mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-19 20:33:42 +00:00
Merge branch 'master' into MDBranch20H1DeviceInstallationTask3514918
This commit is contained in:
ManikaDhiman
@ -17,14 +17,6 @@ ms.date: 07/25/2019
|
||||
|
||||
The AppLocker configuration service provider is used to specify which applications are allowed or disallowed. There is no user interface shown for apps that are blocked.
|
||||
|
||||
> **Note**
|
||||
> When you create a list of allowed apps, all [inbox apps](#inboxappsandcomponents) are also blocked, and you must include them in your list of allowed apps. Don't forget to add the inbox apps for Phone, Messaging, Settings, Start, Email and accounts, Work and school, and other apps that you need.
|
||||
>
|
||||
> In Windows 10 Mobile, when you create a list of allowed apps, the [settings app that rely on splash apps](#settingssplashapps) are blocked. To unblock these apps, you must include them in your list of allowed apps.
|
||||
>
|
||||
> Delete/unenrollment is not properly supported unless Grouping values are unique across enrollments. If multiple enrollments use the same Grouping value, then unenrollment will not work as expected since there are duplicate URIs that get deleted by the resource manager. To prevent this problem, the Grouping value should include some randomness. The best practice is to use a randomly generated GUID. However, there is no requirement on the exact value of the node.
|
||||
|
||||
|
||||
The following diagram shows the AppLocker configuration service provider in tree format.
|
||||
|
||||
|
||||
@ -39,6 +31,9 @@ Defines restrictions for applications.
|
||||
> When you create a list of allowed apps, all [inbox apps](#inboxappsandcomponents) are also blocked, and you must include them in your list of allowed apps. Don't forget to add the inbox apps for Phone, Messaging, Settings, Start, Email and accounts, Work and school, and other apps that you need.
|
||||
>
|
||||
> In Windows 10 Mobile, when you create a list of allowed apps, the [settings app that rely on splash apps](#settingssplashapps) are blocked. To unblock these apps, you must include them in your list of allowed apps.
|
||||
>
|
||||
> Delete/unenrollment is not properly supported unless Grouping values are unique across enrollments. If multiple enrollments use the same Grouping value, then unenrollment will not work as expected since there are duplicate URIs that get deleted by the resource manager. To prevent this problem, the Grouping value should include some randomness. The best practice is to use a randomly generated GUID. However, there is no requirement on the exact value of the node.
|
||||
|
||||
|
||||
Additional information:
|
||||
|
||||
@ -363,7 +358,8 @@ The product name is first part of the PackageFullName followed by the version nu
|
||||
|
||||
The following list shows the apps that may be included in the inbox.
|
||||
|
||||
> **Note** This list identifies system apps that ship as part of Windows that you can add to your AppLocker policy to ensure proper functioning of the operating system. If you decide to block some of these apps, we recommend a thorough testing before deploying to your production environment. Failure to do so may result in unexpected failures and can significantly degrade the user experience.
|
||||
> [!NOTE]
|
||||
> This list identifies system apps that ship as part of Windows that you can add to your AppLocker policy to ensure proper functioning of the operating system. If you decide to block some of these apps, we recommend a thorough testing before deploying to your production environment. Failure to do so may result in unexpected failures and can significantly degrade the user experience.
|
||||
|
||||
|
||||
|
||||
@ -830,7 +826,7 @@ The following list shows the apps that may be included in the inbox.
|
||||
|
||||
The following example disables the calendar application.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Add>
|
||||
@ -854,7 +850,7 @@ The following example disables the calendar application.
|
||||
|
||||
The following example blocks the usage of the map application.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Add>
|
||||
@ -1394,7 +1390,7 @@ In this example, **MobileGroup0** is the node name. We recommend using a GUID fo
|
||||
## Example for Windows 10 Holographic for Business
|
||||
The following example for Windows 10 Holographic for Business denies all apps and allows the minimum set of [inbox apps](#inboxappsandcomponents) to enable to enable a working device, as well as Settings.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<RuleCollection Type="Appx" EnforcementMode="Enabled">
|
||||
<FilePublisherRule Id="96B82A15-F841-499a-B674-963DC647762F"
|
||||
Name="Whitelist BackgroundTaskHost"
|
||||
|
||||
@ -653,7 +653,7 @@ An alert is send to the MDM server in DM package\#1.
|
||||
|
||||
Here's an example.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncBody>
|
||||
<Alert>
|
||||
<CmdID>1</CmdID>
|
||||
|
||||
@ -6,15 +6,12 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: lomayor
|
||||
ms.date: 05/02/2019
|
||||
ms.date: 08/05/2019
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
# BitLocker CSP
|
||||
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it is also supported in Windows 10 Pro.
|
||||
|
||||
> [!NOTE]
|
||||
@ -31,10 +28,10 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
|
||||
|
||||
<a href="" id="--device-vendor-msft-bitlocker"></a>**./Device/Vendor/MSFT/BitLocker**
|
||||
<p style="margin-left: 20px">Defines the root node for the BitLocker configuration service provider.</p>
|
||||
Defines the root node for the BitLocker configuration service provider.
|
||||
|
||||
<a href="" id="requirestoragecardencryption"></a>**RequireStorageCardEncryption**
|
||||
<p style="margin-left: 20px">Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU.</p>
|
||||
Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
@ -57,14 +54,14 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<p style="margin-left: 20px">Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on.</p>
|
||||
Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on.
|
||||
|
||||
- 0 (default) – Storage cards do not need to be encrypted.
|
||||
- 1 – Require Storage cards to be encrypted.
|
||||
|
||||
<p style="margin-left: 20px">Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.</p>
|
||||
Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.
|
||||
|
||||
<p style="margin-left: 20px">If you want to disable this policy use the following SyncML:</p>
|
||||
If you want to disable this policy use the following SyncML:
|
||||
|
||||
```xml
|
||||
<SyncML>
|
||||
@ -85,11 +82,11 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">Data type is integer. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
Data type is integer. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<a href="" id="requiredeviceencryption"></a>**RequireDeviceEncryption**
|
||||
|
||||
<p style="margin-left: 20px">Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption.</p>
|
||||
Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
@ -112,9 +109,26 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<p style="margin-left: 20px">Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.</p>
|
||||
Data type is integer. Sample value for this node to enable this policy: 1.
|
||||
Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<p style="margin-left: 20px">If you want to disable this policy use the following SyncML:</p>
|
||||
Status of OS volumes and encryptable fixed data volumes are checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value [EncryptionMethodByDriveType](#encryptionmethodbydrivetype) policy is set to. However, this policy setting will be ignored for self-encrypting fixed drives and self-encrypting OS drives.
|
||||
|
||||
Encryptable fixed data volumes are treated similarly to OS volumes. However, fixed data volumes must meet additional criteria to be considered encryptable:
|
||||
|
||||
- It must not be a dynamic volume.
|
||||
- It must not be a recovery partition.
|
||||
- It must not be a hidden volume.
|
||||
- It must not be a system partition.
|
||||
- It must not be backed by virtual storage.
|
||||
- It must not have a reference in the BCD store.
|
||||
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) – Disable. If the policy setting is not set or is set to 0, the device's enforcement status will not be checked. The policy will not enforce encryption and it will not decrypt encrypted volumes.
|
||||
- 1 – Enable. The device's enforcement status will be checked. Setting this policy to 1 will trigger encryption of all drives (silently or non-silently based on [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption) policy).
|
||||
|
||||
If you want to disable this policy use the following SyncML:
|
||||
|
||||
```xml
|
||||
<SyncML>
|
||||
@ -135,10 +149,9 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">Data type is integer. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
<a href="" id="encryptionmethodbydrivetype"></a>**EncryptionMethodByDriveType**
|
||||
|
||||
<a href="" id="encryptionmethodbydrivetype"></a>**EncryptionMethodByDriveType**
|
||||
<p style="margin-left: 20px">Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". </p>
|
||||
Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
@ -159,7 +172,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
ADMX Info:
|
||||
<ul>
|
||||
<li>GP English name: <em>Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)</em></li>
|
||||
<li>GP name: <em>EncryptionMethodWithXts_Name</em></li>
|
||||
@ -170,23 +183,23 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!TIP]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress.</p>
|
||||
This setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress.
