From e0c4798c977b18f7a1947cb14aaf21844052ad02 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 31 Jan 2023 15:26:27 -0500 Subject: [PATCH 01/23] Add new policy --- .../mdm/policy-csp-update.md | 72 ++++++++++++++++++- 1 file changed, 71 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 040028b422..7a183cb82b 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -4,7 +4,7 @@ description: Learn more about the Update Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/18/2023 +ms.date: 01/31/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -23,6 +23,7 @@ ms.topic: reference Update CSP policies are listed below based on the group policy area: - [Windows Insider Preview](#windows-insider-preview) + - [AllowTemporaryEnterpriseFeatureControl](#allowtemporaryenterprisefeaturecontrol) - [ConfigureDeadlineNoAutoRebootForFeatureUpdates](#configuredeadlinenoautorebootforfeatureupdates) - [ConfigureDeadlineNoAutoRebootForQualityUpdates](#configuredeadlinenoautorebootforqualityupdates) - [Manage updates offered from Windows Update](#manage-updates-offered-from-windows-update) @@ -103,6 +104,75 @@ Update CSP policies are listed below based on the group policy area: ## Windows Insider Preview + +### AllowTemporaryEnterpriseFeatureControl + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AllowTemporaryEnterpriseFeatureControl +``` + + + + +Features introduced via servicing (outside of the annual feature update) are off by default for devices that have their Windows updates managed*. + +- If this policy is configured to "Enabled", then all features available in the latest monthly quality update installed will be on. + +- If this policy is set to "Not Configured" or "Disabled" then features that are shipped via a monthly quality update (servicing) will remain off until the feature update that includes these features is installed. + +*Windows update managed devices are those that have their Windows updates managed via policy; whether via the cloud using Windows Update for Business or on-premises with Windows Server Update Services (WSUS). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not allowed. | +| 1 | Allowed. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AllowTemporaryEnterpriseFeatureControl | +| Friendly Name | Enable features introduced via servicing that are off by default | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| Registry Value Name | AllowTemporaryEnterpriseFeatureControl | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + ### ConfigureDeadlineNoAutoRebootForFeatureUpdates From d85300ca59615b806e5a9aa48fd6b0a642cc51a8 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 3 Feb 2023 12:33:18 -0500 Subject: [PATCH 02/23] Update Update CSP --- .../mdm/policies-in-policy-csp-supported-by-group-policy.md | 3 ++- windows/client-management/mdm/policy-csp-update.md | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index e6748d67f8..2b636d3e4f 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Group Policy. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/30/2023 +ms.date: 02/03/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -814,6 +814,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md) - [SetEDURestart](policy-csp-update.md) - [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md) +- [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md) - [SetDisableUXWUAccess](policy-csp-update.md) - [SetDisablePauseUXAccess](policy-csp-update.md) - [UpdateNotificationLevel](policy-csp-update.md) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 7a183cb82b..434acb5dde 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -4,7 +4,7 @@ description: Learn more about the Update Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/31/2023 +ms.date: 02/03/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - Update +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + From f45f167b9be4f7d7c50098cfcf19ff63fd67e466 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 6 Feb 2023 12:59:17 -0500 Subject: [PATCH 03/23] Draft for CSP DDF files --- .../mdm/configuration-service-provider-ddf.md | 575 +++++++++++++++++- 1 file changed, 572 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/configuration-service-provider-ddf.md b/windows/client-management/mdm/configuration-service-provider-ddf.md index 4a903492c4..0825b38037 100644 --- a/windows/client-management/mdm/configuration-service-provider-ddf.md +++ b/windows/client-management/mdm/configuration-service-provider-ddf.md @@ -1,7 +1,7 @@ --- title: Configuration service provider DDF files description: Learn more about the OMA DM device description framework (DDF) for various configuration service providers -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -14,7 +14,565 @@ ms.collection: highpri # Configuration service provider DDF files -This topic shows the OMA DM device description framework (DDF) for various configuration service providers. DDF files are used only with OMA DM provisioning XML. +This article lists the OMA DM device description framework (DDF) files for various configuration service providers. DDF files are used only with OMA DM provisioning XML. + +As of December 2022, DDF files schema was updated to include additional information such as OS build applicability. DDF v2 files for Windows 10 and Windows 11 are combined, and provided in a single download: + +- [DDF v2 Files, December 2022](https://download.microsoft.com/download/7/4/c/74c6daca-983e-4f16-964a-eef65b553a37/DDFv2December2022.zip) + +## DDF v2 schema + +DDF v2 schema is listed below: + +```xml + + + + + + Starting point for DDF + + + + + + + + + + + + + Main Recurring XML tag describing nodes of the CSP + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +DDF v2 files also include a reference to the `MSFT` namespace. Schema for the `MSFT` namespace is listed below: + +```xml + + + + + This node contains an XML blob that can be used as an argument to the DiagnosticsLogCSP to pull diagnostics for a feature. + + + + + This node marks that a feature is deprecated. If included, OsBuildDeprecated gives the OS Build version that the node is no longer recommended to be set. + + + + + + + + This node contains information on how to dynamically name the node such that the name is valid. + + + + + + This indicates that the server should generate a unique identifier for the node. + + + + + This indicates that the client will generate the name of the node based on the device state (such as inventorying apps). + + + + + This indicates that the server should name the node, and the value listed gives a regex to define what is allowed. + + + + + + + + + The type of the conflict resolution. + + + + + No policy merge. + + + + + The lowest value is the most secure policy value. + + + + + The highest value is the most secure policy value. + + + + + The last written value is current value + + + + + The lowest value is the most secure policy value unless the value is zero. + + + + + The highest value is the most secure policy value unless the value is zero. + + + + + + + + These tags indicate what are required on the device for the node to be applicable to configured. These tags can be inherited by children nodes. + + + + + + This tag describes the first build that a feature is released to. If the feature was backported, multiple OS versions will be listed, such that the OS build version without a minor number is the first "major release." + + + + + This tag describes the lowest CSP Version that the node was released to. + + + + + This tag describes the list of Edition IDs that the features is allowed on. 0x88* refers to Windows Holographic for Business. + + + + + This tag indicates that the node requires the device to be Azure Active Directory Joined to be applicable. + + + + + + + + These tags describe what values are allowed to be set for this particular node. + + + + + + + + + + This attribute describes what kind of Allowed Values tag this is. + + + + + + This attribute indicates that the Value tag contains an XSD for the node. + + + + + This attribute indicates that the Value tag contains a RegEx for the node. + + + + + This attribute indicates that the node can be described by an external ADMX file. + + + + + This attribute indicates that the node can be described by a JSON schema. + + + + + This attribute indicates that the allowed values are an enumeration. + + + + + This attribute indicates that the allowed values can be combined into a bitwise flag. + + + + + This attribute indicates that the allowed values are a numerical range. + + + + + This attribute indicates that the allowed values are a string in the SDDL format. + + + + + This attribute indicates there is no data-driven way to define the allowed values of the node. This potentially means that all string values are valid values. + + + + + + + + + + + + This tag indicates that the node input can contain multiple, delimited values. + + + + + This attribute details the delimeter used for the list of values. + + + + + + + + + + + This tag indicates an allowed value. + + + + + This tag gives further description to an allowed value, such as for an enumeration. + + + + + + + + + + + + + + This tag gives