From 50d91f3ddfaded2d3b78a1e28901d6902bff2b55 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 18 Jul 2023 08:36:09 -0700 Subject: [PATCH 001/125] ds-api-props-8092737 --- .../deployment/update/deployment-service-feature-updates.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/deployment-service-feature-updates.md b/windows/deployment/update/deployment-service-feature-updates.md index b1a289befa..0b81021c36 100644 --- a/windows/deployment/update/deployment-service-feature-updates.md +++ b/windows/deployment/update/deployment-service-feature-updates.md @@ -8,7 +8,7 @@ ms.author: mstewart manager: aaroncz ms.topic: article ms.technology: itpro-updates -ms.date: 02/14/2023 +ms.date: 07/31/2023 --- # Deploy feature updates with Windows Update for Business deployment service @@ -82,7 +82,8 @@ The following truncated response displays a **Catalog ID** of `d9049ddb-0ca8-4b "displayName": "Windows 11, version 22H2", "deployableUntilDateTime": "2025-10-14T00:00:00Z", "releaseDateTime": "2022-09-20T00:00:00Z", - "version": "Windows 11, version 22H2" + "version": "Windows 11, version 22H2", + "buildNumber": "22621" } ] } From d943a7aedbd32499a892ccd114d27885b04d780e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 18 Jul 2023 11:04:18 -0700 Subject: [PATCH 002/125] ds-api-props-8092737 --- .../deployment/update/deployment-service-expedited-updates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/deployment-service-expedited-updates.md b/windows/deployment/update/deployment-service-expedited-updates.md index 14b6fec38a..f284522eb8 100644 --- a/windows/deployment/update/deployment-service-expedited-updates.md +++ b/windows/deployment/update/deployment-service-expedited-updates.md @@ -8,7 +8,7 @@ ms.author: mstewart manager: aaroncz ms.topic: article ms.technology: itpro-updates -ms.date: 02/14/2023 +ms.date: 07/31/2023 --- # Deploy expedited updates with Windows Update for Business deployment service From 777af751f8c72b639840800a18313d2ed53577a6 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 9 Aug 2023 12:07:53 +0200 Subject: [PATCH 003/125] PDE initial export --- .../personal-data-encryption/configure.md | 37 +++++++++++++++++++ .../personal-data-encryption/toc.yml | 4 +- 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md new file mode 100644 index 0000000000..228d8faf26 --- /dev/null +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -0,0 +1,37 @@ +--- +title: PDE settings and configuration +description: Learn about the available options to configure Personal Data Encryption (PDE) and how to configure them via Microsoft Intune or configuration Service Provider (CSP). +ms.topic: how-to +ms.date: 03/13/2023 +--- + +# PDE settings and configuration + +This article describes the Personal Data Encryption (PDE) settings and how to configure them via Microsoft Intune or configuration Service Provider (CSP). + +## PDE settings list + +## PDE configuration + +### Configure PDE with Microsoft Intune + +To configure devices using Microsoft Intune, [create a **Settings catalog** policy][MEM-1], and use the settings listed under the category **`Local Policies Security Options`**: + +Assign the policy to a security group that contains as members the devices or users that you want to configure. + +### Configure PDE with CSP + +Alternatively, you can configure devices using a [custom policy][MEM-2] with the [Name CSP][CSP-1].\ + +The policy settings are located under: `./Device/Vendor/MSFT/`. + +|Setting| +| - | +| **Setting name**: Title
**Policy CSP name**: `Setting Name`| + + + +[CSP-1]: /windows/client-management/mdm/policy-csp-localpoliciessecurityoptions + +[MEM-1]: /mem/intune/configuration/settings-catalog +[MEM-2]: /mem/intune/configuration/custom-settings-windows-10 \ No newline at end of file diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/toc.yml b/windows/security/operating-system-security/data-protection/personal-data-encryption/toc.yml index 0bb7c66820..72bc8d3dce 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/toc.yml +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/toc.yml @@ -1,7 +1,9 @@ items: - name: Overview href: index.md -- name: Configure PDE with Intune +- name: Configure PD`E + href: configure.md +- name: (Old) Configure PDE with Intune href: configure-pde-in-intune.md - name: Enable Personal Data Encryption (PDE) href: intune-enable-pde.md From f29b6870af539b6cc3398660012d3e1126233b8e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 9 Aug 2023 12:09:30 +0200 Subject: [PATCH 004/125] removed include file --- .../includes/pde-description.md | 20 ------------------- .../personal-data-encryption/index.md | 14 ++++++++++++- 2 files changed, 13 insertions(+), 21 deletions(-) delete mode 100644 windows/security/operating-system-security/data-protection/personal-data-encryption/includes/pde-description.md diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/includes/pde-description.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/includes/pde-description.md deleted file mode 100644 index b34908147d..0000000000 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/includes/pde-description.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -ms.topic: include -ms.date: 03/13/2023 ---- - - - - -Starting in Windows 11, version 22H2, Personal Data Encryption (PDE) is a security feature that provides more encryption capabilities to Windows. - -PDE differs from BitLocker in that it encrypts individual files and content instead of whole volumes and disks. PDE occurs in addition to other encryption methods such as BitLocker. - -PDE utilizes Windows Hello for Business to link data encryption keys with user credentials. This feature can minimize the number of credentials the user has to remember to gain access to content. For example, when using BitLocker with PIN, a user would need to authenticate twice - once with the BitLocker PIN and a second time with Windows credentials. This requirement requires users to remember two different credentials. With PDE, users only need to enter one set of credentials via Windows Hello for Business. - -Because PDE utilizes Windows Hello for Business, PDE is also accessibility friendly due to the accessibility features available when using Windows Hello for Business. - -Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user signs in using Windows Hello for Business. Users will only be able to access their PDE protected content once they've signed into Windows using Windows Hello for Business. Additionally, PDE has the ability to also discard the encryption keys when the device is locked. - -> [!NOTE] -> PDE can be enabled using MDM policies. The content to be protected by PDE can be specified using [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). There is no user interface in Windows to either enable PDE or protect content using PDE. diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md index 83e0433698..617cf005e1 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md @@ -7,7 +7,19 @@ ms.date: 03/13/2023 # Personal Data Encryption (PDE) -[!INCLUDE [Personal Data Encryption (PDE) description](includes/pde-description.md)] +Starting in Windows 11, version 22H2, Personal Data Encryption (PDE) is a security feature that provides more encryption capabilities to Windows. + +PDE differs from BitLocker in that it encrypts individual files and content instead of whole volumes and disks. PDE occurs in addition to other encryption methods such as BitLocker. + +PDE utilizes Windows Hello for Business to link data encryption keys with user credentials. This feature can minimize the number of credentials the user has to remember to gain access to content. For example, when using BitLocker with PIN, a user would need to authenticate twice - once with the BitLocker PIN and a second time with Windows credentials. This requirement requires users to remember two different credentials. With PDE, users only need to enter one set of credentials via Windows Hello for Business. + +Because PDE utilizes Windows Hello for Business, PDE is also accessibility friendly due to the accessibility features available when using Windows Hello for Business. + +Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user signs in using Windows Hello for Business. Users will only be able to access their PDE protected content once they've signed into Windows using Windows Hello for Business. Additionally, PDE has the ability to also discard the encryption keys when the device is locked. + +> [!NOTE] +> PDE can be enabled using MDM policies. The content to be protected by PDE can be specified using [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). There is no user interface in Windows to either enable PDE or protect content using PDE. + [!INCLUDE [personal-data-encryption-pde](../../../../../includes/licensing/personal-data-encryption-pde.md)] From 2324a12d483b9e23cf1a2923568659b75ce8d14f Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 9 Aug 2023 12:42:59 +0200 Subject: [PATCH 005/125] articles merge --- .../configure-pde-in-intune.md | 30 --- .../personal-data-encryption/configure.md | 251 ++++++++++++++++++ .../{faq-pde.yml => faq.yml} | 0 .../intune-disable-arso.md | 63 ----- .../intune-disable-hibernation.md | 62 ----- .../intune-disable-memory-dumps.md | 61 ----- ...tune-disable-password-connected-standby.md | 76 ------ .../intune-disable-wer.md | 64 ----- .../intune-enable-pde.md | 70 ----- .../personal-data-encryption/toc.yml | 20 +- 10 files changed, 254 insertions(+), 443 deletions(-) delete mode 100644 windows/security/operating-system-security/data-protection/personal-data-encryption/configure-pde-in-intune.md rename windows/security/operating-system-security/data-protection/personal-data-encryption/{faq-pde.yml => faq.yml} (100%) delete mode 100644 windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-arso.md delete mode 100644 windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-hibernation.md delete mode 100644 windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-memory-dumps.md delete mode 100644 windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-password-connected-standby.md delete mode 100644 windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-wer.md delete mode 100644 windows/security/operating-system-security/data-protection/personal-data-encryption/intune-enable-pde.md diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure-pde-in-intune.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure-pde-in-intune.md deleted file mode 100644 index fe2fb5b3e9..0000000000 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure-pde-in-intune.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: Configure Personal Data Encryption (PDE) in Intune -description: Configuring and enabling Personal Data Encryption (PDE) required and recommended policies in Intune -ms.topic: how-to -ms.date: 03/13/2023 ---- - - - - -# Configure Personal Data Encryption (PDE) policies in Intune - -The various required and recommended policies needed for Personal Data Encryption (PDE) can be configured in Intune. The following links for both required and recommended policies contain step by step instructions on how to configure these policies in Intune. - -## Required prerequisites - -1. [Enable Personal Data Encryption (PDE)](intune-enable-pde.md) -1. [Disable Winlogon automatic restart sign-on (ARSO)](intune-disable-arso.md) - -## Security hardening recommendations - -1. [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md) -1. [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md) -1. [Disable hibernation](intune-disable-hibernation.md) -1. [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md) - -## See also - -- [Personal Data Encryption (PDE)](index.md) -- [Personal Data Encryption (PDE) FAQ](faq-pde.yml) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index 228d8faf26..bcf0f04760 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -9,10 +9,71 @@ ms.date: 03/13/2023 This article describes the Personal Data Encryption (PDE) settings and how to configure them via Microsoft Intune or configuration Service Provider (CSP). + + +The various required and recommended policies needed for Personal Data Encryption (PDE) can be configured in Intune. The following links for both required and recommended policies contain step by step instructions on how to configure these policies in Intune. + +## Required prerequisites + +1. [Enable Personal Data Encryption (PDE)](intune-enable-pde.md) +1. [Disable Winlogon automatic restart sign-on (ARSO)](intune-disable-arso.md) + +## Security hardening recommendations + +1. [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md) +1. [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md) +1. [Disable hibernation](intune-disable-hibernation.md) +1. [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md) + + ## PDE settings list ## PDE configuration +### Enable Personal Data Encryption (PDE) + +By default, Personal Data Encryption (PDE) is not enabled on devices. Before PDE can be used on a device, it needs to be enabled. This can be done via a custom OMA-URI policy assigned to the device. + +> [!NOTE] +> Enabling the PDE policy on devices only enables the PDE feature. It does not protect any content. To protect content via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. + +## Enable Personal Data Encryption (PDE) in Intune + +To enable Personal Data Encryption (PDE) using Intune, follow the below steps: + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. In the **Home** screen, select **Devices** in the left pane +1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** +1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** +1. In the **Create profile** window that opens: + 1. Under **Platform**, select **Windows 10 and later** + 1. Under **Profile type**, select **Templates** + 1. When the templates appears, under **Template name**, select **Custom** + 1. Select **Create** to close the **Create profile** window +1. The **Custom** screen will open. In the **Basics** page: + 1. Next to **Name**, enter **Personal Data Encryption** + 1. Next to **Description**, enter a description + 1. Select **Next** +1. In **Configuration settings** page: + 1. Next to **OMA-URI Settings**, select **Add** + 1. In the **Add Row** window that opens: + 1. Next to **Name**, enter **Personal Data Encryption** + 1. Next to **Description**, enter a description + 1. Next to **OMA-URI**, enter in: + **`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`** + 1. Next to **Data type**, select **Integer** + 1. Next to **Value**, enter in **1** + 1. Select **Save** to close the **Add Row** window + 1. Select **Next** +1. In the **Assignments** page: + 1. Under **Included groups**, select **Add groups** + > [!NOTE] + > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. + 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window + 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** +1. In **Applicability Rules**, configure if necessary and then select **Next** +1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** + ### Configure PDE with Microsoft Intune To configure devices using Microsoft Intune, [create a **Settings catalog** policy][MEM-1], and use the settings listed under the category **`Local Policies Security Options`**: @@ -29,6 +90,196 @@ The policy settings are located under: `./Device/Vendor/MSFT/`. | - | | **Setting name**: Title
**Policy CSP name**: `Setting Name`| +## Disable Winlogon automatic restart sign-on (ARSO) + +Winlogon automatic restart sign-on (ARSO) isn't supported for use with Personal Data Encryption (PDE). For this reason, in order to use PDE, ARSO needs to be disabled. + +To disable ARSO using Intune, follow the below steps: + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) +1. In the **Home** screen, select **Devices** in the left pane +1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** +1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** +1. In the **Create profile** window that opens: + 1. Under **Platform**, select **Windows 10 and later** + 1. Under **Profile type**, select **Templates** + 1. When the templates appear, under **Template name**, select **Administrative templates** + 1. Select **Create** to close the **Create profile** window. +1. The **Create profile** screen will open. In the **Basics** page: + 1. Next to **Name**, enter **Disable ARSO** + 1. Next to **Description**, enter a description + 1. Select **Next** +1. In the **Configuration settings** page: + 1. On the left pane of the page, make sure **Computer Configuration** is selected + 1. Under **Setting name**, scroll down and select **Windows Components** + 1. Under **Setting name**, scroll down and select **Windows Logon Options**. You may need to navigate between pages on the bottom right corner before finding the **Windows Logon Options** option + 1. Under **Setting name** of the **Windows Logon Options** pane, select **Sign-in and lock last interactive user automatically after a restart** + 1. In the **Sign-in and lock last interactive user automatically after a restart** window that opens, select **Disabled**, and then select **OK** + 1. Select **Next** +1. In the **Scope tags** page, configure if necessary and then select **Next** +1. In the **Assignments** page: + 1. Under **Included groups**, select **Add groups** + > [!NOTE] + > Make sure to select **Add groups** under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. + 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window + 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** +1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** + +## Additional PDE configurations in Intune +## Disable kernel-mode crash dumps and live dumps for PDE + +Kernel-mode crash dumps and live dumps can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps. + +To disable kernel-mode crash dumps and live dumps using Intune, follow the below steps: + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) +1. In the **Home** screen, select **Devices** in the left pane +1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** +1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** +1. In the **Create profile** window that opens: + 1. Under **Platform**, select **Windows 10 and later** + 1. Under **Profile type**, select **Settings catalog** + 1. Select **Create** to close the **Create profile** window +1. The **Create profile** screen will open. In the **Basics** page: + 1. Next to **Name**, enter **Disable Kernel-Mode Crash Dumps** + 1. Next to **Description**, enter a description. + 1. Select **Next** +1. In the **Configuration settings** page: + 1. Select **Add settings** + 1. In the **Settings picker** window that opens: + 1. Under **Browse by category**, scroll down and select **Memory Dump** + 1. When the settings for the **Memory Dump** category appear under **Setting name** in the lower pane, select both **Allow Crash Dump** and **Allow Live Dump**, and then select the **X** in the top right corner of the **Settings picker** window to close the window + 1. Change both **Allow Live Dump** and **Allow Crash Dump** from **Allow** to **Block** by selecting the slider next to each option, and then select **Next** +1. In the **Scope tags** page, configure if necessary and then select **Next** +1. In the **Assignments** page: + 1. Under **Included groups**, select **Add groups** + > [!NOTE] + > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. + 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window + 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** +1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** + +## Disable Windows Error Reporting (WER)/user-mode crash dumps for PDE + +Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps. + +To disable Windows Error Reporting (WER) and user-mode crash dumps using Intune, follow the below steps: + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) +1. In the **Home** screen, select **Devices** in the left pane +1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** +1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** +1. In the **Create profile** window that opens: + 1. Under **Platform**, select **Windows 10 and later** + 1. Under **Profile type**, select **Settings catalog** + 1. Select **Create** to close the **Create profile** window +1. The **Create profile** screen will open. In the **Basics** page: + 1. Next to **Name**, enter **Disable Windows Error Reporting (WER)** + 1. Next to **Description**, enter a description + 1. Select **Next** +1. In the **Configuration settings** page: + 1. Select **Add settings** + 1. In the **Settings picker** window that opens: + 1. Under **Browse by category**, expand **Administrative Templates** + 1. Under **Administrative Templates**, scroll down and expand **Windows Components** + 1. Under **Windows Components**, scroll down and select **Windows Error Reporting**. Make sure to only select **Windows Error Reporting** and not to expand it + 1. When the settings for the **Windows Error Reporting** subcategory appear under **Setting name** in the lower pane, select **Disable Windows Error Reporting**, and then select the **X** in the top right corner of the **Settings picker** window to close the window + 1. Change **Disable Windows Error Reporting** from **Disabled** to **Enabled** by selecting the slider next to the option + 1. Select **Next** +1. In the **Scope tags** page, configure if necessary and then select **Next** +1. In the **Assignments** page: + 1. Under **Included groups**, select **Add groups** + > [!NOTE] + > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. + 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window + 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** +1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** + + +## Disable hibernation for PDE + +Hibernation files can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable hibernation. + +To disable hibernation using Intune, follow the below steps: + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) +1. In the **Home** screen, select **Devices** in the left pane +1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** +1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** +1. In the **Create profile** window that opens: + 1. Under **Platform**, select **Windows 10 and later** + 1. Under **Profile type**, select **Settings catalog** + 1. Select **Create** to close the **Create profile** window +1. The **Create profile** screen will open. In the **Basics** page: + 1. Next to **Name**, enter **Disable Hibernation** + 1. Next to **Description**, enter a description + 1. Select **Next** +1. In the **Configuration settings** page: + 1. select **Add settings** + 1. In the **Settings picker** window that opens: + 1. Under **Browse by category**, scroll down and select **Power** + 1. When the settings for the **Power** category appear under **Setting name** in the lower pane, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window + 1. Change **Allow Hibernate** from **Allow** to **Block** by selecting the slider next to the option + 1. Select **Next** +1. In the **Scope tags** page, configure if necessary and then select **Next** +1. In the **Assignments** page: + 1. Under **Included groups**, select **Add groups** + > [!NOTE] + > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. + 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window + 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** +1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** + +## Disable allowing users to select when a password is required when resuming from connected standby for PDE + +When the **Disable allowing users to select when a password is required when resuming from connected standby** policy isn't configured, the outcome between on-premises Active Directory joined devices and workgroup devices, including Azure Active Directory joined devices, is different: + +- On-premises Active Directory joined devices: + - A user can't change the amount of time after the device's screen turns off before a password is required when waking the device + - A password is required immediately after the screen turns off + The above is the desired outcome, but PDE isn't supported with on-premises Active Directory joined devices +- Workgroup devices, including Azure AD joined devices: + - A user on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device + - During the time when the screen turns off but a password isn't required, the keys used by PDE to protect content could potentially be exposed. This outcome isn't a desired outcome + +Because of this undesired outcome, it's recommended to explicitly disable this policy on Azure AD joined devices instead of leaving it at the default of **Not configured**. + +## Disable allowing users to select when a password is required when resuming from connected standby in Intune + +To disable the policy **Disable allowing users to select when a password is required when resuming from connected standby** using Intune, follow the below steps: + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) +1. In the **Home** screen, select **Devices** in the left pane +1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** +1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** +1. In the **Create profile** window that opens: + 1. Under **Platform**, select **Windows 10 and later** + 1. Under **Profile type**, select **Settings catalog** + 1. Select **Create** to close the **Create profile** window +1. The **Create profile** screen will open. In the **Basics** page: + 1. Next to **Name**, enter **Disable allowing users to select when a password is required when resuming from connected standby** + 1. Next to **Description**, enter a description + 1. Select **Next**. + +1. In the **Configuration settings** page: + 1. Select **Add settings** + 1. In the **Settings picker** window that opens: + 1. Under **Browse by category**, expand **Administrative Templates** + 1. Under **Administrative Templates**, scroll down and expand **System** + 1. Under **System**, scroll down and select **Logon** + 1. When the settings for the **Logon** subcategory appear under **Setting name** in the lower pane, select **Allow users to select when a password is required when resuming from connected standby**, and then select the **X** in the top right corner of the **Settings picker** window to close the window + 1. Leave the slider for **Allow users to select when a password is required when resuming from connected standby** at the default of **Disabled** + 1. select **Next** + +1. In the **Scope tags** page, configure if necessary and then select **Next** +1. In the **Assignments** page: + 1. Under **Included groups**, select **Add groups** + > [!NOTE] + > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. + 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window + 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** +1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** + [CSP-1]: /windows/client-management/mdm/policy-csp-localpoliciessecurityoptions diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/faq-pde.yml b/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml similarity index 100% rename from windows/security/operating-system-security/data-protection/personal-data-encryption/faq-pde.yml rename to windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-arso.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-arso.md deleted file mode 100644 index 9fda445c43..0000000000 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-arso.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Disable Winlogon automatic restart sign-on (ARSO) for PDE in Intune -description: Disable Winlogon automatic restart sign-on (ARSO) for PDE in Intune -ms.topic: how-to -ms.date: 06/01/2023 ---- - -# Disable Winlogon automatic restart sign-on (ARSO) for PDE - -Winlogon automatic restart sign-on (ARSO) isn't supported for use with Personal Data Encryption (PDE). For this reason, in order to use PDE, ARSO needs to be disabled. - -## Disable Winlogon automatic restart sign-on (ARSO) in Intune - -To disable ARSO using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Templates** - 1. When the templates appear, under **Template name**, select **Administrative templates** - 1. Select **Create** to close the **Create profile** window. -1. The **Create profile** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Disable ARSO** - 1. Next to **Description**, enter a description - 1. Select **Next** -1. In the **Configuration settings** page: - 1. On the left pane of the page, make sure **Computer Configuration** is selected - 1. Under **Setting name**, scroll down and select **Windows Components** - 1. Under **Setting name**, scroll down and select **Windows Logon Options**. You may need to navigate between pages on the bottom right corner before finding the **Windows Logon Options** option - 1. Under **Setting name** of the **Windows Logon Options** pane, select **Sign-in and lock last interactive user automatically after a restart** - 1. In the **Sign-in and lock last interactive user automatically after a restart** window that opens, select **Disabled**, and then select **OK** - 1. Select **Next** -1. In the **Scope tags** page, configure if necessary and then select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to select **Add groups** under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** - -## Additional PDE configurations in Intune - -The following PDE configurations can also be configured using Intune: - -### Prerequisites - -- [Enable Personal Data Encryption (PDE)](intune-enable-pde.md) - -### Security hardening recommendations - -- [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md) -- [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md) -- [Disable hibernation](intune-disable-hibernation.md) -- [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md) - -## More information - -- [Personal Data Encryption (PDE)](index.md) -- [Personal Data Encryption (PDE) FAQ](faq-pde.yml) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-hibernation.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-hibernation.md deleted file mode 100644 index ef18936b1b..0000000000 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-hibernation.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Disable hibernation for PDE in Intune -description: Disable hibernation for PDE in Intune -ms.topic: how-to -ms.date: 03/13/2023 ---- - -# Disable hibernation for PDE - -Hibernation files can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable hibernation. - -## Disable hibernation in Intune - -To disable hibernation using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Settings catalog** - 1. Select **Create** to close the **Create profile** window -1. The **Create profile** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Disable Hibernation** - 1. Next to **Description**, enter a description - 1. Select **Next** -1. In the **Configuration settings** page: - 1. select **Add settings** - 1. In the **Settings picker** window that opens: - 1. Under **Browse by category**, scroll down and select **Power** - 1. When the settings for the **Power** category appear under **Setting name** in the lower pane, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window - 1. Change **Allow Hibernate** from **Allow** to **Block** by selecting the slider next to the option - 1. Select **Next** -1. In the **Scope tags** page, configure if necessary and then select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** - -## Additional PDE configurations in Intune - -The following PDE configurations can also be configured using Intune: - -### Prerequisites - -- [Enable Personal Data Encryption (PDE)](intune-enable-pde.md) -- [Disable Winlogon automatic restart sign-on (ARSO)](intune-disable-arso.md) - -### Security hardening recommendations - -- [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md) -- [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md) -- [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md) - -## More information - -- [Personal Data Encryption (PDE)](index.md) -- [Personal Data Encryption (PDE) FAQ](faq-pde.yml) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-memory-dumps.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-memory-dumps.md deleted file mode 100644 index 66a238e3c9..0000000000 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-memory-dumps.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Disable kernel-mode crash dumps and live dumps for PDE in Intune -description: Disable kernel-mode crash dumps and live dumps for PDE in Intune -ms.topic: how-to -ms.date: 03/13/2023 ---- - -# Disable kernel-mode crash dumps and live dumps for PDE - -Kernel-mode crash dumps and live dumps can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps. - -## Disable kernel-mode crash dumps and live dumps in Intune - -To disable kernel-mode crash dumps and live dumps using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Settings catalog** - 1. Select **Create** to close the **Create profile** window -1. The **Create profile** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Disable Kernel-Mode Crash Dumps** - 1. Next to **Description**, enter a description. - 1. Select **Next** -1. In the **Configuration settings** page: - 1. Select **Add settings** - 1. In the **Settings picker** window that opens: - 1. Under **Browse by category**, scroll down and select **Memory Dump** - 1. When the settings for the **Memory Dump** category appear under **Setting name** in the lower pane, select both **Allow Crash Dump** and **Allow Live Dump**, and then select the **X** in the top right corner of the **Settings picker** window to close the window - 1. Change both **Allow Live Dump** and **Allow Crash Dump** from **Allow** to **Block** by selecting the slider next to each option, and then select **Next** -1. In the **Scope tags** page, configure if necessary and then select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** - -## Additional PDE configurations in Intune - -The following PDE configurations can also be configured using Intune: - -### Prerequisites - -- [Enable Personal Data Encryption (PDE)](intune-enable-pde.md) -- [Disable Winlogon automatic restart sign-on (ARSO)](intune-disable-arso.md) - -### Security hardening recommendations - -- [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md) -- [Disable hibernation](intune-disable-hibernation.md) -- [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md) - -## More information - -- [Personal Data Encryption (PDE)](index.md) -- [Personal Data Encryption (PDE) FAQ](faq-pde.yml) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-password-connected-standby.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-password-connected-standby.md deleted file mode 100644 index 4cf442e308..0000000000 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-password-connected-standby.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Disable allowing users to select when a password is required when resuming from connected standby for PDE in Intune -description: Disable allowing users to select when a password is required when resuming from connected standby for PDE in Intune -ms.topic: how-to -ms.date: 03/13/2023 ---- - -# Disable allowing users to select when a password is required when resuming from connected standby for PDE - -When the **Disable allowing users to select when a password is required when resuming from connected standby** policy isn't configured, the outcome between on-premises Active Directory joined devices and workgroup devices, including Azure Active Directory joined devices, is different: - -- On-premises Active Directory joined devices: - - A user can't change the amount of time after the device's screen turns off before a password is required when waking the device - - A password is required immediately after the screen turns off - The above is the desired outcome, but PDE isn't supported with on-premises Active Directory joined devices -- Workgroup devices, including Azure AD joined devices: - - A user on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device - - During the time when the screen turns off but a password isn't required, the keys used by PDE to protect content could potentially be exposed. This outcome isn't a desired outcome - -Because of this undesired outcome, it's recommended to explicitly disable this policy on Azure AD joined devices instead of leaving it at the default of **Not configured**. - -## Disable allowing users to select when a password is required when resuming from connected standby in Intune - -To disable the policy **Disable allowing users to select when a password is required when resuming from connected standby** using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Settings catalog** - 1. Select **Create** to close the **Create profile** window -1. The **Create profile** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Disable allowing users to select when a password is required when resuming from connected standby** - 1. Next to **Description**, enter a description - 1. Select **Next**. - -1. In the **Configuration settings** page: - 1. Select **Add settings** - 1. In the **Settings picker** window that opens: - 1. Under **Browse by category**, expand **Administrative Templates** - 1. Under **Administrative Templates**, scroll down and expand **System** - 1. Under **System**, scroll down and select **Logon** - 1. When the settings for the **Logon** subcategory appear under **Setting name** in the lower pane, select **Allow users to select when a password is required when resuming from connected standby**, and then select the **X** in the top right corner of the **Settings picker** window to close the window - 1. Leave the slider for **Allow users to select when a password is required when resuming from connected standby** at the default of **Disabled** - 1. select **Next** - -1. In the **Scope tags** page, configure if necessary and then select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** - -## Additional PDE configurations in Intune - -The following PDE configurations can also be configured using Intune: - -### Prerequisites - -- [Enable Personal Data Encryption (PDE)](intune-enable-pde.md) -- [Disable Winlogon automatic restart sign-on (ARSO)](intune-disable-arso.md) - -### Security hardening recommendations - -- [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md) -- [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md) -- [Disable hibernation](intune-disable-hibernation.md) - -## More information - -- [Personal Data Encryption (PDE)](index.md) -- [Personal Data Encryption (PDE) FAQ](faq-pde.yml) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-wer.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-wer.md deleted file mode 100644 index 39fe957317..0000000000 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-wer.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Disable Windows Error Reporting (WER)/user-mode crash dumps for PDE in Intune -description: Disable Windows Error Reporting (WER)/user-mode crash dumps for PDE in Intune -ms.topic: how-to -ms.date: 03/13/2023 ---- - -# Disable Windows Error Reporting (WER)/user-mode crash dumps for PDE - -Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps. - -## Disable Windows Error Reporting (WER)/user-mode crash dumps in Intune - -To disable Windows Error Reporting (WER) and user-mode crash dumps using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Settings catalog** - 1. Select **Create** to close the **Create profile** window -1. The **Create profile** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Disable Windows Error Reporting (WER)** - 1. Next to **Description**, enter a description - 1. Select **Next** -1. In the **Configuration settings** page: - 1. Select **Add settings** - 1. In the **Settings picker** window that opens: - 1. Under **Browse by category**, expand **Administrative Templates** - 1. Under **Administrative Templates**, scroll down and expand **Windows Components** - 1. Under **Windows Components**, scroll down and select **Windows Error Reporting**. Make sure to only select **Windows Error Reporting** and not to expand it - 1. When the settings for the **Windows Error Reporting** subcategory appear under **Setting name** in the lower pane, select **Disable Windows Error Reporting**, and then select the **X** in the top right corner of the **Settings picker** window to close the window - 1. Change **Disable Windows Error Reporting** from **Disabled** to **Enabled** by selecting the slider next to the option - 1. Select **Next** -1. In the **Scope tags** page, configure if necessary and then select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** - -## Additional PDE configurations in Intune - -The following PDE configurations can also be configured using Intune: - -### Prerequisites - -- [Enable Personal Data Encryption (PDE)](intune-enable-pde.md) -- [Disable Winlogon automatic restart sign-on (ARSO)](intune-disable-arso.md) - -### Security hardening recommendations - -- [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md) -- [Disable hibernation](intune-disable-hibernation.md) -- [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md) - -## More information - -- [Personal Data Encryption (PDE)](index.md) -- [Personal Data Encryption (PDE) FAQ](faq-pde.yml) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-enable-pde.