|
||||
|
||||
<p style="margin-left: 20px">If you enable this setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10, version 1511.</p>
|
||||
If you enable this setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10, version 1511.
|
||||
|
||||
<p style="margin-left: 20px">If you disable or do not configure this policy setting, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by any setup script.</p>
|
||||
If you disable or do not configure this policy setting, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by any setup script.
|
||||
|
||||
<p style="margin-left: 20px"> Sample value for this node to enable this policy and set the encryption methods is:</p>
|
||||
Sample value for this node to enable this policy and set the encryption methods is:
|
||||
|
||||
```xml
|
||||
<enabled/><data id="EncryptionMethodWithXtsOsDropDown_Name" value="xx"/><data id="EncryptionMethodWithXtsFdvDropDown_Name" value="xx"/><data id="EncryptionMethodWithXtsRdvDropDown_Name" value="xx"/>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operating system drives</p>
|
||||
<p style="margin-left: 20px">EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives.</p>
|
||||
<p style="margin-left: 20px">EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for removable data drives.</p>
|
||||
EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operating system drives
|
||||
EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives.
|
||||
EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for removable data drives.
|
||||
|
||||
<p style="margin-left: 20px"> The possible values for 'xx' are:</p>
|
||||
The possible values for 'xx' are:
|
||||
|
||||
- 3 = AES-CBC 128
|
||||
- 4 = AES-CBC 256
|
||||
@ -196,7 +209,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!NOTE]
|
||||
> When you enable EncryptionMethodByDriveType, you must specify values for all three drives (operating system, fixed data, and removable data), otherwise it will fail (500 return status). For example, if you only set the encrytion method for the OS and removable drives, you will get a 500 return status.
|
||||
|
||||
<p style="margin-left: 20px"> If you want to disable this policy use the following SyncML:</p>
|
||||
If you want to disable this policy use the following SyncML:
|
||||
|
||||
```xml
|
||||
<Replace>
|
||||
@ -213,10 +226,10 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</Replace>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">Data type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
Data type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<a href="" id="systemdrivesrequirestartupauthentication"></a>**SystemDrivesRequireStartupAuthentication**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup".</p>
|
||||
This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup".
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
@ -237,7 +250,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
ADMX Info:
|
||||
<ul>
|
||||
<li>GP English name: <em>Require additional authentication at startup</em></li>
|
||||
<li>GP name: <em>ConfigureAdvancedStartup_Name</em></li>
|
||||
@ -248,31 +261,31 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!TIP]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This setting is applied when you turn on BitLocker.</p>
|
||||
This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This setting is applied when you turn on BitLocker.
|
||||
|
||||
> [!NOTE]
|
||||
> Only one of the additional authentication options can be required at startup, otherwise an error occurs.
|
||||
|
||||
<p style="margin-left: 20px">If you want to use BitLocker on a computer without a TPM, set the "ConfigureNonTPMStartupKeyUsage_Name" data. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive.</p>
|
||||
If you want to use BitLocker on a computer without a TPM, set the "ConfigureNonTPMStartupKeyUsage_Name" data. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive.
|
||||
|
||||
<p style="margin-left: 20px">On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both.</p>
|
||||
On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both.
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1703 release B, you can use a minimum PIN of 4 digits. SystemDrivesMinimumPINLength policy must be set to allow PINs shorter than 6 digits.
|
||||
|
||||
<p style="margin-left: 20px">If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard.</p>
|
||||
If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard.
|
||||
|
||||
<p style="margin-left: 20px">If you disable or do not configure this setting, users can configure only basic options on computers with a TPM.</p>
|
||||
If you disable or do not configure this setting, users can configure only basic options on computers with a TPM.
|
||||
|
||||
> [!NOTE]
|
||||
> If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard.
|
||||
|
||||
<p style="margin-left: 20px">Sample value for this node to enable this policy is:</p>
|
||||
Sample value for this node to enable this policy is:
|
||||
|
||||
```xml
|
||||
<enabled/><data id="ConfigureNonTPMStartupKeyUsage_Name" value="xx"/><data id="ConfigureTPMStartupKeyUsageDropDown_Name" value="yy"/><data id="ConfigurePINUsageDropDown_Name" value="yy"/><data id="ConfigureTPMPINKeyUsageDropDown_Name" value="yy"/><data id="ConfigureTPMUsageDropDown_Name" value="yy"/>
|
||||
```
|
||||
<p style="margin-left: 20px">Data id:</p>
|
||||
Data id:
|
||||
<ul>
|
||||
<li>ConfigureNonTPMStartupKeyUsage_Name = Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive).</li>
|
||||
<li>ConfigureTPMStartupKeyUsageDropDown_Name = (for computer with TPM) Configure TPM startup key.</li>
|
||||
@ -281,20 +294,20 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<li>ConfigureTPMUsageDropDown_Name = (for computer with TPM) Configure TPM startup.</li>
|
||||
</ul>
|
||||
|
||||
<p style="margin-left: 20px">The possible values for 'xx' are:</p>
|
||||
The possible values for 'xx' are:
|
||||
<ul>
|
||||
<li>true = Explicitly allow</li>
|
||||
<li>false = Policy not set</li>
|
||||
</ul>
|
||||
|
||||
<p style="margin-left: 20px">The possible values for 'yy' are:</p>
|
||||
The possible values for 'yy' are:
|
||||
<ul>
|
||||
<li>2 = Optional</li>
|
||||
<li>1 = Required</li>
|
||||
<li>0 = Disallowed</li>
|
||||
</ul>
|
||||
|
||||
<p style="margin-left: 20px">Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:</p>
|
||||
Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:
|
||||
|
||||
```xml
|
||||
<Replace>
|
||||
@ -310,10 +323,10 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</Item>
|
||||
</Replace>
|
||||
```
|
||||
<p style="margin-left: 20px">Data type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
Data type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<a href="" id="systemdrivesminimumpinlength"></a>**SystemDrivesMinimumPINLength**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup".</p>
|
||||
This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup".
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
@ -334,7 +347,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
ADMX Info:
|
||||
<ul>
|
||||
<li>GP English name:<em>Configure minimum PIN length for startup</em></li>
|
||||
<li>GP name: <em>MinimumPINLength_Name</em></li>
|
||||
@ -345,24 +358,24 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!TIP]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits.</p>
|
||||
This setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits.
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1703 release B, you can use a minimum PIN length of 4 digits.
|
||||
>
|
||||
>In TPM 2.0 if minimum PIN length is set below 6 digits, Windows will attempt to update the TPM lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset. This does not apply to TPM 1.2.
|
||||
|
||||
<p style="margin-left: 20px">If you enable this setting, you can require a minimum number of digits to be used when setting the startup PIN.</p>
|
||||
If you enable this setting, you can require a minimum number of digits to be used when setting the startup PIN.
|
||||
|
||||
<p style="margin-left: 20px">If you disable or do not configure this setting, users can configure a startup PIN of any length between 6 and 20 digits.</p>
|
||||
If you disable or do not configure this setting, users can configure a startup PIN of any length between 6 and 20 digits.
|
||||
|
||||
<p style="margin-left: 20px">Sample value for this node to enable this policy is:</p>
|
||||
Sample value for this node to enable this policy is:
|
||||
|
||||
```xml
|
||||
<enabled/><data id="MinPINLength" value="xx"/>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:</p>
|
||||
Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:
|
||||
|
||||
```xml
|
||||
<Replace>
|
||||
@ -379,10 +392,10 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</Replace>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">Data type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
Data type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<a href="" id="systemdrivesrecoverymessage"></a>**SystemDrivesRecoveryMessage**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" (PrebootRecoveryInfo_Name).</p>
|
||||
This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" (PrebootRecoveryInfo_Name).