details for one particular enumeration of the allowed values. + + + + + + + + + + This tag indicates the relevent details for the corresponding ADMX policy for this node. + + + + + This attribute gives the area path of the ADMX policy. + + + + + This attribute gives the name of the ADMX policy. + + + + + This attribute gives the filename for the ADMX policy. + + + + + + + This tag details the replace behavior of the node. + + + + + + When performing a replace operation on this node, the value is appending to the existing node data. + + + + + When performing a replace operation on this node, the existing node data is removed before new data is added. + + + + + + + + This tag describes the reboot behavior of the node. + + + + + + No reboot is required for this node. + + + + + This node will automatically perform a reboot to take effect. + + + + + This node needs a reboot initiated from an external source to take effect. + + + + + + + + This tag details the information necessary to map this node to an existing group policy. + + + + + This attribute details the English name of the GP. + + + + + This attribute details the area path of the GP. + + + + + This attribute details a particular element of a GP that the CSP node maps to. + + + + + + + This tag lists out common error HRESULTS reported by the CSP and English text to associate with them. + + + + + + + + + + + + + + + + + + + This tag indicates that this node and all children nodes should be enclosed by an Atomic tag when being sent to the client. + + + + + These tags detail potential dependencies that the current CSP node has on other nodes in the same CSP. + + + + + + + + + + This tag describes a dependency that the current CSP node has on another nodes in the same CSP. + + + + + + The URI that the current CSP node has a dependency on. + + + + + + + This tag details the kind of dependency. + + + + + + The current node depends on the dependency holding a certain value. + + + + + The current node depends on the dependency not holding a certain value. + + + + + + + + + + This tag details one specific dependency. A node might have multiple different dependencies. + + + + + + + + + This attribute gives a friendly ID to the dependency, to differentiate it from other dependencies. + + + + + + + This tag details the values that the dependency must be set to for the dependency to be satisfied. + + + + + + + + + This tag details a change to the current node's allowed values if the dependency is satisfied. + + + + + + + +``` + +## Older DDF files You can download the DDF files for various CSPs from the links below: @@ -26,4 +584,15 @@ You can download the DDF files for various CSPs from the links below: - [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1607](https://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip) -You can download DDF file for Policy CSP from [Policy DDF file](policy-ddf-file.md). +You can view various Policy area DDF files by clicking the following links: + +- [View the Policy DDF file for Windows 10, version 20H2](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_20H2.xml) +- [View the Policy DDF file for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_2004.xml) +- [View the Policy DDF file for Windows 10, version 1903](https://download.microsoft.com/download/0/C/D/0CD61812-8B9C-4846-AC4A-1545BFD201EE/PolicyDDF_all_1903.xml) +- [View the Policy DDF file for Windows 10, version 1809](https://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/Policy_DDF_all_1809.xml) +- [View the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml) +- [View the Policy DDF file for Windows 10, version 1803 release C](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml) +- [View the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml) +- [View the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml) +- [View the Policy DDF file for Windows 10, version 1607](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml) +- [View the Policy DDF file for Windows 10, version 1607 release 8C](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) From 22ab373428424a3e15682609b2aa8f970761557c Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 6 Feb 2023 14:11:04 -0500 Subject: [PATCH 04/23] Update --- .openpublishing.redirection.json | 27 +- .../mdm/configuration-service-provider-ddf.md | 1058 +++++++++-------- .../client-management/mdm/policy-ddf-file.md | 32 - 3 files changed, 547 insertions(+), 570 deletions(-) delete mode 100644 windows/client-management/mdm/policy-ddf-file.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index e6a9c13cf5..22639222c2 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -19463,7 +19463,7 @@ { "source_path": "windows/security/threat-protection/intelligence/rootkits-malware.md", "redirect_url": "/microsoft-365/security/intelligence/rootkits-malware", - "redirect_document_id": false + "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/intelligence/safety-scanner-download.md", @@ -20114,7 +20114,7 @@ "source_path": "windows/deployment/update/update-compliance-v2-enable.md", "redirect_url": "/windows/deployment/update/wufb-reports-enable", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/update/update-compliance-v2-help.md", "redirect_url": "/windows/deployment/update/wufb-reports-help", @@ -20124,22 +20124,22 @@ "source_path": "windows/deployment/update/update-compliance-v2-overview.md", "redirect_url": "/windows/deployment/update/wufb-reports-overview", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/update/update-compliance-v2-prerequisites.md", "redirect_url": "/windows/deployment/update/wufb-reports-prerequisites", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/update/update-compliance-v2-schema-ucclient.md", "redirect_url": "/windows/deployment/update/wufb-reports-schema-ucclient", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/update/update-compliance-v2-schema-ucclientreadinessstatus.md", "redirect_url": "/windows/deployment/update/wufb-reports-schema-ucclientreadinessstatus", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/update/update-compliance-v2-schema-ucclientupdatestatus.md", "redirect_url": "/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus", @@ -20149,17 +20149,17 @@ "source_path": "windows/deployment/update/update-compliance-v2-schema-ucdevicealert.md", "redirect_url": "/windows/deployment/update/wufb-reports-schema-ucdevicealert", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/update/update-compliance-v2-schema-ucserviceupdatestatus.md", "redirect_url": "/windows/deployment/update/wufb-reports-schema-ucserviceupdatestatus", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/update/update-compliance-v2-schema-ucupdatealert.md", "redirect_url": "/windows/deployment/update/wufb-reports-schema-ucupdatealert", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/update/update-compliance-v2-schema.md", "redirect_url": "/windows/deployment/update/wufb-reports-schema", @@ -20194,7 +20194,7 @@ "source_path": "windows/deployment/planning/features-lifecycle.md", "redirect_url": "/windows/whats-new/feature-lifecycle", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/planning/windows-10-deprecated-features.md", "redirect_url": "/windows/whats-new/deprecated-features", @@ -20205,7 +20205,7 @@ "redirect_url": "/windows/whats-new/removed-features", "redirect_document_id": false }, - { + { "source_path": "windows/deployment/usmt/usmt-common-issues.md", "redirect_url": "/troubleshoot/windows-client/deployment/usmt-common-issues", "redirect_document_id": false @@ -20514,6 +20514,11 @@ "source_path": "windows/deployment/windows-autopatch/references/windows-autopatch-wqu-unsupported-policies.md", "redirect_url": "/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies", "redirect_document_id": true + }, + { + "source_path": "windows-docs-pr/windows/client-management/mdm/policy-ddf-file.md", + "redirect_url": "/windows/client-management/mdm/configuration-service-provider-ddf", + "redirect_document_id": true } ] } diff --git a/windows/client-management/mdm/configuration-service-provider-ddf.md b/windows/client-management/mdm/configuration-service-provider-ddf.md index 0825b38037..b55b3ce963 100644 --- a/windows/client-management/mdm/configuration-service-provider-ddf.md +++ b/windows/client-management/mdm/configuration-service-provider-ddf.md @@ -16,565 +16,569 @@ ms.collection: highpri This article lists the OMA DM device description framework (DDF) files for various configuration service providers. DDF files are used only with OMA DM provisioning XML. -As of December 2022, DDF files schema was updated to include additional information such as OS build applicability. DDF v2 files for Windows 10 and Windows 11 are combined, and provided in a single download: +As of December 2022, DDF XML schema was updated to include additional information such as OS build applicability. DDF v2 XML files for Windows 10 and Windows 11 are combined, and provided in a single download: - [DDF v2 Files, December 2022](https://download.microsoft.com/download/7/4/c/74c6daca-983e-4f16-964a-eef65b553a37/DDFv2December2022.zip) ## DDF v2 schema -DDF v2 schema is listed below: +DDF v2 