install. If you don't restart the PC, and just switch users the app won't be available.| Restart PC. </br> Run **InstallMinecraftEducationEdition.bat** again. </br> If a restart doesn't work, contact your IT Admin. |
|
||||
|
||||
|
||||
If you're still having trouble installing the app, you can get more help on our [Support page](https://go.microsoft.com/fwlink/?LinkID=799757).
|
||||
If you're having trouble installing the app, you can get more help on our [Support page](https://aka.ms/minecraftedusupport).
|
||||
|
||||
## Related topics
|
||||
|
||||
[Working with Microsoft Store for Education](education-scenarios-store-for-business.md) </br>
|
||||
Learn about overall Microsoft Store for Business management: manage settings, shop for apps, distribute apps, manage inventory, and manage order history.
|
||||
[Get Minecraft: Education Edition](get-minecraft-for-education.md)
|
||||
[For IT admins: get Minecraft: Education Edition](school-get-minecraft.md)
|
||||
|
||||
|
||||
@ -92,7 +92,7 @@ While Intune for Education offers simple options for Autopilot configurations, m
|
||||
|
||||
An Enrollment Status Page (ESP) is a greeting page displayed to users while enrolling or signing in for the first time to Windows devices. The ESP displays provisioning progress, showing applications and profiles installation status.
|
||||
|
||||
:::image type="content" source="./images/win11-oobe-esp.png" alt-text="Windows OOBE - enrollment status page" border="false":::
|
||||
:::image type="content" source="./images/win11-oobe-esp.gif" alt-text="Windows OOBE - enrollment status page animation." border="false":::
|
||||
|
||||
> [!NOTE]
|
||||
> Some Windows Autopilot deployment profiles **require** the ESP to be configured.
|
||||
|
||||
@ -57,10 +57,9 @@ For more information, see [Install Windows Configuration Designer][WIN-1], which
|
||||
## Enroll devices with the provisioning package
|
||||
|
||||
To provision Windows devices with provisioning packages, insert the USB stick containing the package during the out-of-box experience. The devices will read the content of the package, join Azure AD and automatically enroll in Intune.
|
||||
All settings defined in the package and in Intune will be applied to the device, and the device will be ready to use.
|
||||
|
||||
:::image type="content" source="./images/win11-oobe-ppkg.png" alt-text="Windows 11 OOBE - enrollment with provisioning package." border="false":::
|
||||
|
||||
:::image type="content" source="./images/win11-login-screen.png" alt-text="Windows 11 login screen" border="false":::
|
||||
:::image type="content" source="./images/win11-oobe-ppkg.gif" alt-text="Windows 11 OOBE - enrollment with provisioning package animation." border="false":::
|
||||
|
||||
________________________________________________________
|
||||
## Next steps
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 102 KiB After Width: | Height: | Size: 89 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 79 KiB After Width: | Height: | Size: 76 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 2.5 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 260 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 3.1 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 265 KiB |
@ -133,7 +133,7 @@ To configure your school's branding:
|
||||
:::image type="content" source="images/entra-branding.png" alt-text="Configure Azure AD branding from Microsoft Entra admin center." lightbox="images/entra-branding.png":::
|
||||
1. To adjust the school tenant's name displayed during OOBE, select **Azure Active Directory** > **Overview** > **Properties**
|
||||
1. In the **Name** field, enter the school district or organization's name > **Save**
|
||||
:::image type="content" alt-text="Configure Azure AD tenant name from Microsoft Entra admin center." source="images/entra-tenant-name.png":::
|
||||
:::image type="content" alt-text="Configure Azure AD tenant name from Microsoft Entra admin center." source="images/entra-tenant-name.png" lightbox="images/entra-tenant-name.png":::
|
||||
|
||||
For more information, see [Add branding to your directory][AAD-5].
|
||||
|
||||
|
||||
@ -78,7 +78,7 @@ To disable Windows Hello for Business at the tenant level:
|
||||
1. Ensure that **Configure Windows Hello for Business** is set to **disabled**
|
||||
1. Select **Save**
|
||||
|
||||
:::image type="content" source="./images/whfb-disable.png" alt-text="Disablement of Windows Hello for Business from Microsoft Endpoint Manager admin center" border="true":::
|
||||
:::image type="content" source="./images/whfb-disable.png" alt-text="Disablement of Windows Hello for Business from Microsoft Endpoint Manager admin center." border="true" lightbox="./images/whfb-disable.png":::
|
||||
|
||||
For more information how to enable Windows Hello for Business on specific devices, see [Create a Windows Hello for Business policy][MEM-4].
|
||||
|
||||
|
||||
@ -38,6 +38,7 @@ Windows 11 SE comes with some preinstalled apps. The following apps can also run
|
||||
| Application | Supported version | App Type | Vendor |
|
||||
| --- | --- | --- | --- |
|
||||
|AirSecure |8.0.0 |Win32 |AIR|
|
||||
|Alertus Desktop |5.4.44.0 |Win32 | Alertus technologies|
|
||||
|Brave Browser |1.34.80|Win32 |Brave|
|
||||
|Bulb Digital Portfolio |0.0.7.0|Store|Bulb|
|
||||
|Cisco Umbrella |3.0.110.0 |Win32 |Cisco|
|
||||
@ -56,27 +57,30 @@ Windows 11 SE comes with some preinstalled apps. The following apps can also run
|
||||
|Google Chrome |102.0.5005.115|Win32 |Google|
|
||||
|Illuminate Lockdown Browser |2.0.5 |Win32 |Illuminate Education|
|
||||
|Immunet |7.5.0.20795 |Win32 |Immunet|
|
||||
|Impero Backdrop Client |4.4.86 |Win32 |Impero Software|
|
||||
|JAWS for Windows |2022.2112.24 |Win32 |Freedom Scientific|
|
||||
|Kite Student Portal |8.0.3.0 |Win32 |Dynamic Learning Maps|
|
||||
|Kortext |2.3.433.0 |Store |Kortext|
|
||||
|Kurzweil 3000 Assistive Learning |20.13.0000 |Win32 |Kurzweil Educational Systems|
|
||||
|LanSchool |9.1.0.46 |Win32 |Stoneware|
|
||||
|Lightspeed Smart Agent |2.6.2 |Win32 |Lightspeed Systems|
|
||||
|MetaMoJi ClassRoom |3.12.4.0 |Store |MetaMoJi Corporation|
|
||||
|Microsoft Connect |10.0.22000.1 |Store |Microsoft|
|
||||
|Mozilla Firefox |99.0.1 |Win32 |Mozilla|
|
||||
|NAPLAN |2.5.0 |Win32 |NAP|
|
||||
|Netref Student |22.2.0 |Win32 |NetRef|
|
||||
|NetSupport Manager |12.01.0011 |Win32 |NetSupport|
|
||||
|NetSupport Notify |5.10.1.215 |Win32 |NetSupport|
|
||||
|NetSupport School |14.00.0011 |Win32 |NetSupport|
|
||||
|NextUp Talker |1.0.49 |Win32 |NextUp Technologies|
|
||||
|NonVisual Desktop Access |2021.3.1 |Win32 |NV Access|
|
||||
|NWEA Secure Testing Browser |5.4.300.0 |Win32 |NWEA|
|
||||
|NWEA Secure Testing Browser |5.4.356.0 |Win32 |NWEA|
|
||||
|Pearson TestNav |1.10.2.0 |Store |Pearson|
|
||||
|Questar Secure Browser |4.8.3.376 |Win32 |Questar, Inc|
|
||||
|ReadAndWriteForWindows |12.0.60.0 |Win32 |Texthelp Ltd.|
|
||||
|Remote Desktop client (MSRDC) |1.2.3213.0 |Win32 |Microsoft|
|
||||
|Remote Help |3.8.0.12 |Win32 |Microsoft|
|
||||
|Respondus Lockdown Browser |2.0.8.05 |Win32 |Respondus|
|
||||
|Respondus Lockdown Browser |2.0.9.00 |Win32 |Respondus|
|
||||
|Safe Exam Browser |3.3.2.413 |Win32 |Safe Exam Browser|
|
||||
|Secure Browser |14.0.0 |Win32 |Cambium Development|
|
||||
|Senso.Cloud |2021.11.15.0 |Win32|Senso.Cloud|
|
||||
|
||||
@ -18,8 +18,8 @@ ms.topic: article
|
||||
- Windows 11
|
||||
- Windows Server 2022
|
||||
|
||||
|
||||
## Summary
|
||||
|
||||
By using Windows operating systems, administrators can determine what devices can be installed on computers they manage. This guide summarizes the device installation process and demonstrates several techniques for controlling device installation by using Group Policy.
|
||||
|
||||
## Introduction
|
||||
@ -60,7 +60,6 @@ It's more difficult for users to make unauthorized copies of company data if use
|
||||
|
||||
You can ensure that users install only those devices that your technical support team is trained and equipped to support. This benefit reduces support costs and user confusion.
|
||||
|
||||
|
||||
## Scenario Overview
|
||||
|
||||
The scenarios presented in this guide illustrate how you can control device installation and usage on the computers that you manage. The scenarios use Group Policy on a local machine to simplify using the procedures in a lab environment. In an environment where you manage multiple client computers, you should apply these settings using Group Policy.. With Group Policy deployed by Active Directory, you can apply settings to all computers that are members of a domain or an organizational unit in a domain. For more information about how to use Group Policy to manage your client computers, see Group Policy at the Microsoft Web site.
|
||||
@ -90,7 +89,6 @@ This scenario, although similar to scenario #2, brings another layer of complexi
|
||||
|
||||
In this scenario, combining all previous four scenarios, you'll learn how to protect a machine from all unauthorized USB devices. The administrator wants to allow users to install only a small set of authorized USB devices while preventing any other USB device from being installed. In addition, this scenario includes an explanation of how to apply the ‘prevent’ functionality to existing USB devices that have already been installed on the machine, and the administrator likes to prevent any farther interaction with them (blocking them all together). This scenario builds on the policies and structure we introduced in the first four scenarios and therefore it's preferred to go over them first before attempting this scenario.
|
||||
|
||||
|
||||
## Technology Review
|
||||
|
||||
The following sections provide a brief overview of the core technologies discussed in this guide and give background information that is necessary to understand the scenarios.