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-enable-pde.md deleted file mode 100644 index 795504237c..0000000000 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/intune-enable-pde.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Enable Personal Data Encryption (PDE) in Intune -description: Enable Personal Data Encryption (PDE) in Intune -ms.topic: how-to -ms.date: 03/13/2023 ---- - -# Enable Personal Data Encryption (PDE) - -By default, Personal Data Encryption (PDE) is not enabled on devices. Before PDE can be used on a device, it needs to be enabled. This can be done via a custom OMA-URI policy assigned to the device. - -> [!NOTE] -> Enabling the PDE policy on devices only enables the PDE feature. It does not protect any content. To protect content via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. - -## Enable Personal Data Encryption (PDE) in Intune - -To enable Personal Data Encryption (PDE) using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Templates** - 1. When the templates appears, under **Template name**, select **Custom** - 1. Select **Create** to close the **Create profile** window -1. The **Custom** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Personal Data Encryption** - 1. Next to **Description**, enter a description - 1. Select **Next** -1. In **Configuration settings** page: - 1. Next to **OMA-URI Settings**, select **Add** - 1. In the **Add Row** window that opens: - 1. Next to **Name**, enter **Personal Data Encryption** - 1. Next to **Description**, enter a description - 1. Next to **OMA-URI**, enter in: - **`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`** - 1. Next to **Data type**, select **Integer** - 1. Next to **Value**, enter in **1** - 1. Select **Save** to close the **Add Row** window - 1. Select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Applicability Rules**, configure if necessary and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** - -## Additional PDE configurations in Intune - -The following PDE configurations can also be configured using Intune: - -### Prerequisites - -- [Disable Winlogon automatic restart sign-on (ARSO)](intune-disable-arso.md) - -### Security hardening recommendations - -- [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md) -- [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md) -- [Disable hibernation](intune-disable-hibernation.md) -- [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md) - -## More information - -- [Personal Data Encryption (PDE)](index.md) -- [Personal Data Encryption (PDE) FAQ](faq-pde.yml) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/toc.yml b/windows/security/operating-system-security/data-protection/personal-data-encryption/toc.yml index 72bc8d3dce..f526600bd4 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/toc.yml +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/toc.yml @@ -1,21 +1,7 @@ items: -- name: Overview +- name: PDE overview href: index.md -- name: Configure PD`E +- name: Configure PDE href: configure.md -- name: (Old) Configure PDE with Intune - href: configure-pde-in-intune.md -- name: Enable Personal Data Encryption (PDE) - href: intune-enable-pde.md -- name: Disable Winlogon automatic restart sign-on (ARSO) for PDE - href: intune-disable-arso.md -- name: Disable kernel-mode crash dumps and live dumps for PDE - href: intune-disable-memory-dumps.md -- name: Disable Windows Error Reporting (WER)/user-mode crash dumps for PDE - href: intune-disable-wer.md -- name: Disable hibernation for PDE - href: intune-disable-hibernation.md -- name: Disable allowing users to select when a password is required when resuming from connected standby for PDE - href: intune-disable-password-connected-standby.md - name: PDE frequently asked questions (FAQ) - href: faq-pde.yml \ No newline at end of file + href: faq.yml \ No newline at end of file From 5b9280f71bcbf391763ac103517e97dea015a69e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 9 Aug 2023 13:29:02 +0200 Subject: [PATCH 006/125] updates --- .../personal-data-encryption/configure.md | 66 ++++--------------- 1 file changed, 12 insertions(+), 54 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index bcf0f04760..da0f067521 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -9,13 +9,9 @@ ms.date: 03/13/2023 This article describes the Personal Data Encryption (PDE) settings and how to configure them via Microsoft Intune or configuration Service Provider (CSP). +## Prerequisites - -The various required and recommended policies needed for Personal Data Encryption (PDE) can be configured in Intune. The following links for both required and recommended policies contain step by step instructions on how to configure these policies in Intune. - -## Required prerequisites - -1. [Enable Personal Data Encryption (PDE)](intune-enable-pde.md) +1. [Enable PDE](#enable-personal-data-encryption-pde) 1. [Disable Winlogon automatic restart sign-on (ARSO)](intune-disable-arso.md) ## Security hardening recommendations @@ -28,51 +24,23 @@ The various required and recommended policies needed for Personal Data Encryptio ## PDE settings list -## PDE configuration +The following table lists the available settings for PDE. -### Enable Personal Data Encryption (PDE) +| Setting name | Description | Details | +|-|-|-| +|Enable PDE|By default, Personal Data Encryption (PDE) is not enabled on devices. Before PDE can be used on a device, it must be enabled.| This setting is required.| +|Disable Winlogon automatic restart sign-on (ARSO)| Winlogon ARSO isn't supported for use with PDE. To use PDE, ARSO must be disabled.| This setting is required.| +|Disable kernel-mode crash dumps and live dumps for PDE.|Kernel-mode crash dumps and live dumps can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps.|This setting is recommended.| -By default, Personal Data Encryption (PDE) is not enabled on devices. Before PDE can be used on a device, it needs to be enabled. This can be done via a custom OMA-URI policy assigned to the device. > [!NOTE] > Enabling the PDE policy on devices only enables the PDE feature. It does not protect any content. To protect content via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. ## Enable Personal Data Encryption (PDE) in Intune -To enable Personal Data Encryption (PDE) using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Templates** - 1. When the templates appears, under **Template name**, select **Custom** - 1. Select **Create** to close the **Create profile** window -1. The **Custom** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Personal Data Encryption** - 1. Next to **Description**, enter a description - 1. Select **Next** -1. In **Configuration settings** page: - 1. Next to **OMA-URI Settings**, select **Add** - 1. In the **Add Row** window that opens: - 1. Next to **Name**, enter **Personal Data Encryption** - 1. Next to **Description**, enter a description - 1. Next to **OMA-URI**, enter in: - **`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`** - 1. Next to **Data type**, select **Integer** - 1. Next to **Value**, enter in **1** - 1. Select **Save** to close the **Add Row** window - 1. Select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Applicability Rules**, configure if necessary and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** +**`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`** +**Data type**, select **Integer** +**Value**, enter in **1** ### Configure PDE with Microsoft Intune @@ -92,16 +60,7 @@ The policy settings are located under: `./Device/Vendor/MSFT/`. ## Disable Winlogon automatic restart sign-on (ARSO) -Winlogon automatic restart sign-on (ARSO) isn't supported for use with Personal Data Encryption (PDE). For this reason, in order to use PDE, ARSO needs to be disabled. -To disable ARSO using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** 1. Under **Profile type**, select **Templates** 1. When the templates appear, under **Template name**, select **Administrative templates** 1. Select **Create** to close the **Create profile** window. @@ -125,10 +84,9 @@ To disable ARSO using Intune, follow the below steps: 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** 1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** -## Additional PDE configurations in Intune ## Disable kernel-mode crash dumps and live dumps for PDE -Kernel-mode crash dumps and live dumps can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps. + To disable kernel-mode crash dumps and live dumps using Intune, follow the below steps: From 51f0bd039bec23979e5f409243c2b4cd461e709c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 9 Aug 2023 13:46:54 +0200 Subject: [PATCH 007/125] update --- .../personal-data-encryption/configure.md | 163 +++--------------- 1 file changed, 20 insertions(+), 143 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index da0f067521..bd5d6074b1 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -9,29 +9,17 @@ ms.date: 03/13/2023 This article describes the Personal Data Encryption (PDE) settings and how to configure them via Microsoft Intune or configuration Service Provider (CSP). -## Prerequisites - -1. [Enable PDE](#enable-personal-data-encryption-pde) -1. [Disable Winlogon automatic restart sign-on (ARSO)](intune-disable-arso.md) - -## Security hardening recommendations - -1. [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md) -1. [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md) -1. [Disable hibernation](intune-disable-hibernation.md) -1. [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md) - - ## PDE settings list -The following table lists the available settings for PDE. +The following table lists the required and suggested settings to use with PDE. -| Setting name | Description | Details | +| Setting name | Description | Required? | |-|-|-| -|Enable PDE|By default, Personal Data Encryption (PDE) is not enabled on devices. Before PDE can be used on a device, it must be enabled.| This setting is required.| +|Enable PDE|PDE isn't enabled by default. Before PDE can be used, you must enable it.| This setting is required.| |Disable Winlogon automatic restart sign-on (ARSO)| Winlogon ARSO isn't supported for use with PDE. To use PDE, ARSO must be disabled.| This setting is required.| -|Disable kernel-mode crash dumps and live dumps for PDE.|Kernel-mode crash dumps and live dumps can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps.|This setting is recommended.| - +|Disable kernel-mode crash dumps and live dumps|Kernel-mode crash dumps and live dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps.|This setting is recommended.| +|Disable Windows Error Reporting (WER)/user-mode crash dumps|Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps.|| +|Disable hibernation|Hibernation files can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable hibernation.|| > [!NOTE] > Enabling the PDE policy on devices only enables the PDE feature. It does not protect any content. To protect content via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. @@ -60,133 +48,31 @@ The policy settings are located under: `./Device/Vendor/MSFT/`. ## Disable Winlogon automatic restart sign-on (ARSO) +Settings Catalog: +Category: `Administrative Templates` +`Windows Components > Windows Logon Options\Sign-in and lock last interactive user automatically after a restart` - 1. Under **Profile type**, select **Templates** - 1. When the templates appear, under **Template name**, select **Administrative templates** - 1. Select **Create** to close the **Create profile** window. -1. The **Create profile** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Disable ARSO** - 1. Next to **Description**, enter a description - 1. Select **Next** -1. In the **Configuration settings** page: - 1. On the left pane of the page, make sure **Computer Configuration** is selected - 1. Under **Setting name**, scroll down and select **Windows Components** - 1. Under **Setting name**, scroll down and select **Windows Logon Options**. You may need to navigate between pages on the bottom right corner before finding the **Windows Logon Options** option - 1. Under **Setting name** of the **Windows Logon Options** pane, select **Sign-in and lock last interactive user automatically after a restart** - 1. In the **Sign-in and lock last interactive user automatically after a restart** window that opens, select **Disabled**, and then select **OK** - 1. Select **Next** -1. In the **Scope tags** page, configure if necessary and then select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to select **Add groups** under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** +## Disable kernel-mode crash dumps and live dumps\ -## Disable kernel-mode crash dumps and live dumps for PDE +`Disable Kernel-Mode Crash Dumps`` +Category: `Memory Dump` - -To disable kernel-mode crash dumps and live dumps using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Settings catalog** - 1. Select **Create** to close the **Create profile** window -1. The **Create profile** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Disable Kernel-Mode Crash Dumps** - 1. Next to **Description**, enter a description. - 1. Select **Next** -1. In the **Configuration settings** page: - 1. Select **Add settings** - 1. In the **Settings picker** window that opens: - 1. Under **Browse by category**, scroll down and select **Memory Dump** - 1. When the settings for the **Memory Dump** category appear under **Setting name** in the lower pane, select both **Allow Crash Dump** and **Allow Live Dump**, and then select the **X** in the top right corner of the **Settings picker** window to close the window - 1. Change both **Allow Live Dump** and **Allow Crash Dump** from **Allow** to **Block** by selecting the slider next to each option, and then select **Next** -1. In the **Scope tags** page, configure if necessary and then select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** +`Allow Live Dump`:Block +`Allow Crash Dump`: Block ## Disable Windows Error Reporting (WER)/user-mode crash dumps for PDE -Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps. +**Administrative Templates**, scroll down and expand **Windows Components** +Under **Windows Components**, scroll down and select **Windows Error Reporting**. Make sure to only select **Windows Error Reporting** and not to expand it +When the settings for the **Windows Error Reporting** subcategory appear under **Setting name** in the lower pane, select **Disable Windows Error Reporting**, and then select the **X** in the top right corner of the **Settings picker** window to close the window +Change **Disable Windows Error Reporting** from **Disabled** to **Enabled** by selecting the slider next to the option -To disable Windows Error Reporting (WER) and user-mode crash dumps using Intune, follow the below steps: +## Disable hibernation -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Settings catalog** - 1. Select **Create** to close the **Create profile** window -1. The **Create profile** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Disable Windows Error Reporting (WER)** - 1. Next to **Description**, enter a description - 1. Select **Next** -1. In the **Configuration settings** page: - 1. Select **Add settings** - 1. In the **Settings picker** window that opens: - 1. Under **Browse by category**, expand **Administrative Templates** - 1. Under **Administrative Templates**, scroll down and expand **Windows Components** - 1. Under **Windows Components**, scroll down and select **Windows Error Reporting**. Make sure to only select **Windows Error Reporting** and not to expand it - 1. When the settings for the **Windows Error Reporting** subcategory appear under **Setting name** in the lower pane, select **Disable Windows Error Reporting**, and then select the **X** in the top right corner of the **Settings picker** window to close the window - 1. Change **Disable Windows Error Reporting** from **Disabled** to **Enabled** by selecting the slider next to the option - 1. Select **Next** -1. In the **Scope tags** page, configure if necessary and then select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** - - -## Disable hibernation for PDE - -Hibernation files can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable hibernation. - -To disable hibernation using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Settings catalog** - 1. Select **Create** to close the **Create profile** window -1. The **Create profile** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Disable Hibernation** - 1. Next to **Description**, enter a description - 1. Select **Next** -1. In the **Configuration settings** page: - 1. select **Add settings** - 1. In the **Settings picker** window that opens: - 1. Under **Browse by category**, scroll down and select **Power** +1. Under **Browse by category**, scroll down and select **Power** 1. When the settings for the **Power** category appear under **Setting name** in the lower pane, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window 1. Change **Allow Hibernate** from **Allow** to **Block** by selecting the slider next to the option - 1. Select **Next** -1. In the **Scope tags** page, configure if necessary and then select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** ## Disable allowing users to select when a password is required when resuming from connected standby for PDE @@ -229,15 +115,6 @@ To disable the policy **Disable allowing users to select when a password is requ 1. Leave the slider for **Allow users to select when a password is required when resuming from connected standby** at the default of **Disabled** 1. select **Next** -1. In the **Scope tags** page, configure if necessary and then select **Next** -1. In the **Assignments** page: - 1. Under **Included groups**, select **Add groups** - > [!NOTE] - > Make sure to add the correct groups under **Included groups** and not under **Excluded groups**. Accidentally adding the desired device groups under **Excluded groups** will result in those devices being excluded and they won't receive the configuration profile. - 1. In the **Select groups to include** window that opens, select the groups that the configuration profile should be assigned to, and then select **Select** to close the **Select groups to include** window - 1. Under **Included groups** > **Groups**, ensure the correct group(s) are selected, and then select **Next** -1. In **Review + create** page, review the configuration to make sure everything is configured correctly, and then select **Create** - [CSP-1]: /windows/client-management/mdm/policy-csp-localpoliciessecurityoptions From 00fdd02fd3078d1572f3740f26caceed094a5895 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 9 Aug 2023 14:04:53 +0200 Subject: [PATCH 008/125] uppdates --- .../personal-data-encryption/configure.md | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index bd5d6074b1..efff303da5 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -115,6 +115,31 @@ To disable the policy **Disable allowing users to select when a password is requ 1. Leave the slider for **Allow users to select when a password is required when resuming from connected standby** at the default of **Disabled** 1. select **Next** + +!INCLUDE [intune-settings-catalog-1](../../../../../includes/configure/intune-settings-catalog-1.md)] + +| Category | Setting name | Value | +|--|--|--| +| Device Guard | Credential Guard | Select one of the options:
 - **Enabled with UEFI lock**
 - **Enabled without lock** | + +>[!IMPORTANT] +> If you want to be able to turn off Windows Defender Credential Guard remotely, choose the option **Enabled without lock**. + +[!INCLUDE [intune-settings-catalog-2](../../../../includes/configure/intune-settings-catalog-2.md)] + +> [!TIP] +> You can also configure Credential Guard by using an *account protection* profile in endpoint security. For more information, see [Account protection policy settings for endpoint security in Microsoft Intune](/mem/intune/protect/endpoint-security-account-protection-profile-settings). + +Alternatively, you can configure devices using a [custom policy][INT-1] with the [DeviceGuard Policy CSP][CSP-1].\ +The policy settings are located under: `./Device/Vendor/MSFT/Policy/Config/DeviceGuard/`. + +| Setting | +|--| +| **Setting name**: Turn On Virtualization Based Security
**Policy CSP name**: `EnableVirtualizationBasedSecurity` | +| **Setting name**: Credential Guard Configuration
**Policy CSP name**: `LsaCfgFlags` | + + + [CSP-1]: /windows/client-management/mdm/policy-csp-localpoliciessecurityoptions From 4d7de6ab88acd763c27e47fbd5dde2e1c728f62c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 9 Aug 2023 14:06:28 +0200 Subject: [PATCH 009/125] uppdates --- includes/configure/gpo-settings-1.md | 6 ++++++ includes/configure/gpo-settings-2.md | 6 ++++++ includes/configure/intune-custom-settings-1.md | 13 +++++++++++++ includes/configure/intune-custom-settings-2.md | 9 +++++++++ includes/configure/intune-custom-settings-info.md | 6 ++++++ includes/configure/intune-settings-catalog-1.md | 6 ++++++ includes/configure/intune-settings-catalog-2.md | 6 ++++++ includes/configure/tab-intro.md | 6 ++++++ 8 files changed, 58 insertions(+) create mode 100644 includes/configure/gpo-settings-1.md create mode 100644 includes/configure/gpo-settings-2.md create mode 100644 includes/configure/intune-custom-settings-1.md create mode 100644 includes/configure/intune-custom-settings-2.md create mode 100644 includes/configure/intune-custom-settings-info.md create mode 100644 includes/configure/intune-settings-catalog-1.md create mode 100644 includes/configure/intune-settings-catalog-2.md create mode 100644 includes/configure/tab-intro.md diff --git a/includes/configure/gpo-settings-1.md b/includes/configure/gpo-settings-1.md new file mode 100644 index 0000000000..2859223cc7 --- /dev/null +++ b/includes/configure/gpo-settings-1.md @@ -0,0 +1,6 @@ +--- +ms.date: 06/21/2023 +ms.topic: include +--- + +To configure devices using group policy, [create a group policy object (GPO)](/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object) and use the settings located under \ No newline at end of file diff --git a/includes/configure/gpo-settings-2.md b/includes/configure/gpo-settings-2.md new file mode 100644 index 0000000000..cc0cad6c72 --- /dev/null +++ b/includes/configure/gpo-settings-2.md @@ -0,0 +1,6 @@ +--- +ms.date: 11/08/2022 +ms.topic: include +--- + +The policy settings can be configured locally by using the Local Group Policy Editor (`gpedit.msc`), linked to the domain or organizational units, and filtered to security groups. \ No newline at end of file diff --git a/includes/configure/intune-custom-settings-1.md b/includes/configure/intune-custom-settings-1.md new file mode 100644 index 0000000000..d911751e75 --- /dev/null +++ b/includes/configure/intune-custom-settings-1.md @@ -0,0 +1,13 @@ +--- +ms.date: 02/22/2022 +ms.topic: include +--- + +To configure devices with Microsoft Intune, use a custom policy: + +1. Go to the Microsoft Intune admin center +2. Select **Devices > Configuration profiles > Create profile** +3. Select **Platform > Windows 10 and later** and **Profile type > Templates > Custom** +4. Select **Create** +5. Specify a **Name** and, optionally, a **Description > Next** +6. Add the following settings: \ No newline at end of file diff --git a/includes/configure/intune-custom-settings-2.md b/includes/configure/intune-custom-settings-2.md new file mode 100644 index 0000000000..1a601acaa7 --- /dev/null +++ b/includes/configure/intune-custom-settings-2.md @@ -0,0 +1,9 @@ +--- +ms.date: 11/08/2022 +ms.topic: include +--- + +7. Select **Next** +8. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next** +9. Under **Applicability Rules**, select **Next** +10. Review the policy configuration and select **Create** \ No newline at end of file diff --git a/includes/configure/intune-custom-settings-info.md b/includes/configure/intune-custom-settings-info.md new file mode 100644 index 0000000000..8ff9da4294 --- /dev/null +++ b/includes/configure/intune-custom-settings-info.md @@ -0,0 +1,6 @@ +--- +ms.date: 11/08/2022 +ms.topic: include +--- + +For more information about how to create custom settings using Intune, see [Use custom settings for Windows devices in Intune](/mem/intune/configuration/custom-settings-windows-10). \ No newline at end of file diff --git a/includes/configure/intune-settings-catalog-1.md b/includes/configure/intune-settings-catalog-1.md new file mode 100644 index 0000000000..713555d40b --- /dev/null +++ b/includes/configure/intune-settings-catalog-1.md @@ -0,0 +1,6 @@ +--- +ms.date: 06/21/2023 +ms.topic: include +--- + +To configure devices using Microsoft Intune, [create a *Settings catalog policy*](/mem/intune/configuration/settings-catalog) and use the following settings: \ No newline at end of file diff --git a/includes/configure/intune-settings-catalog-2.md b/includes/configure/intune-settings-catalog-2.md new file mode 100644 index 0000000000..ebd6a2e1ef --- /dev/null +++ b/includes/configure/intune-settings-catalog-2.md @@ -0,0 +1,6 @@ +--- +ms.date: 11/08/2022 +ms.topic: include +--- + +Assign the policy to a group that contains as members the devices or users that you want to configure. \ No newline at end of file diff --git a/includes/configure/tab-intro.md b/includes/configure/tab-intro.md new file mode 100644 index 0000000000..e195a9281a --- /dev/null +++ b/includes/configure/tab-intro.md @@ -0,0 +1,6 @@ +--- +ms.date: 02/22/2022 +ms.topic: include +--- + +The following instructions provide details how to configure your devices. Select the option that best suits your needs. \ No newline at end of file From 5be1e046be3ea436cf2fb4c761c35941115530f3 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 9 Aug 2023 14:14:13 +0200 Subject: [PATCH 010/125] includes --- .../data-protection/personal-data-encryption/configure.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index efff303da5..1099161dc6 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -116,7 +116,7 @@ To disable the policy **Disable allowing users to select when a password is requ 1. select **Next** -!INCLUDE [intune-settings-catalog-1](../../../../../includes/configure/intune-settings-catalog-1.md)] +[!INCLUDE [intune-settings-catalog-1](../../../../../includes/configure/intune-settings-catalog-1.md)] | Category | Setting name | Value | |--|--|--| @@ -125,7 +125,7 @@ To disable the policy **Disable allowing users to select when a password is requ >[!IMPORTANT] > If you want to be able to turn off Windows Defender Credential Guard remotely, choose the option **Enabled without lock**. -[!INCLUDE [intune-settings-catalog-2](../../../../includes/configure/intune-settings-catalog-2.md)] +[!INCLUDE [intune-settings-catalog-2](../../../../../includes/configure/intune-settings-catalog-2.md)] > [!TIP] > You can also configure Credential Guard by using an *account protection* profile in endpoint security. For more information, see [Account protection policy settings for endpoint security in Microsoft Intune](/mem/intune/protect/endpoint-security-account-protection-profile-settings). From b8f2ca5f3b9ba2ab1fbcbd7df5799c4ea819a57e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 9 Aug 2023 14:32:12 +0200 Subject: [PATCH 011/125] updates --- .../personal-data-encryption/configure.md | 55 ++----------------- 1 file changed, 6 insertions(+), 49 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index 1099161dc6..76a1e5431d 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -54,26 +54,10 @@ Category: `Administrative Templates` ## Disable kernel-mode crash dumps and live dumps\ -`Disable Kernel-Mode Crash Dumps`` - -Category: `Memory Dump` - -`Allow Live Dump`:Block -`Allow Crash Dump`: Block - ## Disable Windows Error Reporting (WER)/user-mode crash dumps for PDE -**Administrative Templates**, scroll down and expand **Windows Components** -Under **Windows Components**, scroll down and select **Windows Error Reporting**. Make sure to only select **Windows Error Reporting** and not to expand it -When the settings for the **Windows Error Reporting** subcategory appear under **Setting name** in the lower pane, select **Disable Windows Error Reporting**, and then select the **X** in the top right corner of the **Settings picker** window to close the window -Change **Disable Windows Error Reporting** from **Disabled** to **Enabled** by selecting the slider next to the option - ## Disable hibernation -1. Under **Browse by category**, scroll down and select **Power** - 1. When the settings for the **Power** category appear under **Setting name** in the lower pane, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window - 1. Change **Allow Hibernate** from **Allow** to **Block** by selecting the slider next to the option - ## Disable allowing users to select when a password is required when resuming from connected standby for PDE When the **Disable allowing users to select when a password is required when resuming from connected standby** policy isn't configured, the outcome between on-premises Active Directory joined devices and workgroup devices, including Azure Active Directory joined devices, is different: @@ -90,47 +74,20 @@ Because of this undesired outcome, it's recommended to explicitly disable this p ## Disable allowing users to select when a password is required when resuming from connected standby in Intune -To disable the policy **Disable allowing users to select when a password is required when resuming from connected standby** using Intune, follow the below steps: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. In the **Home** screen, select **Devices** in the left pane -1. In the **Devices | Overview** screen, under **Policy**, select **Configuration Profiles** -1. In the **Devices | Configuration profiles** screen, make sure **Profiles** is selected at the top, and then select **Create profile** -1. In the **Create profile** window that opens: - 1. Under **Platform**, select **Windows 10 and later** - 1. Under **Profile type**, select **Settings catalog** - 1. Select **Create** to close the **Create profile** window -1. The **Create profile** screen will open. In the **Basics** page: - 1. Next to **Name**, enter **Disable allowing users to select when a password is required when resuming from connected standby** - 1. Next to **Description**, enter a description - 1. Select **Next**. - -1. In the **Configuration settings** page: - 1. Select **Add settings** - 1. In the **Settings picker** window that opens: - 1. Under **Browse by category**, expand **Administrative Templates** - 1. Under **Administrative Templates**, scroll down and expand **System** - 1. Under **System**, scroll down and select **Logon** - 1. When the settings for the **Logon** subcategory appear under **Setting name** in the lower pane, select **Allow users to select when a password is required when resuming from connected standby**, and then select the **X** in the top right corner of the **Settings picker** window to close the window - 1. Leave the slider for **Allow users to select when a password is required when resuming from connected standby** at the default of **Disabled** - 1. select **Next** - - [!INCLUDE [intune-settings-catalog-1](../../../../../includes/configure/intune-settings-catalog-1.md)] | Category | Setting name | Value | |--|--|--| -| Device Guard | Credential Guard | Select one of the options:
 - **Enabled with UEFI lock**
 - **Enabled without lock** | - ->[!IMPORTANT] -> If you want to be able to turn off Windows Defender Credential Guard remotely, choose the option **Enabled without lock**. +|`Memory Dump`|`Allow Live Dump`|Block|| +|`Memory Dump`|`Allow Crash Dump`|Block|| +|`Administrative Templates`| `System > Logon` | Select **Allow users to select when a password is required when resuming from connected standby:**
 - **Disabled**| +|**Power**|**Allow Hibernate**|Change **Allow Hibernate** from **Allow** to **Block** by selecting the slider next to the option| +|`Administrative Templates`| **Windows Components > Windows Error Reporting** | Change **Disable Windows Error Reporting** from **Disabled** to **Enabled** by selecting the slider next to the option| [!INCLUDE [intune-settings-catalog-2](../../../../../includes/configure/intune-settings-catalog-2.md)] -> [!TIP] -> You can also configure Credential Guard by using an *account protection* profile in endpoint security. For more information, see [Account protection policy settings for endpoint security in Microsoft Intune](/mem/intune/protect/endpoint-security-account-protection-profile-settings). +Alternatively, you can configure devices using a [custom policy][INT-1] with the [Policy CSP][CSP-1].\ -Alternatively, you can configure devices using a [custom policy][INT-1] with the [DeviceGuard Policy CSP][CSP-1].\ The policy settings are located under: `./Device/Vendor/MSFT/Policy/Config/DeviceGuard/`. | Setting | From 0989666354505ad79c23d8a1f90e79ebf4105530 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 08:16:23 -0400 Subject: [PATCH 012/125] updates:q --- .../data-protection/personal-data-encryption/configure.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index 76a1e5431d..20945120ed 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -2,7 +2,7 @@ title: PDE settings and configuration description: Learn about the available options to configure Personal Data Encryption (PDE) and how to configure them via Microsoft Intune or configuration Service Provider (CSP). ms.topic: how-to -ms.date: 03/13/2023 +ms.date: 08/11/2023 --- # PDE settings and configuration @@ -95,8 +95,6 @@ The policy settings are located under: `./Device/Vendor/MSFT/Policy/Config/Devic | **Setting name**: Turn On Virtualization Based Security
**Policy CSP name**: `EnableVirtualizationBasedSecurity` | | **Setting name**: Credential Guard Configuration
**Policy CSP name**: `LsaCfgFlags` | - - [CSP-1]: /windows/client-management/mdm/policy-csp-localpoliciessecurityoptions From 55f2f142a83bc27acb46c485fc4fd75adb15090e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 10:52:45 -0400 Subject: [PATCH 013/125] updates --- .../personal-data-encryption/configure.md | 107 ++++++++++- .../personal-data-encryption/faq.yml | 14 -- .../personal-data-encryption/index.md | 172 +++--------------- 3 files changed, 134 insertions(+), 159 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index 20945120ed..6e9dd3a346 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -9,6 +9,66 @@ ms.date: 08/11/2023 This article describes the Personal Data Encryption (PDE) settings and how to configure them via Microsoft Intune or configuration Service Provider (CSP). +> [!NOTE] +> PDE can be configured using MDM policies. The content to be protected by PDE can be specified using [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). There is no user interface in Windows to either enable PDE or protect content using PDE. + +> [!NOTE] +> Enabling the PDE policy on devices only enables the PDE feature. It does not protect any content. To protect content via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. + +### Security hardening recommendations + +- [Kernel-mode crash dumps and live dumps disabled](/windows/client-management/mdm/policy-csp-memorydump#memorydump-policies) + + Kernel-mode crash dumps and live dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps. For information on disabling crash dumps and live dumps via Intune, see [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md). + +- [Windows Error Reporting (WER) disabled/User-mode crash dumps disabled](/windows/client-management/mdm/policy-csp-errorreporting#errorreporting-disablewindowserrorreporting) + + Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps. For more information on disabling crash dumps via Intune, see [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md). + +- [Hibernation disabled](/windows/client-management/mdm/policy-csp-power#power-allowhibernate) + + Hibernation files can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable hibernation. For more information on disabling crash dumps via Intune, see [Disable hibernation](intune-disable-hibernation.md). + +- [Allowing users to select when a password is required when resuming from connected standby disabled](/windows/client-management/mdm/policy-csp-admx-credentialproviders#admx-credentialproviders-allowdomaindelaylock) + + When this policy isn't configured, the outcome between on-premises Active Directory joined devices and workgroup devices, including Azure Active Directory joined devices, is different: + + - On-premises Active Directory joined devices: + + - A user can't change the amount of time after the device´s screen turns off before a password is required when waking the device. + + - A password is required immediately after the screen turns off. + + The above is the desired outcome, but PDE isn't supported with on-premises Active Directory joined devices. + + - Workgroup devices, including Azure AD joined devices: + + - A user on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device. + + - During the time when the screen turns off but a password isn't required, the keys used by PDE to protect content could potentially be exposed. This outcome isn't a desired outcome. + + Because of this undesired outcome, it's recommended to explicitly disable this policy on Azure AD joined devices instead of leaving it at the default of **Not configured**. + + For information on disabling this policy via Intune, see [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md). + +### Highly recommended + +- [BitLocker Drive Encryption](../bitlocker/index.md) enabled + + Although PDE will work without BitLocker, it's recommended to also enable BitLocker. PDE is meant to work alongside BitLocker for increased security. PDE isn't a replacement for BitLocker. + +- Backup solution such as [OneDrive in Microsoft 365](/sharepoint/onedrive-overview) + + In certain scenarios such as TPM resets or destructive PIN resets, the keys used by PDE to protect content will be lost. In such scenarios, any content protected with PDE will no longer be accessible. The only way to recover such content would be from backup. + +- [Windows Hello for Business PIN reset service](../../../identity-protection/hello-for-business/hello-feature-pin-reset.md) + + Destructive PIN resets will cause keys used by PDE to protect content to be lost. A destructive PIN reset will make any content protected with PDE no longer accessible after the destructive PIN reset has occurred. Content protected with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets. + +- [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) + + Provides additional security when authenticating with Windows Hello for Business via biometrics or PIN + ## PDE settings list The following table lists the required and suggested settings to use with PDE. @@ -95,9 +155,54 @@ The policy settings are located under: `./Device/Vendor/MSFT/Policy/Config/Devic | **Setting name**: Turn On Virtualization Based Security
**Policy CSP name**: `EnableVirtualizationBasedSecurity` | | **Setting name**: Credential Guard Configuration
**Policy CSP name**: `LsaCfgFlags` | + +## Disable PDE and decrypt content + +Once PDE is enabled, it isn't recommended to disable it. However if PDE does need to be disabled, it can be done so via the MDM policy described in the section [How to enable PDE](#how-to-enable-pde). The value of the OMA-URI needs to be changed from **`1`** to **`0`** as follows: + +- Name: **Personal Data Encryption** +- OMA-URI: **./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption** +- Data type: **Integer** +- Value: **0** + +Disabling PDE doesn't decrypt any PDE protected content. It only prevents the PDE API from being able to protect any additional content. PDE protected files can be manually decrypted using the following steps: + +1. Open the properties of the file +2. Under the **General** tab, select **Advanced...