mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge branch 'do_docs' of https://github.com/cmknox/windows-docs-pr into do_docs
This commit is contained in:
[cmknox]
commit
ca201be398
@ -1167,7 +1167,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md",
|
||||
"redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-status-report",
|
||||
"redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-summary-dashboard",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
|
||||
@ -21,12 +21,11 @@ Customers with qualifying subscriptions can upgrade student-owned and institutio
|
||||
> [!NOTE]
|
||||
> To be qualified for this process, customers must have a Windows Education subscription that includes the student use benefit and must have access to the Volume Licensing Service Center (VLSC) or the Microsoft 365 Admin Center.
|
||||
|
||||
IT admins can upgrade student devices using a multiple activation key (MAK) manually or through Mobile Device Management (MDM). Alternatively, IT admins can set up a portal through [Kivuto OnTheHub](http://onthehub.com) where students can request a *Windows Pro Education* product key. The following table provides the recommended method depending on the scenario.
|
||||
IT admins can upgrade student devices using a multiple activation key (MAK) manually or through Mobile Device Management (MDM). The following table provides the recommended method depending on the scenario.
|
||||
|
||||
| Method | Product key source | Device ownership | Best for |
|
||||
|-|-|-|-|
|
||||
| MDM | VLSC | Personal (student-owned) | IT admin initiated via MDM |
|
||||
| Kivuto | Kivuto | Personal (student-owned) | Initiated on device by student, parent, or guardian |
|
||||
| Provisioning package | VLSC | Personal (student-owned) or Corporate (institution-owned) | IT admin initiated at first boot |
|
||||
|
||||
These methods apply to devices with *Windows Home* installed; institution-owned devices can be upgraded from *Windows Professional* or *Windows Pro Edu* to *Windows Education* or *Windows Enterprise* using [Windows 10/11 Subscription Activation](/windows/deployment/windows-10-subscription-activation).
|
||||
@ -44,7 +43,7 @@ Some school institutions want to streamline student onboarding for student-owned
|
||||
- [EnterpriseDesktopAppManagement](/windows/client-management/mdm/enterprisemodernappmanagement-csp) - which enables deployment of Windows installer or Win32 applications.
|
||||
- [DeliveryOptimization](/windows/client-management/mdm/policy-csp-deliveryoptimization) - which enables configuration of Delivery Optimization.
|
||||
|
||||
A full list of CSPs are available at [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). For more information about enrolling devices into Microsoft Intune, see [Deployment guide: Enroll Windows devices in Microsoft Intune](/mem/intune/fundamentals/deployment-guide-enrollment-windows).
|
||||
A full list of CSPs is available at [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). For more information about enrolling devices into Microsoft Intune, see [Deployment guide: Enroll Windows devices in Microsoft Intune](/mem/intune/fundamentals/deployment-guide-enrollment-windows).
|
||||
|
||||
## Requirements for using a MAK to upgrade from Windows Home to Windows Education
|
||||
|
||||
@ -80,13 +79,6 @@ For a full list of methods to perform a Windows edition upgrade and more details
|
||||
|
||||
After upgrading from *Windows Home* to *Windows Education* there are some considerations for what happens during downgrade, reset or reinstall of the operating system.
|
||||
|
||||
The following table highlights the differences by upgrade product key type:
|
||||
|
||||
| Product Key Type | Downgrade (in-place) | Reset | Student reinstall |
|
||||
|-|-|-|-|
|
||||
| VLSC | No | Yes | No |
|
||||
| Kivuto OnTheHub | No | Yes | Yes |
|
||||
|
||||
### Downgrade
|
||||
|
||||
It isn't possible to downgrade to *Windows Home* from *Windows Education* without reinstalling Windows.
|
||||
@ -99,8 +91,6 @@ If the computer is reset, Windows Education is retained.
|
||||
|
||||
The Education upgrade doesn't apply to reinstalling Windows. Use the original Windows edition when reinstalling Windows. The original product key or [firmware-embedded product key](#what-is-a-firmware-embedded-activation-key) is used to activate Windows.
|
||||
|
||||
If students require a *Windows Pro Education* key that can work on a new install of Windows, they should use [Kivuto OnTheHub](http://onthehub.com) to request a key before graduation.
|
||||
|
||||
For details on product keys and reinstalling Windows, see [Find your Windows product key](https://support.microsoft.com/windows/find-your-windows-product-key-aaa2bf69-7b2b-9f13-f581-a806abf0a886).
|
||||
|
||||
### Resale
|
||||
|
||||
@ -5,14 +5,23 @@ ms.date: 09/18/2023
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
## Windows edition and licensing requirements
|
||||
<!--## Windows edition and licensing requirements-->
|
||||
|
||||
## Windows edition requirements
|
||||
|
||||
The following table lists the Windows editions that support Assigned Access:
|
||||
|
||||
|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education|
|
||||
|:---:|:---:|:---:|:---:|
|
||||
|Yes|Yes|Yes|Yes|
|
||||
|Edition|Assigned Access support|
|
||||
|:---|:---:|
|
||||
|Education|✅|
|
||||
|Enterprise |✅|
|
||||
|Enterprise LTSC|✅|
|
||||
|IoT Enterprise | ✅|
|
||||
|IoT Enterprise LTSC|✅|
|
||||
|Pro Education|✅|
|
||||
|Pro|✅|
|
||||
|
||||
<!--
|
||||
Assigned Access license entitlements are granted by the following licenses:
|
||||
|
||||
|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5|
|
||||
@ -20,3 +29,4 @@ Assigned Access license entitlements are granted by the following licenses:
|
||||
|Yes|Yes|Yes|Yes|Yes|
|
||||
|
||||
For more information about Windows licensing, see [Windows licensing overview](/windows/whats-new/windows-licensing).
|
||||
-->
|
||||
@ -5,14 +5,23 @@ ms.date: 09/18/2023
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
## Windows edition and licensing requirements
|
||||
<!--## Windows edition and licensing requirements-->
|
||||
|
||||
## Windows edition requirements
|
||||
|
||||
The following table lists the Windows editions that support Shell Launcher:
|
||||
|
||||
|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education|
|
||||
|:---:|:---:|:---:|:---:|
|
||||
|No|Yes|No|Yes|
|
||||
|Edition|Shell Launcher support|
|
||||
|:---|:---:|
|
||||
|Education|✅|
|
||||
|Enterprise |✅|
|
||||
|Enterprise LTSC|✅|
|
||||
|IoT Enterprise | ✅|
|
||||
|IoT Enterprise LTSC|✅|
|
||||
|Pro Education|❌|
|
||||
|Pro|❌|
|
||||
|
||||
<!--
|
||||
Shell Launcher license entitlements are granted by the following licenses:
|
||||
|
||||
|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5|
|
||||
@ -20,3 +29,5 @@ Shell Launcher license entitlements are granted by the following licenses:
|
||||
|No|Yes|Yes|Yes|Yes|
|
||||
|
||||
For more information about Windows licensing, see [Windows licensing overview](/windows/whats-new/windows-licensing).
|
||||
|
||||
-->
|
||||
@ -8,18 +8,20 @@ ms.author: cmcatee
|
||||
author: cmcatee-MSFT
|
||||
manager: scotv
|
||||
ms.topic: conceptual
|
||||
ms.date: 01/11/2024
|
||||
ms.date: 06/21/2024
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# What's new in Microsoft Store for Business and Education
|
||||
|
||||
> [!IMPORTANT]
|
||||
>
|
||||
> - The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286).
|
||||
|
||||
## Latest updates for Store for Business and Education
|
||||
|
||||
**June 2024**
|
||||
|
||||
The Microsoft Store for Business and Microsoft Store for Education portals will retire on August 15, 2024. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-intune-integration-with-the-microsoft-store-on-windows/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). If you are using offline licensing, you can use the [WinGet Download command](/windows/package-manager/winget/download) to continue to access offline apps and license files.
|
||||
|
||||
## Previous releases and updates
|
||||
|
||||
**January 2024**
|
||||
|
||||
**Removal of private store capability from Microsoft Store for Business and Education**
|
||||
@ -28,8 +30,6 @@ The private store tab and associated functionality was removed from the Microsof
|
||||
|
||||
We recommend customers use the [Private app repository, Windows Package Manager, and Company Portal app](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) to provide a private app repository within their organization.
|
||||
|
||||
## Previous releases and updates
|
||||
|
||||
[May 2023](release-history-microsoft-store-business-education.md#may-2023)
|
||||
- Tab removed from Microsoft Store apps on Windows 10 PCs.
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ ms.collection:
|
||||
appliesto:
|
||||
- ✅ <a href="https://www.microsoft.com/windows/business/devices/copilot-plus-pcs#copilot-plus-pcs" target="_blank">Copilot+ PCs</a>
|
||||
---
|
||||
---
|
||||
|
||||
|
||||
# Manage Recall
|
||||
<!--8908044-->
|
||||
@ -90,3 +90,7 @@ The amount of disk space users can allocate to Recall varies depending on how mu
|
||||
Microsoft has been on a responsible AI journey since 2017, when we defined our principles and approach to ensuring this technology is used in a way that is driven by ethical principles that put people first. For more about our responsible AI journey, the ethical principles that guide us, and the tooling and capabilities we've created to assure that we develop AI technology responsibly, see [Responsible AI](https://www.microsoft.com/ai/responsible-ai).
|
||||
|
||||
Recall uses optical character recognition (OCR), local to the PC, to analyze snapshots and facilitate search. For more information about OCR, see [Transparency note and use cases for OCR](/legal/cognitive-services/computer-vision/ocr-transparency-note). For more information about privacy and security, see [Privacy and control over your Recall experience](https://support.microsoft.com/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15).
|
||||
|
||||
## Information for developers
|
||||
|
||||
If you're a developer and want to launch Recall, you can call the `ms-recall` protocol URI. When you call this, Recall opens and takes a snapshot of the screen, which is the default behavior for when Recall is launched. For more information about using Recall in your Windows app, see [Recall overview](/windows/ai/apis/recall) in the Windows AI API documentation.
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: ActiveSync DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the ActiveSync configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10240</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: ApplicationControl DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the ApplicationControl configuration service provider.
|
||||
ms.date: 01/31/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.18362</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: AppLocker DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the AppLocker configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: AssignedAccess DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the AssignedAccess configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10240</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: BitLocker DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the BitLocker configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the B
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.15063</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: CertificateStore DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the CertificateStore configuration service provider.
|
||||
ms.date: 01/31/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the C
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: ClientCertificateInstall DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the ClientCertificateInstall configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the C
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -1162,7 +1162,7 @@ Valid values are:
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: CloudDesktop CSP
|
||||
description: Learn more about the CloudDesktop CSP.
|
||||
ms.date: 03/05/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -19,12 +19,14 @@ ms.date: 03/05/2024
|
||||
The following list shows the CloudDesktop configuration service provider nodes:
|
||||
|
||||
- ./Device/Vendor/MSFT/CloudDesktop
|
||||
- [BootToCloudPCEnhanced](#boottocloudpcenhanced)
|
||||
- [EnableBootToCloudSharedPCMode](#enableboottocloudsharedpcmode)
|
||||
- [BootToCloudPCEnhanced](#deviceboottocloudpcenhanced)
|
||||
- [EnableBootToCloudSharedPCMode](#deviceenableboottocloudsharedpcmode)
|
||||
- ./User/Vendor/MSFT/CloudDesktop
|
||||
- [EnablePhysicalDeviceAccess](#userenablephysicaldeviceaccess)
|
||||
<!-- CloudDesktop-Tree-End -->
|
||||
|
||||
<!-- Device-BootToCloudPCEnhanced-Begin -->
|
||||
## BootToCloudPCEnhanced
|
||||
## Device/BootToCloudPCEnhanced
|
||||
|
||||
<!-- Device-BootToCloudPCEnhanced-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
@ -76,7 +78,7 @@ This node allows to configure different kinds of Boot to Cloud mode. Boot to clo
|
||||
<!-- Device-BootToCloudPCEnhanced-End -->
|
||||
|
||||
<!-- Device-EnableBootToCloudSharedPCMode-Begin -->
|
||||
## EnableBootToCloudSharedPCMode
|
||||
## Device/EnableBootToCloudSharedPCMode
|
||||
|
||||
> [!NOTE]
|
||||
> This policy is deprecated and may be removed in a future release.
|
||||
@ -129,6 +131,55 @@ Setting this node to "true" configures boot to cloud for Shared PC mode. Boot to
|
||||
|
||||
<!-- Device-EnableBootToCloudSharedPCMode-End -->
|
||||
|
||||
<!-- User-EnablePhysicalDeviceAccess-Begin -->
|
||||
## User/EnablePhysicalDeviceAccess
|
||||
|
||||
<!-- User-EnablePhysicalDeviceAccess-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ❌ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ❌ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
|
||||
<!-- User-EnablePhysicalDeviceAccess-Applicability-End -->
|
||||
|
||||
<!-- User-EnablePhysicalDeviceAccess-OmaUri-Begin -->
|
||||
```User
|
||||
./User/Vendor/MSFT/CloudDesktop/EnablePhysicalDeviceAccess
|
||||
```
|
||||
<!-- User-EnablePhysicalDeviceAccess-OmaUri-End -->
|
||||
|
||||
<!-- User-EnablePhysicalDeviceAccess-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Configuring this node gives access to the physical devices used to boot to Cloud PCs from the Ctrl+Alt+Del page for specified users. This node supports these options: 0. Not enabled 1. Enabled.
|
||||
<!-- User-EnablePhysicalDeviceAccess-Description-End -->
|
||||
|
||||
<!-- User-EnablePhysicalDeviceAccess-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- User-EnablePhysicalDeviceAccess-Editable-End -->
|
||||
|
||||
<!-- User-EnablePhysicalDeviceAccess-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | `bool` |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | false |
|
||||
<!-- User-EnablePhysicalDeviceAccess-DFProperties-End -->
|
||||
|
||||
<!-- User-EnablePhysicalDeviceAccess-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| false (Default) | Access to physical device disabled. |
|
||||
| true | Access to physical device enabled. |
|
||||
<!-- User-EnablePhysicalDeviceAccess-AllowedValues-End -->
|
||||
|
||||
<!-- User-EnablePhysicalDeviceAccess-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- User-EnablePhysicalDeviceAccess-Examples-End -->
|
||||
|
||||
<!-- User-EnablePhysicalDeviceAccess-End -->
|
||||
|
||||
<!-- CloudDesktop-CspMoreInfo-Begin -->
|
||||
<!-- Add any additional information about this CSP here. Anything outside this section will get overwritten. -->
|
||||
## BootToCloudPCEnhanced technical reference
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: CloudDesktop DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the CloudDesktop configuration service provider.
|
||||
ms.date: 03/05/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -17,6 +17,69 @@ The following XML file contains the device description framework (DDF) for the C
|
||||
<VerDTD>1.2</VerDTD>
|
||||
<MSFT:Diagnostics>
|
||||
</MSFT:Diagnostics>
|
||||
<Node>
|
||||
<NodeName>CloudDesktop</NodeName>
|
||||
<Path>./User/Vendor/MSFT</Path>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>The CloudDesktop configuration service provider is used to configure different Cloud PC related scenarios.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>2.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x30;0x31;0x7E;0x87;0x88;0x88*;0xA1;0xA2;0xA4;0xA5;0xB4;0xBC;0xBD;0xBF;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>EnablePhysicalDeviceAccess</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>false</DefaultValue>
|
||||
<Description>Configuring this node gives access to the physical devices used to boot to Cloud PCs from the Ctrl+Alt+Del page for specified users. This node supports these options: 0. Not enabled 1. Enabled.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFTitle>Enable access to physical device</DFTitle>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>false</MSFT:Value>
|
||||
<MSFT:ValueDescription>Access to physical device disabled</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Access to physical device enabled</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>CloudDesktop</NodeName>
|
||||
<Path>./Device/Vendor/MSFT</Path>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DeclaredConfiguration DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the DeclaredConfiguration configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>9.9</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Defender CSP
|
||||
description: Learn more about the Defender CSP.
|
||||
ms.date: 05/20/2024
|
||||
ms.date: 06/21/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -33,6 +33,9 @@ The following list shows the Defender configuration service provider nodes:
|
||||
- [BruteForceProtectionConfiguredState](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionconfiguredstate)
|
||||
- [BruteForceProtectionExclusions](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionexclusions)
|
||||
- [BruteForceProtectionMaxBlockTime](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionmaxblocktime)
|
||||
- [BruteForceProtectionPlugins](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionplugins)
|
||||
- [BruteForceProtectionLocalNetworkBlocking](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionpluginsbruteforceprotectionlocalnetworkblocking)
|
||||
- [BruteForceProtectionSkipLearningPeriod](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionpluginsbruteforceprotectionskiplearningperiod)
|
||||
- [RemoteEncryptionProtection](#configurationbehavioralnetworkblocksremoteencryptionprotection)
|
||||
- [RemoteEncryptionProtectionAggressiveness](#configurationbehavioralnetworkblocksremoteencryptionprotectionremoteencryptionprotectionaggressiveness)
|
||||
- [RemoteEncryptionProtectionConfiguredState](#configurationbehavioralnetworkblocksremoteencryptionprotectionremoteencryptionprotectionconfiguredstate)
|
||||
@ -752,6 +755,142 @@ Set the maximum time an IP address is blocked by Brute-Force Protection. After t
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionMaxBlockTime-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-Begin -->
|
||||
##### Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-Applicability-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins
|
||||
```
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-OmaUri-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-Description-Begin -->
|
||||
<!-- Description-Source-Not-Found -->
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-Description-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-Editable-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | `node` |
|
||||
| Access Type | Get |
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-DFProperties-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-Examples-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-Begin -->
|
||||
###### Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins/BruteForceProtectionLocalNetworkBlocking
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later |
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-Applicability-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins/BruteForceProtectionLocalNetworkBlocking
|
||||
```
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-OmaUri-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Extend brute-force protection coverage in Microsoft Defender Antivirus to block local network addresses.
