diff --git a/.openpublishing.redirection.windows-configuration.json b/.openpublishing.redirection.windows-configuration.json
index d68a51ee9f..971d493152 100644
--- a/.openpublishing.redirection.windows-configuration.json
+++ b/.openpublishing.redirection.windows-configuration.json
@@ -282,7 +282,7 @@
},
{
"source_path": "windows/configuration/configure-windows-10-taskbar.md",
- "redirect_url": "/windows/configuration/taskbar/configure-windows-10-taskbar",
+ "redirect_url": "/windows/configuration/taskbar/",
"redirect_document_id": false
},
{
@@ -297,7 +297,7 @@
},
{
"source_path": "windows/configuration/customize-taskbar-windows-11.md",
- "redirect_url": "/windows/configuration/taskbar/customize-taskbar-windows-11",
+ "redirect_url": "/windows/configuration/taskbar",
"redirect_document_id": false
},
{
@@ -447,7 +447,7 @@
},
{
"source_path": "windows/configuration/supported-csp-taskbar-windows.md",
- "redirect_url": "/windows/configuration/taskbar/supported-csp-taskbar-windows",
+ "redirect_url": "/windows/configuration/taskbar/policy-settings",
"redirect_document_id": false
},
{
@@ -755,9 +755,14 @@
"redirect_url": "/windows/configuration/assigned-access/configuration-file",
"redirect_document_id": false
},
+ {
+ "source_path": "windows/configuration/assigned-access/create-xml.md",
+ "redirect_url": "/windows/configuration/assigned-access/configuration-file",
+ "redirect_document_id": false
+ },
{
"source_path": "windows/configuration/kiosk/lock-down-windows-11-to-specific-apps.md",
- "redirect_url": "/windows/configuration/assigned-access/create-xml",
+ "redirect_url": "/windows/configuration/assigned-access/configuration-file",
"redirect_document_id": false
},
{
@@ -837,18 +842,28 @@
},
{
"source_path": "windows/configuration/taskbar/configure-windows-10-taskbar.md",
- "redirect_url": "/windows/configuration/taskbar",
+ "redirect_url": "/windows/configuration/taskbar/",
"redirect_document_id": false
},
{
"source_path": "windows/configuration/taskbar/customize-taskbar-windows-11.md",
- "redirect_url": "/windows/configuration/taskbar",
+ "redirect_url": "/windows/configuration/taskbar/",
"redirect_document_id": false
},
{
"source_path": "windows/configuration/tips/manage-tips-and-suggestions.md",
"redirect_url": "/windows/configuration",
"redirect_document_id": false
+ },
+ {
+ "source_path": "windows/configuration/taskbar/configure.md",
+ "redirect_url": "/windows/configuration/taskbar/",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/configuration/taskbar/supported-csp-taskbar-windows.md",
+ "redirect_url": "/windows/configuration/taskbar/policy-settings",
+ "redirect_document_id": false
}
]
}
\ No newline at end of file
diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md
index d9cf189c9a..647b90ac50 100644
--- a/windows/client-management/mdm/bitlocker-csp.md
+++ b/windows/client-management/mdm/bitlocker-csp.md
@@ -16,13 +16,19 @@ ms.date: 01/18/2024
The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it's also supported in Windows 10 Pro.
> [!NOTE]
+> To manage BitLocker through CSP except to enable and disable it using the `RequireDeviceEncryption` policy, one of the following licenses must be assigned to your users regardless of your management platform:
>
-> - Settings are enforced only at the time encryption is started. Encryption isn't restarted with settings changes.
-> - You must send all the settings together in a single SyncML to be effective.
+> - Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, and E5).
+> - Windows 10/11 Enterprise A3 or A5 (included in Microsoft 365 A3 and A5).
A `Get` operation on any of the settings, except for `RequireDeviceEncryption` and `RequireStorageCardEncryption`, returns the setting configured by the admin.