XML schema definition is listed below along with the schema definition for the referenced `MSFT` namespace. -```xml - - - - - - Starting point for DDF - - - - - - - - - - - - - Main Recurring XML tag describing nodes of the CSP - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` +- Schema definition for DDF v2: -DDF v2 files also include a reference to the `MSFT` namespace. Schema for the `MSFT` namespace is listed below: - -```xml - - - - - This node contains an XML blob that can be used as an argument to the DiagnosticsLogCSP to pull diagnostics for a feature. - - - - - This node marks that a feature is deprecated. If included, OsBuildDeprecated gives the OS Build version that the node is no longer recommended to be set. - - - - - - - - This node contains information on how to dynamically name the node such that the name is valid. - - - - - - This indicates that the server should generate a unique identifier for the node. - - - - - This indicates that the client will generate the name of the node based on the device state (such as inventorying apps). - - - - - This indicates that the server should name the node, and the value listed gives a regex to define what is allowed. - - - - - - - - - The type of the conflict resolution. - - - - - No policy merge. - - - - - The lowest value is the most secure policy value. - - - - - The highest value is the most secure policy value. - - - - - The last written value is current value - - - - - The lowest value is the most secure policy value unless the value is zero. - - - - - The highest value is the most secure policy value unless the value is zero. - - - - - - - - These tags indicate what are required on the device for the node to be applicable to configured. These tags can be inherited by children nodes. - - - - - - This tag describes the first build that a feature is released to. If the feature was backported, multiple OS versions will be listed, such that the OS build version without a minor number is the first "major release." - - - - - This tag describes the lowest CSP Version that the node was released to. - - - - - This tag describes the list of Edition IDs that the features is allowed on. 0x88* refers to Windows Holographic for Business. - - - - - This tag indicates that the node requires the device to be Azure Active Directory Joined to be applicable. - - - - - - - - These tags describe what values are allowed to be set for this particular node. - - - - - - - - - - This attribute describes what kind of Allowed Values tag this is. - - - - - - This attribute indicates that the Value tag contains an XSD for the node. - - - - - This attribute indicates that the Value tag contains a RegEx for the node. - - - - - This attribute indicates that the node can be described by an external ADMX file. - - - - - This attribute indicates that the node can be described by a JSON schema. - - - - - This attribute indicates that the allowed values are an enumeration. - - - - - This attribute indicates that the allowed values can be combined into a bitwise flag. - - - - - This attribute indicates that the allowed values are a numerical range. - - - - - This attribute indicates that the allowed values are a string in the SDDL format. - - - - - This attribute indicates there is no data-driven way to define the allowed values of the node. This potentially means that all string values are valid values. - - - - - - - - - - + ```xml + + + + - This tag indicates that the node input can contain multiple, delimited values. + Starting point for DDF - - - This attribute details the delimeter used for the list of values. - - + + + + + - - - - - + + - This tag indicates an allowed value. + Main Recurring XML tag describing nodes of the CSP + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ``` + +- Schema definition for the `MSFT` namespace: + + ```xml + + + + + This node contains an XML blob that can be used as an argument to the DiagnosticsLogCSP to pull diagnostics for a feature. - + - This tag gives further description to an allowed value, such as for an enumeration. + This node marks that a feature is deprecated. If included, OsBuildDeprecated gives the OS Build version that the node is no longer recommended to be set. + + + - - - - - - - - - - - - This tag gives details for one particular enumeration of the allowed values. - - - - - - - - - - This tag indicates the relevent details for the corresponding ADMX policy for this node. - - - + - This attribute gives the area path of the ADMX policy. + This node contains information on how to dynamically name the node such that the name is valid. - - - - This attribute gives the name of the ADMX policy. - - - - - This attribute gives the filename for the ADMX policy. - - - - - - - This tag details the replace behavior of the node. - - - - - - When performing a replace operation on this node, the value is appending to the existing node data. - - - - - When performing a replace operation on this node, the existing node data is removed before new data is added. - - - - - - - - This tag describes the reboot behavior of the node. - - - - - - No reboot is required for this node. - - - - - This node will automatically perform a reboot to take effect. - - - - - This node needs a reboot initiated from an external source to take effect. - - - - - - - - This tag details the information necessary to map this node to an existing group policy. - - - - - This attribute details the English name of the GP. - - - - - This attribute details the area path of the GP. - - - - - This attribute details a particular element of a GP that the CSP node maps to. - - - - - - - This tag lists out common error HRESULTS reported by the CSP and English text to associate with them. - - - - - - - - - - - - - - - - - - - This tag indicates that this node and all children nodes should be enclosed by an Atomic tag when being sent to the client. - - - - - These tags detail potential dependencies that the current CSP node has on other nodes in the same CSP. - - - - - - - - - - This tag describes a dependency that the current CSP node has on another nodes in the same CSP. - - - - - - The URI that the current CSP node has a dependency on. - - - - - - - This tag details the kind of dependency. - - - - + + + - The current node depends on the dependency holding a certain value. + This indicates that the server should generate a unique identifier for the node. + + + + + This indicates that the client will generate the name of the node based on the device state (such as inventorying apps). + + + + + This indicates that the server should name the node, and the value listed gives a regex to define what is allowed. + + + + + + + + + The type of the conflict resolution. + + + + + No policy merge. - + - The current node depends on the dependency not holding a certain value. + The lowest value is the most secure policy value. + + + + + The highest value is the most secure policy value. + + + + + The last written value is current value + + + + + The lowest value is the most secure policy value unless the value is zero. + + + + + The highest value is the most secure policy value unless the value is zero. - - - - - - This tag details one specific dependency. A node might have multiple different dependencies. - - - - - - - + + - This attribute gives a friendly ID to the dependency, to differentiate it from other dependencies. + These tags indicate what are required on the device for the node to be applicable to configured. These tags can be inherited by children nodes. - - - - - - This tag details the values that the dependency must be set to for the dependency to be satisfied. - - - - - - - - - This tag details a change to the current node's allowed values if the dependency is satisfied. - - - - - - - -``` + + + + + This tag describes the first build that a feature is released to. If the feature was backported, multiple OS versions will be listed, such that the OS build version without a minor number is the first "major release." + + + + + This tag describes the lowest CSP Version that the node was released to. + + + + + This tag describes the list of Edition IDs that the features is allowed on. 0x88* refers to Windows Holographic for Business. + + + + + This tag indicates that the node requires the device to be Azure Active Directory Joined to be applicable. + + + + + + + + These tags describe what values are allowed to be set for this particular node. + + + + + + + + + + This attribute describes what kind of Allowed Values tag this is. + + + + + + This attribute indicates that the Value tag contains an XSD for the node. + + + + + This attribute indicates that the Value tag contains a RegEx for the node. + + + + + This attribute indicates that the node can be described by an external ADMX file. + + + + + This attribute indicates that the node can be described by a JSON schema. + + + + + This attribute indicates that the allowed values are an enumeration. + + + + + This attribute indicates that the allowed values can be combined into a bitwise flag. + + + + + This attribute indicates that the allowed values are a numerical range. + + + + + This attribute indicates that the allowed values are a