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-Description-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-Editable-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | `int` |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | 0 |
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-DFProperties-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Brute-force protection won't block local network addresses. |
|
||||
| 1 | Brute-force protection will block local network addresses. |
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-AllowedValues-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-Examples-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionLocalNetworkBlocking-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-Begin -->
|
||||
###### Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins/BruteForceProtectionSkipLearningPeriod
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later |
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-Applicability-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins/BruteForceProtectionSkipLearningPeriod
|
||||
```
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-OmaUri-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Skip the 2-week initial learning period, so brute-force protection in Microsoft Defender Antivirus can start blocking immediately.
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-Description-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-Editable-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | `int` |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | 0 |
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-DFProperties-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Brute-force protection blocks threats only after completing a 2-week learning period. |
|
||||
| 1 | Brute-force protection starts blocking threats immediately. |
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-AllowedValues-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-Examples-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-BruteForceProtection-BruteForceProtectionPlugins-BruteForceProtectionSkipLearningPeriod-End -->
|
||||
|
||||
<!-- Device-Configuration-BehavioralNetworkBlocks-RemoteEncryptionProtection-Begin -->
|
||||
#### Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Defender DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the Defender configuration service provider.
|
||||
ms.date: 05/20/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -3596,6 +3596,104 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>BruteForceProtectionPlugins</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>BruteForceProtectionLocalNetworkBlocking</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>0</DefaultValue>
|
||||
<Description>Extend brute-force protection coverage in Microsoft Defender Antivirus to block local network addresses.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.16299</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.3</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>Brute-force protection will not block local network addresses</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>Brute-force protection will block local network addresses</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>BruteForceProtectionSkipLearningPeriod</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>0</DefaultValue>
|
||||
<Description>Skip the 2-week initial learning period, so brute-force protection in Microsoft Defender Antivirus can start blocking immediately.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.16299</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.3</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>Brute-force protection blocks threats only after completing a 2-week learning period</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>Brute-force protection starts blocking threats immediately</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>BruteForceProtectionExclusions</NodeName>
|
||||
<DFProperties>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DevDetail DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the DevDetail configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DeviceManageability DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the DeviceManageability configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.14393</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DevicePreparation DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the DevicePreparation configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DeviceStatus DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the DeviceStatus configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DevInfo DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the DevInfo configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -41,7 +41,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DiagnosticLog DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the DiagnosticLog configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.2</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DMAcc DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the DMAcc configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DMClient DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the DMClient configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10240</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -477,7 +477,7 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10240</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: EMAIL2 DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the EMAIL2 configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the E
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10240</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:Deprecated />
|
||||
</DFProperties>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: EnterpriseDesktopAppManagement DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the EnterpriseDesktopAppManagement configuration service provider.
|
||||
ms.date: 05/20/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the E
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -401,7 +401,7 @@ The following XML file contains the device description framework (DDF) for the E
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: EnterpriseModernAppManagement DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the EnterpriseModernAppManagement configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the E
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -2587,7 +2587,7 @@ The following XML file contains the device description framework (DDF) for the E
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: eUICCs DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the eUICCs configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -43,7 +43,7 @@ The following XML file contains the device description framework (DDF) for the e
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.16299</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Firewall CSP
|
||||
description: Learn more about the Firewall CSP.
|
||||
ms.date: 01/18/2024
|
||||
ms.date: 06/21/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -9,8 +9,6 @@ ms.date: 01/18/2024
|
||||
<!-- Firewall-Begin -->
|
||||
# Firewall CSP
|
||||
|
||||
[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
|
||||
|
||||
<!-- Firewall-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The Firewall configuration service provider (CSP) allows the mobile device management (MDM) server to configure the Windows Defender Firewall global settings, per profile settings, and the desired set of custom rules to be enforced on the device. Using the Firewall CSP the IT admin can now manage non-domain devices, and reduce the risk of network security threats across all systems connecting to the corporate network.
|
||||
@ -3465,7 +3463,7 @@ This value represents the order of rule enforcement. A lower priority rule is ev
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-OmaUri-Begin -->
|
||||
@ -3805,7 +3803,7 @@ VM Creator ID that these settings apply to. Valid format is a GUID.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-OmaUri-Begin -->
|
||||
@ -3954,7 +3952,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-OmaUri-Begin -->
|
||||
@ -3992,7 +3990,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-OmaUri-Begin -->
|
||||
@ -4042,7 +4040,7 @@ This value is used as an on/off switch. If this value is false, Hyper-V Firewall
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-OmaUri-Begin -->
|
||||
@ -4092,7 +4090,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-OmaUri-Begin -->
|
||||
@ -4142,7 +4140,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-OmaUri-Begin -->
|
||||
@ -4289,7 +4287,7 @@ This value is an on/off switch for loopback traffic. This determines if this VM
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-OmaUri-Begin -->
|
||||
@ -4327,7 +4325,7 @@ This value is an on/off switch for loopback traffic. This determines if this VM
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-OmaUri-Begin -->
|
||||
@ -4377,7 +4375,7 @@ This value is used as an on/off switch. If this value is false, Hyper-V Firewall
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-OmaUri-Begin -->
|
||||
@ -4427,7 +4425,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-OmaUri-Begin -->
|
||||
@ -4477,7 +4475,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-OmaUri-Begin -->
|
||||
@ -4526,7 +4524,7 @@ This value is an on/off switch for the Hyper-V Firewall enforcement.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-OmaUri-Begin -->
|
||||
@ -4564,7 +4562,7 @@ This value is an on/off switch for the Hyper-V Firewall enforcement.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-OmaUri-Begin -->
|
||||
@ -4614,7 +4612,7 @@ This value is used as an on/off switch. If this value is false, Hyper-V Firewall
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-OmaUri-Begin -->
|
||||
@ -4664,7 +4662,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-OmaUri-Begin -->
|
||||
@ -4714,7 +4712,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later <br> ✅ Windows Insider Preview [10.0.25398] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2352] and later |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-OmaUri-Begin -->
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Firewall DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the Firewall configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.16299</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: HealthAttestation DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the HealthAttestation configuration service provider.
|
||||
ms.date: 01/31/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the H
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: LanguagePackManagement DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the LanguagePackManagement configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the L
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.9999</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: LAPS CSP
|
||||
description: Learn more about the LAPS CSP.
|
||||
ms.date: 05/20/2024
|
||||
ms.date: 06/21/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -55,7 +55,7 @@ The following list shows the LAPS configuration service provider nodes:
|
||||
<!-- Device-Actions-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Actions-Applicability-End -->
|
||||
|
||||
<!-- Device-Actions-OmaUri-Begin -->
|
||||
@ -94,7 +94,7 @@ Defines the parent interior node for all action-related settings in the LAPS CSP
|
||||
<!-- Device-Actions-ResetPassword-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Actions-ResetPassword-Applicability-End -->
|
||||
|
||||
<!-- Device-Actions-ResetPassword-OmaUri-Begin -->
|
||||
@ -134,7 +134,7 @@ This action invokes an immediate reset of the local administrator account passwo
|
||||
<!-- Device-Actions-ResetPasswordStatus-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Actions-ResetPasswordStatus-Applicability-End -->
|
||||
|
||||
<!-- Device-Actions-ResetPasswordStatus-OmaUri-Begin -->
|
||||
@ -179,7 +179,7 @@ The value returned is an HRESULT code:
|
||||
<!-- Device-Policies-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-OmaUri-Begin -->
|
||||
@ -219,7 +219,7 @@ Root node for LAPS policies.
|
||||
<!-- Device-Policies-ADEncryptedPasswordHistorySize-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-ADEncryptedPasswordHistorySize-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-ADEncryptedPasswordHistorySize-OmaUri-Begin -->
|
||||
@ -269,7 +269,7 @@ This setting has a maximum allowed value of 12 passwords.
|
||||
<!-- Device-Policies-AdministratorAccountName-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-AdministratorAccountName-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-AdministratorAccountName-OmaUri-Begin -->
|
||||
@ -314,7 +314,7 @@ Note if a custom managed local administrator account name is specified in this s
|
||||
<!-- Device-Policies-ADPasswordEncryptionEnabled-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-ADPasswordEncryptionEnabled-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-ADPasswordEncryptionEnabled-OmaUri-Begin -->
|
||||
@ -376,7 +376,7 @@ If not specified, this setting defaults to True.
|
||||
<!-- Device-Policies-ADPasswordEncryptionPrincipal-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-ADPasswordEncryptionPrincipal-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-ADPasswordEncryptionPrincipal-OmaUri-Begin -->
|
||||
@ -701,7 +701,7 @@ If not specified, this setting will default to 1.
|
||||
<!-- Device-Policies-BackupDirectory-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-BackupDirectory-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-BackupDirectory-OmaUri-Begin -->
|
||||
@ -807,7 +807,7 @@ This setting has a maximum allowed value of 10 words.
|
||||
<!-- Device-Policies-PasswordAgeDays-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-PasswordAgeDays-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-PasswordAgeDays-OmaUri-Begin -->
|
||||
@ -855,7 +855,7 @@ This setting has a maximum allowed value of 365 days.
|
||||
<!-- Device-Policies-PasswordComplexity-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-PasswordComplexity-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-PasswordComplexity-OmaUri-Begin -->
|
||||
@ -927,7 +927,7 @@ Passphrase list taken from "Deep Dive: EFF's New Wordlists for Random Passphrase
|
||||
<!-- Device-Policies-PasswordExpirationProtectionEnabled-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-PasswordExpirationProtectionEnabled-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-PasswordExpirationProtectionEnabled-OmaUri-Begin -->
|
||||
@ -983,7 +983,7 @@ If not specified, this setting defaults to True.
|
||||
<!-- Device-Policies-PasswordLength-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-PasswordLength-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-PasswordLength-OmaUri-Begin -->
|
||||
@ -1031,7 +1031,7 @@ This setting has a maximum allowed value of 64 characters.
|
||||
<!-- Device-Policies-PostAuthenticationActions-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-PostAuthenticationActions-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-PostAuthenticationActions-OmaUri-Begin -->
|
||||
@ -1089,7 +1089,7 @@ If not specified, this setting will default to 3 (Reset the password and logoff
|
||||
<!-- Device-Policies-PostAuthenticationResetDelay-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later <br> ✅ Windows Insider Preview [10.0.25145] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later <br> ✅ [10.0.25145] and later <br> ✅ Windows 10, version 1809 [10.0.17763.4244] and later <br> ✅ Windows 10, version 2004 [10.0.19041.2784] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.1754] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.1480] and later |
|
||||
<!-- Device-Policies-PostAuthenticationResetDelay-Applicability-End -->
|
||||
|
||||
<!-- Device-Policies-PostAuthenticationResetDelay-OmaUri-Begin -->
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: LAPS DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the LAPS configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the L
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.25145, 10.0.22621.1480, 10.0.22000.1754, 10.0.20348.1663, 10.0.19041.2784, 10.0.17763.4244</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: NetworkProxy DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the NetworkProxy configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.15063</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: NetworkQoSPolicy DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the NetworkQoSPolicy configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.19042</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: NodeCache DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the NodeCache configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.15063</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.1</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -294,7 +294,7 @@ The following XML file contains the device description framework (DDF) for the N
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Office DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the Office configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the O
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.15063</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -211,7 +211,7 @@ The following XML file contains the device description framework (DDF) for the O
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.15063</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: PassportForWork CSP
|
||||
description: Learn more about the PassportForWork CSP.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/21/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -25,7 +25,6 @@ The following list shows the PassportForWork configuration service provider node
|
||||
- ./Device/Vendor/MSFT/PassportForWork
|
||||
- [{TenantId}](#devicetenantid)
|
||||
- [Policies](#devicetenantidpolicies)
|
||||
- [DisablePostLogonCredentialCaching](#devicetenantidpoliciesdisablepostlogoncredentialcaching)
|
||||
- [DisablePostLogonProvisioning](#devicetenantidpoliciesdisablepostlogonprovisioning)
|
||||
- [EnablePinRecovery](#devicetenantidpoliciesenablepinrecovery)
|
||||
- [EnableWindowsHelloProvisioningForSecurityKeys](#devicetenantidpoliciesenablewindowshelloprovisioningforsecuritykeys)
|
||||
@ -158,62 +157,13 @@ Root node for policies.
|
||||
|
||||
<!-- Device-{TenantId}-Policies-End -->
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-Begin -->
|
||||
#### Device/{TenantId}/Policies/DisablePostLogonCredentialCaching
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-Applicability-End -->
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/DisablePostLogonCredentialCaching
|
||||
```
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-OmaUri-End -->
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Disable caching of the Windows Hello for Business credential after sign-in.
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-Description-End -->
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-Editable-End -->
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | `bool` |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | False |
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-DFProperties-End -->
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| false (Default) | Credential Caching Enabled. |
|
||||
| true | Credential Caching Disabled. |
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-AllowedValues-End -->
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-Examples-End -->
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonCredentialCaching-End -->
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Begin -->
|
||||
#### Device/{TenantId}/Policies/DisablePostLogonProvisioning
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2402] and later <br> ✅ Windows 10, version 2004 [10.0.19041.4239] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.2899] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.3374] and later <br> ✅ Windows Insider Preview |
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Applicability-End -->
|
||||
|
||||
<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-OmaUri-Begin -->
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: PassportForWork DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the PassportForWork configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/21/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.2</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -565,7 +565,7 @@ If you do not configure this policy setting, Windows Hello for Business requires
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.2</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -870,7 +870,7 @@ If you disable or do not configure this policy setting, the PIN recovery secret
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:OsBuildVersion>99.9.99999, 10.0.22621.3374, 10.0.22000.2899, 10.0.20348.2402, 10.0.19041.4239</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.6</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
@ -885,45 +885,6 @@ If you disable or do not configure this policy setting, the PIN recovery secret
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>DisablePostLogonCredentialCaching</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>False</DefaultValue>
|
||||
<Description>Disable caching of the Windows Hello for Business credential after sign-in.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.6</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>false</MSFT:Value>
|
||||
<MSFT:ValueDescription>Credential Caching Enabled</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Credential Caching Disabled</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>UseCertificateForOnPremAuth</NodeName>
|
||||
<DFProperties>
|
||||
@ -934,7 +895,7 @@ If you disable or do not configure this policy setting, the PIN recovery secret
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>False</DefaultValue>
|
||||
<Description>Windows Hello for Business can use certificates to authenticate to on-premise resources.
|
||||
<Description>Windows Hello for Business can use certificates to authenticate to on-premise resources.
|
||||
|
||||
If you enable this policy setting, Windows Hello for Business will wait until the device has received a certificate payload from the mobile device management server before provisioning a PIN.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: PDE DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the PDE configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.22621</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0xAB;0xAC;0xBC;0xBF;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0xAB;0xAC;0xB4;0xBC;0xBD;0xBF;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Personalization CSP
|
||||
description: Learn more about the Personalization CSP.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/21/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -9,14 +9,12 @@ ms.date: 04/10/2024
|
||||
<!-- Personalization-Begin -->
|
||||
# Personalization CSP
|
||||
|
||||
[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
|
||||
|
||||
<!-- Personalization-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The Personalization CSP can set the lock screen, desktop background images and company branding on sign-in screen ([BootToCloud mode](policy-csp-clouddesktop.md#boottocloudmode) only). Setting these policies also prevents the user from changing the image. You can also use the Personalization settings in a provisioning package.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Personalization CSP is supported in Windows Enterprise and Education SKUs. It works in Windows Professional only when SetEduPolicies in [SharedPC CSP](sharedpc-csp.md) is set, or when the device is configured in [Shared PC mode with BootToCloudPCEnhanced policy](clouddesktop-csp.md#boottocloudpcenhanced).
|
||||
> Personalization CSP is supported in Windows Enterprise and Education SKUs. It works in Windows Professional only when SetEduPolicies in [SharedPC CSP](sharedpc-csp.md) is set, or when the device is configured in [Shared PC mode with BootToCloudPCEnhanced policy](clouddesktop-csp.md#deviceboottocloudpcenhanced).
|
||||
<!-- Personalization-Editable-End -->
|
||||
|
||||
<!-- Personalization-Tree-Begin -->
|
||||
@ -38,7 +36,7 @@ The following list shows the Personalization configuration service provider node
|
||||
<!-- Device-CompanyLogoStatus-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later |
|
||||
<!-- Device-CompanyLogoStatus-Applicability-End -->
|
||||
|
||||
<!-- Device-CompanyLogoStatus-OmaUri-Begin -->
|
||||
@ -77,7 +75,7 @@ This represents the status of the Company Logo. 1 - Successfully downloaded or c
|
||||
<!-- Device-CompanyLogoUrl-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later |
|
||||
<!-- Device-CompanyLogoUrl-Applicability-End -->
|
||||
|
||||
<!-- Device-CompanyLogoUrl-OmaUri-Begin -->
|
||||
@ -116,7 +114,7 @@ An http or https Url to a jpg, jpeg or png image that needs to be downloaded and
|
||||
<!-- Device-CompanyName-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later |
|
||||
<!-- Device-CompanyName-Applicability-End -->
|
||||
|
||||
<!-- Device-CompanyName-OmaUri-Begin -->
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Personalization DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the Personalization configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.16299</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -101,7 +101,7 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image.</Description>
|
||||
<Description>A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
@ -148,7 +148,7 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only.</Description>
|
||||
<Description>A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
@ -162,7 +162,7 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:OsBuildVersion>10.0.22621.3235</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>2.0</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="None">
|
||||
@ -189,7 +189,7 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:OsBuildVersion>10.0.22621.3235</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>2.0</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
@ -217,7 +217,7 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:OsBuildVersion>10.0.22621.3235</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>2.0</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="RegEx">
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: ADMX-backed policies in Policy CSP
|
||||
description: Learn about the ADMX-backed policies in Policy CSP.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -1663,6 +1663,7 @@ This article lists the ADMX-backed policies in Policy CSP.