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
@ -403,7 +416,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
ADMX Info:
|
||||
<ul>
|
||||
<li>GP English name: <em>Configure pre-boot recovery message and URL</em></li>
|
||||
<li>GP name: <em>PrebootRecoveryInfo_Name</em></li>
|
||||
@ -414,21 +427,21 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!TIP]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked.
|
||||
</p>
|
||||
This setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked.
|
||||
|
||||
<p style="margin-left: 20px">If you set the value to "1" (Use default recovery message and URL), the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and set the value "1" (Use default recovery message and URL).</o>
|
||||
|
||||
<p style="margin-left: 20px">If you set the value to "2" (Use custom recovery message), the message you set in the "RecoveryMessage_Input" data field will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message.</p>
|
||||
If you set the value to "1" (Use default recovery message and URL), the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and set the value "1" (Use default recovery message and URL).</o>
|
||||
|
||||
<p style="margin-left: 20px">If you set the value to "3" (Use custom recovery URL), the URL you type in the "RecoveryUrl_Input" data field will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen.</p>
|
||||
If you set the value to "2" (Use custom recovery message), the message you set in the "RecoveryMessage_Input" data field will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message.
|
||||
|
||||
<p style="margin-left: 20px">Sample value for this node to enable this policy is:</p>
|
||||
If you set the value to "3" (Use custom recovery URL), the URL you type in the "RecoveryUrl_Input" data field will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen.
|
||||
|
||||
Sample value for this node to enable this policy is:
|
||||
|
||||
```xml
|
||||
<enabled/><data id="PrebootRecoveryInfoDropDown_Name" value="xx"/><data id="RecoveryMessage_Input" value="yy"/><data id="RecoveryUrl_Input" value="zz"/>
|
||||
```
|
||||
<p style="margin-left: 20px">The possible values for 'xx' are:</p>
|
||||
The possible values for 'xx' are:
|
||||
|
||||
- 0 = Empty
|
||||
- 1 = Use default recovery message and URL (in this case you don't need to specify a value for "RecoveryMessage_Input" or "RecoveryUrl_Input").
|
||||
@ -440,7 +453,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!NOTE]
|
||||
> When you enable SystemDrivesRecoveryMessage, you must specify values for all three settings (pre-boot recovery screen, recovery message, and recovery URL), otherwise it will fail (500 return status). For example, if you only specify values for message and URL, you will get a 500 return status.
|
||||
|
||||
<p style="margin-left: 20px">Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:</p>
|
||||
Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:
|
||||
|
||||
```xml
|
||||
<Replace>
|
||||
@ -460,10 +473,10 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!NOTE]
|
||||
> Not all characters and languages are supported in pre-boot. It is strongly recommended that you test that the characters you use for the custom message or URL appear correctly on the pre-boot recovery screen.
|
||||
|
||||
<p style="margin-left: 20px">Data type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
Data type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<a href="" id="systemdrivesrecoveryoptions"></a>**SystemDrivesRecoveryOptions**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name).</p>
|
||||
This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name).
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
@ -484,7 +497,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
ADMX Info:
|
||||
<ul>
|
||||
<li>GP English name: <em>Choose how BitLocker-protected operating system drives can be recovered</em></li>
|
||||
<li>GP name: <em>OSRecoveryUsage_Name</em></li>
|
||||
@ -495,52 +508,52 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!TIP]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This setting is applied when you turn on BitLocker.</p>
|
||||
This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This setting is applied when you turn on BitLocker.
|
||||
|
||||
<p style="margin-left: 20px">The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.</p>
|
||||
The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.
|
||||
|
||||
<p style="margin-left: 20px">In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.</p>
|
||||
In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.
|
||||
|
||||
<p style="margin-left: 20px">Set "OSHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.</p>
|
||||
Set "OSHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.
|
||||
|
||||
<p style="margin-left: 20px">Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services), to choose which BitLocker recovery information to store in AD DS for operating system drives (OSActiveDirectoryBackupDropDown_Name). If you set "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you set "2" (Backup recovery password only), only the recovery password is stored in AD DS.</p>
|
||||
Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services), to choose which BitLocker recovery information to store in AD DS for operating system drives (OSActiveDirectoryBackupDropDown_Name). If you set "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you set "2" (Backup recovery password only), only the recovery password is stored in AD DS.
|
||||
|
||||
<p style="margin-left: 20px">Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.</p>
|
||||
Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.
|
||||
|
||||
> [!Note]<br/>> If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated.
|
||||
|
||||
<p style="margin-left: 20px">If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives.</p>
|
||||
If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives.
|
||||
|
||||
<p style="margin-left: 20px">If this setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.</p>
|
||||
If this setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.
|
||||
|
||||
<p style="margin-left: 20px">Sample value for this node to enable this policy is:</p>
|
||||
Sample value for this node to enable this policy is:
|
||||
|
||||
```xml
|
||||
<enabled/><data id="OSAllowDRA_Name" value="xx"/><data id="OSRecoveryPasswordUsageDropDown_Name" value="yy"/><data id="OSRecoveryKeyUsageDropDown_Name" value="yy"/><data id="OSHideRecoveryPage_Name" value="xx"/><data id="OSActiveDirectoryBackup_Name" value="xx"/><data id="OSActiveDirectoryBackupDropDown_Name" value="zz"/><data id="OSRequireActiveDirectoryBackup_Name" value="xx"/>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">The possible values for 'xx' are:</p>
|
||||
The possible values for 'xx' are:
|
||||
<ul>
|
||||
<li>true = Explicitly allow</li>
|
||||
<li>false = Policy not set</li>
|
||||
<li></li>
|
||||
</ul>
|
||||
|
||||
<p style="margin-left: 20px">The possible values for 'yy' are:</p>
|
||||
The possible values for 'yy' are:
|
||||
<ul>
|
||||
<li>2 = Allowed</li>
|
||||
<li>1 = Required</li>
|
||||
<li>0 = Disallowed</li>
|
||||
</ul>
|
||||
|
||||
<p style="margin-left: 20px">The possible values for 'zz' are:</p>
|
||||
The possible values for 'zz' are:
|
||||
<ul>
|
||||
<li>2 = Store recovery passwords only</li>
|
||||
<li>1 = Store recovery passwords and key packages</li>
|
||||
<li></li>
|
||||
</ul>
|
||||
|
||||
<p style="margin-left: 20px">Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:</p>
|
||||
Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:
|
||||
|
||||
```xml
|
||||
<Replace>
|
||||
@ -557,10 +570,10 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</Replace>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">Data type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
Data type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<a href="" id="fixeddrivesrecoveryoptions"></a>**FixedDrivesRecoveryOptions**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" ().</p>
|
||||
This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" ().
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
@ -581,7 +594,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
ADMX Info:
|
||||
<ul>
|
||||
<li>GP English name: <em>Choose how BitLocker-protected fixed drives can be recovered</em></li>
|
||||
<li>GP name: <em>FDVRecoveryUsage_Name</em></li>
|
||||
@ -592,39 +605,39 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!TIP]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker.</p>
|
||||
This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker.
|
||||
|
||||
<p style="margin-left: 20px">The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.</p>
|
||||
The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.
|
||||
|
||||
<p style="margin-left: 20px">In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.</p>
|
||||
In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.
|
||||
|
||||
<p style="margin-left: 20px">Set "FDVHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.</p>
|
||||
Set "FDVHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.
|
||||
|
||||
<p style="margin-left: 20px">Set "FDVActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services) to enable saving the recovery key to AD.</p>
|
||||
Set "FDVActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services) to enable saving the recovery key to AD.
|
||||
|
||||
<p style="margin-left: 20px">Set the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.</p>
|
||||
Set the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.
|
||||
|
||||
<p style="margin-left: 20px">Set the "FDVActiveDirectoryBackupDropDown_Name" (Configure storage of BitLocker recovery information to AD DS) to choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "2" (Backup recovery password only) only the recovery password is stored in AD DS.</p>
|
||||
Set the "FDVActiveDirectoryBackupDropDown_Name" (Configure storage of BitLocker recovery information to AD DS) to choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "2" (Backup recovery password only) only the recovery password is stored in AD DS.
|
||||
|
||||
> [!Note]<br/>> If the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field is set, a recovery password is automatically generated.
|
||||
|
||||
<p style="margin-left: 20px">If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives.</p>
|
||||
If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives.
|
||||
|
||||
<p style="margin-left: 20px">If this setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.</p>
|
||||
If this setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.