|
||||
@ -126,14 +124,14 @@ Hardware IDs are the identifiers that provide the exact match between a device a
|
||||
|
||||
Windows uses these identifiers to select a driver if the operating system can't find a match with the device ID or any of the other hardware IDs. Compatible IDs are listed in the order of decreasing suitability. These strings are optional, and, when provided, they're generic, such as Disk. When a match is made using a compatible ID, you can typically use only the most basic functions of the device.
|
||||
|
||||
When you install a device, such as a printer, a USB storage device, or a keyboard, Windows searches for driver packages that match the device you are attempting to install. During this search, Windows assigns a "rank" to each driver package it discovers with at least one match to a hardware or compatible ID. The rank indicates how well the driver matches the device. Lower rank numbers indicate better matches between the driver and the device. A rank of zero represents the best possible match. A match with the device ID to one in the driver package results in a lower (better) rank than a match to one of the other hardware IDs. Similarly, a match to a hardware ID results in a better rank than a match to any of the compatible IDs. After Windows ranks all of the driver packages, it installs the one with the lowest overall rank. For more information about the process of ranking and selecting driver packages, see How Setup Selects Drivers in the Microsoft Docs library.
|
||||
When you install a device, such as a printer, a USB storage device, or a keyboard, Windows searches for driver packages that match the device you are attempting to install. During this search, Windows assigns a "rank" to each driver package it discovers with at least one match to a hardware or compatible ID. The rank indicates how well the driver matches the device. Lower rank numbers indicate better matches between the driver and the device. A rank of zero represents the best possible match. A match with the device ID to one in the driver package results in a lower (better) rank than a match to one of the other hardware IDs. Similarly, a match to a hardware ID results in a better rank than a match to any of the compatible IDs. After Windows ranks all of the driver packages, it installs the one with the lowest overall rank. For more information about the process of ranking and selecting driver packages, see [How Windows selects a driver package for a device](/windows-hardware/drivers/install/how-windows-selects-a-driver-for-a-device).
|
||||
|
||||
> [!NOTE]
|
||||
> For more information about the driver installation process, see the "Technology review" section of the Step-by-Step Guide to Driver Signing and Staging.
|
||||
|
||||
Some physical devices create one or more logical devices when they're installed. Each logical device might handle part of the functionality of the physical device. For example, a multi-function device, such as an all-in-one scanner/fax/printer, might have a different device identification string for each function.
|
||||
|
||||
When you use Device Installation policies to allow or prevent the installation of a device that uses logical devices, you must allow or prevent all of the device identification strings for that device. For example, if a user attempts to install a multifunction device and you didn't allow or prevent all of the identification strings for both physical and logical devices, you could get unexpected results from the installation attempt. For more detailed information about hardware IDs, see Device Identification Strings in Microsoft Docs.
|
||||
When you use Device Installation policies to allow or prevent the installation of a device that uses logical devices, you must allow or prevent all of the device identification strings for that device. For example, if a user attempts to install a multifunction device and you didn't allow or prevent all of the identification strings for both physical and logical devices, you could get unexpected results from the installation attempt. For more detailed information about hardware IDs, see [Device identification strings](/windows-hardware/drivers/install/device-identification-strings).
|
||||
|
||||
#### Device setup classes
|
||||
|
||||
@ -143,7 +141,7 @@ When you use device Classes to allow or prevent users from installing drivers, y
|
||||
|
||||
For example, a multi-function device, such as an all-in-one scanner/fax/printer, has a GUID for a generic multi-function device, a GUID for the printer function, a GUID for the scanner function, and so on. The GUIDs for the individual functions are "child nodes" under the multi-function device GUID. To install a child node, Windows must also be able to install the parent node. You must allow installation of the device setup class of the parent GUID for the multi-function device in addition to any child GUIDs for the printer and scanner functions.
|
||||
|
||||
For more information, see [Device Setup Classes](/windows-hardware/drivers/install/overview-of-device-setup-classes) in Microsoft Docs.
|
||||
For more information, see [Device Setup Classes](/windows-hardware/drivers/install/overview-of-device-setup-classes).
|
||||
|
||||
This guide doesn't depict any scenarios that use device setup classes. However, the basic principles demonstrated with device identification strings in this guide also apply to device setup classes. After you discover the device setup class for a specific device, you can then use it in a policy to either allow or prevent installation of drivers for that class of devices.
|
||||
|
||||
@ -156,12 +154,11 @@ The following two links provide the complete list of Device Setup Classes. ‘Sy
|
||||
|
||||
Some devices could be classified as _Removable Device_. A device is considered _removable_ when the driver for the device to which it's connected indicates that the device is removable. For example, a USB device is reported to be removable by the drivers for the USB hub to which the device is connected.
|
||||
|
||||
|
||||
### Group Policy Settings for Device Installation
|
||||
|
||||
Group Policy is an infrastructure that allows you to specify managed configurations for users and computers through Group Policy settings and Group Policy Preferences.
|
||||
|
||||
Device Installation section in Group Policy is a set of policies that control which device could or couldn't be installed on a machine. Whether you want to apply the settings to a stand-alone computer or to many computers in an Active Directory domain, you use the Group Policy Object Editor to configure and apply the policy settings. For more information, see Group Policy Object Editor Technical Reference.
|
||||
Device Installation section in Group Policy is a set of policies that control which device could or couldn't be installed on a machine. Whether you want to apply the settings to a stand-alone computer or to many computers in an Active Directory domain, you use the Group Policy Object Editor to configure and apply the policy settings. For more information, see [Group Policy Object Editor](/previous-versions/windows/desktop/Policy/group-policy-object-editor).
|
||||
|
||||
The following passages are brief descriptions of the Device Installation policies that are used in this guide.
|
||||
|
||||
@ -213,9 +210,6 @@ Some of these policies take precedence over other policies. The flowchart shown
|
||||
|
||||
<br/>_Device Installation policies flow chart_
|
||||
|
||||
|
||||
|
||||
|
||||
## Requirements for completing the scenarios
|
||||
|
||||
### General
|
||||
@ -273,7 +267,7 @@ To find device identification strings using Device Manager
|
||||
<br/>_HWID and Compatible ID_
|
||||
|
||||
> [!TIP]
|
||||
> You can also determine your device identification strings by using the PnPUtil command-line utility. For more information, see [PnPUtil - Windows drivers](/windows-hardware/drivers/devtest/pnputil) in Microsoft Docs.
|
||||
> You can also determine your device identification strings by using the PnPUtil command-line utility. For more information, see [PnPUtil - Windows drivers](/windows-hardware/drivers/devtest/pnputil).
|
||||
|
||||
### Getting device identifiers using PnPUtil
|
||||
|
||||
|
||||
@ -754,7 +754,7 @@ ADMX Info:
|
||||
|
||||
This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of required startup key information. This setting is applied when you turn on BitLocker.
|
||||
|
||||
The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used, it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. For more information about adding data recovery agents, see the BitLocker Drive Encryption Deployment Guide on Microsoft Docs.
|
||||
The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used, it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. For more information about adding data recovery agents, see [BitLocker recovery guide](/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan).
|
||||
|
||||
In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.
|
||||
|
||||
@ -843,7 +843,7 @@ ADMX Info:
|
||||
|
||||
This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker.
|
||||
|
||||
The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used, it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. For more information about adding data recovery agents, see the BitLocker Drive Encryption Deployment Guide on Microsoft Docs.
|
||||
The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used, it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. For more information about adding data recovery agents, see [BitLocker recovery guide](/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan).
|
||||
|
||||
In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.
|
||||
|
||||
|
||||
@ -213,6 +213,12 @@ manager: aaroncz
|
||||
<dd>
|
||||
<a href="#internetexplorer-enableextendediemodehotkeys">InternetExplorer/EnableExtendedIEModeHotkeys</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#internetexplorer-enableglobalwindowlistiniemode">InternetExplorer/EnableGlobalWindowListInIEMode</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#internetexplorer-disableieappdeprecationnotification">InternetExplorer/HideInternetExplorer11RetirementNotification </a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#internetexplorer-includealllocalsites">InternetExplorer/IncludeAllLocalSites</a>
|
||||
</dd>
|
||||
@ -612,6 +618,9 @@ manager: aaroncz
|
||||
<dd>
|
||||
<a href="#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols">InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#internetexplorer-resetzoomfordialoginiemode">InternetExplorer/ResetZoomForDialogInIEMode</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#internetexplorer-restrictactivexinstallinternetexplorerprocesses">InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses</a>
|
||||
</dd>
|
||||
@ -4423,6 +4432,115 @@ ADMX Info:
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="internetexplorer-enableglobalwindowlistiniemode"></a>**InternetExplorer/EnableGlobalWindowListInIEMode**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Windows SE|No|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This setting allows Internet Explorer mode to use the global window list that enables sharing state with other applications.
|
||||
The setting will take effect only when Internet Explorer 11 is disabled as a standalone browser.
|
||||
|
||||
- If you enable this policy, Internet Explorer mode will use the global window list.
|
||||
|
||||
- If you disable or don’t configure this policy, Internet Explorer mode will continue to maintain a separate window list.
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) - Disabled
|
||||
- 1 - Enabled
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Enable global window list in Internet Explorer mode*
|
||||
- GP name: *EnableGlobalWindowListInIEMode*
|
||||
- GP path: *Windows Components/Internet Explorer/Main*
|
||||
- GP ADMX file name: *inetres.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="internetexplorer-disableieappdeprecationnotification"></a>**InternetExplorer/HideInternetExplorer11RetirementNotification**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|No|
|
||||
|Windows SE|No|No|
|
||||
|Business|Yes|No|
|
||||
|Enterprise|Yes|No|
|
||||
|Education|Yes|No|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows you to manage whether the notification bar reminder that Internet Explorer is being retired is displayed. By default, the Notification bar is displayed in Internet Explorer 11.
|
||||
|
||||
- If you enable this policy setting, the notification bar will not be displayed in Internet Explorer 11.
|
||||
|
||||
- If you disable, or do not configure, this policy setting, the notification bar will be displayed in Internet Explorer 11.