For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation returns the actual status of enforcement to the admin, such as if Trusted Platform Module (TPM) protection is required and if encryption is required. And if the device has BitLocker enabled but with password protector, the status reported is 0. A Get operation on RequireDeviceEncryption doesn't verify that a minimum PIN length is enforced (SystemDrivesMinimumPINLength).
+
+> [!NOTE]
+>
+> - Settings are enforced only at the time encryption is started. Encryption isn't restarted with settings changes.
+> - You must send all the settings together in a single SyncML to be effective.
@@ -654,7 +660,7 @@ Sample value for this node to enable this policy is: ``
**Example**:
-To disable this policy, use hte following SyncML:
+To disable this policy, use the following SyncML:
```xml
diff --git a/windows/client-management/mdm/clouddesktop-csp.md b/windows/client-management/mdm/clouddesktop-csp.md
index 8e70090f67..e249d20ca8 100644
--- a/windows/client-management/mdm/clouddesktop-csp.md
+++ b/windows/client-management/mdm/clouddesktop-csp.md
@@ -1,7 +1,7 @@
---
title: CloudDesktop CSP
description: Learn more about the CloudDesktop CSP.
-ms.date: 01/18/2024
+ms.date: 03/05/2024
---
@@ -29,7 +29,7 @@ The following list shows the CloudDesktop configuration service provider nodes:
| Scope | Editions | Applicable OS |
|:--|:--|:--|
-| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ❌ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ❌ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later |
diff --git a/windows/client-management/mdm/clouddesktop-ddf-file.md b/windows/client-management/mdm/clouddesktop-ddf-file.md
index 60be060ee6..98427f9e32 100644
--- a/windows/client-management/mdm/clouddesktop-ddf-file.md
+++ b/windows/client-management/mdm/clouddesktop-ddf-file.md
@@ -1,7 +1,7 @@
---
title: CloudDesktop DDF file
description: View the XML file containing the device description framework (DDF) for the CloudDesktop configuration service provider.
-ms.date: 01/31/2024
+ms.date: 03/05/2024
---
@@ -38,9 +38,9 @@ The following XML file contains the device description framework (DDF) for the C
- 99.9.99999
- 9.9
- 0x4;0x30;0x31;0x7E;0x88;0xA1;0xA2;0xA4;0xA5;0xBC;0xBF;0xCD;0xD2;
+ 10.0.22621.3235
+ 1.0
+ 0x4;0x30;0x31;0x7E;0x87;0x88;0x88*;0xA1;0xA2;0xA4;0xA5;0xB4;0xBC;0xBD;0xBF;
@@ -68,8 +68,8 @@ The following XML file contains the device description framework (DDF) for the C
- 99.9.99999
- 9.9
+ 10.0.22621.3235
+ 1.0
diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md
index 70775b2f69..614e47b8a9 100644
--- a/windows/client-management/mdm/personalization-csp.md
+++ b/windows/client-management/mdm/personalization-csp.md
@@ -1,7 +1,7 @@
---
title: Personalization CSP
description: Learn more about the Personalization CSP.
-ms.date: 01/31/2024
+ms.date: 03/05/2024
---
@@ -9,8 +9,6 @@ ms.date: 01/31/2024
# Personalization CSP
-[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
-
The Personalization CSP can set the lock screen, desktop background images and company branding on sign-in screen ([BootToCloud mode](policy-csp-clouddesktop.md#boottocloudmode) only). Setting these policies also prevents the user from changing the image. You can also use the Personalization settings in a provisioning package.
@@ -38,7 +36,7 @@ The following list shows the Personalization configuration service provider node
| Scope | Editions | Applicable OS |
|:--|:--|:--|
-| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later |
@@ -77,7 +75,7 @@ This represents the status of the Company Logo. 1 - Successfully downloaded or c
| Scope | Editions | Applicable OS |
|:--|:--|:--|
-| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later |
@@ -116,7 +114,7 @@ An http or https Url to a jpg, jpeg or png image that needs to be downloaded and
| Scope | Editions | Applicable OS |
|:--|:--|:--|
-| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later |
@@ -127,7 +125,7 @@ An http or https Url to a jpg, jpeg or png image that needs to be downloaded and
-This represents the name of the company. It can be at most 30 characters long. This setting is currently available only for boot to cloud shared pc mode to display the company name on sign-in screen.