|
||||
|
||||
<p style="margin-left: 20px">Sample value for this node to enable this policy is:</p>
|
||||
Sample value for this node to enable this policy is:
|
||||
|
||||
```xml
|
||||
<enabled/><data id="FDVAllowDRA_Name" value="xx"/><data id="FDVRecoveryPasswordUsageDropDown_Name" value="yy"/><data id="FDVRecoveryKeyUsageDropDown_Name" value="yy"/><data id="FDVHideRecoveryPage_Name" value="xx"/><data id="FDVActiveDirectoryBackup_Name" value="xx"/><data id="FDVActiveDirectoryBackupDropDown_Name" value="zz"/><data id="FDVRequireActiveDirectoryBackup_Name" value="xx"/>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">The possible values for 'xx' are:</p>
|
||||
The possible values for 'xx' are:
|
||||
<ul>
|
||||
<li>true = Explicitly allow</li>
|
||||
<li>false = Policy not set</li>
|
||||
</ul>
|
||||
|
||||
<p style="margin-left: 20px">The possible values for 'yy' are:</p>
|
||||
The possible values for 'yy' are:
|
||||
<ul>
|
||||
<li>2 = Allowed</li>
|
||||
<li>1 = Required</li>
|
||||
@ -632,13 +645,13 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
|
||||
</ul>
|
||||
|
||||
<p style="margin-left: 20px">The possible values for 'zz' are:</p>
|
||||
The possible values for 'zz' are:
|
||||
<ul>
|
||||
<li>2 = Store recovery passwords only</li>
|
||||
<li>1 = Store recovery passwords and key packages</li>
|
||||
</ul>
|
||||
|
||||
<p style="margin-left: 20px">Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:</p>
|
||||
Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:
|
||||
|
||||
```xml
|
||||
<Replace>
|
||||
@ -655,10 +668,10 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</Replace>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">Data type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
Data type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<a href="" id="fixeddrivesrequireencryption"></a>**FixedDrivesRequireEncryption**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name).</p>
|
||||
This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name).
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
@ -679,7 +692,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
ADMX Info:
|
||||
<ul>
|
||||
<li>GP English name: <em>Deny write access to fixed drives not protected by BitLocker</em></li>
|
||||
<li>GP name: <em>FDVDenyWriteAccess_Name</em></li>
|
||||
@ -690,17 +703,17 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!TIP]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer.</p>
|
||||
This setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer.
|
||||
|
||||
<p style="margin-left: 20px">If you enable this setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.</p>
|
||||
If you enable this setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.
|
||||
|
||||
<p style="margin-left: 20px">Sample value for this node to enable this policy is:</p>
|
||||
Sample value for this node to enable this policy is:
|
||||
|
||||
```xml
|
||||
<enabled/>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">If you disable or do not configure this setting, all fixed data drives on the computer will be mounted with read and write access. If you want to disable this policy use the following SyncML:</p>
|
||||
If you disable or do not configure this setting, all fixed data drives on the computer will be mounted with read and write access. If you want to disable this policy use the following SyncML:
|
||||
|
||||
```xml
|
||||
<Replace>
|
||||
@ -717,10 +730,10 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</Replace>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">Data type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
Data type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<a href="" id="removabledrivesrequireencryption"></a>**RemovableDrivesRequireEncryption**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name).</p>
|
||||
This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name).
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
@ -741,7 +754,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
ADMX Info:
|
||||
<ul>
|
||||
<li>GP English name: <em>Deny write access to removable drives not protected by BitLocker</em></li>
|
||||
<li>GP name: <em>RDVDenyWriteAccess_Name</em></li>
|
||||
@ -752,29 +765,29 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
> [!TIP]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive.</p>
|
||||
This setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive.
|
||||
|
||||
<p style="margin-left: 20px">If you enable this setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.</p>
|
||||
If you enable this setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.
|
||||
|
||||
<p style="margin-left: 20px">If the "RDVCrossOrg" (Deny write access to devices configured in another organization) option is set, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" group policy setting.</p>
|
||||
If the "RDVCrossOrg" (Deny write access to devices configured in another organization) option is set, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" group policy setting.
|
||||
|
||||
<p style="margin-left: 20px">If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access.</p>
|
||||
If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access.
|
||||
|
||||
> [!Note]<br/>> This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored.
|
||||
|
||||
<p style="margin-left: 20px">Sample value for this node to enable this policy is:</p>
|
||||
Sample value for this node to enable this policy is:
|
||||
|
||||
```xml
|
||||
<enabled/><data id="RDVCrossOrg" value="xx"/>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">The possible values for 'xx' are:</p>
|
||||
The possible values for 'xx' are:
|
||||
<ul>
|
||||
<li>true = Explicitly allow</li>
|
||||
<li>false = Policy not set</li>
|
||||
</ul>
|
||||
|
||||
<p style="margin-left: 20px">Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:</p>
|
||||
Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:
|
||||
|
||||
```xml
|
||||
<Replace>
|
||||
@ -793,7 +806,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
|
||||
<a href="" id="allowwarningforotherdiskencryption"></a>**AllowWarningForOtherDiskEncryption**
|
||||
|
||||
<p style="margin-left: 20px">Allows the admin to disable the warning prompt for other disk encryption on the user machines that are targeted when the RequireDeviceEncryption policy is also set to 1.</p>
|
||||
Allows the admin to disable the warning prompt for other disk encryption on the user machines that are targeted when the RequireDeviceEncryption policy is also set to 1.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Starting in Windows 10, version 1803, the value 0 can only be set for Azure Active Directory joined devices. When RequireDeviceEncryption is set to 1 and AllowWarningForOtherDiskEncryption is set to 0, Windows will attempt to silently enable [BitLocker](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-overview).
|
||||
@ -822,7 +835,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<p style="margin-left: 20px">The following list shows the supported values:</p>
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 – Disables the warning prompt. Starting in Windows 10, version 1803, the value 0 can only be set for Azure Active Directory joined devices. Windows will attempt to silently enable BitLocker for value 0.
|
||||
- 1 (default) – Warning prompt allowed.
|
||||
|
||||
@ -372,7 +372,7 @@ Data type is string.
|
||||
|
||||
Enroll a client certificate through SCEP.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Atomic>
|
||||
@ -571,7 +571,7 @@ Enroll a client certificate through SCEP.
|
||||
|
||||
Add a PFX certificate. The PFX certificate password is encrypted with a custom certificate fro "My" store.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML>
|
||||
<SyncBody>
|
||||
<Delete>
|
||||
|
||||
@ -90,7 +90,7 @@ Specifies the username used to connect to the proxy.
|
||||
|
||||
To delete both a proxy and its associated connection, you must delete the proxy first, and then delete the connection. The following example shows how to delete the proxy and then the connection.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<wap-provisioningdoc>
|
||||
<characteristic type="CM_ProxyEntries">
|
||||
<nocharacteristic type="GPRS_Proxy"/>
|
||||
|
||||
@ -215,7 +215,7 @@ Supported product status values:
|
||||
|
||||
Example:
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.1">
|
||||
<SyncBody>
|
||||
<Get>
|
||||
@ -224,7 +224,7 @@ Example:
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/Defender/Health/ProductStatus</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Item>
|
||||
</Get>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
|
||||
@ -73,7 +73,7 @@ When the PC is already enrolled in MDM, you can remotely collect logs from the P
|
||||
|
||||
Example: Enable the Debug channel logging
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Replace>
|
||||
|
||||
@ -262,7 +262,7 @@ Stores specifies which certificate stores the DM client will search to find the
|
||||
|
||||
Subject specifies the certificate to search for. For example, to specify that you want a certificate with a particular Subject attribute (“CN=Tester,O=Microsoft”), use the following:
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<parm name="SSLCLIENTCERTSEARCHCRITERIA"
|
||||
value="Subject=CN%3DTester,O%3DMicrosoft&Stores=My%5CUser" />
|
||||
```
|
||||
|
||||
@ -56,7 +56,7 @@ Here is an easy way to get the EAP configuration from your desktop using the ras
|
||||
|
||||
9. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML.