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) - Disabled
|
||||
- 1 - Enabled
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Hide Internet Explorer 11 retirement notification*
|
||||
- GP name: *DisableIEAppDeprecationNotification*
|
||||
- GP path: *Windows Components/Internet Explorer/Main*
|
||||
- GP ADMX file name: *inetres.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
<!--Policy-->
|
||||
<a href="" id="internetexplorer-includealllocalsites"></a>**InternetExplorer/IncludeAllLocalSites**
|
||||
@ -11161,6 +11279,60 @@ ADMX Info:
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="internetexplorer-resetzoomfordialoginiemode"></a>**InternetExplorer/ResetZoomForDialogInIEMode**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Windows SE|No|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting lets admins reset zoom to default for HTML dialogs in Internet Explorer mode.
|
||||
|
||||
- If you enable this policy, the zoom of an HTML dialog in Internet Explorer mode will not get propagated from its parent page.
|
||||
|
||||
- If you disable, or don't configure this policy, the zoom of an HTML dialog in Internet Explorer mode will be set based on the zoom of it's parent page.
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) - Disabled
|
||||
- 1 - Enabled
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Reset zoom to default for HTML dialogs in Internet Explorer mode*
|
||||
- GP name: *ResetZoomForDialogInIEMode*
|
||||
- GP path: *Windows Components/Internet Explorer/Main*
|
||||
- GP ADMX file name: *inetres.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="internetexplorer-restrictactivexinstallinternetexplorerprocesses"></a>**InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses**
|
||||
|
||||
|
||||
Binary file not shown.
Binary file not shown.
@ -86,7 +86,7 @@ If you create an issue for something not related to documentation, Microsoft wil
|
||||
- [Product questions (using Microsoft Q&A)](/answers/products/)
|
||||
- [Support requests](#open-a-microsoft-support-case) for Update Compliance
|
||||
|
||||
To share feedback on the fundamental docs.microsoft.com platform, see [Docs feedback](https://aka.ms/sitefeedback). The platform includes all of the wrapper components such as the header, table of contents, and right menu. Also how the articles render in the browser, such as the font, alert boxes, and page anchors.
|
||||
To share feedback about the Microsoft Docs platform, see [Microsoft Docs feedback](https://aka.ms/sitefeedback). The platform includes all of the wrapper components such as the header, table of contents, and right menu. Also how the articles render in the browser, such as the font, alert boxes, and page anchors.
|
||||
|
||||
## Troubleshooting tips
|
||||
|
||||
|
||||
@ -19,15 +19,15 @@ The following posters step through various options for deploying Windows 10 with
|
||||
|
||||
## Deploy Windows 10 with Autopilot
|
||||
|
||||
The Windows Autopilot poster is two pages in portrait mode (11x17). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10AutopilotFlowchart.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10Autopilotflowchart.vsdx) format.
|
||||
The Windows Autopilot poster is two pages in portrait mode (11x17). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://download.microsoft.com/download/8/4/b/84b5e640-8f66-4b43-81a9-1c3b9ea18eda/Windows10AutopilotFlowchart.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10Autopilotflowchart.vsdx) format.
|
||||
|
||||
[](./media/Windows10AutopilotFlowchart.pdf)
|
||||
[](https://download.microsoft.com/download/8/4/b/84b5e640-8f66-4b43-81a9-1c3b9ea18eda/Windows10AutopilotFlowchart.pdf)
|
||||
|
||||
## Deploy Windows 10 with Microsoft Endpoint Configuration Manager
|
||||
|
||||
The Configuration Manager poster is one page in landscape mode (17x11). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.vsdx) format.
|
||||
The Configuration Manager poster is one page in landscape mode (17x11). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://download.microsoft.com/download/e/2/a/e2a70587-d3cc-4f1a-ba49-cfd724a1736b/Windows10DeploymentConfigManager.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.vsdx) format.
|
||||
|
||||
[](./media/Windows10DeploymentConfigManager.pdf)
|
||||
[](https://download.microsoft.com/download/e/2/a/e2a70587-d3cc-4f1a-ba49-cfd724a1736b/Windows10DeploymentConfigManager.pdf)
|
||||
|
||||
## See also
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Device registration overview
|
||||
description: This article provides and overview on how to register devices in Autopatch
|
||||
ms.date: 07/28/2022
|
||||
ms.date: 09/07/2022
|
||||
ms.prod: w11
|
||||
ms.technology: windows
|
||||
ms.topic: conceptual
|
||||
@ -44,12 +44,12 @@ See the following detailed workflow diagram. The diagram covers the Windows Auto
|
||||
| **Step 1: Identify devices** | IT admin identifies devices to be managed by the Windows Autopatch service. |
|
||||
| **Step 2: Add devices** | IT admin adds devices through direct membership or nests other Azure AD assigned or dynamic groups into the **Windows Autopatch Device Registration** Azure AD assigned group. |
|
||||
| **Step 3: Discover devices** | The Windows Autopatch Discover Devices function hourly discovers devices previously added by the IT admin into the **Windows Autopatch Device Registration** Azure AD assigned group in **step #2**. The Azure AD device ID is used by Windows Autopatch to query device attributes in both Microsoft Endpoint Manager-Intune and Azure AD when registering devices into its service.<ol><li>Once devices are discovered from the Azure AD group, the same function gathers additional device attributes and saves it into its memory during the discovery operation. The following device attributes are gathered from Azure AD in this step:</li><ol><li>**AzureADDeviceID**</li><li>**OperatingSystem**</li><li>**DisplayName (Device name)**</li><li>**AccountEnabled**</li><li>**RegistrationDateTime**</li><li>**ApproximateLastSignInDateTime**</li></ol><li>In this same step, the Windows Autopatch discover devices function calls another function, the device prerequisite check function. The device prerequisite check function evaluates software-based device-level prerequisites to comply with Windows Autopatch device readiness requirements prior to registration.</li></ol> |
|
||||
| **Step 4: Check prerequisites** | The Windows Autopatch prerequisite function makes an Intune Graph API call to sequentially validate device readiness attributes required for the registration process. For detailed information, see the [Detailed prerequisite check workflow diagram](#detailed-prerequisite-check-workflow-diagram) section. The service checks the following device readiness attributes, and/or prerequisites:<ol><li>**Serial number, model, and manufacturer.**</li><ol><li>Checks if the serial number already exists in the Windows Autopatch’s managed device database.</li></ol><li>**If the device is Intune-managed or not.**</li><ol><li>Windows Autopatch looks to see **if the Azure AD device ID has an Intune device ID associated with it**.</li><ol><li>If **yes**, it means this device is enrolled into Intune.</li><li>If **not**, it means the device isn't enrolled into Intune, hence it can't be managed by the Windows Autopatch service.</li></ol><li>**If the device is not managed by Intune**, the Windows Autopatch service can't gather device attributes such as operating system version, Intune enrollment date, device name and other attributes. When this happens, the Windows Autopatch service uses the Azure AD device attributes gathered and saved to its memory in **step 3a**.</li><ol><li>Once it has the device attributes gathered from Azure AD in **step 3a**, the device is flagged with the **Prerequisite failed** status, then added to the **Not ready** tab so the IT admin can review the reason(s) the device wasn't registered into Windows Autopatch. The IT admin will remediate these devices. In this case, the IT admin should check why the device wasn’t enrolled into Intune.</li><li>A common reason is when the Azure AD device ID is stale, it doesn’t have an Intune device ID associated with it anymore. To remediate, [clean up any stale Azure AD device records from your tenant](windows-autopatch-register-devices.md#clean-up-dual-state-of-hybrid-azure-ad-joined-and-azure-registered-devices-in-your-azure-ad-tenant).</li></ol><li>**If the device is managed by Intune**, the Windows Autopatch prerequisite check function continues to the next prerequisite check, which evaluates whether the device has checked into Intune in the last 28 days.</li></ol><li>**If the device is a Windows device or not.**</li><ol><li>Windows Autopatch looks to see if the Azure AD device ID has an Intune device ID associated with it.</li><ol><li>**If yes**, it means this device is enrolled into Intune.</li><li>**If not**, it means the device isn't enrolled into Intune, hence it can't be managed by the Windows Autopatch service.</li></ol></ol><li>**Windows Autopatch checks the Windows SKU family**. The SKU must be either:</li><ol><li>**Enterprise**</li><li>**Pro**</li><li>**Pro Workstation**</li></ol><li>**If the device meets the operating system requirements**, Windows Autopatch checks whether the device is either:</li><ol><li>**Only managed by Intune.**</li><ol><li>If the device is only managed by Intune, the device is marked as Passed all prerequisites.</li></ol><li>**Co-managed by both Configuration Manager and Intune.**</li><ol><li>If the device is co-managed by both Configuration Manager and Intune, an additional prerequisite check is evaluated to determine if the device satisfies the co-management-enabled workloads required by Windows Autopatch to manage devices in a co-managed state. The required co-management workloads evaluated in this step are:</li><ol><li>**Windows Updates Policies**</li><li>**Device Configuration**</li><li>**Office Click to Run**</li></ol><li>If Windows Autopatch determines that one of these workloads isn’t enabled on the device, the service marks the device as **Prerequisite failed** and moves the device to the **Not Ready** tab.</li></ol></ol></ol>|
|
||||