string in the SDDL format. + + + + + This attribute indicates there is no data-driven way to define the allowed values of the node. This potentially means that all string values are valid values. + + + + + + + + + + + + This tag indicates that the node input can contain multiple, delimited values. + + + + + This attribute details the delimeter used for the list of values. + + + + + + + + + + + This tag indicates an allowed value. + + + + + This tag gives further description to an allowed value, such as for an enumeration. + + + + + + + + + + + + + + This tag gives details for one particular enumeration of the allowed values. + + + + + + + + + + This tag indicates the relevent details for the corresponding ADMX policy for this node. + + + + + This attribute gives the area path of the ADMX policy. + + + + + This attribute gives the name of the ADMX policy. + + + + + This attribute gives the filename for the ADMX policy. + + + + + + + This tag details the replace behavior of the node. + + + + + + When performing a replace operation on this node, the value is appending to the existing node data. + + + + + When performing a replace operation on this node, the existing node data is removed before new data is added. + + + + + + + + This tag describes the reboot behavior of the node. + + + + + + No reboot is required for this node. + + + + + This node will automatically perform a reboot to take effect. + + + + + This node needs a reboot initiated from an external source to take effect. + + + + + + + + This tag details the information necessary to map this node to an existing group policy. + + + + + This attribute details the English name of the GP. + + + + + This attribute details the area path of the GP. + + + + + This attribute details a particular element of a GP that the CSP node maps to. + + + + + + + This tag lists out common error HRESULTS reported by the CSP and English text to associate with them. + + + + + + + + + + + + + + + + + + + This tag indicates that this node and all children nodes should be enclosed by an Atomic tag when being sent to the client. + + + + + These tags detail potential dependencies that the current CSP node has on other nodes in the same CSP. + + + + + + + + + + This tag describes a dependency that the current CSP node has on another nodes in the same CSP. + + + + + + The URI that the current CSP node has a dependency on. + + + + + + + This tag details the kind of dependency. + + + + + + The current node depends on the dependency holding a certain value. + + + + + The current node depends on the dependency not holding a certain value. + + + + + + + + + + This tag details one specific dependency. A node might have multiple different dependencies. + + + + + + + + + This attribute gives a friendly ID to the dependency, to differentiate it from other dependencies. + + + + + + + This tag details the values that the dependency must be set to for the dependency to be satisfied. + + + + + + + + + This tag details a change to the current node's allowed values if the dependency is satisfied. + + + + + + + + ``` ## Older DDF files -You can download the DDF files for various CSPs from the links below: +You can download the older DDF files for various CSPs from the links below: - [Download all the DDF files for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/Windows10_2004_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1903](https://download.microsoft.com/download/6/F/0/6F019079-6EB0-41B5-88E8-D1CE77DBA27B/Windows10_1903_DDF_download.zip) @@ -584,7 +588,7 @@ You can download the DDF files for various CSPs from the links below: - [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1607](https://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip) -You can view various Policy area DDF files by clicking the following links: +You can download the older Policy area DDF files by clicking the following links: - [View the Policy DDF file for Windows 10, version 20H2](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_20H2.xml) - [View the Policy DDF file for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_2004.xml) diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md deleted file mode 100644 index 07c6ded973..0000000000 --- a/windows/client-management/mdm/policy-ddf-file.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Policy DDF file -description: Learn about the OMA DM device description framework (DDF) for the Policy configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 10/28/2020 ---- - -# Policy DDF file - -This topic shows the OMA DM device description framework (DDF) for the **Policy** configuration service provider. DDF files are used only with OMA DM provisioning XML. - -You can view various Policy DDF files by clicking the following links: - -- [View the Policy DDF file for Windows 10, version 20H2](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_20H2.xml) -- [View the Policy DDF file for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_2004.xml) -- [View the Policy DDF file for Windows 10, version 1903](https://download.microsoft.com/download/0/C/D/0CD61812-8B9C-4846-AC4A-1545BFD201EE/PolicyDDF_all_1903.xml) -- [View the Policy DDF file for Windows 10, version 1809](https://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/Policy_DDF_all_1809.xml) -- [View the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml) -- [View the Policy DDF file for Windows 10, version 1803 release C](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml) -- [View the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml) -- [View the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml) -- [View the Policy DDF file for Windows 10, version 1607](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml) -- [View the Policy DDF file for Windows 10, version 1607 release 8C](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) - -You can download DDF files for various CSPs from [CSP DDF files download](configuration-service-provider-ddf.md). From 7c4072364c07f884a57c5acf3dc4c6d74adc71d2 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 6 Feb 2023 14:12:19 -0500 Subject: [PATCH 05/23] Update TOC --- windows/client-management/mdm/toc.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 919e4cac79..d35962adb6 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -34,7 +34,7 @@ items: href: policy-configuration-service-provider.md items: - name: Policy CSP DDF file - href: policy-ddf-file.md + href: configuration-service-provider-ddf.md - name: Policy CSP support scenarios items: - name: ADMX policies in Policy CSP From 8607282adad6d98f8843d5dcc5180b0cb9955e14 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 6 Feb 2023 14:20:41 -0500 Subject: [PATCH 06/23] Fix broken links --- .../change-history-for-mdm-documentation.md | 8 ++++---- windows/client-management/mdm/index.yml | 2 +- .../mdm/policy-csp-controlpolicyconflict.md | 2 +- .../mdm/policy-csp-localpoliciessecurityoptions.md | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/client-management/change-history-for-mdm-documentation.md b/windows/client-management/change-history-for-mdm-documentation.md index b77a1761a8..5b7f08ac50 100644 --- a/windows/client-management/change-history-for-mdm-documentation.md +++ b/windows/client-management/change-history-for-mdm-documentation.md @@ -185,7 +185,7 @@ As of November 2020 This page will no longer be updated. This article lists new |[RemoteWipe CSP](mdm/remotewipe-csp.md)|Added new settings in Windows 10, version 1809.| |[TenantLockdown CSP](mdm/tenantlockdown-csp.md)|Added new CSP in Windows 10, version 1809.| |[WindowsDefenderApplicationGuard CSP](mdm/windowsdefenderapplicationguard-csp.md)|Added new settings in Windows 10, version 1809.| -|[Policy DDF file](mdm/policy-ddf-file.md)|Posted an updated version of the Policy DDF for Windows 10, version 1809.| +|[Policy DDF file](mdm/configuration-service-provider-ddf.md)|Posted an updated version of the Policy DDF for Windows 10, version 1809.| |[Policy CSP](mdm/policy-configuration-service-provider.md)|Added the following new policies in Windows 10, version 1809:
  • Browser/AllowFullScreenMode
  • Browser/AllowPrelaunch
  • Browser/AllowPrinting
  • Browser/AllowSavingHistory
  • Browser/AllowSideloadingOfExtensions
  • Browser/AllowTabPreloading
  • Browser/AllowWebContentOnNewTabPage
  • Browser/ConfigureFavoritesBar
  • Browser/ConfigureHomeButton
  • Browser/ConfigureKioskMode
  • Browser/ConfigureKioskResetAfterIdleTimeout
  • Browser/ConfigureOpenMicrosoftEdgeWith
  • Browser/ConfigureTelemetryForMicrosoft365Analytics
  • Browser/PreventCertErrorOverrides
  • Browser/SetHomeButtonURL
  • Browser/SetNewTabPageURL
  • Browser/UnlockHomeButton
  • Experience/DoNotSyncBrowserSettings
  • Experience/PreventUsersFromTurningOnBrowserSyncing
  • Kerberos/UPNNameHints
  • Privacy/AllowCrossDeviceClipboard
  • Privacy
  • DisablePrivacyExperience
  • Privacy/UploadUserActivities
  • System/AllowDeviceNameInDiagnosticData
  • System/ConfigureMicrosoft365UploadEndpoint
  • System/DisableDeviceDelete
  • System/DisableDiagnosticDataViewer
  • Storage/RemovableDiskDenyWriteAccess
  • Update/UpdateNotificationLevel