|
||||
|
||||
``` syntax
|
||||
```powershell
|
||||
Get-VpnConnection -Name Test
|
||||
```
|
||||
|
||||
@ -80,17 +80,17 @@ Here is an easy way to get the EAP configuration from your desktop using the ras
|
||||
IdleDisconnectSeconds : 0
|
||||
```
|
||||
|
||||
``` syntax
|
||||
```powershell
|
||||
$a = Get-VpnConnection -Name Test
|
||||
```
|
||||
|
||||
``` syntax
|
||||
```powershell
|
||||
$a.EapConfigXmlStream.InnerXml
|
||||
```
|
||||
|
||||
Here is an example output
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://www.microsoft.co
|
||||
m/provisioning/EapCommon">13</Type><VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorTy
|
||||
pe xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://www.microsoft.com/provisi
|
||||
@ -158,7 +158,7 @@ The following XML sample explains the properties for the EAP TLS XML including c
|
||||
|
||||
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
|
||||
<EapMethod>
|
||||
<Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type>
|
||||
|
||||
@ -314,16 +314,16 @@ For DHA-OnPrem & DHA-EMC scenarios, send a SyncML command to the HASEndpoint nod
|
||||
|
||||
The following example shows a sample call that instructs a managed device to communicate with an enterprise managed DHA-Service.
|
||||
|
||||
``` syntax
|
||||
<Replace>
|
||||
<CmdID>1</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/HASEndpoint</LocURI>
|
||||
</Target>
|
||||
<Data> www.ContosoDHA-Service</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
```xml
|
||||
<Replace>
|
||||
<CmdID>1</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/HASEndpoint</LocURI>
|
||||
</Target>
|
||||
<Data> www.ContosoDHA-Service</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
```
|
||||
|
||||
|
||||
@ -334,24 +334,24 @@ Send a SyncML call to start collection of the DHA-Data.
|
||||
|
||||
The following example shows a sample call that triggers collection and verification of health attestation data from a managed device.
|
||||
|
||||
``` syntax
|
||||
<Exec>
|
||||
<CmdID>1</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/VerifyHealth</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Exec>
|
||||
```xml
|
||||
<Exec>
|
||||
<CmdID>1</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/VerifyHealth</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Exec>
|
||||
|
||||
<Get>
|
||||
<CmdID>2</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/Status</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Get>
|
||||
<CmdID>2</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/Status</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
```
|
||||
|
||||
## <a href="" id="take-action-client-response"></a>**Step 4: Take action based on the clients response**
|
||||
@ -364,21 +364,21 @@ After the client receives the health attestation request, it sends a response. T
|
||||
|
||||
Here is a sample alert that is issued by DHA_CSP:
|
||||
|
||||
``` syntax
|
||||
<Alert>
|
||||
<CmdID>1</CmdID>
|
||||
<Data>1226</Data>
|
||||
<Item>
|
||||
<Source>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/VerifyHealth</LocURI>
|
||||
</Source>
|
||||
<Meta>
|
||||
<Type xmlns="syncml:metinf">com.microsoft.mdm:HealthAttestation.Result</Type>
|
||||
<Format xmlns="syncml:metinf">int</Format>
|
||||
</Meta>
|
||||
<Data>3</Data>
|
||||
</Item>
|
||||
</Alert>
|
||||
```xml
|
||||
<Alert>
|
||||
<CmdID>1</CmdID>
|
||||
<Data>1226</Data>
|
||||
<Item>
|
||||
<Source>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/VerifyHealth</LocURI>
|
||||
</Source>
|
||||
<Meta>
|
||||
<Type xmlns="syncml:metinf">com.microsoft.mdm:HealthAttestation.Result</Type>
|
||||
<Format xmlns="syncml:metinf">int</Format>
|
||||
</Meta>
|
||||
<Data>3</Data>
|
||||
</Item>
|
||||
</Alert>
|
||||
```
|
||||
- If the response to the status node is not 0, 1 or 3, then troubleshoot the issue. For the complete list of status codes see [Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes).
|
||||
|
||||
@ -389,35 +389,34 @@ Create a call to the **Nonce**, **Certificate** and **CorrelationId** nodes, and
|
||||
|
||||
Here is an example:
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Replace>
|
||||
<CmdID>1</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/Nonce</LocURI>
|
||||
</Target>
|
||||
<Data>AAAAAAAAAFFFFFFF</Data>
|
||||
</Item>
|
||||
<CmdID>1</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/Nonce</LocURI>
|
||||
</Target>
|
||||
<Data>AAAAAAAAAFFFFFFF</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
|
||||
<Get>
|
||||
<CmdID>2</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/Certificate</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
|
||||
<Get>
|
||||
<CmdID>3</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/CorrelationId </LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Get>
|
||||
<CmdID>2</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/Certificate</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
|
||||
<Get>
|
||||
<CmdID>3</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/HealthAttestation/CorrelationId </LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
```
|
||||
|
||||
## <a href="" id="forward-data-to-has"></a>**Step 6: Forward device health attestation data to DHA-service**
|
||||
@ -1019,8 +1018,8 @@ Each of these are described in further detail in the following sections, along w
|
||||
## DHA-Report V3 schema
|
||||
|
||||
|
||||
``` syntax
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
||||
xmlns="http://schemas.microsoft.com/windows/security/healthcertificate/validation/response/v3"
|
||||
targetNamespace="http://schemas.microsoft.com/windows/security/healthcertificate/validation/response/v3"
|
||||
|
||||
@ -49,9 +49,9 @@ The following diagram shows the NetworkQoSPolicy configuration service provider
|
||||
|
||||
<p style="margin-left: 20px">Valid values are:
|
||||
|
||||
- 0 (default) - Both TCP and UDP
|
||||
- 1 - TCP
|
||||
- 2 - UDP
|
||||
- 0 (default) - Both TCP and UDP
|
||||
- 1 - TCP
|
||||
- 2 - UDP
|
||||
|
||||
<p style="margin-left: 20px">The data type is int.
|
||||
|
||||
|
||||
@ -478,11 +478,11 @@ An XML blob that specifies the application restrictions company want to put to t
|
||||
>
|
||||
> Here's additional guidance for the upgrade process:
|
||||
>
|
||||
> - Use Windows 10 product IDs for the apps listed in [inbox apps](applocker-csp.md#inboxappsandcomponents).
|
||||
> - Use the new Microsoft publisher name (PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US") and Publisher="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" if you are using the publisher policy. Do not remove the Windows Phone 8.1 publisher if you are using it.
|
||||
> - In the SyncML, you must use lowercase product ID.
|
||||
> - Do not duplicate a product ID. Messaging and Skype Video use the same product ID. Duplicates cause an error.
|
||||
> - You cannot disable or enable **Contact Support** and **Windows Feedback** apps using ApplicationManagement/ApplicationRestrictions policy, although these are listed in the [inbox apps](applocker-csp.md#inboxappsandcomponents).
|
||||
> - Use Windows 10 product IDs for the apps listed in [inbox apps](applocker-csp.md#inboxappsandcomponents).
|
||||
> - Use the new Microsoft publisher name (PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US") and Publisher="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" if you are using the publisher policy. Do not remove the Windows Phone 8.1 publisher if you are using it.
|
||||
> - In the SyncML, you must use lowercase product ID.
|
||||
> - Do not duplicate a product ID. Messaging and Skype Video use the same product ID. Duplicates cause an error.
|
||||
> - You cannot disable or enable **Contact Support** and **Windows Feedback** apps using ApplicationManagement/ApplicationRestrictions policy, although these are listed in the [inbox apps](applocker-csp.md#inboxappsandcomponents).
|
||||
|
||||
|
||||
An application that is running may not be immediately terminated.
|
||||
|
||||
@ -1821,7 +1821,7 @@ ADMX Info:
|
||||
> [!NOTE]
|
||||
> This policy is only enforced in Windows 10 for desktop.
|
||||
|
||||
Added in Windows 10, version 1709. This policy allows you to turn network protection on (block/audit) or off in Windows Defender Exploit Guard. Network protection is a feature of Windows Defender Exploit Guard that protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer.
|
||||
Added in Windows 10, version 1709. This policy allows you to turn network protection on (block/audit) or off. Network protection protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer.
|
||||
|
||||
If you enable this setting, network protection is turned on and employees can't turn it off. Its behavior can be controlled by the following options: Block and Audit.
|
||||
If you enable this policy with the ""Block"" option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center.
|
||||
@ -2815,4 +2815,3 @@ Footnote:
|
||||
- [Defender/SubmitSamplesConsent](#defender-submitsamplesconsent)
|
||||
- [Defender/ThreatSeverityDefaultAction](#defender-threatseveritydefaultaction)
|
||||
<!--EndSurfaceHub-->
|
||||
|
||||
|
||||
@ -65,7 +65,7 @@ manager: dansimp
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits with Windows Defender Exploit Guard](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml).
|
||||
Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/exploit-protection) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml).
|
||||
|
||||
The system settings require a reboot; the application settings do not require a reboot.
|
||||
|
||||
|
||||
@ -70,8 +70,8 @@ manager: dansimp
|
||||
This setting determines whether non-administrators can use Task Manager to end tasks.
|
||||
|
||||
Value type is integer. Supported values:
|
||||
- 0 - Disabled. EndTask functionality is blocked in TaskManager.
|
||||
- 1 - Enabled (default). Users can perform EndTask in TaskManager.
|
||||
- 0 - Disabled. EndTask functionality is blocked in TaskManager.
|
||||
- 1 - Enabled (default). Users can perform EndTask in TaskManager.