| **Step 4: Check prerequisites** | The Windows Autopatch prerequisite function makes an Intune Graph API call to sequentially validate device readiness attributes required for the registration process. For detailed information, see the [Detailed prerequisite check workflow diagram](#detailed-prerequisite-check-workflow-diagram) section. The service checks the following device readiness attributes, and/or prerequisites:<ol><li>**Serial number, model, and manufacturer.**</li><ol><li>Checks if the serial number already exists in the Windows Autopatch’s managed device database.</li></ol><li>**If the device is Intune-managed or not.**</li><ol><li>Windows Autopatch looks to see **if the Azure AD device ID has an Intune device ID associated with it**.</li><ol><li>If **yes**, it means this device is enrolled into Intune.</li><li>If **not**, it means the device isn't enrolled into Intune, hence it can't be managed by the Windows Autopatch service.</li></ol><li>**If the device is not managed by Intune**, the Windows Autopatch service can't gather device attributes such as operating system version, Intune enrollment date, device name and other attributes. When this happens, the Windows Autopatch service uses the Azure AD device attributes gathered and saved to its memory in **step 3a**.</li><ol><li>Once it has the device attributes gathered from Azure AD in **step 3a**, the device is flagged with the **Prerequisite failed** status, then added to the **Not registered** tab so the IT admin can review the reason(s) the device wasn't registered into Windows Autopatch. The IT admin will remediate these devices. In this case, the IT admin should check why the device wasn’t enrolled into Intune.</li><li>A common reason is when the Azure AD device ID is stale, it doesn’t have an Intune device ID associated with it anymore. To remediate, [clean up any stale Azure AD device records from your tenant](windows-autopatch-register-devices.md#clean-up-dual-state-of-hybrid-azure-ad-joined-and-azure-registered-devices-in-your-azure-ad-tenant).</li></ol><li>**If the device is managed by Intune**, the Windows Autopatch prerequisite check function continues to the next prerequisite check, which evaluates whether the device has checked into Intune in the last 28 days.</li></ol><li>**If the device is a Windows device or not.**</li><ol><li>Windows Autopatch looks to see if the Azure AD device ID has an Intune device ID associated with it.</li><ol><li>**If yes**, it means this device is enrolled into Intune.</li><li>**If not**, it means the device isn't enrolled into Intune, hence it can't be managed by the Windows Autopatch service.</li></ol></ol><li>**Windows Autopatch checks the Windows SKU family**. The SKU must be either:</li><ol><li>**Enterprise**</li><li>**Pro**</li><li>**Pro Workstation**</li></ol><li>**If the device meets the operating system requirements**, Windows Autopatch checks whether the device is either:</li><ol><li>**Only managed by Intune.**</li><ol><li>If the device is only managed by Intune, the device is marked as Passed all prerequisites.</li></ol><li>**Co-managed by both Configuration Manager and Intune.**</li><ol><li>If the device is co-managed by both Configuration Manager and Intune, an additional prerequisite check is evaluated to determine if the device satisfies the co-management-enabled workloads required by Windows Autopatch to manage devices in a co-managed state. The required co-management workloads evaluated in this step are:</li><ol><li>**Windows Updates Policies**</li><li>**Device Configuration**</li><li>**Office Click to Run**</li></ol><li>If Windows Autopatch determines that one of these workloads isn’t enabled on the device, the service marks the device as **Prerequisite failed** and moves the device to the **Not registered** tab.</li></ol></ol></ol>|
|
||||
| **Step 5: Calculate deployment ring assignment** | Once the device passes all prerequisites described in **step #4**, Windows Autopatch starts its deployment ring assignment calculation. The following logic is used to calculate the Windows Autopatch deployment ring assignment:<ol><li>If the Windows Autopatch tenant’s existing managed device size is **≤ 200**, the deployment ring assignment is **First (5%)**, **Fast (15%)**, remaining devices go to the **Broad ring (80%)**.</li><li>If the Windows Autopatch tenant’s existing managed device size is **>200**, the deployment ring assignment will be **First (1%)**, **Fast (9%)**, remaining devices go to the **Broad ring (90%)**.</li></ol> |
|
||||
| **Step 6: Assign devices to a deployment ring group** | Once the deployment ring calculation is done, Windows Autopatch assigns devices to one of the following deployment ring groups:<ol><li>**Modern Workplace Devices-Windows Autopatch-First**</li><ol><li>The Windows Autopatch device registration process doesn’t automatically assign devices to the Test ring represented by the Azure AD group (Modern Workplace Devices-Windows Autopatch-Test). It’s important that you assign devices to the Test ring to validate the update deployments before the updates are deployed to a broader population of devices.</li></ol><li>**Modern Workplace Devices-Windows Autopatch-Fast**</li><li>**Modern Workplace Devices-Windows Autopatch-Broad**</li></ol> |
|
||||
| **Step 7: Assign devices to an Azure AD group** | Windows Autopatch also assigns devices to the following Azure AD groups when certain conditions apply:<ol><li>**Modern Workplace Devices - All**</li><ol><li>This group has all devices managed by Windows Autopatch.</li></ol><li>When registering **Windows 10 devices**, use **Modern Workplace Devices Dynamic - Windows 10**</li><ol><li>This group has all devices managed by Windows Autopatch and that have Windows 10 installed.</li></ol><li>When registering **Windows 11 devices**, use **Modern Workplace Devices Dynamic - Windows 11**</li><ol><li>This group has all devices managed by Windows Autopatch and that have Windows 11 installed.</li></ol><li>When registering **virtual devices**, use **Modern Workplace Devices - Virtual Machine**</li><ol><li>This group has all virtual devices managed by Windows Autopatch.</li></ol> |
|
||||
| **Step 8: Post-device registration** | In post-device registration, three actions occur:<ol><li>Windows Autopatch adds devices to its managed database.</li><li>Flags devices as **Active** in the **Ready** tab.</li><li>The Azure AD device ID of the device successfully registered is added into the Microsoft Cloud Managed Desktop Extension’s allowlist. Windows Autopatch installs the Microsoft Cloud Managed Desktop Extension agent once devices are registered, so the agent can communicate back to the Microsoft Cloud Managed Desktop Extension service.</li><ol><li>The agent is the **Modern Workplace - Autopatch Client setup** PowerShell script that was created during the Windows Autopatch tenant enrollment process. The script is executed once devices are successfully registered into the Windows Autopatch service.</li></ol> |
|
||||
| **Step 9: Review device registration status** | IT admins review the device registration status in both the **Ready** and **Not ready** tabs.<ol><li>If the device was **successfully registered**, the device shows up in the **Ready** tab.</li><li>If **not**, the device shows up in the **Not ready** tab.</li></ol> |
|
||||
| **Step 9: Review device registration status** | IT admins review the device registration status in both the **Ready** and **Not registered** tabs.<ol><li>If the device was **successfully registered**, the device shows up in the **Ready** tab.</li><li>If **not**, the device shows up in the **Not registered** tab.</li></ol> |
|
||||
| **Step 10: End of registration workflow** | This is the end of the Windows Autopatch device registration workflow. |
|
||||
|
||||
## Detailed prerequisite check workflow diagram
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Register your devices
|
||||
description: This article details how to register devices in Autopatch
|
||||
ms.date: 08/08/2022
|
||||
ms.date: 09/07/2022
|
||||
ms.prod: w11
|
||||
ms.technology: windows
|
||||
ms.topic: how-to
|
||||
@ -28,7 +28,13 @@ Windows Autopatch can take over software update management control of devices th
|
||||
|
||||
### About the use of an Azure AD group to register devices
|
||||
|
||||
You must choose what devices to manage with Windows Autopatch by either adding them through direct membership or by nesting other Azure AD dynamic/assigned groups into the **Windows Autopatch Device Registration** Azure AD assigned group. Windows Autopatch automatically runs its discover devices function every hour to discover new devices added to this group. Once new devices are discovered, Windows Autopatch attempts to register these devices.
|
||||
You must choose what devices to manage with Windows Autopatch by adding them to the **Windows Autopatch Device Registration** Azure AD assigned group. Devices can be added using the following methods:
|
||||
|
||||
- Direct membership
|
||||
- Nesting other Azure AD dynamic/assigned groups
|
||||
- [Bulk add/import group members](/azure/active-directory/enterprise-users/groups-bulk-import-members)
|
||||
|
||||
Windows Autopatch automatically runs its discover devices function every hour to discover new devices added to this group. Once new devices are discovered, Windows Autopatch attempts to register these devices.
|
||||
|
||||
> [!NOTE]
|
||||
> Devices that are intended to be managed by the Windows Autopatch service **must** be added into the **Windows Autopatch Device Registration** Azure AD assigned group. Devices can only be added to this group if they have an Azure AD device ID. Windows Autopatch scans the Azure AD group hourly to discover newly added devices to be registered. You can also use the **Discover devices** button in either the **Ready** or **Not ready** tab to register devices on demand.
|
||||
@ -78,14 +84,26 @@ To be eligible for Windows Autopatch management, devices must meet a minimum set
|
||||
|
||||
For more information, see [Windows Autopatch Prerequisites](../prepare/windows-autopatch-prerequisites.md).
|
||||
|
||||
## About the Ready and Not ready tabs
|
||||
## About the Ready, Not ready and Not registered tabs
|
||||
|
||||
Windows Autopatch introduces a new user interface to help IT admins detect and troubleshoot device readiness statuses seamlessly with actionable in-UI device readiness reports for unregistered devices or unhealthy devices.
|
||||
Windows Autopatch has three tabs within its device blade. Each tab is designed to provide a different set of device readiness status so IT admin knows where to go to monitor, and troubleshoot potential device health issues.
|
||||
|
||||
| Tab | Purpose |
|
||||
| ----- | ----- |
|
||||
| Ready | The purpose of the Ready tab is to show devices that were successfully registered to the Windows Autopatch service. |
|
||||
| Not ready | The purpose of the Not ready tab is to help you identify and remediate devices that don't meet the pre-requisite checks to register into the Windows Autopatch service. This tab only shows devices that didn't successfully register into Windows Autopatch. |
|
||||
| Device blade tab | Purpose | Expected device readiness status |
|
||||
| ----- | ----- | ----- |
|
||||
| Ready | The purpose of this tab is to show devices that were successfully registered with the Windows Autopatch service. | Active |
|
||||
| Not ready | The purpose of this tab is to help you identify and remediate devices that failed to pass one or more post-device registration readiness checks. Devices showing up in this tab were successfully registered with Windows Autopatch. However, these devices aren't ready to have one or more software update workloads managed by the service. | Readiness failed and/or Inactive |
|
||||
| Not registered | The purpose of this tab is to help you identify and remediate devices that don't meet one or more prerequisite checks to successfully register with the Windows Autopatch service. | Pre-requisites failed |
|
||||
|
||||
## Device readiness statuses
|
||||
|
||||
See all possible device readiness statuses in Windows Autopatch:
|
||||
|
||||
| Readiness status | Description | Device blade tab |
|
||||
| ----- | ----- | ----- |
|
||||
| Active | Devices with this status successfully passed all prerequisite checks and subsequently successfully registered with Windows Autopatch. Additionally, devices with this status successfully passed all post-device registration readiness checks. | Ready |
|
||||
| Readiness failed | Devices with this status haven't passed one or more post-device registration readiness checks. These devices aren't ready to have one or more software update workloads managed by Windows Autopatch. | Not ready |
|
||||
| Inactive | Devices with this status haven't communicated with Microsoft Endpoint Manager-Intune in the last 28 days. | Not ready |
|
||||
| Pre-requisites failed | Devices with this status haven't passed one or more pre-requisite checks and haven't successfully registered with Windows Autopatch | Not registered |
|
||||
|
||||
## Built-in roles required for device registration
|
||||
|
||||
@ -119,16 +137,16 @@ Since existing Windows 365 Cloud PCs already have an existing Azure AD device ID
|
||||
1. Go to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/).
|
||||
2. Select **Devices** from the left navigation menu.
|
||||
3. Under the **Windows Autopatch** section, select **Devices**.
|
||||
4. Select either the **Ready** or the **Not ready** tab, then select the **Windows Autopatch Device Registration** hyperlink. The Azure Active Directory group blade opens.