** +3. Uncheck the option **Encrypt contents to secure data** +4. Select **OK**, and then **OK** again + +PDE protected files can also be decrypted using [WINS-1]. Using `cipher.exe` can be helpful to decrypt files in the following scenarios: + +- Decrypting a large number of files on a device +- Decrypting files on a large number of devices. + +To decrypt files on a device using `cipher.exe`: + +- Decrypt all files under a directory including subdirectories: + + ```cmd + cipher.exe /d /s: + ``` + +- Decrypt a single file or all of the files in the specified directory, but not any subdirectories: + + ```cmd + cipher.exe /d + ``` + +> [!IMPORTANT] +> Once a user selects to manually decrypt a file, the user will not be able to manually protect the file again using PDE. + +## Next steps + +- Review the [Personal Data Encryption (PDE) FAQ](faq.yml) + [CSP-1]: /windows/client-management/mdm/policy-csp-localpoliciessecurityoptions [MEM-1]: /mem/intune/configuration/settings-catalog -[MEM-2]: /mem/intune/configuration/custom-settings-windows-10 \ No newline at end of file +[MEM-2]: /mem/intune/configuration/custom-settings-windows-10 + +[WINS-1]: /windows-server/administration/windows-commands/cipher \ No newline at end of file diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml b/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml index 0429e74204..1e069f5f47 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml @@ -45,14 +45,6 @@ sections: answer: | No. PDE protected content can only be accessed after signing on locally to Windows with Windows Hello for Business credentials. - - question: How can it be determined if a file is protected with PDE? - answer: | - - Files protected with PDE and EFS will both show a padlock on the file's icon. To verify whether a file is protected with PDE vs. EFS: - 1. In the properties of the file, navigate to **General** > **Advanced**. The option **Encrypt contents to secure data** should be selected. - 2. Select the **Details** button. - 3. If the file is protected with PDE, under **Protection status:**, the item **Personal Data Encryption is:** will be marked as **On**. - - [`cipher.exe`](/windows-server/administration/windows-commands/cipher) can also be used to show the encryption state of the file. - - question: Can users manually encrypt and decrypt files with PDE? answer: | Currently users can decrypt files manually but they can't encrypt files manually. For information on how a user can manually decrypt a file, see the section **Disable PDE and decrypt files** in [Personal Data Encryption (PDE)](index.md). @@ -64,9 +56,3 @@ sections: - question: What encryption method and strength does PDE use? answer: | PDE uses AES-CBC with a 256-bit key to encrypt content. - -additionalContent: | - ## See also - - [Personal Data Encryption (PDE)](index.md) - - [Configure Personal Data Encryption (PDE) polices in Intune](configure-pde-in-intune.md) - diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md index 617cf005e1..f522dc5930 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md @@ -2,101 +2,39 @@ title: Personal Data Encryption (PDE) description: Personal Data Encryption unlocks user encrypted files at user sign-in instead of at boot. ms.topic: how-to -ms.date: 03/13/2023 +ms.date: 08/11/2023 --- # Personal Data Encryption (PDE) -Starting in Windows 11, version 22H2, Personal Data Encryption (PDE) is a security feature that provides more encryption capabilities to Windows. +Starting in Windows 11, version 22H2, Personal Data Encryption (PDE) is a security feature that provides file-based data encryption capabilities to Windows. -PDE differs from BitLocker in that it encrypts individual files and content instead of whole volumes and disks. PDE occurs in addition to other encryption methods such as BitLocker. +PDE utilizes Windows Hello for Business to link *data encryption keys* with user credentials. When a user signs in to a device using Windows Hello for Business, decryption keys are released, and encrypted data is accessible to the user.\ +When a user logs off, decryption keys are discarded and data is inaccessible, even if another user signs in to the device. -PDE utilizes Windows Hello for Business to link data encryption keys with user credentials. This feature can minimize the number of credentials the user has to remember to gain access to content. For example, when using BitLocker with PIN, a user would need to authenticate twice - once with the BitLocker PIN and a second time with Windows credentials. This requirement requires users to remember two different credentials. With PDE, users only need to enter one set of credentials via Windows Hello for Business. +The use of Windows Hello for Business offers the following advantages: -Because PDE utilizes Windows Hello for Business, PDE is also accessibility friendly due to the accessibility features available when using Windows Hello for Business. +- It reduces the number of credentials to access encrypted content: users only need to sign-in with Windows Hello for Business +- The accessibility features available when using Windows Hello for Business extend to PDE protected content -Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user signs in using Windows Hello for Business. Users will only be able to access their PDE protected content once they've signed into Windows using Windows Hello for Business. Additionally, PDE has the ability to also discard the encryption keys when the device is locked. - -> [!NOTE] -> PDE can be enabled using MDM policies. The content to be protected by PDE can be specified using [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). There is no user interface in Windows to either enable PDE or protect content using PDE. - - -[!INCLUDE [personal-data-encryption-pde](../../../../../includes/licensing/personal-data-encryption-pde.md)] +PDE differs from BitLocker in that it encrypts files instead of whole volumes and disks. PDE occurs in addition to other encryption methods such as BitLocker.\ +Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user signs in using Windows Hello for Business. ## Prerequisites -### Required +To use PDE, the following prerequisites must be met: -- [Azure AD joined device](/azure/active-directory/devices/concept-azure-ad-join) -- [Windows Hello for Business Overview](../../../identity-protection/hello-for-business/index.md) -- Windows 11, version 22H2 and later Enterprise and Education editions +- The devices must be [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) + - Domain-joined and hybrid Azure AD joined devices aren't supported +- Users must sign in with [Windows Hello for Business](../../../identity-protection/hello-for-business/index.md) + - [FIDO/security key authentication](/azure/active-directory/authentication/howto-authentication-passwordless-security-key) isn't supported +- Windows 11, version 22H2 and later -### Not supported with PDE - -- [FIDO/security key authentication](/azure/active-directory/authentication/howto-authentication-passwordless-security-key) -- [Winlogon automatic restart sign-on (ARSO)](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-) - - For information on disabling ARSO via Intune, see [Disable Winlogon automatic restart sign-on (ARSO)](intune-disable-arso.md). -- [Protect your enterprise data using Windows Information Protection (WIP)](../../../information-protection/windows-information-protection/protect-enterprise-data-using-wip.md) -- [Hybrid Azure AD joined devices](/azure/active-directory/devices/concept-azure-ad-join-hybrid) -- Remote Desktop connections - -### Security hardening recommendations - -- [Kernel-mode crash dumps and live dumps disabled](/windows/client-management/mdm/policy-csp-memorydump#memorydump-policies) - - Kernel-mode crash dumps and live dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps. For information on disabling crash dumps and live dumps via Intune, see [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md). - -- [Windows Error Reporting (WER) disabled/User-mode crash dumps disabled](/windows/client-management/mdm/policy-csp-errorreporting#errorreporting-disablewindowserrorreporting) - - Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps. For more information on disabling crash dumps via Intune, see [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md). - -- [Hibernation disabled](/windows/client-management/mdm/policy-csp-power#power-allowhibernate) - - Hibernation files can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable hibernation. For more information on disabling crash dumps via Intune, see [Disable hibernation](intune-disable-hibernation.md). - -- [Allowing users to select when a password is required when resuming from connected standby disabled](/windows/client-management/mdm/policy-csp-admx-credentialproviders#admx-credentialproviders-allowdomaindelaylock) - - When this policy isn't configured, the outcome between on-premises Active Directory joined devices and workgroup devices, including Azure Active Directory joined devices, is different: - - - On-premises Active Directory joined devices: - - - A user can't change the amount of time after the device´s screen turns off before a password is required when waking the device. - - - A password is required immediately after the screen turns off. - - The above is the desired outcome, but PDE isn't supported with on-premises Active Directory joined devices. - - - Workgroup devices, including Azure AD joined devices: - - - A user on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device. - - - During the time when the screen turns off but a password isn't required, the keys used by PDE to protect content could potentially be exposed. This outcome isn't a desired outcome. - - Because of this undesired outcome, it's recommended to explicitly disable this policy on Azure AD joined devices instead of leaving it at the default of **Not configured**. - - For information on disabling this policy via Intune, see [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md). - -### Highly recommended - -- [BitLocker Drive Encryption](../bitlocker/index.md) enabled - - Although PDE will work without BitLocker, it's recommended to also enable BitLocker. PDE is meant to work alongside BitLocker for increased security. PDE isn't a replacement for BitLocker. - -- Backup solution such as [OneDrive in Microsoft 365](/sharepoint/onedrive-overview) - - In certain scenarios such as TPM resets or destructive PIN resets, the keys used by PDE to protect content will be lost. In such scenarios, any content protected with PDE will no longer be accessible. The only way to recover such content would be from backup. - -- [Windows Hello for Business PIN reset service](../../../identity-protection/hello-for-business/hello-feature-pin-reset.md) - - Destructive PIN resets will cause keys used by PDE to protect content to be lost. A destructive PIN reset will make any content protected with PDE no longer accessible after the destructive PIN reset has occurred. Content protected with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets. - -- [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) - - Provides additional security when authenticating with Windows Hello for Business via biometrics or PIN +[!INCLUDE [personal-data-encryption-pde](../../../../../includes/licensing/personal-data-encryption-pde.md)] ## PDE protection levels -PDE uses AES-CBC with a 256-bit key to protect content and offers two levels of protection. The level of protection is determined based on the organizational needs. These levels can be set via the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). +PDE uses **AES-CBC** with a **256-bit key** to protect content and offers two levels of protection. The level of protection is determined based on the organizational needs. These levels can be set via the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). | Item | Level 1 | Level 2 | |---|---|---| @@ -115,27 +53,11 @@ When a file is protected with PDE, its icon will show a padlock. If the user has Scenarios where a user will be denied access to PDE protected content include: -- User has signed into Windows via a password instead of signing in with Windows Hello for Business biometric or PIN. -- If protected via level 2 protection, when the device is locked. -- When trying to access content on the device remotely. For example, UNC network paths. -- Remote Desktop sessions. -- Other users on the device who aren't owners of the content, even if they're signed in via Windows Hello for Business and have permissions to navigate to the PDE protected content. - -## How to enable PDE - -To enable PDE on devices, push an MDM policy to the devices with the following parameters: - -- Name: **Personal Data Encryption** -- OMA-URI: **./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption** -- Data type: **Integer** -- Value: **1** - -There's also a [PDE CSP](/windows/client-management/mdm/personaldataencryption-csp) available for MDM solutions that support it. - -> [!NOTE] -> Enabling the PDE policy on devices only enables the PDE feature. It does not protect any content. To protect content via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. - -For information on enabling PDE via Intune, see [Enable Personal Data Encryption (PDE)](intune-enable-pde.md). +- User has signed into Windows via a password instead of signing in with Windows Hello for Business biometric or PIN +- If protected via level 2 protection, when the device is locked +- When trying to access content on the device remotely. For example, UNC network paths +- Remote Desktop sessions +- Other users on the device who aren't owners of the content, even if they're signed in via Windows Hello for Business and have permissions to navigate to the PDE protected content ## Differences between PDE and BitLocker @@ -155,52 +77,14 @@ The main difference between protecting files with PDE instead of EFS is the meth To see if a file is protected with PDE or with EFS: 1. Open the properties of the file -2. Under the **General** tab, select **Advanced...** -3. In the **Advanced Attributes** windows, select **Details** +1. Under the **General** tab, select **Advanced...** +1. In the **Advanced Attributes** windows, select **Details** For PDE protected files, under **Protection status:** there will be an item listed as **Personal Data Encryption is:** and it will have the attribute of **On**. For EFS protected files, under **Users who can access this file:**, there will be a **Certificate thumbprint** next to the users with access to the file. There will also be a section at the bottom labeled **Recovery certificates for this file as defined by recovery policy:**. -Encryption information including what encryption method is being used to protect the file can be obtained with the [cipher.exe /c](/windows-server/administration/windows-commands/cipher) command. - -## Disable PDE and decrypt content - -Once PDE is enabled, it isn't recommended to disable it. However if PDE does need to be disabled, it can be done so via the MDM policy described in the section [How to enable PDE](#how-to-enable-pde). The value of the OMA-URI needs to be changed from **`1`** to **`0`** as follows: - -- Name: **Personal Data Encryption** -- OMA-URI: **./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption** -- Data type: **Integer** -- Value: **0** - -Disabling PDE doesn't decrypt any PDE protected content. It only prevents the PDE API from being able to protect any additional content. PDE protected files can be manually decrypted using the following steps: - -1. Open the properties of the file -2. Under the **General** tab, select **Advanced...** -3. Uncheck the option **Encrypt contents to secure data** -4. Select **OK**, and then **OK** again - -PDE protected files can also be decrypted using [cipher.exe](/windows-server/administration/windows-commands/cipher). Using `cipher.exe` can be helpful to decrypt files in the following scenarios: - -- Decrypting a large number of files on a device -- Decrypting files on a large number of devices. - -To decrypt files on a device using `cipher.exe`: - -- Decrypt all files under a directory including subdirectories: - - ```cmd - cipher.exe /d /s: - ``` - -- Decrypt a single file or all of the files in the specified directory, but not any subdirectories: - - ```cmd - cipher.exe /d - ``` - -> [!IMPORTANT] -> Once a user selects to manually decrypt a file, the user will not be able to manually protect the file again using PDE. +Encryption information including what encryption method is being used to protect the file can be obtained with the [`cipher.exe /c`](/windows-server/administration/windows-commands/cipher) command. ## Windows out of box applications that support PDE @@ -209,7 +93,7 @@ Certain Windows applications support PDE out of the box. If PDE is enabled on a - Mail - Supports protecting both email bodies and attachments -## See also +## Next steps -- [Personal Data Encryption (PDE) FAQ](faq-pde.yml) -- [Configure Personal Data Encryption (PDE) polices in Intune](configure-pde-in-intune.md) +- Learn about the available options to configure Personal Data Encryption (PDE) and how to configure them via Microsoft Intune or configuration Service Provider (CSP): [PDE settings and configuration](configure.md) +- Review the [Personal Data Encryption (PDE) FAQ](faq.yml) From 076fbcffed9f1d9e24f46070f3ada58f5406f0ff Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 12:16:59 -0400 Subject: [PATCH 014/125] updates --- .../personal-data-encryption/configure.md | 119 ++++-------------- .../personal-data-encryption/index.md | 29 +++-- 2 files changed, 44 insertions(+), 104 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index 6e9dd3a346..885fad8a2a 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -11,84 +11,31 @@ This article describes the Personal Data Encryption (PDE) settings and how to co > [!NOTE] > PDE can be configured using MDM policies. The content to be protected by PDE can be specified using [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). There is no user interface in Windows to either enable PDE or protect content using PDE. - -> [!NOTE] -> Enabling the PDE policy on devices only enables the PDE feature. It does not protect any content. To protect content via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. - -### Security hardening recommendations - -- [Kernel-mode crash dumps and live dumps disabled](/windows/client-management/mdm/policy-csp-memorydump#memorydump-policies) - - Kernel-mode crash dumps and live dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps. For information on disabling crash dumps and live dumps via Intune, see [Disable kernel-mode crash dumps and live dumps](intune-disable-memory-dumps.md). - -- [Windows Error Reporting (WER) disabled/User-mode crash dumps disabled](/windows/client-management/mdm/policy-csp-errorreporting#errorreporting-disablewindowserrorreporting) - - Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps. For more information on disabling crash dumps via Intune, see [Disable Windows Error Reporting (WER)/user-mode crash dumps](intune-disable-wer.md). - -- [Hibernation disabled](/windows/client-management/mdm/policy-csp-power#power-allowhibernate) - - Hibernation files can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable hibernation. For more information on disabling crash dumps via Intune, see [Disable hibernation](intune-disable-hibernation.md). - -- [Allowing users to select when a password is required when resuming from connected standby disabled](/windows/client-management/mdm/policy-csp-admx-credentialproviders#admx-credentialproviders-allowdomaindelaylock) - - When this policy isn't configured, the outcome between on-premises Active Directory joined devices and workgroup devices, including Azure Active Directory joined devices, is different: - - - On-premises Active Directory joined devices: - - - A user can't change the amount of time after the device´s screen turns off before a password is required when waking the device. - - - A password is required immediately after the screen turns off. - - The above is the desired outcome, but PDE isn't supported with on-premises Active Directory joined devices. - - - Workgroup devices, including Azure AD joined devices: - - - A user on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device. - - - During the time when the screen turns off but a password isn't required, the keys used by PDE to protect content could potentially be exposed. This outcome isn't a desired outcome. - - Because of this undesired outcome, it's recommended to explicitly disable this policy on Azure AD joined devices instead of leaving it at the default of **Not configured**. - - For information on disabling this policy via Intune, see [Disable allowing users to select when a password is required when resuming from connected standby](intune-disable-password-connected-standby.md). - -### Highly recommended - -- [BitLocker Drive Encryption](../bitlocker/index.md) enabled - - Although PDE will work without BitLocker, it's recommended to also enable BitLocker. PDE is meant to work alongside BitLocker for increased security. PDE isn't a replacement for BitLocker. - -- Backup solution such as [OneDrive in Microsoft 365](/sharepoint/onedrive-overview) - - In certain scenarios such as TPM resets or destructive PIN resets, the keys used by PDE to protect content will be lost. In such scenarios, any content protected with PDE will no longer be accessible. The only way to recover such content would be from backup. - -- [Windows Hello for Business PIN reset service](../../../identity-protection/hello-for-business/hello-feature-pin-reset.md) - - Destructive PIN resets will cause keys used by PDE to protect content to be lost. A destructive PIN reset will make any content protected with PDE no longer accessible after the destructive PIN reset has occurred. Content protected with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets. - -- [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) - - Provides additional security when authenticating with Windows Hello for Business via biometrics or PIN +> +> The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. ## PDE settings list -The following table lists the required and suggested settings to use with PDE. +The following table lists the required settings to enable PDE. -| Setting name | Description | Required? | -|-|-|-| -|Enable PDE|PDE isn't enabled by default. Before PDE can be used, you must enable it.| This setting is required.| -|Disable Winlogon automatic restart sign-on (ARSO)| Winlogon ARSO isn't supported for use with PDE. To use PDE, ARSO must be disabled.| This setting is required.| -|Disable kernel-mode crash dumps and live dumps|Kernel-mode crash dumps and live dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps.|This setting is recommended.| -|Disable Windows Error Reporting (WER)/user-mode crash dumps|Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps.|| -|Disable hibernation|Hibernation files can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable hibernation.|| +| Setting name | Description | +|-|-| +|Enable PDE|PDE isn't enabled by default. Before PDE can be used, you must enable it.| +|Disable Winlogon automatic restart sign-on (ARSO)| Winlogon ARSO isn't supported for use with PDE. To use PDE, ARSO must be disabled.| > [!NOTE] > Enabling the PDE policy on devices only enables the PDE feature. It does not protect any content. To protect content via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. -## Enable Personal Data Encryption (PDE) in Intune +## PDE hardening recommendations -**`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`** -**Data type**, select **Integer** -**Value**, enter in **1** +The following table lists the recommended settings to improve PDE's security. + +| Setting name | Description | +|-|-| +|Disable kernel-mode crash dumps and live dumps|Kernel-mode crash dumps and live dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps.| +|Disable Windows Error Reporting (WER)/user-mode crash dumps|Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps.| +|Disable hibernation|Hibernation files can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable hibernation.| +|Allowing users to select when a password is required when resuming from connected standby disabled|When this policy isn't configured on Azure AD joined devices, users on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device. During the time when the screen turns off but a password isn't required, the keys used by PDE to protect content could potentially be exposed. It's recommended to explicitly disable this policy on Azure AD joined devices.| ### Configure PDE with Microsoft Intune @@ -112,37 +59,18 @@ Settings Catalog: Category: `Administrative Templates` `Windows Components > Windows Logon Options\Sign-in and lock last interactive user automatically after a restart` -## Disable kernel-mode crash dumps and live dumps\ - -## Disable Windows Error Reporting (WER)/user-mode crash dumps for PDE - -## Disable hibernation - -## Disable allowing users to select when a password is required when resuming from connected standby for PDE - -When the **Disable allowing users to select when a password is required when resuming from connected standby** policy isn't configured, the outcome between on-premises Active Directory joined devices and workgroup devices, including Azure Active Directory joined devices, is different: - -- On-premises Active Directory joined devices: - - A user can't change the amount of time after the device's screen turns off before a password is required when waking the device - - A password is required immediately after the screen turns off - The above is the desired outcome, but PDE isn't supported with on-premises Active Directory joined devices -- Workgroup devices, including Azure AD joined devices: - - A user on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device - - During the time when the screen turns off but a password isn't required, the keys used by PDE to protect content could potentially be exposed. This outcome isn't a desired outcome - -Because of this undesired outcome, it's recommended to explicitly disable this policy on Azure AD joined devices instead of leaving it at the default of **Not configured**. - -## Disable allowing users to select when a password is required when resuming from connected standby in Intune [!INCLUDE [intune-settings-catalog-1](../../../../../includes/configure/intune-settings-catalog-1.md)] | Category | Setting name | Value | |--|--|--| -|`Memory Dump`|`Allow Live Dump`|Block|| -|`Memory Dump`|`Allow Crash Dump`|Block|| -|`Administrative Templates`| `System > Logon` | Select **Allow users to select when a password is required when resuming from connected standby:**
 - **Disabled**| -|**Power**|**Allow Hibernate**|Change **Allow Hibernate** from **Allow** to **Block** by selecting the slider next to the option| -|`Administrative Templates`| **Windows Components > Windows Error Reporting** | Change **Disable Windows Error Reporting** from **Disabled** to **Enabled** by selecting the slider next to the option| +|**PDE**|**Enable Personal Data Encryption (User)**|Enable Personal Data Encryption| +|**Administrative Templates > Windows Components > Windows Logon Options**|**Sign-in and lock last interactive user automatically after a restart**|Enabled| +|**Memory Dump**|**Allow Live Dump**|Block|| +|**Memory Dump**|**Allow Crash Dump**|Block|| +|**Administrative Templates > System > Logon** | **Allow users to select when a password is required when resuming from connected standby** | Disabled| +|**Power**|**Allow Hibernate**|Block| +|**Administrative Templates > Windows Components > Windows Error Reporting** | **Disable Windows Error Reporting** | **Enabled**| [!INCLUDE [intune-settings-catalog-2](../../../../../includes/configure/intune-settings-catalog-2.md)] @@ -155,7 +83,6 @@ The policy settings are located under: `./Device/Vendor/MSFT/Policy/Config/Devic | **Setting name**: Turn On Virtualization Based Security
**Policy CSP name**: `EnableVirtualizationBasedSecurity` | | **Setting name**: Credential Guard Configuration
**Policy CSP name**: `LsaCfgFlags` | - ## Disable PDE and decrypt content Once PDE is enabled, it isn't recommended to disable it. However if PDE does need to be disabled, it can be done so via the MDM policy described in the section [How to enable PDE](#how-to-enable-pde). The value of the OMA-URI needs to be changed from **`1`** to **`0`** as follows: diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md index f522dc5930..7afed4f153 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md @@ -24,17 +24,15 @@ Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release To use PDE, the following prerequisites must be met: -- The devices must be [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) - - Domain-joined and hybrid Azure AD joined devices aren't supported -- Users must sign in with [Windows Hello for Business](../../../identity-protection/hello-for-business/index.md) - - [FIDO/security key authentication](/azure/active-directory/authentication/howto-authentication-passwordless-security-key) isn't supported - Windows 11, version 22H2 and later +- The devices must be [Azure AD joined][AAD-1]. Domain-joined and hybrid Azure AD joined devices aren't supported +- Users must sign in using [Windows Hello for Business](../../../identity-protection/hello-for-business/index.md). Password and [security key][AAD-2] sign in aren't supported [!INCLUDE [personal-data-encryption-pde](../../../../../includes/licensing/personal-data-encryption-pde.md)] ## PDE protection levels -PDE uses **AES-CBC** with a **256-bit key** to protect content and offers two levels of protection. The level of protection is determined based on the organizational needs. These levels can be set via the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). +PDE uses *AES-CBC* with a *256-bit key* to protect content and offers two levels of protection. The level of protection is determined based on the organizational needs. These levels can be set via the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). | Item | Level 1 | Level 2 | |---|---|---| @@ -86,14 +84,29 @@ For EFS protected files, under **Users who can access this file:**, there will b Encryption information including what encryption method is being used to protect the file can be obtained with the [`cipher.exe /c`](/windows-server/administration/windows-commands/cipher) command. +### Recommendations for using PDE + +The following are recommendations for using PDE: + +- Enable [BitLocker Drive Encryption](../bitlocker/index.md). Although PDE works without BitLocker, it's recommended to enable BitLocker. PDE is meant to work alongside BitLocker for increased security at it isn't a replacement for BitLocker +- Backup solution such as [OneDrive in Microsoft 365](/sharepoint/onedrive-overview). In certain scenarios, such as TPM resets or destructive PIN resets, the keys used by PDE to protect content will be lost making any PDE-protected concent inaccessible. The only way to recover such content is from a backup. If the files are synced to OneDrive, to regain access you have to re-sync OneDrive +- [Windows Hello for Business PIN reset service](../../../identity-protection/hello-for-business/hello-feature-pin-reset.md). Destructive PIN resets will cause keys used by PDE to protect content to be lost, making any content protected with PDE inaccessible after the destructive PIN reset has occurred. Content protected with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason, Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets +- [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) offers additional security when authenticating with Windows Hello for Business via biometrics or PIN + ## Windows out of box applications that support PDE -Certain Windows applications support PDE out of the box. If PDE is enabled on a device, these applications will utilize PDE. +Certain Windows applications support PDE out of the box. If PDE is enabled on a device, these applications will utilize PDE: -- Mail - - Supports protecting both email bodies and attachments +| App name | Details | +|-|-| +| Mail | Supports protecting both email bodies and attachments| ## Next steps - Learn about the available options to configure Personal Data Encryption (PDE) and how to configure them via Microsoft Intune or configuration Service Provider (CSP): [PDE settings and configuration](configure.md) - Review the [Personal Data Encryption (PDE) FAQ](faq.yml) + + + +[AAD-1]: /azure/active-directory/devices/concept-azure-ad-join +[AAD-2]: /azure/active-directory/authentication/howto-authentication-passwordless-security-key From 93beb633694c5527a10c7c304db27a580dc9c26e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 12:27:43 -0400 Subject: [PATCH 015/125] updates --- .../personal-data-encryption/configure.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index 885fad8a2a..5dcd799c92 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -76,12 +76,14 @@ Category: `Administrative Templates` Alternatively, you can configure devices using a [custom policy][INT-1] with the [Policy CSP][CSP-1].\ -The policy settings are located under: `./Device/Vendor/MSFT/Policy/Config/DeviceGuard/`. +|OMA-URI|Format|Value| +|-|-|-| +|`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`|int|`1`| +|`./Device/Vendor/MSFT/Policy/Config/MemoryDump/AllowCrashDump`| int| `0`| +|`./Device/Vendor/MSFT/Policy/Config/MemoryDump/AllowLiveDump` |int| `0`| +|`./Device/Vendor/MSFT/Policy/Config/ErrorReporting/DisableWindowsErrorReporting`|string|``| +|`./Device/Vendor/MSFT/Policy/Config/ADMX_CredentialProviders/AllowDomainDelayLock`|string|``| -| Setting | -|--| -| **Setting name**: Turn On Virtualization Based Security
**Policy CSP name**: `EnableVirtualizationBasedSecurity` | -| **Setting name**: Credential Guard Configuration
**Policy CSP name**: `LsaCfgFlags` | ## Disable PDE and decrypt content From d6423fdd3880ed77caf406da42ca18f236ef797d Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 14:02:40 -0400 Subject: [PATCH 016/125] update --- .../personal-data-encryption/configure.md | 109 ++++++++++++++++++ 1 file changed, 109 insertions(+) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index 5dcd799c92..c2db39d5c6 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -74,6 +74,115 @@ Category: `Administrative Templates` [!INCLUDE [intune-settings-catalog-2](../../../../../includes/configure/intune-settings-catalog-2.md)] + +> [!TIP] +> Use the following Graph call to automatically create the settings catalog policy in your tenant without assignments nor scope tags. [1](#footnote1) + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{ + "id": "00-0000-0000-0000-000000000000", + "name": "_MSLearn_PDE", + "description": "", + "platforms": "windows10", + "technologies": "mdm", + "roleScopeTagIds": [ + "0" + ], + "settings": [ + { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", + "settingInstance": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", + "settingDefinitionId": "device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock", + "choiceSettingValue": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", + "value": "device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock_0", + "children": [] + } + } + }, + { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", + "settingInstance": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", + "settingDefinitionId": "device_vendor_msft_policy_config_errorreporting_disablewindowserrorreporting", + "choiceSettingValue": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", + "value": "device_vendor_msft_policy_config_errorreporting_disablewindowserrorreporting_1", + "children": [] + } + } + }, + { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", + "settingInstance": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", + "settingDefinitionId": "device_vendor_msft_policy_config_windowslogon_allowautomaticrestartsignon", + "choiceSettingValue": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", + "value": "device_vendor_msft_policy_config_windowslogon_allowautomaticrestartsignon_0", + "children": [] + } + } + }, + { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", + "settingInstance": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", + "settingDefinitionId": "device_vendor_msft_policy_config_memorydump_allowcrashdump", + "choiceSettingValue": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", + "value": "device_vendor_msft_policy_config_memorydump_allowcrashdump_0", + "children": [] + } + } + }, + { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", + "settingInstance": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", + "settingDefinitionId": "device_vendor_msft_policy_config_memorydump_allowlivedump", + "choiceSettingValue": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", + "value": "device_vendor_msft_policy_config_memorydump_allowlivedump_0", + "children": [] + } + } + }, + { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", + "settingInstance": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", + "settingDefinitionId": "user_vendor_msft_pde_enablepersonaldataencryption", + "choiceSettingValue": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", + "value": "user_vendor_msft_pde_enablepersonaldataencryption_1", + "children": [] + } + } + }, + { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", + "settingInstance": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", + "settingDefinitionId": "device_vendor_msft_policy_config_power_allowhibernate", + "choiceSettingValue": { + "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", + "value": "device_vendor_msft_policy_config_power_allowhibernate_0", + "children": [] + } + } + } + ] + } +``` + +1 When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions. + + Alternatively, you can configure devices using a [custom policy][INT-1] with the [Policy CSP][CSP-1].