|
||||
- [TS_NoSecurityMenu](policy-csp-admx-terminalserver.md)
|
||||
- [TS_START_PROGRAM_2](policy-csp-admx-terminalserver.md)
|
||||
- [TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP](policy-csp-admx-terminalserver.md)
|
||||
- [TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME](policy-csp-admx-terminalserver.md)
|
||||
- [TS_DX_USE_FULL_HWGPU](policy-csp-admx-terminalserver.md)
|
||||
- [TS_SERVER_WDDM_GRAPHICS_DRIVER](policy-csp-admx-terminalserver.md)
|
||||
- [TS_TSCC_PERMISSIONS_POLICY](policy-csp-admx-terminalserver.md)
|
||||
@ -2210,6 +2211,7 @@ This article lists the ADMX-backed policies in Policy CSP.
|
||||
- [AllowSaveTargetAsInIEMode](policy-csp-internetexplorer.md)
|
||||
- [DisableInternetExplorerApp](policy-csp-internetexplorer.md)
|
||||
- [EnableExtendedIEModeHotkeys](policy-csp-internetexplorer.md)
|
||||
- [AllowLegacyURLFields](policy-csp-internetexplorer.md)
|
||||
- [ResetZoomForDialogInIEMode](policy-csp-internetexplorer.md)
|
||||
- [EnableGlobalWindowListInIEMode](policy-csp-internetexplorer.md)
|
||||
- [JScriptReplacement](policy-csp-internetexplorer.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Policies in Policy CSP supported by Group Policy
|
||||
description: Learn about the policies in Policy CSP supported by Group Policy.
|
||||
ms.date: 05/20/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -805,6 +805,7 @@ This article lists the policies in Policy CSP that have a group policy mapping.
|
||||
- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md)
|
||||
- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md)
|
||||
- [AllowOptionalContent](policy-csp-update.md)
|
||||
- [AlwaysAutoRebootAtScheduledTimeMinutes](policy-csp-update.md)
|
||||
|
||||
## UserRights
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Policies in Policy CSP supported by Windows 10 Team
|
||||
description: Learn about the policies in Policy CSP supported by Windows 10 Team.
|
||||
ms.date: 01/18/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -315,6 +315,7 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
|
||||
- [AllowOptionalContent](policy-csp-update.md#allowoptionalcontent)
|
||||
- [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md#allowtemporaryenterprisefeaturecontrol)
|
||||
- [AllowUpdateService](policy-csp-update.md#allowupdateservice)
|
||||
- [AlwaysAutoRebootAtScheduledTimeMinutes](policy-csp-update.md#alwaysautorebootatscheduledtimeminutes)
|
||||
- [BranchReadinessLevel](policy-csp-update.md#branchreadinesslevel)
|
||||
- [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md#configurefeatureupdateuninstallperiod)
|
||||
- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#deferfeatureupdatesperiodindays)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: ADMX_TerminalServer Policy CSP
|
||||
description: Learn more about the ADMX_TerminalServer Area in Policy CSP.
|
||||
ms.date: 01/18/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -4109,6 +4109,56 @@ This policy setting allows the administrator to configure the RemoteFX experienc
|
||||
|
||||
<!-- TS_SERVER_PROFILE-End -->
|
||||
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-Begin -->
|
||||
## TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME
|
||||
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.1202] and later <br> ✅ Windows 10, version 2009 [10.0.19042.1202] and later <br> ✅ Windows 10, version 21H1 [10.0.19043.1202] and later <br> ✅ Windows 11, version 21H2 [10.0.22000] and later |
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-Applicability-End -->
|
||||
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME
|
||||
```
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-OmaUri-End -->
|
||||
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-Description-Begin -->
|
||||
<!-- Description-Source-Not-Found -->
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-Description-End -->
|
||||
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-Editable-End -->
|
||||
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | `chr` (string) |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-DFProperties-End -->
|
||||
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-AdmxBacked-Begin -->
|
||||
<!-- ADMX-Not-Found -->
|
||||
[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
|
||||
|
||||
**ADMX mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME |
|
||||
| ADMX File Name | TerminalServer.admx |
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-AdmxBacked-End -->
|
||||
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-Examples-End -->
|
||||
|
||||
<!-- TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME-End -->
|
||||
|
||||
<!-- TS_SERVER_VISEXP-Begin -->
|
||||
## TS_SERVER_VISEXP
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DeliveryOptimization Policy CSP
|
||||
description: Learn more about the DeliveryOptimization Area in Policy CSP.
|
||||
ms.date: 01/18/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -1500,20 +1500,8 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts
|
||||
<!-- DORestrictPeerSelectionBy-OmaUri-End -->
|
||||
|
||||
<!-- DORestrictPeerSelectionBy-Description-Begin -->
|
||||
<!-- Description-Source-ADMX -->
|
||||
Set this policy to restrict peer selection via selected option.
|
||||
|
||||
Options available are:
|
||||
|
||||
0 = NAT.
|
||||
|
||||
1 = Subnet mask.
|
||||
|
||||
2 = Local discovery (DNS-SD).
|
||||
|
||||
The default value has changed from 0 (no restriction) to 1 (restrict to the subnet).
|
||||
|
||||
These options apply to both Download Mode LAN (1) and Group (2).
|
||||
<!-- Description-Source-DDF-Forced -->
|
||||
Set this policy to restrict peer selection via selected option. Options available are: 1=Subnet mask, 2 = Local discovery (DNS-SD). These options apply to both Download Mode LAN (1) and Group (2).
|
||||
<!-- DORestrictPeerSelectionBy-Description-End -->
|
||||
|
||||
<!-- DORestrictPeerSelectionBy-Editable-Begin -->
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: InternetExplorer Policy CSP
|
||||
description: Learn more about the InternetExplorer Area in Policy CSP.
|
||||
ms.date: 05/20/2024
|
||||
ms.date: 06/21/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -985,6 +985,60 @@ Note. It's recommended to configure template policy settings in one Group Policy
|
||||
|
||||
<!-- AllowIntranetZoneTemplate-End -->
|
||||
|
||||
<!-- AllowLegacyURLFields-Begin -->
|
||||
## AllowLegacyURLFields
|
||||
|
||||
<!-- AllowLegacyURLFields-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
|
||||
<!-- AllowLegacyURLFields-Applicability-End -->
|
||||
|
||||
<!-- AllowLegacyURLFields-OmaUri-Begin -->
|
||||
```User
|
||||
./User/Vendor/MSFT/Policy/Config/InternetExplorer/AllowLegacyURLFields
|
||||
```
|
||||
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/InternetExplorer/AllowLegacyURLFields
|
||||
```
|
||||
<!-- AllowLegacyURLFields-OmaUri-End -->
|
||||
|
||||
<!-- AllowLegacyURLFields-Description-Begin -->
|
||||
<!-- Description-Source-Not-Found -->
|
||||
<!-- AllowLegacyURLFields-Description-End -->
|
||||
|
||||
<!-- AllowLegacyURLFields-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- AllowLegacyURLFields-Editable-End -->
|
||||
|
||||
<!-- AllowLegacyURLFields-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | `chr` (string) |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
<!-- AllowLegacyURLFields-DFProperties-End -->
|
||||
|
||||
<!-- AllowLegacyURLFields-AdmxBacked-Begin -->
|
||||
<!-- ADMX-Not-Found -->
|
||||
[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
|
||||
|
||||
**ADMX mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | AllowLegacyURLFields |
|
||||
| ADMX File Name | inetres.admx |
|
||||
<!-- AllowLegacyURLFields-AdmxBacked-End -->
|
||||
|
||||
<!-- AllowLegacyURLFields-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- AllowLegacyURLFields-Examples-End -->
|
||||
|
||||
<!-- AllowLegacyURLFields-End -->
|
||||
|
||||
<!-- AllowLocalMachineZoneTemplate-Begin -->
|
||||
## AllowLocalMachineZoneTemplate
|
||||
|
||||
@ -7718,7 +7772,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any
|
||||
<!-- IntranetZoneLogonOptions-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later <br> ✅ Windows 10, version 2004 [10.0.19041.3758] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2792] and later <br> ✅ Windows Insider Preview [10.0.25398.643] |
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later <br> ✅ [10.0.25398.643] and later <br> ✅ [10.0.25965] and later <br> ✅ Windows 10, version 2004 [10.0.19041.3758] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2792] and later |
|
||||
<!-- IntranetZoneLogonOptions-Applicability-End -->
|
||||
|
||||
<!-- IntranetZoneLogonOptions-OmaUri-Begin -->
|
||||
@ -8793,7 +8847,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any
|
||||
<!-- LocalMachineZoneLogonOptions-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later <br> ✅ Windows 10, version 2004 [10.0.19041.3758] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2792] and later <br> ✅ Windows Insider Preview [10.0.25398.643] |
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later <br> ✅ [10.0.25398.643] and later <br> ✅ [10.0.25965] and later <br> ✅ Windows 10, version 2004 [10.0.19041.3758] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2792] and later |
|
||||
<!-- LocalMachineZoneLogonOptions-Applicability-End -->
|
||||
|
||||
<!-- LocalMachineZoneLogonOptions-OmaUri-Begin -->
|
||||
@ -17364,7 +17418,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any
|
||||
<!-- TrustedSitesZoneLogonOptions-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later <br> ✅ Windows 10, version 2004 [10.0.19041.3758] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2792] and later <br> ✅ Windows Insider Preview [10.0.25398.643] |
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later <br> ✅ [10.0.25398.643] and later <br> ✅ [10.0.25965] and later <br> ✅ Windows 10, version 2004 [10.0.19041.3758] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2792] and later |
|
||||
<!-- TrustedSitesZoneLogonOptions-Applicability-End -->
|
||||
|
||||
<!-- TrustedSitesZoneLogonOptions-OmaUri-Begin -->
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Privacy Policy CSP
|
||||
description: Learn more about the Privacy Area in Policy CSP.
|
||||
ms.date: 01/18/2024
|
||||
ms.date: 06/21/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -9,8 +9,6 @@ ms.date: 01/18/2024
|
||||
<!-- Privacy-Begin -->
|
||||
# Policy CSP - Privacy
|
||||
|
||||
[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
|
||||
|
||||
<!-- Privacy-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Privacy-Editable-End -->
|
||||
@ -2929,7 +2927,7 @@ If an app is open when this Group Policy object is applied on a device, employee
|
||||
<!-- LetAppsAccessHumanPresence-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [10.0.25000] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25000] and later |
|
||||
<!-- LetAppsAccessHumanPresence-Applicability-End -->
|
||||
|
||||
<!-- LetAppsAccessHumanPresence-OmaUri-Begin -->
|
||||
@ -3005,7 +3003,7 @@ If an app is open when this Group Policy object is applied on a device, employee
|
||||
<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [10.0.25000] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25000] and later |
|
||||
<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Applicability-End -->
|
||||
|
||||
<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-OmaUri-Begin -->
|
||||
@ -3070,7 +3068,7 @@ If an app is open when this Group Policy object is applied on a device, employee
|
||||
<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [10.0.25000] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25000] and later |
|
||||
<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Applicability-End -->
|
||||
|
||||
<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-OmaUri-Begin -->
|
||||
@ -3135,7 +3133,7 @@ If an app is open when this Group Policy object is applied on a device, employee
|
||||
<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [10.0.25000] |
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25000] and later |
|
||||
<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Applicability-End -->
|
||||
|
||||
<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-OmaUri-Begin -->
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: RemoteDesktopServices Policy CSP
|
||||
description: Learn more about the RemoteDesktopServices Area in Policy CSP.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/21/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -439,7 +439,7 @@ By default, Remote Desktop allows redirection of WebAuthn requests.
|
||||
<!-- LimitClientToServerClipboardRedirection-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2400] and later <br> ✅ [10.0.25398.827] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.2898] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.3374] and later <br> ✅ Windows 11, version 23H2 [10.0.22631.3374] and later <br> ✅ Windows Insider Preview |
|
||||
<!-- LimitClientToServerClipboardRedirection-Applicability-End -->
|
||||
|
||||
<!-- LimitClientToServerClipboardRedirection-OmaUri-Begin -->
|
||||
@ -493,7 +493,7 @@ By default, Remote Desktop allows redirection of WebAuthn requests.
|
||||
<!-- LimitServerToClientClipboardRedirection-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
|
||||
| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2400] and later <br> ✅ [10.0.25398.827] and later <br> ✅ Windows 11, version 21H2 [10.0.22000.2898] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.3374] and later <br> ✅ Windows 11, version 23H2 [10.0.22631.3374] and later <br> ✅ Windows Insider Preview |
|
||||
<!-- LimitServerToClientClipboardRedirection-Applicability-End -->
|
||||
|
||||
<!-- LimitServerToClientClipboardRedirection-OmaUri-Begin -->
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Update Policy CSP
|
||||
description: Learn more about the Update Area in Policy CSP.
|
||||
ms.date: 02/14/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -18,6 +18,7 @@ ms.date: 02/14/2024
|
||||
Update CSP policies are listed below based on the group policy area:
|
||||
|
||||
- [Windows Insider Preview](#windows-insider-preview)
|
||||
- [AlwaysAutoRebootAtScheduledTimeMinutes](#alwaysautorebootatscheduledtimeminutes)
|
||||
- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](#configuredeadlinenoautorebootforfeatureupdates)
|
||||
- [ConfigureDeadlineNoAutoRebootForQualityUpdates](#configuredeadlinenoautorebootforqualityupdates)
|
||||
- [Manage updates offered from Windows Update](#manage-updates-offered-from-windows-update)
|
||||
@ -100,6 +101,68 @@ Update CSP policies are listed below based on the group policy area:
|
||||
|
||||
## Windows Insider Preview
|
||||
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-Begin -->
|
||||
### AlwaysAutoRebootAtScheduledTimeMinutes
|
||||
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-Applicability-End -->
|
||||
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/Update/AlwaysAutoRebootAtScheduledTimeMinutes
|
||||
```
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-OmaUri-End -->
|
||||
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-Description-Begin -->
|
||||
<!-- Description-Source-ADMX -->
|
||||
|
||||
- If you enable this policy, a restart timer will always begin immediately after Windows Update installs important updates, instead of first notifying users on the login screen for at least two days.
|
||||
|
||||
The restart timer can be configured to start with any value from 15 to 180 minutes. When the timer runs out, the restart will proceed even if the PC has signed-in users.
|
||||
|
||||
- If you disable or don't configure this policy, Windows Update won't alter its restart behavior.
|
||||
|
||||
If the "No auto-restart with logged-on users for scheduled automatic updates installations" policy is enabled, then this policy has no effect.