|
||||
4. Select either the **Ready** or the **Not registered** tab, then select the **Windows Autopatch Device Registration** hyperlink. The Azure Active Directory group blade opens.
|
||||
5. Add either devices through direct membership, or other Azure AD dynamic or assigned groups as nested groups in the **Windows Autopatch Device Registration** group.
|
||||
|
||||
> [!NOTE]
|
||||
> The **Windows Autopatch Device Registration** hyperlink is in the center of the Ready tab when there's no devices registered with the Windows Autopatch service. Once you have one or more devices registered with the Windows Autopatch service, the **Windows Autopatch Device registration** hyperlink is at the top of both **Ready** and **Not ready** tabs.
|
||||
> The **Windows Autopatch Device Registration** hyperlink is in the center of the Ready tab when there's no devices registered with the Windows Autopatch service. Once you have one or more devices registered with the Windows Autopatch service, the **Windows Autopatch Device registration** hyperlink is at the top of both **Ready** and **Not registered** tabs.
|
||||
|
||||
Once devices or other Azure AD groups (either dynamic or assigned) containing devices are added to the **Windows Autopatch Device Registration** group, Windows Autopatch's device discovery hourly function discovers these devices, and runs software-based prerequisite checks to try to register them with its service.
|
||||
|
||||
> [!TIP]
|
||||
> You can also use the **Discover Devices** button in either the **Ready** or **Not ready** tab to discover devices from the **Windows Autopatch Device Registration** Azure AD group on demand.
|
||||
> You can also use the **Discover Devices** button in either one of the **Ready**, **Not ready**, or **Not registered** device blade tabs to discover devices from the **Windows Autopatch Device Registration** Azure AD group on demand. On demand means you don't have to wait for Windows Autopatch to discover devices from the Azure AD group on your behalf.
|
||||
|
||||
### Windows Autopatch on Windows 365 Enterprise Workloads
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 560 KiB After Width: | Height: | Size: 561 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 216 KiB After Width: | Height: | Size: 1006 KiB |
@ -37,7 +37,7 @@ In this example, we'll be discussing a device in the First ring. The Autopatch s
|
||||
|
||||
In the following example, the user schedules the restart and is notified 15 minutes prior to the scheduled restart time. The user can reschedule, if necessary, but isn't able to reschedule past the deadline.
|
||||
|
||||
:::image type="content" source="../media/windows-feature-typical-update-experience.png" alt-text="Typical Windows feature update experience":::
|
||||
:::image type="content" source="../media/windows-feature-typical-update-experience.png" alt-text="Typical Windows feature update experience" lightbox="../media/windows-feature-typical-update-experience.png":::
|
||||
|
||||
### Feature update deadline forces an update
|
||||
|
||||
@ -45,7 +45,7 @@ The following example builds on the scenario outlined in the typical user experi
|
||||
|
||||
The deadline specified in the update policy is five days. Therefore, once this deadline is passed, the device will ignore the active hours and force a restart to complete the installation. The user will receive a 15-minute warning, after which, the device will install the update and restart.
|
||||
|
||||
:::image type="content" source="../media/windows-feature-force-update.png" alt-text="Force Windows feature update":::
|
||||
:::image type="content" source="../media/windows-feature-force-update.png" alt-text="Force Windows feature update" lightbox="../media/windows-feature-force-update.png":::
|
||||
|
||||
### Feature update grace period
|
||||
|
||||
@ -53,7 +53,7 @@ In the following example, the user is on holiday and the device is offline beyon
|
||||
|
||||
Since the deadline has already passed, the device is granted a two-day grace period to install the update and restart. The user will be notified of a pending installation and given options to choose from. Once the two-day grace period has expired, the user is forced to restart with a 15-minute warning notification.
|
||||
|
||||
:::image type="content" source="../media/windows-feature-update-grace-period.png" alt-text="Window feature update grace period":::
|
||||
:::image type="content" source="../media/windows-feature-update-grace-period.png" alt-text="Windows feature update grace period" lightbox="../media/windows-feature-update-grace-period.png":::
|
||||
|
||||
## Servicing window
|
||||
|
||||
|
||||
@ -46,7 +46,7 @@ The final release schedule is communicated prior to release and may vary a littl
|
||||
| Fast | Release start + 60 days |
|
||||
| Broad | Release start + 90 days |
|
||||
|
||||
:::image type="content" source="../media/windows-feature-release-process-timeline.png" alt-text="Windows feature release timeline":::
|
||||
:::image type="content" source="../media/windows-feature-release-process-timeline.png" alt-text="Windows feature release timeline" lightbox="../media/windows-feature-release-process-timeline.png":::
|
||||
|
||||
## New devices to Windows Autopatch
|
||||
|
||||
@ -64,7 +64,7 @@ When releasing a feature update, there are two policies that are configured by t
|
||||
| Ring | Target version (DSS) Policy | Feature update deferral | Feature update deadline | Feature update grace period |
|
||||
| ----- | ----- | ----- | ----- | ----- |
|
||||
| Test | 21H2 | 0 | 5 | 0 |
|
||||
| First | 21H2 | 0 | 5 | 0 |
|
||||
| First | 21H2 | 0 | 5 | 2 |
|
||||
| Fast | 21H2 | 0 | 5 | 2 |
|
||||
| Broad | 21H2 | 0 | 5 | 2 |
|
||||
|
||||
|
||||
@ -33,7 +33,7 @@ For a device to be eligible for Microsoft 365 Apps for enterprise updates, as a
|
||||
|
||||
All devices registered for Windows Autopatch will receive updates from the [Monthly Enterprise Channel](/deployoffice/overview-update-channels#monthly-enterprise-channel-overview). This practice provides your users with new features each month, and they'll receive just one update per month on a predictable release schedule. Updates are released on the second Tuesday of the month; these updates can include feature, security, and quality updates. These updates occur automatically and are pulled directly from the Office Content Delivery Network (CDN).
|
||||
|
||||
Unlike Windows update, the Office CDN doesn't make the update available to all devices at once. Over the course of the release, the Office CDN gradually makes the update available to the whole population of devices. Windows Autopatch doesn't control the order in which updates are offered to devices across your estate. After the update has been downloaded, there's a three-day [update deadline](/deployoffice/configure-update-settings-microsoft-365-apps) that specifies how long the user has until the user must apply the update.
|
||||
Unlike Windows update, the Office CDN doesn't make the update available to all devices at once. Over the course of the release, the Office CDN gradually makes the update available to the whole population of devices. Windows Autopatch doesn't control the order in which updates are offered to devices across your estate. After the update has been downloaded, there's a seven day [update deadline](/deployoffice/configure-update-settings-microsoft-365-apps) that specifies how long the user has until the user must apply the update.
|
||||
|
||||
## Update rings
|
||||
|
||||
|
||||
@ -40,6 +40,9 @@ During the [tenant enrollment process](../prepare/windows-autopatch-enroll-tenan
|
||||
|
||||
Each deployment ring has a different set of update deployment policies to control the updates rollout.
|
||||
|
||||
> [!WARNING]
|
||||
> Adding or importing devices into any of these groups directly is not supported and doing so might cause an unexpected impact on the Windows Autopatch service. To move devices between these groups, see [Moving devices in between deployment rings](../operate/windows-autopatch-update-management.md#moving-devices-in-between-deployment-rings).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Windows Autopatch device registration doesn't assign devices to its test deployment ring (**Modern Workplace Devices-Windows Autopatch-Test**). This is intended to prevent devices that are essential to a business from being affected or devices that are used by executives from receiving early software update deployments.
|
||||
|
||||
@ -58,7 +61,7 @@ The Windows Autopatch deployment ring calculation happens during the [device reg
|
||||
|
||||
| Deployment ring | Default device balancing percentage | Description |
|
||||
| ----- | ----- | ----- |
|
||||
| Test | **zero** | Windows Autopatch doesn't automatically add devices to this deployment ring. You must manually add devices to the Test ring. The recommended number of devices in this ring, based upon your environment size, is as follows:<br><ul><li>**0–500** devices: minimum **one** device.</li><li>**500–5000** devices: minimum **five** devices.</li><li>**5000+** devices: minimum **50** devices.</li></ul>Devices in this group are intended for your IT Administrators and testers since changes are released here first. This release schedule provides your organization the opportunity to validate updates prior to reaching production users. |
|
||||
| Test | **zero** | Windows Autopatch doesn't automatically add devices to this deployment ring. You must manually add devices to the Test ring following the required procedure. For more information on these procedures, see [Moving devices in between deployment rings](/windows/deployment/windows-autopatch/operate/windows-autopatch-update-management#moving-devices-in-between-deployment-rings). The recommended number of devices in this ring, based upon your environment size, is as follows:<br><ul><li>**0–500** devices: minimum **one** device.</li><li>**500–5000** devices: minimum **five** devices.</li><li>**5000+** devices: minimum **50** devices.</li></ul>Devices in this group are intended for your IT Administrators and testers since changes are released here first. This release schedule provides your organization the opportunity to validate updates prior to reaching production users. |
|
||||
| First | **1%** | The First ring is the first group of production users to receive a change.<p><p>This group is the first set of devices to send data to Windows Autopatch and are used to generate a health signal across all end-users. For example, Windows Autopatch can generate a statistically significant signal saying that critical errors are trending up in a specific release for all end-users, but can't be confident that it's doing so in your organization.<p><p>Since Windows Autopatch doesn't yet have sufficient data to inform a release decision, devices in this deployment ring might experience outages if there are scenarios that weren't covered during early testing in the Test ring.|
|
||||
| Fast | **9%** | The Fast ring is the second group of production users to receive changes. The signals from the First ring are considered as a part of the release process to the Broad ring.<p><p>The goal with this deployment ring is to cross the **500**-device threshold needed to generate statistically significant analysis at the tenant level. These extra devices allow Windows Autopatch to consider the effect of a release on the rest of your devices and evaluate if a targeted action for your tenant is needed.</p> |
|
||||
| Broad | Either **80%** or **90%** | The Broad ring is the last group of users to receive software update deployments. Since it contains most of the devices registered with Windows Autopatch, it favors stability over speed in an software update deployment.|
|
||||
@ -81,6 +84,9 @@ When the assignment is complete, the **Ring assigned by** column changes to **Ad
|
||||
> [!NOTE]
|
||||
> You can only move devices to other deployment rings when they're in an active state in the **Ready** tab.<p>If you don't see the **Ring assigned by column** change to **Pending** in Step 5, check to see whether the device exists in Microsoft Endpoint Manager-Intune or not by searching for it in its device blade. For more information, see [Device details in Intune](/mem/intune/remote-actions/device-inventory).