\ |OMA-URI|Format|Value| From d0f7be37db472f824adbbe96e382ec3fd192d7ec Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 14:25:44 -0400 Subject: [PATCH 017/125] joined lines for POST --- .../personal-data-encryption/configure.md | 97 +------------------ 1 file changed, 1 insertion(+), 96 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index c2db39d5c6..9ed0735375 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -82,102 +82,7 @@ Category: `Administrative Templates` POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies Content-Type: application/json -{ - "id": "00-0000-0000-0000-000000000000", - "name": "_MSLearn_PDE", - "description": "", - "platforms": "windows10", - "technologies": "mdm", - "roleScopeTagIds": [ - "0" - ], - "settings": [ - { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", - "settingInstance": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", - "settingDefinitionId": "device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock", - "choiceSettingValue": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", - "value": "device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock_0", - "children": [] - } - } - }, - { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", - "settingInstance": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", - "settingDefinitionId": "device_vendor_msft_policy_config_errorreporting_disablewindowserrorreporting", - "choiceSettingValue": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", - "value": "device_vendor_msft_policy_config_errorreporting_disablewindowserrorreporting_1", - "children": [] - } - } - }, - { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", - "settingInstance": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", - "settingDefinitionId": "device_vendor_msft_policy_config_windowslogon_allowautomaticrestartsignon", - "choiceSettingValue": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", - "value": "device_vendor_msft_policy_config_windowslogon_allowautomaticrestartsignon_0", - "children": [] - } - } - }, - { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", - "settingInstance": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", - "settingDefinitionId": "device_vendor_msft_policy_config_memorydump_allowcrashdump", - "choiceSettingValue": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", - "value": "device_vendor_msft_policy_config_memorydump_allowcrashdump_0", - "children": [] - } - } - }, - { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", - "settingInstance": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", - "settingDefinitionId": "device_vendor_msft_policy_config_memorydump_allowlivedump", - "choiceSettingValue": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", - "value": "device_vendor_msft_policy_config_memorydump_allowlivedump_0", - "children": [] - } - } - }, - { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", - "settingInstance": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", - "settingDefinitionId": "user_vendor_msft_pde_enablepersonaldataencryption", - "choiceSettingValue": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", - "value": "user_vendor_msft_pde_enablepersonaldataencryption_1", - "children": [] - } - } - }, - { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", - "settingInstance": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", - "settingDefinitionId": "device_vendor_msft_policy_config_power_allowhibernate", - "choiceSettingValue": { - "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", - "value": "device_vendor_msft_policy_config_power_allowhibernate_0", - "children": [] - } - } - } - ] - } +{ "id": "00-0000-0000-0000-000000000000", "name": "_MSLearn_PDE", "description": "", "platforms": "windows10", "technologies": "mdm", "roleScopeTagIds": [ "0" ], "settings": [ { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock_0", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_errorreporting_disablewindowserrorreporting", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_errorreporting_disablewindowserrorreporting_1", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_windowslogon_allowautomaticrestartsignon", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_windowslogon_allowautomaticrestartsignon_0", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_memorydump_allowcrashdump", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_memorydump_allowcrashdump_0", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_memorydump_allowlivedump", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_memorydump_allowlivedump_0", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "user_vendor_msft_pde_enablepersonaldataencryption", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "user_vendor_msft_pde_enablepersonaldataencryption_1", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_power_allowhibernate", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_power_allowhibernate_0", "children": [] } } } ] } ``` 1 When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions. From 6112e325a2fd32b536cedf490bbde51158ed8ff1 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 15:05:48 -0400 Subject: [PATCH 018/125] updates --- .../personal-data-encryption/configure.md | 69 ++++++++----------- 1 file changed, 28 insertions(+), 41 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index 9ed0735375..5afc65aba5 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -1,13 +1,13 @@ --- title: PDE settings and configuration -description: Learn about the available options to configure Personal Data Encryption (PDE) and how to configure them via Microsoft Intune or configuration Service Provider (CSP). +description: Learn about the available options to configure Personal Data Encryption (PDE) and how to configure them via Microsoft Intune or Configuration Service Providers (CSP). ms.topic: how-to ms.date: 08/11/2023 --- # PDE settings and configuration -This article describes the Personal Data Encryption (PDE) settings and how to configure them via Microsoft Intune or configuration Service Provider (CSP). +This article describes the Personal Data Encryption (PDE) settings and how to configure them via Microsoft Intune or Configuration Service Providers (CSP). > [!NOTE] > PDE can be configured using MDM policies. The content to be protected by PDE can be specified using [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). There is no user interface in Windows to either enable PDE or protect content using PDE. @@ -37,28 +37,7 @@ The following table lists the recommended settings to improve PDE's security. |Disable hibernation|Hibernation files can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable hibernation.| |Allowing users to select when a password is required when resuming from connected standby disabled|When this policy isn't configured on Azure AD joined devices, users on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device. During the time when the screen turns off but a password isn't required, the keys used by PDE to protect content could potentially be exposed. It's recommended to explicitly disable this policy on Azure AD joined devices.| -### Configure PDE with Microsoft Intune - -To configure devices using Microsoft Intune, [create a **Settings catalog** policy][MEM-1], and use the settings listed under the category **`Local Policies Security Options`**: - -Assign the policy to a security group that contains as members the devices or users that you want to configure. - -### Configure PDE with CSP - -Alternatively, you can configure devices using a [custom policy][MEM-2] with the [Name CSP][CSP-1].\ - -The policy settings are located under: `./Device/Vendor/MSFT/`. - -|Setting| -| - | -| **Setting name**: Title
**Policy CSP name**: `Setting Name`| - -## Disable Winlogon automatic restart sign-on (ARSO) - -Settings Catalog: -Category: `Administrative Templates` -`Windows Components > Windows Logon Options\Sign-in and lock last interactive user automatically after a restart` - +## Configure PDE with Microsoft Intune [!INCLUDE [intune-settings-catalog-1](../../../../../includes/configure/intune-settings-catalog-1.md)] @@ -66,17 +45,18 @@ Category: `Administrative Templates` |--|--|--| |**PDE**|**Enable Personal Data Encryption (User)**|Enable Personal Data Encryption| |**Administrative Templates > Windows Components > Windows Logon Options**|**Sign-in and lock last interactive user automatically after a restart**|Enabled| -|**Memory Dump**|**Allow Live Dump**|Block|| -|**Memory Dump**|**Allow Crash Dump**|Block|| +|**Memory Dump**|**Allow Live Dump**|Block| +|**Memory Dump**|**Allow Crash Dump**|Block| |**Administrative Templates > System > Logon** | **Allow users to select when a password is required when resuming from connected standby** | Disabled| |**Power**|**Allow Hibernate**|Block| |**Administrative Templates > Windows Components > Windows Error Reporting** | **Disable Windows Error Reporting** | **Enabled**| [!INCLUDE [intune-settings-catalog-2](../../../../../includes/configure/intune-settings-catalog-2.md)] - > [!TIP] -> Use the following Graph call to automatically create the settings catalog policy in your tenant without assignments nor scope tags. [1](#footnote1) +> Use the following Graph call to automatically create the settings catalog policy in your tenant without assignments nor scope tags. +> +> When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions. ```msgraph-interactive POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies @@ -85,10 +65,9 @@ Content-Type: application/json { "id": "00-0000-0000-0000-000000000000", "name": "_MSLearn_PDE", "description": "", "platforms": "windows10", "technologies": "mdm", "roleScopeTagIds": [ "0" ], "settings": [ { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock_0", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_errorreporting_disablewindowserrorreporting", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_errorreporting_disablewindowserrorreporting_1", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_windowslogon_allowautomaticrestartsignon", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_windowslogon_allowautomaticrestartsignon_0", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_memorydump_allowcrashdump", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_memorydump_allowcrashdump_0", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_memorydump_allowlivedump", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_memorydump_allowlivedump_0", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "user_vendor_msft_pde_enablepersonaldataencryption", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "user_vendor_msft_pde_enablepersonaldataencryption_1", "children": [] } } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSetting", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "device_vendor_msft_policy_config_power_allowhibernate", "choiceSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue", "value": "device_vendor_msft_policy_config_power_allowhibernate_0", "children": [] } } } ] } ``` -1 When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions. +## Configure PDE with CSP - -Alternatively, you can configure devices using a [custom policy][INT-1] with the [Policy CSP][CSP-1].\ +Alternatively, you can configure devices using the [Policy CSP][CSP-1] and [PDE CSP][CSP-2]. |OMA-URI|Format|Value| |-|-|-| @@ -98,15 +77,25 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the |`./Device/Vendor/MSFT/Policy/Config/ErrorReporting/DisableWindowsErrorReporting`|string|``| |`./Device/Vendor/MSFT/Policy/Config/ADMX_CredentialProviders/AllowDomainDelayLock`|string|``| - ## Disable PDE and decrypt content -Once PDE is enabled, it isn't recommended to disable it. However if PDE does need to be disabled, it can be done so via the MDM policy described in the section [How to enable PDE](#how-to-enable-pde). The value of the OMA-URI needs to be changed from **`1`** to **`0`** as follows: +Once PDE is enabled, it isn't recommended to disable it. However if you need to disable PDE, you can do so using the following steps: -- Name: **Personal Data Encryption** -- OMA-URI: **./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption** -- Data type: **Integer** -- Value: **0** +### Disable PDE with a settings catalog policy in Intune + +[!INCLUDE [intune-settings-catalog-1](../../../../../includes/configure/intune-settings-catalog-1.md)] + +| Category | Setting name | Value | +|--|--|--| +|**PDE**|**Enable Personal Data Encryption (User)**|Disable Personal Data Encryption| + +[!INCLUDE [intune-settings-catalog-2](../../../../../includes/configure/intune-settings-catalog-2.md)] + +### Disable PDE with CSP + +|OMA-URI|Format|Value| +|-|-|-| +|`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`|int|`0`| Disabling PDE doesn't decrypt any PDE protected content. It only prevents the PDE API from being able to protect any additional content. PDE protected files can be manually decrypted using the following steps: @@ -144,8 +133,6 @@ To decrypt files on a device using `cipher.exe`: [CSP-1]: /windows/client-management/mdm/policy-csp-localpoliciessecurityoptions +[CSP-2]: /windows/client-management/mdm/personaldataencryption-csp -[MEM-1]: /mem/intune/configuration/settings-catalog -[MEM-2]: /mem/intune/configuration/custom-settings-windows-10 - -[WINS-1]: /windows-server/administration/windows-commands/cipher \ No newline at end of file +[WINS-1]: /windows-server/administration/windows-commands/cipher From 2ef6ca10755586da5773fc8f687db9229b9e36d2 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 15:34:52 -0400 Subject: [PATCH 019/125] updates --- .../personal-data-encryption/configure.md | 64 ++++++++++--------- 1 file changed, 35 insertions(+), 29 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index 5afc65aba5..521c299687 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -20,8 +20,8 @@ The following table lists the required settings to enable PDE. | Setting name | Description | |-|-| -|Enable PDE|PDE isn't enabled by default. Before PDE can be used, you must enable it.| -|Disable Winlogon automatic restart sign-on (ARSO)| Winlogon ARSO isn't supported for use with PDE. To use PDE, ARSO must be disabled.| +|Enable Personal Data Encryption|PDE isn't enabled by default. Before PDE can be used, you must enable it.| +|Sign-in and lock last interactive user automatically after a restart| Winlogon automatic restart sign-on (ARSO) isn't supported for use with PDE. To use PDE, ARSO must be disabled.| > [!NOTE] > Enabling the PDE policy on devices only enables the PDE feature. It does not protect any content. To protect content via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. @@ -32,10 +32,10 @@ The following table lists the recommended settings to improve PDE's security. | Setting name | Description | |-|-| -|Disable kernel-mode crash dumps and live dumps|Kernel-mode crash dumps and live dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps.| -|Disable Windows Error Reporting (WER)/user-mode crash dumps|Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps.| -|Disable hibernation|Hibernation files can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable hibernation.| -|Allowing users to select when a password is required when resuming from connected standby disabled|When this policy isn't configured on Azure AD joined devices, users on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device. During the time when the screen turns off but a password isn't required, the keys used by PDE to protect content could potentially be exposed. It's recommended to explicitly disable this policy on Azure AD joined devices.| +|Kernel-mode crash dumps and live dumps|Kernel-mode crash dumps and live dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps.| +|Windows Error Reporting (WER)/user-mode crash dumps|Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect content to be exposed. For greatest security, disable user-mode crash dumps.| +|Hibernation|Hibernation files can potentially cause the keys used by Personal Data Encryption (PDE) to protect content to be exposed. For greatest security, disable hibernation.| +|Allow users to select when a password is required when resuming from connected standby |When this policy isn't configured on Azure AD joined devices, users on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device. During the time when the screen turns off but a password isn't required, the keys used by PDE to protect content could potentially be exposed. It's recommended to explicitly disable this policy on Azure AD joined devices.| ## Configure PDE with Microsoft Intune @@ -43,13 +43,13 @@ The following table lists the recommended settings to improve PDE's security. | Category | Setting name | Value | |--|--|--| -|**PDE**|**Enable Personal Data Encryption (User)**|Enable Personal Data Encryption| -|**Administrative Templates > Windows Components > Windows Logon Options**|**Sign-in and lock last interactive user automatically after a restart**|Enabled| -|**Memory Dump**|**Allow Live Dump**|Block| -|**Memory Dump**|**Allow Crash Dump**|Block| -|**Administrative Templates > System > Logon** | **Allow users to select when a password is required when resuming from connected standby** | Disabled| -|**Power**|**Allow Hibernate**|Block| -|**Administrative Templates > Windows Components > Windows Error Reporting** | **Disable Windows Error Reporting** | **Enabled**| +|**PDE**|Enable Personal Data Encryption (User)|Enable Personal Data Encryption| +|**Administrative Templates > Windows Components > Windows Logon Options**|Sign-in and lock last interactive user automatically after a restart|Disabled| +|**Memory Dump**|Allow Live Dump|Block| +|**Memory Dump**|Allow Crash Dump|Block| +|**Administrative Templates > Windows Components > Windows Error Reporting** | Disable Windows Error Reporting | Enabled| +|**Power**|Allow Hibernate|Block| +|**Administrative Templates > System > Logon** | Allow users to select when a password is required when resuming from connected standby | Disabled| [!INCLUDE [intune-settings-catalog-2](../../../../../includes/configure/intune-settings-catalog-2.md)] @@ -72,14 +72,16 @@ Alternatively, you can configure devices using the [Policy CSP][CSP-1] and [PDE |OMA-URI|Format|Value| |-|-|-| |`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`|int|`1`| +|`./Device/Vendor/MSFT/Policy/Config/WindowsLogon/AllowAutomaticRestartSignOn`|string|``| |`./Device/Vendor/MSFT/Policy/Config/MemoryDump/AllowCrashDump`| int| `0`| |`./Device/Vendor/MSFT/Policy/Config/MemoryDump/AllowLiveDump` |int| `0`| |`./Device/Vendor/MSFT/Policy/Config/ErrorReporting/DisableWindowsErrorReporting`|string|``| +|`./Device/Vendor/MSFT/Policy/Config/Power/AllowHibernate` |int| `0`| |`./Device/Vendor/MSFT/Policy/Config/ADMX_CredentialProviders/AllowDomainDelayLock`|string|``| -## Disable PDE and decrypt content +## Disable PDE -Once PDE is enabled, it isn't recommended to disable it. However if you need to disable PDE, you can do so using the following steps: +Once PDE is enabled, it isn't recommended to disable it. However if you need to disable PDE, you can do so using the following steps. ### Disable PDE with a settings catalog policy in Intune @@ -93,38 +95,42 @@ Once PDE is enabled, it isn't recommended to disable it. However if you need to ### Disable PDE with CSP +You can disable PDE with CSP using the following setting: + |OMA-URI|Format|Value| |-|-|-| |`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`|int|`0`| -Disabling PDE doesn't decrypt any PDE protected content. It only prevents the PDE API from being able to protect any additional content. PDE protected files can be manually decrypted using the following steps: +## Decrypt PDE-encrypted content + +Disabling PDE doesn't decrypt any PDE protected content. It only prevents the PDE API from being able to protect any additional content. PDE-protected files can be manually decrypted using the following steps: 1. Open the properties of the file -2. Under the **General** tab, select **Advanced...** -3. Uncheck the option **Encrypt contents to secure data** -4. Select **OK**, and then **OK** again +1. Under the **General** tab, select **Advanced...** +1. Uncheck the option **Encrypt contents to secure data** +1. Select **OK**, and then **OK** again -PDE protected files can also be decrypted using [WINS-1]. Using `cipher.exe` can be helpful to decrypt files in the following scenarios: +PDE-protected files can also be decrypted using [`cipher.exe`][WINS-1], which can be helpful in the following scenarios: - Decrypting a large number of files on a device -- Decrypting files on a large number of devices. +- Decrypting files on multiple of devices To decrypt files on a device using `cipher.exe`: - Decrypt all files under a directory including subdirectories: - ```cmd - cipher.exe /d /s: - ``` + ```cmd + cipher.exe /d /s: + ``` - Decrypt a single file or all of the files in the specified directory, but not any subdirectories: - ```cmd - cipher.exe /d - ``` + ```cmd + cipher.exe /d + ``` > [!IMPORTANT] -> Once a user selects to manually decrypt a file, the user will not be able to manually protect the file again using PDE. +> Once a user selects to manually decrypt a file, the user won't be able to manually protect the file again using PDE. ## Next steps @@ -132,7 +138,7 @@ To decrypt files on a device using `cipher.exe`: -[CSP-1]: /windows/client-management/mdm/policy-csp-localpoliciessecurityoptions +[CSP-1]: /windows/client-management/mdm/policy-configuration-service-provider [CSP-2]: /windows/client-management/mdm/personaldataencryption-csp [WINS-1]: /windows-server/administration/windows-commands/cipher From b513c30ecf9cf0c74b393ffef74138fb49637efd Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 16:04:16 -0400 Subject: [PATCH 020/125] updates --- .../data-protection/personal-data-encryption/configure.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index 521c299687..bc72081ebb 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -72,12 +72,12 @@ Alternatively, you can configure devices using the [Policy CSP][CSP-1] and [PDE |OMA-URI|Format|Value| |-|-|-| |`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`|int|`1`| -|`./Device/Vendor/MSFT/Policy/Config/WindowsLogon/AllowAutomaticRestartSignOn`|string|``| +|`./Device/Vendor/MSFT/Policy/Config/WindowsLogon/AllowAutomaticRestartSignOn`|string|`/`| |`./Device/Vendor/MSFT/Policy/Config/MemoryDump/AllowCrashDump`| int| `0`| |`./Device/Vendor/MSFT/Policy/Config/MemoryDump/AllowLiveDump` |int| `0`| -|`./Device/Vendor/MSFT/Policy/Config/ErrorReporting/DisableWindowsErrorReporting`|string|``| +|`./Device/Vendor/MSFT/Policy/Config/ErrorReporting/DisableWindowsErrorReporting`|string|`/`| |`./Device/Vendor/MSFT/Policy/Config/Power/AllowHibernate` |int| `0`| -|`./Device/Vendor/MSFT/Policy/Config/ADMX_CredentialProviders/AllowDomainDelayLock`|string|``| +|`./Device/Vendor/MSFT/Policy/Config/ADMX_CredentialProviders/AllowDomainDelayLock`|string|`/`| ## Disable PDE From 5b17368bf461e5572eb8ea9b525a893ab2009340 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 16:19:50 -0400 Subject: [PATCH 021/125] updates --- .../data-protection/personal-data-encryption/configure.md | 5 +---- .../data-protection/personal-data-encryption/faq.yml | 4 ++-- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index bc72081ebb..b577c577bb 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -14,7 +14,7 @@ This article describes the Personal Data Encryption (PDE) settings and how to co > > The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. -## PDE settings list +## PDE settings The following table lists the required settings to enable PDE. @@ -23,9 +23,6 @@ The following table lists the required settings to enable PDE. |Enable Personal Data Encryption|PDE isn't enabled by default. Before PDE can be used, you must enable it.| |Sign-in and lock last interactive user automatically after a restart| Winlogon automatic restart sign-on (ARSO) isn't supported for use with PDE. To use PDE, ARSO must be disabled.| -> [!NOTE] -> Enabling the PDE policy on devices only enables the PDE feature. It does not protect any content. To protect content via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which content to protect and at what level to protect the content. Additionally, the PDE APIs can't be used to protect content until the PDE policy has been enabled. - ## PDE hardening recommendations The following table lists the recommended settings to improve PDE's security. diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml b/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml index 1e069f5f47..9dbd3b3def 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml @@ -4,7 +4,7 @@ metadata: title: Frequently asked questions for Personal Data Encryption (PDE) description: Answers to common questions regarding Personal Data Encryption (PDE). ms.topic: faq - ms.date: 03/13/2023 + ms.date: 08/11/2023 title: Frequently asked questions for Personal Data Encryption (PDE) summary: | @@ -47,7 +47,7 @@ sections: - question: Can users manually encrypt and decrypt files with PDE? answer: | - Currently users can decrypt files manually but they can't encrypt files manually. For information on how a user can manually decrypt a file, see the section **Disable PDE and decrypt files** in [Personal Data Encryption (PDE)](index.md). + Currently users can decrypt files manually but they can't encrypt files manually. For information on how a user can manually decrypt a file, see the section [Decrypt PDE-encrypted content](configure.md#decrypt-pde-encrypted-content). - question: If a user signs into Windows with a password instead of Windows Hello for Business, will they be able to access their PDE protected content? answer: | From 801c35cab26eefa47d78d41372c90aa935a2be13 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 16:53:11 -0400 Subject: [PATCH 022/125] updates to OMA-URI values --- .../data-protection/personal-data-encryption/configure.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md index b577c577bb..7a7277136f 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md @@ -69,12 +69,12 @@ Alternatively, you can configure devices using the [Policy CSP][CSP-1] and [PDE |OMA-URI|Format|Value| |-|-|-| |`./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`|int|`1`| -|`./Device/Vendor/MSFT/Policy/Config/WindowsLogon/AllowAutomaticRestartSignOn`|string|`/`| +|`./Device/Vendor/MSFT/Policy/Config/WindowsLogon/AllowAutomaticRestartSignOn`|string|``| |`./Device/Vendor/MSFT/Policy/Config/MemoryDump/AllowCrashDump`| int| `0`| |`./Device/Vendor/MSFT/Policy/Config/MemoryDump/AllowLiveDump` |int| `0`| -|`./Device/Vendor/MSFT/Policy/Config/ErrorReporting/DisableWindowsErrorReporting`|string|`/`| +|`./Device/Vendor/MSFT/Policy/Config/ErrorReporting/DisableWindowsErrorReporting`|string|``| |`./Device/Vendor/MSFT/Policy/Config/Power/AllowHibernate` |int| `0`| -|`./Device/Vendor/MSFT/Policy/Config/ADMX_CredentialProviders/AllowDomainDelayLock`|string|`/`| +|`./Device/Vendor/MSFT/Policy/Config/ADMX_CredentialProviders/AllowDomainDelayLock`|string|``| ## Disable PDE From 3a06a978a7c4fe8ee5a696082faa75410edc5720 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 17:01:30 -0400 Subject: [PATCH 023/125] redirects --- ...blishing.redirection.windows-security.json | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 54589ae7b4..6e2684b399 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7334,6 +7334,51 @@ "source_path": "windows/security/zero-trust-windows-device-health.md", "redirect_url": "/windows/security/security-foundations/zero-trust-windows-device-health", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/configure-pde-in-intune.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-arso.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-hibernation.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-memory-dumps.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-password-connected-standby.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-wer.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-enable-pde.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/includes/pde-description.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/faq-pde.yml", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/faq", + "redirect_document_id": false } ] } From 0ca325899fa2e4b819809fd8cf1426d95d2688a6 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 11 Aug 2023 18:19:02 -0400 Subject: [PATCH 024/125] updates --- .../data-protection/personal-data-encryption/index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md index 7afed4f153..6fe6c59028 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md @@ -84,13 +84,13 @@ For EFS protected files, under **Users who can access this file:**, there will b Encryption information including what encryption method is being used to protect the file can be obtained with the [`cipher.exe /c`](/windows-server/administration/windows-commands/cipher) command. -### Recommendations for using PDE +## Recommendations for using PDE The following are recommendations for using PDE: - Enable [BitLocker Drive Encryption](../bitlocker/index.md). Although PDE works without BitLocker, it's recommended to enable BitLocker. PDE is meant to work alongside BitLocker for increased security at it isn't a replacement for BitLocker -- Backup solution such as [OneDrive in Microsoft 365](/sharepoint/onedrive-overview). In certain scenarios, such as TPM resets or destructive PIN resets, the keys used by PDE to protect content will be lost making any PDE-protected concent inaccessible. The only way to recover such content is from a backup. If the files are synced to OneDrive, to regain access you have to re-sync OneDrive -- [Windows Hello for Business PIN reset service](../../../identity-protection/hello-for-business/hello-feature-pin-reset.md). Destructive PIN resets will cause keys used by PDE to protect content to be lost, making any content protected with PDE inaccessible after the destructive PIN reset has occurred. Content protected with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason, Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets +- Backup solution such as [OneDrive in Microsoft 365](/sharepoint/onedrive-overview). In certain scenarios, such as TPM resets or destructive PIN resets, the keys used by PDE to protect content will be lost making any PDE-protected concent inaccessible. The only way to recover such content is from a backup. If the files are synced to OneDrive, to regain access you must re-sync OneDrive +- [Windows Hello for Business PIN reset service](../../../identity-protection/hello-for-business/hello-feature-pin-reset.md). Destructive PIN resets will cause keys used by PDE to protect content to be lost, making any content protected with PDE inaccessible. After a destructive PIN reset, content protected with PDE must be recovered from a backup. For this reason, Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets - [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) offers additional security when authenticating with Windows Hello for Business via biometrics or PIN ## Windows out of box applications that support PDE From 3bf46923087b8de392d38f1724a0770172df3fa0 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 14 Aug 2023 16:01:54 -0700 Subject: [PATCH 025/125] updatesseeker- --- .../deployment/update/waas-configure-wufb.md | 48 +++++++++++++++++-- .../update/waas-wufb-group-policy.md | 4 +- 2 files changed, 45 insertions(+), 7 deletions(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index c6c7a89a58..7eb50a5398 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -8,7 +8,7 @@ ms.localizationpriority: medium ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 05/19/2023 +ms.date: 08/22/2023 --- # Configure Windows Update for Business @@ -162,7 +162,7 @@ In cases where the pause policy is first applied after the configured start date | MDM for Windows 10, version 1607 or later:
../Vendor/MSFT/Policy/Config/Update/
**PauseQualityUpdates** | **1607:** \Microsoft\PolicyManager\default\Update\PauseQualityUpdates
**1703:** \Microsoft\PolicyManager\default\Update\PauseQualityUpdatesStartTime | | MDM for Windows 10, version 1511:
../Vendor/MSFT/Policy/Config/Update/
**DeferUpgrade** | \Microsoft\PolicyManager\default\Update\Pause | -You can check the date that quality updates were paused by checking the registry key **PausedQualityDate** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. +You can check the date that quality updates were paused by checking the registry key **PausedQualityDate** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. The local group policy editor (GPEdit.msc) won't reflect whether the quality update pause period has expired. Although the device will resume quality updates after 35 days automatically, the pause check box will remain selected in the policy editor. To check whether a device has automatically resumed taking quality Updates, check the status registry key **PausedQualityStatus** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings** for the following values: @@ -210,6 +210,42 @@ Starting with Windows 10, version 1607, you can selectively opt out of receiving | GPO for Windows 10, version 1607 or later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Do not include drivers with Windows Updates** | \Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate | | MDM for Windows 10, version 1607 and later:
../Vendor/MSFT/Policy/Config/Update/
**ExcludeWUDriversInQualityUpdate** | \Microsoft\PolicyManager\default\Update\ExcludeWUDriversInQualityUpdate | +## Enable optional updates + +In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using the **Enable optional updates** policy. + +To keep the timing of updates consistent, the **Enable optional updates** policy respects the [deferral period for quality updates](#configure-when-devices-receive-quality-updates). This policy allows you to choose if devices should receive CFRs in addition to the optional nonsecurity preview releases, or if the end-user can make the decision to install optional updates. This policy can change the behavior of the **Get the latest updates as soon as they're available** option in **Settings** > **Update & security** > ***Windows Update** > **Advanced options**. + + +The following options are available for the policy: + +- **Automatically receive optional updates (including CFRs)**: + - The latest optional nonsecurity updates and CFRs are automatically installed on the device. The quality update deferral period is applied to the installation of these updates. + - The **Get the latest updates as soon as they're available** option is selected and users can't change the setting. + - Devices will receive CFRs in early phases of the rollout. + +- **Automatically receive optional updates**: + - The latest optional nonsecurity updates are automatically installed on the device but CFRs aren't. The quality update deferral period is applied to the installation of these updates. + - The **Get the latest updates as soon as they're available** option isn't selected and users can't change the setting. + +- **Users can select which optional updates to receive**: + - Users can select which optional updates to install from **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Optional updates**. + - Optional updates are offered to the device, but user interaction is required to install them unless the **Get the latest updates as soon as they're available** option is also enabled. + - CFRs are offered to the device, but not necessarily in the early phases of the rollout. + - Users can enable the **Get the latest updates as soon as they're available** option in **Settings** > **Update & security** > ***Windows Update** > **Advanced options**. If the user enables the **Get the latest updates as soon as they're available**, then: + - The device will receive CFRs in early phases of the rollout. + - Optional updates are automatically installed on the device. + +- **Not configured** (default): + - Optional updates aren't installed on the device and the **Get the latest updates as soon as they're available** option is disabled. + +**Policies to enable optional updates** + +| Policy | Sets registry key under HKLM\Software | +| --- | --- | +| GPO for Windows 11, version 22H2 with [KBxxxxxxx](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| MDM for Windows 11, version 22H2 with [KBxxxxxxx](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
./Device/Vendor/MSFT/Policy/Config/Update/
**[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | + ## Enable features that are behind temporary enterprise feature control @@ -221,8 +257,8 @@ The features that are behind temporary enterprise feature control will be enable | Policy | Sets registry key under HKLM\Software | | --- | --- | -| GPO for Windows 11, version 22H2 with [kb5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage end user experience > **Enable features introduced via servicing that are off by default**| \Policies\Microsoft\Windows\WindowsUpdate\AllowTemporaryEnterpriseFeatureControl | -| MDM for Windows 11, version 22H2 with [kb5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
../Vendor/MSFT/Policy/Config/Update/
**[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol)** | \Microsoft\PolicyManager\default\Update\AllowTemporaryEnterpriseFeatureControl | +| GPO for Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage end user experience > **Enable features introduced via servicing that are off by default**| \Policies\Microsoft\Windows\WindowsUpdate\AllowTemporaryEnterpriseFeatureControl | +| MDM for Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
./Device/Vendor/MSFT/Policy/Config/Update/
**[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol)** | \Microsoft\PolicyManager\default\Update\AllowTemporaryEnterpriseFeatureControl | ## Summary: MDM and Group Policy settings for Windows 10, version 1703 and later @@ -233,7 +269,7 @@ The following are quick-reference tables of the supported policy values for Wind | GPO Key | Key type | Value | | --- | --- | --- | -| AllowTemporaryEnterpriseFeatureControl

*Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
Other value or absent: Features that are shipped turned off by default will remain off | +| AllowTemporaryEnterpriseFeatureControl

*Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
2: Automatically receive optional updates
3: Users can select which optional updates to receive
Other value or absent: Don't receive optional updates| | BranchReadinessLevel | REG_DWORD | 2: Systems take feature updates for the Windows Insider build - Fast
4: Systems take feature updates for the Windows Insider build - Slow
8: Systems take feature updates for the Release Windows Insider build

Other value or absent: Receive all applicable updates | | DeferFeatureUpdates | REG_DWORD | 1: Defer feature updates
Other value or absent: Don't defer feature updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: Defer feature updates by given days | @@ -248,6 +284,7 @@ The following are quick-reference tables of the supported policy values for Wind | MDM Key | Key type | Value | | --- | --- | --- | +| AllowTemporaryEnterpriseFeatureControl

*Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
2: Automatically receive optional updates
3: Users can select which optional updates to receive
Other value or absent: Don't receive optional updates| | AllowTemporaryEnterpriseFeatureControl

*Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD |2: Systems take feature updates for the Windows Insider build - Fast
4: Systems take feature updates for the Windows Insider build - Slow
8: Systems take feature updates for the Release Windows Insider build
32: Systems take feature updates from General Availability Channel