+The name of the company to be displayed on the sign-in screen. This setting is currently available for boot to cloud shared pc mode only.
diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md
index 07040a6851..87ccb6cf93 100644
--- a/windows/client-management/mdm/personalization-ddf.md
+++ b/windows/client-management/mdm/personalization-ddf.md
@@ -1,7 +1,7 @@
---
title: Personalization DDF file
description: View the XML file containing the device description framework (DDF) for the Personalization configuration service provider.
-ms.date: 01/31/2024
+ms.date: 03/05/2024
---
@@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the P
10.0.162991.0
- 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2;
+ 0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB;
@@ -101,7 +101,7 @@ The following XML file contains the device description framework (DDF) for the P
- A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image.
+ A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image.
@@ -148,7 +148,7 @@ The following XML file contains the device description framework (DDF) for the P
- A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only.
+ A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only.
@@ -162,7 +162,7 @@ The following XML file contains the device description framework (DDF) for the P
- 99.9.99999
+ 10.0.22621.32352.0
@@ -189,7 +189,7 @@ The following XML file contains the device description framework (DDF) for the P
- 99.9.99999
+ 10.0.22621.32352.0
@@ -203,7 +203,7 @@ The following XML file contains the device description framework (DDF) for the P
- This represents the name of the company. It can be at most 30 characters long. This setting is currently available only for boot to cloud shared pc mode to display the company name on sign-in screen.
+ The name of the company to be displayed on the sign-in screen. This setting is currently available for boot to cloud shared pc mode only.
@@ -217,7 +217,7 @@ The following XML file contains the device description framework (DDF) for the P
- 99.9.99999
+ 10.0.22621.32352.0
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md
index 8a1244f15d..c0c0fd2588 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md
@@ -39,6 +39,10 @@ ms.date: 02/03/2023
- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitforegrounddownloadbandwidth) 10
- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitbackgrounddownloadbandwidth) 10
- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitbackgrounddownloadbandwidth) 10
+- [Device/{TenantId}/Policies/EnableWindowsHelloProvisioningForSecurityKeys](passportforwork-csp.md#devicetenantidpoliciesenablewindowshelloprovisioningforsecuritykeys) 12
+- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md#allowinstallationofmatchingdeviceids) 12
+- [DeviceInstallation/DeviceInstall_Removable_Deny](policy-csp-admx-deviceinstallation.md#deviceinstall_removable_deny) 12
+- [DeviceInstallation/EnableInstallationPolicyLayering](policy-csp-deviceinstallation.md#enableinstallationpolicylayering) 12
- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#allowidlereturnwithoutpassword)
- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#allowsimpledevicepassword)
- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#alphanumericdevicepasswordrequired)
@@ -59,12 +63,18 @@ ms.date: 02/03/2023
- [MixedReality/ConfigureMovingPlatform](policy-csp-mixedreality.md#configuremovingplatform) *[Feb. 2022 Servicing release](/hololens/hololens-release-notes#windows-holographic-version-21h2---february-2022-update)
- [MixedReality/ConfigureNtpClient](./policy-csp-mixedreality.md#configurentpclient) 12
- [MixedReality/DisallowNetworkConnectivityPassivePolling](./policy-csp-mixedreality.md#disallownetworkconnectivitypassivepolling) 12
+- [MixedReality/EnableStartMenuWristTap](./policy-csp-mixedreality.md#enablestartmenuwristtap)12
+- [MixedReality/EnableStartMenuSingleHandGesture](./policy-csp-mixedreality.md#enablestartmenusinglehandgesture) 12
+- [MixedReality/EnableStartMenuVoiceCommand](./policy-csp-mixedreality.md#enablestartmenuvoicecommand) 12
- [MixedReality/FallbackDiagnostics](./policy-csp-mixedreality.md#fallbackdiagnostics) 9