|
||||
|
||||
> [!WARNING]
|
||||
> Moving devices between deployment rings through directly changing Azure AD group membership isn't supported and may cause unintended configuration conflicts within the Windows Autopatch service. To avoid service interruption to devices, use the **Assign device to ring** action described previously to move devices between deployment rings.
|
||||
|
||||
## Automated deployment ring remediation functions
|
||||
|
||||
Windows Autopatch monitors device membership in its deployment rings, except for the **Modern Workplace Devices-Windows Autopatch-Test** ring, to provide automated deployment ring remediation functions to mitigate the risk of not having its managed devices being part of one of its deployment rings. These automated functions help mitigate risk of potentially having devices in a vulnerable state, and exposed to security threats in case they're not receiving update deployments due to either:
|
||||
|
||||
@ -36,7 +36,7 @@ Once the deferral period has passed, the device will download the update and not
|
||||
|
||||
In the following example, the user schedules the restart and is notified 15 minutes prior to the scheduled restart time. The user can reschedule, if necessary, but isn't able to reschedule past the deadline.
|
||||
|
||||
:::image type="content" source="../media/windows-quality-typical-update-experience.png" alt-text="Typical windows quality update experience":::
|
||||
:::image type="content" source="../media/windows-quality-typical-update-experience.png" alt-text="Typical windows quality update experience" lightbox="../media/windows-quality-typical-update-experience.png":::
|
||||
|
||||
### Quality update deadline forces an update
|
||||
|
||||
@ -48,7 +48,7 @@ In the following example, the user:
|
||||
|
||||
The deadline specified in the update policy is five days. Therefore, once this deadline is passed, the device will ignore the [active hours](#servicing-window) and force a restart to complete the update installation. The user will receive a 15-minute warning, after which, the device will install the update and restart.
|
||||
|
||||
:::image type="content" source="../media/windows-quality-force-update.png" alt-text="Force Windows quality update":::
|
||||
:::image type="content" source="../media/windows-quality-force-update.png" alt-text="Force Windows quality update" lightbox="../media/windows-quality-force-update.png":::
|
||||
|
||||
### Quality update grace period
|
||||
|
||||
@ -56,7 +56,7 @@ In the following example, the user is on holiday and the device is offline beyon
|
||||
|
||||
Since the deadline has already passed, the device is granted a two-day grace period to install the update and restart. The user will be notified of a pending installation and given options to choose from. Once the two-day grace period has expired, the user is forced to restart with a 15-minute warning notification.
|
||||
|
||||
:::image type="content" source="../media/windows-quality-update-grace-period.png" alt-text="Windows quality update grace period":::
|
||||
:::image type="content" source="../media/windows-quality-update-grace-period.png" alt-text="Windows quality update grace period" lightbox="../media/windows-quality-update-grace-period.png":::
|
||||
|
||||
## Servicing window
|
||||
|
||||
|
||||
@ -50,7 +50,7 @@ To release updates to devices in a gradual manner, Windows Autopatch deploys a s
|
||||
|
||||
Windows Autopatch configures these policies differently across update rings to gradually release the update to devices in your estate. Devices in the Test ring receive changes first and devices in the Broad ring receive changes last. For more information, see [Windows Autopatch deployment rings](../operate/windows-autopatch-update-management.md#windows-autopatch-deployment-rings).
|
||||
|
||||
:::image type="content" source="../media/release-process-timeline.png" alt-text="Release process timeline":::
|
||||
:::image type="content" source="../media/release-process-timeline.png" alt-text="Release process timeline" lightbox="../media/release-process-timeline.png":::
|
||||
|
||||
## Expedited releases
|
||||
|
||||
|
||||
@ -42,7 +42,7 @@ The update is released to the Test ring on the second Tuesday of the month. Thos
|
||||
|
||||
Windows Autopatch monitors devices for a set of core reliability metrics as a part of the service.
|
||||
|
||||
The service then uses statistical models to assess if there are significant differences between the two Windows versions. To make a statistically significant assessment, Windows Autopatch requires that at least 500 devices have upgraded to the new version.
|
||||
The service then uses statistical models to assess if there are significant differences between the two Windows versions. To make a statistically significant assessment, Windows Autopatch requires that at least 500 devices in your tenant have upgraded to the new version.
|
||||
|
||||
As more devices update, the confidence of the analysis increases and gives us a clearer picture of release quality. If we determine that the user experience is impaired, Autopatch will either post a customer advisory or pause the release, depending on the criticality of the update.
|
||||
|
||||
@ -51,8 +51,8 @@ Autopatch monitors the following reliability signals:
|
||||
| Device reliability signal | Description |
|
||||
| ----- | ----- |
|
||||
| Blue screens | These events are highly disruptive to end users so are closely watched. |
|
||||
| Overall app reliability | Tracks the total number of app crashes and freezes on a device. A known issue with this measure is that if one app becomes 10% more reliable and another becomes 10% less reliable then it shows up as a flat line in the measure. |
|
||||
| Microsoft Office reliability | Tracks the number of Office crashes or freezes per application per device. |
|
||||
| Overall app reliability | Tracks the total number of app crashes and freezes on a device. A known limitation with this measure is that if one app becomes 10% more reliable and another becomes 10% less reliable then it shows up as a flat line in the measure. |
|
||||
| Microsoft Office reliability | Tracks the number of Office crashes and freezes per application per device. |
|
||||
| Microsoft Edge reliability | Tracks the number of Microsoft Edge crashes and freezes per device. |
|
||||
| Microsoft Teams reliability | Tracks the number of Microsoft Teams crashes and freezes per device. |
|
||||
|
||||
|
||||
@ -51,7 +51,7 @@ sections:
|
||||
- [Switch workloads for device configuration, Windows Update and Microsoft 365 Apps from Configuration Manager to Intune](/mem/configmgr/comanage/how-to-switch-workloads) (minimum Pilot Intune. Pilot collection must contain the devices you want to register into Autopatch.)
|
||||
- question: What are the licensing requirements for Windows Autopatch?
|
||||
answer: |
|
||||
- Windows Autopatch is included with Window 10/11 Enterprise E3 or higher. For more information, see [More about licenses](../prepare/windows-autopatch-prerequisites.md#more-about-licenses).
|
||||
- Windows Autopatch is included with Window 10/11 Enterprise E3 or higher (user-based only). For more information, see [More about licenses](../prepare/windows-autopatch-prerequisites.md#more-about-licenses).
|
||||
- [Azure AD Premium](/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses) (for Co-management)
|
||||
- [Microsoft Intune](/mem/intune/fundamentals/licenses) (includes Configuration Manager 2010 or greater via co-management)
|
||||
- question: Are there hardware requirements for Windows Autopatch?
|
||||
@ -76,12 +76,13 @@ sections:
|
||||
- question: What systems does Windows Autopatch update?
|
||||
answer: |
|
||||
- Windows 10/11 quality updates: Windows Autopatch manages all aspects of update rings.
|
||||
- Windows 10/11 feature updates: Windows Autopatch manages all aspects of update rings.
|
||||
- Microsoft 365 Apps for enterprise updates: All devices registered for Windows Autopatch will receive updates from the Monthly Enterprise Channel.
|
||||
- Microsoft Edge: Windows Autopatch configures eligible devices to benefit from Microsoft Edge's progressive rollouts on the Stable channel and will provide support for issues with Microsoft Edge updates.
|
||||
- Microsoft Teams: Windows Autopatch allows eligible devices to benefit from the standard automatic update channels and will provide support for issues with Teams updates.
|
||||
- question: What does Windows Autopatch do to ensure updates are done successfully?
|
||||
answer: |
|
||||
For Windows quality updates, updates are applied to device in the Test ring first. The devices are evaluated, and then rolled out to the First, Fast then Broad rings. There's an evaluation period at each progression. This process is dependent on customer testing and verification of all updates during these rollout stages. The outcome is to ensure that registered devices are always up to date and disruption to business operations is minimized to free up your IT department from that ongoing task.
|
||||
For Windows quality updates, updates are applied to devices in the Test ring first. The devices are evaluated, and then rolled out to the First, Fast then Broad rings. There's an evaluation period at each progression. This process is dependent on customer testing and verification of all updates during these rollout stages. The outcome is to ensure that registered devices are always up to date and disruption to business operations is minimized to free up your IT department from that ongoing task.
|
||||
- question: What happens if there's an issue with an update?