Note: Other value or absent: Receive all applicable updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: Defer feature updates by given days | @@ -272,3 +309,4 @@ When a device running a newer version sees an update available on Windows Update | PauseFeatureUpdates | PauseFeatureUpdatesStartTime | | PauseQualityUpdates | PauseQualityUpdatesStartTime | + \ No newline at end of file diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 7d696f704d..36c302b87d 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -11,7 +11,7 @@ ms.collection: manager: aaroncz ms.topic: how-to ms.technology: itpro-updates -ms.date: 02/28/2023 +ms.date: 08/22/2023 --- # Walkthrough: Use Group Policy to configure Windows Update for Business @@ -22,7 +22,7 @@ ms.date: 02/28/2023 - Windows 10 - Windows 11 -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) ## Overview From 812444d15fc7d8414c7d6dcb8a1da76d29a7c9a2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 14 Aug 2023 16:12:34 -0700 Subject: [PATCH 026/125] updateseeker-7991583 --- .../media/7991583-update-seeker-enabled.png | Bin 0 -> 154172 bytes .../deployment/update/waas-configure-wufb.md | 1 + .../update/waas-wufb-group-policy.md | 31 ++++++++++++++++++ 3 files changed, 32 insertions(+) create mode 100644 windows/deployment/update/media/7991583-update-seeker-enabled.png diff --git a/windows/deployment/update/media/7991583-update-seeker-enabled.png b/windows/deployment/update/media/7991583-update-seeker-enabled.png new file mode 100644 index 0000000000000000000000000000000000000000..34e0e5e413dcb7af21fcbb9f06460d6570483758 GIT binary patch literal 154172 zcmb4qbyQSs^zH}(k^&Nv(m8-igCHOv-7VcA-3>~Eba!`1DIp*!Atjwk*B~Vz{d-68 z``v%;y6c{`zV*q>IcMJ3d%w?q_OnA3m$7rf+_}Jzxu4tA&w-&L5!*& zN)_U3B&_n73p=owLabXEPgFtZ$L3X})hpBW8&8vsb<@+6lbxmd?SlxiczU1Ef=4qvJtdMBuy=WkW%jF$#fYWk{S9m z4sPbWlBz60o}zT(4m2J*XgGm7^UU*1?nxrFNFBez*sAnS%S6A9pq0tQ>79yvW6A>Q zUu~~NQ&<#LCzjd7U*n8Tzg;*VC28&;V7T z`=sG}Q+=L`t7VCf5KDF&wF8CC+LZ;`3OehVC$aT;tn;gaSCjAKFY(t&G%e*-PO|IT zUcVd~?h&n&7;h{s%_vJqc-2z7q(Y#Fu!$a>qfsdCi*s~zSp0@e#DTM3DCs6~xbglQ zd#~U!`(<{2fuqULypN`HM7pm`bcbWt)uYoXGtZcsxu?x?en(Z&&8rAj($QW{#G{}J z@Spe$+N!IHS=e9A-K$)#vRmcv!53&k&a-FD!R3!M4Xs^JBp6yR|I8;wL90giQlXn3 zmAew5EHtWRA|_DD%1EzBs%M(I|F!%KX2m$&h)mtdX05oD`-~KsR6>M>^n(G03+x2y zY2#20oq`09r0)7E%f|L60jDl*>`)d{k0)5P{Q2XRp(}Y`a*SP7k0Qe-io-aP>uW{E zrZ`W0Tx`XSPPv8s@bD4%=(?Q&O_B+)s^&VjvZ*1b!r~F zv_}VO0VrhQ;TjHo2+K14JoHS>8LwsB`iqstG}&&7XiC{qIx1jK9CTp3hZ=Yo^eWv%sVgpFplng#ox(^6&qR5N?8LHtNENl0k?u<2O|okZq5-NZ?>7%5HG ztcvA1_46#X{4I?WB!d6v*;Vg34hW*b;V zH7(n{A{ojy1Iy2nx5o(*>r&bXb8X&~wXfNjc5o|Hj#g_oV-`$yTb0oD{Nfa;Y*3lo zhD^!XaYpqtSyIjEIqj!s%Flh>@U-VW``-X2m7-eYSns8sk7Di{C?xJpTvnELdW5wCFPT2 zm`w8A4E0Gi#hc$F9($=mBpy$tl{)Nwo$coGH^XGIXSx%ggM4BfC^&r3KN)uZi+jq( zD*cNTi_NQw!Z@aK!M4-wu{#)$5&hzq9W5l$HX!Q4uVOtIbIgplbN78)7jNrP(PF&; zfe?%11h>CmLpW?=G?AZZ?3kg|GK<#GsZ@FjzfnMBI=KBBl9pjrjNZYWFZ3Jh??(#X z$357BYTi2`?%B2nTZWdZt>3x5dFY67d!!F}WP`L=SVo+9bI7=FY7don=i@GYYsDyX-rTLG(ycI)e!jn7 z`-xjjRqFU&A7!;&9!m3S2N`q*T^&UEzMlI~L0TzLS{hbMe-GbWVT@yOz+V-Mn8W<{ z{*vp0b5e3PR9@hC{0$O%BFihf;0MA29=}2gDHm>kHT&{x*jKm7Y3sc~=hLT8ja36O z_+7toEHu0N?$%EktM1wtkcj#-iCrnr>!d%#XUw!<5-ud!H2CiY?_O;TWdviAoDBP3 zD`O=s?fKqZNVB!nxgVMGY6o`@(RGo(!atnFe0m3dW`b*^A;Yc%wMON`L+?l1#4%FX z7D$@-bWGiMYnbfqN+kZ?KuMRQVc&NfJrMPlsY?`7OVXu_&DiWxI4Jga6BefN;AOUG3&}NseaU zn`=FvGm~d&n)njje_t)Mrs%~gZC`wG;NB_69sT|K?pW7Xw=s)g*WFjbu?8;yF)iQSLi1${1mr`a?~s@>Y>xIo+0 zuC4Fo!I$>8C|U5uXX>an`a%HJ5E{EY%DRbHbxx3=4XJxm9)>;4k)W`<6%-|SZob?V zs$3{T#PvG4oat?8>4Ym%@H-N2!JEsYZ~~TGhh~>uWGqr1!>$mUg{IJIRSxg-UyY6% ztyd>=b;g=-@B^;nkxHHBOs_-9u)S3~qVv(9Pw>bNT02zn)(oM4_{NQcx2!N-ZocO)XSaZZcTud8e-H zZUP2T+5D4_I6u#9sUwixYzQ`16qQU7l%Ae`cC;a%{8$)^xqme8B_W%x*ZEe_+zeVi z$={Jd(lwfd*IGz$Gi}^XX3X@w4!Sq8d|T&>1@X`<#u0R?3Y|IwP#;WIyyEt~zWn-C zMic+zOs$!G2A}g-p{zr)Ua;YKv7+O~&^!89x9dD|&tk&qydw`R-mFzs%h`IGGbP>d zz`)K(&I?+He+Hs}8rsG##(>wfQ`rn(OeAyyr|ogc$sQH&q}SNM2i3|oVlpyVf~lde zKD-8Atkc*RNB>B`LuGvI$9RddnEwc_coeySV1VMo*4I{7r;SQfE8TC$yDfOUA48p**&E0B6O0B7 zdo$f}$YP>2p`1y+&F5-}Z>Jp0zbw7G&puRW=?as3J~}Ch+wR9_5PUGn_*5c)Fl4q} z{A>=!Aab}mp4!;hxB+%%HCwj@!i~9#i_6KyUfa$2PStP*e-g4h-&TH$=P57#2wI@@LcTErVc@@00S_o&Vax+r3ZBv3c<2kzSim z%cimr=dwti3PnmvN?kFlPLl$rfU<0a)r+AN_TWTu)33?GZ?k-_8;i5JthIn;bZcmJ zBtJ3gi6mndN3A<){@ElQk@467;otr%?9m7=?2jwUXSgo9>v9VSBVYe0v!pf#|+Ce|`R1`1#0kp^mtwaK=SNdnK0Hin0Ld)>~~l1%W21w*W8@2MD>p)k=4 z2MGtO!h@j9+6P~RL^`Ho_dK685<`|q5DPf+L?`S1hzXTnd8fYD&DAiU%9 z=|*-(5bGGu4~b7nnJH6e4FbvKT)DIfUVX`lp+BUhvnn^GK}EX0~FX)jGFu-$oS!>*AaNp^Ycw= zO;zN@wj3=7OuWh{VopooP;vC~nF5|CzqZDz8rM_j=jXrQT%U4qv9mkEV`PzBLG{f1 zC-7)WG!kf5ol`RnrfVsES~foE)~9pzCz-Kby=(l=c57G|~b z=oL4n0P)dnb3EDo<#4u>&CwT;w`ic4zLa}GNIa5Mvi(`$ud3Gb((*6`*-+#h;5;Da z?9S9~bOfT8(1M7Uf5=?*$?#O~A-n03AK5pi0M&o??=?57#t-ahWS zy#%18PSsB*#IDB%9Rc`Y=9;zQShq7BcYFqpuhh!23HJ-h_bl2Cc7v&$;0LW2nw))n zuKD*q)tZmyT8tIK1CHFkeH$)$>DDAH)|68Sf+P&Ml4iA`n6554CKl1tRS-ZoU*E%s=`gTk3(?%Oo&y)s-vxL2kCbgXAAikK8aPc9;|5InTdm z4FAvZ{Qu1K|FSG4FC$4OIdsOHyK9Vf1acg5%PpX`RLEj8%W2e^vSaygYX5C?sr;2R z_hwV2MJoH00wvX+erln?!d-V1Vg%)WtPTnKszo zL?NV=LbPFBT;D6h6z3wodI-EQ!8-P?1V3G+5mIZx_d{ zw8(g)ax0O}#v`=ky>1^IS6(i^Q|97`m0GB%uZJRUP+W`oFXRlsgqkJ~!N8{0{nL%;(!my4)gNz)_hPK%oJ!Yd*R~pf%Fb0UQ5?u_xdIzni{-6d#HHr z`z~YbsoOJ$Y^*%-$#540h{{I*#Yk)#mX4?N^r{V!1n!e?!9bvO_%jtD4W5PUnxB|3 zMdcP!6(5oi52wsGl{@45+WmJRmJ8s%HTkA_5O>!?Y8rje=p006)(6w*>DOR-Q2^4V z15n%_(62&`l8sfS?FyOFc7pZcz^A%al40JKnVF;TW%vT(C%)W)&K6H=(;bEn@{YBE zqyeSr8j}Iz5)6Rw3!wG@l_VD21LsB@tzXa%13e0O0|i!nv`w~M%k`pZjV?Digg9tS z{<%(K!|~2k5($!6Ax-NUV2qgFIwnR$L@IxPVG`Ubj@T7D z9*FnGEgslap+SnphJI(kp>GY|AUFisq_L_mM9X!W)e;-7uPz2~xt%sg3Z#>4X6r&T zQ80;Vtp2zrsb!t(+b=5?j}`f>@BLK01F2uTJQ_}-Wpz;x1b6oyknS$YRL`^IUKTO{;d!=90I4u&0xzx4+#guOO>>9XEu3=`QxYT>^d9Dq5?*5 zjLppE)D3!jdpAdN-ZI41oQpQF&OdhARM7n6JRxZwtNWC)Q(Fd_Pe-%q&d)KI52Ghs z`+~&639b$Y*c>QQK`ICb`wkSN=50uCg+2G~K*l57kJe>VIV7OvBPNScHw{Oi;G9!5%M$SX;MlxA zlwtKJi(ifQ8?ZS_2tT>xZuP7HI*iYw+% z!FVJ%znDn*B4|WA7drA&tI=UCmR1^8t{^ThUZvY&9#`U?uxYC_xr3W#RoR=A7VrEF zs@)Lnf>W;tBkcTR@ysWpB3Aq&kWEB!8#Aurm~kiSMDIHhVp8 zKOa~G5HHm^iXVL=f#O2&c$qaoP+)`KVm4rzwJsavvY}Ggn1abNDAp-mx^c#X-|H2@Ur^ zK=&n+YQYBSP7E!|REu;5;Y$9oTn66+5y{J3)a}3(4#HvgQ+1E^M=M7&Y9LUe}; zFLq)~%#v2>J1SN6o*eZm-I^}3mPymqE5TgkEI=2;K@S!TH=GzGT*Q0FKgCeLlv^#1 zsYx8h9WKGuxC*br39}rV<~V6wFDH+qvB;`};ReoT2mt%>N4+^yQ;Tsgf-qw0 zNh^NdT<_hiLcU<#8*)|&F`b^Rv!H%y=hX1+&bl_E>~ouW9xZACenPRa5&vDUJPn_K}H*J50?z$nL3%n)cl>pUgOZ>g>5LS#V5_)kg=v(@{s2@=)E$>|I8h-N_t%<<2aRBLUu1v6dbKF~w;a z`=p~O9j4*rC!Iulioe#jbz5K0JT<$pScdaMT_HFQ$$4uEU)TF_M31{3$oJxMN9&D_ zIHw3{5hLYR7Ee1Py)?6=s2Rj_oV|jkzan%$px7wnb>!Qbtcar(Yg|iwrEOLdLcpq7 zlOJZ*pu!!t$k^k;6{{sT+G_Q^$w8*>G=1uV1}sXR&_W|Alkz)u8@2&J_*k6%5*hm$ z_KAmk&lk#(n;?KeSqz7dBWJ{zSnwjyRT$^V#>(x>-{ZyVfg@dP<rY;NK{%{I=QTYNs|DKxS(0Cs>M+asRhn(>3bvgjT z%=Rzo0iJ>5slGWIUCrAjNQVZHyh5k;XgK>hAaNR@2fc$tPP}kR}QgIY(s^{*+lX2UM6RL3HLx+Q?Q(M+WBL2Uql z!-O#v@LGLJCf$O_OvZ5RHJ-TxrKg|r%;7uN0`Ov-tkUTPEkCse76${X@ekOnkjaKV zh9PC4McA8Syjste#j3Vztq9y>RUCKP($YL}suc)?v+vlbnf=`PI&-gSIS)jD6Zvug zn;I%3GzBHEUcG?j%E;=B+*es1u#YpX^D2MGzOri*vwM9S{^P^N!-)5bBdi*@Mk9hRA)2!(bzl#ocup;r1Ka?Bx` zz@7SsPYgv@d%hX!`Cc72@3ndYzU2X(jNO{ycDzF~Mpy3>UcEx5*5wZ{*y~v%yj3_Q z1Dmb}tV;&3Bi*j=hO~n7P`+d!oB>OOyHIY|mmbSx(n<KVH{W3Dmysc;+B)=1 z)*$%T#Pft&l0bygfg{a8&O0s$mRN5<3Q`SYZlzIaM91@JkfGBsh%qaj9+F zm0BV$8W|}ho363)Jw@*Kg2-3;;w_c_wPV+S5M_kn7^`-n66!nBTEW;kVa#N+MLr-m z`tsA$P_MOpX0Y8|S&3wj`R6!~!)k90U-CQvtN1MlidtH!PhJ|@ zp;U zBSc22pFrT0w7nJuLb@cT_+lGXg zxA7n8B+>uQj6>9hv2R#uG(PVRuiaf?Pos;|hK^cr;9JMNMlrFR#YQCl>TO=#W-} zC|9GBx?>)JcYzOw)JMj-a73I*1Hx@i3m+hBaj3=PJ>_Hz$N(i=x9`>^XbqCR>{jW| zd;66?vWo68J+ciiXiO}zNUhwlo~^@?mQ!iUNoCy$DHB5wlI@3jONxZ~Fs8d?B0u6R zEa3SQ9zpR`Szr=wn~=9j6O!f_R~QS^q?YB(A#6RGP30o&ECYo@FO6OvJZ+A zZEjR0xv>X?$43wZ$mP?xth@AcLAEEHh>J;t0x6aplEzg^KLPCIfPbp zsGcJK*%S>LR>lmr<*Nu*RF3{LWfvNCj^6+Sc43WMAZRXY6VB2=<$v7M1F26lht~<( z1ix>M3mu&(odj0AeXKM_-74Vy^|0&!;}`=r%Et2vAaMp{`ZO*6{o(U(NAUk0VZUk(z zVxnOxkG)}f6*!ji!1?>k?LE{Ugew+ilBXv9cxL1@ABySal#D=r$%?Y9HW^62N$YY# zn)9KX=d*e6SfbjMVHWT@XFX9B?KL6YwN;_+nUcF^a{guy%K>%|eN$dh6X2TkUe)A2 zfCTY7U+K;28CCn1s|_23A*?|o%wknlAPe26x z08Q{oikY)%mQCc*+5+^6&Q3v(eCD$h7oI^+P^_T_M=As}Q!Co{YaP_17n}Few!pnb zH|h(h4U$&!@aIryi45n`J;VShXc~z3(vp%(7Qv={& zPqU$PMwAZoJdfjTu|QDYTD%TT>rgTK&F%VgzE@xHaKpop4Sv+b9BcqSUb_W9{rqHi z=lq?(HdYa25q~ufge1}HCb=aBr0F4(Z!V!n*O7dzVvJqW)zxC&qegkVS~bR!nr2Eo zQ7A>lRq-s_t?!zuLN@t-c)ioEYOt~uZJn&^?B?Ww=YETfa(~Ke1(pp5PBU0a z+SpWDWpxQ^Q{R6-?THUU!5zC}n_|1%cA}HA^kO_t)Tw6Iy}CLMovAXP4;@H^+7!|g zFJNdOGhadryK9EBSDY({eJn>%Z`culIuuTghDQ~q{2ZoXzuFr!rQ@2x@I{EyeD#V9 zR-no;B}8?qJAOrU+|^QCH3ced+6KJ!QXInx6xsNytW!b&Y&~dHH_8sxb6-o~$umry z)^%HDHpwHT+HNHSr3W~<==WA5@``wrNqa$6yC>?AeETQT9|SB~90|3x4k`qJ4*@&2 z!Dreft|(pnqiK?ktn%QIe%T|p z-$d)B9=*#!RKa}RmJF&Tf;}0s<|*K;3O|Td9Fcp_WlpmDNK4Gaqlq*!C{?)KOOuU* zB^~Q6&oCy@bDvKcLiRazUwMQvVLIRgz*F8XknPW55gkgl`u2ZCg z^lSy~ojIlRE}?qZbFd;(IH`_^B{G~U@tDX45hHERM8JZJA$QU@c0%CAVCIYMfA z?iWPa=YJId-(q+DvbX|fpMz+pW!mUYn(9ZF7n;F_%@Rf+5ngchKt9e~UP)q4D`X*v z#}PANvR=O(VU}cQEu?eUoe_nE#T`_DV)!Q)5ts4HH+6xMpg3yW=u2duA(dOpB5?y_ zCtL;tcoAL&dvK?t4rVjo!yp{MI)Kn1gouBkMGpQkVy^0Gnawv3Duzv!1O8~aL{=34 zY7HX~HDLL7U3A~bj??oj{CI|%s|6^xNYJpnkZ(DIX=7iopza1aD+7a^!K~`1cJ90N38M&y7|EZP!jdLSWun$T^<` zI>w7C&;8!8BA-N5&VR%~W-K2mjJP>dp#?f2IesWaK>=sQi5dRrCy047Uq%x_h^miz zbuNFiSxQm4S4y3|5d~E=4+2e$ga;-QC^%u0ORw`7b0+Ie_+YX3<0j;8Kdx9m0T?WQ@b&)nBvt zTU{a+P<647VY`Ag?s~zrFni!Y)%gsX|mT9WrTq)C4?FvcEjT5L=1MW_PRRDJD zc>>EZ)5`AOd!blCuh2jtduut^+ytUWLVTpMNB0)xxc6sEovpDMvl| zR&9<8aaI0n>M}2vWVeg10Ycv=hF}LGG z6QvC@8~DXRM}s1oG%hbMskn66Jc3oM_oLgo zreBY6*WRzMXn-(N6#3nd>!B_#gwe#bB99%yNKM!ghY>+qIcJA1^Y{JcG*GnfGwk8Z zV*UYRm`}slQ1?3fQTH;4?li;7>r`o#DR430l$Un?E9v_6yeKHvNt7~lX?A^^K~Zei z(;jN_Gvj}-NqU(ia5rkuuB?n3HU{f6823qoAoBNLB-fGgu|brtbags z8o}SM&;k(|W8b5N!~CJRy}dmHUYOZpz;7UYV3AG;ME@rrTj@T+RF&lx-8K0kgSk(G zNF6-z;ND&Hl&kaOBe!Q9>I`^?7gwC_9wMhd7fec&WX2+Vjc$K=n|HEE_{0+XKI@$p z5^W+BoY%E?UliopG%LRV)IEnRcwSOcvZ*q>dcqo{$2BSd_x>F-Bsw{cak>D{?OXd0 z=l*uA2#tDd$NJIPCNK8AajzzSwFP*hufSN>(jW(19)59fl^)eZeMwvIi@7#Hj=c0Ud%nJA*i*!=xj^ zkFc4Uxbo<6YImg6QiXf+cUlaqcd#^`5>ghe-o($mpp2DZH7Bk3HiWf5AwBfeew|v> z)E{j*H5`OQ;Gh?g{2sr|!2w&M8{xo`{|yvJo|unN@G2m+>qisQ!NU~%B1XbV8>^L} zSCFVudQ!cG%x@1jkz&d};rGW^9v&i67SX9=ASpWf?2o7-S*xtSr|qyd^7IQ(O`((q z%|5z!7als`mk_l<=nmJ&4Ycy(Z+1)-=_dcodb=qQ>xy-s%>@=SA}dJRkhFi@9-ew z%1>KAGK^pqJ#bsi>~(sZVU=x$^Q{&ixXLe?X{RNNyXrpeoDA!n7@e(91WeqjshzNW zM@Prg-8ol4rgU_O5X;EQ4uY~;f4}8yT}g6ws>0h{6~GC>FQL5Uh#(Uh`SE~E8A=fw zvmX_Q<^DZYpC~dj#u`MNo>W_;=6;SvTN)6bRSuIfldV8sMvM9T=t%MbI@dnzPT(#q zl&RFCUW`8G9`^7MLNyQCfS9mK%~yXTV&U-+Gfyc>OOsu+K#~6xk9j?;1buugy?&Wy zzyNsWJJ{&0HRi#~14 zBF~*{P!lHq`uR)TP*kd5vRt*v$DNNs1pn`mU%w^spBh&sE@H~LaQUm5i~q8D|3#cY zyT7ywzYcZtA7H>c8IrhQW-bM zAY1R&K!h4ao7#zb)TJfZM4S>$LpB#a^Kk`?W+!KkWJ4z~muI7g2yVp!kd1pw?uuoF zmm(@uZz(d}OZ}h7#!EO@J$fhfM8e-kpHYUUe6EX9q@DTC$cvWJX|7Rd0vNNS3sK4ey0 z7PkcZ?;bRmj<}x}jPkE}Uw&>dGNN|V9VJ_o=JoV4T5Kg_MfGako zy%*%B;0D~wl6#0S6nTF4Rvt@%g_A+@`?)jo0!4D6xdOb`wcU!a6D}cMbsB1Ax;(FzOgrKnzWE_+lLU zn;iVaywp4Cx;B6Zd*Yo{zbaS2gtnj|P7+>RJ||bXPne4GCWl&VGDpNweuPhnh8{as zKuS7lk)zKtv7AF%QQqq3ZcIs5Y5}L@LGK@ZQ1;McjIoWQO5J)7pi~vis?uv~y}CGN zhr*F*HXlAxLX|6#9t_>9{&~Z?e!}%+o%BI^YQgdA^{uQmfjkzE4YpIcc$Au_x!>HWcc8*yQ(GteAzvNw?FtXC12#VeSdRV z@*RKoFs-Ik4LoRf8rIQnyVi34VrxzZ{)o`=(i!qu09-?+(w*2jS@CFN@kY!*@v)cf z8lRD4>%nLBZf>vSj~2db@>R)4-UrU;N6jq`tFxy^#n3-Ul!9+SY0HYzQv*iyXNF;U z`xmw|sGEW#1)=opeNxij(&#h?L5~#YA%cg&=dYONzb=oe?`k7154TA*?>c3XhRnSS zk7D_*Y`MEZzUO`xOZOL7cVLXk9GDD`}F=b6neYE}V<9(sYWD|f2f#6sBWSwc8 zRO4STIc|$GS8b?QB#gbH%NP~enVF4SPB?xNAkxF_Szd(|FiCpPyYab(cFE<78|dC! zv-}et){8{QUfhGL5G8o#PY!JiYI&-uRes`5J`{o0s~p zQ(Go4E#YC)Olf{Po%uyiB}W$mJ=O9#E9mzJS`GE)FLVQkf4F749##|;^!g`PdR0+u zbF#@>EqR`Xar{mG(q*{I!ECyvs-~t+BU(i#RJ7qrx#h!NOW!~T%p$IdpFdOTRu3ai zt1KPnwpvR!h$V(6&v)CTv^bs}ErgHRZpFr@X#3|Qa$egqukhW;FTb!FU-tfkJ-7LM z8j;nor^34msO~^0$XAjGzb>?l zt#_Q3NB^G8!7*hV*LE`x*B{wkuF?$A1B?Wg?i%RWQ`z$@DK(x0Ke!Q#o*uIvHHn=) zUrqFV5cb_^^m${=%zIWzhla%Y5$fY39HNg|O4ozbE(9dpUa8HkN~eDhcfyH-EKInw zg&3+=^16sE{`6a5VQq3@%rqO8zS{U4QJ2qmfI{0{Hb3?}Fm;@xBwa;BSLo5Hq|Z={ z)PmNZh})6wj(k2P$3p>+_%?|J5qg=v4e!&nJL@y*qk_4K91K}pEki_QwK(c#cq;~Y zs}0Sn?FVkcu+~@l{{W=~(;~vI5`5Yl%Qdeg5G;DkE)Op`Q3g;uY@gGfg*v7dc6lm? zq)vV)Iq5GT`smC?kAHYnJ<=e5h(55>^#_2A?sp;V&3|^pfJp)>46fP~VpMKpblXcZ zROK{$c0J2|mU&%oC)pczew0#j!$&_c;WkBmVYh#pMHa_ySBaW_|4+^?WV9gz-52Q^ z=GKY_y+`Kdi5HCy= zaYKqJz*aWr0H+rewEb#4Zosbk56mA8`{7 z{FwlQ@|N}sMi(1@{OLYC39hcsd&EqAOc1}I5W$uHK~5R6WWk0Ed8~2f7yNXCm(D?? z44p6ZvfsiHlaSYDa~?(v*$fK5`8tx%E^;%l72>k3?*!|sUz*%kUtE0)a;-GGB2H(u z*-K;RQR~TJ$e-W0&-@br{2Jm@6h6a!N9c@p*zLSogcp18_n5M+V8NnxRSvXGu>EwZ z)dEPz@S73Q?WEw$h7c9Sg2EjpxKfZfn#js%jo4?5b}Oo=sNdh?=cKZ7Wu*IVXejgT z%>@ZgEp{A8om}QCi42*MSLQiFNS>sa}L?HxM}2#m0J-saF6gS;6qe?w>Gx1r?k49Upp03`9O? zXlOv>gHQZG_t+S* zZl!;E%vy$n>4T}Bo?|~gBOq+kX#}NRO(gq^9le{Tkmi+0e&dAPubBd`U`kBArD4UJ zuwNaaTU!O7i{UfJsvb}F69c`p@lJQ7rcz5O!&b>L^`j0E7lijyJF?Q!c^l`~aoLqS zHC;ycJ$lHV+#yEws6~0(4(P&j<2>PW8Al%q4h-S3?W2_aVT9bIELnrRwNsW;Xms5{QQn@09|Q9!1oV2Hq7qQBs8@ z-pGlkp4`9c@mOM#!t$%uySrg;7D00c;54lsE<|-RQX*JW#85-BbMoXLpOacGe&Y2m z9MxA;j48I2Ah^`_`f6JvjVtOoKUwClOjA7R+-T9NP{u~Xj4x+PcQanLls#T}a^X+n=@V&WcyNN@@ z&PvkraUabUbI6V%;&a+0jzj}uY0IpmVGJ<~T7Tkqb^?%o(?`5a7bjE$PV@WvT(cij zwxuO#YFyv)Oi{3~OtK8_kX`3WfTxHb9rT%Ulr!^q)jm&d;il-^4Ee$$Ks+Aou1RjJ zZf9rfS^koY3kWo|yTSP+nAi67@;>GTZz_@>L11`I7&D`y_b-$zoG9^A25*e_)B(>| zAHg_(B_iGkI^{O%Ed{6-^sAn8=v2XL`66Xnf0;jAICJ2^z%fdnqT*@(Ji*yYw{~E(uJnOpE7#{pyqeaX>DQv0JdBK1%-8h5DXAvUKQN5{+G5APYhfH5q8 zLG8>mk;=_?#b6Ghe&^j;{Rp+4B+%(aqec_G4Cw3}_qDZ#LeFZI&Y!?mJrb?le5|j- zNZYKKOLr9273+BImqitQmP6@9DL*{F+LCvvdv4r|othD%iyP1};O28$nZ7&sQTcI7 zOw1F9RSB&U@2B^~5?tr)gW0Jv1iksXQ*vdjAG~`#RY}%e?ETyq{6I z@aq~ZP#N-?ZALfpA!wP)E`~RW7WWMe6%vH$`^-1k*QIOLnvNQCNR(whF+$D?%cHMX`2bsfxmB5?W;&?a(E&Rlb+C$Od%)ANcmP3b|u zYW9fSIOqqhPZiFZqomV-Y5tjcUR2*~;jz{L| z00Vjv!zC-J=v_qvP?dCB;ku-}?xx)&B#H{;HG?zQ9!?Z6ucSu zDP}FuQd^7%yW2&Zq)mlpZ{ri#H6uqq%Uh>3i^_p63)P|(A62Ax(b0ra$3ydX*D=iVM|=DQCIZdNd#4wdHOCV&gucBy@8P--ylX(6cVlhq zdL4)8J}r&@y$g+Z&!7Fs>RQ=O#i0vLPyXYXs0DblS*Rv-Gv zM(+#vup`iRCJ3QNL}tk-o~?25{c=_Yvb61r2Wd4V)}oxBUR^aytXgOaYL=R|)NFfD z!P^W#OwB_;$~~!SSDaDIz3Oa;BUAAOWvJX}4Lo<3ok>}&fDGU3vt0e)pP(lokU<-0 z|8n*7gzA9$*@2=1wE1ofrg4MnD^O6~eIH95Q4E>q1>G$KfuMbHK+D?$il){#XRvo9IO))3K$k+mz;pM^Mq=ye%bQ+ zOMH2L>leXT&IR-#ppM&I2|eKwce#&4Z!%J?(^xA4*%l1HB7iqXr3&jPD}5r5DrBTX zdR_REos(dsPbfx&XApO#%f~r94 z01%1|rt`+Rh>T}_H=3)rN@7sRX8jqVU)%Y*S_7@LNH&em(!A;$T;1=v6iC?PID-ycByCNi2YPI3pCMRxD-v|>-+9E8J{pr(m19uUw@3hx0v#_LZjEBeXR-Zjx zBX@m2)eO3S6d~sNGMTR*4@O%c3#6_cY>|f%$Vw}-MA;mYyKt0;6~`7m)R@6BPK3?WMTqf21u?(S}+8>M?xdgzux8iwvtQUs*C8|iL_hWGG)zj|GM8J=^_ z-g~We??Qy3vLBo%Q~6)gtC-J5JslrZ(t4}3rUK#urzC-azq)zc>rPeM&k-2hNRNwXVy3ug|u;=U6=f8*2ca0LR zWTo$E${-IXK{6+WS_}kmLi4`kOaS}%B*AeS(+{ZY2PvS9$+Xoar^K_!29R322kC8?xIWtQD1P6PbLL?SjBV?N;KLD|uE0!N$unOJZYFo?fw#eKsnruQfo|CPtLkX;~1 z<3EWey*OyaZBIXz!48@B&V|>o0q_O@=lC#&NcB_p5EF;{;9v=%iGEBiu{vqa*+wEN z>dNdEXbl%?@{INrJ!V8DG2E$D-jy{^XZ)QNtNlEA%BLo|EhWz%Av?+WZ7J#u9OBG~=BQ8E^@=2Zxr}lbv#X$}ZfPZLiN0Gx<(G31Jjy#291W&PI)!9RvOc)Is&VlIXNce#4GZQ!MDKq%7 zCl>Kdye$6ndUgF288|m5c)YCK;n3K4lOQIT5W$m*&!nlUIH{?Uovu0hGr0evt?6CX z$bGmR6U@)?0w$a8ZoRZIoeV}lylU@_?)nDKNAR~fj(Rrbm0^&Wr?^^~VK0eg-idv` zG>VjetG$%(pGP6O2fz}abum9*JXcXtBEyW{Ddd>W$NsoK-&moh1HcGkM*%g_HTrr? z(R3+&Qlo3U>QyNsE5hQ;wNi0Wv5ErPkj#qX_aJ8OXeb%n@ZqsgYdSp=pUym`e=Pe9 zhxDwTp!v$IS&*_ZB!?33GX7C>{66Q=O@@iDpI~o;u_s~2#>g_TTocDY0i22qOj|i`D z-gWoUKSz&CUwD2g`mp)m+1qyCtU(9-i*O2*Ek0h4UJF%CMoWfq=9=i2X%M%2 z$#Ybeykh;m@~?9Gof)^D5&LzE$VZMg65BtYeC9m;b+xwsA&{4(Ri%@Dk{2gsx|vCE zdzyqdti4K~|LrYRnF*2%s*kXSD}4|fVC78LQs19l{Ee?oJ&gSyJ^eOfn8$5T?zC8^ z+ViN3+T<=+xwv5ePZR(^Y=J-5ijbD68Axgxf}b*vlMd}cE=YxmTpM`-+lJuDpy&z9 z(U2sma@*;0q#zvQ0nuA{U-#w1wB97Pj{Y@OOV0R8-W6a3XGE0_{sEjOFE2b}au8YJ z8T-k@{PXz=jcE?q_%D@$AHW<;gEhc+9A_Q0q+qQXu5NGfPe^nOLTSoc++{E$}&3Fmkt2u*fH^lW7BEXelSN+g)>KBH!^slFQ zc2tcU#v_&(RT#Fl5k!;*ZUwVI)J%Jk{*V=~?44JbTh$JL$g~H*k1i6fNhhIvx;8uYmfo6yuvL)PGSOB-Vqa6n?-?o2I z5yNHS{(r;R)%{~xUx}wNj;1Wq@bK}wzn102KTs+GeI6CNagQEzN#?ue)EiCzz{a!53s;w*KN5N~M#usZsZPx{1p>9z{-Lr}Zd7st7BNg|Q~MUL;1 zqR$#YU|UX{o?|qs`Jgb(l@wLzA>JZ1xac$D0smU|tRF|>9Cv7m9KDq?LVn9#EI(5c zn|^FK=Ancwej$D`o(5~qk3nP|z4bSz^+WvE^#LkB=ZlLjt(6PJZNKE?GpJ_;A$6n+ z4tGzvm2Bz zxS@wS|H+INmn7*w9Q=KM{{c?Z4X9#(Bbur3oq7L{U!VT{`Csf+Q=_&1C6y3%PlN~1 z;=f4rD>aA<=lmMr*~{3k%C2gyKclZh24iuDz9{*RP>uK@B{O#`Bq?T5kgd{_?47N-LJr3BEfvtDE?Y3WK#gUBv3{0GJ{)jfU%1&ne zsE)UhqYTiLlZ@f%{P`E&0*s`pmWLqesT@vNb-ecn6hMOKi)cfFs&ZvUE#D?L z?+IDpB~+dTbw^Y}!Z^@a3rp(g*w`w6{?r-)=5YN@5Iw#IjG_+in|1=j*#dQXuN^oZ zeFC$g0y(@9dWhvG1Qs1eMJ@Md}cBiGrZstC=13s6m z?&E&m0fV36uKgXPFuB*0Hn~28CW2_AhPZqO5BTqH_F)8m(ZEoD3J6DH@)B*ho9JKY zL;$aa3|&@PUbW|du9)PSDbM}b@mO1qKmj^=$h*B|^prBE^>x>64kC5Z{bk*8?6J65 z@3uBxa-GQJ?8|qd(c%KyNh1kz%p7pepqn1A&j;l5MyOt@#k-)|X45rzew(*rczIdQ zkv{D-t*%X}EJUxTJU24UDG9H2qBWAd{DG{r!mx_B=jYB|pKQtB!+r^SLs|x*BKnB` z_7*0H-=@=1ZNL8~!#N1MVF*Y;D&Gwz-hxm%K0dz6sC+bs_$G9t!JJim8WMX4!tQ)2ErhqV7B}U?a9wgy##kgABeDmIlTAX5OjzAQ^NzOD^LRZH-Sy7 zoyPikcnYYM0L@OsgmyZ&{C@syx$@;9npoiuy#~~78fs0cs{y^w(1EIOs@y~pQ3O)+ zRi8A8#P!fbb}|8yFRmtZ`aO8uxj+=`=i)c46(MLY7@vSK!2fJ+LUUQ#5*7VC4L0yM zm=Jmr{h^)Shp+?k%Z2cOkc!S=*5v+EuljedOz48mX>3T=^Mbo(cd6rP zJRAktkJw`{v(*bVl^Hl1Em$WiL z7tw2ymOHcL9?zvp!q8m&wzUyI$!5A{dP!5JOpbC?=Q!`os%>T)XI^&WOVzk$N~mm` zn6d_hx|}AO;G;}J8|qh=Vc5}(8aj8DUJ%W}!{Q@s1scru^+YO3G0}&=j=TRZH7&T7 zHG-V$w{PD-;)SOb7xUN1@Gww!X%-VHODqObPrMg@KjfVg+Og;JZB9!C^CSlJ5H?=2 zOrP}&VgQFknoG_%)jR58k$y0Gz`s9LDf!$N)G8-C4e5|wIJkIv9)3a31@m9jp8moP6u6b756lO&NUMqN2)tZ))8JH10ycp>O$ zoRJOD_gJ2@fr$RoauHHXG(%M=n#iRo*=(rJ`r|uZueE8t}Auoi{%9bFa^WQeDkZPmh5r7z!Yh;8Nee z7pGR^HE)j+o3DYE9RHpR^L*+Fp-lbBu5R*M8T(VG{Sn zuOKnn2s&rbf?G?2L^8)`U{F@$JT%FdA9pMf{!%AaE%!3((B`Tf)-G6c@aZJ$dq*2X zJrySOrPl##GTS@WN(z{N&<5;K4@sCMlZ7Gf$-MT?*eB+hv$kyOlbVNeKmGiEXxUd? zQd{{4*=THH=Au{xP zF#lv#L?8WBZ?{Qk?A=7tJa)A`xEVk#kp{JTB~EqU(xwahP1o4bONifQyc!-E0cG?h zb(;54B<$J*s6aq@+h|x33&J68b9t?|V);Pohj}039&2;526D^DqNV@g*1|c#u>PHe z3OFGz7dA3|OVRRFyRj77S$feV5NbK!6>^rRv!5!v^u)GF1YE<7m3}K6=2#82o@fb& z&Q(Meh;+$hSfj_k*j8;ZuOa9pxrTKq|JR=|B)8P^M>Cb-gVo^ZhH#8GqQp8Oqk@Bw zuN$v8Coi!Zzn;~vgr+XXGEnj~hfba!p?EkLN8abQ8?; zjkDh3z>haQ01n4ksdHe!ZO(ky45a9Yd0m}TKbP4|FnJ(8S>w2L{$MX-c%+0AQDLzY#YaKs^e;>=8{YtC^NZXa_ ztTx~oh2-k&Q+ha%z%8C9^T^CM(gn==T_@H8?LEWTnCxLoPUV<2_)R_xfdpbU9zGCT z4wi&{u>_38`Y-YAkT9(ZJqh>FZVE?i27B`-O=O5fjwDx7JK|j>PdvUVoJgXhJY*0@ z_;@!}E(Uv(X+p?LtgM<1#MTHNg37qKq(v$M;}3VZ%8a^*8a%ORx-3Uh8%>wKbgjdz zm7-+&0BBD<4&fKz9CxZr{g^OJ_qZn@DkBA@s2Ukt&6LUdH&ejZJpi7!o2#>W`vwcc z-io@E&wt;5kbi$Huceb^P$#(W3%t(uKos&848&Nz)C0j3l!?9r{AbtTb@kcG&jnBr zCR5-zYmF5S2zD>&bO$y@kGSBGQ>>HoPj?$(X`)_Aa;5eb3UI5iI$lc12 zpDneAf}hrxXa|5Weozo$D$t0f0lNu!QYHZF5$Kbu3f$shz&qc-9GT;k8AEl|V|aT6 z?&6fWDyKtZx}AmQg{I>>bxr;F`1t!#92fO>Rx@~I=)-CY5Kb8tF}7gJ)X*3OkJx=> z`01a>G^P$a<5nr)gn-hNP7)1j333Od9r~Z!@ldBkd0}DTl`;`EoPXT$?Yey4~3CJs$TtV)K=);vpo}8#JzpP7+J^8&(f1;c5H}p1x6cQ(v3;#x2$y z6!=Q|FeJmA4Xpz=1rrcSO&-nt!`MW;N#6zxkI*w(KK-`i^c(BCeiur&TkGK1RUQoBo5CQGQk;t0T+{R{CZ5$+dP zRVjorW^b4a(bC{pr=SyFH{i9KZlZIfrpOqb*}s^=9H((5LT~>*iavGbe_+OQ8(xs@ zV#`{?AfTk8pAbX4vh}!L@Aeg4$4%1A2R%@fgD5sO9?i-v=rt9&SK|OfB~;mLbE0$s zB*@Evkl8`vwF8_B%^R7a_v5jG+AH=K>%=U&K)KXt*`MxW3c0UPhnk2b00kFtP+{{P z>tMz({Ti@K$32?EK-m>aFW?P8#^4}^D{CuPxn8j*RBeIpM9*_G2RvBS@304H$d`fb z=b3gxBwa@7CxcSW3741jUBMykZ_5t`;nA%R*eUkjM|AWS$qEKsBDcyR&0F#^o`=Yh z8h+=$gCt4$b*HN+eP-{|Rs?Z9+lkWM?Hr1jE0eH2Fgn-s&7?H^6&gyTuE9P^uh(eH^7?;91kopnX!HJ$|yrpkk=3m8(v@##^_w6n3+A#=9x# zX=Uq^3nGv%G!qWUJWiKnFZz#d@gspS88iXE(39P-T1j>-38#Po^*CZfL+IFj3Ik_H zUm^K*#psJ>-^YFbltqMdxDsoEGkM#WRrzRbBi}yc=uXVY>ynW=)t0DxC6&o3s9TY5 zc>yPqQE7ljXZx!#h^oss51ddX_o>l$sr05>zo|MhQW|NzhC>*5U#UUWD`OhTeQRW2 zjZu3rOq*0iT0~xr)#Ng3p!SSZhdB_!HS#9~mevK-D`pdwi-L|p&po*t3R?O*Kltph zz6>mQi{AL++B^2e48d^lBGTzNsqn9z9F5cjEq|CpI0Q}x~QZ3(sJ zXEJMF&g7q-C@KJC>iOX^s5{^dXi)Qean8|`PXZkI)6QQ6`G4v^gJ!$bg=H*7i~h*=G)_B^%sYg0>n`a zEWcCR$#})4TCL*f;<%S%YO(T*nviA#Z?0eGQPBu9q}iJmGJdU6bn6fG zRFv#3HnaxS2k9ElO7b>HBs=c#bhRn_r_pZEDORhf=;n)e#ATXndb03ijv=4ONJ#Of z=RJkcv$fhH2#)B4OEXDFsvFd*#S4a)q7n#(kB(AFs@!0EU9l5hu_rGE&<1@q)JAd( zH|spx1{p;)8@`&S3Mnfw<80cHZqHLzn@#gC&`CtUq8t9!j!Z4s$nUBX6lG>o@(xHC zzoVPm(hzryQmxjxXw#j;h~4cm3{0QUn5 zR-vefvT6^EIkPNH&w0uyuc=ia7Pi*N+})lV{kj4smypToBd|bM;TS)$zCBS(%D+(t z*t_p2i1)71R24_C@4<~=oCa7zGoV=p@OQi+qhag;pU($bX%RlnxxxB!1$=myo^#vh zaT#;0x1Y?x3IkmJ%FD&n2BR3s-N{}zll`>{{H+imAwux*PB%v+aYSzbEv^JyjyGGH z%`);i`{VJFhLg{HLfM{+n!XDL>0i&rOorT0lrVME&eXt>m#4S@?nAn-IOUc=199rZ zX^-KGB8|+HlB9vX5LFE)X_}))J|99FlvvpShi;Q+$q~%MkIb>K=?((It0aE7dlt*yJDom$@=-1$Fpv_I(~IS{Y{4 zsj|^BErRQ65>fN3Sk>l(BsFI1$ngD~w+mXKZ=F~&cM2-2Br%s^}Ix>ioAm_-8 zw*vHP&RTZ!DnrinT192IFZgz2bVsY?b@oc$IV6ufr!=AyHnVY6=~>2hcs-JA|AyQ% z`0R6##=PCtaoqBy7~Ij z-CBA2lC;D850s%4Mqr#!p2zFsgYqvi!+&xKs{0RiJ16eEG|vioETC_0G<-cfmSg?A za0qA%6vw=~tb}17W2_+b$c1edzprXK0jYYXGzQ|QRrZ;C{N^gl@lgvC*&$ZnGfWbO z#Wcgyua>)5dIh^zItXtJoi@?&T`1<1Qk7`LU`csKci}H#URyuG;PT|enfrICH8(KD zfJuiWiAS3@?t?=c!p%S%!sNjC(1yCC6tzaO0-iR1lxJ7s*Na+y_&ehLf#wF}}4d-ZKF~yANu*)TU8>06;{~{S1A> zKN4qbd??p;#;?qbtcr!4E)^OT%XYSmOb!ka!0NuDpEoxIN+glDV>W(TzoNRebu}vfYi5p0nnI3t#c9XOqSkkHmdE)UMbR z`*~RCla_Kw&n}y1^r35l3+n{v95*HhU5tGzyopaSBX#ESm-~5cGh}t3Hc76hMRsZ4 z^+9uQRcmQ7HF}L5e2;JyPxnVzWAP<*MfX`Et>(|x0y_j}SLJ0%Jv7GiDs@h`(wyg}Q~i+QhR`F88=URy9!7F}c&zWM z4)a=~DlB*R3eE3CNExKz93EnY3#WYfRs}IXGK=m$Z?Bj=ad0@*`t?+8?r3ZLdLe~t zV|1Ce;LKVE#k9IRFg|cjG4Sj{6lqRM9L7iYtPqdX{8~^WIK@7_OLmRv_5KI)!<>C~ z<>C=z$N5B(wf7*MrMP4KX~znsSA`os59dl{U&rkM3WvKc!UG74`=E8hY+d=J_36$u)x7ehFb|%1rY6En8OHwPar*9^zAa=ZU5fN4hUM&t?EXH zp<=fuBZ`pAVS)_$lAlXp$e-=dt|mQ1fVbgA>@%{Q_{btxC)mMLtd|LsqFw0qvn(VwB zo9Ewf9j}asI`HOnWmI3ts3?~ZJx6Slk~(*2U$)HEClvKfmF*rJCUxBr`7RN!S1T30 z53I{_NC&yB+J=ut+f;R@L$&n+I`xHlTp!X^k#!c0nOi%?FUZ?Tk91^aDwB7;4&ZBV zI@s$^r^XCzX9+&|ATy}|DTWV@n9npj+6sSasM9D}{Rrabb1vV1oVMmDs~!l}S-%>r2G+-Q38SY~{OjW(=MB!OM0S_XVd#S`^Y9HeKOx3wKc9F25jf zt2*7EeqmZ$T?J|VnP-^n;pVD2tlBhBa_K60=*Hb5%pc)(7a?F3R1vRqSRo&TUpm*$ zW)S(h` z+T1L7dL*zrZrgL?*^}V_<6e@-NOdvCx@)qH-Ici5R7>tYR}urIg=<{~Nrr17OM;2*mGdF}yw0(0ZZF!+jBKX86tY6~Lq z%mbik$Db%$Fopsy%IFKS;107yeK7uwoZ@^|he(3JHW8~2ahUW&L>H!K$oqp-@ zOt>Sx3AqO$0dDdhVtlk&GG1Q{-$(I-b|~@3IJ@Xn z<(-kiNJ)lLRD_NI@!h|q2;IXh_Rv!KIb#AUzVi6}e*}X27aM;K`I|oe9(A$t?b=Vx z(f4c-l9iXSA2}MLSKKq+g<06$QV!gF8aht)l)tE0UKTXV_Sokx%~APL0;y@--ple) z;JTK|RNfu%Dw%QtE3wHv|?|Fx>XvBeKBysFgJ6@O7xYHy`2T<=wr z#zx{((kDdzxiO7LtgDZnG(H@VFWqa{JxzmTZLIsX(3{^t_rmQA_YN%BmG}AB#82_D zJsoZCVBWA*tokd#!{ahd*BaXdj-=eT42lHaNKQofv~qd$ zdM%JVOI?|}IB`%==$ARwnhyTBe#+H#Z8=kpe|9tIaG9`eI1}&ELmzbFT)9j8Fx6hE zZ}9E5Bl6loJMrn=*|ya-jDNQtE7#|yeLRz?cqA}YPzVF>W_zSDv2W_KwJGWqL(_$z zpaHwrcGUnbrC0IWAbocU$^9T3tp3!ao?j!rzih{A6wVl)ukL$&8vS*mLLy-MVolUA+;182caYAC?h()=aDfWR!ECIKz0 z3k_(XkIn$Z5LjGlz+Mk&8^$MH=8kHa(Ul zE>+aK0TfcV#&n|pg~!twfa1f%!m0}lp-kl*l z=LA#eB0?=8-+Q4Un6(exv5t=f7Dy~-YSc%@H{k;lS+o2AcII)_EfeHQD*N^xH@@#s?@sbjCcC9zJ?)~=(nQ){dv7~h70=rtRGMJBJNOTWG zgE@XLHY;v)1@QKDIS?zuE%7`OB-w{q7p@s}&uDIDsOh`pA#=HeNO9dQX)`nHuWvA) zz+obYT%L{M*{M{m4$F zWTza)orp?eHWCSpJgH3x0{n#To%_3SEB^pER6>b_O-aSlo_+Z%w47-24BZb*d+SQp zS63;isjqH)G1=NQdEbXoWnlon*sEuc8w{9X3zdd``K+|G`FVN4slWj GvRaynL zUJ?&R>0V}+>7mgFd<$%j`nHk2WFlOD6Ur%=sckd>`+MfTDP0SVj9HmM?B8q#7r47% z)`ow%xQWmcRaZ3G42*gs_hzuki$EWvx9-1_HM5LO3!TcRx_2a8Wq!=*Gz6)ZH}*n* zx$PS0IY_xPT?Xa+<|bqG>04fDTBwDk7X&)@efJ(nz+s&6DZ5_0xvN#T@d?aChcB9XVaA#{h~ zPOB#5A1{8-dCNd=w1vpLgl@;<1*sV(#31mYPVvZY7;F-9q|?VA(31H`78i$$-0p7A zBzY_ruTqFbzV*b)s(9TeWuXn)KrX2JlX@z7h+&LpZ*w8_5S7+{d9BFLah=~PX#Zvd z_i?@X`RR)DcT^we_cO~lf2q& ztkrzRd^W;Sk*yIw6vV}!o0AjL68O~>CmQX+VDONeh9`1A#kfqsb7=(lSo>~2kZp&# zo~}8xytTn)zGTtFiAzYz6cjjl%&pV`!N&*7C-Om?kD}cJj#t1w>;lWMWEZl40_(P! zlL)_e!lmtiY$X5?Lga_Y?vd3MV4~>);C*U$oZyl{`WWJByV)W_nFe?bi%Ryc3gWqwC%*?ONuu zB#j}!XS&q$1lCK-N9Dcu-i-_En4O)Sdut=T%D9YXi5>u1I>0f2ee9{{lXmnv10U-y zAPj(&jl)3ZN*uFYFH|hfA>vUJXjNV3jdV{M$Y04bN3eLYSrJ*U zfTO(tR&PyA12@`79fHPj$L~#xTRe>~^C+F~lU!t!l&ip&o5A^P_sz5*6h3(MZTbKZ zVh7R$VL&Q4u?H&^G5RbIoah0eQLK*;{10}Q@gnUi`uo~!bW|i3EEh2b+RZ!sC<#=HQs)nEaY@AGO({rFC!h7){^|2N_MP|I$>sOZMXmVMxWp(~0>BJwO%CtOCux1*B=5hA*?YAQHy0d-K)eRYz-N(Kh&)SRT z=XX_0c3j@EFXu3$v;*&^E2q!6`fCq@-cQZk$k1e4CLn18XN8N7A9>{>#&-#vdu3Qi z3>uQ>)>QS#G=~1-3JCB|v0XG4!;zI%=x)|Y<_g*k3uPN~5S3A~nX`oT+a4Zb+VRwj z1rl*=`CmJ2e}oqE)g_CTM8pqiG-7hJyGWLA$%)Sh9;e+d7?fH+w{bdX3_^Evm^tyM z8ZSZfNOPE#Bz;4yi?p9|+o|4ZEkX;nnsaRlVN@+@_Nnr74U-NZJ?Tnx>1IA^KI)53 zsqba`8MOW(s-(`uwGQ9%2sS(HxhW(f4RGwdwW)x@@oc7 z2GPRgvdKmB?z~0WGfdLLhhHS&C=n}y4KLjF>8^(FcMRpkWhyTg|6H@u!gc|7C)Z&Z zw_3WQ+GU_f)?ht3lN1lIU;Mtc*0{*l zjwcICfVBFrk%#T#RaKFKx8KL5dZ@wM3jBxoCbSWrU`1y>f0Y4|c=`SA#(b(H9>}N^ zkvQWopbO>Mfn{%1wNkxOPo^=vu{DD)^Nbm&6(A;pz_BuFu0vZKDndN%1sa-|cl!66 z2(5??w}Ll!v8dadcNL(h&D=EC{%VsBoI|w8GN*L~9VxIirOney2IN>HvR@gp z;*0AyEn2&{cYVjK04|M=XZdKj!c10kpYSV+q}m@7_yMVXLLu=?OBa2?sh zE#T!~lyp)PEd?PqV;5(w;oEDF@?6>Y4$y4E0}H-a#e@(`T}!Ky;OQ0WLXh||0}%Bp zCmJPE9%q{P{J^H6p%cgeGgwE1+5+}07#LPqn3;ifEy<7E5v-Jy?aPNsP!Sqm18~g1 z{yvddP=<`KT6K~8CQ1LIiU0`-*#-&YP)nr<`h9sxzfqEPdSD&5ST7`-pIh?8FHbbj znoPw(M|{y?Dx}*6xfWj#acSp8Xh??UxIJzhS+(@F1q&ohfZf3P%MeseG^qP4+S4{I z5j!v7*vU`H>|0vQwQ3VF1{Y43bFV68#_C{8rQ@m$OTs+B*pkjbQH7;Vud;|Z@MGiJ zDAkOc=PUE3pWQaB(-0%h?oiiprkJ#wDMmDbT_h)x;g3F(=&HC6_~NV|X0$!>z`U3$ zvriJ}QF`R7vxOTJUzmEeSD~HElw5f;yk7hK;w&-|3?bDAKm^fHZY)-=GM~KJ_=(Gy zQRC~P^n!{)e7ZUrT--?3yZzWd-iG5tUAqk$U%MZyvg#$Ow<{K*|jytmIE zSxNXYCfHHWDC6_ye?wYKCBE1#CA(4V%ke}^XZ@E`;T&K^RmsMh*G-@{Ni3k{>yKYb zM=S8lWe1UL{z`niiwEmGRGxHKJ5u>%BALlHF=H0s1YDO1^pAS~df`7^_jS@5a~@xZ zpB1F%9GE|4j1`cxWUR}~Rl352!#jF=8jq5&MeiC9;Yosq+&0@|%(i!Pv%5CqH!Je0 zMXi6aOKt5ga|axJPuEv@<54;r&9y1R4Q8r+OIFcDZEpv}wH>;ozT(vTzq|@}%_6iV zv~;rlA70?{k<7r!nCkO!)uYOyY3Bi%RQLJMq_flFC8Yvd&AFEC<0g)16k+G;NrH!SpN9V40?WQ~d%+>^5KYInX@IT?g{6YE`B6 z7#)i+p7JMIS+Ih0_MQZ*BLLQpQt*$^U^0T;U5wT%{AaT!r76am(=Ra1^;%xZqXtEB zhoFi2u2TTOoo^0o3^Z~h;bbkc8=E00r@O0 zud8G#JEGK@Cl{XW2>euedKq@L%KYIu-}nitzk=Q9t3Py%n-QZN@TrZ{Y7QO` zI4IMUd;&Mgk9KsHgE))`WXmVC{^%6A1}e=fzi(1co%d!hhGm&^2m;XaS=0a!6f6n_ zU^uP)UvVPFFZl+H2m2ULx@hLmae)tt&C@=xQ$cHb%#BPw;r3}=X4q=Lp_MT ziKd0of?;pX=FU-Ak=RG&OYYnahWWW3@!>Z)sf^QOCvoI0ss@9Zg*$S^J@I?hFS zf&sBN*H_i_pg88PS0Q=npYBI3hGX)k;s63!wqd4BRG~EE4R-?;dObYgY$Gx$pQqj$ z`7_J^M=MwRY+HgYU3(z)oXPwoXLShjx`Me`Ttce6O5Ve|Cya_Zh@+x-kg?sw^fF9P zZ;&OAhPDb|9r7r*Ga5{uJSp^@x9}L&G7S9Inp?Hj_*F}n!IQr1~g`eS}nnzoo(0q0ShOfW~vWhrZVEIx;fBPQcT8 z#{8?P{weeyRzACJM^EN#^tE{Ot0~q?J>R2Ll0vB238|SN{K1+TfZQ*?Us&VBL@-fE>x(~MubIkCxl|5J z!@AF3O~2rA++kNylY6a{M}^*Vly-L=gld)NoHHerQXU!_Yx41$*!sczFoS5~-)8_u z7%_*F*7dCN>|hkf(dpNBI$q1PeZ#($OZ%tR49LM?@B^%;p~tZNzfgI^4cJGR!CZbK zkolMJ8i8Z_`^&>B7y{(A;^O{m+K^b~6KNxHwO8KZOqqO(dK(o%k4VIq8bFy3AHJWT z`>((D!>((+w7QsNx|0hyPg^_Lkz6%k11{0}*2Ztw;uMY%?e{g)7d#TLWL=2`o&8mF zxc-E~;dydxG_RIZh9AT|{*>97ruFJezzETmyg>0qEPbSRg{ngWY-Qx?DfYR#m%M6Y zUBZ7Q+D6)T$z=l1AulQbhFMfA@lg|vKp^v=NnV#Z&BFFbue%)pg1PJS?(>mhG>CR{%>`x{9G~9v$Px#l4N9PGr3M zwU`;fPtwR~$TBJ8zCiA4@U%K)0qU1Sc#bN&)2_>q!hUCPaKS9|0k#yiJma<%7Z=k# zj4dD5b4lpug^okaZg6?|Ocv8$F?o<3SMg&R-hngPi~&(Q3j3xMEEHWsziE-Y{h;@+ z>y7@H`Sl^Ed@Mf?W1Hy6kWM}&(m3gulqg3_xF%9gu|7ebq&|VT5O!&_Fyt+`o5Jim zNbqNAeeb7#6J!e!j|@V1h}Pa9a^9+FFTCW>rmU8lXtc7r!WoPii5*Uc4p@7-a=Pj~ zEDqciOL%-l=lQk8^`T8c$@eaqgX1(OdGRE++u@b$7vZ^s)3MnmtVdKkdFM^*h#<=@ftaAJ3-^?H}{AMhDI8F-4EQ z{FU@h4ms4X^j(C>Eqn0YHuKXO6pP?qa=f2Vfn7UJ3UXdW+05)p>hDdH1xKtdNh%MK z8;-t!yV7t$IvAgjpD-GVg;2y~d|E9TrtzI=^5IRZmJu`AG5_feR)n3ryU;DPoQZy) zvxmEc`4;r!tJmdFUv<5RXFar&310AIRx?cXz1d%}imwte?ds(pM`gx(XoIXblk5+l zMl=>F7IM2%TQ@@D2T(W#zeoofF{ANPMFVJ=t4QtZHj$Ifv7tFrH?r2G9M!=@l` z2o_LwbnS`Us~k(a9%ctLPtzf@DkLFLfaU$q@#R zFpI^LYVv?CW~>?7x(~z#X!+#d^Myar^^L=Nx{`STqtBIHspNkEQWBZ$M`wQq{koH! zM1#zUlxaEkawoYZeNhL_^6*EEZ}J^M>hFXPP>!w9iA9_lLI!>Z_6ejDvtWcGwVfrS ztDA+o7IYiT7Q|IG?J%I*lTf$$@Ra5x=ayU;&vFWje#M>lR#S%;3^n*Ab|j+a0H2Ef zYg8uw8^oS`Mc9jgS%da{)u|8+a#`$v-o^QA!KTAy&2~nw>go97VYB@Rt7dQGfoj$M z+YLpF-e0Gho(4@z{I@mS^qjlw_M2%H9>x>mwXQdZr0WjuJJ)!y%@jvdaI_@IqB76J zjDC;y3i5f*cGSD+jn18oHTo!yx%!`9g|4DacH!2E|EpPJpUimyp?`67kw-;qiri&Z zfbE4YtwdFzP!S7r6YF!j^}Z|_Gd2@d*3r&?CJ8hNNO`g;Ii+RgPl>J{g$p-Z6V?69 zrPTc}!+D}OXrzw=k-xj@AzdZFoA<198xytgaaq_jyvg6rd${T0D|<}k*Mkg%1uZ_WW#w&tyf>AV(;vE>U#@;;mz4=6N*2&t&knDHKq>&ZE zitaW&{%$NX1CoZiAgyDpZ@x=o-u>=yp6a{n$LxD}wjUL9Jh-_KCU`M7wA%#R_%R0K zUf$$Ir!n7{RUMhXyP;hW_ykU@;*IUno3wc+g@t96#FDwWOz960p5HtPqg4kVrS2*+ z30J&QVWCTYVO-)=ETD+maMIIzto1)!(8a~YNtZ;L!wD^Q;TA24c*n6j>bNloQ!6MU z&<<5_Q-WPfTAb`2cuI%YJ|?`Bjd7@Ncs1P9F z3UoL(Ku*aBn}0{M|V@TT%rSKvh^pN@I)U7d4xPMptBLx7F)5 zMDMzB<~P-T`my02m2;r1Q-UjSzIfO{YFKTJ*Jx1HxZDw$_`dr+XDKvV4j3|3LAxy( zegR5gkf^-3Y=rtuc9w;q$?`ltiZ}6!TOP({UyhM>5Ih-=(3iZXM!s#F;e6xmIm6Mx z$y>0&%+P(C|ACS@o3c^RvoD2mLpfDql7J@S4#eZkv~wnqjNSKW@DGdB}Hva=ejLW!v}Oip>(o4+oEJ z`^g5+%>^!^WqaMUbpGe^(XnUhkhIMn+iiu>2qW{|BKwUM;Mac_TzBKU%g65FB-xmj z+gu=b8Kfb6S@(6_*P%fh@g04}3Kn=bxKBN$N+=(0pJ$C(GlNCVgx0 za^>N+w#xNMocW< zyg2?Q(-ls<=-0N@p|QWz^@RLw@ZMA2xF*U~nUu^mzTJ@9K3QBsb#--L2bVp9q&RR2naWWY#`WkKQZIp4J;n^zM4~L3h*Dw&sFt zx71^ZKB>7zYm9aQIvL3NqgCXd(W%K6z7l4cg3g$`;rHo!hVinYY0u%dNXKPy%T`vd z^v6%tCk+{MpkV^pYbQhhsu3gK3ug}>08=|yj;kpRZ}Im!gHo`Tr|fe~(Y;)Awshm~ z9mhfe7gH2j&so>cw+QG8B?&{R0>$&SxXJQf`0@MCZP&JZ(*@}s)0Q<^>DbF3q0!iM zA4UNd9&RuJ9aT~FVbMAR`u z@3C4c{~D$bZ4V^Er?y;%E8a+4pR6o#(@IFV-?^UK?dWQ>NBDNdaHl`G;Mgn0KPdE>hGr0>N}tT}5deXAwgK5s~i(}eXL@pfOK`n{|Z%(A5}i68m1^#{Km3Noi= z52eW*Z_Vj&{|?$#^JTcZ7GoWMbzs=*O)1}0b2x&|K&#$%Or zZsZVdU}N;DW4Ab*TmI&F`&hzS#wT`RG#2uYR$1M=nde?}mRBbdn@4Y&=Qsu$9hWC# z-d)bsKX&OsOJ!95^y2wt)O$N6@=M=AADt&ls=VeHzzDuc(s87jKDJjBAQmUW99oi?Ic~>A=k%a!m<;4fyV}}+ zO|5tM9esN5h=@dw#YdngFA?3r@p$9*m8nWw23>7er~N(x_h-h zd){-~XtLwfUA;lo><8te(aYq`i*^U+gAu~5OPh{Jv$+k7yjlxOB9HC!?W1xnUF%w( zh1|p03~`rMF61NR#Jpqy@6F(y`GnG}Y1e8AoHhd4&jhfX$2yGv~8Y;X3O=?JU zLylVH^aF#6$zijQ0Ft)4x%sakQlszn&ekH2U(}rUO;i!R)gkmqPahxhDfl>ZJR41_ zo8&$p{GRD(V=RZ-$y^`gt)bUMYWOE;0o^|Rs5;lSj3I~ruw;9tLCCwWaC?DHH#-$N zINvk26s0AXJqCx5s#ENN_+bLsV@RCM@P>BInZ3KKZ#|TTZ|1PixJ#4Xl z*km2`s?_11lD?O=Ro1C)iH^{zuR)_Q9}dW`z%MvT3f&$&=G3skN3ABVzizl>6z(`} z2!{-c$DdvbO6NPDSl74##R>67`V_j@T7#axF~c}T?s+evhQE^7<+a7zhUnNND5U~% zhf3EZ>uou^0zG_=B{+f#>93$q&e=#`vO+k@6KeX`obzm1e%*UzH`k2l#THvhcjWx^ z^V)8Hbisj}7+htpB`2hOK;M^vg~by1(r$Yn;BR_~lHHGHTI@6LXe-A1V?g-aEd7P3 zNB+pj2%^y%(pnGhv)q(3=mzLg`Ngx!t_6LAF(x^J*LBh5Mel>GDXiMtaqr!?#p7}s z%hj%ajk(aol(>&5gkjN`pp23ge8gV&OAXyfYelB1g`$z=so* zVf^{M@#i*gt$e%;)cSC9w{g6NZ4_~Sorf%nLMQJSExCW7OYvw65%6x*QI3Fc!0@k-I= z@pBxNhF3Ef0ZpFb1zY)y7P{PuQ9RBrHQfuZZeO{Z)anMWe6`7?>2~30DP$725UNlS z8B+ThF~lONExy4-CGSVg|H{zEUoh1fa^hFMbfDH_k?;Y51mqBi^?=ZH~#ku zxO z-k`=IABwrBYhSeZcw44++>u@-^o0y7NZmlAbigOH2Tk(6FCH&pAX%&eWZ(c)k|PuA zAfL(a_ZUUNSBiBf`7))^-K2egZX36y!sD&A=VsTf6{?3^4mh$0rh1=V(uzkI%i2OA z)m@;Q1C}{CRF@*9xkJ!__Bc~>xaNJBlwXqV7NDzuFFl4D&c+VXXLIgtz>R2vHb5+p zQ*Kv1%1q(<(FHm$t2)9s3@S~7tRq_FbMw*;e_zw#c-@7FqBl$M+#c=8Ha?7KH)aWhWB%ts%?*0F|! z@3ZpOFZAprhU)qg&RqBWUrBtI$sSU;?d=4e(1~(C_xAP>=}xV16~!ty*-=?s3<{M1 zBC(1S+J60Lj;}(unoK}VwCklUg z*AN^G6xG}BS*A!tqS!@*-)k&*)!=-@=D;)I5v~x+UPO#a zlDfB(dhz*z1~t}!Q@bV#Q^PpD+#8~Yzp3AsxU+}}azwFq3TRALF{kQ`Whs5w!ANWI z*88b+c)mr#u3!?xocIg>?xP!L0X;JA0W(`|n9QxQRuw90Rr>CiZCS%Mm1AUDk7LTg)vP1(dk>Aj2YIAp*)-E$xHsVdmmRU9=)ob zyZ`Zpn=$S;hvo;XZ=O=JQJc0~_)Mi8V21S>Rowbg8x~dM-WYXWOw>^DEWtyV>#cL* z{ChT8>1{ONAu*V(l}}ta`cAz0;?~P_DhuYLB{Veg!}fVzPBr_-!L9=xnZ?Z>`x=Ov z0IdxvsqUvS;!LH&yJ_6Sk6RciKLob%@eJ&rLyl*4lq0%6tQrj0KxTmCY5r;{9;sZ)GRLp>ghzLmH z7lb_*$=QE}F(3c>b!XUewNU!K`jJe~A53hLs}{B5!pbMwTwduOk^m3KV_P|K^YPstlx!IR-(9V z*oT;B8vKncrbILO)uEJE^-c8=T#yh42Zy+L#y7>oT!k2kwY=9wAhfBO#==k_gQ#C4 zaU8xjuwzLYXtgTx`)-?#(%rltLK#hRLbGnUhDvA3R19BTUF%fXj#aG)GmKX)wtu@EWN4WS0N1i_r>0kVaNEJ@@GFmQE4cFMax1&CKx;W27-HpaEQHJ zh+-4DQsbyW-sxvfSjIMmLENgI6#5c4;knTS;`F9erOt$?am2r8@Ti}m(?^I{5_~iC zzoxH0_*O;w-b`*)<~69fDHme?I-gy&TK1XOx=en8KjZM)lU?pXb~pYg;ODwJ`fBIDACDFVx&Qv7F8pZQ$-%>AZ zJmUE`WPfR+M7pe((To^HnNy$5=h<*b?7Yqw$~o8vZ%>e+B2N-b5oJ7JN$io(!8R0l zWfN-4=UK5uPyJEg;O7OAo@jvT{XsE8DV40l@Xh7Y-27BA*LJ4dH>(Em<*3rBCPU57 zlqd#rJ)ELQo~c_GPx7Naq8jMVlxaM}EPYsPFl;&TL1&i)lTq%YM2eWnRi(7FhY;RT zZ^&+S+1maex9wmZqqj-Uc0XN}7r4l*uU~1Cp!}q{RKIb4?WPd~Ls`x9w-1ONw;QHg zzJHTci~cYyf2$X_mm~7!_Ro)p%oCCwFS3ugas=;=ybPi`=*(!29<6NJZDk0nfr_k*v1-pegNFP84G4 zN2*d393gas;blc8wKFbhRHX8Ecc70s&n28AhlPbMhq)RuSK0c^Vg(pc1*8ur?!1|H znRraJHr)JXabdqRlkKe_rX@dEd7N(R}6ayYY-}{J8 zlozD$*8LE=Ws9#WPbkdxKy;0v#J;IvQQshaHNSBA9DKuSyj|0<^PoP6IT39p(UJx% zw>UsWDmyllwOIYzS?Dag6PcC?Lgn6kAZLP;7Ypyu&=Gt{tx|v)e|k+I*iub5z>B=U zPJo_9X7>K!W0k6$+w6yUaxXTdPTnuGvljU3{p|A%d^pK>6_mMr4O_Gdh1Ny;!%z}a zq6V`{UZv3$yJ~Bqj2X%0hoBK6gV5ucCzY%*GVPUY5o+$H{;oz(v`&fo+BMO<;%pLP zX42zH6s#BBZ{T~3R4qlByN|M9F1ugDENUW3*}w5UwMaHj;1RLhb|VhOqo$&T&D{K* zcQ<$6J#G2ZSNZBZNtcbfTHTG%rGH<#xW~Zs z8_n;xjMO&5m!3C^oGV|$N;|1z780rjiWE3KzV`N-;zye?GBSp(3#;p|Bt_+sy#hU& zlMA1cJPqV>C=#yb%rwHgHy}{X<-hBi;MXB)&#Ur@svkF8%CAISUoeRAj$66nq5C+) zTLYV9_m~6h6pvU5RMpX^yAtG$gs5*L+0Ib7#DbnxvAQ&m1 zTzq32jy`1-6*f*zJMi!bTFe?u$bb=ru=d4$B_;e@4~sJ~waK5jZa)=b0`)?u9bH)& z{m?C-E{-JGMDK{xDEl@n)ztmZAC?VX0x{&)Dr}1Fxz@s!QJvW20B5(@{i%p2;$lm` zv&F<11H4g@aE4F~`OH{SQLS;sn`~mJifSb$ot*lA41g-f`q@VcH%*X%^Aok1ZwumB zY-lWE^wrc-9mNik<}a$`8=W+xFOGL+Td`mlA3e}k8dXohq>fSOXLi5=krK%ZhHHB6 z^*1`NHpK8wou2lf9o?pEKNZ+%4Ah>CX$aL~w{W(psR~FgLkP1h4-6YVD(I>g99Rmv zn^`7k5v*BvSnfDV~-4hgR~7zgg4Iqb$Jg|^ev&=Z%89D;(m)9g)C$8Ro z!d^}EzTY>Z8XPD8d^dAn9dUV>q5I1a4Jj*H_-y0DTd;J{Si$^tlzCwzUJ`f>sxUvb z2B44L>~f~Fo)x(xko`O+7=?hqf9A24*tKwtvOn?BDYKWiM%n4J9!b45-)RWj@j_M+ z5q@)q-%E%yZ|ascCf(LVnT5Rla`2+2Wt!7iXZ@qQ3uiGhJ=)aJ{@=-8CiHioBjc^M0b;P*byXpQm{j zf9HW#{sV#bwcwo_q`R!dw-f?<9i$Y6w2|U(f@p>+D$ z#2iZgV2STb0j@89uDv>mzbVLrp4KCf>me*;JgOaII%Kt!!40|_v{t(-TxKk7*}g|f zj9V7Xz9;)FWiv@^A$@|IC9mx$hBR-E;jFum+;@MmQaBymJI`BGayoxoZF8DO6}XO& z#u$xlro3m`-{0;TP{_n8Y0F*9rfXSH`KGBEuND6`mDhZU#pnG)mTub|je`eQeLgrY zRjtmAa!Pogs?g4TS_=kO9{tsUV{4KCRz(DzvI1e^f!#|k61e@+{)4=Sc3VR=?!i=? z(=*#Pbx*fGdh>8~=)KM~sy}Ni{Fanvt+-pVZ?_SN5V9T9f9_)YVfX4%crB53<+8+j z)aktSl`^LL=!fVRE}bHV&sE7z`$`uToRl8$7zFR}v9mohVCo|pk}dh7M)DMw=k>di z4E$%?XzxvvnQ*dQfhHq>*moPvWc@N{J@d+ay^>Dkv7qYcrIXtFw6C|*Zms-)bW2Y4K ziry|d=;yls6kNi=;+M0+VjeCuprs3Cy6Y;03sdl6Jj24W1RmS z_sa=D$8j**sA+E98R~gEr&g;-{^2zq@HfiWu7EqP4&(1Q3;cH z?X=q>ZmdA$Ud!>Olzy7}nF9)!PxE&8bDwA!((d=n@8w4i)RgynOkhO6;II7BC1$_F z^Yz26da6+d*@v#^7A0}xtbfK_&%3Tn0`+xt0|K+bI+Hle8>@4s$KsW;+h}oi6<6;xgFkP5$)f(+H!-#o z#XTuP>2(Wn8I2V-gH2ej-N+$bAs<_uhjtxk3btLS&Zf~D`kJ<7^gU{{SZjf3dCPBVyX~JLI{XMG3 zM{WCF*%T9BG0Wg8PU1R`!;&`}nsLpbHbaogoo=T-Db9`16}0%y>3e!-;*bc;&(USZ zoj(7Q#*;tIAtW!jFm>0qQ7<<8_WtmW#vA0V4QP%3DmECc&TI2?FJpGgQ|w{GrsCv3 z{&gCoFC`+Af4_bwuz}Nt?VmXz$J|@fFQ9a*9vsY8w5V@2z3OplFL`71qS#3W`GFAG zd30K8IB2{{1{|HlXJAd-{$ujM(}eB#Re(5rb|N0KsehLH74$Gbuq zyw!&9KYjuUBw$uIiUV2loaYa}bIHHyrR!)*VhMMtr|s$53J60e$6d$iEA6@v%E#XJ za$Oycaj_H8V-HzJiz!f}p4!4)>2UTy=-^7C=<3${Uo0w;YvUOgFpG}hlqSEd&o(wT za7E=j1x+v<`Ef^_rIJwtufvtmOiKF^^372*op+*~?XGijcgn8T-~Xdc{e)em#*?V~ zg>U{EIL+A*75en>mvOwjDRHE@U?sI&U!nZB<6T644r!zrSA2m;1 z6z?@?eVNQiP50K6k4K-NMhM#$5$BKK6j}GG3}%{&;!+^py8P zdpv#(?Sb$N%}Oyo-+Ai;tn-}5+U&1y%72oSj^^b#XA%!NXMB_M1*3vurqFmo@Tutv zwgdTbD`}>`!U(uS{`5 zA1EUa&*GHJf;cq>F{Mkn6a$5x*_teh=XLD66Hn0eNNAF869kN3M`$treTBr6rQ9J> zMiWqZcM&0%m}XJoh~tvaH%#MzBR`ZEQglBH8czDE92^}5qVmn5*g;nO-%n!1Wsoul z7U*RJt@D@5p9#J!SHsDXlvVSW758i#F9ykSvgokVRiG6I-4kjFFEM zJTRi4EGHR5FXi%oV#w;sN=DgB&%#r;7uAQ=;1*EC)5C&c%g6)MAG8Vg_xD4N_yj@y z2NmQ{*C6V9d0wEJ)*HqOh3d~i$O48*Z2$M-4ij1Tu=4M6h0>}PkXtoBmC<{a<1d>j zZsM3JPHRPwY=K9@Wz-197a_Ei!naZmWx9aaA>3$SjyR9LyCv*#P?TPzd9*#(Vlhnj zkHRP%6Ilrd&x!`_YJJb3cpQcnXI;T2SBT~zOo$VgL6L6AP+|c<`hl2f2Zjfz4r%G= zOgP7MjW)VF{*@v{TwE45W5zAzd`hcJFHC|I3mTXF{f!$MMc-rtv;e*rzjNmfWw1$V zK}kur`YHgP(5edhM6Z&+d<4p{lEUY#x5Yi2_Li=mZ{J6snREM|-yF9@2De?`I@;Nk>b|3q3jL%V^bFLx@KVIwc^4$vis|2n zul}gx3)JjrjJl>DdxwdMj&5Aq5n8vpUm>t01H&jv&jh+aJZTJC_@PXuveix)+>otJ zh4XpCIySVc01e;ch1F1}yYXr4V%yt}!Pm1*p7d0(Kr}Tqb#)Wl=U+C=kVJG^)zFOq z-3{<3yOSNkwZLM58q!+}0cbekF)`Z{?~U)@zyIvnv&WBrfFcjA0w$bRD~T{m;%!*a7Ok3Ii~sz(csW(&G$y)3Gu<1?!U-o(*C_n3>F^tI^Viv z7op@l#(+=6=QdWcg?Dz6=0*t#kQXdoPDXsOy%unr=>q!Y038;y`Cb9NzhBHh)XmtH zj#H432!eLfYMF71QG%3%!yeH6ssq#6^hd2^ck2=HI{&>T$Tj`A2KxeAi)Shc21Ta=&do|PZ!4Tfll}@9UWOWFjo3g z2+7Io>}EtKm8AYoG5koN;_livSjs=$LVG`#IYd{NMj__HZ?StWB=BitD`!st!*svh z56W`JVLQV0H$rkUJw1JA=jCJ@Qk}&sxEHkS#&ue8@murRG9lI28KI#V^oh6@%%Y<8 zzy=^MN|OZ-g82~WQ^_qe3Nt-0->EdhZAUU9^NX>6C^a>RV^M`e8a&mHNDg`O&oo!?Fte=nz zz+uejeZxjs>4&s?7sxWCOnGhw&TiI=sptQ-BV~9Xzhp97HRX(7Qmp*D|`L?wT$JK-Oi3cXs(nB ziK$kAhljKXMR@xJjc~?S=w8GohxL?S4jD>k|6as{zu|x3p7dj@ccuZF?*{^_nnx251 zd=kW7WRIXz6WWDB+IOLuvKF{Z>FH%2Vw3S(#5NA_(9%jV(D3k7Lh&1zs@Gj?&`6dB zT>oEF1xlftRFUbiWrBKR+g>yJo)(O=@j< zZ_+!8`}0BkFSj@vE;BMwCkqD$-pF%uK6Ca*AF<6_&fPlJMhkJ8{QSTm78Vq=wF!-g z;!yC1h7JEh{4rJ8iAuo^D`3lR68b)+TbtQWDlK6S7B#|+LryYC>9i6%R?6+GgVY`Q+%a@&2~ zSE=iP(#T*m+Rqha%=y$%(JSwA-w$l-6l-+SZxi{LjZxs#aD+>TK46=?8~^UfSS<3_ zg;I5tkH7xJo0*9{HVGeb5=y|L67?4)iOAQ?SGKgYjP2^`ilGv508J$g4UHV7|L*be z(CXZ0%DJ|;_CkSy7Tb0^FNM0fv|_y~_1OLW{RPu-@Jq)%_Lh21PENp}eEIT4(E3|s zGunR(nUvISUmmq~-V4dym1}559Z9!TfSVgHyVKNOm6^&s%V~Qrpi}Xe=f*{{CPf5G*j z`rm|?t$wr5d`^F$z`7^FK`USVCOWuH#u(+_FNuvvVA>7{p>O*>^Mq+aO6vYgt^YoUw}8H1N{6~-$4o?Wi~fH{+T*+>J1y?ZfwP$C zj(2tgC{i-1c+!gQj3Od+;AKQn3Ps1n2+97P$vm|j=cpw`Y0Ho8jBMq)E z{@E_E3tgj8KjVHiP=ew2A|xS6Oh`ybPPWKX_1f(umEX8#I$32V&z`iivje%R?eCTJ ztgO9w_=uT`U7&scKvhwnDP)SwHK&+&sWSSCj?Vq{sl=9(3w>Dy# z`zeV*yBvuyf{_ssd@Wy*AnzoEk(-;#xF!YOl#NZ9#|If`R1-7W^2>XcZQ$;Md>W5> z!$C)X3Cf%dtM+8VyRmK|_vQ#XhK!dos`8eGYQoJUl$H?Ms3W>1<{j^~WGV z7`X%rsaa@ueV2RRIR5I_ud&i`a^ko0T#OQuoug!V)eVw+8n{3QjA?MJkNK^+DEnck zVzDV2;IMeig(+vtAUT*O*`|r0slfL>dwrH-(i-t6yuEaUw-P zNEjDksU09E-X4NG(f4=J;Q2DUq6i5iHpem?dY9B0hykJbb=h)$OCL-Z+Qj*f$^u57-QNI^a{~L^WdN|EFk~ZK)LgG zPf}ZOS#*0Vp|}dch1C^;54ksf0gf9U({eLI6+|@#E=Iu55H{qwCVPmx(3&amaUM4DJ!VucFxHZ%>H3% z{%0)H^;Jb#^J3VF7{eamp(()Bt{tvv{@pNjtGl~&ifqO=VX2ZLp`e50*6rK4o_ftq zpaIvwo7q$h+AjEg`3}py1R@ak$)4k_MJT^vC7*2GS&f{cf4MqD8%88jV?7~gTBn#B zzNoLXw)=R?}hWEjyaPSSq8ThQR&LllcRHd>72g~e@R;nEx15?YKE#mRc*csSpL!03DE zGF{ZEduyH$_=bAm#6wsFRsF1d?Avw!*m&yD7O73Ap&vN%35azdPi>Vf>dcCL250#9 z9=hW!wG2^=?8V)H=+cMp!=RS9_J{U{ zd%)BAxC;zuuuow?#nz{;+S&fObA!nd{31;gE31-YT&sUhCEQO9U}`z>0Dp>57sUSo z!kzW~=)XhwfE$;UI%H{S3Cu5881H67O=La^O<&iiV3T<3G`x;BCaKd%iAoTfX3OIQ zPrxbLD^c9OBSDi?NUTn~p!x1tEee(iIgfGo4p4B1P&`vW@nCCV_W$M8JVJM`!<&8= z=qJP6?iKuVWboggCSUzKmN z)7{W>G6AcEgw65NhhQMla3}&7AiN+s_J1(zwXX_>@?G~dV+c0+D+-zfmjUf}2E=tk zYd`8fobssbtKm$p`Mt960P-@r1IddaG%LwtbxIGQBG5hX0zIUlE6XsTQUPINLUE}_ zNN*&Cp~9wZ0*rMao&%&MKL;us{J}~_{6f>x`SXe~E(}xH~&K5Q`-^n3Ve~M1m-{#@Se|W!KJJf?eu+M1U6}F(&3A zVA6JdS2)YkUAXNIa}a*<1b-Im0eSAx)vFu0TTRDCPDpREI0QzZ%#dvI?`CE2W$$4r z6Sa7Jj#!h05G=mHOP)_gYkaa)q0O=`lpX}FvA9;en7ztWZ-=<4lfQ+=D&53<` z@S#+zlu)hJ`0ro3-3#qRL2d7zGW_Q=;4P5W!#VhO6o|k&z*PC-{PRtSualD@pPAW_ zi9d{c@oIVi>)n}}#hYT{oe+$8JfFj)0d-dW6K>T1eOhs>lx~JIse!$bbuWZreTcXf zUGrk|V-e{upLYRGUE^x>hUcO0TTSPw|MQt>N$;-glyqwz2{c|hsvpbIUV7soVGgSV zWZUFL+>VI;KNl&~xOb?XX#Wz!%U&icj`_MeXAe4C$0AZB|9`_f3@?7QW-K+tHtU>; zjkirXc#Uf;<5raKv~jlx#?`)S2G8S)REwj&g06zuX06OmlY zNrKl;eoSR0kM+dA?V9&}6mjg1Sv$SyBx=Y>dNcCmRwVX6p9GKNvBnQ-bUw2MlW@aA zcGPBS2hBTu)pxxPNKiF?C=#IvlSxTQ>6VT!JBVbc)l>G8T7N4G15b+J-$&%IYa;km zWh9S-a4R?}1oM0L(3;FdbAn&tqep@`mF_LQ^ZOZ{XJSF0C|_zrocD%}8GjA3FXGv}304#|HAf&6mXD^=cac~4cWxMi9XJz`lUgn0Yt#Ay8%*{q z`KSYT)K$7pGj9epu^?wiIBlui_|&ZX`S{`;HFZcvXGH_D{QIFYeZD||P11Ru22ajN z27lB~uM+SF;VyW1dy(+*@rAuG;1|o#f5%!fZQHPCmM9FUGa}}Kd*bLCbXwfM z`cUT6-PJ&Q%!vMjyRYVD+FAIH-(0X>yG+E)Mo0<;At4_iJW!l^0Okn@XF+~(r1EK3 z&t@F9Udk03#(q>ar6xPp-#?ynOP##(%@;9Th+0i$!9_nBhKlrpIDEkIq#ygG&D zzYnJlW5kaL9SNiONrQ_x`(~dvv9zIb=)b8d<`L_;~FNj)W5vm=?|{Op{4evFXm{3qE3c>}s#!Ou?lVJAsms5O3&DdE5RBUi~y< zmlQ2bLnF01AIVH`AFWZ>J>~mM#l6l@Ke_40Lj9uqKRSqYqHf+JwKTklJ%lN%^>J}M z9b%NGWt(`E)!5&h1tGvudf+?I~Q#+ z8?vqr=D#(OD)h|22hAAzkuj$WsXWz`yKE;(Gt6mXip)CP-P6 z!b61`X$J5?ae_dm7tuiXUb4NATSDRz$o@%XK*Df8j@rG2R4 zLd5606%`dlMMXfaz;@SIQB5uLt}Ey7qzimFxI9671JPbu2WuW=&@(zv*OGrfGccF} z606XvqT4cT{d}Z=4IwmXJPb?#6ol$DUe^Xm5_Ua=!=~Yeh$(QBLh!4 zfbRTGK;fixF+!!>`Q=M^fuHD|`^hx9uQecIXz$)nWvo5~9*biAHj@jeSToBMXTtl* zd>`~%JtBSpugZd?A_;AN=;&JY^d^Qs?LT-dsSs@b1#2YJaWpiv-a(r0Hi9)yvgMeA zH{KPw@e&9!`B61A8BTvh@IeW0n3=i;2=(Z1&9gmzs!JK2xNeQQF*-}Kwzp=@tostX z>ca;pldS`ATrYFQo{awq8AR#4Vq#Q+e*nlbxzYY4crvmKd^UXP%4vM$*wvtFO(-yh z;0G&Q@+OuDCug}z66dcjPW2lM+?Q!WFK*tlD9Fo$d_%F8TsA}qvGlK)s;8cs_H(HR zM&aCud>#nfNlv^Z>o&sOcnNp_hRNsS?YZ0XCqNio`kVy&3*zKE(ArkRHg7)@V&UdI zpn4PGSO~{I;%I-U2v2s1s!CRC7dk&oBF#x-uJHv+lcgK=R4<*($g*-8cdN80pxQlrSArU0sq5{W4;+x>c73laX*8 zwlfL_F6y2SS0BUJvurfg@E>X zbz@bjXt~^vlu}~X>Io&=9HqEeYSz*yeJWR$s)3CT*4oX&#s00}{e4R!p84!VOIN)+ z&b(eYdjUjgXlEy#;R`5V82YDx5$QPq;uU&5B9fjYq$TjvdWwzeg8oa&9N#qMej8)~drWtpF{IR;k*yBxVD(jmw ze`+f)w0fAf~u->t?K{P`9 zxXGg?F?%1RMCgfb;i^-bV}DrMv_=BusxD^kL3x8hSiE>!vrUxtvJiwr@i`;b(1fIN z60oNw^$`;gyc&E0R8?!%|M>2hg=!#a2B9OHP6-hOg;kBgt(ze;b|E?u?6$Al-Cqa~ z_0bPqvKyU|_I9)r>B#Jzi2e?N!}z1b%v2SZ-1Hcd{5yxf0OHr8`VyP#f7p_#J0mc^ z?*nO;-z0V)3CS7cv-ZJ6^l4qJp!K%-h2YyUadO_&uLzXuqD+u}(8w_j0&+BB9tX^A zkYGbLfiCzOY{CU^<{@h&E6@h$a6(k92WqUK)DWUWU7_|I?0vAXopcq3ur5hYOf+BQda>6eyU_!ASoPJp-3H;r zc&1r>#rV*b?W04lNu^z^nGY~0)Xgt~gA0JQ`(-bE{}a7mv!9=E^Y`8W#03EWMn@+O zPypFsCa;+?q?!QkSvtFdNRY1acS$L~t?_3kAyZU;-AGGbS~YY(j1qz~Uoh~idJtJM z_62|nJbl^Yx+(^5)3MAXNOjO5&}N7o;iRNSlX%vRSH0e)B&%o-klo9xBK7QRLIVF7 zm=_5Rt;P4`@rj7?e&EE)Xc9#SUkgvV;o8oT^wu4D>B^82kJ|KnD&NLdohBtcziaPi z31qJ@gb74MM1-*+bAi}iAg&!}uZ9R-66=JP?H*l1mIOcbSW8w;4mkDAGA`>CzMq4t za7=VGXS_XRS$mS12rbkcrfaN8Nl2ImwY-1^DYUfA@h4bJ0SfMHYK^s_>~;`KdI;Z{ z+oA}e?B%cLY#1y`OCM>4u>S>&7yP$0hY};WZSX56ZA@n|bF$bnDgPKOXj-Pc6iRk? zdGj&CrlJ-5&j(VS zp}lC*gWK!mW!%~IrakJUE*Z={_TWF`*t6YfOpx~gSKw?{K+$&g14B1E@s|uDe0(0a zouA*o>m3@PODj_^zfR1PUi!y9PQHby$7t~G+vm@cJTDHNF-|F3ofk-glqbycbR^Ge9sS~5%wqKC_Kv8Dx4s1VXh|F7sKSB@u5*7Ir&M;|NpYkdT z%i$bUgpBT7?*2nVXB}`U7`EmkcO++j34>Cp(lu=X?^7rG?9pr)^hl^6{<>I+8uJXC zkSBj24@sQ;M>U;V(Kea!Ev{5Idp5y-DBi;@+KvJJ|3bAd8kwkvX2jfGhy8T&I#y@L zj!%bz$4za@xjPtD29&p4efKX)KKL3wucQ0npn#&X**mqZbr9-kCKAcsiB&trwR@qG zy7CpY9l2?tdlAm}OCZMVin)CSM5BP=m;-J?%%&UI1{UH2xXK8&aJ4g0=idm*5-_D# zo3(S%)Zz#RPVl?|yT{&@@IIv>6^)`0n1W~nPNHTY1_E0IG~x&?ZXa-gQBY7`)Gd>| z)4AA;q!hIAqbU1PU0n@q_}B8Y&cQ?GGH!nSM*3L&4=gPL3JO+KNPL=)A(A^RV1T9o zd;9|$gOE$<1#%z;Q6vOHoY6ji0&NJtA@d8+3y8lGbCjrIN(7m!%&08jW5IJyLSm+}EiU4;@QZ}b81?3_+OzcMO3{1i$ceuH!# zbcJg)fLJ<$h7{2;8imD2LQ0Cz9XpV6;#Nu4)F#HqpWhuNP)TGLdHM4*5SX$kr7-GH z-W-J^>g9Ew`(wJf@;GC;@_~=55mPY>BQc+K5I%U~#A*#l3+TNZv;+jiE}%TT6G+Ue zU16|qqsjKJ&rK=ki(Ysw2O>U+t->V<*JDTi;EQa|#IBweU6g@aq+Un*gblfHR3A53 zUpBCBvnq-cWh+>P^?LsqA2;K)!uo<81`amahpCGLAqnbKL?qt)E(v|1(O(>wl8osX zB9xYkqiLX=Y5he7{A|GTj>bocNxg;k5}LMv?4>yOV7K;DdvMb8)ua zBFDkTW(@>}K-=xNNAVd$fsuPGZu*n`)8fXbUD2@M$6>+r=Vy9uiR=%Gel7_?g(!M> z8ql0}irKFIz<1;x8yuKHvV#SJeNRM0-yqN@S3c^A&(oiw z)i36#b9WZ)KgXJV8PXxT=djcbtpwPwsrg>G2xXxZA$OTV0lw8^(1F`M!HIxHN3#xa z^{$&kNBhiA9+mF!@bG%zJUe-{zo213n=Jc>}vZ|e%fm@{0BY+ zCYW_#Aw@cIDlcR>&n^{LlzpNs3I6nacK+#vq(kELIXw||WL;l}MN#E)L-AAm!Y0iCg#mM*GTc{De4KnLL)uo2t{W0^)wtadc$;P*ML&( zIotmwn9?ab&H7JkX8IBvkPkjh{prdo`;;kiEa3dHXiaxendTKkVBe{^%>1`d0*|6r zFKs-o@&MU?QH8+Ak_m61K(Q~mcEceYG9Ad5yr`d1Q)0CL9^NPDDokW&RaVmHP{Bh> zOADDi2)ts`SFCz-u0oW5aJs&VKI$W~t-0zQ;?hdMTK(4*guB5+nZZGo;ezB?0%zk* zLd49bqvThGYMwEcT^es9AjAYthqOFIiVK5w=?C+d@q{_nIs^=>_{WbrBm$kv`bmue zqp6~IwnI&!yfcGRFNVW)e};iB#XxhIr`Wxa$L%#pSADlRcc*lyuMDF4?(Ig@tHL^A zF=T2OFsFrgJA~E;zpYCyC7Z#4`|K4p zeVy#@ZCbNO;$o6hrcR7}$)UN#ijB{LKZdO7rg-qQ$Ry9XUx}Jm8lw)6yL|cdUctJ@ zmchWf9pVWlNOj~@|0bhzprsQmp@~0-Qrh*Epckl`)kW^QAx!rgiTk^XJ})2!q9xgn z(Rlez9OI~fJq>Z68~!U8KP z{zJ~#?lWQacF-Kvf?Nw6e5jbRy8sO}L-QQOL9dr4Gp~jMC6vk6yqKfciD{QiWg0s% z27J-#w;^HwwfpZ<>W0iZxRfEN{E5TT5I4-ZE#mk?4z?&g554lJ>jsyvo1EF>AmI-KvGeUA^nG}&U!E>OkfC8nPw?v`Y z_XyyC2V%P&78!6vG{Ir=TcxcH4ncn);U+$jGnJM`42*StS)u*ejpsVO1`&~a5aZ`Y z_x-8b7cUqTHR#o@+fxZ=s5Q()56NtO8y3grOdD`HSk>?n0|Y$);{d{~UpYg*?$@(* zS$gtelEHtc6m=?!V}eB+A)7N z9;G!F#a>95>ZamOPg@t^E}WNUpdhFYok?H;>Le@3w(Wl&W+1lsFT`}*yKvIe`wrg9 zB$O)2q^f{l0>=J1pzbSCZiGlAtSan`?Y`Q#pr)$d>a48lvV2*Y3CW(@~ zJldGFj7-3*S8ADJh-@WM;7#S-TJ9UPOVZM|wy_xh>`)=#sZmi?^#*!)i22P!&mCaa z0qU)>7zX{Va*Mg`rv8&S@lgudo|%4Yx4s7EGTW!A`e-i{ zf)OZM%L;~v#u5aFG$nZu%4x|bg{$Qz;?Od~23?~57*BTns_O$`R07F&nY`Tc9^ zw_ZQK!tLvaqAZl){l^jF*cGAmff!p>mt*rfo*BV2ZUcZnSvZ(y*IJhF#XMVkQ zx(Q0z0EwA(=;HuhSbZqw07tdOeo_AU78^sh`LKQ6V+0pIY!qHTzFiU9*+zE=g=4V< zmcl7KOeGi(z6{3BJtuKcJzSV?ze#!O`k6$EJ&?#w!M`Jr9&U|U!oGD zS2eT>p4Rb9)fiPpHof?3G{C9GVAC$5S-*@(?|FR(>QsH9(lHrNCgGl50i=vQ;VwW< z7~y{bK7=#<6Fl4BvrTs$WMpJ2zrr2xm4!m}T6cGMnq9pTChHSbsLsLSi;)NJJ}DxE zHV>GAH~~zyP9&7-#cPaPeV!6EH@Z@&R)MJuZ0Gkf0YYz6z$a zi!CsTZ3JIfHI-kgD=WaL>FV+f!H1nHzjgKhsCvt&D%0<{4($b~U zpoDZch!P?V0wQG*BAp@)g3?k-NjLoWneXq#^URvHW?oF3bME`P_THb`m-E+cdg(H4 z;-GxO`P~TJ|E0lt8$?+r;nFGu)~8PHlHA&Z#c{AGkurhygAbhXPN_#zC}sxURuXMQ z5hPoMZ`c2UdMoJq@`+Q0R*3#MoM||O5L9#D2i_z0Ptd1lW~HZ7Ol9$4hLhVWzr5B8 zIh6MKYv4^_+f!>+Yoi9gOY#4pD>1NxR}%Cp}Gvq4O9g;KS08MSyW2= z@23!kqiI5X@i|_h1r`NJTf5hlw{>@Q`Q;e&&cbA1@np7yuWi^MI7COm!5Nft(tatC z>{l>pEDfag?Q*sFZG!@BP{|wjc?d_6kb|^@gb!e+G!k6*sW&IAqQqt79t^Lcr$#6b$_Az{^O*Zi+rv`R-5(Ev6RWb{8Y;B_a3Nj!WX2;p z+g&G#Asx770_;3SJ6cTdph!#QgT;meRDI7BOp~e5M2$N|O@!xp&dH9YuJD|dO z<)C(Xb%)-(`tOhGYTa+|o5e{H{rL41+Ny%zVv0*jFtMZae%Q1I@^m@bmAD*@pKF>hys(h^7x)9qC$bP z$v|TP+|h2s&5k0)8n65rK&kpLX-EgSjTO{QcOcrl+^X2?-2<X({vM<=RcFd@LxQ1vy& zVY=tieWz*E(cpY3UZ^71Y7?2YB+KS`w=Fj!vNBug7*>rdsE+$_k{9~pERTz7f7z88 z+TGoSR3*m24#Q*kAqrBK)TI?p7FaDSS=XQ>UF`QUVvDhoS#fBO7__n&NtO1PMY zPv7s&wDOoN+sVGgoa@V5tkm-@K z3}oOq==hVXuFmJLCCM5xAKyS}qF#g}#_@;z`ZK35w%-r!;T*!UA1{-%H54#y;7QI3cm2@O??>SJ+Q{KX-Oe+vjX|R z0**FerKY!o16SNNkb8jTIpOR9G6IMt<~LoF!CR_S^`_R0&txh>r9A=isGW;seTNl; zLucr9cfs*!(#%b*Y>>I;(X?p9D*D!UIGc{0-tLoaL{iLpSvdd(&^QbI6A^!+rSRhK z^PnEaCoJN3u0WfkSFop>+kyM2RJaR9a?br2Vb=B5v_Pi6GS~2wB9?8Wg_fEBqw~!} zzGPFAR++rVTD*5h-X{{**p&nX3WoP(9_SU2jWn_a46-PDbF=`l7|ri&0<90 zPNK_;*>&vks6QapV>lZwRKvHw4u`whiUl+@t=0%dwM^!qpK5um$C)C-pB|e7m>G&j{P|c8vd%t(6bP71^~cEj6>xzIxMJFQ3|sE7Vup6UXli@i zw1VpKozl8?>fnbK9DXy32+*~$rH@daWJP|zhAj;?h3Q@z1Oe|$wi0EeSXoiA@g2kT z0|Ya(U~R*9y**4KDhG$D8tY7kb(KOc@@RC&kDg&lU+uq99oB@qf8wse#-wW5toxQ= zEGVtL625vn)jS)NOkxcgK|_gT-XO68tzhd1y$5>yM=NYEV`*u)i<(p1*tM~W`o5fe zC~FRlL`Dy0qSjbid4Y|37`cd*k4#Vy{WjZQ;Rq$KEq+Ht~FD{Wp5idTcVVAJds#EGyRBZmMn z2OVey90xK(1>TGS*6G2+Qh0$+mQl=dn8~TId!2>s{z?0d&_p(YnAewI6KE9?{VTBx z+y?!$<$_pPxCDswz|)X}f=?|dF6!B^QPq@Au6kB#x#B*^UE@C3HGzFYF~NGRBqf6j z(W{p5{~Ji9mh?3LowK7kSmh8Lwx54nT>Aa>d|S*^qQKYWT*LRK+s_Yw;Nh$CdYgU4 z6HI}Y_?8M&E1HHYbl;FLR{}PG4$bbscFo+ZYqQ;WhN)=vN_XVCBj_zJ&o-)IV!$)I z1m_b^vD$Jl8OqXKu}w48+@Le()Bu!#9p1|=+)RW8P`}T z!y_Db_Wj?_g@2L%dZ;9p1QCdM0*FM)UZTK;^^xW%@!mNpa^VPvHq$BE%!TUlG+KB8 z@ahiVJ_#p>=37t*xc`z1SvgvaW^NbU+aGUamJ@Kv3mB32?!3bx<^^vJdqQ&Z4^bT? z)~l|AZ5#U4PchK?D1bVMOi%2QX6*%`zU8v>5dglLcmK&44{#7jj=waGaa?Hr^|-pF zsO{GsRt=3(ZKle9L3S#Zk6G3(8dB%wZoVFjqvQwuJqWsfu6VMBjX7LhoPx?NIX<5J z_UEfBFP5Fy^t(78f8=klY`aV6Q_;}y%wgwI?1{w_M?T_IlCqi#s1LeeAHx~5NQ*>j zx^cei67J0M*Nk@Ih6xN5`(2MWyl#y{P#sV4NA$Jv#)YZN3b85X!S%RY*z;^vUp6Jc z;?4iS7_4vp#!kjz#PpH_zl6ou=fi?Pal!N{G%s;mE&jr|6_h34FIB$?OV-$2UtOx} z?8sCKu%{{l)ues`uZ#9wrJ@RY#|hNDm=XT@8~D)U?4RbJz<}=Dc~Bdlr|E!Y#76Ll z;nqI>mT))d7J4<8ZE`UT_Miozi@o68(-KzX+YvDyFR!