- [MixedReality/ManualDownDirectionDisabled](policy-csp-mixedreality.md#manualdowndirectiondisabled) *[Feb. 2022 Servicing release](/hololens/hololens-release-notes#windows-holographic-version-21h2---february-2022-update)
- [MixedReality/MicrophoneDisabled](./policy-csp-mixedreality.md#microphonedisabled) 9
- [MixedReality/NtpClientEnabled](./policy-csp-mixedreality.md#ntpclientenabled) 12
+- [MixedReality/PreferLogonAsOtherUser](./policy-csp-mixedreality.md#preferlogonasotheruser) 12
- [MixedReality/SkipCalibrationDuringSetup](./policy-csp-mixedreality.md#skipcalibrationduringsetup) 12
- [MixedReality/SkipTrainingDuringSetup](./policy-csp-mixedreality.md#skiptrainingduringsetup) 12
+- [MixedReality/RequireStartIconHold](./policy-csp-mixedreality.md#requirestarticonhold) 12
+- [MixedReality/RequireStartIconVisible](./policy-csp-mixedreality.md#requirestarticonvisible) 12
- [MixedReality/VisitorAutoLogon](policy-csp-mixedreality.md#visitorautologon) 10
- [MixedReality/VolumeButtonDisabled](./policy-csp-mixedreality.md#volumebuttondisabled) 9
- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#displayofftimeoutonbattery) 9, 14
@@ -91,9 +101,9 @@ ms.date: 02/03/2023
- [Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessgazeinput_forcedenytheseapps) 8
- [Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessgazeinput_userincontroloftheseapps) 8
- [Privacy/LetAppsAccessLocation](policy-csp-privacy.md#letappsaccesslocation)
-- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](/windows/client-management/mdm/policy-csp-privacy) 12
-- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](/windows/client-management/mdm/policy-csp-privacy) 12
-- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](/windows/client-management/mdm/policy-csp-privacy) 12
+- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesslocation_forceallowtheseapps) 12
+- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesslocation_forcedenytheseapps) 12
+- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesslocation_userincontroloftheseapps) 12
- [Privacy/LetAppsAccessMicrophone](policy-csp-privacy.md#letappsaccessmicrophone)
- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forceallowtheseapps) 8
- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forcedenytheseapps) 8
@@ -113,8 +123,8 @@ ms.date: 02/03/2023
- [System/AllowLocation](policy-csp-system.md#allowlocation)
- [System/AllowStorageCard](policy-csp-system.md#allowstoragecard)
- [System/AllowTelemetry](policy-csp-system.md#allowtelemetry)
-- [System/ConfigureTelemetryOptInSettingsUx](/windows/client-management/mdm/policy-csp-system) 12
-- [System/DisableDeviceDelete](/windows/client-management/mdm/policy-csp-system) 12
+- [System/ConfigureTelemetryOptInSettingsUx](policy-csp-system.md#configuretelemetryoptinsettingsux) 12
+- [System/DisableDeviceDelete](policy-csp-system.md#disabledevicedelete) 12
- [TimeLanguageSettings/ConfigureTimeZone](./policy-csp-timelanguagesettings.md#configuretimezone) 9
- [Update/ActiveHoursEnd](./policy-csp-update.md#activehoursend) 9
- [Update/ActiveHoursMaxRange](./policy-csp-update.md#activehoursmaxrange) 9
@@ -165,6 +175,3 @@ Footnotes:
[Policy CSP](policy-configuration-service-provider.md)
[Full HoloLens CSP Details](/windows/client-management/mdm/configuration-service-provider-support)
-
-
-
diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml
index b6023eda4e..c71df35e46 100644
--- a/windows/configuration/index.yml
+++ b/windows/configuration/index.yml
@@ -24,7 +24,7 @@ landingContent:
- text: Customize the Windows Start menu layout
url: start/customize-and-export-start-layout.md
- text: Customize the Windows taskbar
- url: taskbar/configure.md
+ url: taskbar/index.md
- text: Configure Windows Spotlight on the lock screen
url: lock-screen/windows-spotlight.md
- text: Accessibility information for IT pros
diff --git a/windows/configuration/taskbar/configure.md b/windows/configuration/taskbar/index.md
similarity index 100%
rename from windows/configuration/taskbar/configure.md
rename to windows/configuration/taskbar/index.md