|
||||
answer: |
|
||||
Autopatch relies on the following capabilities to help resolve update issues:
|
||||
|
||||
@ -29,10 +29,10 @@ Windows Autopatch will create Azure Active Directory groups that are required to
|
||||
| Modern Workplace-All | All Modern Workplace users |
|
||||
| Modern Workplace - Windows 11 Pre-Release Test Devices | Device group for Windows 11 Pre-Release testing. |
|
||||
| Modern Workplace Devices-All | All Modern Workplace devices |
|
||||
| Modern Workplace Devices-Windows Autopatch-Test | Immediate ring for device rollout |
|
||||
| Modern Workplace Devices-Windows Autopatch-First | First production ring for early adopters |
|
||||
| Modern Workplace Devices-Windows Autopatch-Fast | Fast ring for quick rollout and adoption |
|
||||
| Modern Workplace Devices-Windows Autopatch-Broad | Final ring for broad rollout into an organization |
|
||||
| Modern Workplace Devices-Windows Autopatch-Test | Deployment ring for testing update deployments prior production rollout |
|
||||
| Modern Workplace Devices-Windows Autopatch-First | First production deployment ring for early adopters |
|
||||
| Modern Workplace Devices-Windows Autopatch-Fast | Fast deployment ring for quick rollout and adoption |
|
||||
| Modern Workplace Devices-Windows Autopatch-Broad | Final deployment ring for broad rollout into the organization |
|
||||
| Modern Workplace Devices Dynamic - Windows 10 | Microsoft Managed Desktop Devices with Windows 10<p>Group Rule:<ul><li>`(device.devicePhysicalIds -any _ -startsWith \"[OrderID]:Microsoft365Managed_\")`</li><li>`(device.deviceOSVersion -notStartsWith \"10.0.22000\")`</li></ul><br>Exclusions:<ul><li>Modern Workplace - Telemetry Settings for Windows 11</li></ul> |
|
||||
| Modern Workplace Devices Dynamic - Windows 11 | Microsoft Managed Desktop Devices with Windows 11<p>Group Rule:<ul><li>`(device.devicePhysicalIds -any _ -startsWith \"[OrderID]:Microsoft365Managed_\")`</li><li>`(device.deviceOSVersion -startsWith \"10.0.22000\")`</li></ul><br>Exclusions:<ul><li>Modern Workplace - Telemetry Settings for Windows 10</li></ul> |
|
||||
| Modern Workplace Roles - Service Administrator | All users granted access to Modern Workplace Service Administrator Role |
|
||||
@ -132,4 +132,4 @@ Windows Autopatch creates an enterprise application in your tenant. This enterpr
|
||||
|
||||
| Script | Description |
|
||||
| ----- | ----- |
|
||||
| Modern Workplace - Autopatch Client Setup | Installs necessary client components for the Windows Autopatch service |
|
||||
| Modern Workplace - Autopatch Client Setup v1.1 | Installs necessary client components for the Windows Autopatch service |
|
||||
|
||||
@ -20,7 +20,7 @@ Windows Autopatch is a cloud service for enterprise customers designed to keep e
|
||||
|
||||
Windows Autopatch provides its service to enterprise customers, and properly administers customers' enrolled devices by using data from various sources.
|
||||
|
||||
The sources include Azure Active Directory (AD), Microsoft Intune, and Microsoft Windows 10/11. The sources provide a comprehensive view of the devices that Windows Autopatch manages. The service also uses these Microsoft services to enable Windows Autopatch to provide IT as a Service (ITaaS) capabilities:
|
||||
The sources include Azure Active Directory (Azure AD), Microsoft Intune, and Microsoft Windows 10/11. The sources provide a comprehensive view of the devices that Windows Autopatch manages. The service also uses these Microsoft services to enable Windows Autopatch to provide IT as a Service (ITaaS) capabilities:
|
||||
|
||||
| Data source | Purpose |
|
||||
| ------ | ------ |
|
||||
@ -74,7 +74,7 @@ Microsoft Windows Update for Business uses data from Windows diagnostics to anal
|
||||
|
||||
## Microsoft Azure Active Directory
|
||||
|
||||
Identifying data used by Windows Autopatch is stored by Azure Active Directory (Azure AD) in a geographical location. The geographical location is based on the location provided by the organization upon subscribing to Microsoft online services, such as Microsoft Apps for Enterprise and Azure. For more information on where your Azure AD data is located, see [Azure Active Directory - Where is your data located?](https://msit.powerbi.com/view?r=eyJrIjoiODdjOWViZDctMWRhZS00ODUzLWI4MmQtNWM5NjBkZTBkNjFlIiwidCI6IjcyZjk4OGJmLTg2ZjEtNDFhZi05MWFiLTJkN2NkMDExZGI0NyIsImMiOjV9)
|
||||
Identifying data used by Windows Autopatch is stored by Azure Active Directory (AD) in a geographical location. The geographical location is based on the location provided by the organization upon subscribing to Microsoft online services, such as Microsoft Apps for Enterprise and Azure. For more information on where your Azure AD data is located, see [Azure Active Directory - Where is your data located?](https://msit.powerbi.com/view?r=eyJrIjoiODdjOWViZDctMWRhZS00ODUzLWI4MmQtNWM5NjBkZTBkNjFlIiwidCI6IjcyZjk4OGJmLTg2ZjEtNDFhZi05MWFiLTJkN2NkMDExZGI0NyIsImMiOjV9)
|
||||
|
||||
## Microsoft Intune
|
||||
|
||||
|
||||
@ -419,15 +419,9 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B
|
||||
> [!IMPORTANT]
|
||||
> If you've already registered your VM (or device) using Intune, then skip this step.
|
||||
|
||||
Optional: see the following video for an overview of the process.
|
||||
|
||||
|
||||
|
||||
> [!video https://www.youtube.com/embed/IpLIZU_j7Z0]
|
||||
|
||||
First, you need a Microsoft Store for Business account. You can use the same one you created above for Intune, or follow [these instructions](/microsoft-store/windows-store-for-business-overview) to create a new one.
|
||||
|
||||
Next, to sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) with your test account, select **Sign in** on the upper-right-corner of the main page.
|
||||
Next, to sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/store) with your test account, select **Sign in** on the upper-right-corner of the main page.
|
||||
|
||||
Select **Manage** from the top menu, then select the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example:
|
||||
|
||||
@ -528,8 +522,6 @@ Select **OK**, and then select **Create**.
|
||||
|
||||
If you already created and assigned a profile via Intune with the steps immediately above, then skip this section.
|
||||
|
||||
A [video](https://www.youtube.com/watch?v=IpLIZU_j7Z0) is available that covers the steps required to create and assign profiles in Microsoft Store for Business. These steps are also summarized below.
|
||||
|
||||
First, sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/manage/dashboard) using the Intune account you initially created for this lab.
|
||||
|
||||
Select **Manage** from the top menu, then select **Devices** from the left navigation tree.
|
||||
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@ -45,17 +45,17 @@ productDirectory:
|
||||
# Card
|
||||
- title: Windows 11 required diagnostic data
|
||||
# imageSrc should be square in ratio with no whitespace
|
||||
imageSrc: https://docs.microsoft.com/media/common/i_extend.svg
|
||||
imageSrc: /media/common/i_extend.svg
|
||||
summary: Learn more about basic Windows diagnostic data events and fields collected.
|
||||
url: required-windows-11-diagnostic-events-and-fields.md
|
||||
# Card
|
||||
- title: Windows 10 required diagnostic data
|
||||
imageSrc: https://docs.microsoft.com/media/common/i_build.svg
|
||||
imageSrc: /media/common/i_build.svg
|
||||
summary: See what changes Windows is making to align to the new data collection taxonomy
|
||||
url: required-windows-diagnostic-data-events-and-fields-2004.md
|
||||
# Card
|
||||
- title: Optional diagnostic data
|
||||
imageSrc: https://docs.microsoft.com/media/common/i_get-started.svg
|
||||
imageSrc: /media/common/i_get-started.svg
|
||||
summary: Get examples of the types of optional diagnostic data collected from Windows
|
||||
url: windows-diagnostic-data.md
|
||||
|
||||
|
||||
@ -69,7 +69,7 @@ If the error occurs again, check the error code against the following table to s
|
||||
| 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Azure AD and rejoin. |
|
||||
| | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. |
|
||||
| 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. |
|
||||
| 0xC00000BB | Your PIN or this option is temporarily unavailable.| The destination domain controller doesn't support the login method. Most often the KDC service doesn't have the proper certificate to support the login. Use a different login method.|
|
||||
| 0xC00000BB | Your PIN or this option is temporarily unavailable.| The destination domain controller doesn't support the login method. Most often the KDC service doesn't have the proper certificate to support the login. Use a different login method. Another common issue is caused by clients inability to verify the KDC certificate CRL|
|
||||
|
||||
|
||||
|
||||
@ -100,6 +100,7 @@ For errors listed in this table, contact Microsoft Support for assistance.
|
||||
| 0x801C03F1 | There is no UPN in the token. |
|
||||
| 0x801C044C | There is no core window for the current thread. |
|
||||
| 0x801c004D | DSREG_NO_DEFAULT_ACCOUNT: NGC provisioning is unable to find the default WAM account to use to request Azure Active Directory token for provisioning. Unable to enroll a device to use a PIN for login. |
|
||||
| 0xCAA30193 | HTTP 403 Request Forbidden: it means request left the device, however either Server, proxy or firewall generated this response. |
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -63,6 +63,11 @@ The following scenarios aren't supported using Windows Hello for Business cloud
|
||||
- Using cloud trust for "Run as"
|
||||
- Signing in with cloud trust on a Hybrid Azure AD joined device without previously signing in with DC connectivity
|
||||
|
||||
> [!NOTE]
|
||||
> The default security policy for AD does not grant permission to sign high privilege accounts on to on-premises resources with Cloud Trust or FIDO2 security keys.
|
||||
>
|
||||
> To unblock the accounts, use Active Directory Users and Computers to modify the msDS-NeverRevealGroup property of the Azure AD Kerberos Computer object (CN=AzureADKerberos,OU=Domain Controllers,\<domain-DN\>).
|
||||
|
||||
## Deployment Instructions
|
||||
|
||||
Deploying Windows Hello for Business cloud trust consists of two steps:
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
title: Microsoft Defender SmartScreen overview
|
||||
description: Learn how Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files.
|
||||
ms.prod: m365-security
|
||||
author: mjcaparas
|
||||
ms.author: macapara
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: high
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -49,7 +49,7 @@ The general steps for expanding the S mode base policy on your Intune-managed de
|
||||
- Create a new base policy using [New-CIPolicy](/powershell/module/configci/new-cipolicy?view=win10-ps&preserve-view=true)
|
||||
|
||||
```powershell
|
||||
New-CIPolicy -MultiplePolicyFormat -ScanPath <path> -UserPEs -FilePath "<path>\SupplementalPolicy.xml" -Level Publisher -Fallback Hash
|
||||
New-CIPolicy -MultiplePolicyFormat -ScanPath <path> -UserPEs -FilePath "<path>\SupplementalPolicy.xml" -Level FilePublisher -Fallback SignedVersion,Publisher,Hash
|
||||
```
|
||||
- Change it to a supplemental policy using [Set-CIPolicyIdInfo](/powershell/module/configci/set-cipolicyidinfo?view=win10-ps&preserve-view=true)
|
||||
|
||||
|
||||
@ -3,13 +3,13 @@ title: Script rules in AppLocker (Windows)
|
||||
description: This article describes the file formats and available default rules for the script rule collection.