>kqPPXIP1K73z`IouK7a4K zWty{ZV-P=b6Zmp3`OFW{VPiYq9Q0H1);-B_^kBfi#s;6+_?EAuqobL?%bXmB&W95f zktFM!A1?9Fi0?VIsIU%V?kb?9D)n3sZNLx6zcvJ2bhOq#cXUdeQqt$KVbU>Cnmt9h zZbZxqk2(*i^XWv$moQMF;b1y{Gq{K$c`tM6Ua5{qp5)2QBE^e4p;Bs|&TJ9pIm^4E zPnG|B-8_>6xfAR!38iL)L5-6oi`V_lKtd`FT5)oT_13Rlcg@~aKoxP} zX*GCmPU_FTvlw1ZAVJLEMJ$|S8FXs@VFFA|Fu4{8AUgA&F5#*avDjtuWTvE`yx#}U z(bh;&bZSO?AZOAbIxV#hV_5-99gC_50kcP@W3QTFjBOPQc1->_tmQc97yrV4fTb?9 z`gn7yRdK1X-2` z=IN2zfK?TOlnt+Yjn}>-jxtM`JS8E0%8!TS_7m3gxuFH^@lckpP^)Dcnv6MQY4Q7H z`i@&S2Wkp>;}d||gJ7#crb+^}d-9WGYQ)qBS^w~)9ywJ`IQo1~(m+ebL8FKFH?XSn8btn!Y+Xxi5AK{M=yllni z#a!_k$$ydn#KGHPHIY<LIr`4be#dEE>imlteLsr$_o&XWQjYI zt=<|3PI?a-T2PF%23|so;iMUi?ZMwAe#D@OzY=%e1Gid18mNmzZ?hTV`S?8kr3^Yb0y00YPAyGiW>Lv)-P;y6vltkc>g!X zva_?hHU8n^aI0U$%Jc#$Rp{N6S9SOSy@@x!xTUeh1U&ZWEX&0NXHxWrYbN|f3(tk^;j~G(m&+N)~0~#cbNPI zTmf#gjg*o@@PX9U;N)s}!loLUaRBVX`>2a7=H3d8m+7kzr5upIL=5 zLt>4m)Z?EA5Eh4UH9`Rgk>;H{8hQF!(3GofJCdPrkuW}IOIulE#FG{gzJ_dUs-KbN zxcp~8yW9_lM#mK#jBt^<`}eX&O+<4QS7xF8>WY0fVR-)%+R;@7q@ZAR4O5s^`gEkw zfbB;6t&AQFjI2N(0gOC^TF`z%G68}90fPp%Mj&Wuq)Rj16G+Dj0}1iU3D0=`V*$Im z3Zem0U>VGUZgk;&)cen%P%gxRjZxGIh}WYym%$F0uf884V^~4Oo{6WjjGw2XKEM6- z+%-oS2JiH@*b106pW!8OaazWd*Wib-4Qe4(H<1{VM(6o&VhQgPa5_pyi#(6|K*C+q z^Jb3S#L6S970h!`A5@YQ7C!Vi|K3&a+y5d?>Y1u%isecA>1{ZDoBw?xCd~%9mzx;FSC?SC$ zJ&ZI6P&U5r`wt$pH3mU_^az{S|M(^fwAH4|Xz}qk1RKZ{fx_0*#1WhYDj}`p&uf0q zOLa~bupZgAs|O?%J^lp*<|i-dtqartS%xU6PVMnteUF;pqpF4x!szWGEGlV3j4irn zJ|i^#fi}If;4KT;@+oHJcR6{KnEOfC(pPr;M4^X*Zf^{!R<_5y9MyfIV$GWt00=(7 zj}6`LTH;xGcyL&klp^r-$1Dix^u&tN)p{J>vyN-$-25LwsT8!M3@p@pghi1YiHz{5 z+U?y5a~mi0-kUf`7t{>S(6z57VAdpes{mLtdfwEw=svaO8=?Lw$yAgT&08@XHLVUE zVIRBNP;1wh2J?b#&Xwrk#auZ2TWfbjPSM`0Z89c_VZgG8jP4mR>+i7S&vLU7^Ufu5sMBqv}^1Az~bFt&IY~B zXk>L9M?^ZWoY6p-sd84v4qsA?NfzL~XbRO1D|ECt-I%sUOKRs8njxki&t|tH66wjw z$Tocgetk;)PcPTM{FZIZ0(IjKc3{xxUbmvr#pQX3+7(GOiHRPM$auHn90ig>Km>+K zq*)dF*x|mVs*5R;MsgYB68*nji~^URSPRq=QIJ<0+dDl`Y2>$3t6O>VA>=!4R44Hb zKCBtT@6VoN(uxE6ytH$)MH7{SP^ZtJJh}_$G4^jXl2G4Zho6 z@!&S3$-T>3!PhrSxOFf~cq9t;oLNfYoqGFq%Za$N@o&SW2eJhCAouRwV`pQ7HtH+ls?Y}% zTp;Cv+MsV)8k6FQ&0NX?a=PQAE^-r%oo-o+~8u?dPtI2i-CKQR2*YbjpisdgA(e7R~WT)_5|-KT&;~ z$jCnQ@E%0-{`6DO(Qog$$P+joZk|MYMtCI9bS9>H`p+Wnd^-G7;j{Q#YpPHi1dr>n--}B174BVL@ zC(C#&?;I0oo!cjx;2Wd;ebyb0wRX7N8qcLc_f_Y!rl2XW&7FjV0~GBp;bcXeR7}h= zrq+3XJ!K~`2)y$KYwjOgE{;+r!KwZ=WSa1Vgg41rrx1FemJw2vB&=~oZH_-E$pj)=gl*$~gbV*c5ckqw;Tq}fUo5ho{4?QR&?v}$g=I%Un0^{GgmY%!q|v5ByZ zcH~D}c5(%3aFjgnSZ%pbK&g}Dv{1iD9S77D0$Sn`OzP_Dx9XINxz*X8km=!`C6tnC z5E~u~v!>|e%F!Zylz!=5a+%tGap+D7+too=T38 zgMMKg68zzF{;+g}F#`!?gUN9Tz?Z#)KVt>#dD}|>8cSOEKyH8mXbHiWH`iP5)H(nV zMV}^xM9oJMh{z8|GFGaps-TyGJ&5lDwi`4&hvLxAW8X?`ORE=(gW`7*Jo<_M-{)xi zewrhU)6L2%->j#^?OOF^pj3GAQ!3RkfmD|Aw@t5g-%#+rU#P=MP|cEAUsDQQ6JzBJ zabSCuvJsMc|EIKt>(tRs<-|aJ(Q8FT3h{CkP z1^&Ddz54m|UqVrvQR}NAf|l@YZzbh`m(9|Fge*W7aIFIyx3sk6F1_C*6!$LvP`q*% z;vT?Cw+?;z{XkUE>PL}~Rt}M%8e^+qf2x{ZK<=Drhjeh0G%Gk5IJI^e90b3?APQ@& z?IA0&4C8UZ3qgy2XZHL$3&{C|f6ZY)N~H|8R=0;Vc>^`i8wV%R)-P zZgKWw+~kj8>EqAb?iXOYg(QG8Sc&%$%oId#`YG+FmO(TN%$(2*RAPS91mnYdL`-UM zO{3ce{GXm(6WDFc=QQf|{(~}b2)k=I)LK9u49+~Ts8VAt!?ycT^LK%`Zm!fZsV%Td z*CQTDMgo#U6QBB8an#A!*cgt(qaEO{-j?Eb+I|_uK6vnWGKE)E+X1{C;qygq&(03o zas*62Xi97qa7n!Sg;q#TN?L$tvk6X3W!2kmp%MYis)&A~J-d6j*P>leD%?$AR_^%u z@gbqUk`ibsK|Bx)!z{@C4&nKU6?0Y9FX2VN@qcdT@eeq$W{^ohJ~vV=k*WjBM{oK* z0=Ve=d~+~J`PYvikp|@4<1kDCK|n|ACj(6e@cteJFp5QURSkeZ@3Vj9W~v5LYP1Bz z7C+>%aspu4-N|VkF0HS?Joh4{iRM!23jSgE=^ywTknzjjWck|lAY$$3Kc&R3_yq^} z%l_cam2ZaTiJbRY#jH5IL8dDoF^Z(PMn?a2Y3&aQpOV zI_z9j7TrFFAZ4M{*>!M@mld59Gel-LbL*nibna6KuKAazBHQmr%T5UdmJQI$Z~Z(} zh#WTL&74;~b?!Znu|nH_+mqm34ul&%l|XBHVR{aVvp<({4+*mDp25=EJ922P=gNLleP^*7JQ@Cq*W5kH0jQ*+4U zaogE&<<51W`WP@hN`gx~NH}yrcYkygkG&CvK3yhQf;H-4zWOwfNIV=9Hm-cLk=z=w@I5joCi^`Y*f>rA8 zCDDpueIB5;e2S{k`vuRSRjKR6&o3q@M||6*03??knu* zX$}Xozr3k-#mv=dkl&F>Cr1j--&7ZHv~f~Dd?=6(2MEZ6A92z8CxGeKu0lkCywL^nsuy`V|NL)# zp@W@WD_O`YIur^9BBrC!?2s)-w zzX6U%x-^ABXXPQoO*gzL-%LYAimhN#jgjV12*4jcGjnUkyouK@ZLGKdw4STw9@;UN zCW$gLN$9((w|Q+tB*GwyLz3_@VkDC+x|)4_7X|?#>`ClTf#ENrfMDS?%-EsW{%Y1d z4UQK7FUqfh#}Bp&M1Zbac6|b@6|Y{uPV8EN^`ss)*8m!w=vjT*-IaOzkEPOedNKkJ zlpx?5W&QJ`npq*2C+TnqoJIOncrIO!xLW4W6qy|p#(&F&dI*|CwgsZmvoY?3TY|Ef zX0cv@hE7)aq}Fopp9BSyxu9V4!Cf7eB*wJNyC$_L=Cl_%Lz+uPU*ca6Xa4YOJaIS1|)w`5HG>5lXzF^ot-OMQ>Y9QgL@om(6@6D3L% z9F{XMYYYh-J+r-GBv?-I!M#^vKKYB_ryk1JuZ)^LcjU`-#Z12V>6dDdv|zAJ+!(apZsW)8)wz}JZ3%rUd(H& zV)J&(&+DIyCpU3}V_0wteh<@*(W%8v{6MLZemI=p1`DI#16>Tg;?hfJyJfcAu=;vw z;{^xz=P7Sk_llrc8UMJ&u;DXPXhqDPgvp7Zz<%vDzXOD8U2m`EA!cMDbZ0mowkaGT zT2`HVWc2j$tEDD8jH0KNVyAXzd7Ys2ZSKv0?tx=fcXqKQ(5ON>FoPajDtIH zLK8D`t1i`3FA_vreXvaS)YvLxKtu;!KcPzPd9_lxw;}C-M*tvoEqd zT)SW5hdH|hySN!k{mq4L)L%-T`fC6>TH`JRvEsD@y;L68!I2_FiQ1T`3vqb!=H_)@ z%FP=@y-99i(9oiy($doM#4IfUkRGYpK<~~&dP^{_^_D6UuJm_cO2JprWJ7ruGlQPP zI%?Kw?cOf=oTC);UDq%YmzQqpZUKjR7WWJ2=u8l+HJAJcZ1ae0B{y7SELz z_v!qC?%)$x=G0 zC9!av-cBEi3S=VXwag5U_qDaL8DB?I)Dy0sI}j((pIA%EL2mYmfK~1*$;WZhliKwY zeCO7no01Mh0#1!!-jAYnHb*2oHorFtD9CLr!?Rye zSsRJ}(kz-(BFKL`ufx88YFD~mH*di7y7{-;cXn6YN~L;qDr?BsaU;wrPfv*kQD-#WUpfD% zdYyXo4Lq+nD^pWb0Cdi@Dx9qsfw^U2Td>)psAWlij?)B9b;Hf;pOTEtVD!@4tQ1c? zodaM|dapNVth8x<+9yEg)X|Fp-Czi9{@3wK=!!`yzS}5G&O z#Os`=VA61?3;c-noAvpjMFwiFJ2{M20CU%56yLy%D{=!YSKajb3{pe5P!V3Azc&c` z3`nZ8D#!Eic%051f>taIkV2Si84at(t38KMz1&1(q#eO%^byGS{ij2O$yI0xn353D zJIdvb;Xz?VNaxJ>{{GpcJF$qctISz)=)pQ`U!I)mNDM|p$A-ndtS!`h;4*jPa_+== zT`n0%*FmBYL@oLG`9RX#uQVprsx)?O+WG`47d%S7R!yZCX{_>gdd|KEGj|B(Uc^V*Qv5aC)!~%Y@Z%EPkL6yJCiQWJlGhJ#P;0#gSXm=c zGcZHmwt=Daf!_+HxqMa2mH&+VPW|ts-QPXGBQ&a_^(}OyEw=y6GmDaOc5%K4qatir z9qs?gP7qYaNJa4R7HfBaUmFa2>M?z(cGF!OHhNM10!-0#0iW5bF7O@Fdr(=&ml`7| zKUbqJp#Al1sKE$?5`XvJz5S*!+f@(k>7i@WU?hEP(V{2b63S5w8 ziaLy`rhc#tlpw#W>j%al*eev@bOi=1=_lLfmAC$<-Yo;>g_dpw)jXdGRB-~sE9dgo zAVIPjKxs%jpW#3nhS;gGn5qJxTbI(IW@ir`XL57f6AKtmzCv+hd_NK}81+zV=IHmZD}5F;Er=pi zC5nWX2`Jh0NQ~$|-Slo3$1T_LveeUA>n)#yk}N`dW{Kg|5C%_+<(2~iLn}6qo{8Dl zTm4ipG|ywvUjjxESe;dbGe|yAkeUh#0GhEk>_LVe-ZritZP%Ochq!ceq~S&uz&RvS zXe~(BBVlDdWzE1eHauDQ{regmO2nnZ!7w&Jl4}9v=?TGByovh{v@`Ym^>@>wPxu{SZJ;gImdP*DL6@?1TAdu|*cN=}iSX=3IjK z9|ILWJyiXU#)J|TR_YtOdQZr8Mivfmos2tN#`UT6eh`M|v=$m&BW$HS1Fbx=vx6Y^ znBPRGi%5WvM0?q%lv)aDXEr2F_n;EqR2HjzW8X zunfGdm}ngNv{J4Ap^Fw3Yu9}-)|G6e7|D9tkFi7M_pDc~-N4fwiq;Y)>U~JPC!!TC zetTsX@kmPAaqpZ+rlse%c5c!c`K$vL5rfn6YpEKVo<#a%(1BXr5~=+wlj?>3?H;?s z65gd+@miFK75Q3?U-7@3Uk0|*i6v;Iq}+Cpl4GZm7g@=a`<;Zvotm~ zHc|`8q6|RWU$5eLZA3cz!&DV1*Szwu0=&i4t%2IUs~TTSi#Hjr%4={6#pAd}9)rf^+6&VZOs zK4in?4$YzJm?98i)0)qx>;II#O85{95+OE&rWwrr0)Y!&eS@5R1KUi8yo{dwFT6S` zYr(2Hy4;iX;0=nIdh`hZJy0bd`!>n5vqJ)Ij>0oK^%Ix`=p-NUD85Fw@4MTQ6e~fA zxW7$&w=71AsrfK?Q#derUo}*~Pg1!Rdu(Vj6A`A41P!LtV3#aA+v#h?CCl_^RgC>^ z{>amgr0vCnuTUCDGxkq`+8Fa97+4e2O#^9L`P*Bemc?MzE5h-&AFvQ)`oSr1x(zh| z?HGy_8o=6DPV@7B-D2cCmOA0mq9!BT1Hv8bd^8AiRCkXMT_``$+JMdYV-It%d2>kl z$%$X}8vkkBtE9va$@?bOAOiY2mMPc}^zz1qC3?T*lS_YwTT?$!+?gjV2(k7wF@@`V zqKKJ^e))ha6q=5#cj21Vmd(qI*kMnpO8=Hkypg70*%>c?t{LJ4TEMK?Wr%_t85w~W zAC@Z$xhRoCI021}Cx?-h)2tpJ21GHIwJ0Tbz>AYCVuRzPrXHaQ?7?qfnRIhv)JMdZ zqI^j`z)Qf^X^8cmcb<@o;a-7%SS>QpBKZ1>iT?y}>TG&(CzMFw9ki-&a9QoCjBV!E z7i`a=&uwc=Su3k`>NeZ}9W`-X%@Q_@c{1L`>9pp3))SS+wKnlY-peBgUg*?j2iD-2 zucyw}H$d8QGp*+oeHX~RnYz}#zv7;a!VSeIZFICdNAvvyp`RuDQN2P?-W7G|4)D%K zF_vOzrq{65k*vG+cN(+=DtjKPsXHDY^Rakh{={f?j28r~7iSX=BzsQ23Z004#YJG{ zjnZF+fte`x8to45z&;GKY$j1WLY$Hl$T{p%ph%rtUchcAc5f^tkA2A^IoOKEN)6+o zvZRpr&Kx8E0*q3c_9OF_u`giMaOq$FJ}tu{t9C29Nq zbfU9r3q1HgwpZZfC4#Yh2da1kGVfU#zhka4_9G_8oOT&F%g2$f8-p+|cX~)s08N4} z>t{(GWbW9^5un}|C-}p8pjWY0g%=mO9#i}?Bqa#g5A(S2cqXGepx@4C6_1WeCvgbB zh{Il{x%rX~$C@&xUFM$E_e|qnkwqMl(fudxB#1c5%#3;pbQ($s!j@>VVfI^2g%RkT zMbnYtYtSNnd;V}v4vZT$gh+w_l#11$ky2=p6XGb-kjG3^*SCh43Xd237c1IvwyHcy zKGz@~x}?_xwb6zziDiAmlc(#F}G&?bop_)hr_FG4Y2rKYk<*sdaR zx`&l^lv6{XTx)<%yI$3H)J}|%i|}6bVuyKpm8I8riA?6?9a~CRj%;8d8vNc*d>0c0@o;5uauEl zf-X}vi*P@~d5;eQ1!oh$jiBs%ZS>ZNaKmb55+D$ZH@b}J?Fibp<-u2{Z{P}CPZ(dV zg>69xlS8%p(s!&T-fGY^`flMBU4kY)gdva1VCi~nIdLdF$+939d1Y>&VtltwTX~;= z+vd~VD~!4b`nrOU!Qc7G^isO7=dOkv#}j7YjizgW>Czt%{DcH^xj{#R`2Jm77{Qq$ zq}O}9Sjku5*0r5u>CqGsKb4^u2pt_8(^vJDBl(;f5wRRC&9Lit4VFCjPYcC|3SJ~V zk!b29gIdJZGx$PZkZbr3HmAumqyAGH*7C^Rj$$wO)gdhg%qP4EE|73H4VZG+ZXrwp@b_NHU9iLvPFa^ zY8ep4`CKK~25p0Lo#lhEK#HBCr4uZGtax)juidOZ|#!Vq%|4xlj?p=mjT5rIts zBv?qjS_#AeX#0tbffaH2mFX#Ki&trX4Db`Uh>Re@#Z6^rGs&K7uo<}?lU?-WUZ2{MdHm~R zM_z~P(Cn<1av0$#=q!N{zfHzJe~CrVRaf&LcxZEe#ktbVV;JgrV*EM6BJ_^ zxw)=EXNO^SFp}<}yF}!O)f2IFt}!wPHgLt5qvDc~|2)qoAtx`gL`&=ih#XRE{NaK~ z&7uETLGhQGEiUE3QQqM%wgEMlNKEU${j(Bc5K&=t&Hyl2m&j*9LCy!^2n7_PXmso; z$eiuPjNZg%l6*uH{JBIx80wQB6Frh?hmwV~lVZ9}QQ+onJQ8VcL6Nln>^ht9$TP^Q zgg@Q__fSJuf~3brONN@ItsR%tUXg{33%f2Qf@Ih8uPfwOw3i=3Pp+Y+wsM@-i;orP z8))h0zA!*@7ZJ!>rCwV+ZrJ|&Lnz4tV)3!N1z3&Lbu_-BD0nW%a115>v~E+cESA3W z1YI_vFV&A+*h1Zswlv{uQ^6+7T65=06|V=lBL6*wY!Zl{M^Z2#?1#X2r0VD3W;zuN z4Iuix29>_$gvr-H8KaA!IU}V3gKEoX&=SM)1Tcpp>71N_wd+x4o9-`cY4s*--?$@L z57lHWOd!L7_KgudfSralCKd0+u%V z8OoccqK(5^qAk+gq-+cq8eq3gc70^dn4d3@o;YNKbseR{f4`PgxH`*yUy+pJ=^;+!)F z8d}iRv5(XPTEY2X^xXv(8@n~)aS{aizR>Pc&=Zv;`8O6#pU#@-8D<~~o98nF(2cF$ zf5$<|X899-VwkpL>|9*_LQgnw3GO>ZC;Z!tS~ktgp}l>P*u;Xo1ohIrC073y+8~nR z>FG)adHkT{RW3Mc@RyI=JH3{e-Q)7j zMf@l9xR+XS^z3|Zzf}fqb67@=G-@El!zA;)?^A)GgP69edZzU!ED>dgf+?KUQm1|L zJo^vr5t<_`%)W0YOo2ZKS*8FxyDdaHgO>;w9I{Ws$NnH~C7{j>08T;1YqgA8g^F47 z?MitP=Vf>}_vqF$$4is^o<(;TqVdu9AD=AY49ykX=o>e?G4R8<6W_1zhVr2KuNO_B z8RuamZq+$Fh~6#)_$fIHk8Td{DBtn(KjCQ#GR*!lVK zEl3r>*)?9Q^&DCjF<_;^AMp(NMz&lBL3>tW;32kmB+Gf--YaqQ`70ew8okJY{aMvfpxW?QsY(n{tYZOkKG4E%RYH`c0+!CwnvEHx{BlOf_W_0_%aWR z<#=`6_)jHHr~lNIh%k!)L%XI=TR&wtbEwB!QQ~PDv6Q}Y>Owi!9LCPeM;%sUdo!@2EA`S2pyt7nq;_A?h z&hS#&QOwa)sKt#W&xq-nwlzerNU$;W{0NMpG`+!zPp1|=(gzny0Nm$wOGrKlX`Bh1 zDhOdhuwACJMJjVCBO)u5>0K7*Ds^#qfAp51Gy9rvTP?)_T=zA>94ECTs0WT}iPJ!7{dz0BpXAca23tRyaxa7I8t_5VV znpI!+ZV5QmeAR!M;4rzaSvL?yWLpv$6zA-y>6O}L0!IdtqTH7{aU~dNOX(hw-VKzX zW(^|Z_a_o|Hl78whc{S{GF3kQ!;G@@2zzk=dU1$4i?EI3@DKB4O?TCnk{kZ^f@qy` z6-a2B%g$(=*MK#qTJjQ1AZ!(sc#^U`R7sF_es|U3m#G>!4f*;RXbpoX4P;Ao0@PHU znEL#*kBq)$sJv2`yAox$aCmx@)EJK?B|;|a;xO)W!XVhImNbX{j#;58ttp9j#P$|Q zg=gG>-hKwPOWyxL^Y(3UV{U<*3jF(0;Q2FlRd~Sg_~@n*;i@W}xWq3uC{m^Z_aHzZ z83a7YBtsB$RhztDg$5U!h#|&Yz+UzCOCdbcm$!u(LSh8kg_ZVg&^)G`VLq;IKBB|o zCwq_Z(3?4=#`QEl>c8VANYiPj^Mpf)E}^MY;e;fc#1LtgA-6v`j(% zlVPQFZN>w zW!dmw3?#US`v`9%xSBt%9T|Xrezmk8wqSW2zavTM1t-{=nLm@wh`RJeCd084v45me_jNS!1gq zoIWCr7B>pJq0l&8yj0y!)i9fmBK1*9VUKCZ7oz>X~0$BMU(u)!OcDI-htd< z`4$2i^z=w%B_Y@7;NSobsi5T-qCuI4_|CT76QUL59UB}fg}Pn z9$#PX1Ox221y@F1W;uvG6k02nl=5{M7zwtZ%RuV=;2iw`eI&Rf$V>7Q&H!aO2C}ax z4-}EgYa@3KF!lh}ARBuM8vCME_^G}^;T?`{hnoTR-X|4>yF!;sm$+1eCVo~Oe2K5p z5t0As)~$ZS`xcRP02!o|qkw}67Q%F@LNWry8m>1?m^Tw}n0Xk?KX@W7|JSHd0;CM} zP+i626kti!HAH352wR~zP+p=+XFCzCX#rZcBG&+Pu1KPu5@8I>1}IcIvfM%G2N{s} z%kKh?z?(_VU=xC)i+g}47JhFD>F6aTK-IvTHLJ7h1D#OFz6KEqU*F(h5Jba-Lf=KYw*ED%cV{K&f=xX!&zFD@SH1(MQ2~ZgSpI?$MMcm6yvIA( z|0Eq#Q_poLH=!dgH>TkP8mG2RijIMqoXk`kxuGmEZ1%7{_?br>6Oge109W|Iiws96 z@ux61#0YEa=;SB{D=ZPqACR00MF~;}tEJ?7CeW?Qiz7{I23PQUw~t4xB;>+pW)wrW z8XnA*r;qZ6RFYw{8i+O}!1%;Nmo53&)W~QOSQnrPZO$&BGBuZ)(I5Y>lJUS z&cKXh<=H`}aov9n{}Z5m zz`vryOY|MevY|;1y|j8}A7Eli%#eG6#|YL*N>6$Tmx##{hvsvzfW)CRlr4#x6>dlQ zKK5{27J>yNIJ`XzRk&ifzU&EtnU8Dst#7wQg_?`?AG$rU#%~*qTETtz7=(z!kVhJ2 zf&J_p(?n?1j?c{$67ecnJ3$C`L~Kw{mU#Qwn96sFX_` zHJ_^ho5W@|q^{1t)g6{k#ARFew-?UA)eZmsK%hF?^N|vtfWyC-;mqAk12V>$JV}1^ z0LlB~e50N8gliR=7~-kux?jwzQWT(f?7UK z?3gMPQ6fnoc@j^|g5_yyuOUhM^@+d2^@SIKJLo)V{s8%h|LYLm54bSp8xw64gFuY| zhfF-8PS{&SahNYT^>d`yGLq{Ricu-g2g zngMG!WQoXrSmg&IJCK>hPAid8bZSC^PH1YO^eO{Za3mh3d-sx@1~Y_VX6L#F{)!@} zM{oO}go>~6r)6A7zTCK$jjw01BOP%9)zjt(z_kFl7Lm?L+a7Cq__TmA>fidSN~pAi za!4a0ubt=$k&x1OFoU2)h2ZwsEjb^l<+hfErk=(wu9TY~3LRFHrVDcX#3PlfsT@Lnh}f0S^W zWAF-safPD*>lw{84fRhoY!XD!-*H}NoM+Fcm8iNSag{%VHlYzh;RzVfBhb1rG1tFE zuwwwC<%G;sfotdNN6QuFCHOsK=t@Z)d!Yw|qZKDR!s(2EnnKDK+0P-rY<(WQ!cL@k>*%Yr-1LJ3KoD#9>XF(TqEx!@De zKC)#zU!vZRMEQtva%!b=64s?v-*1F|vXz2+dqNK=Ar-E8Cd^E9d)kJrJuvJwI_`iN z`^_h@?q>(iQ)LiPgzdUE+w>$_A%tOd@=aclEM)fr9EkLdf+>C-%r9M-!+OEkogl;p zR|Gl_GGz=w5gHmTd)P=gUWfAXADCPqE1d#%>(T4X5b~g5ieo&dEM=_JFfq<2%k*=? zCrwqtmMs26GjdxYGoOYij$K=#fCLw>Ful{d&{mHJpY?AjCR|xQ9#Zhn*VSC6#P=yn zv7}cY>tpm)Rtk7ysf1(Tm66L=LuoxoMW#rNquieQ5Tk@9lU9bh71x9+3-6(pj*jZa z0%U0YnQu`nWjth|E`n{BDLSI<&|yKW2)%^(=nPk5kSHQfvC_p5cT~tOBk6ZQ z!(Ht~{EHw$ezamq@d$k0|3}n!$5Z+K|C^CblD%bS@4YwKyNs;J7NN2?IbK|1dVfE^{;0>}#5w1_?(4o@>p4CrkrAtSC2?71HoBW1TzcD5ljoaX z-fl*B4B1D~M_(zns=`QMc4ZAoHjji;f(M&W)qvXFRAq=2 zMF&m@wG;1llke^Y=rMInQp-F&gP4M3{iplz7Faz)3d+GO8bBy8tcKnTv8JPm9q)Ko z%r%|pWmw?b8XBRu;>E4;KLM5dLq)2^B>P%vjTf4(ho0K4{rkUA`vqMwhyA z&G>*g@k776ZIh1J)@11?72i3R`u^stK>9d@o;E0RP|7>1a}RXrTtZ5?1Eml2&5#wI z&T|z31Sbw6=a0aMWa$11Fke7qKFFFUix_h=VFS0A8mDRjB`X+%_`Yt?Q|PV%C6f>E zuaFeet}|q`v43t23Ik|M*;s%PQ;-b_E*jEc66IacIOf&qANAjS{t?FtjiA zl&P~4qZVTf-|v;ZbW~l}y~@ZIuG7St5(<`5nm2Kv&4|O`iE0Lb2Ml|pxMQ(OriG_d zF1F|IAG7FU9CE}p1UW$=2zmmV74>?CL_OFgF~za3g1)B^OBhRX9H2B_TpwWiyq#Z+ zxY{A5=Bgc{qPN4{rkaKyhl-4yZf&BdHt(X^nbg9Xyv)A=W^$%A5ShhTmwW&fgGzUL zMN{&a$`=(azXpJz+A&@Z+LLkXZ_1l+3UBOKRF%rQLViXcb`}5Ba))y3DQo-|&D9{( zKzM{1qXVc{;8=`&kc{})SKppQdR4wSdIh-Oa$rp(9hX1(_~%zSzFY=AbUW|610BNG ze9;fO7wB%p-qit<$mLZ%kK(`&DVR|wY?TT5vTGoETPLmr=-^&%EW?g{+1UahRZ>%j9 zISSl0GGY%|S+>5%Ht8@$k7}D#2}H^{K(hkR@Qz3K^{Ce)A)X>R^k6ne;$eWzt9O7y zQbLD=5})@Rl1(pQw80dSUWG0vh|AH&j5h|v6qd+y?`>S^iF);B*%MnQG?P_y!}FDD zvyLn^arhVFw-2kERVYXKTtIt50I>v71|$RlKq2y` z*ORd)C)sRm_^yw0PDWIJhlkqK)HLrg_`qcnii)r4C51<2D9Bau#sh^xj!c|>opu0i zGSp+qwyh+@Pk-l1viuHoQ;5`Ah|mtSk{so|gS=7bV}Yhk+eklXSlq{>LR+hL9>UN> zBq~7G7}y{byeW;eM@oKDNgveBSSU2a92V92v0aMF1BLU(r;l*i=yQ1XPQVwlc1QM4 z5KQ&Z4T5lsbpEksLZU37b&1?Bkfnmr#|NnEf%&UI;Oqqb2JkX~BubW86*Bjxz{?A$ z*rTl@T>CgsQyCuoK+dV_GS6BVHFemc2;^sU9q%OTUJpaiE4F|X2K1z4zw@3V_YQ5j zMI*_8BN`5h(on7X#sE10bX|NYjy}2GUOl8ciVE zL7axcC0p~xxbS+UblCuO%B_Gk57XUtBt6x29{U^^Z(n@oTx@~|$ssnx9k=6w`=t#5 zg9`T=zVe^Ti{Gu#+`_O+fIgU2dkECxIoKzJn0VLh3d98CiEc6CG6YdZFk#)We+>Pn z(H-ajG41Mu@*9~}#E`V_WNREpR*w1*vd$a-@u61vlEUwYhAAs+y&FEgJwwZ6Cc z6w{OusH`3N0fBmL3(^S~O_OQUPDT&FYM(CcvOx&}p(b{Gv*Y9rMWnzC-L5M;OYX zhG7&_J%BGoM?Boe_#QvzjReCZ(G%#sD;cH_!5(;eH0$7qrXN;v7o0RE>F=P4GRmC& zL|+Sp5(_Lv(s+8;HD0wR0;fKow4DW4m3o@xDvPJIYAtL^cfK8kbn$PNFe}PGL+Qk` zCv=^$Vdyj=;l%W?Z7+^E*N3JxAW5vBpiJyRwh&ay)vD$JS$hJdP$|3)h)~8j<@9z? z#)8(%%^~eDou^CTH=rT%9x@JOo2c@IE^FD%8QsbQE1l?Jc3@!1U*nCiegJou*5@ls zKzJr!ld(j}TE1{WDWF%x9-Y6JAoU66VF0FwI{ySB5AO;u(PV-}i5z276LC8c@7=H@ zgQ>jhlW{uw!?lEVPkD{=7Qy=eK};%jef0Nq%P z@%;db*yP28Fhit#>AfE66Ia}sOXxnF!e|EsUH>z|z~ z!pEKsKpQoJ+ge@M9ZERhiy$368>npmoB&5XG?ed7y1U~t(IA2k$D7J&oD3mq7AX%w zJm+ygOPVCWYeZkWkLPv%`hX`Ge}eQ$(3HNZ{#5juJbSr_V}mg>yHuiHIs#7N2OuO1 zddBP@YaqHx12>wc^D4btxK6>ShyejqbMum{#W=((d4wBO(xmB~@Z>^rP3AC$ocO9K zBtls)^|K8fiQtxY{lf;9F3Xy-QpKp~iY$&uCm6>)fD3mMBP-X8PId;FreI1UWScx> zFpGHbeda5wHGgh*+Z@+eQF5-LB>h`P8aY0vqlI!K%n)at`a-^_rX#4X%a`@p@rXPi zEc}O_mnkDI{_r8OuCw)dZz-KqQ_y#IX5Jf14&y6w~@?e`?HA58n8A;WS zM-dbyg~pz`PM`x(iE?_d$+VW4?yiH#7z4{nTfh6+lc7xE*xpca;|LIv@CoH+r=(y8 z{D3G>IgB7h#~UcRogFcTYmU3{{3)YxjH+Vy?N_3H{RL@|08-zIq0Ul_dev5=P+P2j z9krAY`n9|d5-v}}3?;`OaK+=6`Cp`e*;A~bBU<6y}^F->|wwZ0hR6O+|Ze!Y?ZC0w%l7ABuh zoQR;H!7KdWn`>ApR$rso>?mqca<>GU!hCempWW~e|Gct5ttS?QK_k1$|7L@v>6X_s z1$Ob#GyyWJmdbHZ{`&;JNHvT&IAchDE5Hn%MQLIqKIZ5SNosrgongs_R2vguIHm3@ zN^5!cjdJ6ZX0R|uqV&=@R8FLY}P%U)MzC#jxIz22{XWH zG6}b~;=h-6d1UosQV-%;gt2H$NH`p*uL?iU38hkpLHJy)ORRa&`Z-9{VY91z)xM&D zEzIirBFdn|0#igxr`ld?M*HOb$Q_Y9Zf2X2SbicQKGNE`+za}M^xKtz^rTkU(YI`C z9d|KjK-v=kV=0>~JVG)O!r<3v4mi9X#}9#wHcbsffM z@O?s>Xz7B;DCmsXTovXrNi@DX(L%zDN#paa*`{x-*dR8ae}+ho1B=n}0J z`>OaZLkPul|9oxLpu2tP%99bLqZrIK46ms^_va?)_QY~|$^b+TL1u#Bs*@}=PG3i6ELtJ%^Ek$&TEOgqhYD~cbJ2B1%_TxNUf=3Um zFnim^IYJ--nc}Z;Aw(X@@`mFS5NcM5w|DXuGyb}P{q>h+!F@o&_kbvodB+8tIEwF^ z&;6TCQ+X~Q>rF>Y?AS1`Cg}+DCWaI3$-ZP5L77b0@Say~H?A)u& z(VvrN3#)<-t}!elUYntMXwBL@4(AqX+mVkFO&%^7#lm0sGR-kHT1BL48m31?Z17B! zQC6St2`aZ*9Hj?aXB#MGCF_tTODH#S}N^g7;BIbGpKyzyiMinKua+vw+ z9dYHu7!|1tY+YH5*_{{0Q|v5cnMaMc8DAg}KS9SC4A{(taZ#p7D4wI3K z-AzVhC~sl#!PQagT>ARyE&W1Ya74P3S?a6U2L3OIWYL)KTNzzs#S{fmuL+7eQD0v5 zXkPFbuAP=Ge4%{u6vIS+yqGkSpOJT;xr7MQ&U7=LyocPAAyQ}PmTC^u&J{LUv__7o ze4|nP#!qTFFN2iHn(_<0tBo|(4RIKjGoBG773-TBEDGbY6%5F$G*acW7>Vubw_`7y;*u^aLpBC6Ly*xt;_Hv63Kp}xSt&W&pj3~QhaXAa(o;t#`SA)pD< zBYVrFA#35CUzStFjK<9UB=qJoHnA}#Lt>RZFUA3#U2dq(;k5;Xe-1qj;wCe@kOKA- z)gc$TKTvRTTQpQE#gaiRyzS^%>~uq%BpBmx(2wn*dMyIokU^eUy*3HD3$tW2n*vFU z#5pKBIE{KZs+=e%A57Mq<# z8l691K3qkQcYsR8RKGotyWW0nGfCil52H%pkm2T`DoH_H)YpX?lPA9|6SJr&0*o1TNGUo>$5=9S97`QPeN}b^93J|GA~|e~o)gh)coN50R4HO7Tdb;+ zaotrVRWE164z^WeQ|12oksrNrl0H3UI5+Vvdh~!iiB#88C=D$MNfPv5&{;>=Rm(RN zOgEVr8IqD%a>WLzQS)@@*_LzfYnPrdkS1Fo8p0wXN*ZEf31GkND{>b#G%cqx>@7d` z?Nr`g!1oD2;$~`{zgJ3>wHt|i(taj++YrubhEdhSBv>gJEUdBQlj(zM!+@OfY2zsgiz~-@4C;=nMmAk z7UrFZy!&NW#lSA;zwoNSDzHDWkw!AqbT;yd;~Al6wWJ|lKCL0u55vRs2$fVU#2c<^ zmXc*?lwzcRlRXGd{HXENQw|3wLRH1gfLxDe>|peF=-v8=#E;vprZ&oE7|P-|vgPSh zUJ^I5opKd;2SuVSi#kQgsu0l0Cx|~;X4OE=>L@-|p~{_xiLk0g*m$OV7!IKw@*ZF; z{w7AsIj?lAEZ?nI|FX}EMOIH0Sn1(;sp$HO&Qds`5D}Y7%GuxAET=EUiTBVTy-3?j zsD9+>m>cOBERgFUvZ%UQHdk?R^TawCF?g;CZ zWK+)xK+ejp)t@i|ulVCmIS3lT3rKme*jFtdG4g9XdwgY(UQudjzqmkZXv%St9h z4%Ghr>`Dt?o$v-N*7N4zgnqbf|Gj#KxZ$w5b48pIN9ie#AmhKc1+_gN?^x4)9+SA= z4+11Lb?@HVdfs1xMMx)rv`6NaCaajG@jeYC{?E}@Z=UT&2#=+FV;~SDjE?H5o}ORy zS_b~voMss`p4$#T(W>wYk{N^v%D?yjqjHI9yT23htMToUt>@Mjok&4`{u-d9*KO%e z*89q(0^%kA?;D1Z3Xts@3vPsXwlpub$*2U*Rta!&YCOh&K|vuVHY+C=48m7!_yDW? z_ZzAo$a!2vtDAGrOvg?yq^r&=&|frui1_iNEHm>5;%iQX@f~YNQg$a1_%euJeZ`lq z4IC%0bLK7s`tNuViR7cAs;NvEkX_^{2i9`zxiRt3=bYkgJ`) z;^BPTI9UPUQafi)PG6k|UVdA0uAJKzx$EoV@xTSF8Hz3D@q=U{VRo?^YZx8Kb9TW) zepGp6ot+TaFxBR&waztn^j&-Vcia^px2EIs)5KV=E>_8T9N|_!1=OVKSDV=3A8&o9 z%nJ%CJbcsL`Wan`KJX&Ia|$<+s#G1qQ{4^mH&b4@UBwdwZ#_!olZ}>NXj7Ty#={ zV0QGMeSR7Q#6Y-vc{7e}SM~H(-Q`~1Q7@Kft zVEV2uP429h2P}WdrWlE3${*i}lPSpzg}waO_x}itqoR)0iwN3;|F?Jgm+Km8Wx60K z+gU4bUDz!bESFVczvferGi01V$iyN&Pz}Q{lcui<%81{uR?89 zkQO(1i|5OQUIC2PE9fgheMe0Ynd>13n)R{ZyaI|6Om`+h#|uQ=@T>tQf=>)>!YjBv zi%WacACzeNif)~pr#d^kJ%z44t+T|%l2O%Z4yl^LYQy)dSFs9jo!nV5|NV-{ zujHpeHksCU<7T(zUpFq&f-d0kH$N?szO6Pwap}&f(20Bb8tK*rE@^@yp+^^2ZgG9z ziJ%D}q!sg-Uvkeca^`X7J*6btoqBCv`?EB{Y0v7N33#bZY*Gt9FtM`w3fOH|TR078 z*Ot#%vceZHg=j-msc~R56?Sn@D?J@J62Zn@oO)bBy z;Gj~x%b_?~Mt$i-c(DGq`{h`+u7HR^3Hd>Pn8a{JDp(Nxw~&(M}a4sq{cy0 zn{_j27K~&20~pA#;N_Ooxzsl>F#ZL;~!KPk5{0j;YaWOGTj8=f=c;XSO8;J90*i=M>9{u-YbN(TqOId1y2)S9>XNQfU4LJyr4@jk=`dxl!vN{KusnH z(<|x<2P+>CZOMy-&8g}?iEh9Opqu0<#iwf??7*%l}ggM)+p zZ~hC;ulmqPoHa~p|C8BOb$55y(LvbW_g{}GrF$^nzz41k5nccT|HIR}#MazQMR4Zj z{V$Zk%xF)jFF_|csG=Ru9)CLo1|jwi4lpsjy8^>M==+8p;=XwVSoz9gz{jla*+&9( z{i>6VSZswgSX`C@U1k83wC#(xKH^RWA<+UjmE{H6$^3$z#OSn!YAjL3i%(=Rln|Wp zpfLy@LUNX#xcLAAV=LGIL#HrDrN{Wi4#1p+shC2lli5Q;`2z}K!P2y6#En?#d4MMv z$`q@H&grP`p=Or&)M(!-0N8^qCT;1F`r!a<{4p?{fs2d{Yd%tiQRx6M1Vw@4^S+zLpFA`t@1qUoX@ z%jdrrc}`%ZEAwDZ$1sPna_XnJHj=#v6S+GqR$WoV07L^4WD2t!IApgd5EG{(d)HaO z*6@GB$h8jwMod*edOS9=q{fFH952!>ETXC2KB*{_fm;Gb3>e;y#!tj z@~Zp%Ui;7`uK*GY)RUd3Kf3ZfZ>Hj}t}=dme(dcuQ1YBr?{<-`y={I`QU57r*EH`& z?$hoqXCe^7kpTk+7(;-%<1uow2@w*`rmohX0Fi~`n#~eDNREJs?x-^HQ!smZoD%|u z+DS=h-#@DYb)6v*jx#1-SO;}9D`P?mehkkQO2({2CKbweK`4_6jIca>5DV=s(GlC^ zfU-)pU3wwm>#C~tZr`JFVfc+vQ#KMdYLwB zYAXE3ZdBns=JXJO7Ps9mz6+|`0L22I?0C=v0JAR!XV6sabIH7MJchHsPYS0*Jn@7d zc)EaUK(qHIKRDGSs4yFqTSSj`>Z7=V%wZS|rjzomeAI%FG;;xEd8`x&$pOH)0Z?+H z3mUBusVYnnA+|vH8M-1Ps{rRj6d<=&fq)DUuPl{`3#4Ed5wyMalW_K=9~nFZ!Vnc- z78I9El5_v70oZjtMKqHcd_xbrcyi~kjOQOYH&5^-82Fvnwef`V6WZC?z0%ei?(3^u zpV^+J_`Mi#yZ;ZRtgY<|jKM+hpaOPahyU)_YpgKtG!0Md{Z7i?g#Z!G`>F+(0Fy#P zFe)?o1@o*;@RXeu(Pi!ny;^*RbY=KdHVaTT32<&^su;~lf;gVnaQp(Bh>mU%?jH>B z1Xx%KKo|<(ixJQM_sp#<_tdn@d5NVj;IAJJ_4tuIUJ1nsz%ox@ZK#^x(X8j3c=C2N zVdEFMO;+d%dekumqU7|N0`zUv-j1Y~&+IL?7-J=(`92zIub;PVFy8ecM9y{o6!#I0-4GQ+ei-M$Y$Ly(-tvt|cF&N({bzjQ^4A z2BTrMzFX}@YU-=RtQ0>L+c)NOb$mF<^yxf92{~WN$AAU{%+FU-UKsWOQnxA}B(xnE z#Qt0}7O{5DL<)!^&JL*O)v9DiIS+=Wu^jt8jNv2VP@F& z8EIUkhp=qVWB%%vFW+E9>C^+kHr0`?f%}h&+hy4JVIO#3IXVN- zgecs(-R$5#!WuT26?Ph4FL3YDyqXU_TIP(#-JxnY*BC%P9B1qC98nIwM1YcU|qQqgZTH( z0#1i)mYEvAKveC2X23}WZ!#sSe3Z_wii;g(`hXR1CV|5j5yjLq+Q`g_I?L>lZ_cCH zxjG-N%pKm*7@J1n^$qD#0{#2H2YDEgCHbrH@iRFbjkVky{7^0|5f01H!2`VTIoF5b zpK!KL%W{!A>VH2UQJqWrL1@Hf)LkU`j7Q&upK$gQKAvdP@EKnCU`+)>&KIrgz1^lf zjq_|e>KhVN4JE-udY&uw1^B#NXTVdbUWj9&Uk zMqx?P<=x#msg+IB>)9`jw?146-|@x9iFLo8)i!@l1T38Xl!;L5ARP)h3g2 zz4y*Z?Y5SOX_4YU=1b%^74%Hm^>!nD2rwS9A_9P& zG%_?4RtZp|U(e`JNgBQWU0&?9YOMAaenrT_tteikrrKA}Rz_f~@46yx>JZK}c)VT& zwvA-Fp+(xft@C)h|ALg6swL11R=U?+P(-eVH8`YuZT@p$ZWJBceuB@G6^s2&9fLb< zaMK&awK*F%NN;`i7xdL~YM^RRW&!`f=-KF?hAAg}JUoz>mY0NE{u>Xe!VjxuQRcXV z!9(9WK4xDHD!g2j!3(ZwmR-s7%S)QWpHRLDB@$h?{M*<xCQt!KR;hoj zoGw-qahtIyY@;|6@qsTUs`NL)8M`cs6g5t*ap3JSbITXXEr=>~a?xC`10)4R(Y(d~ zer_gf9WHV6!c%}nmR+v~s$)c$;!%GLVV>w%DpUuPw#GrjcJIsHRT^@9T~C1_RnjJ^a2~uwv{0ZyKTN zi`i(1QZ#YDe(sP?VEHe$pWy~Qlp4yKmr5K=Mo-yx&v`7nwBW!?|v!x?FJsp{|E$Qji}eCgG$ulR$25kiRAwNC0?f( zs~#d7P%1gLYK+yr?F51KDhslr!L7*!e6qiH6pv8^#bR{Tp57KFbkfA+MTZOp=!~K&27>7a%x%L zzH;wL)cxKqJ~+H3B&g(7D}w|p7+5?B{%$?(FAK7Ndy>{eA}I4zK_3{jUjx7a990nH zv#@LXl!h=LD;${M{ok@H?W1ixPq<%i_O`0My@bilUB`(;3=7XU^g{oo!#qCRTS1rR zhs~qUh*@F32>jND}>KGUu@11%|INb7LB*t4@?#Cn<%@+ah@=(^t0yFKH2$5TGg z)SMeu_`lSeVO`-%MbAJ@v)p6+1LQvV7hcvi`CO9@b@>!CYRVd@&In)8V*THLbq-`7+Wc^*r{*T2d`SkTlg7Z}7ia*f2HDf0f9e#ULNF0xp? zsVjNs6_;r*`T765urMMUtC>%Y_Ff+Jh5>?B4OB7J3ukg~TtzM{PUze>H#Xr8%-1r)LjZ`PULNhL~aP8z)bP@)Qrde*gw#>q8JR{+97PIBAAzw{J=Hr9GR zeUTPu>*sVg-z>g`L`A6dm@2u5VY-w4(lO9~Ao_Ctvlr>JpiE8QjLwvM56wa>c2Lp= zw|wlc%y^+?5-_7}AZ^nBt+P7T{x{sJ=3E160{=H;R#P7eCoXC~|I8*c6H45ayK1{c zSKm!Su9KVeCS!rvpR2caJ$G92WtG3Fgp2|9#6qViS=y`UmB8;CKHMKsGR`PO!`qU~OAdM&&D-U+O_ZTAYN z4g=Hlfn3JzJn}^Ce~}-)W)~|2L&XLB0h?)&tBx08ZEZP2Wtl&yRSE{I$;{o2o-ql` zCBC@lYaSxc5r&BwiTSzo3I?V`$hOfN&PkWqq@7GJW`~LUMcuBZ&!4UYD>OShSZ@2w zaG_EN8|U0=D>Sw|aNHsM|0gz4E8E~~QlgEoDGm3Vg=KH&Up4}zBY!9b@o=R%IUVMX zXilGB)S0=s4&&yw_R9qX}alC68Rq8dfc3Sb%%Kg^JEV3fpz>g>| zCtR9q{)j$B6%2IAhx{kd|Q z3+f~4H--0d7`vYxD4$}+pbTE*w+d8yQoF`>hPR?LAFcaX33F-J8+x%*pRYS2qz=*y zzBj8-%M^)c5fn}Ac&;>LnY#K$NbJp&Gz;&RKKc=p*>=wD95W`%N8bwr>i=%_#prwT zf}cBAp8S>%nkzU@QhZcfYUFIC>c~=Eftm|L8K>6An^h(>y@I|9sy3x|J;bLYMKs)J z4$~JFrmn^jr&R}~m((pS$30JGP171P4dd)%;PYQ(Wo^4VzP!2N@xN_~qoCGIfWkrzVpY+F;H9Lf|@&^PD+A_ zbN}F|vmDDP-|hh>ar7}BXY#BGK1DmcVWQ!Juv7No6#bfM9+V}C#!^O?>lFz~bAZeuXY&Q9D8~fiq_q6Ln+(r=^$`yZMa#;#Y%4jX@OHlI zCBD&X?j>SUCj4^3ex$BY4BeAUJN8H!Yhn6pP4l+4Z>m7sjv{{hXZy$>ag^5;wj!_Z zxmiQKUI#KJNGcz+kh}P7Z2#M810>S;X2d7$qnw?NJ-Xbgl;Bv)9Lms%hr@NpNV;1d<(p{xE}OH73H_z^9*z zqG6>Pp72fD19QfL?B!Z&TlU%$cZu5H!m?^FZC*+_>$ILO&ZeCoU1WZZQ3zPQSH^Ci+t(_tcz9k4V}o zdAH}j!!?F^mOjeXP%it!=hh%gt$Ow#QJt44ZIETJGmG7TgNRL+)_IjJ^V}UHmrw<@ZP(G}ub+ zcji80U>N$C#QaEOx4C!k+wwAS7^Yzg1q4<&{D!k-E?`_aDk5EyN)TTH;$SY2;*1!gkxl=^21IhQt!osK=U&kF*SAHgJr-8} ziZACyxC`o>@9HN! zk|%eroTnt9Tsq1C%cb81x5m!S{mj1@oWg8Ub z&&=#bEpt^ST%y6Ni8zPl6a3#jcwaXa*P&;=7*3MSmUd|km*iXWY|i|3kMxgm?{-Mi z%})h7oib+gOWqRmsN9iLE-E+mh??&Zbk+K5k}a^=x^=*$2ax9%(0Crs6cdn^{s5vI zR3fhMc#+b`fcpJN)ar;`+8ujnLW_HE@H&6u^4skM`lYz<4p%ene<@!$hEXW-V0;?x zTwJo8phoQmFUMi*ZLQgbpoy85=3Ht&YV{4n#I@tmKn4XbJV&?CuDGp_m`DIe%Vve0*S~t3&HHrW(S;pN&~v~2)IrmS1`YJ2#e}HX*q3m;0bS!Rh|<6q z!F8@~yK0czyve(y_*m|#Rfh~vd<1R8!JNXR<PudJV{*NRJm+n^-w!*W^l9)&6y#j27 z@>!-j=hsLhIORqq@grj8ylB&XMd-ch%Vj*5+?%{CPzlng*xyIh^~>#xk`e=rLItVa zid3um(sB$=LqKi;+`|OSAOX}o4n1)~l^_+pIvIG9HIwAc%rb}vSAiNNKa(Seu7(5D z9}wz!79X#rrM2)rpdP*?g2WcU=`faSU5cRE8OBsYY0O;;Cq-2b4%k)lxI|Xkh`iOz zcyalb{$20!_gI)##bm@yQx-R=aisg*YR2z52Pp+SUoBtZ3KQu=s9=cI%^+tOK?23U-q}Xo-K(F4R`TSuZ&~GQV02mu?_K^_ zxN3EMYC-y<+0J@U{!XQOh=v_sE>1V5JW)7D0H+Q{@CB*d-6bVC$4%TPSFdw^pl8Ee z?9;p8kuWqf4Z*ERkJ5-{BXMeT8eB%>nC;^la8cjQZjVj))1X3ays)2eT8O^QW!H1|p$(8`sW?ZpZtzGX6GIHITpk zy;E&VL4)$XA>BixK*1;h?B5Yc$}Wr@jp$K+Hc?8vNf_CqyWFGeJKoQ}0~pkADm`6YapZiA?Ce*&k#X(ce26vsv0ke5;iNtw9+C^v&Pb!*>mFPqr9 z4P)D%$xfNdyYx$Vdz=utj6cCeA~uG0J+TXRhuUJD3soV~fZVjD&HpzJ({fPOec)YN zSj>Y7;7Fzz6Q&gq1)(Yh%Ac0D_A?Nyg_w;rskbZG0olQodrG9wpW*|AqneQtIjeC} z1>Ivk%}6|o5OF(VVqJx#AbB|OhdzZH=vjxsr4&mGp37X0uU_39!g&$vT+aPn7{z(l zLW!Ytan*hLGClD~HHfyHkN#~h(Sa`IO4!RzsjbV@4{Qa#x*OJ*ezM`VsvX#vj!H^O ze||4pPXSP19OloEWjTBtq@|P~29R=gHqs!Dw9@x(6aY+WQ8c!{e`bKp;+*aIt5?r{ z8I_^>AN^>2eC)Ym+>i_b8UApKjN7_K4AuFeOTEa$6T2tspDd-Sap+a3(wJ)-2A&smgbs0jU%(vE%2>eH(Cv&Uc8 z#Y|0I=4yU5WX05D$UMz9PNeIO_4YQfjZ$ef?AX+~Lol^HS~=mG#x(hjfDnJoAW+x3 zor&;Lrh8p~Dn}}l5#@`**Zt!^g$#^&H@U^c8sW&?+}vD~Bqp8;6a0J&?j;CPS?JTo zY=Goo>z{5OP!Z%`7=3Fl;w7h(YYjX9kype(Dep4M!v~V;waOZk%*Uu4gKid{EBHjN zl?01%qK-Y^ZtW3{`!`sxz@9!koRV=_tahHhc;a^caM3)SGWyA%*;cp3kJA@tLwSo* z=gs-yYM1YM@3-%gaX&JLx0b^+O;$;(+*vZ=qPRlx#RCv4<7t*Q-|~d=%$_^*P?agyb8(`ABTsZfJ(|!7hbPW z2bl69uTT24Of2xlSO9x6e>GmZp@zgJ70pjAWs|l|&rN)np}ecnXi4n0hfT8K{MVCa z1*ZZU++lttJ4{a+v@tbGFqxoNXSJGNo6`xGrR#cQDzIIKZo|GHk_^p|cO&7K@b?G-) zYoz?4wzlv(Tu%UuZ2emd)YWmMnPGfe3o=b!9@q9EU$XWGqx!xFMCaRXff}l+ZA;%` zr-t(Ml)a2tuio>P%W7<>2@0bcDjSSeMA>RRx1e;ZJQ2mtKX4CKnAlAM;nArmp^YW< zR$6CXMgs04rmk&eiq_?cv!_yJR*KZ~CxoSw`IUF0Csy|!h5Vu)LV4tcoo`pa4K;@^ zNRW6Hl7Qri;)`D+rSyz>^c@9DlX?JC00bhX*%;`bv^1u3Al2~UhtdTU6^CC~)L>VQPUPk|G?BeR0qhg`^NWZ3T;8zQt*a2m8406e(uV&wKk)*e~9vSMu`-2|O%VKUr4expOzW$U-Kp@FIqUSeO2L(>kO- zu$iWNAMz^uU^jSJK`q)R;-HRc3$u+YlSJ528ak3CNo{-{U3x|iZ{1< zU1tbqKisRDe43)BIGNN}lr6bU8-HYZ@hc4!?`o8NWSuWTut5OF2v_=6;9jgH^4=QZ zAIYMaO+pH!ED!(~G?SPSlS#T!$9j+oLAA5({h1P6^Em%rWM%B8a$&G-AZh|5rH>zRA4x2CbBa~rpEYCT3cnC4i zp0?J;Ak+s0Ziocp6T4ztNd%Dak9OjGN}yG#3?cBh<}9-!Vk^3Gc? zPh}pDn=wg%cf%79W-l9QmO>xMG&ozqOSFAwEZl{X|Opar@MMxmf*=*-n!#7Q~# zr$x$p13_9D8yzk80+{+t@d=Lk1*{zaTiDAAzrKAMJ>p_}<-kLhAT=-g8M~7J+@-oX z*Uke#^`)80Qd&xh>T$~c1kHha{?OjIcT(Sa?g9!ga2#_H5WVbaUqtHUo)8HOdp!3_CXjYF6-LSx)3KUE%jOb-g5HpB0Sb$o z&ec(lL%LiUTZBCB9rX~Mz#zRf#<_|>VC6SEb*n^|FDBZGiUz51pLv}o*))6OD5~Kj z04hj@F0sKR0bup%jd7whQ9nPwhUIrovbc*)f@f0|Ps24jLCeU3$%dUfVH8azxJf34 zpNZ*Pugt}}A7UK6tEAH2-d8PGiQUIk^mTY#+p-hJSHr!wjjP^5g@YBa96Tg6SR>*f1vMNM#U z2_7Ig?GZ9B2a8yw&yW)1>^I>&3Q?{-?0>BGXTAqS{j2$LjU?!9dDUF*jX6E(ZiC&$ zcMi;SyE^foG?9hUW}9m*){uufmb=YXb!Upuv*ws=TSbn2uK#T}Q|o+#03#YwcvVki zDl**fCB7#VCRMX|5=`kH@s^U?v@OJ`i0b{>#m`8YbW?nJ*TOb~4t)0sEfMS6prt=p zppnKA1Af_|-%(rUL34rmu1)3vBRN(GKEoau8(49?gh*rtQU&p=;x)&s9g`siM`*sV>k zYmZsnOJc5(>j)gJ1K>_UTtv59qY-2sd2fDejBKWyVt951W=e0+|e zy^2)jd8~aiS(;&-R=Su{x?pUJ7O-w0RIZaS<&5{`>8Xq6m~F}!jv|QEAdV9P&pO#W z?>jzSUt4=dCGs(oCw$}*>^r9@gXQUaHK%6bS#UeFLs--Qd^k~I*$OT1PLuLQ69xt< zM*&!Yelk-+VGx1L$ zQk5d`bZ!w;>h?hu1*!iH@(^x^p@@#8R7DMz1sqC-`JC(-jm){A90e;B`A=@?CZPr0 ztqhPx)k2iu5iSE9ep&=*I97^GdhkW!rh$yKW~L~yu?$m%6- z{y)+pemSH9gw^Ub*#oo}(9aZznWQb{*DrW_@S4t=V~OxMAn`!GHa0d^K)=A;_bm9+bKaPUTO(Mnn~x$}$~mvOgv_ zi?@|E_k~0bzT`+>-^N1oZwTr?)f~CsyaHEmne)xta44#Lqc}VObMKQZQ=KKZf#c2F zfll16r65@qT=H1t{IDXhTTJnku1NI*+n$yO++)y0zr*7MC{dw=w`ITuH>yVYsv#yK z;tNWuhosKMHyhu{yCyfRrkX>0E-fV`+-)4`vki`E-pvc2vTmSN>os&wbmD8(QpDeA zllD}gz^8VGWauWrt+VF^?x?Kil#1{mmyfeT+-3weTqB%p)E9tMBd4Qt<9xFR=G`4+_#YG zR4*6L3eWBdQAS`8OzI`|m@h-~N3b$gtm?V^?{4bA{Q z4vUniD7OE{)LTbYwRY{p(n<<~G)O3&(v5(iNJ%#+tF(~5 z?)v7|^Sr-r{oxpA9N4VA;=bpcS9KTq?z25|NDsKV0~<5omcEd*_$y;|ZM2My6I<;U z_?bWr^0XQEv>UgAuRlbbxs7J$>IWzw#~*2`xVj3slEk?=szubSPSyJHU!oJ!(sE%D zNqxw81Dx&jQ6NEQ`Wgr_X&;N>(`S4@Nk#gEef5jca!(4Vp`}t7D!P(q1|(_T_*b|c z-C$Ds=o0+zRwJG%dS1_ZM=d~Bq&SSn*V%FG>3{bvXb+H<>>@4?>2aWyjfjl=*#kG^ zYSOn(%3h(jn$EAQ%}{y(p#l=F>5Ze3uTy3{b;;RtLJAZxE$c4c>&Z>bp_9kixs7KEpuDce+PDiAil_D3V= z>qNtXtm>6LL!G{1EHhznhkxhiZFR5D>slcx+#?92kv@Dwp6o`E>x5#tZ|#=TvY>4?2=LX3|-X8G;y?SIRC%u2rTYPZ7n26%7G=j|2Ehy~!JF=S6QH{WU;Fu{+3rg9yBoOR_e=(t2IHIPb>L>*3@`Zx8TVxi2dVnu(qt z9Pe8679X*k#=l-5C=fHKiUNC=kjMs$5A{FNeCIfXP~aZswfE5Cni`0Y8l#U^AyewMm- z50#>q|D^w;xR)ykR8oBobW69?uH7oGKk$z7r0-gX&V^dwdHj4GREoayt+C_d2B#)6 z!+6Pp$q%TgUlV$T&NW%<0z$=)GYrkZ2CV-K0zF%VA;0Obwz^d&jy@%)Kv6*2v%w!neDOl(4YJeY1fd+cDa%6fR5 zp(9&@cxtfp)4UP{^@=)_ieD0nh=(3O{sB%t6%~AOBPO(F-txpUs4g%e`gK==ZnWYf zig0WB0oAqj6yhr$$>{i4Sg#x96JCsc!-$;tyJufI+-4GGNPzu7{cVOFlxtLT zFup4y)|?^Rh_Dv|1CpYAMcMvW>9?a*yu2-73_zr0j9eJo%`v^*FJPr@z!FV7wAz}R zqyBo}b+k<#7`+BNzif*4_8jdc8Ad)AHD9Ostp|Lg1*lev`WOf_mki_1Xay<@=(Fij8k$F#)^X9q#Bk<}hO#mYILrQWPRY7hmS~qrwbDG+B_i zF&LQ9>OZh#8?Rm!U;aqWnfV7dTVBs|H}Gst%s75c&CqrrTbQ_}dts;^*2f3+f^YY# zac)iN#Cz5lr6NNsXrkpmVB#bqLq6^+5|KWz_<%xsAB-}=11tQ@eDcf9&*;>gbH6wJ zG2*DfZ*Zc*fkAK4%KEbF@{Hii475Jar^>+t)Zn*CNNjV^Gz@&r4q)8XDy>gJ`fd=7 zI?Ml@E>?$HTaNh_HJ0jhT(#mIm+ft?A{WE+Mm(?w6=45W9XuMa+~sQR+5Q0QF!U_lxR6#?7S-U?`Wr zrpUELX2iXICpT7Zr}E%I?8Xx$QGT5?PF5C=z&I9x(8Ck+FtZD)H^{hB**wAN;$5z@ zS%b|rZ-cHm!p6eN%F4-!FL=v1zU}!~K@7W`$6EOuRFR;f0-74MLnR7a+WK1OF)6-R zFK0x`R5m3*Y^Zi75ljiC!v}vZvIy_Qr@!qR%`;ZXV4jUpr_I=iry+_f*q^8=nMK>6 zX<9Y3RMvpE*g>qhaf^`9P{1s*E^Y7LyN6l#fW}X6^D^Hgh{N=D$0Xj7+DP@w(7bC` zLoM|g-6O4Q4s88Fg9$r-OG}IV7|lY=hYvRi31fjE-$e{uK7jt(+S(e!Ek491#Kyun zC4i)Z9YJ?sdy5`H=q*>`hBlzA>M1B?uI<22qN?)t&xFZY?q&>P#fP%D&mnuX8hp8G zyx4q$WaOY_CP!x00UQD-b0VH25ciEF2CuaKqz_})VH{MQ>AQ)X0P1Cl2u$c>Gt|+s zApeYwtC?7X=jy~Q$Oi#n(&>RQxI6L;kX;8~pgvew-|i_1PH31ue}#yyf$L@S+geqV z#QMNCZ52mrGgzcVo-K>%)g!2pBErKPz;3#sAuDn+sZK%RC947o@t2lKyzJA=!xu5> z^ry?2g3J$BRAX@kuM_e!z>Mt{TsznN4xW&K>+4FFb!ugK0lv1zfx9v2dM8g!T7d^4ERb0>h8Qj7A|VtPq94nr6r@XnI6}Y z|J1SF>#WlqSZZf(Yr7!1P4+@BDug14qtoatkelGti4 zv;ARkE;ydHnOSLvG85c9HrIQEnuFlrDAFHRiz9ci`dPz>{B{|Obns6_#Sz$^gRG04 z$Z<_nZSGB;^cCH}^1MJwV!2;kU0t1>5`Guo11YnvD42%vn~XXK;A2{9nSRkvc{H;p zcwc4`o8?yaln9-A7)$G<4jpFl0}qz@TzY2BUqtj7Hv?62;C3VMQ@akqDd~w#=M7ES zs=89BTP@Z!2T1LRl5-L1cV!3ok)BY;rimhdXMk}g5}@Dmu@_>C_X@w> z=SQ!Tc=zRt3fTI-^IeV^TI-{I6x%(NdxYjG$jACr@*}>|D;y$?x<5%QXJjEyaw27Q zPaghzWat?g=RxMQ*`1D-_#(1LU48m<;FFlpE8%kT^2k((AtSF10^h9w?z!W*1zJY6 zI0fk%mOfUydo`3r`@OeNU1b_0*Q5GcWk#1L(&QP;Y~~ZpaXsC0_atzkfQv-FA+V+} ztfZ^bt#w}gJmlZD@McMiKK;YSgeneETi((n-ilFS`Kw91lO4T3t_2uW@s&6yD%Sbw zrI9qI-QU^8esGsFo zl5A=wT#(^SIu9K_AmDuW=cBkOw+PQL13viADJUAP+(X`9-g6c=*rj;ELYB`||Wsd$&lEmuKT+8K#I=QJcnE!pGTB735boQDKTbrW^ z!B=?qF9qL~va}8Ra-~CB>GrP=5bV51bs+l^{^WXgr&EwH|;fTlK9n$zh;xgTIC5aD} zp!wT=SkCH9upi0s#o_7Q&4nf6le2JRm(PesJ9s(8C$E2U|K7BE8Mi+|S!t>0?Hk=^ z9!SY|El%ep?!POWakGw$t7PT`3q3Zn{c2R@Awp)?S}(NEW6*eODZeZH+|w_}K3P?h zMXd&susR8kXVd1-=&sGJQ+~|>zq97(j8EaTfG1@fc^ezHV)NK=S6TEA z(H))pUK6~v;ka^Wt03|3*&rlGO`5k7uBKAv%PLNLsozr~oI5sy?NHT7^~b(rV|RH5 zv)tH)#g}0=O^CR*vG75fw7Nz|NFah0L1Vk+S^Fb~WYxKH-!mT#=R&Pw;!jZ#cU)UG zg7qohf6obO|C0Ol#jO}lpZP!-$p0qDx*AXITN;{I`RlGMllS;iUlv{M)xBQoF7SDqvxqx1_J0^AvqRe4^HqXT{g- z>TSH8$p1>lK07;m0%UJsabPv{g}U*-)0Q3RxjKU>E}(jnX@fA{f95;z=}1N|=<+B; z(DjJDt?*qQz7o#0o-LKwA>+rh`<^7VDt)Jd?uut}Ki+(&DWLzd9Z0b+9HoD+eOj)2 zW4uz`Hs@$LGaA@qi7V&Czzl#;3xDDNzD`{6^ab^V4WlBey7i_plw9)qHB=*cvAx23 zFK?YA8Vd;qRaGAotvGSfoGI4M4tTM<-`i_ZCiZwwR5-Mxd4~O)C9zzV!{){xih(k( za<(rq0X?wvq`WzvMgrxumq#ryhrn8aR$CAjcyL>`XJ5qqcmLJwF-qT;mDEtK3eVaX zdxm8#-^lG-aIBi(jBc58Mj#fW@SM78SR~R7-(_-7&Fp66@i+!(?|W$$3NAGqzMx+1 zU#q&L&v=?QYyTNPSK?}rdSmQL%guQPcjQ#~$rA`Wi-nAx3*>N~mDQ#%C#o{?--Df( zBK*0YeU!{>jO34Wz{Dfd2!1l_vqJ0pd4SwikJFTotvo*0d+@yCbjY)UZd5J4@c6qY zPl&OL`?+u7)LPA*{0+ORgCxqhVG&sl*3N-Oyc35NdBS;x08`*T0OqzjUbzc%uHBs- zBn1UFPbb|^$;rtOT1P;}eWl3+94>+Uv&b8QjPeF5CSctS^p7BzAdJc>q4DLL)>x8a z;@fITmF+V^-bdU!Ae(&JN%`CI$xTYRGA&JBHbpg1br8_Jdt*`%Q4mcf{FpZu0P$Gw z|5kGPNKrISt)INx#)4~Qv|6wtoR|b&a9l} zv-lpReJc2eK6}5Cyza|a(>Lgq@5mq8ICXFpu9PmNComLN&}q=-*B1ySH!1tLWA#rv ziWqvnHy6|pv?@-8oBgMH6CV$c8dQ-;FJ0h)$kp2#1)@S8@k0RgqoY$_wEp^ay#BSz zjAe8etWc!x`hxv{4){J)fVltFD^%UYcklRso;D9I0VIkyh={;5H5_kX_Dcvr%ce3g zO3$-|;TnAHpZT(!$jMwg$foI|&~IT`uTy@bAt4E(T9>l5{gZlmW?94e-=)xHT}Poy z$BszQCna*_CYo+%ZFl+18NIqAO2Ri5MPKi-9ZTrw9pAUd{qo1HpEEl`6Glq=!Wtoc z*;BeRj>6m=y;MPnn}2>rk7ZX)Af|GUeei2#V2M!8rIa)pSlVZsu~mt0%am7_lB`H; zdIV(5?u)5XYjvOjKuHd5=2z$zOH28zt0F*!oBpB}7^wgiB+iI9Q_zp*v|lYml?_Z z&;??XxctE`IE3=z+_mg%Z*2ub?^aF4(26!Hie)^#rPV(sPNhGIm3ImfNlsVD!!I{>66JTxTXg+IQ#-Yx{ZV3|06~ZE zmq+7gA1Fj+8*+2jIk?iWSNNX5jd6MPv~5~a(jnlKK@ClO^Co={n2iI3k`xj3hrp^a znp*UmcRmUT|M5z(;IgtlZ>)v1rTET7{W$r5?A;r8NP zh)-KbN7+<$z0SWHL{0tanRSgo`#u{T2130=B;N@0e)frr-LHb z&y}$?UGjXD2m}L##_1C8K5`1QN|YZM=j@9V0$}R3 zH4OR91nL0%g2()K`4#|V%8%eD^%DwmAfWrMd5q2H*Sg5zITpN6b+B&aj$$VLEB!Jo zT6AB(=Tcvp@Gos!DB&vWbzykF>_X1J`t{o+p7b-s7@7WeGPCaT{L2X4+{Ojh3I=LI zMBzZmZYsgqj#RW?Ev3_J_dXN;gfqS2Iy9j!$mS z?S&0(b49zB{5THRQ^q$hHS-pZ!)2%|XI_6FeEnVEHBPgN?^=W;#*uaQLdfSz(~D$P zV^_-Cg1xDiL&@rWKhCV|Cd)bHyBqLe^&J7!k_g}sLvUjU#W%P~^pZm07ra+My()FH zw;BZgPdO6&JUs*~RTSo>6ozj?6D7*WqF8=#lQ|&okj;JjZ7uc1M1HftTakl)){OTw zH4Vg{Xn6`Mba{`Q>-5&^Rt^3*ga@Y(XMX4T zY-BmJtV`9Ia>#7IH-4>(=GNQ*v5&igPoP56vx{2=tehR2y&7@G4kzF7LsW1y`_ZOS z_l3ig^%7d{_m4uJV#Ep@p;Jc&aZeU7X z?a@?xxu;c6)=kRiris!;t{Zxf3QS425Un@?q;n}= zf26+}%n~B)-}S|Tp42dQ9lRZaRv>uI&@}EPSioQDgN z2w=c#^R31OX4c0$E;(4-jG;4*0zW&5NeQH;ie#K@67~Jg0;g8kSoTCddQ4f8CLbPY z#AS#;0)}ECrl#6n3|fw-HkMptw2Inx<`HqKc0J4P&80YEVh_cK-oK-0auLGk-(C!i zLXHv8<(`%uqZD5MvWUXf<#*QNcMBPf`;}d<($O3MHXwQfDX~dS?Vt4#edGT(Fcbc3PPU)cN236V)EF4tx<-Vfw za!&gbnHGHZj4F(0u9q)&vD@B!U0eLc7=c9blD$zU{|{!l%|id@O@*u_af|1qJJCG+ zRd1|VFPy9-@AT;o}GzWu>Hw#fXEDa3RG z);I|U%MNcXfZ#h2>FB!BE2kyqeY6EU9W%zO?^=3+OFxWlW>O$|u^pYK z^x-uCmV3)RD4B|1biZPX2K>&Jilz}SLIZpbQm#vgmti6cXuyHAg`AXyvT`R5*LVN9 zdwPTKsYTtl(#pnQu5I>~diYH!YoH3Fx5rV`4{ZyWND`I_9W@K8X9t|A?V9`XfBy7Z z+fzrJk&%&)um9>5=!DGZ=@eu0T+Yph26_orE|0%YPS%|6Jy>4bJ*K=fu8Mh}FooG! zl2dta?775c*VOr%eO}>53EqIdO$`zz&X4=m9D5RE3d?AU6vddiiyA%iLqq-gm!9H@ ziw<7*#{W#Yo@{e{iE=?_7{4xMgqbWWb#ivRD|u8;U-+^ZTDbhLX?h9 zO|3r|S1?|bo{~GK)qW0l++q2>nDH}m{NBtHabFUg_E5Bk83~1}>T!!(YcDZ1H%Ze! znR2@2wQV?5%Z&eV`*S4sOeJ>Ju_~bI@)nnWvg}#PT*(jDLUd$7L#W0vOnFP|G$!$r z-kDDx=M3g|(|j5pg$RE)jRO4&^C6BKw#!cgDf7Pw;dKW#+ug6*4DOqA4i+|CDP|zC zyeRiDwr&d23+p1|cnk`c?Kt<3MyZW!1Kvg*o0^)bv^d_adm$%$ehzBV(t|8Z<<%mW zd#hX5I|{1SW|-&q$hpGb7XLRzLGb&azox)0K!YZRSK;kV(d*q=c%C?iPm-pr{jTSv zP|vIC9%nF2aT~ zL;br^To>)CODPUP%?=_|WsYXm-dyK3gZzHpmy>IWz}-O()8WW_`9MZ3Ubp{wx|%L> z4+_lrT(fWEw~Nk>AXTn$Fmg?c^>jbf(lNKrQSZ@6oub@0oXQZosFl9KWaQx!O)E=U z;ket+Zd_sPaO`6>eM-$a@QK9Bhjgd^jdw_9Yx;sHbtQv{v!2`97N=yz=z@I}UtHVf zASynS`__{@1S=2SU0@0QJ(D}_*Y7DE*~ks3B?`F3_WJC8 zc&^QFca_e*6(&_)Fu3aQq_Wy2{$9%PmTVBbp?dRcfP^YbwcCz-( zZOkoPfMJgKi3wgJ;>5@ITy0nAe&%5Cum_MFGV=1S()vT!0q-vG3@q{i=nf72z3VOp zQDk9&ox3o6q1oNt-JpKj!%Vv9z43m~r2mWHQ2~>Bf6brOzVh3YEj-`^9Nn^VAY@3> zluq&~yenNO88NnU)v4;<9=&g_qDzIQW&@sQj;~S_Zb#wKnbBFM_8rX|goZTVjSBak z)y2sdRW<%yJQU5rqo3q;n?iweD<)$gF%IfihcAMCYukUqu9(xKdK#mX$Xi@MX5L71 zZMNhhs!v#Fc68U36L0I-2+81Hzpzj}z9x50JAfpHKmGkC2$^PEdy$WL+&gh<)g-pe zH*oVvNu!%XxyW9kYhK2d7T3kEMiO~`E7rL*-o&MAYtO#Vanz#2oFFS3cg^E!(9hi4 zA%EW@>pgkqf=#@APlwM_n9T13}^qwWmm-L~sLLjxZ4jqRAHdXuj!p?A+=oJ7;y z=5D~~b*mpoTtv4gNGfaIO?ha_&S5xYhE5)+p<9LAppb`V12$*>($tqdrFWB$dYma% zzs;4kkfJUhYMCTxRT*3qiZp`YH2!hbSb_Jn*FKm`?JdNK>1DnR z+%9~<@vl9nxAC^9NM~`j?1dX|%{Jbxb54o+1U>sJNeDj0Gp7HB z`FgKUR{B-%Ki#)2YLwQKG`Gm7Rktp!C%ePD)nWjgfxkyoevd5@DM20?Hyb7TGg1T^ z@DiKHh>^Dg4ra1s{DKGLkEH+mg$}*x>sXxnEtvRzQ2zWq%FJpV?rlz(Bw7Ca`!K+7 z*~mn*ylWa8ii*ZbZLYUZK(?}ze&A69b>zrv;h-1FbDn(-=~oD2!>{rwKNST?3jf*})@ z@qeF_NTL%HNMrlog8{#^nze2f!zpq8=D$yPmCo0Y=CJ<1bHm2ocoL1tFh2b}+>k2# z{KC*92&ZdN{KThzx~sNwZBE@s#rycE5_SIjf#!waZHceQP5^oEQ#Tuu^j4>@?3-IdEw!$Q+?xv(pU8D1^2{u*Sa;W@A0ViaWm1s z?@e!Ga6hoV!Y{)*YNF`kEa>)>nc>!{`QVLJRu+x3a5PDLxq-;kSIIau(d=&C9~P1> zdxqGeeJneN&~o3(SQGvG1_Oa#S%N4BQ){O& z5g}=su_0MKTvfX;>kQRCs0@3onWF$W4~T0RMl z)5Ohc*4#$?q~Md=k6RX9Y2&KzC$VX!;NE8&rG4#tczNE2tBD?`_1k!K>3E@P@rV$mW4RNCK7o|(b{N3^fkBILiCLKNQztN#n^#E|Dt?P+5gR6F@$bAp_5s2s zn74mP*_K%7SbK0%Mx?}{7De0iDbF^#O}?qW2LvfUb?7Kfnf-mEM} zmcH+g68Szs4l4|!)!yS%33UUB61;?$78dY;wbc|(0$dKJ7u*q#*zZ9PWP0F?e4nb= z-$$|X1*OyXDSF3h%ilL3961SZ4aJXr5tS;SUCPFy)tE6_Rw;ljNyyW))3+GRwspf% z$t$0XrtimohxT-?;kc%$;TIbczp}#90lzQ1PCPK#4H&G*2AVGPXzMT#^7cMMw(F1_ zmhlK?h&(lrbr{7@fpy?i=Z{i?G?x_?KAB(!^#>o2@1Z*p;^MM{HWJPkNT*a1-tLbc zMOF^`>ms#XX=K<>N%E~Y@4(4tw7tK}HnleBO;c%IKjX}IG>i_f@y4luHiufw0ZCH1 zvioR-%$PfN?SOnxfBuruXhr7O;?hYnh9^q)&tW&l@1sTdFSHn4V@5`Wp+kZIZN?Rd z*>>{{7So?HCAH*>@Q>?;tND5;Iiq8Y>&!6YZv~3h6M(E?M<4A;5iMl zFL>rmJ8!7n4b&3P0p9YV#@;nuQjibPB1y;mAorT(l7ZHzf@%9dz8DV~8~Bm*B34_vN|tWc6wT|3|IR=t$FZ@qdpqZbW|zwu zk!Ku7?4#5#gd1P(uUQjH2yT`_TeV z81S*l$qvND$5+76-Yf}RKHD;YJfxVx3u+KYuOXmO)mv)v`GXn_LO$D)k-Uw?D?z82tW0AIaRNuWHUC zKkQaG%mMRJ^@^jDQ|_aLS7q%@??Hul?*)uI?2Y3H7sR> zID|GFZPnNX1a1~$biS#K4@EcwTmQimn3qMgflAkCzm^!BrEfFH12uV~-Dc5#9Uw3O zeSpM@{VjAu%VBYwV;2MjUGY4bO~xh25dtGp5&{UB{sAp6#oh7gJ}O@&yUsa3Q%-v! z#%_}!Ih`UO?HV`;Xh54y<+>ibjuuEiJ7kNe~Nh@uqC z(8W=>Wm*3U1NM?ButESPU61npK2q&Tun+$7F0QtYfJV$6sm#2hkQQ}*w%ZkV`PSDT z6thI?rN>yfWd0yh9~U-jy{@al0D={(@XfJu0xx>eFx^vS?DbU`dX?Euh_EnV?Erzh zwHFBEc0lrlTQd0a`^oC(vQQroPB?)vaUMF;_4n+?KfK`%!ov8~^Rb4Lj1?is31`!? zXx0T>-65G>XM$Z?_I7aG)8>oP!ans}E( z4Jc(02njY*K4l3=4wKR(tUfIeR`|3z@&mEMRV$9TU`o~(vO}b$V~XAuY0|0uC%k#t zncR9WF$XqVqQ@4nuU)IT)N^w;%UeRUZm~6<8PzhiFI1Iq_=*jcIhERNR3QrH5TTrs zh-rbjsu-yNZV^EZ&m71uu#D;tl{GM+A_6owmTGydoGZuJ@4T!%<3aTOQ`p$ew8S86 zuk~FIIcvaT`99M*1hqbIkhsTq)8)_jNb;v(z`92C*W;V|ZDt|>u7eQlfW^p0r2p?z zoAj>!)dcg3{(UMI; zG4Qdv0^B3wRO`5ntN6PhCXn!{5>`)j-JJaR;Y08Z+fMC2K%N`U4&KZ}R_O~IdZl^U za#X+Z@pLI{t+r4Y6eC|>(|RXORHC4ehH_1OD-FRJ$0jD`-Cg!&P&-IeRF>ZO*^Qfn z>HNM_Jq6-J-x{MutMYJabt6koKWxv=dpw}I!W8@)=#zQ@nLeNlL*Qk0mv`?PWXKf5XAO~lV zm4OJW1?pO4j4W#dr{)^qd&v)~NAc{WWnJhdP63vu|Eg3E=n8-nWoxlx2ht)jh8*A}5u&@b6A8v8@+4Qr>w2{#dY~=G=3{-9`Slz zY{e!{t#KT1_0(KSTSL+KW>sVLj-}8R8R*-b-;;Wx0L%P$0jX2@fjf3MRkIYqpgODX z^*;%HmwFGd)Vk+zZdNYPnW#3e3c0MlOW;-bX}UFC4_-ogur~oBU10L_whu(T#{cfd zq@Vr~xmx#ZU)4{5oTwP){HP5ws6xXT+ zQ%=1){Yp3EWQjS>Yq+45;MxO2loA4_utgE*Ml9}PKZ@s`$&NERnb`ETcUB(3^GhTWh&s95i!46}`p+2f4=7O?H=Oy;ZpCKriNm5vNk@oE=Nz6N2m8ad7AJQzB7c{ z^MtSLEVOMz*=M0OD_sT3p+BnQS|CPTirctDNLKC1D%%5%DX0)S-ZgGR7Ddu0o9fGp z)1D7?FXMNc)$(%`U56r%`MYPGeR> zL4v4aR@y>}7E1%U`F;`>5z+fSELr8?f0XutO9)yT;As2Iy)p$g?4tLsB}~Xf*(l!S zK%@?%%szwsB~R~tvU_UXoq`R7h}m5dlA9?%(mv4@cz3GqS9>>EqO(WpG$vOUddweu zj~bYbe%!GMi4v<$*AAQuk&e4^;_^OQJmBg$7A`_Y z#s5}I6IhR|tk8h`82cjFo?s540C1ZLhf@NIe6jsZ18|aH`xQUm>x&lKQIL|H1Rr_8 z_$r*CkmT;f4L5bN5-`y__j(k{sUOzdXUX>b=jhDbteNgnL4HvXi{>x?Sfz(jI8Fp+bD~H&P4+8FR3t#; zCaL_4tJSsyk9wb4W*R=9=dd_MeaJib>TP%1@Bz9%8+^0p$&77pEzh1Yg zU3+$t6w@71E~%r2DQ-BrAg!+1R0xC|3rq8b#l?#Qow4tfqO3u_o1YBW&!sCYT`!-l zeKHP!pdOlNtkXGQM_QM*-eh57T6!(|M=B}HTj*8=#d8^1rEtDT(3H@QlP$xR2S_o= z&&^8cb35XBo`RGLDoUQOt0)xhR;!>c7o6VQMcp_CwFVxgKr1`N3~~UYlJZWs4YtAV zy8FeyZE#xU`%WP6TT0VvEc1dE6vVB`f_5oBP5w$~j@=SmQ{O^htbm0sE$isGGusq_ zludh;zw&SQ4`}!y4)Q0V;~k0O)XN=t?WU2h+WNXY9$jfZDQKB8sb4VI5%it22hNwS`J>ISdAo1@n&4Sm1SZ!aQN;*5P+zPj$Tcz7@UdQQS?b5z=i z)O$xoJhbx*t>WS=08rHRSO!)|(cK+A3e#&(`P8FH}T8rJ&yK(q^~mfTm3 zB)^NPUYR-z4j@s{(U!=`dER|J)!JYw^F};8QGc1!yjGlJ((s4~;#8HyJ*_kpMUvVK z0zB)V6rGmlAAh7}3yZ>ak8R8p@4{V2ej`7Zt};SXY03xb*d=y}gx?$lG&Z9bZ|ANv zFoF0V>0AV>0@!iI>q_?`zoZzb5NT^wj~c4Y2+mfeZbPXm9R$ig1g+K76E>@}q+Nkt zT&M)Tw(FI&NgVJ_xIes|_&a_Qdd_&v$W|P?+VgJ-yx?^f&&R&uVFkra*JIK0kwOQm#$P(Eg9Z(I z0S}GpjBB-R)yxT`U3|y!kPE_)NF|jFH!eoS^C0C+7Ii!D*7`8Eki55xBA@fK_HtL5 zjYw3?@l+GCIT2B!m+Co9m_t^zNF0iR>^;5z|w5oiFVuAWYQ zx|pTb%b|jk@kAAVAbkfiJ)r=ylX8j}cnp6`id))cp`%M_4Go3J8p>+tYXp;DnVzM4 zzkBIJ6`I#G(5D)U8f96k+~W@kHwA`kgd6&$V#RNv7AxEoWnn+U90B{vhYueH^I*$7 zdW5St0lc{4S6A-^OP(FgMW^~*czCxkU~y~!GY4ZGEJ_#QJ%$}Rpp+Ow30~Ccge3{u z`9g4xL(%Y0sKyH`7Zd$a^X5k^Q=1m;d69lN&u&5b>Tp@ym zX#B!WpqrYNJ7CVAwdx_gAB(OICIW@!e3hwYhw!%ag-~A%mms_;P9a=VNJ;g@`Q(*V zue{d1JsHr@xNSHpn$v1-?|qrB<;C zV`jtpi^S|gpM|o8ijfvkg!~Wih=Gz3Oi8ivix|eaX3(T7{8`!@Dm0GzgOD=K?=^dh zr$MVs86b;KDbSwGgdAY2Ne$oIY*D4K&GV539faPkFroQ{1!VIG4ODN-4{T=tC(MzW zWX~${TjSI4?kZp*|B@!@=3DN^p5<8jo0yYwFcA;{R}DQ_7z246&0ukaSpm4GkX(1G zW9K#hE(6p4{05yybNUf7`5T3&&_|#)x5D&4qpiJ(6Za&5izioCMh+n{u+VS!!=xYN zhQB^<7E`X9U9XQb@_ZnmmjDYMyzJk@=?IdpzMiDr>#pJf0bMzDzdYo$STX*a^+=p0wKsM1zVa!y-=&c{kv4=JP95Nc&y4NDY*2YGG1` z1rK?sO(YcK?9%?n6#*>s>O)aQEBxGM;0OFWFv$N;hCr;*>2Hq~682Z327hvtr6vhA ztYilB8OV_T9%?VPEwJHikOv~5_Xkch$Bjjw8%TZOzyD8dK$S4_B>aB@BYK4Bse6p~ z_5VXOQ~D|r8a#N0O~&=>|L+tAf@+Kd2;HuF^J4t_7(%rugGd1dS}dQ2|N9|~SYN>) zj&aqK>HnQT#_HE8CAz!o6aPbDr5%bH(Ei`I!TqL;|NqWRRhaz$5K@z(=;^xu`{V&R zjII=uivL4X8WHt} zo;>5z&K1e)lmDGfe+Gu=;1v>$*5ZFW9e4^jAD(hrL0Hxkg8w@$L(bLoXK2eVnEh@4 z|MOwE3$Ow5w!-0}I{LI>vi{}&yQXNC7&Vm1x)?^~t4_}(I#vXBDP&x2Q?wn3iAh)x zTC@8s5~-DSGcl#J+5j&4`XCVT->?a4=vj9XKNnh&&;;wkqb+Y_MDrJfaTj~@R~n+h zFQ-;gQeuxn{x5waxhisQ+F69_%NJq%Y+BU9p|M;yn7f@m(T|#{MiF)R<2@NSwcwld zQD1evtc600U4N$@Yje%~>^D%KKS-S7_7Xi))w~Qkd)1}lbKIHEK;BZz%*xrLeG5v0 z=|<|l6Y|Bsj0e3t16E4a2A)(`wBPKz@aT^Aq{lYmNi)0h-zDqOf~7C5tSb* zgZIXJUp#=#9x1FZwXCR}htKw1ZYMc}+%@*wot(+!V4p1lR0C$UU}-38UOD0E$0w)u zkEENiT8Ctq#6k_L)q;M^prx8XVuPPcXlqY#$uE>TdwDoC_1>MUnKVBz3tFkcwwoX2E zs&MMb-v>v7-$3vtDd`+VFX(-b>%)XJG(z@ltpat>ypuj!Hc^D*;M9WK>n!u5&V~xX&~+?Mq|mMOWY4b zn0utKrqd`nJd-FhwaedPxtL?B{jhg9<>N)SiAppgEUY{Av3gtnqd1+=H9Aw%MY0$K z!uXMXG3J@*ZsURR%_POk-73Gs?~l7$$f<@mzbv<2{Z*LR-`@{I3xHOEUYfoDR*?E; zzFYNJNFm2MAc9$Bgld^}@=t(en{!lw3zR6VoN?2?{0cKQ;--qOqQ_e!&-<0Tcz?*;DIB1b}J*NZov`e zB2`H9W;(j{(Z4Ii!VD`9A0IJkl>cY>b`iYASrhF1uRWfE-pR*Y51^D45EWgDxRDS( z<+nOtyX)vA>b4So##UIhI+!9U-LTY$A5Xuc{%%N;tNHnm!W02RM>Q)rn6<4? z2|DJr4?;^a1{rfjkO>D7#__uE+kXAhh0XNg!*JYXZuhO}78b$-I~I#TQWagAHbxX9E19I1(bCj!Cro&N{XUMUPFn0?EM3tb0)^UeHNR5V6xwD z@$oHdMRvF4L+(llzllrISB<&snQ=b*e(V|klT_*n-W`S&*GkL@;)}jD8If;x9OhX8 z0bFDRxx>(?<{Akbq2TG3t%3rF_n03IurI^063y4g6k+UX0jbT-<+Wk zBLD~lJpVSHr34VFGe$; z>Y6vSRwg9REI)7=rz9swqI>9QK-E+(OsTu+{5_u)@=%nYGCGQ zo;?g@%F_HixG^d>Eg9Vs&<@60eomN3Fqm}J}4*K^2r2klU;_;h#;3w0jBTrj%m>7#QUC? z9p}Bq21u?4#6jSW75%9!9f=MDI|Al|2Okq)4ks&XpVIdqaZBShi9^NF+|OwB=4aiJ zmlRrgW1o&XC~3zzNqrmcHD)f?MNSt2f z=4r&epN8Tsv9QWk7~|Z{!O_;vpVm?x@ki;%e#A*&Id5^K(xc_lr8&A$5Yx)O+JGi*J-d;bDBRjt+E-c{ zg@{)tfcUhp_TJP9rykclNBq=6(&w>NLM)$e&a%IFBq_j1z)@@vcksG2Q?-hT_A(&t=S7Z%v3`9+pmI!qcLRAf0Y zB`|#?QfWLm&c*%~j6}8pE&jUV*w?dK9&6a&ZAzChN-b9br$8d21?l)G1`*!b)dMvm zSyfHHu=1?5iVE3n*lTWGR&Um_F*B>4BWC-&1QmD;9$c=({+z-wgmPbuo?Yr&LnKvfVPWZHCB)=M}y^~2b``}*V zDOF!#h<~2cdkMPx`0V|`^YISvjVEaMd3)zY`8d^03h-yJ zpTPATRd{jhs6PniqHZBcIW;!}Lva*5RFXC~ahY1aRm_9K9LI_CfG!R@Zcs_S${Qsls zE1)Wq$@7({# znl)?98sOy@=bXKt{RGvFk^$Cryo6VeEmP8b9C)xS+?1zce@dW3c^K?2Q3K*DrtQxEpEo?V|mC{*A;g0XOq*7VKLz~)x6 z(24ySoG`(+D1Q?Q47KK|2%+Hv9Vb%qBCt!~4F89mt{79JYh!I)(6-pfYYcw2=f$(Z zLPPt9!CXfC<`clnHrhnD0TRL4{_}lii^U`Blv6-bL0Eh#3M%@=vi3q~p@lAYN2-vTLf`Q+-eV za{z)*70|e171^c2$i6|~H;nS25E*3q=NJ}`E%yraZSBsvRciV*WZwTHEzEzx3`kJW zd2Jvg?#GWG1-i9W_yGm~G>~Zw?G$#``B)bkQfYz$6H;qx9?HTV+nc5TceKmP{2w}( zn3x!t*zovP=B*@>1OyLl&!)aPcWmD{0I*Xi)h4Y8@#BBLm~MwwGwlau3jRxWtx80F z`2}4jej?P|m%{e{G;xn3^fW{<=y-nqpEmRPI0dd;R&&RHJFWg@`mrPBXs+C0O4De={+0%qafv??#LN+sph@aDb_jx3UZWy^;TRk>74@t6(KjSoirt6e|J^%{MkP zgJ2Bk=q3vx3Y2L?