diff --git a/windows/configuration/taskbar/supported-csp-taskbar-windows.md b/windows/configuration/taskbar/policy-settings.md
similarity index 100%
rename from windows/configuration/taskbar/supported-csp-taskbar-windows.md
rename to windows/configuration/taskbar/policy-settings.md
diff --git a/windows/configuration/taskbar/toc.yml b/windows/configuration/taskbar/toc.yml
index 906f16ce7c..c3601e77ec 100644
--- a/windows/configuration/taskbar/toc.yml
+++ b/windows/configuration/taskbar/toc.yml
@@ -1,5 +1,5 @@
items:
- name: Customize the Taskbar
- href: configure.md
+ href: index.md
- name: Supported Taskbar CSPs
- href: supported-csp-taskbar-windows.md
\ No newline at end of file
+ href: policy-settings.md
\ No newline at end of file
diff --git a/windows/deployment/update/update-other-microsoft-products.md b/windows/deployment/update/update-other-microsoft-products.md
index 1479c86008..0d05bd2cd3 100644
--- a/windows/deployment/update/update-other-microsoft-products.md
+++ b/windows/deployment/update/update-other-microsoft-products.md
@@ -11,7 +11,7 @@ manager: aaroncz
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 03/11/2024
+ms.date: 03/14/2024
---
# Update other Microsoft products
@@ -70,7 +70,6 @@ The following is a list of other Microsoft products that might be updated:
- Windows Azure Pack
- Windows Azure Service Bus
- Windows Embedded Developer Update
-- Windows Intune
- Windows Live Sign-in Assistant
- Windows Small Business Server
- Zune
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md b/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md
index b9655217a3..1d76e0e5a9 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md
@@ -2,7 +2,7 @@
title: Use multiple Windows Defender Application Control Policies
description: Windows Defender Application Control supports multiple code integrity policies for one device.
ms.localizationpriority: medium
-ms.date: 03/13/2024
+ms.date: 07/19/2021
ms.topic: article
---
@@ -11,19 +11,17 @@ ms.topic: article
>[!NOTE]
>Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md).
-Beginning with Windows 10 version 1903 and Windows Server 2022, you can deploy multiple Windows Defender Application Control (WDAC) policies side-by-side on a device. To allow more than 32 active policies, install the Windows security update released on, or after, March 12, 2024 and then restart the device. With these updates, there's no limit for the number of policies you can deploy at once to a given device. Until you install the Windows security update released on or after March 12, 2024, your device is limited to 32 active policies and you must not exceed that number.
-
-Here are some common scenarios where multiple side-by-side policies are useful:
+Prior to Windows 10 1903, Windows Defender Application Control only supported a single active policy on a system at any given time. This limited customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports up to 32 active policies on a device at once in order to enable the following scenarios:
1. Enforce and Audit Side-by-Side
- To validate policy changes before deploying in enforcement mode, users can now deploy an audit-mode base policy side by side with an existing enforcement-mode base policy
2. Multiple Base Policies
- Users can enforce two or more base policies simultaneously in order to allow simpler policy targeting for policies with different scope/intent
- - If two base policies exist on a device, an application must pass both policies for it to run
+ - If two base policies exist on a device, an application has to be allowed by both to run
3. Supplemental Policies
- Users can deploy one or more supplemental policies to expand a base policy
- A supplemental policy expands a single base policy, and multiple supplemental policies can expand the same base policy
- - For supplemental policies, applications allowed by either the base policy or its supplemental policy/policies run
+ - For supplemental policies, applications that are allowed by either the base policy or its supplemental policy/policies are allowed to run
> [!NOTE]
> Pre-1903 systems do not support the use of Multiple Policy Format WDAC policies.