|
||||
ms.assetid: fee24ca4-935a-4c5e-8a92-8cf1d134d35f
|
||||
ms.reviewer:
|
||||
ms.author: macapara
|
||||
ms.author: dansimp
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: mjcaparas
|
||||
author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
|
||||
@ -3,13 +3,13 @@ title: Understand AppLocker enforcement settings (Windows)
|
||||
description: This topic describes the AppLocker enforcement settings for rule collections.
|
||||
ms.assetid: 48773007-a343-40bf-8961-b3ff0a450d7e
|
||||
ms.reviewer:
|
||||
ms.author: macapara
|
||||
ms.author: dansimp
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: mjcaparas
|
||||
author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
|
||||
@ -59,7 +59,7 @@ To familiarize yourself with creating WDAC rules from audit events, follow these
|
||||
4. Use [New-CIPolicy](/powershell/module/configci/new-cipolicy) to generate a new WDAC policy from logged audit events. This example uses a **FilePublisher** file rule level and a **Hash** fallback level. Warning messages are redirected to a text file **EventsPolicyWarnings.txt**.
|
||||
|
||||
```powershell
|
||||
New-CIPolicy -FilePath $EventsPolicy -Audit -Level FilePublisher -Fallback Hash –UserPEs -MultiplePolicyFormat 3> $EventsPolicyWarnings
|
||||
New-CIPolicy -FilePath $EventsPolicy -Audit -Level FilePublisher -Fallback SignedVersion,FilePublisher,Hash –UserPEs -MultiplePolicyFormat 3> $EventsPolicyWarnings
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -126,13 +126,13 @@ Deny rules and policies can be created using the PowerShell cmdlets or the [WDAC
|
||||
### Software Publisher Based Deny Rule
|
||||
|
||||
```Powershell
|
||||
$DenyRules += New-CIPolicyRule -Level FilePublisher -DriverFilePath <binary_to_block> -Deny -Fallback FileName,Hash
|
||||
$DenyRules += New-CIPolicyRule -Level FilePublisher -DriverFilePath <binary_to_block> -Fallback SignedVersion,Publisher,Hash -Deny
|
||||
```
|
||||
|
||||
### Software Attributes Based Deny Rule
|
||||
|
||||
```Powershell
|
||||
$DenyRules += New-CIPolicyRule -Level FileName -DriverFilePath <binary_to_block> -Deny -Fallback Hash
|
||||
$DenyRules += New-CIPolicyRule -Level FileName -DriverFilePath <binary_to_block> -Fallback Hash -Deny
|
||||
```
|
||||
|
||||
### Hash Based Deny Rule
|
||||
|
||||
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.reviewer: jgeurten
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 02/28/2018
|
||||
@ -49,7 +49,9 @@ To create a catalog file, you use a tool called **Package Inspector**. You must
|
||||
|
||||
2. Start Package Inspector, and then start scanning a local drive, for example, drive C:
|
||||
|
||||
`PackageInspector.exe Start C:`
|
||||
```powershell
|
||||
PackageInspector.exe Start C:
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> Package inspector can monitor installations on any local drive. Specify the appropriate drive on the local computer.
|
||||
@ -77,13 +79,12 @@ To create a catalog file, you use a tool called **Package Inspector**. You must
|
||||
|
||||
For the last command, which stops Package Inspector, be sure to type the drive letter of the drive you have been scanning, for example, C:.
|
||||
|
||||
`$ExamplePath=$env:userprofile+"\Desktop"`
|
||||
|
||||
`$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"`
|
||||
|
||||
`$CatDefName=$ExamplePath+"\LOBApp.cdf"`
|
||||
|
||||
`PackageInspector.exe Stop C: -Name $CatFileName -cdfpath $CatDefName`
|
||||
```powershell
|
||||
$ExamplePath=$env:userprofile+"\Desktop"
|
||||
$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"
|
||||
$CatDefName=$ExamplePath+"\LOBApp.cdf"
|
||||
PackageInspector.exe Stop C: -Name $CatFileName -cdfpath $CatDefName
|
||||
```
|
||||
|
||||
>[!NOTE]
|
||||
>Package Inspector catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries' hash values.
|
||||
@ -125,15 +126,18 @@ To sign the existing catalog file, copy each of the following commands into an e
|
||||
|
||||
1. Initialize the variables that will be used. Replace the *$ExamplePath* and *$CatFileName* variables as needed:
|
||||
|
||||
`$ExamplePath=$env:userprofile+"\Desktop"`
|
||||
|
||||
`$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"`
|
||||
```powershell
|
||||
$ExamplePath=$env:userprofile+"\Desktop"
|
||||
$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"
|
||||
```
|
||||
|
||||
2. Import the code signing certificate that will be used to sign the catalog file. Import it to the signing user's personal store.
|
||||
|
||||
3. Sign the catalog file with Signtool.exe:
|
||||
|
||||
`<path to signtool.exe> sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName`
|
||||
```powershell
|
||||
<path to signtool.exe> sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName
|
||||
```
|
||||
|
||||
>[!NOTE]
|
||||
>The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* represents the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the computer on which you are attempting to sign the catalog file.
|
||||
@ -156,16 +160,20 @@ After the catalog file is signed, add the signing certificate to a WDAC policy,
|
||||
|
||||
1. If you haven't already verified the catalog file digital signature, right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with the algorithm you expect.
|
||||
|
||||
2. If you already have an XML policy file that you want to add the signing certificate to, skip to the next step. Otherwise, use [New-CIPolicy](/powershell/module/configci/new-cipolicy) to create a Windows Defender Application Control policy that you'll later merge into another policy (not deploy as-is). This example creates a policy called **CatalogSignatureOnly.xml** in the location **C:\\PolicyFolder**:
|
||||
2. If you already have an XML policy file that you want to add the signing certificate to, skip to the next step. Otherwise, use [New-CIPolicy](/powershell/module/configci/new-cipolicy) to create a Windows Defender Application Control policy that you will later merge into another policy (not deploy as-is). This example creates a policy called **CatalogSignatureOnly.xml** in the location **C:\\PolicyFolder** by scanning the system and allowlisting by signer and original filename:
|
||||
|
||||
`New-CIPolicy -Level PcaCertificate -FilePath C:\PolicyFolder\CatalogSignatureOnly.xml –UserPEs`
|
||||
```powershell
|
||||
New-CIPolicy -Level FilePublisher -FilePath C:\PolicyFolder\CatalogSignatureOnly.xml –UserPEs -MultiplePolicyFormat -Fallback SignedVersion,Publisher,Hash
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> Include the **-UserPEs** parameter to ensure that the policy includes user mode code integrity.
|
||||
|
||||
3. Use [Add-SignerRule](/powershell/module/configci/add-signerrule) to add the signing certificate to the WDAC policy, filling in the correct path and filenames for `<policypath>` and `<certpath>`:
|
||||
3. Use [Add-SignerRule](/powershell/module/configci/add-signerrule) to add the signing certificate to the WDAC policy, filling in the correct path and filenames for `<policypath>` and `<certificate_path>`:
|
||||
|
||||
`Add-SignerRule -FilePath <policypath> -CertificatePath <certpath> -User`
|
||||
```powershell
|
||||
Add-SignerRule -FilePath <policypath> -CertificatePath <certificate_path> -User
|
||||
```
|
||||
|
||||
If you used step 2 to create a new WDAC policy, and want information about merging policies together, see [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md).
|
||||
|
||||
|
||||
@ -56,19 +56,19 @@ Prior to Windows 10 1903, Windows Defender Application Control only supported a
|
||||
In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below example describes the process of creating a new policy in the multiple policy format.
|
||||
|
||||
```powershell
|
||||
New-CIPolicy -MultiplePolicyFormat -ScanPath "<path>" -UserPEs -FilePath ".\policy.xml" -Level Publisher -Fallback Hash
|
||||
New-CIPolicy -MultiplePolicyFormat -ScanPath "<path>" -UserPEs -FilePath ".\policy.xml" -Level FilePublisher -Fallback SignedVersion,Publisher,Hash
|
||||
```
|
||||
|
||||
Optionally, you can choose to make the new base policy allow for supplemental policies.
|
||||
|
||||
```powershell
|
||||
Set-RuleOption -FilePath <string> -Option 17
|
||||
Set-RuleOption -FilePath ".\policy.xml" -Option 17
|
||||
```
|
||||
|
||||
For signed base policies to allow for supplemental policies, make sure that supplemental signers are defined. Use the **Supplemental** switch in **Add-SignerRule** to provide supplemental signers.
|
||||
|
||||
```powershell
|
||||
Add-SignerRule -FilePath <string> -CertificatePath <string> [-Kernel] [-User] [-Update] [-Supplemental] [-Deny] [<CommonParameters>]
|
||||
Add-SignerRule -FilePath ".\policy.xml" -CertificatePath <certificate_path_> [-Kernel] [-User] [-Update] [-Supplemental] [-Deny]
|
||||
```
|
||||
|
||||
### Supplemental policy creation
|
||||
@ -79,12 +79,9 @@ In order to create a supplemental policy, begin by creating a new policy in the
|
||||
- "BasePolicyToSupplementPath": path to base policy file that the supplemental policy applies to
|
||||
|
||||
```powershell
|
||||
Set-CIPolicyIdInfo [-FilePath] <string> [-PolicyName <string>] [-SupplementsBasePolicyID <guid>] [-BasePolicyToSupplementPath <string>] [-ResetPolicyID] [-PolicyId <string>] [<CommonParameters>]
|
||||
Set-CIPolicyIdInfo -FilePath ".\supplemental_policy.xml" [-SupplementsBasePolicyID <BasePolicyGUID>] [-BasePolicyToSupplementPath <basepolicy_path_>] -PolicyId <policy_Id> -PolicyName <PolicyName>
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> **ResetPolicyId** reverts a supplemental policy to a base policy, and resets the policy GUIDs back to a random GUID.
|
||||
|
||||
### Merging policies
|
||||
|
||||
When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \<ID>, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy will be a base policy with ID \<ID>.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user