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-Description-End -->
|
||||
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-Editable-End -->
|
||||
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | `int` |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Range: `[15-180]` |
|
||||
| Default Value | 15 |
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-DFProperties-End -->
|
||||
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-GpMapping-Begin -->
|
||||
**Group policy mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | AlwaysAutoRebootAtScheduledTime |
|
||||
| Friendly Name | Always automatically restart at the scheduled time |
|
||||
| Element Name | work (minutes) |
|
||||
| Location | Computer Configuration |
|
||||
| Path | Windows Components > Windows Update > Manage end user experience |
|
||||
| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
|
||||
| ADMX File Name | WindowsUpdate.admx |
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-GpMapping-End -->
|
||||
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-Examples-End -->
|
||||
|
||||
<!-- AlwaysAutoRebootAtScheduledTimeMinutes-End -->
|
||||
|
||||
<!-- ConfigureDeadlineNoAutoRebootForFeatureUpdates-Begin -->
|
||||
### ConfigureDeadlineNoAutoRebootForFeatureUpdates
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: WindowsAI Policy CSP
|
||||
description: Learn more about the WindowsAI Area in Policy CSP.
|
||||
ms.date: 06/13/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -142,6 +142,9 @@ This policy setting allows you to control whether Windows saves snapshots of the
|
||||
<!-- TurnOffWindowsCopilot-Begin -->
|
||||
## TurnOffWindowsCopilot
|
||||
|
||||
> [!NOTE]
|
||||
> This policy is deprecated and may be removed in a future release.
|
||||
|
||||
<!-- TurnOffWindowsCopilot-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: PrinterProvisioning DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the PrinterProvisioning configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.22000, 10.0.19044.1806, 10.0.19043.1806, 10.0.19042.1806</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Reboot DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the Reboot configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the R
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.14393</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: RootCATrustedCertificates DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the RootCATrustedCertificates configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the R
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -1067,7 +1067,7 @@ The following XML file contains the device description framework (DDF) for the R
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: SecureAssessment DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the SecureAssessment configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the S
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.15063</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: SharedPC DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the SharedPC configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the S
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.14393</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: SUPL DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the SUPL configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the S
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10240</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: VPNv2 DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the VPNv2 configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the V
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -3265,7 +3265,7 @@ The following XML file contains the device description framework (DDF) for the V
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: WiFi DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the WiFi configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the W
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -322,7 +322,7 @@ The following XML file contains the device description framework (DDF) for the W
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: WindowsDefenderApplicationGuard DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the WindowsDefenderApplicationGuard configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the W
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.16299</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.1</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: WindowsLicensing DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the WindowsLicensing configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the W
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xB4;0xBC;0xBD;0xBF;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: WiredNetwork DDF file
|
||||
description: View the XML file containing the device description framework (DDF) for the WiredNetwork configuration service provider.
|
||||
ms.date: 04/10/2024
|
||||
ms.date: 06/19/2024
|
||||
---
|
||||
|
||||
<!-- Auto-Generated CSP Document -->
|
||||
@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the W
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.17763</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -118,7 +118,7 @@ The following XML file contains the device description framework (DDF) for the W
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.17763</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;</MSFT:EditionAllowList>
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: What is Shell Launcher?
|
||||
description: Learn how to configure devices with Shell Launcher.
|
||||
ms.date: 02/29/2024
|
||||
ms.date: 06/18/2024
|
||||
ms.topic: overview
|
||||
---
|
||||
|
||||
@ -126,4 +126,6 @@ Depending on your configuration, you can have a user to automatically sign in to
|
||||
|
||||
<!--links-->
|
||||
|
||||
[MEM-1]: /mem/intune/configuration/custom-settings-windows-10
|
||||
[MEM-1]: /mem/intune/configuration/custom-settings-windows-10
|
||||
[MEM-2]: /mem/intune/fundamentals/licenses#device-only-licenses
|
||||
[WIN-3]: /windows/client-management/mdm/assignedaccess-csp
|
||||
|
||||
@ -13,6 +13,8 @@
|
||||
href: update/release-cycle.md
|
||||
- name: Basics of Windows updates, channels, and tools
|
||||
href: update/get-started-updates-channels-tools.md
|
||||
- name: Defining Windows update-managed devices
|
||||
href: update/update-managed-unmanaged-devices.md
|
||||
- name: Prepare servicing strategy for Windows client updates
|
||||
href: update/waas-servicing-strategy-windows-10-updates.md
|
||||
- name: Deployment proof of concept
|
||||
@ -113,7 +115,7 @@
|
||||
- name: Deploy updates with Group Policy
|
||||
href: update/waas-wufb-group-policy.md
|
||||
- name: Deploy updates using CSPs and MDM
|
||||
href: update/waas-wufb-csp-mdm.md
|
||||
href: update/waas-wufb-csp-mdm.md
|
||||
- name: Update Windows client media with Dynamic Update
|
||||
href: update/media-dynamic-update.md
|
||||
- name: Migrating and acquiring optional Windows content
|
||||
@ -377,7 +379,7 @@
|
||||
- name: Delivery Optimization reference
|
||||
href: do/waas-delivery-optimization-reference.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json
|
||||
- name: FoD and language packs for WSUS and Configuration Manager
|
||||
href: update/fod-and-lang-packs.md
|
||||
href: update/fod-and-lang-packs.md
|
||||
- name: Windows client in S mode
|
||||
href: s-mode.md
|
||||
- name: Switch to Windows client Pro or Enterprise from S mode
|
||||
|
||||
@ -20,7 +20,7 @@ appliesto:
|
||||
# Microsoft Connected Cache for Internet Service Providers (early preview)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This document is for Microsoft Connected Cache (early preview). Microsoft Connected Cache for ISPs is now in Public Preview - for our early preview customers, we highly encourage you to migrate your cache nodes to our public preview. See [instructions on how to migrate](#migrating-your-mcc-to-public-preview) below.
|
||||
> This document is for Microsoft Connected Cache (early preview). Microsoft Connected Cache for ISPs is now in Public Preview - for our early preview customers, we highly encourage you to onboard onto our Public Preview program. For instructions on signing up and onboarding please visit [Operator sign up and service onboarding for Microsoft Connected Cache](mcc-isp-signup.md).
|
||||
|
||||
## Overview
|
||||
|
||||
@ -441,6 +441,13 @@ If the test fails, for more information, see the [common issues](#common-issues)
|
||||
|
||||
## Common Issues
|
||||
|
||||
### Microsoft Connected Cache is no longer serving traffic
|
||||
If you did not migrate your cache node then your cache node may still be on early preview version.
|
||||
Microsoft Connected Cache for Internet Service Providers is now in Public Preview! To get started, visit [Azure portal](https://www.portal.azure.com) to sign up for Microsoft Connected Cache for Internet Service Providers. Please see [Operator sign up and service onboarding for Microsoft Connected Cache](mcc-isp-signup.md) for more information on the requirements for sign up and onboarding.
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
> [!NOTE]
|
||||
> This section only lists common issues. For more information on additional issues you may encounter when configuring IoT Edge, see the [IoT Edge troubleshooting guide](/azure/iot-edge/troubleshoot).
|
||||
|
||||
@ -551,19 +558,6 @@ If you have an MCC that's already active and running, follow the steps below to
|
||||
|
||||
1. To finish configuring your MCC with BGP routing, continue from Step 10 of [Steps to Install MCC](#steps-to-install-mcc). -->
|
||||
|
||||
## Migrating your MCC to Public Preview
|
||||
|
||||
> [!NOTE]
|
||||
> Please note, if you reboot your server, the version that you are currently on will no longer function, after which you will be required to migrate to the new version.
|
||||
|
||||
We recommend migrating now to the new version to access these benefits and ensure no downtime.
|
||||
|
||||
To migrate, use the following steps:
|
||||
|
||||
1. Navigate to the cache node that you would like to migrate and select **Download Migration Package** using the button at the top of the page.
|
||||
1. Follow the instructions under the **Connected Cache Migrate Scripts** section within Azure portal.
|
||||
:::image type="content" source="images/mcc-isp-migrate.png" alt-text="A screenshot of Azure portal showing the migration instructions for migrating a cache node from the early preview to the public preview." lightbox="images/mcc-isp-migrate.png":::
|
||||
1. Go to https://portal.azure.com and navigate to your resource to check your migrated cache nodes.
|
||||
|
||||
## Uninstalling MCC
|
||||
|
||||
|
||||
@ -0,0 +1,71 @@
|
||||
---
|
||||
title: Defining Windows update-managed devices
|
||||
description: This article provides clarity on the terminology and practices involved in managing Windows updates for both managed and unmanaged devices.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: overview
|
||||
ms.date: 06/25/2024
|
||||
author: mikolding
|
||||
ms.author: v-mikolding
|
||||
ms.reviewer: mstewart,thtrombl,v-fvalentyna,arcarley
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
---
|
||||
|
||||
# Defining Windows update-managed devices
|
||||
|
||||
As an IT administrator, understanding the differences between managed and unmanaged devices is crucial for effective Windows update management. This article provides clarity on the terminology and practices involved in managing Windows updates for both types of devices.
|
||||
|
||||
## What are update-managed Windows devices?
|
||||
|
||||
Update-managed devices are those where an IT administrator or organization controls Windows updates through a management tool, such as Microsoft Intune, or by directly setting policies. You can directly set policies with group policy objects (GPO), configuration service provider (CSP) policies, or Microsoft Graph.
|
||||
|
||||
> [!NOTE]
|
||||
> This definition is true even if you directly set registry keys. However, we don't recommended doing this action because registry keys can be easily overwritten.
|
||||
|
||||
Managed devices can include desktops, laptops, tablets, servers, and manufacturing equipment. These devices are secured and configured according to your organization's standards and policies.
|
||||
|
||||
### IT-managed: Windows update offering
|
||||
|
||||
Devices are considered Windows update-managed if you manage the update offering in the following ways:
|
||||
|
||||
- You configure policies to manage which updates are offered to the specific device.
|
||||
- You set when your organization should receive feature, quality, and driver updates, among others.
|
||||
- You use [group policy objects (GPO)](/windows/deployment/update/waas-wufb-group-policy), [configuration service provider (CSP)](/windows/client-management/mdm/policy-csp-update#update-allowupdateservice), or [Microsoft Graph](/windows/deployment/update/deployment-service-overview) to configure these offerings.
|
||||
|
||||
### IT-managed: Windows update experience
|
||||
|
||||
Devices are considered Windows update-managed if you use policies (GPO, CSP, or Microsoft Graph) to manage device behavior when taking Windows updates.
|
||||
|
||||
Examples of controllable device behavior include active hours, update grace periods and deadlines, update notifications, update scheduling, and more. Consult the complete list at [Update Policy CSP](/windows/client-management/mdm/policy-csp-update).
|
||||
|
||||
## Examples of update-managed Windows devices
|
||||
|
||||
Here are a few examples of update-managed devices:
|
||||
|
||||
- **Company-owned devices:** Devices provisioned by your IT department with corporate credentials, configurations, and policies.
|
||||
- **Employee-owned devices in BYOD programs:** Personally owned devices that are enrolled in the company's device management system to securely access corporate resources.
|
||||
- **Devices provisioned through Windows Autopilot:** Devices that are set up and preconfigured to be business-ready right out of the box.
|
||||
- **Mandated security settings:** Devices with health requirements such as device encryption, PIN or strong password, specific inactivity timeout periods, and up-to-date operating systems.
|
||||
- **Intune-enrolled devices:** Devices enrolled in Microsoft Intune for network access and enforced security policies.
|
||||
- **Third-party managed devices:** Devices enrolled in non-Microsoft management tools with configured Windows update policies via GPO, CSP, or registry key.
|
||||
|
||||
## What are update-unmanaged Windows devices?
|
||||
|
||||
Unlike update-managed devices, unmanaged devices aren't controlled through policies, management tools, or software. These devices aren't enrolled in tools like Microsoft Intune or Configuration Manager. If you only configure the Settings page to control overall device behavior when taking updates, it's considered an unmanaged device.
|
||||
|
||||
> [!NOTE]
|
||||
> The term "Microsoft managed devices" used to refer to what we now call "update unmanaged Windows devices." Based on feedback, we have updated our terminology for clarity.
|
||||
|
||||
## Examples of update-unmanaged Windows devices
|
||||
|
||||
Examples of update-unmanaged devices include:
|
||||
|
||||
- **Personal devices:** Devices owned by individuals at your organization that aren't enrolled in any corporate management system.
|
||||
- **BYOD devices not enrolled in management programs:** Devices used for work but not part of an organizational bring your own device (BYOD) program.
|
||||
- **Peripheral devices:** Devices like printers, IP phones, and uninterruptible power supplies (UPS) that can't accept centrally managed administrative credentials.
|
||||
|
||||
For more information on managed and unmanaged devices, see [Secure managed and unmanaged devices](/microsoft-365/business-premium/m365bp-managed-unmanaged-devices).
|
||||
@ -53,6 +53,7 @@ The following is a list of other Microsoft products that might be updated:
|
||||
- Microsoft StreamInsight
|
||||
- Mobile and IoT
|
||||
- MSRC
|
||||
- .NET (also known as .NET Core)
|
||||
- Office 2016 (MSI versions of Office)
|
||||
- PlayReady
|
||||
- Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware
|
||||
|
||||
@ -7,7 +7,7 @@ ms.localizationpriority: high
|
||||
author: DHB-MSFT
|
||||
ms.author: danbrown
|
||||
manager: laurawi
|
||||
ms.date: 06/04/2020
|
||||
ms.date: 06/27/2024
|
||||
ms.topic: conceptual
|
||||
ms.collection: privacy-windows
|
||||
---
|
||||
@ -60,16 +60,16 @@ A final set of changes includes two new policies that can help you fine-tune dia
|
||||
|
||||
- The **Limit dump collection** policy is a new policy that can be used to limit the types of [crash dumps](/windows/win32/dxtecharts/crash-dump-analysis) that can be sent back to Microsoft. If this policy is enabled, Windows Error Reporting will send only kernel mini dumps and user mode triage dumps.
|
||||
- Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Dump Collection**
|
||||
- MDM policy: System/LimitDumpCollection
|
||||
- MDM policy: System/LimitDumpCollection
|
||||
- The **Limit diagnostic log collection** policy is another new policy that limits the number of diagnostic logs that are sent back to Microsoft. If this policy is enabled, diagnostic logs aren't sent back to Microsoft.
|
||||
- Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Diagnostic Log Collection**
|
||||
- MDM policy: System/LimitDiagnosticLogCollection
|
||||
|
||||
For more info, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
|
||||
For more information, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
|
||||
|
||||
## Services that rely on Enhanced diagnostic data
|
||||
|
||||
Customers who use services that depend on Windows diagnostic data, such as [Microsoft Managed Desktop](/microsoft-365/managed-desktop/service-description/device-policies#windows-diagnostic-data), may be impacted by the behavioral changes when they're released. These services will be updated to address these changes and guidance will be published on how to configure them properly.
|
||||
Customers who use services that depend on Windows diagnostic data, such as [Microsoft Managed Desktop](/managed-desktop/operate/device-policies#windows-diagnostic-data), may be impacted by the behavioral changes when they're released. These services will be updated to address these changes and guidance will be published on how to configure them properly.
|
||||
|
||||
## Significant change to the Windows diagnostic data processor configuration
|
||||
|
||||
@ -78,7 +78,7 @@ Customers who use services that depend on Windows diagnostic data, such as [Micr
|
||||
> - Windows 10, versions 20H2, 21H2, 22H2, and newer
|
||||
> - Windows 11, versions 21H2, 22H2, 23H2, and newer
|
||||
|
||||
Previously, IT admins could use policies (for example, the “Allow commercial data pipeline” policy) at the individual device level to enroll devices in the Windows diagnostic data processor configuration.
|
||||
Previously, IT admins could use policies (for example, the "Allow commercial data pipeline" policy) at the individual device level to enroll devices in the Windows diagnostic data processor configuration.
|
||||
|
||||
Starting with the January 2023 preview cumulative update, how you enable the processor configuration option depends on the billing address of the Azure AD tenant to which your devices are joined.
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ metadata:
|
||||
description: Learn about how privacy is managed in Windows.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-privacy
|
||||
ms.topic: hub-page # Required
|
||||
ms.topic: hub-page
|
||||
ms.collection:
|
||||
- highpri
|
||||
- essentials-privacy
|
||||
@ -17,162 +17,49 @@ metadata:
|
||||
author: DHB-MSFT
|
||||
ms.author: danbrown
|
||||
manager: laurawi
|
||||
ms.date: 09/08/2021 #Required; mm/dd/yyyy format.
|
||||
ms.date: 06/27/2024
|
||||
ms.localizationpriority: high
|
||||
|
||||
# highlightedContent section (optional)
|
||||
# Maximum of 8 items
|
||||
highlightedContent:
|
||||
# itemType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
|
||||
items:
|
||||
# Card
|
||||
- title: Windows privacy & compliance guide for IT and compliance professionals
|
||||
itemType: overview
|
||||
url: Windows-10-and-privacy-compliance.md
|
||||
# Card
|
||||
- title: Configure Windows diagnostic data
|
||||
itemType: how-to-guide
|
||||
url: configure-windows-diagnostic-data-in-your-organization.md
|
||||
# Card
|
||||
- title: View Windows diagnostic data
|
||||
itemType: how-to-guide
|
||||
url: diagnostic-data-viewer-overview.md
|
||||
|
||||
# productDirectory section (optional)
|
||||
productDirectory:
|
||||
title: Understand Windows diagnostic data in Windows 10 and Windows 11
|
||||
summary: For the latest Windows 10 version and Windows 11, learn more about what Windows diagnostic data is collected under the different settings.
|
||||
items:
|
||||
# Card
|
||||
- title: Windows 11 required diagnostic data
|
||||
# imageSrc should be square in ratio with no whitespace
|
||||
imageSrc: /media/common/i_extend.svg
|
||||
summary: Learn more about basic Windows diagnostic data events and fields collected.