@@ -33,11 +31,11 @@ Here are some common scenarios where multiple side-by-side policies are useful:
- Multiple base policies: intersection
- Only applications allowed by both policies run without generating block events
- Base + supplemental policy: union
- - Files allowed by either the base policy or the supplemental policy run
+ - Files that are allowed by either the base policy or the supplemental policy aren't blocked
## Creating WDAC policies in Multiple Policy Format
-In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique values generated for the policy ID and 2) the policy type set as a Base policy. The below example describes the process of creating a new policy in the multiple policy format.
+In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below example describes the process of creating a new policy in the multiple policy format.
```powershell
New-CIPolicy -MultiplePolicyFormat -ScanPath "" -UserPEs -FilePath ".\policy.xml" -Level FilePublisher -Fallback SignedVersion,Publisher,Hash
@@ -57,7 +55,7 @@ Add-SignerRule -FilePath ".\policy.xml" -CertificatePath [-K
### Supplemental policy creation
-In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format as shown earlier. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy.
+In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format as shown above. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy.
- "SupplementsBasePolicyID": GUID of base policy that the supplemental policy applies to
- "BasePolicyToSupplementPath": path to base policy file that the supplemental policy applies to
@@ -68,11 +66,11 @@ Set-CIPolicyIdInfo -FilePath ".\supplemental_policy.xml" [-SupplementsBasePolicy
### Merging policies
-When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy is a base policy with ID \.
+When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy will be a base policy with ID \.
## Deploying multiple policies
-In order to deploy multiple Windows Defender Application Control policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP.
+In order to deploy multiple Windows Defender Application Control policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP, which is supported by Microsoft Intune's custom OMA-URI feature.
### Deploying multiple policies locally
@@ -88,9 +86,15 @@ To deploy policies locally using the new multiple policy format, follow these st
Multiple Windows Defender Application Control policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment.
-However, when policies are unenrolled from an MDM server, the CSP attempts to remove every policy not actively deployed, not just the policies added by the CSP. This behavior happens because the system doesn't know what deployment methods were used to apply individual policies.
+However, when policies are unenrolled from an MDM server, the CSP will attempt to remove every policy from devices, not just the policies added by the CSP. The reason for this is that the ApplicationControl CSP doesn't track enrollment sources for individual policies, even though it will query all policies on a device, regardless if they were deployed by the CSP.
For more information on deploying multiple policies, optionally using Microsoft Intune's custom OMA-URI capability, see [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp).
> [!NOTE]
> WMI and GP do not currently support multiple policies. Instead, customers who cannot directly access the MDM stack should use the [ApplicationControl CSP via the MDM Bridge WMI Provider](/windows/client-management/mdm/applicationcontrol-csp#powershell-and-wmi-bridge-usage-guidance) to manage Multiple Policy Format Windows Defender Application Control policies.
+
+### Known Issues in Multiple Policy Format
+
+* If the maximum number of policies is exceeded, the device may bluescreen referencing ci.dll with a bug check value of 0x0000003b.
+* If policies are loaded without requiring a reboot such as `PS_UpdateAndCompareCIPolicy`, they will still count towards this limit.
+* This may pose an especially large challenge if the value of `{PolicyGUID}.cip` changes between releases. It may result in a long window between a change and the resultant reboot.
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md
index fbccba4c71..91af264958 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md
@@ -2,7 +2,7 @@
title: WDAC Admin Tips & Known Issues
description: WDAC Known Issues
ms.manager: jsuther
-ms.date: 03/13/2024
+ms.date: 11/22/2023
ms.topic: article
ms.localizationpriority: medium
---
@@ -43,28 +43,32 @@ When the WDAC engine evaluates files against the active set of policies on the d
4. Lastly, WDAC makes a cloud call to the ISG to get reputation about the file, if the policy enables the ISG option.
-5. Any file not allowed by an explicit rule or based on ISG or MI is blocked implicitly.
+5. If no explicit rule exists for the file and it's not allowed based on ISG or MI, then the file is blocked implicitly.