    Start/DisableContextMenus - added in Windows 10, version 1803.

    RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.| ## July 2018 @@ -217,7 +217,7 @@ As of November 2020 This page will no longer be updated. This article lists new |New or updated article|Description| |--- |--- | -|[Policy DDF file](mdm/policy-ddf-file.md)|Updated the DDF files in the Windows 10 version 1703 and 1709.
  • [Download the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml)
  • [Download the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)| +|[Policy DDF file](mdm/configuration-service-provider-ddf.md)|Updated the DDF files in the Windows 10 version 1703 and 1709.
  • [Download the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml)
  • [Download the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)| ## April 2018 @@ -281,7 +281,7 @@ As of November 2020 This page will no longer be updated. This article lists new | New or updated article | Description | | --- | --- | -| [Policy DDF file](mdm/policy-ddf-file.md) | Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709. | +| [Policy DDF file](mdm/configuration-service-provider-ddf.md) | Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709. | | [Policy CSP](mdm/policy-configuration-service-provider.md) | Updated the following policies:

    - Defender/ControlledFolderAccessAllowedApplications - string separator is `|`
    - Defender/ControlledFolderAccessProtectedFolders - string separator is `|` | | [eUICCs CSP](mdm/euiccs-csp.md) | Added new CSP in Windows 10, version 1709. | | [AssignedAccess CSP](mdm/assignedaccess-csp.md) | Added SyncML examples for the new Configuration node. | @@ -313,5 +313,5 @@ As of November 2020 This page will no longer be updated. This article lists new |[Office CSP](mdm/office-csp.md)|Added the following setting in Windows 10, version 1709:
  • Installation/CurrentStatus| |[BitLocker CSP](mdm/bitlocker-csp.md)|Added information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to four digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.| |[Firewall CSP](mdm/firewall-csp.md)|Updated the CSP and DDF topics. Here are the changes:
  • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
  • Changed some data types from integer to bool.
  • Updated the list of supported operations for some settings.
  • Added default values.| -|[Policy DDF file](mdm/policy-ddf-file.md)|Added another Policy DDF file [download](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) for the 8C release of Windows 10, version 1607, which added the following policies:
  • Browser/AllowMicrosoftCompatibilityList
  • Update/DisableDualScan
  • Update/FillEmptyContentUrls| +|[Policy DDF file](mdm/configuration-service-provider-ddf.md)|Added another Policy DDF file [download](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) for the 8C release of Windows 10, version 1607, which added the following policies:
  • Browser/AllowMicrosoftCompatibilityList
  • Update/DisableDualScan
  • Update/FillEmptyContentUrls| |[Policy CSP](mdm/policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1709:
  • Browser/ProvisionFavorites
  • Browser/LockdownFavorites
  • ExploitGuard/ExploitProtectionSettings
  • Games/AllowAdvancedGamingServices
  • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
  • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
  • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
  • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
  • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
  • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
  • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
  • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
  • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
  • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
  • Privacy/EnableActivityFeed
  • Privacy/PublishUserActivities
  • Update/DisableDualScan
  • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork

    Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.

    Changed the names of the following policies:
  • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
  • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
  • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess

    Added links to the extra [ADMX-backed BitLocker policies](mdm/policy-csp-bitlocker.md).

    There were issues reported with the previous release of the following policies. These issues were fixed in Windows 10, version 1709:
  • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
  • Start/HideAppList| diff --git a/windows/client-management/mdm/index.yml b/windows/client-management/mdm/index.yml index d8bd8ed982..db2be7efaf 100644 --- a/windows/client-management/mdm/index.yml +++ b/windows/client-management/mdm/index.yml @@ -47,7 +47,7 @@ landingContent: - text: Policy CSP url: policy-configuration-service-provider.md - text: Policy DDF file - url: policy-ddf-file.md + url: configuration-service-provider-ddf.md - text: Policy CSP - Start url: policy-csp-start.md - text: Policy CSP - Update diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index f955123b29..b6865f7b07 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -58,7 +58,7 @@ This ensures that: - The current Policy Manager policies are refreshed from what MDM has set - Any values set by scripts/user outside of GP that conflict with MDM are removed -The [Policy DDF](policy-ddf-file.md) contains the following tags to identify the policies with equivalent GP: +The [Policy DDF](configuration-service-provider-ddf.md) contains the following tags to identify the policies with equivalent GP: - \ - \ diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 459b035faf..075a1bd389 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -19,7 +19,7 @@ ms.topic: reference > [!NOTE] -> To find data formats (and other policy-related details), see [Policy DDF file](./policy-ddf-file.md). +> To find data formats (and other policy-related details), see [Policy DDF file](./configuration-service-provider-ddf.md). From fd9d7ac6ef6ee08dd128111579a334c9f1528a15 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 6 Feb 2023 14:21:48 -0500 Subject: [PATCH 07/23] Fix redirect --- .openpublishing.redirection.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 22639222c2..645db60d9e 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20516,7 +20516,7 @@ "redirect_document_id": true }, { - "source_path": "windows-docs-pr/windows/client-management/mdm/policy-ddf-file.md", + "source_path": "windows/client-management/mdm/policy-ddf-file.md", "redirect_url": "/windows/client-management/mdm/configuration-service-provider-ddf", "redirect_document_id": true } From 9719a245a7fec2c5cfc7fb2eb3f3244308bcd858 Mon Sep 17 00:00:00 2001 From: Andre Della Monica Date: Mon, 6 Feb 2023 20:03:28 -0600 Subject: [PATCH 08/23] Doc updates to Feature and Quality updates --- ...autopatch-windows-feature-update-overview.md | 6 +++--- ...autopatch-windows-quality-update-overview.md | 17 ++++++++++++----- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index b58aa2938f..5f3cf42951 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -1,7 +1,7 @@ --- title: Windows feature updates description: This article explains how Windows feature updates are managed in Autopatch -ms.date: 02/02/2023 +ms.date: 02/07/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -88,7 +88,7 @@ Windows Autopatch provides a permanent pause of a Windows feature update deploym 8. If you're resuming an update, you can select one or more deployment rings. 9. Select **Okay**. -If you've paused an update, the specified release will have the **Customer Paused** status. The Windows Autopatch service can't overwrite a customer-initiated pause. You must select **Resume** to resume the update. +If you've paused an update, the specified release will have the **Customer Pause** status. The Windows Autopatch service can't overwrite IT admin's pause. You must select **Resume** to resume the update. > [!NOTE] > The **Service Paused** status only applies to [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release). Windows Autopatch doesn't pause Windows feature updates on your behalf. @@ -98,7 +98,7 @@ If you've paused an update, the specified release will have the **Customer Pause Windows Autopatch doesn’t support the rollback of Windows Feature updates. > [!CAUTION] -> It’s not recommended to use [Microsoft Intune’s capabilities](/mem/intune/protect/windows-10-update-rings#manage-your-windows-update-rings) to pause and rollback a Windows feature update. However, if you choose to pause, resume and/or roll back from Intune, Windows Autopatch is **not** responsible for any problems that arise from rolling back the Windows feature update. +> It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). ## Contact support diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index c8ab6062c6..2ed89e8d06 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -1,7 +1,7 @@ --- title: Windows quality updates description: This article explains how Windows quality updates are managed in Autopatch -ms.date: 12/15/2022 +ms.date: 02/07/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -9,7 +9,7 @@ ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan manager: dougeby -msreviewer: hathind +msreviewer: andredm7 --- # Windows quality updates @@ -125,12 +125,19 @@ If Windows Autopatch detects a [significant issue with a release](../operate/win 8. If you're resuming an update, you can select one or more deployment rings. 9. Select **Okay**. -There are two statuses associated with paused quality updates, **Service Paused** and **Customer Paused**. +> [!CAUTION] +> It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). + +There are three statuses associated with paused quality updates, **Service Paused**, **Customer Paused** and **Customer & Service pause**. | Status | Description | | ----- | ------ | -| Service Paused | If the Windows Autopatch service has paused an update, the release will have the **Service Paused** status. You must [submit a support request](windows-autopatch-support-request.md) to resume the update. | -| Customer Paused | If you've paused an update, the release will have the **Customer Paused** status. The Windows Autopatch service can't overwrite a customer-initiated pause. You must select **Resume** to resume the update. | +| Service Pause | If the Windows Autopatch service has paused an update, the release will have the **Service Pause** status. You must [submit a support request](windows-autopatch-support-request.md) to resume the update. | +| Customer Pause | If you've paused an update, the release will have the **Customer Pause** status. The Windows Autopatch service can't overwrite a customer-initiated pause. You must select **Resume** to resume the update. | +| Customer & Service Pause | If you and Microsoft (Windows Autopatch service) have both paused an update, the release will have the **Customer & Service pause** status. If you plan on resuming an update deployment under this mixed state, you must first [submit a support request](windows-autopatch-support-request.md) for Windows Autopatch service engineers to resume the update deployment on your behalf, this will change your update deployment status to **Customer pause**, once this happens, you can resume the update deployment in Windows Autopatch Release management blade yourself. | + +> [!NOTE] +> The service-level pause of updates is driven by the various software update deployment-related signals Windows Autopatch receive from Windows Update for Business several other product groups within Microsoft. ## Remediating Ineligible and/or Not up to Date devices From 6050b7cd71e4802c908a12c71ecfa182c09563ea Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Mon, 6 Feb 2023 19:41:41 -0800 Subject: [PATCH 09/23] Update windows-autopatch-windows-feature-update-overview.md --- .../windows-autopatch-windows-feature-update-overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index 5f3cf42951..0d53f7c783 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -91,14 +91,14 @@ Windows Autopatch provides a permanent pause of a Windows feature update deploym If you've paused an update, the specified release will have the **Customer Pause** status. The Windows Autopatch service can't overwrite IT admin's pause. You must select **Resume** to resume the update. > [!NOTE] -> The **Service Paused** status only applies to [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release). Windows Autopatch doesn't pause Windows feature updates on your behalf. +> The **Service Pause** status only applies to [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release). Windows Autopatch doesn't pause Windows feature updates on your behalf. ## Rollback Windows Autopatch doesn’t support the rollback of Windows Feature updates. > [!CAUTION] -> It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). +> It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). ## Contact support From 4735447f4381f2a9c62fe0cda6915f096e61a44f Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Mon, 6 Feb 2023 19:45:04 -0800 Subject: [PATCH 10/23] Update windows-autopatch-windows-quality-update-overview.md --- .../windows-autopatch-windows-quality-update-overview.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index 2ed89e8d06..ee7cad09af 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -128,13 +128,13 @@ If Windows Autopatch detects a [significant issue with a release](../operate/win > [!CAUTION] > It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). -There are three statuses associated with paused quality updates, **Service Paused**, **Customer Paused** and **Customer & Service pause**. +The three following statuses are associated with paused quality updates: | Status | Description | | ----- | ------ | -| Service Pause | If the Windows Autopatch service has paused an update, the release will have the **Service Pause** status. You must [submit a support request](windows-autopatch-support-request.md) to resume the update. | +| Service Pause | If the Windows Autopatch service has paused an update, the release will have the **Service Pause** status. You must [submit a support request](../operate/windows-autopatch-support-request.md) to resume the update. | | Customer Pause | If you've paused an update, the release will have the **Customer Pause** status. The Windows Autopatch service can't overwrite a customer-initiated pause. You must select **Resume** to resume the update. | -| Customer & Service Pause | If you and Microsoft (Windows Autopatch service) have both paused an update, the release will have the **Customer & Service pause** status. If you plan on resuming an update deployment under this mixed state, you must first [submit a support request](windows-autopatch-support-request.md) for Windows Autopatch service engineers to resume the update deployment on your behalf, this will change your update deployment status to **Customer pause**, once this happens, you can resume the update deployment in Windows Autopatch Release management blade yourself. | +| Customer & Service Pause | If you and Windows Autopatch have both paused an update, the release will have the **Customer & Service Pause** status. If you plan on resuming an update deployment under this mixed state, you must first [submit a support request](../operate/windows-autopatch-support-request.md) for Windows Autopatch to resume the update deployment on your behalf. After approval, the update deployment status will change to **Customer Pause**. Once this happens, you can resume the update deployment in Windows Autopatch Release management blade. | > [!NOTE] > The service-level pause of updates is driven by the various software update deployment-related signals Windows Autopatch receive from Windows Update for Business several other product groups within Microsoft. From 3540e551d428c21eeed3cd59845043d6983cb727 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Mon, 6 Feb 2023 19:45:37 -0800 Subject: [PATCH 11/23] Update windows-autopatch-windows-feature-update-overview.md --- .../windows-autopatch-windows-feature-update-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index 0d53f7c783..5289b2b06f 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -95,7 +95,7 @@ If you've paused an update, the specified release will have the **Customer Pause ## Rollback -Windows Autopatch doesn’t support the rollback of Windows Feature updates. +Windows Autopatch doesn’t support the rollback of Windows feature updates. > [!CAUTION] > It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). From dada47a33c1a22c74b66abc8995cfe8d1e562c4a Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Tue, 7 Feb 2023 06:49:19 -0800 Subject: [PATCH 12/23] Update windows-autopatch-windows-feature-update-overview.md --- .../windows-autopatch-windows-feature-update-overview.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index 5289b2b06f..fb14accf70 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -73,6 +73,10 @@ Windows Autopatch provides a permanent pause of a Windows feature update deploym ## Pausing and resuming a release +> [!CAUTION] +> It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). + + > [!IMPORTANT] > Pausing or resuming an update can take up to eight hours to be applied to devices. Windows Autopatch uses Microsoft Intune as its management solution and that's the average frequency devices take to communicate back to Microsoft Intune with new instructions to pause, resume or rollback updates.

    For more information, see [how long does it take for devices to get a policy, profile, or app after they are assigned from Microsoft Intune](/mem/intune/configuration/device-profile-troubleshoot#how-long-does-it-take-for-devices-to-get-a-policy-profile-or-app-after-they-are-assigned).

    From bb140fa7c3411341ad07904d39f372992e9f7e8e Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Tue, 7 Feb 2023 06:50:04 -0800 Subject: [PATCH 13/23] Update windows-autopatch-windows-feature-update-overview.md --- .../operate/windows-autopatch-windows-feature-update-overview.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index fb14accf70..7425935a04 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -76,7 +76,6 @@ Windows Autopatch provides a permanent pause of a Windows feature update deploym > [!CAUTION] > It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). - > [!IMPORTANT] > Pausing or resuming an update can take up to eight hours to be applied to devices. Windows Autopatch uses Microsoft Intune as its management solution and that's the average frequency devices take to communicate back to Microsoft Intune with new instructions to pause, resume or rollback updates.

    For more information, see [how long does it take for devices to get a policy, profile, or app after they are assigned from Microsoft Intune](/mem/intune/configuration/device-profile-troubleshoot#how-long-does-it-take-for-devices-to-get-a-policy-profile-or-app-after-they-are-assigned).