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 05/21/2019
|
||||
ms.date: 08/16/2019
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -1072,7 +1072,7 @@ The following list shows the supported values:
|
||||
- 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709)
|
||||
- 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709)
|
||||
- 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted).
|
||||
- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903)
|
||||
- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the Semi-annual Channel and Semi-annual Channel (Targeted) into a single Semi-annual Channel with a value of 16)
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
@ -2418,13 +2418,11 @@ The following list shows the supported values:
|
||||
<!--Validation-->
|
||||
To validate this policy:
|
||||
|
||||
1. Enable the policy ensure the device is on a cellular network.
|
||||
1. Enable the policy and ensure the device is on a cellular network.
|
||||
2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell:
|
||||
- `regd delete HKEY_USERS\S-1-5-21-2702878673-795188819-444038987-2781\software\microsoft\windows\currentversion\windowsupdate /v LastAutoAppUpdateSearchSuccessTime /f`
|
||||
|
||||
- `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\Automatic App Update"""" /I""`
|
||||
|
||||
3. Verify that any downloads that are above the download size limit will complete without being paused.
|
||||
```TShell
|
||||
exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I'
|
||||
```
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
@ -2472,11 +2470,6 @@ Added in Windows 10, version 1703. Specifies whether to ignore the MO download
|
||||
> [!WARNING]
|
||||
> Setting this policy might cause devices to incur costs from MO operators.
|
||||
|
||||
|
||||
- `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\AUScheduledInstall"""" /I""`
|
||||
|
||||
3. Verify that any downloads that are above the download size limit will complete without being paused.
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
@ -2489,7 +2482,10 @@ The following list shows the supported values:
|
||||
To validate this policy:
|
||||
|
||||
1. Enable the policy and ensure the device is on a cellular network.
|
||||
2. Run the scheduled task on phone to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell:
|
||||
2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell:
|
||||
```TShell
|
||||
exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I'
|
||||
```
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
@ -3874,20 +3870,20 @@ The following list shows the supported values:
|
||||
<!--Example-->
|
||||
Example
|
||||
|
||||
``` syntax
|
||||
<Replace>
|
||||
<CmdID>$CmdID$</CmdID>
|
||||
<Item>
|
||||
<Meta>
|
||||
<Format>chr</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl</LocURI>
|
||||
</Target>
|
||||
<Data>http://abcd-srv:8530</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
```xml
|
||||
<Replace>
|
||||
<CmdID>$CmdID$</CmdID>
|
||||
<Item>
|
||||
<Meta>
|
||||
<Format>chr</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl</LocURI>
|
||||
</Target>
|
||||
<Data>http://abcd-srv:8530</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
```
|
||||
|
||||
<!--/Example-->
|
||||
|
||||
@ -117,7 +117,7 @@ A Get operation on this node must follow an Exec operation on the /RemoteLock/Lo
|
||||
|
||||
Initiate a remote lock of the device.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Exec>
|
||||
<CmdID>1</CmdID>
|
||||
<Item>
|
||||
@ -130,7 +130,7 @@ Initiate a remote lock of the device.
|
||||
|
||||
Initiate a remote lock and PIN reset of the device. To successfully retrieve the new device-generated PIN, the commands must be executed together and in the proper sequence as shown below.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Sequence>
|
||||
<CmdID>1</CmdID>
|
||||
<Exec>
|
||||
|
||||
@ -31,14 +31,14 @@ The supported operation is Exec.
|
||||
|
||||
The following sample shows how to initiate a remote ring on the device.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Exec>
|
||||
<CmdID>5</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/RemoteRing/Ring </LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
<CmdID>5</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/RemoteRing/Ring </LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Exec>
|
||||
```
|
||||
|
||||
|
||||
@ -81,7 +81,7 @@ Supported operations are Get and Replace.
|
||||
|
||||
Retrieve all available Windows Information Protection (formerly known as Enterprise Data Protection) logs starting from the specified StartTime.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML>
|
||||
<SyncBody>
|
||||
<Replace>
|
||||
@ -104,7 +104,7 @@ Retrieve all available Windows Information Protection (formerly known as Enterpr
|
||||
|
||||
Retrieve a specified number of security auditing logs starting from the specified StartTime.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Replace>
|
||||
|
||||
@ -199,7 +199,7 @@ The following security roles are supported.
|
||||
|
||||
Setting a security policy:
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<wap-provisioningdoc>
|
||||
<characteristic type="SecurityPolicy">
|
||||
<parm name="4141" value="0"/>
|
||||
@ -209,7 +209,7 @@ Setting a security policy:
|
||||
|
||||
Querying a security policy:
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<wap-provisioningdoc>
|
||||
<characteristic type="SecurityPolicy">
|
||||
<parm-query name="4141"/>
|
||||
@ -222,7 +222,7 @@ Querying a security policy:
|
||||
|
||||
Setting a security policy:
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns='SYNCML:SYNCML1.2'>
|
||||
<SyncHdr>
|
||||
…
|
||||
@ -245,7 +245,7 @@ Setting a security policy:
|
||||
|
||||
Querying a security policy:
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns='SYNCML:SYNCML1.2'>
|
||||
<SyncHdr>
|
||||
…
|
||||
|
||||
@ -53,7 +53,7 @@ The following table shows the OMA DM versions that are supported.
|
||||
|
||||
The following example shows the general structure of the XML document sent by the server using OMA DM version 1.2.1 for demonstration purposes only. The initial XML packages exchanged between client and server could contain additional XML tags. For a detailed description and samples for those packages, see the [OMA Device Management Protocol 1.2.1](https://go.microsoft.com/fwlink/p/?LinkId=526902) specification.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns='SYNCML:SYNCML1.2'>
|
||||
<SyncHdr>
|
||||
<VerDTD>1.2</VerDTD>
|
||||
@ -107,7 +107,7 @@ The following example shows the header component of a DM message. In this case,
|
||||
|
||||
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncHdr>
|
||||
<VerDTD>1.2</VerDTD>
|
||||
<VerProto>DM/1.2</VerProto>
|
||||
@ -130,7 +130,7 @@ SyncBody contains one or more DM commands. The SyncBody can contain multiple DM
|
||||
|
||||
The following example shows the body component of a DM message. In this example, SyncBody contains only one command, Get. This is indicated by the <Final /> tag that occurs immediately after the terminating tag for the Get command.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncBody>
|
||||
<!-- query device OS software version -->
|
||||
<Get>
|
||||
@ -157,7 +157,7 @@ The Replace command is used to update a device setting.
|
||||
|
||||
The following example illustrates how to use the Replace command to update a device setting.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncHdr>
|
||||
<VerDTD>1.2</VerDTD>
|
||||
<VerProto>DM/1.2</VerProto>
|
||||
|
||||
@ -481,7 +481,7 @@ Adding a SUPL and a V2 UPL account to the same device. Values in italic must be
|
||||
|
||||
Adding a SUPL account to a device. Values in italic must be replaced with correct settings for the mobile operator network. A valid binary blob must be included for the root certificate data value.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.1">
|
||||
<SyncBody>
|
||||
<Add>
|
||||
|
||||
@ -39,52 +39,52 @@ The following diagram shows the SurfaceHub CSP management objects in tree format
|
||||
|
||||
<p style="margin-left: 20px">Here's a SyncML example.