|
||||
url: required-diagnostic-events-fields-windows-11-22H2.md
|
||||
# Card
|
||||
- title: Windows 10 required diagnostic data
|
||||
imageSrc: /media/common/i_build.svg
|
||||
summary: See what changes Windows is making to align to the new data collection taxonomy
|
||||
url: required-windows-diagnostic-data-events-and-fields-2004.md
|
||||
# Card
|
||||
- title: Optional diagnostic data
|
||||
imageSrc: /media/common/i_get-started.svg
|
||||
summary: Get examples of the types of optional diagnostic data collected from Windows
|
||||
url: windows-diagnostic-data.md
|
||||
|
||||
# conceptualContent section (optional)
|
||||
# conceptualContent:
|
||||
# # itemType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
|
||||
# title: sectiontitle # < 60 chars (optional)
|
||||
# summary: sectionsummary # < 160 chars (optional)
|
||||
# items:
|
||||
# # Card
|
||||
# - title: cardtitle1
|
||||
# links:
|
||||
# - url: file1.md OR https://learn.microsoft.com/file1
|
||||
# itemType: itemType
|
||||
# text: linktext1
|
||||
# - url: file2.md OR https://learn.microsoft.com/file2
|
||||
# itemType: itemType
|
||||
# text: linktext2
|
||||
# - url: file3.md OR https://learn.microsoft.com/file3
|
||||
# itemType: itemType
|
||||
# text: linktext3
|
||||
# # footerLink (optional)
|
||||
# footerLink:
|
||||
# url: filefooter.md OR https://learn.microsoft.com/filefooter
|
||||
# text: See more
|
||||
# # Card
|
||||
# - title: cardtitle2
|
||||
# links:
|
||||
# - url: file1.md OR https://learn.microsoft.com/file1
|
||||
# itemType: itemType
|
||||
# text: linktext1
|
||||
# - url: file2.md OR https://learn.microsoft.com/file2
|
||||
# itemType: itemType
|
||||
# text: linktext2
|
||||
# - url: file3.md OR https://learn.microsoft.com/file3
|
||||
# itemType: itemType
|
||||
# text: linktext3
|
||||
# # footerLink (optional)
|
||||
# footerLink:
|
||||
# url: filefooter.md OR https://learn.microsoft.com/filefooter
|
||||
# text: See more
|
||||
# # Card
|
||||
# - title: cardtitle3
|
||||
# links:
|
||||
# - url: file1.md OR https://learn.microsoft.com/file1
|
||||
# itemType: itemType
|
||||
# text: linktext1
|
||||
# - url: file2.md OR https://learn.microsoft.com/file2
|
||||
# itemType: itemType
|
||||
# text: linktext2
|
||||
# - url: file3.md OR https://learn.microsoft.com/file3
|
||||
# itemType: itemType
|
||||
# text: linktext3
|
||||
# # footerLink (optional)
|
||||
# footerLink:
|
||||
# url: filefooter.md OR https://learn.microsoft.com/filefooter
|
||||
# text: See more
|
||||
|
||||
# # tools section (optional)
|
||||
# tools:
|
||||
# title: sectiontitle # < 60 chars (optional)
|
||||
# summary: sectionsummary # < 160 chars (optional)
|
||||
# items:
|
||||
# # Card
|
||||
# - title: cardtitle1
|
||||
# # imageSrc should be square in ratio with no whitespace
|
||||
# imageSrc: ./media/index/image1.svg OR https://learn.microsoft.com/media/logos/image1.svg
|
||||
# url: file1.md
|
||||
# # Card
|
||||
# - title: cardtitle2
|
||||
# imageSrc: ./media/index/image2.svg OR https://learn.microsoft.com/media/logos/image2.svg
|
||||
# url: file2.md
|
||||
# # Card
|
||||
# - title: cardtitle3
|
||||
# imageSrc: ./media/index/image3.svg OR https://learn.microsoft.com/media/logos/image3.svg
|
||||
# url: file3.md
|
||||
|
||||
# additionalContent section (optional)
|
||||
# Card with summary style
|
||||
# additionalContent:
|
||||
# # Supports up to 3 sections
|
||||
# sections:
|
||||
# - title: sectiontitle # < 60 chars (optional)
|
||||
# summary: sectionsummary # < 160 chars (optional)
|
||||
# items:
|
||||
# # Card
|
||||
# - title: cardtitle1
|
||||
# summary: cardsummary1
|
||||
# url: file1.md OR https://learn.microsoft.com/file1
|
||||
# # Card
|
||||
# - title: cardtitle2
|
||||
# summary: cardsummary2
|
||||
# url: file1.md OR https://learn.microsoft.com/file2
|
||||
# # Card
|
||||
# - title: cardtitle3
|
||||
# summary: cardsummary3
|
||||
# url: file1.md OR https://learn.microsoft.com/file3
|
||||
# # footer (optional)
|
||||
# footer: "footertext [linktext](/footerfile)"
|
||||
|
||||
# additionalContent section (optional)
|
||||
# Card with links style
|
||||
additionalContent:
|
||||
# Supports up to 3 sections
|
||||
sections:
|
||||
- items:
|
||||
# Card
|
||||
- title: View and manage Windows 10 connection endpoints
|
||||
links:
|
||||
- text: Manage Windows 10 connection endpoints
|
||||
url: ./manage-windows-2004-endpoints.md
|
||||
url: ./manage-windows-21h2-endpoints.md
|
||||
- text: Manage connection endpoints for non-Enterprise editions of Windows 10
|
||||
url: windows-endpoints-2004-non-enterprise-editions.md
|
||||
url: windows-endpoints-21h1-non-enterprise-editions.md
|
||||
- text: Manage connections from Windows to Microsoft services
|
||||
url: manage-connections-from-windows-operating-system-components-to-microsoft-services.md
|
||||
# Card
|
||||
- title: Additional resources
|
||||
links:
|
||||
- text: Windows 10 on Trust Center
|
||||
@ -181,5 +68,4 @@ additionalContent:
|
||||
url: /microsoft-365/compliance/gdpr
|
||||
- text: Support for GDPR Accountability on Service Trust Portal
|
||||
url: https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted
|
||||
# footer (optional)
|
||||
# footer: "footertext [linktext](/footerfile)"
|
||||
|
||||
|
||||
@ -7,7 +7,7 @@ ms.localizationpriority: high
|
||||
author: DHB-MSFT
|
||||
ms.author: danbrown
|
||||
manager: laurawi
|
||||
ms.date: 03/07/2016
|
||||
ms.date: 06/27/2024
|
||||
ms.topic: reference
|
||||
---
|
||||
|
||||
@ -537,6 +537,9 @@ To turn off Live Tiles:
|
||||
|
||||
### <a href="" id="bkmk-mailsync"></a>11. Mail synchronization
|
||||
|
||||
> [!NOTE]
|
||||
> The Mail app and mail synchronization aren't available on Windows Server.
|
||||
|
||||
To turn off mail synchronization for Microsoft Accounts that are configured on a device:
|
||||
|
||||
- In **Settings** > **Accounts** > **Your email and accounts**, remove any connected Microsoft Accounts.
|
||||
@ -1607,7 +1610,7 @@ You can disable Teredo by using Group Policy or by using the netsh.exe command.
|
||||
|
||||
-or-
|
||||
|
||||
- Create a new REG_SZ registry setting named **Teredo_State** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TCPIP\\v6Transition** with a value of **Disabled**.
|
||||
- Create a new REG_SZ registry setting named **Teredo_State** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TCPIP\\v6Transition** with a value of `Disabled`.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-wifisense"></a>23. Wi-Fi Sense
|
||||
|
||||
@ -42,7 +42,7 @@ We used the following methodology to derive these network endpoints:
|
||||
|\*.g.akamai.net | HTTPS | Used to check for updates to maps that have been downloaded for offline use.
|
||||
|\*.msn.com\* |TLSv1.2/HTTPS | Windows Spotlight related traffic
|
||||
|\*.Skype.com | HTTP/HTTPS | Skype related traffic
|
||||
|\*.smartscreen.microsoft.com\* | HTTPS | Windows Defender Smartscreen related traffic
|
||||
|\*.smartscreen.microsoft.com | HTTPS | Windows Defender Smartscreen related traffic
|
||||
|\*.telecommand.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting.
|
||||
|\*cdn.onenote.net* | HTTP | OneNote related traffic
|
||||
|\*displaycatalog.mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store.
|
||||
|
||||
@ -49,7 +49,7 @@ The following methodology was used to derive the network endpoints:
|
||||
| \*.login.msa.\*.net | HTTPS | Microsoft Account related
|
||||
| \*.msn.com\* | TLSv1.2/HTTPS | Windows Spotlight
|
||||
| \*.skype.com | HTTP/HTTPS | Skype
|
||||
| \*.smartscreen.microsoft.com\* | HTTPS | Windows Defender Smartscreen
|
||||
| \*.smartscreen.microsoft.com | HTTPS | Windows Defender Smartscreen
|
||||
| \*.telecommand.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting
|
||||
| \*cdn.onenote.net\* | HTTP | OneNote
|
||||
| \*displaycatalog.\*mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
ms.date: 08/31/2023
|
||||
ms.date: 06/20/2024
|
||||
title: Additional mitigations
|
||||
description: Learn how to improve the security of your domain environment with additional mitigations for Credential Guard and sample code.
|
||||
ms.topic: reference
|
||||
@ -46,8 +46,8 @@ Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring,
|
||||
To enable Kerberos armoring for restricting domain users to specific domain-joined devices:
|
||||
|
||||
- Users need to be in domains that are running Windows Server 2012 R2 or higher
|
||||
- All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**.
|
||||
- All the devices with Credential Guard that the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**.
|
||||
- All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**
|
||||
- All the devices with Credential Guard that the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** > **Administrative Templates** > **System** > **Kerberos**.
|
||||
|
||||
### Protect domain-joined device secrets
|
||||
|
||||
@ -56,7 +56,7 @@ Since domain-joined devices also use shared secrets for authentication, attacker
|
||||
Domain-joined device certificate authentication has the following requirements:
|
||||
|
||||
- Devices' accounts are in Windows Server 2012 domain functional level or higher.
|
||||
- All domain controllers in those domains have KDC certificates which satisfy strict KDC validation certificate requirements:
|
||||
- All domain controllers in those domains have KDC certificates that satisfy strict KDC validation certificate requirements:
|
||||
- KDC EKU present
|
||||
- DNS domain name matches the DNSName field of the SubjectAltName (SAN) extension
|
||||
- Windows devices have the CA issuing the domain controller certificates in the enterprise store.
|
||||
@ -70,19 +70,19 @@ For example, let's say you wanted to use the High Assurance policy only on these
|
||||
|
||||
**Create a new certificate template**
|
||||
|
||||
1. From the Certificate Manager console, right-click **Certificate Templates > Manage**
|
||||
1. Right-click **Workstation Authentication > Duplicate Template**
|
||||
1. Right-click the new template, and then select **Properties**
|
||||
1. On the **Extensions** tab, select **Application Policies > Edit**
|
||||
1. Select **Client Authentication**, and then select **Remove**
|
||||
1. Add the ID-PKInit-KPClientAuth EKU. Select **Add > New**, and then specify the following values:
|
||||
- Name: Kerberos Client Auth
|
||||
- Object Identifier: 1.3.6.1.5.2.3.4
|
||||
1. On the **Extensions** tab, select **Issuance Policies > Edit**
|
||||
1. Under **Issuance Policies**, select **High Assurance**
|
||||
1. On the **Subject name** tab, clear the **DNS name** check box, and then select the **User Principal Name (UPN)** check box
|
||||
1. From the Certificate Manager console, right-click **Certificate Templates > Manage**
|
||||
1. Right-click **Workstation Authentication > Duplicate Template**
|
||||
1. Right-click the new template, and then select **Properties**
|
||||
1. On the **Extensions** tab, select **Application Policies > Edit**
|
||||
1. Select **Client Authentication**, and then select **Remove**
|
||||
1. Add the ID-PKInit-KPClientAuth EKU. Select **Add > New**, and then specify the following values:
|
||||
- Name: Kerberos Client Auth
|
||||
- Object Identifier: 1.3.6.1.5.2.3.4
|
||||
1. On the **Extensions** tab, select **Issuance Policies > Edit**
|
||||
1. Under **Issuance Policies**, select **High Assurance**
|
||||
1. On the **Subject name** tab, clear the **DNS name** check box, and then select the **User Principal Name (UPN)** check box
|
||||
|
||||
Then on the devices that are running Credential Guard, enroll the devices using the certificate you just created.
|
||||
Then on the devices that are running Credential Guard, enroll the devices using the certificate you created.
|
||||
|
||||
**Enroll devices in a certificate**
|
||||
|
||||
@ -123,12 +123,13 @@ So we now have completed the following:
|
||||
|
||||
- Created a special certificate issuance policy to identify devices that meet the deployment criteria required for the user to be able to sign on
|
||||
- Mapped that policy to a universal security group or claim
|
||||
- Provided a way for domain controllers to get the device authorization data during user sign-on using Kerberos armoring. Now what is left to do is to configure the access check on the domain controllers. This is done using authentication policies.
|
||||
- Provided a way for domain controllers to get the device authorization data during user sign-on using Kerberos armoring. Now what is left to do is to configure the access check on the domain controllers. This is done using authentication policies
|
||||
|
||||
Authentication policies have the following requirements:
|
||||
- User accounts are in a Windows Server 2012 domain functional level or higher domain.
|
||||
|
||||
**Creating an authentication policy restricting users to the specific universal security group**
|
||||
- User accounts are in a Windows Server 2012 domain functional level or higher domain
|
||||
|
||||
#### Create an authentication policy restricting users to the specific universal security group
|
||||
|
||||
1. Open Active Directory Administrative Center
|
||||
1. Select **Authentication > New > Authentication Policy**
|
||||
@ -154,7 +155,7 @@ To learn more about authentication policy events, see [Authentication Policies a
|
||||
|
||||
## Appendix: Scripts
|
||||
|
||||
Here is a list of scripts mentioned in this topic.
|
||||
Here's a list of scripts mentioned in this article.
|
||||
|
||||
### <a href="" id="bkmk-getscript"></a>Get the available issuance policies on the certificate authority
|
||||
|
||||
@ -195,7 +196,7 @@ displayName = displayName : {0}
|
||||
Name = Name : {0}
|
||||
dn = distinguishedName : {0}
|
||||
InfoName = Linked Group Name: {0}
|
||||
InfoDN = Linked Group DN: {0}
|
||||
InfoDN = Linked Group DN: {0}
|
||||
NonLinkedIPs = The following Issuance Policies are NOT linked to groups:
|
||||
'@
|
||||
}
|
||||
@ -221,7 +222,7 @@ $getIP_strings.help8
|
||||
""
|
||||
$getIP_strings.help10
|
||||
""
|
||||
""
|
||||
""
|
||||
$getIP_strings.help11
|
||||
" " + '$' + "myIPs = .\get-IssuancePolicy.ps1 -LinkedToGroup:All"
|
||||
" " + '$' + "myLinkedIPs = .\get-IssuancePolicy.ps1 -LinkedToGroup:yes"
|
||||
@ -272,7 +273,7 @@ write-host $errormsg -ForegroundColor Red
|
||||
if (($LinkedToGroup -eq "yes") -or ($LinkedToGroup -eq "all")) {
|
||||
$LDAPFilter = "(&(objectClass=msPKI-Enterprise-Oid)(msDS-OIDToGroupLink=*)(flags=2))"
|
||||
$LinkedOIDs = get-adobject -searchBase $configNCDN -LDAPFilter $LDAPFilter -properties *
|
||||
write-host ""
|
||||
write-host ""
|
||||
write-host "*****************************************************"
|
||||
write-host $getIP_strings.LinkedIPs
|
||||
write-host "*****************************************************"
|
||||
@ -317,11 +318,11 @@ write-host "There are no issuance policies that are mapped to a group"
|
||||
return $LinkedOIDs
|
||||
break
|
||||
}
|
||||
}
|
||||
if (($LinkedToGroup -eq "no") -or ($LinkedToGroup -eq "all")) {
|
||||
}
|
||||
if (($LinkedToGroup -eq "no") -or ($LinkedToGroup -eq "all")) {
|
||||
$LDAPFilter = "(&(objectClass=msPKI-Enterprise-Oid)(!(msDS-OIDToGroupLink=*))(flags=2))"
|
||||
$NonLinkedOIDs = get-adobject -searchBase $configNCDN -LDAPFilter $LDAPFilter -properties *
|
||||
write-host ""
|
||||
write-host ""
|
||||
write-host "*********************************************************"
|
||||
write-host $getIP_strings.NonLinkedIPs
|
||||
write-host "*********************************************************"
|
||||
@ -385,7 +386,7 @@ confirmOUcreation = Warning: The Organizational Unit that you specified does not
|
||||
OUCreationSuccess = Organizational Unit "{0}" successfully created.
|
||||
OUcreationError = Error: Organizational Unit "{0}" could not be created.
|
||||
OUFoundSuccess = Organizational Unit "{0}" was successfully found.
|
||||
multipleGroups = Error: More than one group with name "{0}" was found in Organizational Unit "{1}".
|
||||
multipleGroups = Error: More than one group with name "{0}" was found in Organizational Unit "{1}".
|
||||
confirmGroupCreation = Warning: The group that you specified does not exist. Do you want to create it?
|
||||
groupCreationSuccess = Univeral Security group "{0}" successfully created.
|
||||
groupCreationError = Error: Univeral Security group "{0}" could not be created.
|
||||
@ -445,12 +446,12 @@ break
|
||||
$searchBase = [String]$root.configurationnamingcontext
|
||||
$OID = get-adobject -searchBase $searchBase -Filter { ((displayname -eq $IssuancePolicyName) -or (name -eq $IssuancePolicyName)) -and (objectClass -eq "msPKI-Enterprise-Oid")} -properties *
|
||||
if ($OID -eq $null) {
|
||||
$tmp = $ErrorMsg.NoIP -f $IssuancePolicyName, $searchBase
|
||||
$tmp = $ErrorMsg.NoIP -f $IssuancePolicyName, $searchBase
|
||||
write-host $tmp -ForeGroundColor Red
|
||||
break;
|
||||
}
|
||||
elseif ($OID.GetType().IsArray) {
|
||||
$tmp = $ErrorMsg.MultipleIPs -f $IssuancePolicyName, $searchBase
|
||||
$tmp = $ErrorMsg.MultipleIPs -f $IssuancePolicyName, $searchBase
|
||||
write-host $tmp -ForeGroundColor Red
|
||||
break;
|
||||
}
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure Credential Guard
|
||||
ms.date: 06/20/2024
|
||||
title: Configure Credential Guard
|
||||
description: Learn how to configure Credential Guard using MDM, Group Policy, or the registry.
|
||||
ms.date: 08/31/2023
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
@ -11,19 +11,16 @@ This article describes how to configure Credential Guard using Microsoft Intune,
|
||||
|
||||
## Default enablement
|
||||
|
||||
Starting in **Windows 11, version 22H2**, Credential Guard is turned on by default on devices that [meet the requirements](index.md#hardware-and-software-requirements). The default enablement is **without UEFI Lock**, which allows administrators to disable Credential Guard remotely, if needed.
|
||||
[!INCLUDE [windows-server-2025-preview](../../includes/windows-server-2025-preview.md)]
|
||||
|
||||
If Credential Guard or VBS are disabled *before* a device is updated to Windows 11, version 22H2 or later, default enablement doesn't overwrite the existing settings.
|
||||
Starting in Windows 11, 22H2 and Windows Server 2025 (preview), Credential Guard is [enabled by default on devices which meet the requirements](index.md#default-enablement).