    From ba077c67462cb50bb07b6ce8cb8e5522cec934fa Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Tue, 7 Feb 2023 07:03:49 -0800 Subject: [PATCH 14/23] Update windows-autopatch-windows-quality-update-overview.md --- .../windows-autopatch-windows-quality-update-overview.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index ee7cad09af..f585127b25 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -108,6 +108,9 @@ Windows Autopatch schedules and deploys required Out of Band (OOB) updates relea ### Pausing and resuming a release +> [!CAUTION] +> It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). + If Windows Autopatch detects a [significant issue with a release](../operate/windows-autopatch-windows-quality-update-signals.md), we may decide to pause that release. > [!IMPORTANT] @@ -125,9 +128,6 @@ If Windows Autopatch detects a [significant issue with a release](../operate/win 8. If you're resuming an update, you can select one or more deployment rings. 9. Select **Okay**. -> [!CAUTION] -> It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). - The three following statuses are associated with paused quality updates: | Status | Description | From 13f46a695fda77ee3e10c66b6425571f379d2d4f Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Tue, 7 Feb 2023 08:16:34 -0800 Subject: [PATCH 15/23] Update windows-autopatch-windows-quality-update-overview.md --- .../windows-autopatch-windows-quality-update-overview.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index f585127b25..d0f0148818 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -111,7 +111,7 @@ Windows Autopatch schedules and deploys required Out of Band (OOB) updates relea > [!CAUTION] > It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). -If Windows Autopatch detects a [significant issue with a release](../operate/windows-autopatch-windows-quality-update-signals.md), we may decide to pause that release. +The service-level pause of updates is driven by the various software update deployment-related signals Windows Autopatch receive from Windows Update for Business several other product groups within Microsoft. If Windows Autopatch detects a [significant issue with a release](../operate/windows-autopatch-windows-quality-update-signals.md), we may decide to pause that release. > [!IMPORTANT] > Pausing or resuming an update can take up to eight hours to be applied to devices. Windows Autopatch uses Microsoft Intune as its management solution and that's the average frequency devices take to communicate back to Microsoft Intune with new instructions to pause, resume or rollback updates.

    For more information, see [how long does it take for devices to get a policy, profile, or app after they are assigned from Microsoft Intune](/mem/intune/configuration/device-profile-troubleshoot#how-long-does-it-take-for-devices-to-get-a-policy-profile-or-app-after-they-are-assigned).

    @@ -136,9 +136,6 @@ The three following statuses are associated with paused quality updates: | Customer Pause | If you've paused an update, the release will have the **Customer Pause** status. The Windows Autopatch service can't overwrite a customer-initiated pause. You must select **Resume** to resume the update. | | Customer & Service Pause | If you and Windows Autopatch have both paused an update, the release will have the **Customer & Service Pause** status. If you plan on resuming an update deployment under this mixed state, you must first [submit a support request](../operate/windows-autopatch-support-request.md) for Windows Autopatch to resume the update deployment on your behalf. After approval, the update deployment status will change to **Customer Pause**. Once this happens, you can resume the update deployment in Windows Autopatch Release management blade. | -> [!NOTE] -> The service-level pause of updates is driven by the various software update deployment-related signals Windows Autopatch receive from Windows Update for Business several other product groups within Microsoft. - ## Remediating Ineligible and/or Not up to Date devices To ensure your devices receive Windows quality updates, Windows Autopatch provides information on how you can remediate [Ineligible Devices (Customer Actions)](../operate/windows-autopatch-windows-quality-update-reports-overview.md#ineligible-devices-customer-action). In addition, the Windows Autopatch service may remediate [Not up to Date devices](../operate/windows-autopatch-windows-quality-update-reports-overview.md#not-up-to-date-microsoft-action) to bring them back into compliance. From ccdf23dececf81ea2f04491a26bfbf44204be7e2 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Tue, 7 Feb 2023 11:09:39 -0800 Subject: [PATCH 16/23] Update windows-autopatch-windows-quality-update-overview.md --- .../windows-autopatch-windows-quality-update-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index d0f0148818..5c89498b75 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -134,7 +134,7 @@ The three following statuses are associated with paused quality updates: | ----- | ------ | | Service Pause | If the Windows Autopatch service has paused an update, the release will have the **Service Pause** status. You must [submit a support request](../operate/windows-autopatch-support-request.md) to resume the update. | | Customer Pause | If you've paused an update, the release will have the **Customer Pause** status. The Windows Autopatch service can't overwrite a customer-initiated pause. You must select **Resume** to resume the update. | -| Customer & Service Pause | If you and Windows Autopatch have both paused an update, the release will have the **Customer & Service Pause** status. If you plan on resuming an update deployment under this mixed state, you must first [submit a support request](../operate/windows-autopatch-support-request.md) for Windows Autopatch to resume the update deployment on your behalf. After approval, the update deployment status will change to **Customer Pause**. Once this happens, you can resume the update deployment in Windows Autopatch Release management blade. | +| Customer & Service Pause | If you and Windows Autopatch have both paused an update, the release will have the Customer & Service Pause status. If you resume the update, and the Service Pause status still remains, you must [submit a support request](../operate/windows-autopatch-support-request.md) for Windows Autopatch to resume the update deployment on your behalf. | ## Remediating Ineligible and/or Not up to Date devices From 974834f1de9ee341caa655285cc0290b84232e35 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Tue, 7 Feb 2023 11:19:13 -0800 Subject: [PATCH 17/23] Update windows-autopatch-windows-quality-update-overview.md --- .../windows-autopatch-windows-quality-update-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index 5c89498b75..0651acb3f9 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -134,7 +134,7 @@ The three following statuses are associated with paused quality updates: | ----- | ------ | | Service Pause | If the Windows Autopatch service has paused an update, the release will have the **Service Pause** status. You must [submit a support request](../operate/windows-autopatch-support-request.md) to resume the update. | | Customer Pause | If you've paused an update, the release will have the **Customer Pause** status. The Windows Autopatch service can't overwrite a customer-initiated pause. You must select **Resume** to resume the update. | -| Customer & Service Pause | If you and Windows Autopatch have both paused an update, the release will have the Customer & Service Pause status. If you resume the update, and the Service Pause status still remains, you must [submit a support request](../operate/windows-autopatch-support-request.md) for Windows Autopatch to resume the update deployment on your behalf. | +| Customer & Service Pause | If you and Windows Autopatch have both paused an update, the release will have the **Customer & Service Pause** status. If you resume the update, and the **Service Pause** status still remains, you must [submit a support request](../operate/windows-autopatch-support-request.md) for Windows Autopatch to resume the update deployment on your behalf. | ## Remediating Ineligible and/or Not up to Date devices From 09b3ec450ac84e2166805231457053254f432da4 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Tue, 7 Feb 2023 11:46:39 -0800 Subject: [PATCH 18/23] Update windows-autopatch-windows-quality-update-overview.md --- .../windows-autopatch-windows-quality-update-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index 0651acb3f9..107c863015 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -133,7 +133,7 @@ The three following statuses are associated with paused quality updates: | Status | Description | | ----- | ------ | | Service Pause | If the Windows Autopatch service has paused an update, the release will have the **Service Pause** status. You must [submit a support request](../operate/windows-autopatch-support-request.md) to resume the update. | -| Customer Pause | If you've paused an update, the release will have the **Customer Pause** status. The Windows Autopatch service can't overwrite a customer-initiated pause. You must select **Resume** to resume the update. | +| Customer Pause | If you've paused an update, the release will have the **Customer Pause** status. The Windows Autopatch service can't overwrite an IT admin's pause. You must select **Resume** to resume the update. | | Customer & Service Pause | If you and Windows Autopatch have both paused an update, the release will have the **Customer & Service Pause** status. If you resume the update, and the **Service Pause** status still remains, you must [submit a support request](../operate/windows-autopatch-support-request.md) for Windows Autopatch to resume the update deployment on your behalf. | ## Remediating Ineligible and/or Not up to Date devices From d01dc9e1527cbc680f99eb7496db281fb74f72f0 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 8 Feb 2023 08:11:24 -0800 Subject: [PATCH 19/23] Tweak --- .../windows-autopatch-windows-quality-update-overview.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index 107c863015..0ff47c507d 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -111,7 +111,9 @@ Windows Autopatch schedules and deploys required Out of Band (OOB) updates relea > [!CAUTION] > It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). -The service-level pause of updates is driven by the various software update deployment-related signals Windows Autopatch receive from Windows Update for Business several other product groups within Microsoft. If Windows Autopatch detects a [significant issue with a release](../operate/windows-autopatch-windows-quality-update-signals.md), we may decide to pause that release. +The service-level pause of updates is driven by the various software update deployment-related signals Windows Autopatch receives from Windows Update for Business, and several other product groups within Microsoft. + +If Windows Autopatch detects a [significant issue with a release](../operate/windows-autopatch-windows-quality-update-signals.md), we may decide to pause that release. > [!IMPORTANT] > Pausing or resuming an update can take up to eight hours to be applied to devices. Windows Autopatch uses Microsoft Intune as its management solution and that's the average frequency devices take to communicate back to Microsoft Intune with new instructions to pause, resume or rollback updates.