|
||||
|
||||
``` syntax
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Replace>
|
||||
<CmdID>1</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/SurfaceHub/DeviceAccount/UserPrincipalName</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">chr</Format>
|
||||
</Meta>
|
||||
<Data>user@contoso.com</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
<Replace>
|
||||
<CmdID>2</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/SurfaceHub/DeviceAccount/Password</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">chr</Format>
|
||||
</Meta>
|
||||
<Data>password</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
<Exec>
|
||||
<CmdID>3</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/SurfaceHub/DeviceAccount/ValidateAndCommit</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Exec>
|
||||
<Get>
|
||||
<CmdID>4</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/SurfaceHub/DeviceAccount/ErrorContext</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Replace>
|
||||
<CmdID>1</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/SurfaceHub/DeviceAccount/UserPrincipalName</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">chr</Format>
|
||||
</Meta>
|
||||
<Data>user@contoso.com</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
<Replace>
|
||||
<CmdID>2</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/SurfaceHub/DeviceAccount/Password</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">chr</Format>
|
||||
</Meta>
|
||||
<Data>password</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
<Exec>
|
||||
<CmdID>3</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/SurfaceHub/DeviceAccount/ValidateAndCommit</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Exec>
|
||||
<Get>
|
||||
<CmdID>4</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/SurfaceHub/DeviceAccount/ErrorContext</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
<p style="margin-left: 20px">To use a device account from Active Directory
|
||||
|
||||
@ -37,20 +37,20 @@ The following diagram shows the TPMPolicy configuration service provider in tree
|
||||
|
||||
Here is an example:
|
||||
|
||||
``` syntax
|
||||
<Replace>
|
||||
<CmdID>101</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/TpmPolicy/IsActiveZeroExhaust
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format>bool</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Data>true</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
```xml
|
||||
<Replace>
|
||||
<CmdID>101</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/TpmPolicy/IsActiveZeroExhaust
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format>bool</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Data>true</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
```
|
||||
|
||||
@ -598,7 +598,7 @@ Value type is bool. Supported operations include Get, Add, Replace, and Delete.
|
||||
|
||||
Profile example
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2" xmlns:A="syncml:metinf">
|
||||
<SyncBody>
|
||||
<Atomic>
|
||||
@ -657,244 +657,241 @@ Profile example
|
||||
|
||||
AppTriggerList
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<!-- Internet Explorer -->
|
||||
<Add>
|
||||
<CmdID>10013</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/0/App/Id</LocURI>
|
||||
</Target>
|
||||
<Data>%PROGRAMFILES%\Internet Explorer\iexplore.exe</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10014</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/1/App/Id</LocURI>
|
||||
</Target>
|
||||
<Data>%PROGRAMFILES% (x86)\Internet Explorer\iexplore.exe</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<!-- Edge -->
|
||||
<Add>
|
||||
<CmdID>10015</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/2/App/Id</LocURI>
|
||||
</Target>
|
||||
<Data>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10013</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/0/App/Id</LocURI>
|
||||
</Target>
|
||||
<Data>%PROGRAMFILES%\Internet Explorer\iexplore.exe</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10014</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/1/App/Id</LocURI>
|
||||
</Target>
|
||||
<Data>%PROGRAMFILES% (x86)\Internet Explorer\iexplore.exe</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<!-- Edge -->
|
||||
<Add>
|
||||
<CmdID>10015</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/2/App/Id</LocURI>
|
||||
</Target>
|
||||
<Data>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
```
|
||||
|
||||
RouteList and ExclusionRoute
|
||||
|
||||
``` syntax
|
||||
|
||||
<Add>
|
||||
<CmdID>10008</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/Address</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.0</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10009</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/PrefixSize</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">int</Format>
|
||||
</Meta>
|
||||
<Data>24</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10010</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/ExclusionRoute</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">bool</Format>
|
||||
</Meta>
|
||||
<Data>true</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
```xml
|
||||
<Add>
|
||||
<CmdID>10008</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/Address</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.0</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10009</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/PrefixSize</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">int</Format>
|
||||
</Meta>
|
||||
<Data>24</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10010</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/ExclusionRoute</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">bool</Format>
|
||||
</Meta>
|
||||
<Data>true</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
```
|
||||
|
||||
DomainNameInformationList
|
||||
|
||||
``` syntax
|
||||
|
||||
<!-- Domain Name rule with Suffix Match with DNS Servers -->
|
||||
<Add>
|
||||
<CmdID>10013</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>.contoso.com</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10014</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DnsServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.11,192.168.0.12</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
```xml
|
||||
<!-- Domain Name rule with Suffix Match with DNS Servers -->
|
||||
<Add>
|
||||
<CmdID>10013</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>.contoso.com</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10014</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DnsServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.11,192.168.0.12</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
<!-- Domain Name rule with Suffix Match with Web Proxy -->
|
||||
<Add>
|
||||
<CmdID>10013</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>.contoso.com</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
<Add>
|
||||
<CmdID>10015</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/WebProxyServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.100:8888</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
<Add>
|
||||
<CmdID>10013</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>.contoso.com</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
<Add>
|
||||
<CmdID>10015</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/WebProxyServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.100:8888</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
<!-- Domain Name rule with FQDN Match with DNS Servers -->
|
||||
|
||||
<Add>
|
||||
<CmdID>10016</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>finance.contoso.com</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10017</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DnsServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.11,192.168.0.12</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
|
||||
<Add>
|
||||
<CmdID>10016</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>finance.contoso.com</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10017</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DnsServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.11,192.168.0.12</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
<!-- Domain Name rule with FQDN Match with Proxy Server -->
|
||||
|
||||
<Add>
|
||||
<CmdID>10016</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>finance.contoso.com</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10017</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/WebProxyServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.11:8080</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
|
||||
<Add>
|
||||
<CmdID>10016</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>finance.contoso.com</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10017</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/WebProxyServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.11:8080</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
<!-- Domain Name rule for all other (any) traffic through DNS Servers -->
|
||||
<Add>
|
||||
<CmdID>10016</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>.</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10017</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DnsServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.11,192.168.0.12</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
<Add>
|
||||
<CmdID>10016</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>.</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10017</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DnsServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.11,192.168.0.12</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
<!-- Domain Name rule for all other (any) traffic through Proxy -->
|
||||
|
||||
<Add>
|
||||
<CmdID>10016</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>.</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10017</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/WebProxyServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.11</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
|
||||
<Add>
|
||||
<CmdID>10016</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/DomainName</LocURI>
|
||||
</Target>
|
||||
<Data>.</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Add>
|
||||
<CmdID>10017</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/WebProxyServers</LocURI>
|
||||
</Target>
|
||||
<Data>192.168.0.11</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
```
|
||||
|
||||
AutoTrigger
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Add>
|
||||
<CmdID>10010</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/AutoTrigger</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">bool</Format>
|
||||
</Meta>
|
||||
<Data>true</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<CmdID>10010</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/AutoTrigger</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">bool</Format>
|
||||
</Meta>
|
||||
<Data>true</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
```
|
||||
|
||||
Persistent
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Add>
|
||||
<CmdID>10010</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/Persistent</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">bool</Format>
|
||||
</Meta>
|
||||
<Data>true</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<CmdID>10010</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/Persistent</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">bool</Format>
|
||||
</Meta>
|
||||
<Data>true</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
```
|
||||
|
||||
TrafficFilterLIst App
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
Desktop App
|
||||
<Add>
|
||||
<CmdID>10013</CmdID>
|
||||
@ -929,7 +926,7 @@ TrafficFilterLIst App
|
||||
|
||||
Protocol, LocalPortRanges, RemotePortRanges, LocalAddressRanges, RemoteAddressRanges, RoutingPolicyType, EDPModeId, RememberCredentials, AlwaysOn, Lockdown, DnsSuffix, TrustedNetworkDetection
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
Protocol
|
||||
<Add>
|
||||
<CmdID>$CmdID$</CmdID>
|
||||
@ -1077,7 +1074,7 @@ Protocol
|
||||
|
||||
Proxy - Manual or AutoConfigUrl
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
Manual
|
||||
<Add>
|
||||
<CmdID>$CmdID$</CmdID>
|
||||
@ -1103,7 +1100,7 @@ Manual
|
||||
|
||||
Device Compliance - Sso
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
Enabled
|
||||
<Add>
|
||||
<CmdID>10011</CmdID>
|
||||
@ -1143,7 +1140,7 @@ Device Compliance - Sso
|
||||
|
||||
PluginProfile
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
PluginPackageFamilyName
|
||||
<!-- Configure VPN Server Name or Address (PhoneNumber=) [Comma Separated]-->
|
||||
<Add>
|
||||
@ -1181,7 +1178,7 @@ PluginPackageFamilyName
|
||||
|
||||
NativeProfile
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
Servers
|
||||
<Add>
|
||||
<CmdID>10001</CmdID>
|
||||
|
||||
@ -344,7 +344,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
||||
## Plug-in profile example
|
||||
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<VPNProfile>
|
||||
<PluginProfile>
|
||||
<ServerUrlList>testserver1.contoso.com;testserver2.contoso..com</ServerUrlList>
|
||||
|
||||
@ -160,7 +160,7 @@ Stores specifies which certificate stores the DM client will search to find the
|
||||
|
||||
Subject specifies the certificate to search for. For example, to specify that you want a certificate with a particular Subject attribute (“CN=Tester,O=Microsoft”), use the following:
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<parm name="SSLCLIENTCERTSEARCHCRITERIA"
|
||||
value="Subject=CN%3DTester,O%3DMicrosoft&Stores=My%5CUser" />
|
||||
```
|
||||
|
||||
@ -121,7 +121,7 @@ These XML examples show how to perform various tasks using OMA DM.