|
||||
|
||||
While the default state of Credential Guard changed, system administrators can [enable](#enable-credential-guard) or [disable](#disable-credential-guard) it using one of the methods described in this article.
|
||||
System administrators can explicitly [enable](#enable-credential-guard) or [disable](#disable-credential-guard) Credential Guard using one of the methods described in this article. Explicitly configured values overwrite the default enablement state after a reboot.
|
||||
|
||||
If a device has Credential Guard explicitly turned off before updating to a newer version of Windows where Credential Guard is enabled by default, it will remain disabled even after the update.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> For information about known issues related to default enablement, see [Credential Guard: known issues](considerations-known-issues.md#single-sign-on-for-network-services-breaks-after-upgrading-to-windows-11-version-22h2).
|
||||
|
||||
> [!NOTE]
|
||||
> Devices running Windows 11 Pro/Pro Edu 22H2 or later may have Virtualization-based Security (VBS) and/or Credential Guard automatically enabled if they meet the other requirements for default enablement, and have previously run Credential Guard. For example if Credential Guard was enabled on an Enterprise device that later downgraded to Pro.
|
||||
>
|
||||
> To determine whether the Pro device is in this state, check if the following registry key exists: `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\IsolatedCredentialsRootSecret`. In this scenario, if you wish to disable VBS and Credential Guard, follow the instructions to [disable Virtualization-based Security](#disable-virtualization-based-security). If you wish to disable Credential Guard only, without disabling VBS, use the procedures to [disable Credential Guard](#disable-credential-guard).
|
||||
> For information about known issues related to default enablement, see [Credential Guard: known issues](considerations-known-issues.md).
|
||||
|
||||
## Enable Credential Guard
|
||||
|
||||
@ -124,7 +121,7 @@ You can use PowerShell to determine whether Credential Guard is running on a dev
|
||||
(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning
|
||||
```
|
||||
|
||||
The command generates the following output:
|
||||
The command generates the following output:
|
||||
|
||||
- **0**: Credential Guard is disabled (not running)
|
||||
- **1**: Credential Guard is enabled (running)
|
||||
@ -225,7 +222,7 @@ There are different options to disable Credential Guard. The option you choose d
|
||||
|
||||
- Credential Guard running in a virtual machine can be [disabled by the host](#disable-credential-guard-for-a-virtual-machine)
|
||||
- If Credential Guard is enabled **with UEFI Lock**, follow the procedure described in [disable Credential Guard with UEFI Lock](#disable-credential-guard-with-uefi-lock)
|
||||
- If Credential Guard is enabled **without UEFI Lock**, or as part of the automatic enablement in the Windows 11, version 22H2 update, use one of the following options to disable it:
|
||||
- If Credential Guard is enabled **without UEFI Lock**, or as part of the [default enablement update](index.md#default-enablement), use one of the following options to disable it:
|
||||
- Microsoft Intune/MDM
|
||||
- Group policy
|
||||
- Registry
|
||||
@ -256,7 +253,7 @@ Once the policy is applied, restart the device.
|
||||
|
||||
#### [:::image type="icon" source="../../images/icons/group-policy.svg" border="false"::: **GPO**](#tab/gpo)
|
||||
|
||||
### Disable Credential Guard with group policy
|
||||
### Disable Credential Guard with group policy
|
||||
|
||||
If Credential Guard is enabled via Group Policy and without UEFI Lock, disabling the same group policy setting disables Credential Guard.
|
||||
|
||||
|
||||
@ -1,40 +1,50 @@
|
||||
---
|
||||
ms.date: 08/31/2023
|
||||
ms.date: 06/20/2024
|
||||
title: Considerations and known issues when using Credential Guard
|
||||
description: Considerations, recommendations and known issues when using Credential Guard.
|
||||
description: Considerations, recommendations, and known issues when using Credential Guard.
|
||||
ms.topic: troubleshooting
|
||||
---
|
||||
|
||||
# Considerations and known issues when using Credential Guard
|
||||
|
||||
It's recommended that in addition to deploying Credential Guard, organizations move away from passwords to other authentication methods, such as Windows Hello for Business, FIDO 2 security keys or smart cards.
|
||||
Microsoft recommends that in addition to deploying Credential Guard, organizations move away from passwords to other authentication methods, such as Windows Hello for Business, FIDO 2 security keys, or smart cards.
|
||||
|
||||
## Upgrade considerations
|
||||
|
||||
[!INCLUDE [windows-server-2025-preview](../../includes/windows-server-2025-preview.md)]
|
||||
|
||||
As Credential Guard evolves and enhances its security features, newer versions of Windows running Credential Guard might affect previously functional scenarios. For instance, Credential Guard could restrict the use of certain credentials or components to thwart malware exploiting vulnerabilities.
|
||||
|
||||
It's advisable to thoroughly test operational scenarios within an organization before updating devices that utilize Credential Guard.
|
||||
|
||||
Upgrades to Windows 11, version 22H2, and Windows Server 2025 (preview) have Credential Guard [enabled by default](index.md#default-enablement) unless explicitly disabled.
|
||||
|
||||
## Wi-fi and VPN considerations
|
||||
|
||||
When you enable Credential Guard, you can no longer use NTLM classic authentication for single sign-on. You'll be forced to enter your credentials to use these protocols and can't save the credentials for future use.
|
||||
When Credential Guard is enabled, you can no longer use NTLM classic authentication (NTLMv1) for single-sign-on (SSO). You'll be forced to enter your credentials to use these protocols and can't save the credentials for future use.
|
||||
|
||||
If you're using WiFi and VPN endpoints that are based on MS-CHAPv2, they're subject to similar attacks as for NTLMv1.
|
||||
|
||||
For WiFi and VPN connections, it's recommended to move from MSCHAPv2-based connections (such as PEAP-MSCHAPv2 and EAP-MSCHAPv2), to certificate-based authentication (such as PEAP-TLS or EAP-TLS).
|
||||
|
||||
## Kerberos considerations
|
||||
## Delegation considerations
|
||||
|
||||
When you enable Credential Guard, you can no longer use Kerberos unconstrained delegation or DES encryption. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process.\
|
||||
Use constrained or resource-based Kerberos delegation instead.
|
||||
When Credential Guard is enabled, certain types of identity delegation are unusable, as their underlying authentication schemes are incompatible with Credential Guard or require supplied credentials.
|
||||
|
||||
When Credential Guard is enabled, [Credential Security Support Provider ("CredSSP")](/windows/win32/secauthn/credential-security-support-provider) is no longer able to use saved or SSO credentials, though cleartext credentials can still be supplied. CredSSP-based Delegation requires cleartext credentials to be supplied on the destination machine, and doesn't work with SSO once Credential Guard is enabled and blocks cleartext credential disclosure. Usage of [CredSSP for delegation](/windows/win32/secauthn/credential-security-support-provider), and in general, isn't recommended due to the risk of credential theft.
|
||||
|
||||
Kerberos Unconstrained delegation and DES are blocked by Credential Guard. [Unconstrained delegation](/defender-for-identity/security-assessment-unconstrained-kerberos#what-risk-does-unsecure-kerberos-delegation-pose-to-an-organization) isn't a recommended practice.
|
||||
|
||||
Instead [Kerberos](/windows-server/security/kerberos/kerberos-authentication-overview) or [Negotiate SSP](/windows/win32/secauthn/microsoft-negotiate) are recommended for authentication generally, and for delegation, [Kerberos Constrained Delegation](/windows-server/security/kerberos/kerberos-constrained-delegation-overview) and [Resource-Based Kerberos Constrained Delegation](/windows-server/security/kerberos/kerberos-constrained-delegation-overview#resource-based-constrained-delegation-across-domains) are recommended. These methods provide greater credential security overall, and are also compatible with Credential Guard.
|
||||
|
||||
## Non-Microsoft Security Support Providers considerations
|
||||
|
||||
Some non-Microsoft Security Support Providers (SSPs and APs) might not be compatible with Credential Guard because it doesn't allow non-Microsoft SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs aren't supported.\
|
||||
Some non-Microsoft Security Support Providers (SSPs and APs) might not be compatible with Credential Guard because it doesn't allow non-Microsoft SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs aren't supported.
|
||||
|
||||
It's recommended that custom implementations of SSPs/APs are tested with Credential Guard. SSPs and APs that depend on any undocumented or unsupported behaviors fail. For example, using the KerbQuerySupplementalCredentialsMessage API isn't supported. Replacing the NTLM or Kerberos SSPs with custom SSPs and APs.
|
||||
|
||||
For more information, see [Restrictions around Registering and Installing a Security Package](/windows/win32/secauthn/restrictions-around-registering-and-installing-a-security-package).
|
||||
|
||||
## Upgrade considerations
|
||||
|
||||
As the depth and breadth of protections provided by Credential Guard are increased, new releases of Windows with Credential Guard running may affect scenarios that were working in the past. For example, Credential Guard may block the use of a particular type of credential or a particular component to prevent malware from taking advantage of vulnerabilities.
|
||||
|
||||
Test scenarios required for operations in an organization before upgrading a device using Credential Guard.
|
||||
|
||||
## Saved Windows credentials considerations
|
||||
|
||||
*Credential Manager* allows you to store three types of credentials:
|
||||
@ -86,7 +96,7 @@ On domain-joined devices, DPAPI can recover user keys using a domain controller
|
||||
>[!IMPORTANT]
|
||||
> Best practice when clearing a TPM on a domain-joined device is to be on a network with connectivity to domain controllers. This ensures DPAPI functions and the user does not experience strange behavior.
|
||||
|
||||
Auto VPN configuration is protected with user DPAPI. User may not be able to use VPN to connect to domain controllers since the VPN configurations are lost.
|
||||
Auto VPN configuration is protected with user DPAPI. User might not be able to use VPN to connect to domain controllers since the VPN configurations are lost.
|
||||
If you must clear the TPM on a domain-joined device without connectivity to domain controllers, then you should consider the following.
|
||||
|
||||
Domain user sign-in on a domain-joined device after clearing a TPM for as long as there's no connectivity to a domain controller:
|
||||
@ -110,34 +120,38 @@ Credential Guard blocks certain authentication capabilities. Applications that r
|
||||
|
||||
This article describes known issues when Credential Guard is enabled.
|
||||
|
||||
### Single sign-on for Network services breaks after upgrading to Windows 11, version 22H2
|
||||
### Live migration with Hyper-V breaks when upgrading to Windows Server 2025 (preview)
|
||||
|
||||
Devices that use 802.1x wireless or wired network, RDP, or VPN connections that rely on insecure protocols with password-based authentication are unable to use SSO to sign in and are forced to manually re-authenticate in every new Windows session when Credential Guard is running.
|
||||
[!INCLUDE [windows-server-2025-preview](../../includes/windows-server-2025-preview.md)]
|
||||
|
||||
#### Affected devices
|
||||
Devices that use CredSSP-based Delegation might no longer be able to use [Live Migration with Hyper-V](/windows-server/virtualization/hyper-v/manage/live-migration-overview) after upgrading to Windows Server 2025 (preview). Applications and services that rely on live migration (such as [SCVMM](/system-center/vmm/overview)) might also be affected. CredSSP-based delegation is the default for Windows Server 2022 and earlier for live migration.
|
||||
|
||||
Any device with Credential Guard enabled may encounter the issue. As part of the Windows 11, version 22H2 update, eligible devices that didn't disable Credential Guard, have it enabled by default. This affected all devices on Enterprise (E3 and E5) and Education licenses, as well as some Pro licenses, as long as they met the [minimum hardware requirements](index.md#hardware-and-software-requirements).
|
||||
||Description|
|
||||
|-|-|
|
||||
| **Affected devices**|Any server with Credential Guard enabled might encounter this issue. Starting in Windows Server 2025 (preview), [Credential Guard is enabled by default](index.md#default-enablement-on-windows-server) on all domain-joined servers that aren't domain controllers. Default enablement of Credential Guard can be [preemptively blocked](configure.md#default-enablement) before upgrade.|
|
||||
| **Cause of the issue**|Live Migration with Hyper-V, and applications and services that rely on it, are affected by the issue if one or both ends of a given connection try to use CredSSP with Credential Guard enabled. With Credential Guard enabled, CredSSP can only utilize supplied credentials, not saved or SSO credentials. <br><br>If the source machine of a Live Migration uses CredSSP for delegation with Credential Guard enabled, the Live Migration fails. In most cases, Credential Guard's enablement state on the destination machine won't impact Live Migration. Live Migration also fails in cluster scenarios (for example, SCVMM), since any device might act as a source machine.|
|
||||
| **Resolution**|Instead of CredSSP Delegation, [Kerberos Constrained Delegation and Resource-Based Kerberos Constrained Delegation](/windows-server/security/kerberos/kerberos-constrained-delegation-overview) are recommended. These forms of delegation provide greater credential protections, in addition to being compatible with Credential Guard. Administrators of Hyper-V can [configure these types of delegation](/windows-server/virtualization/hyper-v/deploy/set-up-hosts-for-live-migration-without-failover-clustering#BKMK_Step1) manually or with the help of automated scripts.|
|
||||
|
||||
All Windows Pro devices that previously ran Credential Guard on an eligible license and later downgraded to Pro, and which still meet the [minimum hardware requirements](index.md#hardware-and-software-requirements), will receive default enablement.
|
||||
### Single sign-on for Network services breaks after upgrading to Windows 11, version 22H2 or Windows Server 2025 (preview)
|
||||
|
||||
Devices that use 802.1x wireless or wired network, RDP, or VPN connections that rely on insecure protocols with password-based authentication are unable to use SSO to sign in and are forced to manually reauthenticate in every new Windows session when Credential Guard is running.
|
||||
|
||||
||Description|
|
||||
|-|-|
|
||||
| **Affected devices**|Any device with Credential Guard enabled might encounter the issue. Starting in Windows 11, version 22H2, and Windows Server 2025 (preview), eligible devices that didn't disable Credential Guard, have it [enabled by default](index.md#default-enablement). This affects all devices on Enterprise (E3 and E5) and Education licenses, and some Pro licenses, as long as they meet the [minimum hardware requirements](index.md#hardware-and-software-requirements).<br><br>All Windows Pro devices that previously ran Credential Guard on an eligible license and later downgraded to Pro, and which still meet the [minimum hardware requirements](index.md#hardware-and-software-requirements), receive default enablement.|
|
||||
| **Cause of the issue**|Applications and services are affected by the issue when they rely on insecure protocols that use password-based authentication. Such protocols are considered insecure because they can lead to password disclosure on the client or the server, and Credential Guard blocks them. Affected protocols include:<br><br>- Kerberos unconstrained delegation (both SSO and supplied credentials are blocked)<br>- Kerberos when PKINIT uses RSA encryption instead of Diffie-Hellman (both SSO and supplied credentials are blocked)<br>- MS-CHAP (only SSO is blocked)<br>- WDigest (only SSO is blocked)<br>- NTLM v1 (only SSO is blocked) <br><br>**Note**: Since only SSO is blocked for MS-CHAP, WDigest, and NTLM v1, these protocols can still be used by prompting the user to supply credentials.|
|
||||
| **Resolution**|Microsoft recommends moving away from MSCHAPv2-based connections (for example, PEAP-MSCHAPv2 and EAP-MSCHAPv2), to certificate-based authentication (for example, PEAP-TLS or EAP-TLS). Credential Guard doesn't block certificate-based authentication.<br><br>For a more immediate, but less secure fix, [disable Credential Guard](configure.md#disable-credential-guard). Credential Guard doesn't have per-protocol or per-application policies, and it can either be turned on or off. If you disable Credential Guard, you leave stored domain credentials vulnerable to theft.|
|
||||
|
||||
> [!TIP]
|
||||
> To determine if a Windows Pro device receives default enablement when upgraded to **Windows 11, version 22H2**, check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`.
|
||||
> If it's present, the device enables Credential Guard after the update.
|
||||
> To prevent default enablement, configure your devices [to disable Credential Guard](configure.md#disable-credential-guard) before updating to a version which [received default enablement](index.md#default-enablement). If the setting is not configured (which is the default state) and if the device is eligible, the device automatically enable Credential Guard after the update.
|
||||
>
|
||||
> You can Credential Guard can be disabled after upgrade by following the [disablement instructions](configure.md#disable-credential-guard).
|
||||
|
||||
#### Cause of the issue
|
||||
|
||||
Applications and services are affected by the issue when they rely on insecure protocols that use password-based authentication. Such protocols are considered insecure because they can lead to password disclosure on the client or the server, and Credential Guard blocks them. Affected protocols include:
|
||||
|
||||
- Kerberos unconstrained delegation (both SSO and supplied credentials are blocked)
|
||||
- Kerberos when PKINIT uses RSA encryption instead of Diffie-Hellman (both SSO and supplied credentials are blocked)
|
||||
- MS-CHAP (only SSO is blocked)
|
||||
- WDigest (only SSO is blocked)
|
||||
- NTLM v1 (only SSO is blocked)
|
||||
> If Credential Guard is explicitly disabled, the device won't automatically enable Credential Guard after the update.
|
||||
|
||||
> [!NOTE]
|
||||
> Since only SSO is blocked for MS-CHAP, WDigest, and NTLM v1, these protocols can still be used by prompting the user to supply credentials.
|
||||
> To determine if a Windows Pro device receives default enablement when upgraded to **Windows 11, version 22H2** or **Windows Server 2025 (preview)**, check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`.
|
||||
> If it's present, the device enables Credential Guard after the update.
|
||||
>
|
||||
> Credential Guard can be disabled after upgrade by following the [disablement instructions](configure.md#disable-credential-guard).