%a*o+;B+7|&mX*D8Zal2 zVL+RPVRDB78C?6X_jFSY=Fo=66a$J6Z|~-&)faAV?kLG{Hj5G<9^949dj5$Rvat7$ zKEn5Bn}G3R!ew(H{Ky*Qxr4EPxEKSg$0ZUF}`;?d#lf%bR-yEIg)giHY71sNDJ z;a9^bN*_u)Kl}h-h5hw@I{L%a(hPQI-Dv1+PdrXUrqdsWzZlSv2!4tK$I*MvJa5LR z2Bj~>){jXWUg`khmhhU2_3W)Y>sQEy5)E?5SnXqxUgEr4cSMWfc6Jq`@ZlGwecKzO z`EE&6Di=s7Eh8hQ^|3S6fQa=~<rD3Hk2t87E z$6(?rc8&G$>VTVE)?_ywOSz8+!&+S+lVV+_ocPYx$u0b&O<`)WKw{e+vj;h!H7l=bHQG#ybFZo#IT&+AXZ*);P)e6(CD_Xn?P`?CTl6IxdHMgTJ3S@E!RPc`5wrLF(ja={J86ds#e~q z&)?@ExlxO-1AxUGjc`&n=^;nxdAk9bzVni~$aelouE%3q5gMAN#IJ#Qezhg#!*&!D zp67N;82c+407737BI0v2u(L)J3;oGn^>`FH2^Iwt#a7zRBWEI<)-?YrBC<(~Kg;%u z8{x1<5KY%|n;p;8WDR0>gGMxm5;zTU0(J{<;i3C@p2uPxWiH>r?vZ>D-fp-@wUS}I z=w271LWhVc)9T%D;D)84)tPh=+t17+JXr440=#1~LIBS2nKuR;n=J@r3=#gK*l_t{ zQ!pd7EdY*ChPHR@(;K5Y_F?f{I*!v0anDG{!+?pRuBXrgTV4=z4%h^@z$7p71dx7% zQ*iDz(h^p&1Lw{44J}0$iBPsu8%o4u!av>_Na)3@sZpVZP?K&{sdE@ zMTr(|Yko0Aiee*cjoYW$G2JSj+rmEbbK-cl%3}G#|yEK=EN( zG@g5vvq(StKP>C_=F1&}Rr!y7Ft`~REiM*`f70&Du8@D@qOaUWk5)Ut{|H9sn~My0 zgx+?8AFfF?H8>>S$GJV-Acuwea25$8&h%ko3D;{{*^{g%pd7fZJWen3SMZr)of`XEEIDFBu@LNn63yI|BBE_4wVRJSb*K&7JmCIy#Lc^p<1SDs5kBt54p{ z>dnpZ_*rP4qgVSqCf7(jzRhgOdHC)XOXE6X@H5;91C`y~-9FnSAY0X)_x+H0{@fjC zuuIg}p$PcMfnwgQjmK<`rR#BGBKunu2{Hb+6(4Y^KN!)5l9tbUDh^5p8KeNsOZg*# z$7KcOuO<&yKG`5b+e%lEo8f78N88!>y~)e20|sV#6X0Xxj?FZ^)*4`w@=h9cU_cqg zcr(bP>*F}K&hFY5g2$Rg`rfK|`WU({YxJA44bnH4S=$5?VH75)hr>IeGrWnY>c7#! zx`Ko092TCIZAcy?<0_HKC_6<|M}D_5|eN=HoL3)P$ggJbx>e778LJ-&bv$CWgO{oFsyz*EIj+Fm`9@FRxln5c59Vz*M^yR?%ZdaN_NZ)J86;NpdJrU5cKyg1` z&J>5Fs3>pR7)Bip1t(Zd8vKtQ-6g?*az>-Umpx|@tpCCT18?(~_dzkGNOYJA<=H?I zLH-V88lX!J73ztMKb4IF^YetfkXT?Lxs%^FY=M30OMM4$rDXgPH zbn0O5DZlKS;=bxTcg$a<0RzGsKSH2BYWDMl>G*!@lPf_p^(1+@oIxLg-P_zic;bq>H= z)}hpp(E(*t)MJK2RGeJ|jU|mG<-NMDGn(J;VM8E&)ev4?%wAoJs915yboNnYUC;%6{DQv)`|Z(Qzdb2-azlob7IZzj}6aYbFKdN+PU$&~!A zPPkQ%OwYXL56DiQyp)bu$V?YR`Htn~C~xq!y@B=V#0fB@{dUdJ?K7QjB(L z=yLYWNbb1;;I`s6$OmeJGMuIH&EX+%=FfW%1n{0%)dM9Oi>Ru%zpH>*0gKWUoZbf< z-J!@j#?mP^l+e;5`?wII@TW*xUOtwQ4Kz;Gz{EtDoRCp|YM1Ael+=J8Ly;cQ_o-$q zOWf%zDxZ}FE0Xm+W;UTq)sned?ANpJiZI9uEH^xI)F-`1{lwq#wd7MGm)(F5x{SN$PM^ZIa!#JoOmPnu_>#t1BhNlcsqbDfI!``SSFFDJh>C%W(|*?DEWbrB@Yn7>xQH1d z6dOdWYIEfM>qyix8I-8I(BpmgxNupjf#rLc#qt+d@PmpSIMgq74CD8HCg=C-o~20E z79r#0+*k6wTpaZ@e%Xw$i@Wc>S=_d;umG$E_q022<)o%WNtG#kd(luevFN6yKQ3c9g9dT`#Xsl+9tCqYxk!QZ zA#I(~cMFHy{3et@zd_mnd9IQX6k)6@ShTo6cLbb;5)6^dngN3a#`#Z^AL%sUd1bri zFA)bcs#}69T#LA?P#JUvBZcS#M6dQu!y@cBkbPo9{1i~|lI)UV>SCEg9L;4kuKZ%^ zu2N13E&nhbIP!GWS9`Ltl!utn*tk~EjCjP^Wx+ffdi-tYKpS!Ht_p8M0LY=81NO5n z&>@$iJ``DwayYv!{w;A4a?rG0pu#i~*vdTlaJyPmIs%>h1)1gc#@#!ep_H1QeaBMT zE@0&*Jqs}aaerp(XEk2qV}+9O0u&@DEbQ@}8km7#r}QDidX$Z$) zYzRi`tRXCAu1D6<(U0zcdm1zulumQrUV&n~9X(XkLg+9W4h;zrOA@eUrnN2TV}R-| z0%oD?Pe5Hb^}yRk+-;xQ3=oTB<7UQg=>0%alN=jc?s8zUl$DhQY9$m*H#=aH>ggdU z9f6%MzZRo|3h#NLjqd`l5!MI}p$F_e9agsiW)BS{CL*H8Iq*`e+GlI{b^!cdM)J3t zW7I}WX(wSL0tB9yd&!D7VD0pX)9OgR0zwc7h&F&?3^@yoA&{*Za9GJ3dU-7LSx6r}cu>;!H&PpK7n`0_4^Aap)8`2CO1?htjdjeHB>D^f}LGa%S>sd0w2 zQQj;(mi*N_%rJ&(W`*j-?adb=OKjs2;elGA0NqqdJn;{(0!z$H&x;Mc`!TD05L0Bx z!mluw&H(K$Cj5;wSbaW5I5cyn!3=FPUsJt}aLl)50+78W9bm)=H}j`+0D?Rdr#ABR zc+2xjC^KgIIn`bI(0)9Qi7E$H;*JZ#*RHMqq$?Ut8z8}u5?&QZ2wj5(2op}VBv%@U zWzf%j2B7NVukQEQwR{C0A~zQoEV93V6UbPA1Iv4);d{XxhjfKSJJt72(&}EvHJrn0 z#ykzNx2bvr2hT3mBHjvXogqK}1?W4^R=)RbPMr#`moRNK;qxk6&5(KG*GCmQkB5v< zp2{GcBY6m5=e`T|8eBo%k8^mr`f5bLB@tL&=r?X7mQzQe@J5tFBh7u1%4FoMU$6^7 zPEU66yFjhz{r!C)Ji|*4Rg1Wk6fMRe;*L;?2*dh?Bj`B0?6YMNpb1NJ&3(dN*6zn3 zq1%Z!I%>k^)K5P-LC6dnwA8M?Aud_|;ZBR=tUF^VJBqHr9oozlH=Oz5=uaj-*UfIP zlA28>+NiBN3Fpes%phXS^1S&+@2xMkT0}8Eo2%GNa{g3jTHcJ5aKK1CtO!vjcJo7q zr@T6$4}b07MB(a$xAK8Oz#@r?YnFeAqbk!xhn1f0T08CmD$Yvn52HzhXXHqoL=^#O zsVA9K)q&d0buM~sW99mnqpjI`I8}>(C`9cBh=W)Xn0HMQR{-L}E(3`}AjPH)$ytNj zV#*>7+d;te$J=3U3te*wFm?b6HY)=I1H^fei~~R8V}Raw%TZh$MK?Z(2_!&UN{u@X z?F5T%mwl!YvWHGZdAfyv>dyWs`ooai?d*3stXkkI>pE0#@F_Fic?Te=$fqt?P!SgdQKi0Q^rywQ9 zpPa*#2We86{eh=wRN4CIL{*vPWW{-~KjqSr%iWELI6TK}#$EMOXmXO6q$D3jhNJ(L z_5!E+^uaO+t_-xs1IRw6{nSgshLfm@j-LK$OJg^SpX4RHH$^faY4VO&jqNi?g?lGfq%e`#1MKe;_w%Q= zv*+yE4V4z-WS4ifFVj&Hwiu}uO<*t<1C=s?QPF|5IhQ-R?uA*@zImiZ^WX zt=P|uqAk5v(;SaEANYFW~PoUMwvcpN(OC1o+e76c`NJ{GwwWgLhz) zW++{NV^?jSg$AGZVxtqfx6QL{SPgSGjWK+r!yTa{8>>ye*ffKjPIh_NY?r-bq0of) z@42ij=({5+4B$1IDSP=LCW5P?uH40x_ny@$5QmwVn2P>*{T<$<*su4a?X{)OduDZI zw2|@ztUT14b9gCSzAlzoS5chQv3F(MTn=i=9sSV}&KdHc7SFrwnio$~L)We`UhM_o zr<(jh#ry~*K0=0(xKg#PSFVx^D4f;1kSeHdb$pDtl&HfSM1D1 zKLGL;2*|t*k?7w>b>N*;+T@*p5p6@Btx|0c3bL z#CG~2JR&f~tJIzkL|E{eK+@;W9D?F1^4rC}FG1$Oa)y2kq`*Nrvf0y z_R`+Y7qKgmaOysU%J7qQRYy0=0f24`D0|SnMvue(2F2*-ht33RV2^laCUO?fdx`rj zoQ${g)Eq(=)S(hMn|7SNfcTf<-B!pQByp>$hi6*Cft8h!;SP%!+FVjZfQk|eKn9J7 zUd|xo_(oefitzAn&n7r8ZVER*_RBbytCId2q;=7|P68Z(P-#N3Qq5L^ONu#us;d6N zVb=Yq!_nJH>zPlYw^yn0?->{~Zr6GxwP7~a0bQf+WaX0*bx*`Mi94K`uNmwLLTf^b z5Qc1agkznvmxuhDf?SGXhK6Yu(PSnLBO!(&zrAjS=Py22RZ#GH09tH6-x9g-&1Oh$ z19ZfH(C~LDTRvG`(KZp=DpsjL0a!A(xiq)`NxcNa{pa7qZ(V}*-7}=6Nt-9pcR8*K zSUoq74{td6ezO?PX&ThNY{=&~JHZ)8OMF~ZuQXC69qpNXU1toDPggQImJAn4wDr`| zei`rCcY0o0gD8>VYjUQ3_4rPhwwU{elQxUD6^X)k-WR?g%921m51*rN4p+Tc0h8QY zEN&2~n&(nv#AI|~t+vB#U^X0tDwk4Y=5f-cw@}r?rr1ATIzw>yf~#}A(-TXRl1gdd z^nmSZQZb%o=0x>MZJ`MyLHWzGxwaj612ELD=|e#CD&}UMo>=2J&R1i-7A9L7cN818 znAM7Vv`w~1ziL|C91;4SQ0PQtqkqPUFNdfTmR~8relf_>Q+bimc7$AKnWraP89F+8 zU!&gSwa1q(e-+gbJ)Wwm|H(pfa?q!)E0Q=tPWP7Q(b;fIOC2a&)t?59UTiqmJ3LT{ z&0JRuWB|{Ji;(yHm#^OHZnI8sU(g6iRzz77txqHxybV;n&{C;5>#=M$=BogdKPbW< zMj>;w-Q6V!2Q1EQF!u<=qy17?v4G_kbLv)Ce|bb{)E^Sq9UDGD(@ln+0c=Iah?F#&pi%U=; zE>7T%s#X|^;R;iLpo>F>9KDX$?orsrF%)f|G&A4|J?AH|)lZ}sS+_y<*~GX9G60BC z4vJ_2{H=?op-mn3syv1fNLzgX=&MeC8v2(lm^3n@!x7tpHYM+|d+SU8n?^H%y6XzZ zRT~A9wXXca#gM8VETQxiWLUxk#e}gjfHmV}V`br5j@z?kJ420ael~AN7T}-Wz}E9! zg(D!;=B5r0LfXz0nUoZ^@xqO2u?t&ylNxJofHW7vWM~=Z*fgv8`@FD~-KyvHqat!= z;F!Dh((RkUsvUuX?w<)U;YA~CwJ?ncdq(5-yEU$-5e6tJ)F(qu^*Yc}= zw|h7kF7vhw1F#@Orm21`BK!{F`7(x)Xkkfd>m2sX_Q2|Q=^d_*YDi{yTfGPaNdOR> z*tgd`L3w+uC2s#~J-1L2Nst`+m$uJy!{XkcEdx0KhTeEK3nCEwa zDUj^sSPO?PP!1530e;%>yPOya_Ye8Uj%Gb0Y~G%&#hexszB0WdP-juhfqQ4Rh=fBY zayFf1W=3DcyXo?o>V>ca`A=n-Mur8*q!4lZ3__Yo)4LMvam5Yzr+a~N+%*O6sRJS&OWuVo= z-h)1qhET~`<#MUk@7bBMoaIA?iTK6g5zAZIw+HVjzc?i?4v_pb(n0C6DM-4wU|y0g zc9quKy~`@K52cCnjC92mbY!f;Sb2MDS)95@- z`;9Id%A3OChJ1cD%a|m$3J0Tki&#>|=-1~fa>2aGare>c(^|!=T=gtHLTUQXChk=> zBbOE$4~=f)fa%ZiyKe!CD04pY=ys8sbjEX%#)iQ>9(yMEbNs-gS=K;3JK6#l_DpvL zUznxJyec6q9T|Yy6IA*=b<(?v4Ryq@jkeMlYf-Xtg&>bmOyrhO&CZOcu4_K_%a*bz zmD&LdXG>Z7w=&>Bry~O?bKh$eBLL6KFN-~!T7RQ=xRKN%t@w}Gu zM>TZyZu5l&A0<;e>OjrP95IH1^(A?w>|4oU6_?E!GmhV-wC3KmD}Cv=YN*NJeE)wy0F zAPgmhQN$zv4=B5jm30oDJr#0yMc2WAV>uN)QUWX>U_bNZkg=N^qvvUe)JuBtBprG1 z>a_6c{fj0-y##aV8pMfu%@!G!Jv$l%W1$RJ-Xi~vk+^h!JP((kNdtHA{E{k=ohuicDCeqTva%8wtBdz`O zVek08*m9~nXBfRuS_~!}$v=IRNGl;hnCi4Qst|Z}=XlaWPw014RP$Ej-J^bfg$x!s z>~-;( zk7#XF7I9p6?qUynwz9gSbY;Cecp_r)=JNgDS6Vf3?;0Rr$u$;nhSeh+^W`_T&Owhn zrl+h)XR#9^sp2S?rOf@#-#;fOSQAW5_fEQ9S*(1BC$p2doiF8kPVy9~J)LDNJ4jG$ z`h?KDa?GWAooCNFSxbk+0Xn`*Ij-vVhCnfd2bxsGPDFr{hhfZz4^88-&J*O(&Wh{b zk7y$;>mVf|K3^6#_dbd)KkHm=l zX#|-3en`lZ_;0Lw+|r@V7Tu2@tCvh#SL3vqOGxH4*BwCm14S5Vt{)ZU3gAmz+Ntc? z-}N6rd|y0K1sl}fgTQ{@A}J)`pxP5je_7K%$`d3LaI47(F46ccqPCCq+hn_z822tdiG{n%6QPr zhAnB{`HVKv4w)+`MdwrK*40DggAnzaEU9C;0gGSm$;S%1GgpG=YUdnzy0s5zX`3(W z@}Ka|o-C)z`fUxbC#HetExXE2cnocc=k;jMHnqdg%!QJLP9`>UUU(dI+nN?v!v%NG zWIX-)UureI-PI=EHt=Il;Qn?YL7Ri^K8J4m3qOFhuqNl#Cq5`6oMx-0tz!q*r~7!$ zx8|`;pVb>ZaZiznw{31N|E@@cBf?d^TKeRvg0fcxpW7|embjomGW>!pI|mLDi-lGa zJ+~or!Ppw6mY6#Qp9f_EzKAYBTl}HS2?T&Y*D2gp{@{Gq%hAer^bT=yRgH^zYkY3`_vX{ zx>lr~Q>ZacU5mM!@W}0!0(#-y1ez6DUX_ZyEV(2uWg?=Y84q*vxu3o(s6CUt9*5jz zx^yB;IUdO>6_X#eYEoh@B+t)RMJPdXICI$Uwh+X)y>dTTeffP>hUAt;2+#1BRoqPI z0gBtEEfBTp)j|D|_QLy3N-7X%3D`I_8{yf#w|m`=4JW$Rr^5h9}^nSa)iVL0454!F^KV!RtV(!QQA+pHA#-RN847Tnh zB>XT~;Eo0F7cf=BQ$Bm%1YsL-+G_QkHc6!^Hwx|o7G*o_f0%XA`%GWW*yu`3`C48G znF5}LSQ3&dTK0Bt!~k#k6M`VXeSEt|asjb~G)?@~!AmpAJ3~*?R}W$9-h#A+vT%zD zvb-X0iRVVdL^+!_m8yvxJlK|HYgmrLe0(Fas<>zVHcDkT!REzh&p*>9jLZsYGXJ!2 zMB(D->2F+_d-1%w>p0h_uL z)5jrYZ<7g#s+P2ybWgmeqce%D z&6kHzaCVP_cBWa6pPhl|!ik0EyL(`Knq*9LG+lE(#*H12>IEW#DRdkcSQH+#b!M;> zSl+i(PdcktSb+z33Wo{AT>4<;6UPqk@^7#Z^`$q;O$cVM0x?}Gt>k?+s`46#^$B!c z+w9g6CK^X3*9uAp2L}2c7QDo+CoalI^p;^EA=nj6vGp6B?Pgwp&!IEg*FkCwk;gX)p$VSOXU=F0MwvuZN& zxEkz72h*TF6i_5MDE-r(-IXQoB~wRltbO?B&#(w_qI?4ai5TL(L&{d4kktL={d@rbGt zy>5%kH2mSD%$GSi>%H}F9+Z~agS7tcty_z)c{^;IuW+qr&nAj~sTF*EG$A~e??Yi; zTZrTC^7zeBuGlRbbH6524qg^FAe-6IFf(@uV=>?>qBIk&llwy<)4^U1c;pehwkFIR zsz7G-lVxkA7lzMryMnf-K{BHUfoFnuAs>nQ zLP7PPCy&f&(5I5E0%TM-&%qo^F?A?(+GFyz)zpl1LtEh;T&?E_KO{0a;0dNwcAGy% zh>uIE;)&>Bj@I}cL5TdSLsbtJZE>B#i?{h9(c1mq$UW6s8HliEV`6IX)_?KU0Lr<*1HM2A=`*8UrHBa+DrH zl^tPHp|@TweR;`uk8048^ z-UoN0zi#7%x{F!rgFT8B?ZZj2e|H>b&-<;Fbt6dBErTo~oparK` z>nCni80&^%bvI8Eh5;X%=8w|BzF$vdFyXusa?T+w*!)R=uCwg;s}EuRh_Ed<0S+_I zFbMRQp1xjA7GuCOy;UJSU2KHGu?DlfSEi(W`q#0sWq`q{jO0KwovY6I5+%A&TnE6W ziv1Qz6iJO6RPxrKvOmf&)gewd8B3SK(_{(wtNj*o#3hOKygHjLto~CaMd92sQxOJB zD~3t!$fXvr`DoR?^GK2KnAt}sA!(038;UTFDCsD5G3|^ov6Q8-=!_zQr=*S2D~c$% zO+)v6zOUaHqhA{1_qH@l?1k+VJw6+iSHJ)2%<~Gb%{uQzBLxk{b9_Opvir6~){p4> zam@&_{=jrv@d%13s7Y^EE zKaYCKpWK^cz<}M!Y{C?+Q*rG$3VJ9=aPl{j{_+?o?{CRVODbjRQh*nSvs*lA-qayR zntL49-qRy_OUC02qB=kWNw}XUKX%g+1meRn)5yoc`gX>adN6qK=LmaM}^5 z?BVmpZWTDg)$8OsiglM^OS3H~>V$5tNX4VEf8?7Q=M{M{|GggWnPet-KG6P_J&e+e zbre>)&}QD;8qSedJaIsodt>0>7COfs&|JAuP+f$Av~>tCvXlHmO%k9qK);LK;{!sQ zvs_m6*V9MJfJz_CkEtG_|G+oc(DOLSsNu<`lzIc_p1yi<*|`)3SFZ5tvYtyv@r>1O z0*v-aJ~i7ss@vSGkBj-u7)AdJuj!2s{?k5B9l7$Zu&;x^4!o+8fY!?Kb9Kb+IWY#ZtT7T&P8wK}> zf~DK)tr--+T&f|ex!XDIN4leZUp245J~?w}0ZvK)Ib8(&j&(c^EU@|8hrCd5#Qahs zO7rz?T6#J(M6Y@j_WJX+`AL6>}z@oN56f)Cxa zRb(=1Ep{h*1HIVtMaR$n7<7Aoi*Wd{=N=v&R#uyUvQ><2BN$|4Jih=bHYTCAC`r`( zF^0o2oOR^UC-lG;$o^@W;YNQoZ;H={kH&Cbi=ai5R(sz^N6aGO3yYX`O5czBnHWBh zNdA6(Q+uHDU(0R9NZV}bf4-3hi!1hxwe7BG+<(4L<#KgnH!^Zv~ z#D@6vK(^pCr`j2SWa)G`)PZtgOaJm63J2enC5g*p`tL+tLtYY9dC18!dsU>?*#vM` zhQy_L$YzP9b8~`iaO-FFs%@?#uD?ol4w)b}3VJbVucdYx#gL7sLkhxEDOc&Uh2Hs< zVE!O;K&ox2HSd4!)8v!(zUCbHOFGR&<(&z<38@ZXZ*+ZdyFXTsM<}s#;+B)MTk!V< z!SZ@5^6uR`{owJE`#ufhWMA)1Q58v#@-*Yjnk;*q{5)E<-&1K_RX?~;y9mx?;c%2L zr+hK{b&*#o6oeVH$!n(=dX(x>7>0^6c3|HyHM zeRL$Xa3-sCG(NtfqMc_8<4w^@U&(s{sZdosWxvU}r>KseySa00xLH$}=F8zk;lC1l z@+24w8!NbmzEy%=w@`5^_1JCng}sASo8{!Um&5lQH8cvnf4@Vpg5ZmnQ7x{)V)B_~ zxz+L90CE>OyXn`b!@L$1^HWFTS-qyziW=DwJ#)(4)#3CbeZnjYova>If~%$W_YO|n z#>WLu(9nYAw~kY8PgA-H*KUbvm}hq_OIOsIS#^Jl!=b6XJF&Ra9>yW?iPr@wFwjS) z?#A)or9E`VS?0<|*ZojRdWewY?(#ama+yVHMTN$ntVm=??bd1t{vM)4*FA&NuCAI7 z&IebQyHotL9-NBk@trt?2J`dk;!@u&hM#dljEGA%#t-QzYml20 zKcA>-;oR)>C%*w31qr`$mzU(UMzR0Rh-wEX^EYpX4vOyzT^9MakSz^pW)fIFeqvu$ zSb5sHQE*{kY#dGWew%zzXb2ij8VV=X&Cw&GPSA$KBoQWt-Of2?fKP+?pIok5 zP=1I2&24v%d-_zPZB;3?apQpNA8iuo*YQV#0j#Mo&+8RQo?O6{ws27o2&p9p79-Ad z^?b;n9&LYtLxsaEYIMDM50?x7@xgUW;*UYX$Es~G<4*eYA>>Wr(R6 z)ZSL=0NV6kPZwmNFzChh&?4y*J{ug$V|L#ptq+ zDCC`-oFFQN>*wpgTPC`MB2Wgv8>`=6()BwqKI61V;?Zs&VoI7P7tONa^-)0s)}NWbDF@E!lW^~h$*UtX@L>Y!w350MJSNA!R*}w zoWx%*N}3?1C~H9GVJ>|>2;3jQ%$NiCzzTL~NX1^1o5#2vq4)t6z<45K)s5Ro7#Bvh z+1b*n!w`OZPF!X^olyMuNMh+-+yQ)xfs2b^G_1l!`~$JFj=Ywq8i`WH2+!K|&6{p8 z4Y%dBZJAGItUo_mD>PAQKkPppq^C=`c`d$@WS8~VsKUhV)e5ZM-sGb*H%!NA3ZQ(O z2RlLxTzA}kr&oZ`9Khg#LfEYWD51dJuABEK?|$;L5AG;(nts{vTDj*Z6 zzjp}bQt7L1)Ytj8ECR@94x$0)p2I zEtnm8|1e|0a=iwaL8Pci@o^GlA(1n%J_lfEBe@d-8FJ&$vN*>z!F%}O{rh_%@8f7* zTvB6$NOwd58wLHw<9N^WMM`PfK{iFKNf5uWPk?yYz~bV9QV78dTgT(`7Hby1eU`R$ zEqqi*zai6(A}=F*N=G5*ytsWw4s0|9m3|OJGM6%OVkW*d)++Rg5q8?98j!yBx(Ji5 za|`o3?#d0tTbWXyaJVerk#!4{b(4+%U5T+PuPZl4KZ+U`Di-Q_a!8~fTAPn%#u!dv z*-_W`Q5Y7n?yPw>awFrofV&Ef!MzY*EJz-tpHFk!vRWh||tLP*wua7oy60*jYy5bPSj z?AcuAlLU_WJ$c|Q(9$A&|CP{}p*x=d`oqwzo1YrK!wC)^zD7Oj#zWbPaU9y;Zzyk` zz)Ptx4F2a~ez9J}mr%79!) z`@74p(*$}}Kar?-5<@v}F=Z<@`8^+$wlX!k=Wa(AC)g)wyC3v4tS+)WJcD|#+|_!< z?Pu3|%slP?Oaj!0TYB0%UJ5q*CW>}ZX-uys%fiAcNAezkSE@WP(q3?k0>5M0+7W`I z;F)A6itgNj~X> zFjBmLJAI2{X?O&95cCLsD)5-n9$=l)XXHOn$rlXM@F%r4kG`xhNKI8Q8`b_4+-vs6 z_TI~!6JH4rRZ2+$w0*;1JQ3k!VGZ8~g0%^+Z`M_!HfHGk!1n+@{k;H@bEH=*Fp+nJ z%u`SYVg9(bW`!NZi8ticRe{njxD5 zz3c@I3u7P*o90Xuk&nG{6$ybm1pueUspw5!+8T$yQ8Mdd(}mnJqx}A%EfEgf612Jv zy3@i+PcSPh1pyWtzI`t1gG(ifK}w-?U(zg6k(y``KkoD=Nw7#g6(zmmdYfH26?b5t zB$%HdGDZ`+bN8W9CxODTAs;AyUP{DI*)SmrK) zoGNk;p-rPH8;0-<7AvCkei-m+xQ=3C8bdydgefbXqZpe`#l1(5+=1SONHjQ`)lplA z9*s|Vxt*N=_MQe@j8K1Y$?YdaVbFPZS}grc&5n&%=>SPh`VVFCpR5MVwvcvj^6c?q zPmChpzYblzuPWZg%;2o}S<>p%|M;QfI!yGNK6)GGEY3v3tAoC{hZVk=r(KQ~ks9Ff zLmZrH+qU6xdtZnda)u#Dbq6ubxI9@!?0Hh5w^O%daSC@4FF6|8mruUK0hIA@eF<-#ya#~}|6gY*$7*(X*<Xv&c0|08i|x%K1o$Sd*uye935eMNxx(Y_eHq)B7eOESK& zyLJzfAX?74d{Rf@5$x#EDc2^d5PQtge4CYyPU6KMF9aLgw9_lYd|=Y`CTdZY984zZWW6-w69`0OfBtZWEsG z0MlCb++Nzbh2*F)){%`0N+v0xD+HO%SS=F{syK)#^}Jy|JZsyG1AN2xxYs37vuP5j zs;j!4>N3%m^IxgDvjJ0yF>^pl3`|kk_2WXTB2zg)_yA0I%9{%azCUb*DFaJcAaT1{ zYqQnAlaNc7U<=chMaIjugOh!0To-waVYvOCukB0Rbqia_TxOlmibO?X$ku}f4+CB4 ziWHx!C!?YPsTRs!C~&W74Z#=*a#d{sqXB+0tf+1i^k^wsXOMluYSyT8J4xWRlnlQU zWVm8zq=K9W8w*0I4+_ut%9zIn&V4Hl-Y8IoD11^0?1Vuuz0y5{rgvWVsn|heFlJyW zUo?r>C;UnXt6AhP%19o&00UFanUntR9-eH$JrPd)l5<$O@ixyePb;E`T4%Y- zPdM}2b$*!GK-98$gEC7$vR;L)fu!UQ*bhH@oUS3t4&fr7$9t|2Bl3?UH4wTbdf>WE zq9WrYcrj=n)4Kf=;{p|0HV*iJDFCtbte6{^PvY^NG`LJbNkJfMd(>zRr8YTHLP%Jf zE>+uvD)TlB)IWvfJ|s@0v4U82hYdA0V0SjKeW#bPG=?}^g3-s1fVdbRukE6a-J?28 zt8K+jy4IYGf5pA^be;@ zipJ$P)jEGNUvv8{7fiaIx24~*J3pO^4Bq`+Sqi~C&d!x;S^mGW+Xdz2Y~tX!ep*(r z`{MbWCV1C?JUJx9C~y9~aip}f3)6qr?I*QE&bkT{==+~kYZ-2D_JSVNFeZy^?uWJHOe@vR|oED6>b3_rprdv#OVqN#|gl7f=hI4Pm>aA9`hklx z_g~}8;brX7Ixf6Eyn?;=RBo*M) zx*T+Nb&tY@Mu}F&CYo= zm2zbDzaYdM!CDkwWy);P!D@cnqW{9HIgd(LeRd*-LqO*3efM7r%|k1EjKhC@Jhk4> zJvpJc@jtVa7cWVYg;OJLYw}GskhA>rxq;a$RuNT0+sz2{^UcWvU=M?~vzs&rwHJX5 zsis;*i<&)5^+8~-{mbhhlSTB9p!ppb9Q>I#0jWlRfbKlK@zN*9`J>i0DV)G*GNrAg zY)JF|TwQ@2{5=WWqjYJKToBHNrCkZa{&uL=c~)N`93~_{RR)_fum$3v1sz@~`G|}G zvQKgQOlz_Wwt0=s?F0_Z64b&%2w8&kPUI}{Tb(!h^zrzM=3y25>;|EC_}ZjRJ$va# z7#QliKwr__E!$E21$a<9Q((F91zZT&OG^S-hJKl0e)_DdGw|Md8(iFsB49 z3sB-g^p_B{(cu1KgHWTU{djx7UElQqS{poqG_uF`FRUf6(RCi(HP;7nAzUOWDJhcY zhMbJd#!Rgc0rU}dOV@*hrIW8)WFq$2mnXMx!7b-~u=m#9sM8ijv6frt3C~k-8R=k~ zpo_1TK1g>nJAe)11{sezY-n5|sHRcOr61A%EDHn0L3S3bAmaVt4+SrlS%=XVAn+fV z!TS3F;L>0SoDVvj5vKrY{TE+=Y8qZvSwYAG1~(6gQ?CWbh@c>!sF|bt0lHz66c2(N zYVJ8ZyzFNXTtpiGWTXVcMS;Lo^N`6Od{&4r<8LYTT z{MVkv{3aA|{46XMI}5FcAL$a(0ke^K1e97Sq%vwsm{Y^7*4~bphc?O+&I7PGd0GsU za|88^D7KyO@)?&drd+Xa8qwg(Ve&e~-+-Fr0oe`;x%e;^3tiKVFqhbg&l*jQodW1sGVusaRtY9NA0wNvq1KH0HHDBj= zV79EX1PpvVSDd-s)!$KddE~}xL zZ?hXN)==5}CpyJ`RZhj)#`S7ly}qfx7FhD&H~j=j z7UBqELPKxZ7th0yZZ4VjJbXCga}0zwY7`^0rs0Glzs3u6PZl}-mG0HZU~4E!!+=PA z8j(mk{e|}97|r~*dc8YGjz9s~u-*mtb~kq~NNkZziWIHLwB3LS4AbdEZ$zFw2k5w| z()mDu`OLHx*tE6^*=EPv^KrFHGKhRZ=|#UHIqbu?p#2c|t<=Dga(UnAN1k3i1tXTA z7wYs{lQQPf8LR2kn=G4q zCfPreKKbWH+ob$|H~O>dA3@pvIC1UkKkt=!_wT}D?e6WBx`fqg7R}YchFFS!Z?eYS z6D3uY$JjS<_%=9K$8MD^L`F)#I|y(L5&|zfWm8se*F&q^j4)IdDRNb^cVnm%!>}8D zz|aoVt#wJ&gpwFAK5yoP7OF|wlMrZp1wM&%3yn&?k?$WX=$Xp8!727=|;LkQc5JGySqCT0qO28K}ztObMO6q zYw?#$@tk+&o!R@@PuLa4?390e{v`@q+83h~?C_J^6dEu+r!vQLfWQ7yt;HD5mjUn^ z#8ZfpH)Y16LwejZ>kdKoKA<&qK>$%vmh7OeCGE7HB+3qYOaho@kAQjND=oX`#n+%~ z;wUclFK2D0-lBcV1g=_koHx#rO~gt(!Mtq+jKJ$pdMbCRm=lj=5`GS6OW6Pfwrg{3 zh$$zx#cFfK@`96ao}_c|p1Y%RI}R+I4OhNAeY|{QDqx;O4lXrV3%MT#4T4vzB>gpA z1BgtO%d6$Ct`%e!*Pf3jygmL;Hp?UY=-E{=tc|HYti0KWpNkz9Pk*xPt2s3hkjvyk z)p%V1_45SP0Z5-GQ^mK*_6$yeTwqwMJlRjIP~wz)xffzOK5a47J{k;8jC=$is%ed( zuMqhS=m!9)zI;uuYP+@EIPmrd6!H4-A>1oKkVB5GL_&qD)F#quTC4@RG;7sqYT zE5S0e8-rRxJyyN=wX51T1{hvAx+-aF^E502+*v$0r6zJWnP`NG|JX_;&JMG^dlgYeZG(+vaeYzRW^eyG;CXg!(n6WC>NyIZQO zY4w0Z4|>iP%^s^1>=sDmq7R1*>QBeTTB*U@|K3*y^JX>B~(i?$JX6HeEC=Y^*Af*{OkIXrKjHJ1J}*`)tsj6JM9I{*|pGS zNKzLv!xs*qLjW`R3jPRF!iXh&&YoONr;f%JUX%CTCoJPc5lbG6Mf5E|en)IYs8j~n zu7AN$q8J^%on{k=(t^+hK;8M9*16Y2hO&TCEE`)cBuoy2PK{2RmtR|3yH@U~8_GAv z=!4sI_W<}M3cTQWreF`vhU3UCn*?erHsQD+E2$JV-P%q2=x$k90P|P^I20U=z5o>g zog2Djx}6rYLUj)qt87;xK!ietly`7-5=W191Cy%Zfgl z1HZiZQY~itTu9gLO+0Ppo(PXa6vj?r3TKbr@0P^?@_X-1(aM5tO)xJW6w3^_)7HQp zS$hUe3SeJp${~q3PtruJv3$64#&YaD>rJ4?OQ@Vm7w>N^(tw=Wm&duil@!3`gE66S zeDJOV&4zTB(4RK={DuE8FLYF~16kKD4{%xTip2`U3D**^J1cq=x}k%=Dooe(vQRZ0 zv)98ufrX)i%NMhSYWEDCQ4mquaqx3!K-KMg=0F+s5h&I51rU?gl?4sbv zSMcjF)BKit;qk+&VSI=~h~5r0pRF`?vbvA$I*yQ~6o?Ul0f0R?zd<_-v7@<(fDtOW46E+&|qt`7UwJH0AEch>5Ip_UMuZ; zpa~NCnGjm>!6NVCP@!$DmmMse`y7G9do`xa_o46YG@HQV0vS_woIS*wu=0u1tNAvh ziJ<);Go9`y{IjQ`Lw7m}T3$`LuHZ~TFcv#LJ_hAzATZIo=|m>&KKNq`4gK^R*h4@J z#;H7~cos~AT?VmbS3!J?f}Gtq_ATt{J8_#0=wSCA1ZeccFdY6otZ{Ya$D+_=wa%Aq zgH3R+N}-BXIYGCA@}h>8I0JmQM`nxZxtl{QF=U`FjH5x85*tqnb5dyo;;JJTuqO#4 zn8*z^T*Q~kJV{+!U@Ra?n7dG5_}a z&}!PLjz`+fh@^=J6k3{UIheAAo=0`pbG`c^WdX%zeiZg#PbD8lLvDF7&b=>s z<6xOUSsN?puys}{(g4H3hz@WvMoUS^e2xP(%JYwZe=&vIKft7%#=Nff25V*7Rz`_Q z_#RAffA4$}#Rye~_u0Hgu9&nod833Ic^;C#H*AuqJho#z0!dXBa{H_#8j zk$UxTkZb(@y>iP`_6He|UjoDq095V-hoQ`3xpl^4u#ugohc`$#`U7UD5X;6}Zx>{6 zGz>VP#@Fsld#|7;w089Qc@6NMazS1!Aw=Ly+jj+mhc1O*AmSrms(zqm4ESIgmfj5) z5yXz7kcWbyF~Ol64<33B2;Bk3gC$<_+uopF1krYG0P*Zx03UULTSQkAcxPV$y&Rya z5j1sde!fX(f*iMGSw6q_w+QWQwBNnk@t%=qNLmPkk?%z;qi#Z*h3o6D2C|TKy6Byc zPiK6l{cs=SLLe6mTO1+hHjrO@1gCpiAfoizxk+>f#i1$6it@;6@im9E$N00iqvtv1 zc>&K-8qa(L@m1)nG)tYx{kn6uZZCjFQaG@kOG>F!c-vdA^2JJSzn{=RZD=C^i#)SF*~PTlmzK z)qc7*`Nr5vbeZs57Xmj-!RKm^uaDdT13elgU5!L$8!v-B9b;hK6u>A7xN^v@Q-U?C zb0t#CyLdni(Mr3#BZln22vbiHV(XfG)3J@FT9%3CQ~Dc@A!AX6TR$G2^NpqBM#i#i zkE`GTmpS!|Z2yk200;Tw7B~Bsy0=9k#N>}gNv4EW3=tpyK~mdyd4MSiW zjEEe5*In>`zXo#sn^PXRTC>mSsWo_73l@QQcWHjBFF&<4yTc8_2}WQQX9JDSwMvEv zLf37e8Yjdk$RrZdetmbmC`wH1M33o?%;X~jD-jLSq~$Cv_dtsXF1YHDw;yjSjKNa7 zfEK)!x||ZZ^JX9uOHG_y4Mtndd&x4rjPkz^a@fRr$^LTE}aH5k<`BWN2wgR~_X$ z63mu}B$aw$it?ze%unvKi~TVJvb9VJ=|{iUFJQsUSLjNgbdV^RDE3?*$?U}p?f-pZ z*ej1m{9J7O@{`L8%XI~1Jz4OT+3J0s&sOZssF!_e33Q^pUvO(n@P8gn85ppjR{J=^ zd68n>uDbpBnE+b=b;d(EeTSP7RnUb{DhO^sro{iQ$IodEyOL#l=OcQ=D+icUtBHi6 z$Td$yhk)1nQ6EkRaS1f4jsCjK2d2IzSZV#$*7iRWC@xQY#8Xw}U#}oFY(uZRA91jpIi6=@3sFF^l}(j0mnQDQI31Nu7IHkV!Ag zqjW0)s!{UAbsSU(AkZ^rQU8vZ_~BZ>>)a5}0c<@pc8kXwkVp2d>d%^&F@9HQEjWjO zddd;PcXj(AtgTk&14?6nvgCkjpD~ck2TZ^qhnRVSfE7R~LcM_JkENw0BAGkZ&?5xF zXKh(^T{MksvYnNIPeb~04(O%ZkSr=aUZE{89PvBI@p>e_1j5~RkR;X(W}e1XVCMS* z6ym^i(QPGLxSh;Xt+}qkf#&cn=sbb_?l$nAQ+Ptj01mtlfQCJbs|Bm=R&t6H4yoC{ z0&D~_GCw~9ZmZ1I)P(XhUJ++Pu9@3QKr5&sbjFQFwD$q8ws;MAdlMw;Za8)LkhCGl z?0N=h@3x2v?DUL2I@#4ap5*P$gG?xQNDEe2`-Lnsrv}!X zMfA_2x$`ETv2!0h-YB;o=eX3*SEPq?jl_3`g~F5!q=uwEyGg*fU+d*Ploo-u%urgcsVAK0w&S3L5Qg&x zAP%JA@cXN;fH^l<_2De!iB*sm`}c97M`S1NjdPeE05=p$dBJ9j23Mz!PxEV8QkOxX z_Hfa9DMnoW1162O3)O%82uUD`)H@K=JQPE)6tuH=a=mj);NL(v7klYqU(bg)rU;iq z^NO7wr^uCOk9v#D!1x|eH`_NuP@Q8)&V)>h*I5jjD*<<%P<%xs%Cr0XYAU3TP-O2a ze2b<@9QIQ&qQ+6LaZL^JO>3BvF_jZSaW?U$SSH3g>z@*%?TB#E$%pGzdBy$8MLc_* zGSQmqMemsmuZzszKC#z>mBCLs+N1qKZN|kJ_j>dvgZ0(-Vss+YMCyEt$RdUdUC)13 zfGKGwXq01OP}&2Qo6mqO_uad96drTxvJ?T_ol6cn7xcY;L-_A{Rg9YKv_a{72i`$2 zEg-bd@qU}Yh=T;LJ`E-OD1wAy8zS`qj`A2pU2BnpON}~22%|Ay?1vf@c-qd~*G913 zJMnxVJCqZ!&NjKcNO~;HJ=GEf_A>yK`vPdwYA?E{ppX*UOV!-W3qaWh?k;=@4&z*q zlK%*+g=bUr)Ihhb$lq(AtEN(eP5!2XWZyr<=OcWa=T;x`Oo>TYVLxCC~~ z76cTBW%*K#X?44t z8>k-Kz6%^czB04T6Uf^w2QB3-xL3j0m3ed%G`ttn`2!#*x$N&PonX2e(7m|={0T%J z$~_Pjo67C>bOe*4BU-`kjmt*zfrp_qdB+cq?tL(!Ea{2>a;}UEmpsN%z853ddtei3 zjJMzU`@7~#e<$cOus(v4jq}Gh;j!<9C9VH)69y9na{tcUJcbV~4oeWNspa-y^t76$ zX6Vu%^A$1ABjv(`mUmu|FpEmv_oZNz81bR!&{LQW#;29mQ zLA$q4$wp3hrZ51ThcO0-2s@AZ3AB5Fb79&H%M}2wD0!$ca7oD;PM3v)+a;Q_=G3o`N-4t{?xBEo z-=6=5vVhqH<^-%_=2&N;+685+3-4UU@-&fa&T&fbA(KL3LSx@UU*SB8jBx-GV}8E4FxH;9Nq(8w zr&$R%+rhS3_9=1BN!$3P;NGle)AhAYgYJIR-#Wrd`N+mQyl}DevE@G_&z<-iB=tHz zJ$Hud&&Kw#= z+t1Ak%=#-H29#iek>wl*WKvbZBigui2=5{a#zuT_JIWU3b*C0{ICg2a$M5~ARzoT{ zRHjMsD{oRsVo(S*%fAVNOXBfY6oaJGv)vXI_$id`=^0fRnd5w zc~##f6vR$vwK>lvdnjpKGX zyGysBsN5@HNKF8tu)rCeVB2O3Q{+CVv+-+$&pa>zI(7@j>D?coE#^XbkXr zd8Pboy4IR_+<6?p7G)j4LRhFoEPG5bVnV$flHIgHG^2fyYS4 zp872j@aIDP0Cx;VCFH{35RM%I)_ z&tVhgTi(PmYer(J%c1)s74r{b5OP2TC>dk;w;>)x`eFs#az+k=9C7}@7yqn((NQij ziJOMRF6Yw`fXh`7r`7>33~u{*v@NuhNG?ZKQ{Rp@ivF9-E%fgNJbI+2zOzQK3At6O zfq$M=2dw>N{Lq2-_+{A3m-V`B)vo1)la7N$=$w_7?^^e8emy9{3c& zrB&`&#UzeYe|QQhNx`mva|A3SMS;`}#hnx}0pK9GuhW1Lp;?$@oY*N4;w9}Ki2f7k zBFBNPDJY;$8EdUp%+5m^kuFt|Xi=oZs!Jtn11I!dRu=Jc0Dx+2?GDKhN$Z@xiNP4b z>FDS<)pQ~B8(x`c!@0>x#?n^inwXfVdk+&?le$lf0}n{9szoeRlAvyvel*O;3u!3& zj7d{gP)1>6g_7%=Ni@WKuE~g?3(~D;tokEr(klGVEJpqf1>o?^*bTiQ4Ky@}g ziA}hmAj6|`0Wh8$qh9Q3XBTLBqY9?g7~>L#un)oukQ!kVz<_Q6211qqK@))FAMfnj zLPsPDB@7MI-ncLF6BxC?n+K(CTI3UI(0-c6P@)^OEyDO@C1qZK(nv!9hLADOcC>0t;i`kAKKp%{nVAz|YF-K>;p7DrrlzrjS1;NQ$YTn2k>*0-A^Y4cr~oN$8epC%3Y56Z z?>v4TzNdx4_~P|m2xcI&JZRgLKTjxA`3yGv(|K3EqqhGKZsfCI>;u69a1-E%LUy?e z0IqD>A#NuU{Npmp%pSYg0W;BnyQcPG5c?q3ib1SRb`tZJa{E~F`Jf<{t)O2FAvrZh zOfLWbwtM&UAA=joaU>K}4_m8OGK3oz0jMqau500K_F3!kBdeBX20Kg>RG4-cv_cdN&1Z|rM+x#^{#VWe&`Rhwkw9&j*sm_zb#IlC zEU7tC-K%Gv6Mn0C7y$#54k*WDcf|fCJOV>dMsPDRnNEU~wfg-@X0f}#z=kJXhr`BY z&I>mPSA}1^t+45n^cj2LgW}$uYvDyaWTvd!RhbJS?NtS^tHP8l>!F?V`Hsw`mijHE-Wwbu8^}FXB^%- zmwZ+-OkNT9z7+0Lo-raS;6_q#7RelI5DE69Icw3r+w0TbLTE z8&XkGBIq_H1&Yq*%5WXN1Kw*=K}@8=;cNWQM5D2PO8lk1yu#~H6M|YCXx)cgZh(!_ zsk)Bv0mifet=lRX*6JS^P>hl&-(X?Pzl!B#X7FG@Lq}o2sxTz)!?jC5;wD~`Ovp;U zl@=3ly}H#-0VHKgWK!%1y;{2PL$#gfBO& z-}~xIkr_1Eg$q&}r-D!sWDR?&qhgYfI8P1TlfP=1)YT$$fs_4e_OCzD`hIzg;`ain z8|?I)jmT_9`EQUL6jNHt#3sy5;{kd^oPC`7NT2%=Nt1tjPp4sA*QdyS=oc9}|EMl$ zL&E#6qW$%@it~@RB+r?*7sna+uVB_MYy>?8aVLtUP=fShJCLrAov<2lNJqvjxLWI* z9hQ=n^uiXKbcQeq$^L#Ivi=g>WCiFsE5X;|dns|uMsa*G>E>q{cHC5g3jaCO zaR}*6dNOVJgcf9NW3s~l#urjB;NelFtlIqUJG20(g3ZcGgO!w zUOhQT`#6pgo4W!mqzHs{7Zc);_W%Wr4sH7Opai{dr^Idoe94$cLyO@vu4JF0CHs^Brj)*Y&@^RAw7{Z-t8jjw?9YF^OBU)P#X5A9Sg_f4#GsCwY4Dgd8Bv3KpGB61vWL~7i6n~H%Me|Mg z)4*kogw%coA*Y=CKHn}3pygefF=|Q7hWx?{GzxM;#JdNE1kX&sjCQNg3cTy@}1AZmVt*J`t}i!7r!bA_ECmyQXix z-Sxv@@?^&{S=1)ozIarXbX4De|9E+fn`BsK%%%&WVU++vkJzQhW zwys~Enn{RV_LMr%d~3v4kFZqvqxY*yX12SvzIxpoDF zm%Dg}1JSwk{Yc(YNE-yy; zRN_IDYI$!14kOi=BO-1J8#DK}-O{A)2eX+%`O9_Cr-CtIIMkrkWJYkkItu{bW%ENa zF5Ck+H>mI(Nht|}fje~=2}TfBYgxX3mJ5or0JZ{Aae@hXpYG=dc?{xCF$czdSRFuJ(SgF3CNiFz+FE{5x^L5$fQ((8cL;(`z(Zq|&HmM)&!Uns%t6+*c_8mB{ajC**_)m&%PJM;&Ck z&h$?aT(hp8Av~mtYt|M=XgcST%99-gO>^)L@Up0j`L;4@>7Ov|rhEf>A?@Lq(s^X& z8-M)S!duD$Nc-8OacH=({53!04EN_|R+OL_Z!2hPYPklnHTM7=k||pL8KsSNt}JB8 zFo3&=tmMXK7y=BL^g>n6oHQbipPH5Cz%M&3VodDmOl|x4q1P?io=wzhqa53@3ghy zA0XNxfZu`G1hrUH%*hORR00Tn>Xo50wAF8bsxc$rJsR=AWfP46PlxZT*u9l5pxuEq zwa40r3U+P{nJXs}Ne&BYCEo&$s6&Ch~USSAeZ8ijHAIViW{5gTF z6mRnHHg>=6HsdG6@fyQqNEIX7?%0ZD!>Bb_LgagBgdY(d5mAc_6H0=@y*L)XmAU+TW1lG*H+hz#NV#J#4>Gf`q_g&h%HQ>-DrJJL@WhFb0XSSs)-V|6oprh!=MO)KoT zFZt6HBP%56XQxx4qXa3Iv;|`v>dU0pQU?bl*g-OBMu^!-^MCUIy%y<-g-|B2wVQ7l z*fVf5cTrst8)xrfk;Vz=LDmlYdR1(e*XT?G=SX<^nSY1FZf8BX}QM(^vr_Ehg7TJoxwv8mJRpKtG|&6`29z9lVpO@ zOp20}Ors^+r`opm{;~WMV6l8l1T$H+d@{uGA-?hHj8S)kKa!}}KXsz2?0>LG4YnoN z{7^fb%bw^tL_qxMLAxn(-nzpfFg;}^a;z_xqJMx$F{H%-%3-fx>YwP;yz#_*h^@X9 zFqnA6v#FN|!2v3QKh26?2KC&HlP-phrNBBaR--1z{!O`k`-SH~UD~7DjFAg#DD5K| z`X$EO&Y_qS%+rlFc)AkjT3Klyu9MUy`IUN8m_&TFP9`W^mkcOS1 zhTGJDM!z9A2W@^=ef@Q^B3m0cn!!dxzNQ0!tANspFm`}DLN!=}A&bKOgN0E|r{bsM{6(+ss6j1bJQ5)G!kqznVJ z zKCfW2$TF$1MkEfZbpY==6al1aRXT}n&?G`=8Mg#Dz1UUpq*DjKUH&LP^@RF6kW=mN zBM~PWtwL=E1-%FeQgma)#U+v{8LlleqQ&4nmj9#vp@`Mq7I7T4oxe~P1!D*%H#R=P zQHfYi%+6I(n5LC>&Yj?wmvT&hDh{QEaT$IBru5FlQge7*>g3ooFcnNUcH^(AEItMY zyG4#6mbn`j{VpmHc52;1!233x0PD;1$m=?HKr9{b{)Jk;tHTBk+ff>C_KiK=wxMhz z!`8_pN4YxGB(s(Yw?`F#6BGF18Ii+xqA*B(e`r;O$K}mG^vQDK$F)9g`kVH411oGT zeW`qgZ|F=^QRF4QEimIp<2Wwolo6i`oh>5infHy5tzHfEaI8CBI2|58OTBg^(5=4D zN4XsOWZ;z5{YB)B$U_oLaN9!A&b0aK7OS;?4&M*E5Ex#ItO;qgay+rV`#Z_NY&}N& zsw)TQ)5vRPW{&+j1%nPxR{DG%;r7;zzvUHm>#~>_TZZKAz7MV4W5+q-OOjW zpyy9M=(yBMSAf}ld$EygwG|=xLCj>BR+jtbBcg9SJi)du)fy-+nAvbF!cKg#3_Vie z2Jj+e3Xox@s>Fh@tH_8^Oq*Znet=xKik>WmCSPDHt7~C80BqP4EC?niz*NZWr+@A) z;6(L@Bp398^08g-MI-ORKn<7nVzuoJy=oK{O$JeScC9}p0as!w(K;W1qq>;HHc>+M zi04DFWu&VV5=j*fr%a)mp$W2(s1(bvbT_{O)D56!;opH!*mMtM8oSh2O&8k841NTq z?EZvTfq3!bn2~No>sKRCGc&7%q&fL&Z$yios(G?ClDy8^WOn4Taxg02rWqFBk%&p3V$r%xmorVqdhmh)4GM{ef(5jAD%ly0d|ThYmT!o$+A3O? zhnegYI^L_P{IHSw(g7?2^XQmJX|4cvQm$EJ;>l^_=%9DPTf)lV*in{YKcIr?B!{Ou zk?+$I91!?!PB`YDeh$%FhC2mjhMdR0C{1nmC4B#WU#_NkQkyauSWmeA(43ZmCHxc1 z%XeGq`#ceUp!~QhU;dhp^-eaY;jZTHnMu#+h@Xhz^+!C-Wb0u>M_)(g)U-6Zl(E#^ z;%uiZK*j`MAtwtbd>pwjaRq@~wSH51?k=FNb?zoBzTA(9VvzD<(KohM^fhzl_s;zT z(FLZtVi3E3P$UO{K|x({*!M7tIJg1w;eP`-N?5vglmhs$lvMpLh3{}6^H?kl5yd0i z4scU2sDADAzB1$Ibyx&;*qD@;g()iiouOlRmgGEksTVw=wa4lvlTLugKIiM7Cs<0; z3S6DE5)n1TS&IeQZ=p=IALk7|{CxVMnA0wEEm-Q~iQzYqA`bLYee6Ml)32Ph2gKp!KJ+l0yA6z;nNO9QA>XpWa)+$jxAv5HZ*HG> z@ci>~Jujmzw}>3SuUXMcn|I)!D6C2V7R-LVVVMdM| zz|yug)DI4BjSt(GhGKeD>`JT)q5y4V$$t@lI$jk_eLmR^OP;bm2qirh#WiMMf&!(hy*+Cj4P?>6*MTvbwLojCl| z2wxtGa@AXME986&@OF)BW`H?T3qK$feA}hV8)gNK92AM(H+Cs%p@;|4Z zo1VKq#Dt_Co30O*t}hGORJE5K8QH5-(R&|x8Z@=dOb%Qp!j;(_K0>cm>V4p*c9G;$*)~C}0`XNYH586gZkW{!dB(}4^oC3(ucX?|6U~@q{ z5knCmlO?Q95HYp+Z-;`P^9)khl5q} z0X(9^S$jCw;O}7NY4DSw-j70D{AkS~FiUcnYw82|^zFc4#yx3M#*FVgN){eE9F8N=)_7Np=cB|3< z$WrpwNqewrp+_F|Q%b;X%C8Upx0>^I-AiL4oEH@fqQ(dG<7S^%>a>^UE1%X>k9t@i z&%gg``J1$$t8H}(gUY@o;`Vp)WIabUHVqmrTobWmWFk2it zc<=R~0Z9!9bl)jZ=IekAL*SV!;RD_@z&cj>J;lv94D1PY0a?~VyhD5wTs&WR9rc0k zq;wZ?%(zA33V1Cv0vgN&TL-YXcPfSw3w2oUByz-{izIbL3eN?CYDU&^Ti!Wv6x0M- zrdQ5mB-Y zj&29h%`B9AJN?LnX3PafgcUkvBa3Q58^HYJaf)a{e#uGSUokzl3eykWxRI%-8)3CX z`#LlqF-0gV>0%egb<);{2c2&VEf&}g2J7UJa_2*L; zf_j|+%k_>|4O!K`KH0R53R_dmyl8Jt4r+AkLX0q@e?#AR!upu94kShpVXnX$&0K;7 zy#R@NwZRkPp67(74JOZ%0T5To02IeFyysV+>% zGQ+yXqe#5J%Ip+02^ECirT0m4d`7{lyq|j+bbeABtk2uc58D~xzqS{rXnhmSyA;-1 z)5mG_co~@BDDHnbRvMm&LP3 zz`PG!pIfv5u%qh*VatA$C{^18+4=0fREZ+&hVr}vE2ZggkX-yvMJflBxIkgz+RqN-BL@2>-w(0nI| zuzcHxO^M)b$99pXkFm8627Iv;oqnBu9fO&XpS_$MTgs6(7_sMjDudg8 zQNnEgsL*5mRj3T@sGbJMb?rA|Dz@VFUw?tT<8ZrsD~%K1bYECVWr^G zN9&)BNLf$iR&6Nr`OS?qn=7vvrK-%NkAYqx8taSy5hvsSc7ka^@U8uhZsk>%B;_RR zRZ>r1e!?})_FLJUI@;X`cr%IM+eHPnBVjE@@U1YjpyzaN*B4>5xc|3$93TIRhP4fR zi-VH?I&$zvjVTt&D#F$AjmLPpX@*4NbI%#0N0Yc0-{I8+Z07&&HP_vm1h3{Z1WUm= z__TT#h~$V*c+A^gv;W2Y)$&EFDQR67nnejG0qspc;Qd zK|i{nkXQZpte8wtp{cZ0Y+KuW8jB!%Wvj=il^7gTipp#W9Ruj?#hgjmm?-#Ko5c|( z;Qjn>#S=5?!AWKlZ8(k|Qhd4Nd>d35fQwJ1E}pDr{*6$}7xqn}MMe&xM{zc7c~lbP zPx@$Pv*w*rF#`OPvLPFd+g=S|wd#mmastfx`N`+A|X$KN<;leMb8G`x4 zs?ll+!v0j3$7cvB|NsBywp94Hm)Szy+=x1{>ycgmx#5?m1}Ex-O*Svhv9e&!cMGoZ z22GQf$rqL1jYzYj8C|7i>Pj_E<9qB(R8I&<1!|-}b%?PU7!)7uJ63`r`)dUxx5?2m zhW+nT6$CeRd!8+Ozcm6}3nL@8bAt7V0L03~_}$&SCbvl!Z0%!;ekJ;p&Oerf#Xp@D z6nIZ8T(m@>mGhb%%{7LTid6+zX(aqDAd-v!{6z1aJ0zywpCiDWTq@B^#(Ln->6Uh- z&X{&5QfE&wzYC>OBD5;`#&pq#?mFUwHMVJc=(T6b} z+m-2wJuU)L3JKl1n9_R+B}HnjDZjq`hOFtp7d58!ee}9GqIX_$=bZo26ZXH0toe>B za}opy0-eXQ)AT-6mG4QIJ{4-5BV1e9xU+&ur3YZ`*>$q_}Tk8^Fv6Icf=V|^p048vPf{&=d^=7$&3DHFdk}EFsI0u4t3~Sn&Xo`?<|Y8xOrIgB zEm#KLdxj!?5~x0dYbH6a({a*I?L>+1TvLlX8{tsG;ITLsxwMR_z4~0jEL9_CUOW*! z*M-HoP=1iO0j4qZDYn3EMOu1Dg~Q{`f1eaOdfXHk5jZS2G9}4PdrI=YUe_;vmE!SU zTcZ2YGjy-j)2Tyzb-8w@M$gOLEoTZLq6{|}TJs61{DhQhcW;ndJ2sTCm@doqxN9v@ zr36eV0R0qb8bnq5{`)4(DbS~sRabwvY5-O54Gm_(ot3*9rsmv=6BhBMX!?5pwVnfC zhVjCJ+pi9{P=dKqAjrs~Cd`*c*GQg-whLU8{hs6Mr1hpQ)#xE^cgrHO zDxnMPopZe39d?rvywV?Cy?8HC+Zf7S(tggL&;WuqNO7a3fF~y~AR99_`oH)25a_P7 zn6))EVIv(^fFN-ogaAW--YGT-6}_#4WH6hGNq2M50lW62COt$awnynYvf*SxXw^|* z{raCI%+TVY*?5Ixf9#xQdOYZT@^x&kQ!(=2ciX%R5OEk`*q)C5b#Zot!LhQYYO^$1C6D`2 z?>eKwf~3Y$Q9F9PnR``oaa#tOs>x9*(l;y94>`w{)nSsQep`~7yIf^WtKw+!roT8m zCcIS{8BbTHKQl@DlG(Ldj)(>QHUBE*I==Zfgo@sW=oP{D3nk((nFNTTW#-P3fCDpTq!9cupj zO+(G7oIMZSSk?1|_#P#Vp@1!49%T$MTv;AJmX1QePPX_nVwz4h>Ciq*6zU+hQ%pR4 zYyVBa)xIO&t~HZP#9k|>|9_=sjcX>eX<*TdRZQ0N#^jXcxg8@-WZU8HMJ zP^DzRd3?exSAj+|nrprHS5K+l*NpMcm*W~nL^c8&I>R?y!?1XnO7uA@JA#9%+8mQ? zik)bGA|2bB&rl*mi3VI<+-;67lxZ(bQNDf4(3WC(i#3Qdz37w}Sad}RlRs2X#`9|2 zqezME({@en=5?bE#}?wuJ&c5#MxgL$F2j*ee{76c61}0S`hCNkyqowqepX;&zt6<) z?V}{K874y`Y8n*;KQ?TY5>z(TMd$n#Iih$klq2>Wa#gX|eLN;9F*XkN=sUi2MQ=Xr zt8QnSXyb36C+Uzi^@ZBra_7fl6|JSqM-_fXn#GYg8}j7L6OKEJz{$V<#OBy1p{BwObv!l4XRyX~c0bkMO@(=t8bko%lvONE}?eB=ygtFD~=S z>k0Ce3yV50O-;w``u%L_LD@;qxL zc{P%egHM8CLQY;ruR>PzKv)Q_q+4`xSisMYQ7;7@3g1r@Xf&y-Pca>#;QQRYG z{pl{+CO-86TsIDpEvi*Tauj?=qPi=RHd~;?eHjM-_-n-HZJMT%q zM%|;5eZ@t@H!s$7BGqcl)KA&);#N==BT*otrYJAK`lk=PSEL4w z!gxFJ)JdI|GUdp(c;)+n4-SPM#=Q&$|Hohr^h+!Lt2ODu2-Q1M)oej+IO$|5DNkR2 z0?k4*wPWhbDJ!boTb?7lov}GXMuC1|&Z~C}!LU`KU#KW8EW#3|Xv{t_)lcIzdE=ED zI)Co`y^F|Yqy-(_KMGe*2d^f%g0811qC{opzKaoix5lVF_>L^5+@M2XxU47vXcuo8 z^^CR)Q~g_#O^M0f-9JE;il{Dpah9WHH!3Q~)KU(lGMjlPR_BvcLlUmYjKmmEP=nY; z>R+z?rc^Y{0otdEQgnbLjy6=U&&6CX-6;)U^cx#5^5D1%8}r_XbY*M0j*m%~#TVVx zW*nD=vHq;OD(|-hUJeGG3aeAPDl#e)8LorRm>J%?H!K*g?KsDKKY!28Nl8!#aeSd= z2$>WM){^#C7wi=~M!-Y-G^$yAYvziSiA6>w?&IwX^9YlHV=pfkNZ86-FRgB2HB#<17CCBzE-fwWH5_bSFKbEqYU8@J{`D#GXn~)D{!(_ZHS9 zfaPV>7Lq2ILc3u=p3(t)oKJGh(w&+W9%J1ls;xS>`cTx=%)~ir2O3fS&`Bzlb)9ca zz9I{JY^19|%0PJ-|D#Se%0O9rof~ke6&w5-r9|`a?eDZ*D?90r zsvv|tMKRxSi+Rq1`Z`Kr)Mu@@(p$AKrQnI>n13~!bo;xwx`Cdl;7D7$<}c?;Niwq6 ze9dKN76inZ>1gyl5*DyeizFLnnG(x6uDtU73lCyL?MPy6`U7lu#z631>-Zc+6sZOzJJsD+6Q|UZ*AG z6<5QNGz$LhFeuV{^>jP)7FG4G6`iY7^R1a#g*k%^<_z_o{o@WpvgayMx2F26 z$}V^q0*KMt-`?)OU7y>lGXLeTB(gDBB!!f;{OTfwF>d@_o+i@!HbXZyA2n&-xk#aC zu^^=D^ycYnBG;z(DQ^q4@+^!J*_vWf$zA$5ZeEwf^+T5^eL;L2{Y}G?)tS9hs7UJI z$X1T^fhyL0H#svJ>Dso@IC`t*KqF~8QPX^r>Ccy8K71Lr{%D)O*dt%a*D#^GQlywT zlVGe8)2R=jmaFKdbSV{!=Ux+0QGL)2$l$q*{aGto~wx^F}Jll!ZBc(TO8I zi4^)-AWZP02dfb0RctzrZ6VAIHMSkg!so!FZYFl#g;}YC+vM?YF*vrzk<*O-W^$>g z!;xY4u%%O%r$^$bnbqD%X(XPPy3Y@)-zZ*3Ng5eZ4+{0+u_Y+Ls`02pYoG@pNlt%u zG9SuuL*{#Mmx$r*93FkeY3CJsne`?pNdz-(o`My>Le0fp&4YVwId`TxJG#Tx1(7WA zj_aazv2iW$d)Sh@^Ea&MX$F0;L6YmL_k29xCpyg&UO;L|PfIW1Dyu3>)zzK}8Fa;MCTrP_4znCOi_hjY z7<0|Ybm|`$G$8Y`=S^|v8oT!X?b<<|G)4PGOECMp#jNi8w!Nv^?!hcQ(pysIICW0# z0U8mzOg8hdf!{}JA6`({v>l0x_QC|cQ(K1{Q{lggz{(-T60@mWM?a$KQK_U8h$_&R zh#Y9_e%>$aHPFNre1rcEiZ0C<-CGLAae(n{u4uwcKf7onvKW_79=5ZsOx|1bg2_^W z7s9FJ3LF($N4_Wv=TVQwL%#C*mx%P_eyY9Enl$Jw+8R5jtC5N6#5Z|vGEQ5GXBB@1 zbtzLMi37`wBo;aP&~61vJd;Qhid9?{iTKkhu}kx0un^O9c@y1#8fWS@X|v_y%m+SG z8q#vRaiu6q={K!Wn(t<7`EyB2lxdkBo`yj&t!dKsOTtb_`Z5YfkdD(A!?LIGkN@Kz zHNj@Y;KCondVn2^R1*JAS^i;f3zaFA7wi88UI?N0j$)w_l$z{twVcF3>7+i4k1CWJ z9OQ=}{lQTxr*;rt8SV*5HwmZ+6{U2Ee5D+YUc85w6aG^Y{3C@*(w6{AaxFxHxxapd zU`TuB2umo!s7^8^CC5<&QDcei2IyV0F%^$x6S1t45#%Y1%Gpm{WOL+YR}dvtAdC9t zTma zIG}`b0u(b*+{NmEzP56+RxBeI3;qp5S#vc*Nu*1KO2i*uB7qRWf0}#LteGchC=#=y zBcfy?8CEhviY6!!93WRpqCnxGPQ*lL)lra>mjQAY&{s!1EmC(hs-y<8Ur;g~lV92} zqC$;od1o_RPq-2vLW8GIC(s#$Bjt+HPGFi=D;$MiKdO|sS~la2U?C&-xqui~xg^42 zEN6v6<*E+_)8<9cf=79BaUyH{qf)b{D5dhDlTh5-zC-9~mTa#ec_1SY=rUXFOxY#5R&FIRwN}rILtp$`fW3 zM#PCd2^HjJC5~AC+OfE8JF&QU?wOh8Rtt7Vc)i$6Kd!j(7F^#BHRF~WbhEEX$|#WHRd>x`6TZH>he zED9FB6K>RX3y)_EBw@++Uv=fqPg&C5r&xtb zQ&jiEyj1Fs?AxMy>q4m*S~Jj55Vk@xG5Wfi*=S}6Cr=m6sFYnkIh~Y*{7zQBz)>Cr za%iC$$`bg9K8LwftfDc+$~y@NkrwA&Kt8$AOrNZk5d9&I^-5M6T~@-5XDmA_^av#) z1GJG?(W0fq+Z(Jny=M;VTG_xdDGp9H?Z%U3cCt+7i1ZoPlB*yp2_2~-0_v&cmq#~Y z#gaKMREzp%aE#%o0x3cqQEpiyC2Y)v!jTbgj}VtURFZ;4k?`M>^6=7WDFn$ci^LM% z3(yBGWvHPr6(F({nIc<+YbkO_NtL0B5_M4L1tB>B(K+Q&j9xT7eH>R@wcV_ZvzAPV zZh$imTgwseQ*+ScvDA#CM+r5m!Ko*Rj^W}IQQCMiE`CqWiX*6*Q=W2CX(tu4%dL2Y zXlfU2jwAJ9DyL{|dEP}kiyEqmLY;-lK}yMRS#gkTR-P=Yu+wR4E3y?mQ&v=LiXkmd z4L-7__$QFb#DUHig~O3dCKE~YZPCZjBcAV(N2HQ&eYc{skikDkU0I6*!<2Fl0<~a@=$Sb zb`vftL6Q_A&!#08N+M8%lO8f(mAwN=S(m&oiNwZ<7_4#e@)V2!D=l&pg*T~OWMS!#=nfvXurP(7cq1vsgqV5c$Pf>EB`^qt zAuT6t#EaP!(+(ydsnS9j+$2hX4~ **Update & security** > ***Windows Update** > **Advanced options**. +:::image type="content" source="media/7991583-update-seeker-enabled.png" alt-text="Screenshot of the Get the latest updates as soon as they're available option in the Windows updates page of Settings." lightbox="media/7991583-update-seeker-enabled.png"::: The following options are available for the policy: diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 36c302b87d..3918a661e6 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -200,6 +200,37 @@ When you disable this setting, users will see **Some settings are managed by you If you use Windows Server Update Server (WSUS), you can prevent users from scanning Windows Update. To do this, use **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Remove access to use all Windows Update features**. +#### I want to enable optional updates + +(*Starting in Windows 11, version 22H2 or later*) + +In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using the **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > Enable optional updates** policy. + +To keep the timing of updates consistent, the **Enable optional updates** policy respects the [deferral period for quality updates](#configure-when-devices-receive-quality-updates). This policy allows you to choose if devices should receive CFRs in addition to the optional nonsecurity preview releases, or if the end-user can make the decision to install optional updates. This policy can change the behavior of the **Get the latest updates as soon as they're available** option in **Settings** > **Update & security** > ***Windows Update** > **Advanced options**. + +The following options are available for the policy: + +- **Automatically receive optional updates (including CFRs)**: + - The latest optional nonsecurity updates and CFRs are automatically installed on the device. The quality update deferral period is applied to the installation of these updates. + - The **Get the latest updates as soon as they're available** option is selected and users can't change the setting. + - Devices will receive CFRs in early phases of the rollout. + +- **Automatically receive optional updates**: + - The latest optional nonsecurity updates are automatically installed on the device but CFRs aren't. The quality update deferral period is applied to the installation of these updates. + - The **Get the latest updates as soon as they're available** option isn't selected and users can't change the setting. + +- **Users can select which optional updates to receive**: + - Users can select which optional updates to install from **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Optional updates**. + - Optional updates are offered to the device, but user interaction is required to install them unless the **Get the latest updates as soon as they're available** option is also enabled. + - CFRs are offered to the device, but not necessarily in the early phases of the rollout. + - Users can enable the **Get the latest updates as soon as they're available** option in **Settings** > **Update & security** > ***Windows Update** > **Advanced options**. If the user enables the **Get the latest updates as soon as they're available**, then: + - The device will receive CFRs in early phases of the rollout. + - Optional updates are automatically installed on the device. + +- **Not configured** (default): + - Optional updates aren't installed on the device and the **Get the latest updates as soon as they're available** option is disabled. + - + #### I want to enable features introduced via servicing that are off by default (*Starting in Windows 11, version 22H2 or later*) From 2d85abcb6a9adef29d11e87d39d3cac69d4077e9 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 14 Aug 2023 16:20:52 -0700 Subject: [PATCH 027/125] updateseeker-7991583 --- windows/deployment/update/waas-wufb-group-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 3918a661e6..076e89d74f 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -206,7 +206,7 @@ If you use Windows Server Update Server (WSUS), you can prevent users from scann In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using the **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > Enable optional updates** policy. -To keep the timing of updates consistent, the **Enable optional updates** policy respects the [deferral period for quality updates](#configure-when-devices-receive-quality-updates). This policy allows you to choose if devices should receive CFRs in addition to the optional nonsecurity preview releases, or if the end-user can make the decision to install optional updates. This policy can change the behavior of the **Get the latest updates as soon as they're available** option in **Settings** > **Update & security** > ***Windows Update** > **Advanced options**. +To keep the timing of updates consistent, the **Enable optional updates** policy respects the [deferral period for quality updates](waas-configure-wufb.md#configure-when-devices-receive-quality-updates). This policy allows you to choose if devices should receive CFRs in addition to the optional nonsecurity preview releases, or if the end-user can make the decision to install optional updates. This policy can change the behavior of the **Get the latest updates as soon as they're available** option in **Settings** > **Update & security** > ***Windows Update** > **Advanced options**. The following options are available for the policy: From 179b6837e23a7408e51d811c9148723162c78c32 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 14 Aug 2023 16:25:02 -0700 Subject: [PATCH 028/125] updateseeker-7991583 --- windows/deployment/update/waas-configure-wufb.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index b67ebc54ad..550d1eb323 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -270,7 +270,8 @@ The following are quick-reference tables of the supported policy values for Wind | GPO Key | Key type | Value | | --- | --- | --- | -| AllowTemporaryEnterpriseFeatureControl

*Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
2: Automatically receive optional updates
3: Users can select which optional updates to receive
Other value or absent: Don't receive optional updates| +| AllowOptionalContent

*Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
2: Automatically receive optional updates
3: Users can select which optional updates to receive
Other value or absent: Don't receive optional updates| +| AllowTemporaryEnterpriseFeatureControl

*Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD | 2: Systems take feature updates for the Windows Insider build - Fast
4: Systems take feature updates for the Windows Insider build - Slow
8: Systems take feature updates for the Release Windows Insider build

Other value or absent: Receive all applicable updates | | DeferFeatureUpdates | REG_DWORD | 1: Defer feature updates
Other value or absent: Don't defer feature updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: Defer feature updates by given days | @@ -285,7 +286,7 @@ The following are quick-reference tables of the supported policy values for Wind | MDM Key | Key type | Value | | --- | --- | --- | -| AllowTemporaryEnterpriseFeatureControl

*Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
2: Automatically receive optional updates
3: Users can select which optional updates to receive
Other value or absent: Don't receive optional updates| +| AllowOptionalContent

*Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
2: Automatically receive optional updates
3: Users can select which optional updates to receive
Other value or absent: Don't receive optional updates| | AllowTemporaryEnterpriseFeatureControl

*Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD |2: Systems take feature updates for the Windows Insider build - Fast
4: Systems take feature updates for the Windows Insider build - Slow
8: Systems take feature updates for the Release Windows Insider build
32: Systems take feature updates from General Availability Channel
Note: Other value or absent: Receive all applicable updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: Defer feature updates by given days | From 1cd7f8f1f583b3d78cc3edce3ad10c82d4000d5c Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 14 Aug 2023 16:27:49 -0700 Subject: [PATCH 029/125] updateseeker-7991583 --- windows/deployment/update/waas-wufb-group-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 076e89d74f..2e5b11bdd0 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -229,7 +229,7 @@ The following options are available for the policy: - **Not configured** (default): - Optional updates aren't installed on the device and the **Get the latest updates as soon as they're available** option is disabled. - - + #### I want to enable features introduced via servicing that are off by default From f7fb6b07519f6caaafe93320dc603ca07e99f72d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 17 Aug 2023 11:34:09 -0700 Subject: [PATCH 030/125] add mbam/mdop from 2019 8233265 --- windows/whats-new/deprecated-features.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 5d0649468d..866159a45c 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -49,6 +49,7 @@ The features in this article are no longer being actively developed, and might b | Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | | Companion Device Framework | The [Companion Device Framework](/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 | | Dynamic Disks | The [Dynamic Disks](/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](/windows-server/storage/storage-spaces/overview) in a future release.| 2004 | +| Microsoft BitLocker Administration and Monitoring (MBAM)| [Microsoft BitLocker Administration and Monitoring (MBAM)](/microsoft-desktop-optimization-pack/mbam-v25/), part of the [Microsoft Desktop Optimization Pack (MDOP)](/lifecycle/announcements/mdop-extended) is is no longer being developed. | September, 2019 | | Language Community tab in Feedback Hub | The Language Community tab will be removed from the Feedback Hub. The standard feedback process: [Feedback Hub - Feedback](feedback-hub://?newFeedback=true&feedbackType=2) is the recommended way to provide translation feedback. | 1909 | | My People / People in the Shell | My People is no longer being developed. It may be removed in a future update. | 1909 | | Package State Roaming (PSR) | PSR will be removed in a future update. PSR allows non-Microsoft developers to access roaming data on devices, enabling developers of UWP applications to write data to Windows and synchronize it to other instantiations of Windows for that user.
 
The recommended replacement for PSR is [Azure App Service](/azure/app-service/). Azure App Service is widely supported, well documented, reliable, and supports cross-platform/cross-ecosystem scenarios such as iOS, Android and web.