|
||||
|
||||
The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwork,' a proxy URL 'testproxy,' and port 80.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Atomic>
|
||||
@ -160,7 +160,7 @@ The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwor
|
||||
|
||||
The following example shows how to query Wi-Fi profiles installed on an MDM server.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Get>
|
||||
<CmdID>301</CmdID>
|
||||
<Item>
|
||||
@ -173,7 +173,7 @@ The following example shows how to query Wi-Fi profiles installed on an MDM serv
|
||||
|
||||
The following example shows the response.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Results>
|
||||
<CmdID>3</CmdID>
|
||||
<MsgRef>1</MsgRef>
|
||||
@ -190,17 +190,17 @@ The following example shows the response.
|
||||
|
||||
The following example shows how to remove a network with SSID ‘MyNetwork’ and no proxy. Removing all network authentication types is done in this same manner.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Atomic>
|
||||
<CmdID>300</CmdID>
|
||||
<Delete>
|
||||
<CmdID>301</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Delete>
|
||||
<CmdID>300</CmdID>
|
||||
<Delete>
|
||||
<CmdID>301</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Delete>
|
||||
</Atomic>
|
||||
```
|
||||
|
||||
@ -208,21 +208,21 @@ The following example shows how to remove a network with SSID ‘MyNetwork’ an
|
||||
|
||||
The following example shows how to add PEAP-MSCHAPv2 network with SSID ‘MyNetwork’ and root CA validation for server certificate.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Atomic>
|
||||
<CmdID>300</CmdID>
|
||||
<Add>
|
||||
<CmdID>301</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">chr</Format>
|
||||
</Meta>
|
||||
<Data><?xml version="1.0"?><WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1"><name>MyNetwork</name><SSIDConfig><SSID><name>MyNetwork</name></SSID><nonBroadcast>false</nonBroadcast></SSIDConfig><connectionType>ESS</connectionType><connectionMode>manual</connectionMode><MSM><security><authEncryption><authentication>WPA2</authentication><encryption>AES</encryption><useOneX>true</useOneX></authEncryption><OneX xmlns="http://www.microsoft.com/networking/OneX/v1"><authMode>user</authMode><EAPConfig><EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://www.microsoft.com/provisioning/EapCommon">25</Type><VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId></EapMethod><Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>25</Type><EapType xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV1"><ServerValidation><DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation><ServerNames></ServerNames><TrustedRootCA> InsertCertThumbPrintHere </TrustedRootCA></ServerValidation><FastReconnect>true</FastReconnect><InnerEapOptional>false</InnerEapOptional><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>26</Type><EapType xmlns="http://www.microsoft.com/provisioning/MsChapV2ConnectionPropertiesV1"><UseWinLogonCredentials>false</UseWinLogonCredentials></EapType></Eap><EnableQuarantineChecks>false</EnableQuarantineChecks><RequireCryptoBinding>false</RequireCryptoBinding><PeapExtensions><PerformServerValidation xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">true</PerformServerValidation><AcceptServerName xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">false</AcceptServerName></PeapExtensions></EapType></Eap></Config></EapHostConfig></EAPConfig></OneX></security></MSM></WLANProfile> </Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<CmdID>300</CmdID>
|
||||
<Add>
|
||||
<CmdID>301</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">chr</Format>
|
||||
</Meta>
|
||||
<Data><?xml version="1.0"?><WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1"><name>MyNetwork</name><SSIDConfig><SSID><name>MyNetwork</name></SSID><nonBroadcast>false</nonBroadcast></SSIDConfig><connectionType>ESS</connectionType><connectionMode>manual</connectionMode><MSM><security><authEncryption><authentication>WPA2</authentication><encryption>AES</encryption><useOneX>true</useOneX></authEncryption><OneX xmlns="http://www.microsoft.com/networking/OneX/v1"><authMode>user</authMode><EAPConfig><EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://www.microsoft.com/provisioning/EapCommon">25</Type><VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId></EapMethod><Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>25</Type><EapType xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV1"><ServerValidation><DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation><ServerNames></ServerNames><TrustedRootCA> InsertCertThumbPrintHere </TrustedRootCA></ServerValidation><FastReconnect>true</FastReconnect><InnerEapOptional>false</InnerEapOptional><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>26</Type><EapType xmlns="http://www.microsoft.com/provisioning/MsChapV2ConnectionPropertiesV1"><UseWinLogonCredentials>false</UseWinLogonCredentials></EapType></Eap><EnableQuarantineChecks>false</EnableQuarantineChecks><RequireCryptoBinding>false</RequireCryptoBinding><PeapExtensions><PerformServerValidation xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">true</PerformServerValidation><AcceptServerName xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">false</AcceptServerName></PeapExtensions></EapType></Eap></Config></EapHostConfig></EAPConfig></OneX></security></MSM></WLANProfile> </Data>
|
||||
</Item>
|
||||
</Add>
|
||||
</Atomic>
|
||||
```
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Win32CompatibilityAppraiser CSP
|
||||
# Win32CompatibilityAppraiser CSP
|
||||
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
@ -120,7 +120,7 @@ The following list describes the characteristics and parameters.
|
||||
## Examples
|
||||
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Get>
|
||||
|
||||
@ -30,9 +30,9 @@ Interior node. Supported operation is Get.
|
||||
|
||||
<a href="" id="allowwindowsdefenderapplicationguard"></a>**Settings/AllowWindowsDefenderApplicationGuard**
|
||||
Turn on Windows Defender Application Guard in Enterprise Mode. Value type is integer. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
- 0 - Stops Application Guard in Enterprise Mode. Trying to access non-enterprise domains on the host will not automatically get transferred into the insolated environment.
|
||||
- 1 - Enables Application Guard in Enterprise Mode. Trying to access non-enterprise websites on the host will automatically get transferred into the container.
|
||||
|
||||
- 0 - Stops Application Guard in Enterprise Mode. Trying to access non-enterprise domains on the host will not automatically get transferred into the insolated environment.
|
||||
- 1 - Enables Application Guard in Enterprise Mode. Trying to access non-enterprise websites on the host will automatically get transferred into the container.
|
||||
|
||||
<a href="" id="clipboardfiletype"></a>**Settings/ClipboardFileType**
|
||||
Determines the type of content that can be copied from the host to Application Guard environment and vice versa. Value type is integer. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
@ -27,7 +27,7 @@ The child node names of the result from a WMI query are separated by a forward s
|
||||
|
||||
Get the list of network adapters from the device.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Get>
|
||||
<Target>
|
||||
<LocURI>./cimV2/Win32_NetworkAdapter</LocURI>
|
||||
@ -37,7 +37,7 @@ Get the list of network adapters from the device.
|
||||
|
||||
Result
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
<Item>
|
||||
<Source>
|
||||
<LocURI>./cimV2/Win32_NetworkAdapter</LocURI>
|
||||
|
||||
Reference in New Issue
Block a user