|
||||
|
||||
#### How to confirm the issue
|
||||
|
||||
@ -186,22 +200,11 @@ MS-CHAP and NTLMv1 are relevant to the SSO breakage after the Windows 11, versio
|
||||
:::column-end:::
|
||||
:::row-end:::
|
||||
|
||||
#### How to fix the issue
|
||||
|
||||
We recommend moving away from MSCHAPv2-based connections, such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication, like PEAP-TLS or EAP-TLS. Credential Guard doesn't block certificate-based authentication.
|
||||
|
||||
For a more immediate, but less secure fix, [disable Credential Guard](configure.md#disable-credential-guard). Credential Guard doesn't have per-protocol or per-application policies, and it can either be turned on or off. If you disable Credential Guard, you leave stored domain credentials vulnerable to theft.
|
||||
|
||||
> [!TIP]
|
||||
> To prevent default enablement, configure your devices [to disable Credential Guard](configure.md#disable-credential-guard) before updating to Windows 11, version 22H2. If the setting is not configured (which is the default state) and if the device is eligible, the device automatically enable Credential Guard after the update.
|
||||
>
|
||||
> If Credential Guard is explicitly disabled, the device won't automatically enable Credential Guard after the update.
|
||||
|
||||
### Issues with non-Microsoft applications
|
||||
|
||||
The following issue affects MSCHAPv2:
|
||||
|
||||
- [Credential guard doesn't work with MSCHAPv2 configurations, of which Cisco ISE is a common enterprise implementation](https://quickview.cloudapps.cisco.com/quickview/bug/CSCul55352).
|
||||
- [Credential Guard doesn't work with MSCHAPv2 configurations, of which Cisco ISE is a common enterprise implementation](https://quickview.cloudapps.cisco.com/quickview/bug/CSCul55352).
|
||||
|
||||
The following issue affects the Java GSS API. See the following Oracle bug database article:
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
ms.date: 08/31/2023
|
||||
ms.date: 06/20/2024
|
||||
title: How Credential Guard works
|
||||
description: Learn how Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them.
|
||||
ms.topic: concept-article
|
||||
@ -7,18 +7,26 @@ ms.topic: concept-article
|
||||
|
||||
# How Credential Guard works
|
||||
|
||||
Kerberos, NTLM, and Credential Manager isolate secrets by using Virtualization-based security (VBS). Previous versions of Windows stored secrets in its process memory, in the Local Security Authority (LSA) process `lsass.exe`. With Credential Guard enabled, the LSA process in the operating system talks to a component called the *isolated LSA process* that stores and protects those secrets, `LSAIso.exe`. Data stored by the isolated LSA process is protected using VBS and isn't accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process.
|
||||
Kerberos, NTLM, and Credential Manager isolate secrets by using Virtualization-based security (VBS). Previous versions of Windows stored secrets in its process memory, in the Local Security Authority (LSA) process `lsass.exe`.
|
||||
|
||||
For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All the binaries are signed with a certificate that VBS trusts, and the signatures are validated before launching the file in the protected environment.
|
||||
:::row:::
|
||||
:::column span="2":::
|
||||
With Credential Guard enabled, the LSA process in the operating system talks to a component called the *isolated LSA process* that stores and protects those secrets, `LSAIso.exe`. Data stored by the isolated LSA process is protected using VBS and isn't accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process.
|
||||
|
||||
Here's a high-level overview on how the LSA is isolated by using Virtualization-based security:
|
||||
|
||||
:::image type="content" source="images/credguard.png" alt-text="Diagram of the Credential Guard architecture.":::
|
||||
For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All the binaries are signed with a certificate that VBS trusts, and the signatures are validated before launching the file in the protected environment.
|
||||
:::column-end:::
|
||||
:::column span="2":::
|
||||
:::image type="content" source="images/credential-guard-architecture.png" alt-text="Diagram of the Credential Guard architecture." lightbox="images/credential-guard-architecture.png" border="false":::
|
||||
:::column-end:::
|
||||
:::row-end:::
|
||||
|
||||
## Credential Guard protection limits
|
||||
|
||||
Some ways to store credentials aren't protected by Credential Guard, including:
|
||||
|
||||
- When Credential Guard is enabled, NTLMv1, MS-CHAPv2, Digest, and CredSSP can't use the signed-in credentials. Thus, single sign-on doesn't work with these protocols. However, applications can prompt for credentials or use credentials stored in the Windows Vault, which aren't protected by Credential Guard with any of these protocols
|
||||
> [!CAUTION]
|
||||
> It's recommended that valuable credentials, such as the sign-in credentials, aren't used with NTLMv1, MS-CHAPv2, Digest, or CredSSP protocols.
|
||||
- Software that manages credentials outside of Windows feature protection
|
||||
- Local accounts and Microsoft Accounts
|
||||
- Credential Guard doesn't protect the Active Directory database running on Windows Server domain controllers. It also doesn't protect credential input pipelines, such as Windows Server running Remote Desktop Gateway. If you're using a Windows Server OS as a client PC, it will get the same protection as it would when running a Windows client OS
|
||||
@ -26,9 +34,6 @@ Some ways to store credentials aren't protected by Credential Guard, including:
|
||||
- Physical attacks
|
||||
- Doesn't prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access to high value assets in your organization
|
||||
- Non-Microsoft security packages
|
||||
- When Credential Guard is enabled, NTLMv1, MS-CHAPv2, Digest, and CredSSP can't use the signed-in credentials. Thus, single sign-on doesn't work with these protocols. However, applications can prompt for credentials or use credentials stored in the Windows Vault, which aren't protected by Credential Guard with any of these protocols
|
||||
> [!CAUTION]
|
||||
> It's recommended that valuable credentials, such as the sign-in credentials, aren't used with NTLMv1, MS-CHAPv2, Digest, or CredSSP protocols. If these protocols must be used by domain or Microsoft Entra users, secondary credentials should be provisioned for these use cases.
|
||||
- Supplied credentials for NTLM authentication aren't protected. If a user is prompted for and enters credentials for NTLM authentication, these credentials are vulnerable to be read from LSASS memory. These same credentials are vulnerable to key loggers as well
|
||||
- Kerberos service tickets aren't protected by Credential Guard, but the Kerberos Ticket Granting Ticket (TGT) is protected
|
||||
- When Credential Guard is enabled, Kerberos doesn't allow *unconstrained Kerberos delegation* or *DES encryption*, not only for signed-in credentials, but also prompted or saved credentials
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 575 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 59 KiB |
@ -1,7 +1,7 @@
|
||||
---
|
||||
ms.date: 06/20/2024
|
||||
title: Credential Guard overview
|
||||
description: Learn about Credential Guard and how it isolates secrets so that only privileged system software can access them.
|
||||
ms.date: 08/31/2023
|
||||
ms.topic: overview
|
||||
---
|
||||
|
||||
@ -14,28 +14,63 @@ Credential Guard uses [Virtualization-based security (VBS)](/windows-hardware/de
|
||||
When enabled, Credential Guard provides the following benefits:
|
||||
|
||||
- **Hardware security**: NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials
|
||||
- **Virtualization-based security**: NTLM, Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system
|
||||
- **Virtualization-based security**: NTLM, Kerberos derived credentials, and other secrets run in a protected environment that is isolated from the running operating system
|
||||
- **Protection against advanced persistent threats**: when credentials are protected using VBS, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges can't extract secrets that are protected by VBS
|
||||
|
||||
> [!NOTE]
|
||||
> While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques, and you should also incorporate other security strategies and architectures.
|
||||
|
||||
## Default enablement
|
||||
|
||||
[!INCLUDE [windows-server-2025-preview](../../includes/windows-server-2025-preview.md)]
|
||||
|
||||
Starting in **Windows 11, 22H2** and **Windows Server 2025 (preview)**, VBS and Credential Guard are enabled by default on devices that meet the requirements.
|
||||
|
||||
The default enablement is **without UEFI Lock**, thus allowing administrators to disable Credential Guard remotely if needed.
|
||||
|
||||
When Credential Guard is enabled, [VBS](#system-requirements) is automatically enabled too.
|
||||
|
||||
> [!NOTE]
|
||||
> If Credential Guard is explicitly [disabled](configure.md#disable-credential-guard) *before* a device is updated to Windows 11, version 22H2 / Windows Server 2025 (preview) or later, default enablement does not overwrite the existing settings. That device will continue to have Credential Guard disabled even after updating to a version of Windows that enables Credential Guard by default.
|
||||
|
||||
### Default enablement on Windows
|
||||
|
||||
Devices running Windows 11, 22H2 or later have Credential Guard enabled by default if they:
|
||||
|
||||
- Meet the [license requirements](#windows-edition-and-licensing-requirements)
|
||||
- Meet the [hardware and software requirements](#system-requirements)
|
||||
- Aren't [explicitly configured to disable Credential Guard](configure.md#default-enablement)
|
||||
|
||||
> [!NOTE]
|
||||
> Devices running Windows 11 Pro/Pro Edu 22H2 or later may have Virtualization-based Security (VBS) and/or Credential Guard automatically enabled if they meet the other requirements for default enablement, and have previously run Credential Guard. For example if Credential Guard was enabled on an Enterprise device that later downgraded to Pro.
|
||||
>
|
||||
> To determine whether the Pro device is in this state, check if the following registry key exists: `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\IsolatedCredentialsRootSecret`. In this scenario, if you wish to disable VBS and Credential Guard, follow the instructions to [disable Virtualization-based Security](configure.md#disable-virtualization-based-security). If you wish to disable Credential Guard only, without disabling VBS, use the procedures to [disable Credential Guard](configure.md#disable-credential-guard).
|
||||
|
||||
### Default enablement on Windows Server
|
||||
|
||||
Devices running Windows Server 2025 (preview) or later have Credential Guard enabled by default if they:
|
||||
|
||||
- Meet the [license requirements](#windows-edition-and-licensing-requirements)
|
||||
- Meet the [hardware and software requirements](#system-requirements)
|
||||
- Aren't [explicitly configured to disable Credential Guard](configure.md#default-enablement)
|
||||
- Are joined to a domain
|
||||
- Aren't a domain controller
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Starting in Windows 11, version 22H2, VBS and Credential Guard are enabled by default on all devices that meet the system requirements.\
|
||||
> For information about known issues related to the default enablement of Credential Guard, see [Credential Guard: Known Issues](considerations-known-issues.md).
|
||||
> For information about known issues related to default enablement, see [Credential Guard: known issues](considerations-known-issues.md#known-issues).
|
||||
|
||||
## System requirements
|
||||
|
||||
For Credential Guard to provide protection, the devices must meet certain hardware, firmware, and software requirements.
|
||||
For Credential Guard to provide protection, the device must meet certain hardware, firmware, and software requirements.
|
||||
|
||||
Devices that meet more hardware and firmware qualifications than the minimum requirements, receive additional protections and are more hardened against certain threats.
|
||||
Devices that exceed the minimum hardware and firmware qualifications receive additional protections and are more hardened against certain threats.
|
||||
|
||||
### Hardware and software requirements
|
||||
|
||||
Credential Guard requires the features:
|
||||
|
||||
- Virtualization-based security (VBS)
|
||||
>[!NOTE]
|
||||
> [!NOTE]
|
||||
> VBS has different requirements to enable it on different hardware platforms. For more information, see [Virtualization-based Security requirements](/windows-hardware/design/device-experiences/oem-vbs)
|
||||
- [Secure Boot](../../operating-system-security/system-security/secure-the-windows-10-boot-process.md#secure-boot)
|
||||
|
||||
@ -64,7 +99,7 @@ The requirements to run Credential Guard in Hyper-V virtual machines are:
|
||||
|
||||
When Credential Guard is enabled, certain authentication capabilities are blocked. Applications that require such capabilities break. We refer to these requirements as *application requirements*.
|
||||
|
||||
Applications should be tested prior to deployment to ensure compatibility with the reduced functionality.
|
||||
Applications should be tested before deployment to ensure compatibility with the reduced functionality.
|
||||
|
||||
> [!WARNING]
|
||||
> Enabling Credential Guard on domain controllers isn't recommended.
|
||||
@ -77,16 +112,17 @@ Applications break if they require:
|
||||
|
||||
- Kerberos DES encryption support
|
||||
- Kerberos unconstrained delegation
|
||||
- Extracting the Kerberos TGT
|
||||
- Kerberos TGT extraction
|
||||
- NTLMv1
|
||||
|
||||
Applications prompt and expose credentials to risk if they require:
|
||||
Applications ask and expose credentials to risk if they require:
|
||||
|
||||
- Digest authentication
|
||||
- Credential delegation
|
||||
- MS-CHAPv2
|
||||
- CredSSP
|
||||
|
||||
Applications may cause performance issues when they attempt to hook the isolated Credential Guard process `LSAIso.exe`.
|
||||
Applications might cause performance issues when they attempt to hook the isolated Credential Guard process `LSAIso.exe`.
|
||||
|
||||
Services or protocols that rely on Kerberos, such as file shares or remote desktop, continue to work and aren't affected by Credential Guard.
|
||||
|
||||
@ -95,4 +131,4 @@ Services or protocols that rely on Kerberos, such as file shares or remote deskt
|
||||
- Learn [how Credential Guard works](how-it-works.md)
|
||||
- Learn [how to configure Credential Guard](configure.md)
|
||||
- Review the advice and sample code for making your environment more secure and robust with Credential Guard in the [Additional mitigations](additional-mitigations.md) article
|
||||
- Review [considerations and known issues when using Credential Guard](considerations-known-issues.md)
|
||||
- Review [considerations and known issues when using Credential Guard](considerations-known-issues.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure Active Directory Federation Services in a hybrid certificate trust model
|
||||
description: Learn how to configure Active Directory Federation Services (AD FS) to support the Windows Hello for Business hybrid certificate trust model.
|
||||
ms.date: 03/12/2024
|
||||
ms.date: 06/23/2024
|
||||
ms.topic: tutorial
|
||||
---
|
||||
|
||||
@ -52,19 +52,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
1. Restart the AD FS server
|
||||
|
||||
> [!NOTE]
|
||||
> For AD FS 2019 in a hybrid certificate trust model, a PRT issue exists. You may encounter this error in the AD FS Admin event logs: *Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'*. To remediate this error:
|
||||
>
|
||||
> 1. Launch AD FS management console and browse to **Services > Scope Descriptions**
|
||||
> 1. Right click **Scope Descriptions** and select **Add Scope Description**
|
||||
> 1. Under name type `ugs` and select **Apply > OK**
|
||||
> 1. Launch PowerShell as an administrator
|
||||
> 1. Obtain the *ObjectIdentifier* of the application permission with the `ClientRoleIdentifier` parameter equal to `38aa3b87-a06d-4817-b275-7a316988d93b`:
|
||||
> ```PowerShell
|
||||
> (Get-AdfsApplicationPermission -ServerRoleIdentifiers 'http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope' | ?{ $_.ClientRoleIdentifier -eq '38aa3b87-a06d-4817-b275-7a316988d93b' }).ObjectIdentifier
|
||||
> ```
|
||||
> 1. Execute the command `Set-AdfsApplicationPermission -TargetIdentifier <ObjectIdentifier from step 5> -AddScope 'ugs'`.
|
||||
> 1. Restart the AD FS service
|
||||
> 1. On the client: Restart the client. User should be prompted to provision Windows Hello for Business
|
||||
> For AD FS 2019 and later in a certificate trust model, a known PRT issue exists. You may encounter this error in AD FS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. For more information about the isse and its resolution, see [Certificate trust provisioning with AD FS broken on windows server 2019](../hello-deployment-issues.md#certificate-trust-provisioning-with-ad-fs-broken-on-windows-server-2019).
|
||||
|
||||
## Section review and next steps
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure and enroll in Windows Hello for Business in hybrid certificate trust model
|
||||
description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid certificate trust scenario.
|
||||
ms.date: 03/12/2024
|
||||
ms.date: 06/23/2024
|
||||
ms.topic: tutorial
|
||||
---
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure and validate the PKI in an hybrid certificate trust model
|
||||
title: Configure and validate the PKI in a hybrid certificate trust model
|
||||
description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a hybrid certificate trust model.
|
||||
ms.date: 03/12/2024
|
||||
ms.date: 06/23/2024
|
||||
ms.topic: tutorial
|
||||
---
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Hello for Business hybrid certificate trust deployment guide
|
||||
description: Learn how to deploy Windows Hello for Business in a hybrid certificate trust scenario.
|
||||
ms.date: 03/12/2024
|
||||
ms.date: 06/23/2024
|
||||
ms.topic: tutorial
|
||||
---
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
ms.date: 01/03/2024
|
||||
ms.date: 06/23/2024
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
@ -8,6 +8,8 @@ ms.topic: include
|
||||
Windows Hello for Business requires users perform multifactor authentication (MFA) prior to enroll in the service. On-premises deployments can use, as MFA option:
|
||||
|
||||
- certificates
|
||||
> [!NOTE]
|
||||
> When using this option, the certificates must be deployed to the users. For example, users can use their smart card or virtual smart card as a certificate authentication option.
|
||||
- non-Microsoft authentication providers for AD FS
|
||||
- custom authentication provider for AD FS
|
||||
|
||||
|
||||
@ -61,4 +61,4 @@ CertUtil: -dsTemplate command completed successfully."
|
||||
```
|
||||
|
||||
>[!NOTE]
|
||||
>If you gave your Windows Hello for Business Authentication certificate template a different name, then replace `WHFBAuthentication` in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the `Get-CATemplate` ADCS Administration Windows PowerShell cmdlet on your certification authority.
|
||||
>If you gave your Windows Hello for Business Authentication certificate template a different name, then replace `WHFBAuthentication` in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc).