## Known issues
### Boot stop failure (blue screen) occurs if more than 32 policies are active
-Until you apply the Windows security update released on or after March 12, 2024, your device is limited to 32 active policies. If the maximum number of policies is exceeded, the device bluescreens referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. To remove the maximum policy limit, install the Windows security update released on, or after, March 12, 2024 and then restart the device. Otherwise, reduce the number of policies on the device to remain below 32 policies.
+If the maximum number of policies is exceeded, the device will bluescreen referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit.
### Audit mode policies can change the behavior for some apps or cause app crashes
-Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that turns on user mode code integrity (UMCI) with the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode:
+Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that includes the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode:
- Some script hosts might block code or run code with fewer privileges even in audit mode. See [Script enforcement with WDAC](/windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement) for information about individual script host behaviors.
- Option **19 Enabled:Dynamic Code Security** is always enforced if any UMCI policy includes that option. See [WDAC and .NET](/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet#wdac-and-net-hardening).
+### Managed Installer and ISG may cause excessive events
+
+When Managed Installer and ISG are enabled, 3091 and 3092 events are logged when a file didn't have Managed Installer or ISG authorization, regardless of whether the file was allowed. These events were moved to the verbose channel beginning with the September 2022 Update Preview since the events don't indicate an issue with the policy.
+
### .NET native images may generate false positive block events
In some cases, the code integrity logs where Windows Defender Application Control errors and warnings are written include error events for native images generated for .NET assemblies. Typically, native image blocks are functionally benign as a blocked native image falls back to its corresponding assembly and .NET regenerates the native image at its next scheduled maintenance window.
### Signatures using elliptical curve cryptography (ECC) aren't supported
-WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If WDAC blocks a file based on ECC signatures, the corresponding 3089 signature information events show VerificationError = 23. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA.
+WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If you try to allow files by signature based on ECC signatures, you'll see VerificationError = 23 on the corresponding 3089 signature information events. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA.
### MSI installers are treated as user writeable on Windows 10 when allowed by FilePath rule
@@ -84,19 +88,18 @@ As a workaround, download the MSI file and run it locally:
```console
msiexec -i c:\temp\Windows10_Version_1511_ADMX.msi
```
-
### Slow boot and performance with custom policies
-WDAC evaluates all processes that run, including inbox Windows processes. You can cause slower boot times, degraded performance, and possibly boot issues if your policies don't build upon the WDAC templates or don't trust the Windows signers. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies.
+WDAC evaluates all processes that run, including inbox Windows processes. If policies don't build off the WDAC templates or don't trust the Windows signers, you'll see slower boot times, degraded performance and possibly boot issues. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies.
#### AppId Tagging policy considerations
-AppId Tagging policies that aren't built upon the WDAC base templates or don't allow the Windows in-box signers might cause a significant increase in boot times (~2 minutes).
+If the AppId Tagging Policy wasn't built off the WDAC base templates or doesn't allow the Windows in-box signers, you'll notice a significant increase in boot times (~2 minutes).
-If you can't allowlist the Windows signers or build off the WDAC base templates, add the following rule to your policies to improve the performance:
+If you can't allowlist the Windows signers, or build off the WDAC base templates, it's recommended to add the following rule to your policies to improve the performance:
:::image type="content" source="../images/known-issue-appid-dll-rule.png" alt-text="Allow all dlls in the policy.":::
:::image type="content" source="../images/known-issue-appid-dll-rule-xml.png" alt-text="Allow all dll files in the xml policy.":::
-Since AppId Tagging policies evaluate but can't tag dll files, this rule short circuits dll evaluation and improve evaluation performance.
+Since AppId Tagging policies evaluate but can't tag dll files, this rule will short circuit dll evaluation and improve evaluation performance.
diff --git a/windows/security/identity-protection/hello-for-business/images/fingerprint.svg b/windows/security/identity-protection/hello-for-business/images/fingerprint.svg
index e2b816716a..2494d65659 100644
--- a/windows/security/identity-protection/hello-for-business/images/fingerprint.svg
+++ b/windows/security/identity-protection/hello-for-business/images/fingerprint.svg
@@ -1,3 +1,3 @@
-