    For more information, see [how long does it take for devices to get a policy, profile, or app after they are assigned from Microsoft Intune](/mem/intune/configuration/device-profile-troubleshoot#how-long-does-it-take-for-devices-to-get-a-policy-profile-or-app-after-they-are-assigned).

    From 466e0ce1aa02b4111e4954c7dd7b1eaac265f4d5 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 8 Feb 2023 08:22:05 -0800 Subject: [PATCH 20/23] Tweak. --- .../operate/windows-autopatch-support-request.md | 2 -- .../windows-autopatch-windows-feature-update-overview.md | 2 +- .../prepare/windows-autopatch-enrollment-support-request.md | 2 +- 3 files changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md index 800f387276..79ff9e1b78 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md @@ -17,8 +17,6 @@ msreviewer: hathind > [!IMPORTANT] > Make sure you've [added and verified your admin contacts](../deploy/windows-autopatch-admin-contacts.md). The Windows Autopatch Service Engineering Team will contact these individuals for assistance with remediating issues. -You can submit support tickets to Microsoft using the Windows Autopatch admin center. Email is the recommended approach to interact with the Windows Autopatch Service Engineering Team. - ## Submit a new support request Support requests are triaged and responded to as they're received. diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index 7425935a04..4d8d128f89 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -105,4 +105,4 @@ Windows Autopatch doesn’t support the rollback of Windows feature updates. ## Contact support -If you’re experiencing issues related to Windows feature updates, you can [submit a support request](../operate/windows-autopatch-support-request.md). Email is the recommended approach to interact with the Windows Autopatch Service Engineering Team. +If you’re experiencing issues related to Windows feature updates, you can [submit a support request](../operate/windows-autopatch-support-request.md). diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md index c36be7a98b..44447d5697 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md @@ -14,7 +14,7 @@ msreviewer: hathind # Submit a tenant enrollment support request -If you need more assistance with tenant enrollment, you can submit support requests to the Windows Autopatch Service Engineering Team in the Windows Autopatch enrollment tool. Email is the recommended approach to interact with the Windows Autopatch Service Engineering Team. +If you need more assistance with tenant enrollment, you can submit support requests to the Windows Autopatch Service Engineering Team in the Windows Autopatch enrollment tool. > [!NOTE] > After you've successfully enrolled your tenant, this feature will no longer be accessible. You must [submit a support request through the Tenant administration menu](../operate/windows-autopatch-support-request.md). From 2f809b5ce63b9100fbcc15e9d63bf5954945696f Mon Sep 17 00:00:00 2001 From: Jared Agee Date: Wed, 8 Feb 2023 11:36:01 -0600 Subject: [PATCH 21/23] Update remote-credential-guard.md Removed redundant portion of a sentence, "to turn on Windows Defender Remote Credential Guard". --- .../security/identity-protection/remote-credential-guard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index e094da893b..eb1922b3a8 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -128,7 +128,7 @@ You must enable Restricted Admin or Windows Defender Remote Credential Guard on - Add a new DWORD value named **DisableRestrictedAdmin**. - - To turn on Restricted Admin and Windows Defender Remote Credential Guard, set the value of this registry setting to 0 to turn on Windows Defender Remote Credential Guard. + - To turn on Restricted Admin and Windows Defender Remote Credential Guard, set the value of this registry setting to 0. 3. Close Registry Editor. @@ -189,4 +189,4 @@ mstsc.exe /remoteGuard - No credentials are sent to the target device, but the target device still acquires Kerberos Service Tickets on its own. -- The server and client must authenticate using Kerberos. \ No newline at end of file +- The server and client must authenticate using Kerberos. From bc4215046196969c65c42f6a46a68f68137dc75a Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 8 Feb 2023 14:01:26 -0800 Subject: [PATCH 22/23] Tweak. --- .../windows-autopatch-windows-quality-update-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index 0ff47c507d..c2ad146ec6 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -89,7 +89,7 @@ By default, the service expedites quality updates as needed. For those organizat **To turn off service-driven expedited quality updates:** 1. Go to **[Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Devices**. -2. Under **Windows Autopatch** > **Release management**, go to the **Release settings** tab and turn off the **Expedited Quality Updates** setting. +2. Under **Windows Autopatch** > **Release management**, go to the **Release settings** tab and turn off the **Expedited quality updates** setting. > [!NOTE] > Windows Autopatch doesn't allow customers to request expedited releases. From 1a8346994b82d7db547a5ae0729f7ea3fafad082 Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Wed, 8 Feb 2023 16:18:18 -0700 Subject: [PATCH 23/23] Update policy-csp-update.md https://microsoft-ce-csi.acrolinx.cloud/api/v1/checking/scorecards/e399e338-279c-47c8-b5ad-b239d24218f0#CORRECTNESS Line 2665 and 3061: is a integer. > is an integer. Line 2736: on the every week. > every week. Line 3120: allows to remove > allows removing --- windows/client-management/mdm/policy-csp-update.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 434acb5dde..e9921d6795 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -2662,7 +2662,7 @@ If you select "Apply only during active hours" in conjunction with Option 1 or 2 -Enables the IT admin to schedule the day of the update installation. The data type is a integer. +Enables the IT admin to schedule the day of the update installation. The data type is an integer. @@ -2733,7 +2733,7 @@ Enables the IT admin to schedule the day of the update installation. The data ty -Enables the IT admin to schedule the update installation on the every week. Value type is integer. +Enables the IT admin to schedule the update installation every week. Value type is integer. @@ -3058,7 +3058,7 @@ Enables the IT admin to schedule the update installation on the third week of th - the IT admin to schedule the time of the update installation. The data type is a integer. Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. The default value is 3. + the IT admin to schedule the time of the update installation. The data type is an integer. Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. The default value is 3. @@ -3117,7 +3117,7 @@ Enables the IT admin to schedule the update installation on the third week of th -This setting allows to remove access to "Pause updates" feature. +This setting allows removing access to "Pause updates" feature. Once enabled user access to pause updates is removed.