|
||||
|
||||
@ -3,7 +3,7 @@ ms.date: 01/03/2024
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
### Configure an enrollment agent certificate template
|
||||
## Configure an enrollment agent certificate template
|
||||
|
||||
A certificate registration authority (CRA) is a trusted authority that validates certificate request. Once it validates the request, it presents the request to the certification authority (CA) for issuance. The CA issues the certificate, returns it to the CRA, which returns the certificate to the requesting user. Windows Hello for Business certificate trust deployments use AD FS as the CRA.
|
||||
|
||||
@ -12,7 +12,7 @@ The CRA enrolls for an *enrollment agent certificate*. Once the CRA verifies the
|
||||
> [!IMPORTANT]
|
||||
> Follow the procedures below based on the AD FS service account used in your environment.
|
||||
|
||||
#### Create an enrollment agent certificate for Group Managed Service Accounts (GMSA)
|
||||
### Create an enrollment agent certificate for Group Managed Service Accounts (GMSA)
|
||||
|
||||
Sign in to a CA or management workstations with *Domain Administrator* equivalent credentials.
|
||||
|
||||
@ -32,7 +32,7 @@ Sign in to a CA or management workstations with *Domain Administrator* equivalen
|
||||
1. Select **OK** to finalize your changes and create the new template
|
||||
1. Close the console
|
||||
|
||||
#### Create an enrollment agent certificate for a standard service account
|
||||
### Create an enrollment agent certificate for a standard service account
|
||||
|
||||
Sign in to a CA or management workstations with *Domain Administrator* equivalent credentials.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure Active Directory Federation Services in an on-premises certificate trust model
|
||||
description: Learn how to configure Active Directory Federation Services (AD FS) to support the Windows Hello for Business on-premises certificate trust model.
|
||||
ms.date: 03/12/2024
|
||||
ms.date: 06/23/2024
|
||||
ms.topic: tutorial
|
||||
---
|
||||
|
||||
@ -16,20 +16,7 @@ Windows Hello for Business works exclusively with the Active Directory Federatio
|
||||
[!INCLUDE [adfs-deploy](includes/adfs-deploy.md)]
|
||||
|
||||
> [!NOTE]
|
||||
> For AD FS 2019 and later in a certificate trust model, a known PRT issue exists. You may encounter this error in AD FS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. To remediate this error:
|
||||
>
|
||||
> 1. Launch AD FS management console. Browse to ***Services > Scope Descriptions**
|
||||
> 1. Right-click **Scope Descriptions** and select **Add Scope Description**
|
||||
> 1. Under name type *ugs* and select **Apply > OK**
|
||||
> 1. Launch PowerShell as an administrator and execute the following commands:
|
||||
>
|
||||
> ```PowerShell
|
||||
> $id = (Get-AdfsApplicationPermission -ServerRoleIdentifiers 'http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope' | ?{ $_.ClientRoleIdentifier -eq '38aa3b87-a06d-4817-b275-7a316988d93b' }).ObjectIdentifier
|
||||
> Set-AdfsApplicationPermission -TargetIdentifier $id -AddScope 'ugs'
|
||||
> ```
|
||||
>
|
||||
> 1. Restart the AD FS service
|
||||
> 1. Restart the client. User should be prompted to provision Windows Hello for Business
|
||||
> For AD FS 2019 and later in a certificate trust model, a known PRT issue exists. You may encounter this error in AD FS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. For more information about the isse and its resolution, see [Certificate trust provisioning with AD FS broken on windows server 2019](../hello-deployment-issues.md#certificate-trust-provisioning-with-ad-fs-broken-on-windows-server-2019).
|
||||
|
||||
## Review to validate the AD FS and Active Directory configuration
|
||||
|
||||
@ -40,6 +27,21 @@ Windows Hello for Business works exclusively with the Active Directory Federatio
|
||||
> - Confirm you added the AD FS service account to the KeyAdmins group
|
||||
> - Confirm you enabled the Device Registration service
|
||||
|
||||
[!INCLUDE [enrollment-agent-certificate-template](includes/certificate-template-enrollment-agent.md)]
|
||||
|
||||
### Publish the certificate template to the CA
|
||||
|
||||
Sign in to the CA or management workstations with **Enterprise Admin** equivalent credentials.
|
||||
|
||||
1. Open the **Certification Authority** management console
|
||||
1. Expand the parent node from the navigation pane
|
||||
1. Select **Certificate Templates** in the navigation pane
|
||||
1. Right-click the **Certificate Templates** node. Select **New > Certificate Template** to issue
|
||||
1. In the **Enable Certificates Templates** window, select the *WHFB Enrollment Agent* template you created in the previous step. Select **OK** to publish the selected certificate templates to the certification authority
|
||||
1. If you published the *Domain Controller Authentication (Kerberos)* certificate template, then unpublish the certificate templates you included in the superseded templates list
|
||||
- To unpublish a certificate template, right-click the certificate template you want to unpublish and select **Delete**. Select **Yes** to confirm the operation
|
||||
1. Close the console
|
||||
|
||||
## Configure the certificate registration authority
|
||||
|
||||
The Windows Hello for Business on-premises certificate-based deployment uses AD FS as the certificate registration authority (CRA). The registration authority is responsible for issuing certificates to users and devices. The registration authority is also responsible for revoking certificates when users or devices are removed from the environment.
|
||||
@ -55,7 +57,7 @@ Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplat
|
||||
>[!NOTE]
|
||||
> If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace *WHFBEnrollmentAgent* and *WHFBAuthentication* in the above command with the name of your certificate templates. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template by using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name by using the `Get-CATemplate` PowerShell cmdlet on a CA.
|
||||
|
||||
### Enrollment agent certificate enrollment
|
||||
### Enrollment agent certificate lifecycle management
|
||||
|
||||
AD FS performs its own certificate lifecycle management. Once the registration authority is configured with the proper certificate template, the AD FS server attempts to enroll the certificate on the first certificate request or when the service first starts.
|
||||
|
||||
@ -87,6 +89,7 @@ For detailed information about the certificate, use `Certutil -q -v <certificate
|
||||
> [!div class="checklist"]
|
||||
> Before you continue with the deployment, validate your deployment progress by reviewing the following items:
|
||||
>
|
||||
> - Configure an enrollment agent certificate template
|
||||
> - Confirm only the AD FS service account has the allow enroll permission for the enrollment agent certificate template
|
||||
> - Consider using an HSM to protect the enrollment agent certificate; however, understand the frequency and quantity of signature operations the enrollment agent server makes and understand the impact it has on overall performance
|
||||
> - Confirm you properly configured the Windows Hello for Business authentication certificate template
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
ms.date: 03/12/2024
|
||||
ms.date: 06/23/2024
|
||||
ms.topic: tutorial
|
||||
title: Configure Windows Hello for Business Policy settings in an on-premises certificate trust
|
||||
description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises certificate trust scenario
|
||||
@ -73,7 +73,11 @@ After a successful key registration, Windows creates a certificate request using
|
||||
|
||||
The AD FS registration authority verifies the key used in the certificate request matches the key that was previously registered. On a successful match, the AD FS registration authority signs the certificate request using its enrollment agent certificate and sends it to the certificate authority.
|
||||
|
||||
The CA validates that the certificate is signed by the registration authority. On successful validation, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user's certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user that they can use their PIN to sign-in through the Action Center.
|
||||
The CA validates that the certificate is signed by the registration authority. On successful validation, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user's certificate store.
|
||||
|
||||
The following video shows the Windows Hello for Business enrollment steps after signing in with a password, using a custom MFA adapter for AD FS.
|
||||
|
||||
> [!VIDEO https://learn-video.azurefd.net/vod/player?id=771165c0-e37f-4f9d-9e21-4f383cc6590d alt-text="Video showing the Windows Hello for Business enrollment steps after signing in with a password."]
|
||||
|
||||
### Sequence diagram
|
||||
|
||||
|
||||
@ -1,13 +1,12 @@
|
||||
---
|
||||
title: Windows Hello for Business on-premises certificate trust deployment guide
|
||||
description: Learn how to deploy Windows Hello for Business in an on-premises, certificate trust scenario.
|
||||
ms.date: 03/12/2024
|
||||
ms.date: 06/23/2024
|
||||
ms.topic: tutorial
|
||||
---
|
||||
|
||||
# On-premises certificate trust deployment guide
|
||||
|
||||
|
||||
[!INCLUDE [apply-to-on-premises-cert-trust](includes/apply-to-on-premises-cert-trust.md)]
|
||||
|
||||
[!INCLUDE [requirements](includes/requirements.md)]
|
||||
@ -48,8 +47,6 @@ Windows Hello for Business must have a Public Key Infrastructure (PKI) when usin
|
||||
|
||||
[!INCLUDE [web-server-certificate-template](includes/certificate-template-web-server.md)]
|
||||
|
||||
[!INCLUDE [enrollment-agent-certificate-template](includes/certificate-template-enrollment-agent.md)]
|
||||
|
||||
[!INCLUDE [auth-certificate-template](includes/certificate-template-auth.md)]
|
||||
|
||||
[!INCLUDE [unpublish-superseded-templates](includes/unpublish-superseded-templates.md)]
|
||||
@ -64,7 +61,7 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen
|
||||
1. Expand the parent node from the navigation pane
|
||||
1. Select **Certificate Templates** in the navigation pane
|
||||
1. Right-click the **Certificate Templates** node. Select **New > Certificate Template** to issue
|
||||
1. In the **Enable Certificates Templates** window, select the *Domain Controller Authentication (Kerberos)*, *Internal Web Server*, *WHFB Enrollment Agent* and *WHFB Authentication* templates you created in the previous steps. Select **OK** to publish the selected certificate templates to the certification authority
|
||||
1. In the **Enable Certificates Templates** window, select the *Domain Controller Authentication (Kerberos)*, *Internal Web Server*, and *WHFB Authentication* templates you created in the previous steps. Select **OK** to publish the selected certificate templates to the certification authority
|
||||
1. If you published the *Domain Controller Authentication (Kerberos)* certificate template, then unpublish the certificate templates you included in the superseded templates list
|
||||
- To unpublish a certificate template, right-click the certificate template you want to unpublish and select **Delete**. Select **Yes** to confirm the operation
|
||||
1. Close the console
|
||||
@ -85,7 +82,6 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen
|
||||
> - Configure domain controller and web server certificate templates
|
||||
> - Supersede existing domain controller certificates
|
||||
> - Unpublish superseded certificate templates
|
||||
> - Configure an enrollment agent certificate template
|
||||
> - Publish the certificate templates to the CA
|
||||
> - Deploy certificates to the domain controllers
|
||||
> - Validate the domain controllers configuration
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
ms.date: 03/12/2024
|
||||
ms.date: 06/23/2024
|
||||
ms.topic: tutorial
|
||||
title: Configure Windows Hello for Business Policy settings in an on-premises key trust
|
||||
description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises key trust scenario
|
||||
@ -52,6 +52,10 @@ This information is also available using the `dsregcmd.exe /status` command from
|
||||
|
||||
[!INCLUDE [user-experience](includes/user-experience.md)]
|
||||
|
||||
The following video shows the Windows Hello for Business enrollment steps after signing in with a password, using a custom MFA adapter for AD FS.
|
||||
|
||||
> [!VIDEO https://learn-video.azurefd.net/vod/player?id=771165c0-e37f-4f9d-9e21-4f383cc6590d alt-text="Video showing the Windows Hello for Business enrollment steps after signing in with a password."]
|
||||
|
||||
### Sequence diagram
|
||||
|
||||
To better understand the provisioning flows, review the following sequence diagram:
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Hello for Business on-premises key trust deployment guide
|
||||
description: Learn how to deploy Windows Hello for Business in an on-premises, key trust scenario.
|
||||
ms.date: 03/12/2024
|
||||
ms.date: 06/24/2024
|
||||
ms.topic: tutorial
|
||||
---
|
||||
|
||||
@ -57,7 +57,7 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen
|
||||
1. Expand the parent node from the navigation pane
|
||||
1. Select **Certificate Templates** in the navigation pane
|
||||
1. Right-click the **Certificate Templates** node. Select **New > Certificate Template** to issue
|
||||
1. In the **Enable Certificates Templates** window, select the *Domain Controller Authentication (Kerberos)*, and *Internal Web Server* templates you created in the previous steps. Select **OK** to publish the selected certificate templates to the certification authority
|
||||
1. In the **Enable Certificates Templates** window, select the *Domain Controller Authentication (Kerberos)* and *Internal Web Server* templates you created in the previous steps. Select **OK** to publish the selected certificate templates to the certification authority
|
||||
1. If you published the *Domain Controller Authentication (Kerberos)* certificate template, then unpublish the certificate templates you included in the superseded templates list
|
||||
- To unpublish a certificate template, right-click the certificate template you want to unpublish and select **Delete**. Select **Yes** to confirm the operation
|
||||
1. Close the console
|
||||
|
||||
@ -8,7 +8,7 @@ items:
|
||||
- name: Cloud Kerberos trust deployment
|
||||
href: hybrid-cloud-kerberos-trust.md
|
||||
- name: Key trust deployment
|
||||
items:
|
||||
items:
|
||||
- name: Requirements and validation
|
||||
href: hybrid-key-trust.md
|
||||
displayName: key trust
|
||||
@ -19,7 +19,7 @@ items:
|
||||
href: ../hello-hybrid-aadj-sso.md
|
||||
displayName: key trust
|
||||
- name: Certificate trust deployment
|
||||
items:
|
||||
items:
|
||||
- name: Requirements and validation
|
||||
href: hybrid-cert-trust.md
|
||||
displayName: certificate trust
|
||||
@ -41,7 +41,7 @@ items:
|
||||
- name: On-premises deployments
|
||||
items:
|
||||
- name: Key trust deployment
|
||||
items:
|
||||
items:
|
||||
- name: Requirements and validation
|
||||
href: on-premises-key-trust.md
|
||||
- name: Prepare and deploy Active Directory Federation Services (AD FS)
|
||||
@ -49,10 +49,10 @@ items:
|
||||
- name: Configure and enroll in Windows Hello for Business
|
||||
href: on-premises-key-trust-enroll.md
|
||||
- name: Certificate trust deployment
|
||||
items:
|
||||
items:
|
||||
- name: Requirements and validation
|
||||
href: on-premises-cert-trust.md
|
||||
- name: Prepare and Deploy Active Directory Federation Services (AD FS)
|
||||
- name: Prepare and deploy Active Directory Federation Services (AD FS)
|
||||
href: on-premises-cert-trust-adfs.md
|
||||
- name: Configure and enroll in Windows Hello for Business
|
||||
href: on-premises-cert-trust-enroll.md
|
||||
|
||||
@ -44,7 +44,7 @@ sections:
|
||||
The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process doesn't receive the PIN, but rather the ticket that grants them private key operations. There isn't a policy setting to adjust the caching.
|
||||
- question: Where is Windows Hello biometrics data stored?
|
||||
answer: |
|
||||
When you enroll in Windows Hello, a representation of your biometrics, called an enrollment profile, is created more information can be found on [Windows Hello face authentication](/windows-hardware/design/device-experiences/windows-hello-face-authentication). This enrollment profile biometrics data is device specific, is stored locally on the device, and does not leave the device or roam with the user. Some external fingerprint sensors store biometric data on the fingerprint module itself rather than on Windows device. Even in this case, the biometrics data is stored locally on those modules, is device specific, doesn't roam, never leaves the module, and is never sent to Microsoft cloud or external server. For more details, see [Windows Hello biometrics in the enterprise](/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise#where-is-windows-hello-data-stored).
|
||||
When you enroll in Windows Hello, a representation of your biometrics, called an enrollment profile, is created. The enrollment profile biometrics data is device specific, is stored locally on the device, and does not leave the device or roam with the user. Some external fingerprint sensors store biometric data on the fingerprint module itself rather than on Windows device. Even in this case, the biometrics data is stored locally on those modules, is device specific, doesn't roam, never leaves the module, and is never sent to Microsoft cloud or external server. For more details, see [Windows Hello biometrics in the enterprise](/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise#where-is-windows-hello-data-stored) and [Windows Hello face authentication](/windows-hardware/design/device-experiences/windows-hello-face-authentication).
|
||||
- question: What is the format used to store Windows Hello biometrics data on the device?
|
||||
answer: |
|
||||
Windows Hello biometrics data is stored on the device as an encrypted template database. The data from the biometrics sensor (like face camera or fingerprint reader) creates a data representation—or graph—that is then encrypted before it's stored on the device. Each biometrics sensor on the device which is used by Windows Hello (face or fingerprint) will have its own biometric database file where template data is stored. Each biometrics database file is encrypted with unique, randomly generated key that is encrypted to the system using AES encryption producing an SHA256 hash.
|
||||
|
||||
9
windows/security/includes/windows-server-2025-preview.md
Normal file
9
windows/security/includes/windows-server-2025-preview.md
Normal file
@ -0,0 +1,9 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 06/21/2024
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Windows Server 2025 is in preview. This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: BCD settings and BitLocker
|
||||
title: BCD settings and BitLocker
|
||||
description: Learn how BCD settings are used by BitLocker.
|
||||
ms.topic: reference
|
||||
ms.date: 10/30/2023
|
||||
ms.date: 06/18/2024
|
||||
---
|
||||
|
||||
# Boot Configuration Data settings and BitLocker
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Configure BitLocker
|
||||
description: Learn about the available options to configure BitLocker and how to configure them via Configuration Service Providers (CSP) or group policy (GPO).
|
||||
ms.topic: how-to
|
||||
ms.date: 10/30/2023
|
||||
ms.date: 06/18/2024
|
||||
---
|
||||
|
||||
# Configure BitLocker
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user