 
PSR was removed in Windows 11.| 1909 | From 9f7653268fc4ea8f2a7fd260560abd36fb778686 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 17 Aug 2023 11:35:56 -0700 Subject: [PATCH 031/125] add mbam/mdop from 2019 8233265 --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 866159a45c..4729a760c3 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer developing in Windows 10 and Windows 11. -ms.date: 08/01/2023 +ms.date: 08/17/2023 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium From 57b38f935cf2f4c143496c863ec0d95e18585113 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 18 Aug 2023 12:05:40 -0700 Subject: [PATCH 032/125] ds-api-props-8092737 --- .../deployment-service-expedited-updates.md | 41 +++++++++++++------ .../deployment-service-feature-updates.md | 2 +- 2 files changed, 30 insertions(+), 13 deletions(-) diff --git a/windows/deployment/update/deployment-service-expedited-updates.md b/windows/deployment/update/deployment-service-expedited-updates.md index f284522eb8..3d2bf93f14 100644 --- a/windows/deployment/update/deployment-service-expedited-updates.md +++ b/windows/deployment/update/deployment-service-expedited-updates.md @@ -8,7 +8,7 @@ ms.author: mstewart manager: aaroncz ms.topic: article ms.technology: itpro-updates -ms.date: 07/31/2023 +ms.date: 08/22/2023 --- # Deploy expedited updates with Windows Update for Business deployment service @@ -47,13 +47,13 @@ All of the [prerequisites for the Windows Update for Business deployment service ## List catalog entries for expedited updates -Each update is associated with a unique [catalog entry](/graph/api/resources/windowsupdates-catalogentry). You can query the catalog to find updates that can be expedited. The `id` returned is the **Catalog ID** and is used to create a deployment. The following query lists all security updates that can be deployed as expedited updates by the deployment service. Using `$top=3` and ordering by `ReleaseDateTimeshows` displays the three most recent updates. +Each update is associated with a unique [catalog entry](/graph/api/resources/windowsupdates-catalogentry). You can query the catalog to find updates that can be expedited. The `id` returned is the **Catalog ID** and is used to create a deployment. The following query lists all security updates that can be deployed as expedited updates by the deployment service. Using `$top=1` and ordering by `ReleaseDateTimeshows` displays the most recent update that can be deployed as expedited. ```msgraph-interactive -GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$filter=isof('microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry') and microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/isExpeditable eq true&$orderby=releaseDateTime desc&$top=3 +GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$filter=isof('microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry') and microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/isExpeditable eq true&$orderby=releaseDateTime desc&$top=1 ``` -The following truncated response displays a **Catalog ID** of `693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432` for the `01/10/2023 - 2023.01 B Security Updates for Windows 10 and later` security update: +The following truncated response displays a **Catalog ID** of `e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5` for the `08/08/2023 - 2023.08 B SecurityUpdate for Windows 10 and later` security update: ```json { @@ -61,21 +61,38 @@ The following truncated response displays a **Catalog ID** of `693fafea03c24cca "value": [ { "@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry", - "id": "693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432", - "displayName": "01/10/2023 - 2023.01 B Security Updates for Windows 10 and later", + "id": "e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5", + "displayName": "08/08/2023 - 2023.08 B SecurityUpdate for Windows 10 and later", "deployableUntilDateTime": null, - "releaseDateTime": "2023-01-10T00:00:00Z", + "releaseDateTime": "2023-08-08T00:00:00Z", "isExpeditable": true, - "qualityUpdateClassification": "security" - }, - ... + "qualityUpdateClassification": "security", + "catalogName": "2023-08 Cumulative Update for Windows 10 and later", + "shortName": "2023.08 B", + "qualityUpdateCadence": "monthly", + "cveSeverityInformation": { + "maxSeverity": "critical", + "maxBaseScore": 9.8, + "exploitedCves@odata.context": "https://graph.microsoft.com/$metadata#admin/windows/updates/catalog/entries('e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5')/microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/cveSeverityInformation/exploitedCves", + "exploitedCves": [ + { + "number": "ADV230003", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/ADV230003" + }, + { + "number": "CVE-2023-38180", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180" + } + ] + } + } ] } ``` ## Create a deployment -When creating a deployment, there are [multiple options](/graph/api/resources/windowsupdates-deploymentsettings) available to define how the deployment behaves. The following example creates a deployment for the `01/10/2023 - 2023.01 B Security Updates for Windows 10 and later` security update with catalog entry ID `693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432`, and defines the `expedite` and `userExperience` deployment options in the request body. +When creating a deployment, there are [multiple options](/graph/api/resources/windowsupdates-deploymentsettings) available to define how the deployment behaves. The following example creates a deployment for the `08/08/2023 - 2023.08 B SecurityUpdate for Windows 10 and later` security update with catalog entry ID `e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5`, and defines the `expedite` and `userExperience` deployment options in the request body. ```msgraph-interactive POST https://graph.microsoft.com/beta/admin/windows/updates/deployments @@ -87,7 +104,7 @@ content-type: application/json "@odata.type": "#microsoft.graph.windowsUpdates.catalogContent", "catalogEntry": { "@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry", - "id": "693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432" + "id": "e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5" } }, "settings": { diff --git a/windows/deployment/update/deployment-service-feature-updates.md b/windows/deployment/update/deployment-service-feature-updates.md index 0b81021c36..91b9bca1b7 100644 --- a/windows/deployment/update/deployment-service-feature-updates.md +++ b/windows/deployment/update/deployment-service-feature-updates.md @@ -8,7 +8,7 @@ ms.author: mstewart manager: aaroncz ms.topic: article ms.technology: itpro-updates -ms.date: 07/31/2023 +ms.date: 08/22/2023 --- # Deploy feature updates with Windows Update for Business deployment service From 01d2ee024f5e52ba61515a19768be2eb0e40a7dd Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 18 Aug 2023 14:44:31 -0700 Subject: [PATCH 033/125] ds-api-props-8092737 --- .../deployment-service-expedited-updates.md | 81 +++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/windows/deployment/update/deployment-service-expedited-updates.md b/windows/deployment/update/deployment-service-expedited-updates.md index 3d2bf93f14..9ebaccd539 100644 --- a/windows/deployment/update/deployment-service-expedited-updates.md +++ b/windows/deployment/update/deployment-service-expedited-updates.md @@ -90,6 +90,87 @@ The following truncated response displays a **Catalog ID** of `e317aa8a0455ca60 } ``` +The deployment service can display more information about updates that were released on or after January 2023. Using [product revision](/graph/api/resources/windowsupdates-productrevision) gives you additional information about the updates, such as the KB numbers, and the `MajorVersion.MinorVersion.BuildNumber.UpdateBuildRevision`. Windows 10 and 11 share the same major and minor versions, but have different build numbers. + +Use the following to display the product revision information for the most recent quality update: + +```msgraph-interactive +GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$expand=microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/productRevisions&$orderby=releaseDateTime desc&$top=1 +``` + + +The following truncated response displays information about KB5029244 for Windows 10, version 22H2, and KB5029263 for Windows 11, version 22H2: + +```json +{ + "@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries(microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/productRevisions())", + "value": [ + { + "@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry", + "id": "e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5", + "displayName": "08/08/2023 - 2023.08 B SecurityUpdate for Windows 10 and later", + "deployableUntilDateTime": null, + "releaseDateTime": "2023-08-08T00:00:00Z", + "isExpeditable": true, + "qualityUpdateClassification": "security", + "catalogName": "2023-08 Cumulative Update for Windows 10 and later", + "shortName": "2023.08 B", + "qualityUpdateCadence": "monthly", + "cveSeverityInformation": { + "maxSeverity": "critical", + "maxBaseScore": 9.8, + "exploitedCves@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries('e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5')/microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/cveSeverityInformation/exploitedCves", + "exploitedCves": [ + { + "number": "ADV230003", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/ADV230003" + }, + { + "number": "CVE-2023-38180", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180" + } + ] + }, + "productRevisions@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries('e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5')/microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/productRevisions", + "productRevisions": [ + { + "id": "10.0.19045.3324", + "displayName": "Windows 10, version 22H2, build 19045.3324", + "releaseDateTime": "2023-08-08T00:00:00Z", + "version": "22H2", + "product": "Windows 10", + "osBuild": { + "majorVersion": 10, + "minorVersion": 0, + "buildNumber": 19045, + "updateBuildRevision": 3324 + }, + "knowledgeBaseArticle@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries('e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5')/microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/productRevisions('10.0.19045.3324')/knowledgeBaseArticle/$entity", + "knowledgeBaseArticle": { + "id": "KB5029244", + "url": "https://support.microsoft.com/help/5029244" + } + }, + { + "id": "10.0.22621.2134", + "displayName": "Windows 11, version 22H2, build 22621.2134", + "releaseDateTime": "2023-08-08T00:00:00Z", + "version": "22H2", + "product": "Windows 11", + "osBuild": { + "majorVersion": 10, + "minorVersion": 0, + "buildNumber": 22621, + "updateBuildRevision": 2134 + }, + "knowledgeBaseArticle@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries('e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5')/microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/productRevisions('10.0.22621.2134')/knowledgeBaseArticle/$entity", + "knowledgeBaseArticle": { + "id": "KB5029263", + "url": "https://support.microsoft.com/help/5029263" + } + }, +``` + ## Create a deployment When creating a deployment, there are [multiple options](/graph/api/resources/windowsupdates-deploymentsettings) available to define how the deployment behaves. The following example creates a deployment for the `08/08/2023 - 2023.08 B SecurityUpdate for Windows 10 and later` security update with catalog entry ID `e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5`, and defines the `expedite` and `userExperience` deployment options in the request body. From a61502339e663cfaf46b3954fb73d9f28fb44c60 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 18 Aug 2023 14:49:09 -0700 Subject: [PATCH 034/125] ds-api-props-8092737 --- .../deployment/update/deployment-service-expedited-updates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/deployment-service-expedited-updates.md b/windows/deployment/update/deployment-service-expedited-updates.md index 9ebaccd539..8f46741631 100644 --- a/windows/deployment/update/deployment-service-expedited-updates.md +++ b/windows/deployment/update/deployment-service-expedited-updates.md @@ -91,7 +91,7 @@ The following truncated response displays a **Catalog ID** of `e317aa8a0455ca60 ``` The deployment service can display more information about updates that were released on or after January 2023. Using [product revision](/graph/api/resources/windowsupdates-productrevision) gives you additional information about the updates, such as the KB numbers, and the `MajorVersion.MinorVersion.BuildNumber.UpdateBuildRevision`. Windows 10 and 11 share the same major and minor versions, but have different build numbers. - + Use the following to display the product revision information for the most recent quality update: ```msgraph-interactive From 09aac6547eb796db55ee58b1dec57573fb21a901 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Fri, 18 Aug 2023 16:22:06 -0700 Subject: [PATCH 035/125] add must-keep collection --- windows/application-management/app-v/appv-about-appv.md | 1 + ...add-or-remove-an-administrator-with-the-management-console.md | 1 + .../appv-add-or-upgrade-packages-with-the-management-console.md | 1 + .../app-v/appv-administering-appv-with-powershell.md | 1 + ...nistering-virtual-applications-with-the-management-console.md | 1 + .../appv-allow-administrators-to-enable-connection-groups.md | 1 + .../app-v/appv-application-publishing-and-client-interaction.md | 1 + ...pv-apply-the-deployment-configuration-file-with-powershell.md | 1 + .../appv-apply-the-user-configuration-file-with-powershell.md | 1 + .../application-management/app-v/appv-auto-batch-sequencing.md | 1 + windows/application-management/app-v/appv-auto-batch-updating.md | 1 + .../app-v/appv-auto-clean-unpublished-packages.md | 1 + windows/application-management/app-v/appv-auto-provision-a-vm.md | 1 + .../application-management/app-v/appv-available-mdm-settings.md | 1 + windows/application-management/app-v/appv-capacity-planning.md | 1 + .../app-v/appv-client-configuration-settings.md | 1 + ...v-configure-access-to-packages-with-the-management-console.md | 1 + ...-configure-connection-groups-to-ignore-the-package-version.md | 1 + ...e-the-client-to-receive-updates-from-the-publishing-server.md | 1 + .../app-v/appv-connect-to-the-management-console.md | 1 + .../application-management/app-v/appv-connection-group-file.md | 1 + .../app-v/appv-connection-group-virtual-environment.md | 1 + ...pv-convert-a-package-created-in-a-previous-version-of-appv.md | 1 + ...-group-with-user-published-and-globally-published-packages.md | 1 + .../app-v/appv-create-a-connection-group.md | 1 + ...te-a-custom-configuration-file-with-the-management-console.md | 1 + .../app-v/appv-create-a-package-accelerator-with-powershell.md | 1 + .../app-v/appv-create-a-package-accelerator.md | 1 + ...v-create-a-virtual-application-package-package-accelerator.md | 1 + .../app-v/appv-create-and-use-a-project-template.md | 1 + .../app-v/appv-creating-and-managing-virtualized-applications.md | 1 + ...virtual-application-extensions-with-the-management-console.md | 1 + .../app-v/appv-delete-a-connection-group.md | 1 + .../app-v/appv-delete-a-package-with-the-management-console.md | 1 + .../app-v/appv-deploy-appv-databases-with-sql-scripts.md | 1 + ...v-packages-with-electronic-software-distribution-solutions.md | 1 + .../app-v/appv-deploy-the-appv-server-with-a-script.md | 1 + .../application-management/app-v/appv-deploy-the-appv-server.md | 1 + windows/application-management/app-v/appv-deploying-appv.md | 1 + .../app-v/appv-deploying-microsoft-office-2010-wth-appv.md | 1 + .../app-v/appv-deploying-microsoft-office-2013-with-appv.md | 1 + .../app-v/appv-deploying-microsoft-office-2016-with-appv.md | 1 + ...g-packages-with-electronic-software-distribution-solutions.md | 1 + .../app-v/appv-deploying-the-appv-sequencer-and-client.md | 1 + .../app-v/appv-deploying-the-appv-server.md | 1 + .../application-management/app-v/appv-deployment-checklist.md | 1 + .../application-management/app-v/appv-dynamic-configuration.md | 1 + ...h-packages-with-electronic-software-distribution-solutions.md | 1 + .../appv-enable-reporting-on-the-appv-client-with-powershell.md | 1 + .../app-v/appv-enable-the-app-v-desktop-client.md | 1 + windows/application-management/app-v/appv-evaluating-appv.md | 1 + windows/application-management/app-v/appv-for-windows.md | 1 + windows/application-management/app-v/appv-getting-started.md | 1 + .../application-management/app-v/appv-high-level-architecture.md | 1 + ...onvert-the-associated-security-identifiers-with-powershell.md | 1 + ...e-management-and-reporting-databases-on-separate-computers.md | 1 + ...ppv-install-the-management-server-on-a-standalone-computer.md | 1 + .../appv-install-the-publishing-server-on-a-remote-computer.md | 1 + ...appv-install-the-reporting-server-on-a-standalone-computer.md | 1 + .../application-management/app-v/appv-install-the-sequencer.md | 1 + .../appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md | 1 + windows/application-management/app-v/appv-maintaining-appv.md | 1 + ...packages-running-on-a-stand-alone-computer-with-powershell.md | 1 + ...onnection-groups-on-a-stand-alone-computer-with-powershell.md | 1 + .../app-v/appv-managing-connection-groups.md | 1 + .../app-v/appv-migrating-to-appv-from-a-previous-version.md | 1 + .../app-v/appv-modify-an-existing-virtual-application-package.md | 1 + .../app-v/appv-modify-client-configuration-with-powershell.md | 1 + .../app-v/appv-move-the-appv-server-to-another-computer.md | 1 + windows/application-management/app-v/appv-operations.md | 1 + .../application-management/app-v/appv-performance-guidance.md | 1 + windows/application-management/app-v/appv-planning-checklist.md | 1 + .../app-v/appv-planning-folder-redirection-with-appv.md | 1 + .../app-v/appv-planning-for-appv-server-deployment.md | 1 + windows/application-management/app-v/appv-planning-for-appv.md | 1 + .../app-v/appv-planning-for-high-availability-with-appv.md | 1 + .../app-v/appv-planning-for-sequencer-and-client-deployment.md | 1 + .../app-v/appv-planning-for-using-appv-with-office.md | 1 + ...eploy-appv-with-electronic-software-distribution-solutions.md | 1 + .../application-management/app-v/appv-planning-to-deploy-appv.md | 1 + .../app-v/appv-preparing-your-environment.md | 1 + windows/application-management/app-v/appv-prerequisites.md | 1 + .../app-v/appv-publish-a-connection-group.md | 1 + .../app-v/appv-publish-a-packages-with-the-management-console.md | 1 + ...unregister-a-publishing-server-with-the-management-console.md | 1 + .../app-v/appv-release-notes-for-appv-for-windows-1703.md | 1 + .../app-v/appv-release-notes-for-appv-for-windows.md | 1 + windows/application-management/app-v/appv-reporting.md | 1 + ...ocally-installed-applications-inside-a-virtual-environment.md | 1 + .../application-management/app-v/appv-security-considerations.md | 1 + .../app-v/appv-sequence-a-new-application.md | 1 + .../app-v/appv-sequence-a-package-with-powershell.md | 1 + .../app-v/appv-supported-configurations.md | 1 + windows/application-management/app-v/appv-technical-reference.md | 1 + ...o-another-version-of-a-package-with-the-management-console.md | 1 + windows/application-management/app-v/appv-troubleshooting.md | 1 + ...ding-to-app-v-for-windows-10-from-an-existing-installation.md | 1 + .../app-v/appv-using-the-client-management-console.md | 1 + ...virtual-application-extensions-with-the-management-console.md | 1 + .../app-v/appv-viewing-appv-server-publishing-metadata.md | 1 + 100 files changed, 100 insertions(+) diff --git a/windows/application-management/app-v/appv-about-appv.md b/windows/application-management/app-v/appv-about-appv.md index e92126877b..4fc8997a6e 100644 --- a/windows/application-management/app-v/appv-about-appv.md +++ b/windows/application-management/app-v/appv-about-appv.md @@ -7,6 +7,7 @@ ms.date: 06/08/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md index db32a71242..040eda052e 100644 --- a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 06/08/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md index d9607a39ca..b11acc20a7 100644 --- a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 06/08/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-administering-appv-with-powershell.md b/windows/application-management/app-v/appv-administering-appv-with-powershell.md index e11cff3d2f..ec381c1293 100644 --- a/windows/application-management/app-v/appv-administering-appv-with-powershell.md +++ b/windows/application-management/app-v/appv-administering-appv-with-powershell.md @@ -7,6 +7,7 @@ ms.date: 06/08/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md index b73a1de7c6..cf6f1e8a76 100644 --- a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md +++ b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 06/08/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md index 80ab1602b9..a02875375a 100644 --- a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md +++ b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md @@ -7,6 +7,7 @@ ms.date: 06/08/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 5782b539d8..025efdca77 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -7,6 +7,7 @@ ms.date: 06/08/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index ec704a9bfe..24903fe377 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -7,6 +7,7 @@ ms.date: 06/15/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md index 134f74c8d0..9d78748d49 100644 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md @@ -7,6 +7,7 @@ ms.date: 06/15/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-auto-batch-sequencing.md b/windows/application-management/app-v/appv-auto-batch-sequencing.md index ccec12eeac..c8a8e980b5 100644 --- a/windows/application-management/app-v/appv-auto-batch-sequencing.md +++ b/windows/application-management/app-v/appv-auto-batch-sequencing.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-auto-batch-updating.md b/windows/application-management/app-v/appv-auto-batch-updating.md index 3cfc4a25e9..42e883d6c6 100644 --- a/windows/application-management/app-v/appv-auto-batch-updating.md +++ b/windows/application-management/app-v/appv-auto-batch-updating.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index ef08860114..f73f89ee26 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -7,6 +7,7 @@ ms.date: 06/15/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-auto-provision-a-vm.md b/windows/application-management/app-v/appv-auto-provision-a-vm.md index 960c96a092..0f09ca265b 100644 --- a/windows/application-management/app-v/appv-auto-provision-a-vm.md +++ b/windows/application-management/app-v/appv-auto-provision-a-vm.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 1e7968c63d..e869fd86fb 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -7,6 +7,7 @@ ms.date: 06/15/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-capacity-planning.md b/windows/application-management/app-v/appv-capacity-planning.md index 87702c1df2..2b7edc6c54 100644 --- a/windows/application-management/app-v/appv-capacity-planning.md +++ b/windows/application-management/app-v/appv-capacity-planning.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-client-configuration-settings.md b/windows/application-management/app-v/appv-client-configuration-settings.md index 2b4f017846..d87457a13f 100644 --- a/windows/application-management/app-v/appv-client-configuration-settings.md +++ b/windows/application-management/app-v/appv-client-configuration-settings.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md index 1160f2c0de..ab350e2a83 100644 --- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 06/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md index b472e767b9..9e7f90b5a1 100644 --- a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md +++ b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md @@ -7,6 +7,7 @@ ms.date: 06/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md b/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md index ef9a170375..687c339a07 100644 --- a/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md +++ b/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md @@ -7,6 +7,7 @@ ms.date: 06/25/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-connect-to-the-management-console.md b/windows/application-management/app-v/appv-connect-to-the-management-console.md index d5f427090d..95ec5914c4 100644 --- a/windows/application-management/app-v/appv-connect-to-the-management-console.md +++ b/windows/application-management/app-v/appv-connect-to-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 06/25/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-connection-group-file.md b/windows/application-management/app-v/appv-connection-group-file.md index dbd81a5419..df85debbf2 100644 --- a/windows/application-management/app-v/appv-connection-group-file.md +++ b/windows/application-management/app-v/appv-connection-group-file.md @@ -7,6 +7,7 @@ ms.date: 06/25/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-connection-group-virtual-environment.md b/windows/application-management/app-v/appv-connection-group-virtual-environment.md index eb01f08fd1..26f5a073a8 100644 --- a/windows/application-management/app-v/appv-connection-group-virtual-environment.md +++ b/windows/application-management/app-v/appv-connection-group-virtual-environment.md @@ -7,6 +7,7 @@ ms.date: 06/25/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md index eb35d19690..3a2f20cbb5 100644 --- a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md +++ b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md @@ -7,6 +7,7 @@ ms.date: 07/10/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md index fe8a0c0ac9..09a658895f 100644 --- a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md +++ b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md @@ -7,6 +7,7 @@ ms.date: 07/10/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-create-a-connection-group.md b/windows/application-management/app-v/appv-create-a-connection-group.md index b67e058e20..18a61bee6e 100644 --- a/windows/application-management/app-v/appv-create-a-connection-group.md +++ b/windows/application-management/app-v/appv-create-a-connection-group.md @@ -7,6 +7,7 @@ ms.date: 07/10/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md index 4d6aef98c4..0dd4402170 100644 --- a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md +++ b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 07/10/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md index 206a2c4dc9..30cddc907d 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md @@ -7,6 +7,7 @@ ms.date: 07/10/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator.md b/windows/application-management/app-v/appv-create-a-package-accelerator.md index cd1a5e6314..93333681f5 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator.md @@ -7,6 +7,7 @@ ms.date: 07/10/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md index c5d16599a9..162c56efbc 100644 --- a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md +++ b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md @@ -7,6 +7,7 @@ ms.date: 07/10/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-create-and-use-a-project-template.md b/windows/application-management/app-v/appv-create-and-use-a-project-template.md index 8fad7898e7..9420f67b5f 100644 --- a/windows/application-management/app-v/appv-create-and-use-a-project-template.md +++ b/windows/application-management/app-v/appv-create-and-use-a-project-template.md @@ -7,6 +7,7 @@ ms.date: 07/10/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md index 41a9ea4ae0..4616ec336f 100644 --- a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md +++ b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md index 5d28a86d19..117cbd91bd 100644 --- a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md +++ b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 07/10/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-delete-a-connection-group.md b/windows/application-management/app-v/appv-delete-a-connection-group.md index 018b8c8984..55dc6b0ec7 100644 --- a/windows/application-management/app-v/appv-delete-a-connection-group.md +++ b/windows/application-management/app-v/appv-delete-a-connection-group.md @@ -7,6 +7,7 @@ ms.date: 09/27/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md index 6c7fbb6ee0..1917d768e9 100644 --- a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md +++ b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 09/27/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md index 580eebc9fd..3fac560518 100644 --- a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md +++ b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md index 5088aaaf0f..cbaf3e7123 100644 --- a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md @@ -7,6 +7,7 @@ ms.date: 09/27/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md index 16db5ceeae..19e48512a0 100644 --- a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md +++ b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server.md b/windows/application-management/app-v/appv-deploy-the-appv-server.md index 3b942f6fc7..4a9f49f03b 100644 --- a/windows/application-management/app-v/appv-deploy-the-appv-server.md +++ b/windows/application-management/app-v/appv-deploy-the-appv-server.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploying-appv.md b/windows/application-management/app-v/appv-deploying-appv.md index e4abca5b4d..d1d23d6d74 100644 --- a/windows/application-management/app-v/appv-deploying-appv.md +++ b/windows/application-management/app-v/appv-deploying-appv.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md index 1db6409588..02924fde4f 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md index 482e1e96be..0cb31fa36f 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md index 5f5a47faf9..ee4cbe5751 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md index baaaf62754..20e131feb1 100644 --- a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md @@ -7,6 +7,7 @@ ms.date: 09/27/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md index bbba1c8a0a..e2fd60d1e8 100644 --- a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md +++ b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deploying-the-appv-server.md b/windows/application-management/app-v/appv-deploying-the-appv-server.md index 623e3ef07e..2b08876aed 100644 --- a/windows/application-management/app-v/appv-deploying-the-appv-server.md +++ b/windows/application-management/app-v/appv-deploying-the-appv-server.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-deployment-checklist.md b/windows/application-management/app-v/appv-deployment-checklist.md index 6b89ffcb68..fd90b055be 100644 --- a/windows/application-management/app-v/appv-deployment-checklist.md +++ b/windows/application-management/app-v/appv-deployment-checklist.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-dynamic-configuration.md b/windows/application-management/app-v/appv-dynamic-configuration.md index f782e22867..03ba41c6d2 100644 --- a/windows/application-management/app-v/appv-dynamic-configuration.md +++ b/windows/application-management/app-v/appv-dynamic-configuration.md @@ -7,6 +7,7 @@ ms.date: 09/27/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md index ca51b3b8f9..9c19cab0aa 100644 --- a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md @@ -8,6 +8,7 @@ ms.date: 05/02/2022 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: how-to --- diff --git a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md index 3e0f982303..cc71b17cb7 100644 --- a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md +++ b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md index d23763d372..5b65a93ac1 100644 --- a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md +++ b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-evaluating-appv.md b/windows/application-management/app-v/appv-evaluating-appv.md index 7ef67197bc..6874ebc260 100644 --- a/windows/application-management/app-v/appv-evaluating-appv.md +++ b/windows/application-management/app-v/appv-evaluating-appv.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-for-windows.md b/windows/application-management/app-v/appv-for-windows.md index 2798d2e4cf..ecb4183907 100644 --- a/windows/application-management/app-v/appv-for-windows.md +++ b/windows/application-management/app-v/appv-for-windows.md @@ -7,6 +7,7 @@ ms.date: 09/27/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-getting-started.md b/windows/application-management/app-v/appv-getting-started.md index 500a015467..f851ca2a85 100644 --- a/windows/application-management/app-v/appv-getting-started.md +++ b/windows/application-management/app-v/appv-getting-started.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-high-level-architecture.md b/windows/application-management/app-v/appv-high-level-architecture.md index 3d480833f0..437b20eeb1 100644 --- a/windows/application-management/app-v/appv-high-level-architecture.md +++ b/windows/application-management/app-v/appv-high-level-architecture.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md index 604d4ca93a..acc244a595 100644 --- a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md +++ b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md index ec07a9f2a4..ae2e2b56c3 100644 --- a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md index 077dfe70f2..5b258437f3 100644 --- a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md index 62b5f49184..7457b54f82 100644 --- a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md index 995af4a7b2..f5335dd5f0 100644 --- a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-install-the-sequencer.md b/windows/application-management/app-v/appv-install-the-sequencer.md index eeeb9120d7..2fdd2ec28d 100644 --- a/windows/application-management/app-v/appv-install-the-sequencer.md +++ b/windows/application-management/app-v/appv-install-the-sequencer.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md index 22fab6a3b5..2170f1e25b 100644 --- a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -7,6 +7,7 @@ ms.date: 09/27/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-maintaining-appv.md b/windows/application-management/app-v/appv-maintaining-appv.md index 8892ec9047..fb3a0ccc4e 100644 --- a/windows/application-management/app-v/appv-maintaining-appv.md +++ b/windows/application-management/app-v/appv-maintaining-appv.md @@ -7,6 +7,7 @@ ms.date: 09/27/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md index fc381bb0f9..e125255c83 100644 --- a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md +++ b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md @@ -10,6 +10,7 @@ ms.date: 09/24/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md index 4765157af7..c870425b03 100644 --- a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md +++ b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-managing-connection-groups.md b/windows/application-management/app-v/appv-managing-connection-groups.md index 789d7cc976..d65f100109 100644 --- a/windows/application-management/app-v/appv-managing-connection-groups.md +++ b/windows/application-management/app-v/appv-managing-connection-groups.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md index 78d3d9b6a6..b5ca6b5e48 100644 --- a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md index 0322083aa8..db81d9833c 100644 --- a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md +++ b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md index f707da5e2e..6e0950dbf8 100644 --- a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md +++ b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md index 7eb6a6ee5d..4b844f29a5 100644 --- a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md +++ b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-operations.md b/windows/application-management/app-v/appv-operations.md index bca6d21d80..7b2ef74380 100644 --- a/windows/application-management/app-v/appv-operations.md +++ b/windows/application-management/app-v/appv-operations.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-performance-guidance.md b/windows/application-management/app-v/appv-performance-guidance.md index 3d32c1834d..cb7e615a02 100644 --- a/windows/application-management/app-v/appv-performance-guidance.md +++ b/windows/application-management/app-v/appv-performance-guidance.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-planning-checklist.md b/windows/application-management/app-v/appv-planning-checklist.md index 4ba8df6b30..c391399dd5 100644 --- a/windows/application-management/app-v/appv-planning-checklist.md +++ b/windows/application-management/app-v/appv-planning-checklist.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md index 7f9891e8dc..04e30a407c 100644 --- a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md +++ b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md index d586c7d002..6d1dfd402c 100644 --- a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md +++ b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-planning-for-appv.md b/windows/application-management/app-v/appv-planning-for-appv.md index 88d29b3939..e0bf768b4b 100644 --- a/windows/application-management/app-v/appv-planning-for-appv.md +++ b/windows/application-management/app-v/appv-planning-for-appv.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md index f83a6efb92..3f800f36de 100644 --- a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md +++ b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md index 6249fb1463..61f49df9b6 100644 --- a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md +++ b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md index c0d76e731a..02914cd55b 100644 --- a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md +++ b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md index 2faf00ec3f..478b1f8523 100644 --- a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv.md b/windows/application-management/app-v/appv-planning-to-deploy-appv.md index 8aeafdf96d..5cfdf7b332 100644 --- a/windows/application-management/app-v/appv-planning-to-deploy-appv.md +++ b/windows/application-management/app-v/appv-planning-to-deploy-appv.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-preparing-your-environment.md b/windows/application-management/app-v/appv-preparing-your-environment.md index 7960a6176f..95fad14736 100644 --- a/windows/application-management/app-v/appv-preparing-your-environment.md +++ b/windows/application-management/app-v/appv-preparing-your-environment.md @@ -7,6 +7,7 @@ ms.reviewer: author: aczechowski manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-prerequisites.md b/windows/application-management/app-v/appv-prerequisites.md index e25a1a1ee7..9df6ba5e4c 100644 --- a/windows/application-management/app-v/appv-prerequisites.md +++ b/windows/application-management/app-v/appv-prerequisites.md @@ -7,6 +7,7 @@ ms.date: 04/18/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-publish-a-connection-group.md b/windows/application-management/app-v/appv-publish-a-connection-group.md index 5f377d48e3..2a86b56aff 100644 --- a/windows/application-management/app-v/appv-publish-a-connection-group.md +++ b/windows/application-management/app-v/appv-publish-a-connection-group.md @@ -7,6 +7,7 @@ ms.date: 09/27/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md index 2c52dce04b..8d1b3b7041 100644 --- a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 09/27/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md b/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md index 55b03dee3e..2c82592252 100644 --- a/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md +++ b/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md index 9c0c3225bb..f2df77ee92 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md index 523b7ad256..00fd89be8c 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-reporting.md b/windows/application-management/app-v/appv-reporting.md index cd42eb1ffc..0108207c9e 100644 --- a/windows/application-management/app-v/appv-reporting.md +++ b/windows/application-management/app-v/appv-reporting.md @@ -7,6 +7,7 @@ ms.date: 04/16/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md index 6b551661d4..ce0c73c061 100644 --- a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md +++ b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md @@ -7,6 +7,7 @@ ms.date: 03/08/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-security-considerations.md b/windows/application-management/app-v/appv-security-considerations.md index 9482c32049..5c13af93a6 100644 --- a/windows/application-management/app-v/appv-security-considerations.md +++ b/windows/application-management/app-v/appv-security-considerations.md @@ -7,6 +7,7 @@ ms.date: 04/16/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-sequence-a-new-application.md b/windows/application-management/app-v/appv-sequence-a-new-application.md index 6950c97d05..a19c89cc1c 100644 --- a/windows/application-management/app-v/appv-sequence-a-new-application.md +++ b/windows/application-management/app-v/appv-sequence-a-new-application.md @@ -7,6 +7,7 @@ ms.date: 04/16/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md index 04be00dcbf..1b289057fe 100644 --- a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md +++ b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-supported-configurations.md b/windows/application-management/app-v/appv-supported-configurations.md index ffb10c4b02..059ef24c65 100644 --- a/windows/application-management/app-v/appv-supported-configurations.md +++ b/windows/application-management/app-v/appv-supported-configurations.md @@ -7,6 +7,7 @@ ms.date: 04/16/2018 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.topic: article ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-technical-reference.md b/windows/application-management/app-v/appv-technical-reference.md index bb3c4874f4..5feee6e5a9 100644 --- a/windows/application-management/app-v/appv-technical-reference.md +++ b/windows/application-management/app-v/appv-technical-reference.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md index 74aec2aba2..6ad489e6d0 100644 --- a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md +++ b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-troubleshooting.md b/windows/application-management/app-v/appv-troubleshooting.md index 5678e04c06..8e916937ed 100644 --- a/windows/application-management/app-v/appv-troubleshooting.md +++ b/windows/application-management/app-v/appv-troubleshooting.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md index bb291a0484..d9769d9ac3 100644 --- a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-using-the-client-management-console.md b/windows/application-management/app-v/appv-using-the-client-management-console.md index 66b4aa8372..3cdd99110d 100644 --- a/windows/application-management/app-v/appv-using-the-client-management-console.md +++ b/windows/application-management/app-v/appv-using-the-client-management-console.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md index c0d29c01af..92b64eb2ec 100644 --- a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md +++ b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- diff --git a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md index d51f9556a1..ed8de7183d 100644 --- a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md +++ b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md @@ -7,6 +7,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: aaroncz ms.author: aaroncz +ms.collection: must-keep ms.technology: itpro-apps --- From 81815cfcccf90526d26e4d83fa4b25ffba071af6 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Fri, 18 Aug 2023 16:26:01 -0700 Subject: [PATCH 036/125] add must-keep collection --- .../uev-administering-uev-with-windows-powershell-and-wmi.md | 4 +++- windows/configuration/ue-v/uev-administering-uev.md | 4 +++- .../ue-v/uev-application-template-schema-reference.md | 4 +++- .../ue-v/uev-changing-the-frequency-of-scheduled-tasks.md | 4 +++- .../ue-v/uev-configuring-uev-with-group-policy-objects.md | 4 +++- ...onfiguring-uev-with-system-center-configuration-manager.md | 4 +++- windows/configuration/ue-v/uev-deploy-required-features.md | 4 +++- .../ue-v/uev-deploy-uev-for-custom-applications.md | 4 +++- windows/configuration/ue-v/uev-for-windows.md | 4 +++- windows/configuration/ue-v/uev-getting-started.md | 4 +++- .../ue-v/uev-manage-administrative-backup-and-restore.md | 4 +++- windows/configuration/ue-v/uev-manage-configurations.md | 4 +++- ...ngs-location-templates-using-windows-powershell-and-wmi.md | 4 +++- ...-uev-agent-and-packages-with-windows-powershell-and-wmi.md | 4 +++- windows/configuration/ue-v/uev-migrating-settings-packages.md | 4 +++- windows/configuration/ue-v/uev-prepare-for-deployment.md | 4 +++- windows/configuration/ue-v/uev-release-notes-1607.md | 4 +++- windows/configuration/ue-v/uev-security-considerations.md | 4 +++- windows/configuration/ue-v/uev-sync-methods.md | 4 +++- windows/configuration/ue-v/uev-sync-trigger-events.md | 4 +++- .../ue-v/uev-synchronizing-microsoft-office-with-uev.md | 4 +++- windows/configuration/ue-v/uev-technical-reference.md | 4 +++- windows/configuration/ue-v/uev-troubleshooting.md | 4 +++- .../ue-v/uev-upgrade-uev-from-previous-releases.md | 4 +++- ...-using-uev-with-application-virtualization-applications.md | 4 +++- .../configuration/ue-v/uev-whats-new-in-uev-for-windows.md | 4 +++- ...uev-working-with-custom-templates-and-the-uev-generator.md | 4 +++- 27 files changed, 81 insertions(+), 27 deletions(-) diff --git a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md index f6909fdc31..9c048c2cf5 100644 --- a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md +++ b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md @@ -3,7 +3,9 @@ title: Administering UE-V with Windows PowerShell and WMI description: Learn how User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets to help administrators perform various UE-V tasks. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-administering-uev.md b/windows/configuration/ue-v/uev-administering-uev.md index 02bb612d1b..627039a508 100644 --- a/windows/configuration/ue-v/uev-administering-uev.md +++ b/windows/configuration/ue-v/uev-administering-uev.md @@ -3,7 +3,9 @@ title: Administering UE-V description: Learn how to perform administrative tasks for User Experience Virtualization (UE-V). These tasks include configuring the UE-V service and recovering lost settings. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-application-template-schema-reference.md b/windows/configuration/ue-v/uev-application-template-schema-reference.md index d0d7b3db53..21e3edd00d 100644 --- a/windows/configuration/ue-v/uev-application-template-schema-reference.md +++ b/windows/configuration/ue-v/uev-application-template-schema-reference.md @@ -3,7 +3,9 @@ title: Application Template Schema Reference for UE-V description: Learn details about the XML structure of the UE-V settings location templates and learn how to edit these files. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md index 28f57b767c..0104526a2b 100644 --- a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md +++ b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md @@ -3,7 +3,9 @@ title: Changing the Frequency of UE-V Scheduled Tasks description: Learn how to create a script that uses the Schtasks.exe command-line options so you can change the frequency of UE-V scheduled tasks. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md index f18438c0c3..44e725599f 100644 --- a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md +++ b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md @@ -3,7 +3,9 @@ title: Configuring UE-V with Group Policy Objects description: In this article, learn how to configure User Experience Virtualization (UE-V) with Group Policy objects. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md index efd9497722..30bf50f542 100644 --- a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md +++ b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md @@ -3,7 +3,9 @@ title: Configuring UE-V with Microsoft Configuration Manager description: Learn how to configure User Experience Virtualization (UE-V) with Microsoft Configuration Manager. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-deploy-required-features.md b/windows/configuration/ue-v/uev-deploy-required-features.md index 04a273fdd4..1ab8b30874 100644 --- a/windows/configuration/ue-v/uev-deploy-required-features.md +++ b/windows/configuration/ue-v/uev-deploy-required-features.md @@ -3,7 +3,9 @@ title: Deploy required UE-V features description: Learn how to install and configure User Experience Virtualization (UE-V) features, for example, a network share that stores and retrieves user settings. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md index 76987da15a..65523c41b0 100644 --- a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md +++ b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md @@ -3,7 +3,9 @@ title: Use UE-V with custom applications description: Use User Experience Virtualization (UE-V) to create your own custom settings location templates with the UE-V template generator. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-for-windows.md b/windows/configuration/ue-v/uev-for-windows.md index 7b140aa669..c8732241c7 100644 --- a/windows/configuration/ue-v/uev-for-windows.md +++ b/windows/configuration/ue-v/uev-for-windows.md @@ -3,7 +3,9 @@ title: User Experience Virtualization for Windows 10, version 1607 description: Overview of User Experience Virtualization for Windows 10, version 1607 author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 05/02/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-getting-started.md b/windows/configuration/ue-v/uev-getting-started.md index 32db93baee..7bf8cae820 100644 --- a/windows/configuration/ue-v/uev-getting-started.md +++ b/windows/configuration/ue-v/uev-getting-started.md @@ -3,7 +3,9 @@ title: Get Started with UE-V description: Use the steps in this article to deploy User Experience Virtualization (UE-V) for the first time in a test environment. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 03/08/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md index 34a9229f65..ec137a5b65 100644 --- a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md +++ b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md @@ -3,7 +3,9 @@ title: Manage Administrative Backup and Restore in UE-V description: Learn how an administrator of User Experience Virtualization (UE-V) can back up and restore application and Windows settings to their original state. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-manage-configurations.md b/windows/configuration/ue-v/uev-manage-configurations.md index 51a1e724fe..419e2f3379 100644 --- a/windows/configuration/ue-v/uev-manage-configurations.md +++ b/windows/configuration/ue-v/uev-manage-configurations.md @@ -3,7 +3,9 @@ title: Manage Configurations for UE-V description: Learn to manage the configuration of the User Experience Virtualization (UE-V) service and also learn to manage storage locations for UE-V resources. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md index 78252752e3..fd0c9e9aac 100644 --- a/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md +++ b/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md @@ -3,7 +3,9 @@ title: Managing UE-V Settings Location Templates Using Windows PowerShell and WM description: Managing UE-V Settings Location Templates Using Windows PowerShell and WMI author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md index 079e034324..9be69be554 100644 --- a/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md +++ b/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md @@ -3,7 +3,9 @@ title: Manage UE-V Service and Packages with Windows PowerShell and WMI description: Managing the UE-V service and packages with Windows PowerShell and WMI author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-migrating-settings-packages.md b/windows/configuration/ue-v/uev-migrating-settings-packages.md index 27fcbea39e..37a5be45ad 100644 --- a/windows/configuration/ue-v/uev-migrating-settings-packages.md +++ b/windows/configuration/ue-v/uev-migrating-settings-packages.md @@ -3,7 +3,9 @@ title: Migrating UE-V settings packages description: Learn to relocate User Experience Virtualization (UE-V) user settings packages either when you migrate to a new server or when you perform backups. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-prepare-for-deployment.md b/windows/configuration/ue-v/uev-prepare-for-deployment.md index f498b6600b..3ed4ab1b43 100644 --- a/windows/configuration/ue-v/uev-prepare-for-deployment.md +++ b/windows/configuration/ue-v/uev-prepare-for-deployment.md @@ -3,7 +3,9 @@ title: Prepare a UE-V Deployment description: Learn about the types of User Experience Virtualization (UE-V) deployment you can execute and what preparations you can make beforehand to be successful. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-release-notes-1607.md b/windows/configuration/ue-v/uev-release-notes-1607.md index 42571c453b..995f79f988 100644 --- a/windows/configuration/ue-v/uev-release-notes-1607.md +++ b/windows/configuration/ue-v/uev-release-notes-1607.md @@ -3,7 +3,9 @@ title: User Experience Virtualization (UE-V) Release Notes description: Read the latest information required to successfully install and use User Experience Virtualization (UE-V) that isn't included in the UE-V documentation. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-security-considerations.md b/windows/configuration/ue-v/uev-security-considerations.md index 2bde66cad7..0f2220b76e 100644 --- a/windows/configuration/ue-v/uev-security-considerations.md +++ b/windows/configuration/ue-v/uev-security-considerations.md @@ -3,7 +3,9 @@ title: Security Considerations for UE-V description: Learn about accounts and groups, log files, and other security-related considerations for User Experience Virtualization (UE-V). author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-sync-methods.md b/windows/configuration/ue-v/uev-sync-methods.md index bff2257777..17d2bba46f 100644 --- a/windows/configuration/ue-v/uev-sync-methods.md +++ b/windows/configuration/ue-v/uev-sync-methods.md @@ -3,7 +3,9 @@ title: Sync Methods for UE-V description: Learn how User Experience Virtualization (UE-V) service sync methods let you synchronize users’ application and Windows settings with the settings storage location. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-sync-trigger-events.md b/windows/configuration/ue-v/uev-sync-trigger-events.md index a080d46d6e..6cae6d66bf 100644 --- a/windows/configuration/ue-v/uev-sync-trigger-events.md +++ b/windows/configuration/ue-v/uev-sync-trigger-events.md @@ -3,7 +3,9 @@ title: Sync Trigger Events for UE-V description: Learn how User Experience Virtualization (UE-V) lets you synchronize your application and Windows settings across all your domain-joined devices. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md b/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md index a28147ecb1..e06e33e471 100644 --- a/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md +++ b/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md @@ -3,7 +3,9 @@ title: Synchronizing Microsoft Office with UE-V description: Learn how User Experience Virtualization (UE-V) supports the synchronization of Microsoft Office application settings. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-technical-reference.md b/windows/configuration/ue-v/uev-technical-reference.md index c4f15d65ce..aa4bde4500 100644 --- a/windows/configuration/ue-v/uev-technical-reference.md +++ b/windows/configuration/ue-v/uev-technical-reference.md @@ -3,7 +3,9 @@ title: Technical Reference for UE-V description: Use this technical reference to learn about the various features of User Experience Virtualization (UE-V). author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-troubleshooting.md b/windows/configuration/ue-v/uev-troubleshooting.md index 0f96a38a1b..e27f2c92a6 100644 --- a/windows/configuration/ue-v/uev-troubleshooting.md +++ b/windows/configuration/ue-v/uev-troubleshooting.md @@ -3,7 +3,9 @@ title: Troubleshooting UE-V description: Use this technical reference to find resources for troubleshooting User Experience Virtualization (UE-V) for Windows 10. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md b/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md index 495602a3d7..12ac8cd14c 100644 --- a/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md +++ b/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md @@ -3,7 +3,9 @@ title: Upgrade to UE-V for Windows 10 description: Use these few adjustments to upgrade from User Experience Virtualization (UE-V) 2.x to the latest version of UE-V. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md b/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md index 4d2e9541ec..85bc1b7d3c 100644 --- a/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md +++ b/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md @@ -3,7 +3,9 @@ title: Using UE-V with Application Virtualization applications description: Learn how to use User Experience Virtualization (UE-V) with Microsoft Application Virtualization (App-V). author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md b/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md index 147230cb37..fa2083f4ad 100644 --- a/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md +++ b/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md @@ -3,7 +3,9 @@ title: What's New in UE-V for Windows 10, version 1607 description: Learn about what's new in User Experience Virtualization (UE-V) for Windows 10, including new features and capabilities. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md b/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md index 1c94036b4c..8fca3e87fa 100644 --- a/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md +++ b/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md @@ -3,7 +3,9 @@ title: Working with Custom UE-V Templates and the UE-V Template Generator description: Create your own custom settings location templates by working with Custom User Experience Virtualization (UE-V) Templates and the UE-V Template Generator. author: aczechowski ms.prod: windows-client -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep ms.date: 04/19/2017 ms.reviewer: manager: aaroncz From 9c7447640662a337c91b3506d6498d9e6ff970c7 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Fri, 18 Aug 2023 17:05:20 -0700 Subject: [PATCH 037/125] add must-keep collection and reference topic --- windows/configuration/wcd/wcd-accountmanagement.md | 3 ++- windows/configuration/wcd/wcd-accounts.md | 3 ++- windows/configuration/wcd/wcd-admxingestion.md | 3 ++- windows/configuration/wcd/wcd-assignedaccess.md | 3 ++- windows/configuration/wcd/wcd-browser.md | 3 ++- windows/configuration/wcd/wcd-cellcore.md | 3 ++- windows/configuration/wcd/wcd-cellular.md | 3 ++- windows/configuration/wcd/wcd-certificates.md | 3 ++- windows/configuration/wcd/wcd-changes.md | 3 ++- windows/configuration/wcd/wcd-cleanpc.md | 3 ++- windows/configuration/wcd/wcd-connections.md | 3 ++- windows/configuration/wcd/wcd-connectivityprofiles.md | 3 ++- windows/configuration/wcd/wcd-countryandregion.md | 3 ++- windows/configuration/wcd/wcd-desktopbackgroundandcolors.md | 3 ++- windows/configuration/wcd/wcd-developersetup.md | 3 ++- windows/configuration/wcd/wcd-deviceformfactor.md | 3 ++- windows/configuration/wcd/wcd-devicemanagement.md | 3 ++- windows/configuration/wcd/wcd-deviceupdatecenter.md | 3 ++- windows/configuration/wcd/wcd-dmclient.md | 3 ++- windows/configuration/wcd/wcd-editionupgrade.md | 3 ++- windows/configuration/wcd/wcd-firewallconfiguration.md | 3 ++- windows/configuration/wcd/wcd-firstexperience.md | 3 ++- windows/configuration/wcd/wcd-folders.md | 3 ++- windows/configuration/wcd/wcd-hotspot.md | 3 ++- windows/configuration/wcd/wcd-kioskbrowser.md | 3 ++- windows/configuration/wcd/wcd-licensing.md | 3 ++- windows/configuration/wcd/wcd-location.md | 3 ++- windows/configuration/wcd/wcd-maps.md | 3 ++- windows/configuration/wcd/wcd-networkproxy.md | 3 ++- windows/configuration/wcd/wcd-networkqospolicy.md | 3 ++- windows/configuration/wcd/wcd-oobe.md | 3 ++- windows/configuration/wcd/wcd-personalization.md | 3 ++- windows/configuration/wcd/wcd-policies.md | 3 ++- windows/configuration/wcd/wcd-privacy.md | 3 ++- windows/configuration/wcd/wcd-provisioningcommands.md | 3 ++- windows/configuration/wcd/wcd-sharedpc.md | 3 ++- windows/configuration/wcd/wcd-smisettings.md | 3 ++- windows/configuration/wcd/wcd-start.md | 3 ++- windows/configuration/wcd/wcd-startupapp.md | 3 ++- windows/configuration/wcd/wcd-startupbackgroundtasks.md | 3 ++- windows/configuration/wcd/wcd-storaged3inmodernstandby.md | 3 ++- windows/configuration/wcd/wcd-surfacehubmanagement.md | 3 ++- windows/configuration/wcd/wcd-tabletmode.md | 3 ++- windows/configuration/wcd/wcd-takeatest.md | 3 ++- windows/configuration/wcd/wcd-time.md | 3 ++- windows/configuration/wcd/wcd-unifiedwritefilter.md | 3 ++- windows/configuration/wcd/wcd-universalappinstall.md | 3 ++- windows/configuration/wcd/wcd-universalappuninstall.md | 3 ++- windows/configuration/wcd/wcd-usberrorsoemoverride.md | 3 ++- windows/configuration/wcd/wcd-weakcharger.md | 3 ++- windows/configuration/wcd/wcd-windowshelloforbusiness.md | 3 ++- windows/configuration/wcd/wcd-windowsteamsettings.md | 3 ++- windows/configuration/wcd/wcd-wlan.md | 3 ++- windows/configuration/wcd/wcd-workplace.md | 3 ++- windows/configuration/wcd/wcd.md | 3 ++- 55 files changed, 110 insertions(+), 55 deletions(-) diff --git a/windows/configuration/wcd/wcd-accountmanagement.md b/windows/configuration/wcd/wcd-accountmanagement.md index 3d883a1d2b..0b571541ae 100644 --- a/windows/configuration/wcd/wcd-accountmanagement.md +++ b/windows/configuration/wcd/wcd-accountmanagement.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-accounts.md b/windows/configuration/wcd/wcd-accounts.md index 2f26418dde..1678247efe 100644 --- a/windows/configuration/wcd/wcd-accounts.md +++ b/windows/configuration/wcd/wcd-accounts.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-admxingestion.md b/windows/configuration/wcd/wcd-admxingestion.md index b1c2aad0d0..9af5c203a8 100644 --- a/windows/configuration/wcd/wcd-admxingestion.md +++ b/windows/configuration/wcd/wcd-admxingestion.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-assignedaccess.md b/windows/configuration/wcd/wcd-assignedaccess.md index 17322a4076..0e3964d49e 100644 --- a/windows/configuration/wcd/wcd-assignedaccess.md +++ b/windows/configuration/wcd/wcd-assignedaccess.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-browser.md b/windows/configuration/wcd/wcd-browser.md index abcc63d261..97e8ca8ceb 100644 --- a/windows/configuration/wcd/wcd-browser.md +++ b/windows/configuration/wcd/wcd-browser.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 10/02/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-cellcore.md b/windows/configuration/wcd/wcd-cellcore.md index 4d48caa562..f9f8b16187 100644 --- a/windows/configuration/wcd/wcd-cellcore.md +++ b/windows/configuration/wcd/wcd-cellcore.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 10/02/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-cellular.md b/windows/configuration/wcd/wcd-cellular.md index d39280a5fe..4ea08e6e5b 100644 --- a/windows/configuration/wcd/wcd-cellular.md +++ b/windows/configuration/wcd/wcd-cellular.md @@ -7,7 +7,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/wcd/wcd-certificates.md b/windows/configuration/wcd/wcd-certificates.md index 8a15c48f5b..b05ce84a8f 100644 --- a/windows/configuration/wcd/wcd-certificates.md +++ b/windows/configuration/wcd/wcd-certificates.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-changes.md b/windows/configuration/wcd/wcd-changes.md index 6788558d33..32db3b13f7 100644 --- a/windows/configuration/wcd/wcd-changes.md +++ b/windows/configuration/wcd/wcd-changes.md @@ -7,7 +7,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/wcd/wcd-cleanpc.md b/windows/configuration/wcd/wcd-cleanpc.md index 3bb2b66098..d5cf3986fb 100644 --- a/windows/configuration/wcd/wcd-cleanpc.md +++ b/windows/configuration/wcd/wcd-cleanpc.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-connections.md b/windows/configuration/wcd/wcd-connections.md index 0434a57ba2..dc3d949232 100644 --- a/windows/configuration/wcd/wcd-connections.md +++ b/windows/configuration/wcd/wcd-connections.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-connectivityprofiles.md b/windows/configuration/wcd/wcd-connectivityprofiles.md index 88daab22bd..e66ad72ff5 100644 --- a/windows/configuration/wcd/wcd-connectivityprofiles.md +++ b/windows/configuration/wcd/wcd-connectivityprofiles.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-countryandregion.md b/windows/configuration/wcd/wcd-countryandregion.md index 9c1e5b2b70..8e9f623688 100644 --- a/windows/configuration/wcd/wcd-countryandregion.md +++ b/windows/configuration/wcd/wcd-countryandregion.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md b/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md index b7d4eee9d8..3c88652ff7 100644 --- a/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md +++ b/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/21/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-developersetup.md b/windows/configuration/wcd/wcd-developersetup.md index f93fe468a8..1820eebc0a 100644 --- a/windows/configuration/wcd/wcd-developersetup.md +++ b/windows/configuration/wcd/wcd-developersetup.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-deviceformfactor.md b/windows/configuration/wcd/wcd-deviceformfactor.md index d47c6a0d97..eb07550f1f 100644 --- a/windows/configuration/wcd/wcd-deviceformfactor.md +++ b/windows/configuration/wcd/wcd-deviceformfactor.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-devicemanagement.md b/windows/configuration/wcd/wcd-devicemanagement.md index fd933e1cb7..1f4744f0a1 100644 --- a/windows/configuration/wcd/wcd-devicemanagement.md +++ b/windows/configuration/wcd/wcd-devicemanagement.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-deviceupdatecenter.md b/windows/configuration/wcd/wcd-deviceupdatecenter.md index 4d5c9d8f2f..8c9cbe5372 100644 --- a/windows/configuration/wcd/wcd-deviceupdatecenter.md +++ b/windows/configuration/wcd/wcd-deviceupdatecenter.md @@ -6,7 +6,8 @@ author: aczechowski ms.localizationpriority: medium ms.author: aaroncz manager: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/wcd/wcd-dmclient.md b/windows/configuration/wcd/wcd-dmclient.md index 218f3f2102..f5169b0cee 100644 --- a/windows/configuration/wcd/wcd-dmclient.md +++ b/windows/configuration/wcd/wcd-dmclient.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-editionupgrade.md b/windows/configuration/wcd/wcd-editionupgrade.md index 696a33078b..99b9f9fc47 100644 --- a/windows/configuration/wcd/wcd-editionupgrade.md +++ b/windows/configuration/wcd/wcd-editionupgrade.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-firewallconfiguration.md b/windows/configuration/wcd/wcd-firewallconfiguration.md index 3bfedb1fc5..1310f33c30 100644 --- a/windows/configuration/wcd/wcd-firewallconfiguration.md +++ b/windows/configuration/wcd/wcd-firewallconfiguration.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-firstexperience.md b/windows/configuration/wcd/wcd-firstexperience.md index d17727272b..1c2b161ffa 100644 --- a/windows/configuration/wcd/wcd-firstexperience.md +++ b/windows/configuration/wcd/wcd-firstexperience.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 08/08/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-folders.md b/windows/configuration/wcd/wcd-folders.md index d59d40f6a3..05670e0935 100644 --- a/windows/configuration/wcd/wcd-folders.md +++ b/windows/configuration/wcd/wcd-folders.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-hotspot.md b/windows/configuration/wcd/wcd-hotspot.md index e838a329d8..0fb6073692 100644 --- a/windows/configuration/wcd/wcd-hotspot.md +++ b/windows/configuration/wcd/wcd-hotspot.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 12/18/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-kioskbrowser.md b/windows/configuration/wcd/wcd-kioskbrowser.md index 600809d119..addcf27aad 100644 --- a/windows/configuration/wcd/wcd-kioskbrowser.md +++ b/windows/configuration/wcd/wcd-kioskbrowser.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 10/02/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-licensing.md b/windows/configuration/wcd/wcd-licensing.md index f03737f546..a2135a483b 100644 --- a/windows/configuration/wcd/wcd-licensing.md +++ b/windows/configuration/wcd/wcd-licensing.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-location.md b/windows/configuration/wcd/wcd-location.md index 94fe50a11b..bbc00f2648 100644 --- a/windows/configuration/wcd/wcd-location.md +++ b/windows/configuration/wcd/wcd-location.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-maps.md b/windows/configuration/wcd/wcd-maps.md index a371f05731..bf3aeccaf3 100644 --- a/windows/configuration/wcd/wcd-maps.md +++ b/windows/configuration/wcd/wcd-maps.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-networkproxy.md b/windows/configuration/wcd/wcd-networkproxy.md index f12104c539..3e2ac6dce1 100644 --- a/windows/configuration/wcd/wcd-networkproxy.md +++ b/windows/configuration/wcd/wcd-networkproxy.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-networkqospolicy.md b/windows/configuration/wcd/wcd-networkqospolicy.md index 71560b301f..eb78b8e3fe 100644 --- a/windows/configuration/wcd/wcd-networkqospolicy.md +++ b/windows/configuration/wcd/wcd-networkqospolicy.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-oobe.md b/windows/configuration/wcd/wcd-oobe.md index f8af613b82..61c6c77b95 100644 --- a/windows/configuration/wcd/wcd-oobe.md +++ b/windows/configuration/wcd/wcd-oobe.md @@ -7,7 +7,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/wcd/wcd-personalization.md b/windows/configuration/wcd/wcd-personalization.md index b89c45755d..c6ab55142e 100644 --- a/windows/configuration/wcd/wcd-personalization.md +++ b/windows/configuration/wcd/wcd-personalization.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-policies.md b/windows/configuration/wcd/wcd-policies.md index 902475d894..449ba3ba75 100644 --- a/windows/configuration/wcd/wcd-policies.md +++ b/windows/configuration/wcd/wcd-policies.md @@ -7,7 +7,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/wcd/wcd-privacy.md b/windows/configuration/wcd/wcd-privacy.md index 65d872fe1b..13962db09d 100644 --- a/windows/configuration/wcd/wcd-privacy.md +++ b/windows/configuration/wcd/wcd-privacy.md @@ -6,7 +6,8 @@ author: aczechowski ms.localizationpriority: medium ms.author: aaroncz manager: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/wcd/wcd-provisioningcommands.md b/windows/configuration/wcd/wcd-provisioningcommands.md index d523106679..e79eb9f7f3 100644 --- a/windows/configuration/wcd/wcd-provisioningcommands.md +++ b/windows/configuration/wcd/wcd-provisioningcommands.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-sharedpc.md b/windows/configuration/wcd/wcd-sharedpc.md index 80275970c1..fbfb42be13 100644 --- a/windows/configuration/wcd/wcd-sharedpc.md +++ b/windows/configuration/wcd/wcd-sharedpc.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 10/16/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-smisettings.md b/windows/configuration/wcd/wcd-smisettings.md index 5ce6d3c4b1..1e5fe77243 100644 --- a/windows/configuration/wcd/wcd-smisettings.md +++ b/windows/configuration/wcd/wcd-smisettings.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 03/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-start.md b/windows/configuration/wcd/wcd-start.md index 53ff39614a..b8d84f5b0c 100644 --- a/windows/configuration/wcd/wcd-start.md +++ b/windows/configuration/wcd/wcd-start.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-startupapp.md b/windows/configuration/wcd/wcd-startupapp.md index 44ae8f59c7..55c8fcc8f3 100644 --- a/windows/configuration/wcd/wcd-startupapp.md +++ b/windows/configuration/wcd/wcd-startupapp.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-startupbackgroundtasks.md b/windows/configuration/wcd/wcd-startupbackgroundtasks.md index b04f726240..6838b63730 100644 --- a/windows/configuration/wcd/wcd-startupbackgroundtasks.md +++ b/windows/configuration/wcd/wcd-startupbackgroundtasks.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-storaged3inmodernstandby.md b/windows/configuration/wcd/wcd-storaged3inmodernstandby.md index d9a2c856ff..397c14a4f5 100644 --- a/windows/configuration/wcd/wcd-storaged3inmodernstandby.md +++ b/windows/configuration/wcd/wcd-storaged3inmodernstandby.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep manager: aaroncz ms.technology: itpro-configure ms.date: 12/31/2017 diff --git a/windows/configuration/wcd/wcd-surfacehubmanagement.md b/windows/configuration/wcd/wcd-surfacehubmanagement.md index 92dd641460..cd0bdc4208 100644 --- a/windows/configuration/wcd/wcd-surfacehubmanagement.md +++ b/windows/configuration/wcd/wcd-surfacehubmanagement.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-tabletmode.md b/windows/configuration/wcd/wcd-tabletmode.md index 13b9e9a810..9934c78fd0 100644 --- a/windows/configuration/wcd/wcd-tabletmode.md +++ b/windows/configuration/wcd/wcd-tabletmode.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-takeatest.md b/windows/configuration/wcd/wcd-takeatest.md index 1001238225..2fd7a6d426 100644 --- a/windows/configuration/wcd/wcd-takeatest.md +++ b/windows/configuration/wcd/wcd-takeatest.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 09/06/2017 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd-time.md b/windows/configuration/wcd/wcd-time.md index 320b7fa6a5..1bb981193e 100644 --- a/windows/configuration/wcd/wcd-time.md +++ b/windows/configuration/wcd/wcd-time.md @@ -6,7 +6,8 @@ author: aczechowski ms.localizationpriority: medium ms.author: aaroncz manager: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/wcd/wcd-unifiedwritefilter.md b/windows/configuration/wcd/wcd-unifiedwritefilter.md index 6bc7634cfb..2c03844e3f 100644 --- a/windows/configuration/wcd/wcd-unifiedwritefilter.md +++ b/windows/configuration/wcd/wcd-unifiedwritefilter.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-universalappinstall.md b/windows/configuration/wcd/wcd-universalappinstall.md index 98f1fd3fd3..2e3a68fe9f 100644 --- a/windows/configuration/wcd/wcd-universalappinstall.md +++ b/windows/configuration/wcd/wcd-universalappinstall.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-universalappuninstall.md b/windows/configuration/wcd/wcd-universalappuninstall.md index 4f40efa1fb..5889dc2d7e 100644 --- a/windows/configuration/wcd/wcd-universalappuninstall.md +++ b/windows/configuration/wcd/wcd-universalappuninstall.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-usberrorsoemoverride.md b/windows/configuration/wcd/wcd-usberrorsoemoverride.md index 8dbef10171..9869da77b4 100644 --- a/windows/configuration/wcd/wcd-usberrorsoemoverride.md +++ b/windows/configuration/wcd/wcd-usberrorsoemoverride.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-weakcharger.md b/windows/configuration/wcd/wcd-weakcharger.md index a7eafa43c9..211d170ce0 100644 --- a/windows/configuration/wcd/wcd-weakcharger.md +++ b/windows/configuration/wcd/wcd-weakcharger.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-windowshelloforbusiness.md b/windows/configuration/wcd/wcd-windowshelloforbusiness.md index 1a414d570f..f69695122b 100644 --- a/windows/configuration/wcd/wcd-windowshelloforbusiness.md +++ b/windows/configuration/wcd/wcd-windowshelloforbusiness.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-windowsteamsettings.md b/windows/configuration/wcd/wcd-windowsteamsettings.md index e37dc898a4..d5e531d913 100644 --- a/windows/configuration/wcd/wcd-windowsteamsettings.md +++ b/windows/configuration/wcd/wcd-windowsteamsettings.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure diff --git a/windows/configuration/wcd/wcd-wlan.md b/windows/configuration/wcd/wcd-wlan.md index a44a635cf6..6a2da109c1 100644 --- a/windows/configuration/wcd/wcd-wlan.md +++ b/windows/configuration/wcd/wcd-wlan.md @@ -7,7 +7,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/wcd/wcd-workplace.md b/windows/configuration/wcd/wcd-workplace.md index b36b0cd090..8e21def9dd 100644 --- a/windows/configuration/wcd/wcd-workplace.md +++ b/windows/configuration/wcd/wcd-workplace.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.date: 04/30/2018 ms.reviewer: manager: aaroncz diff --git a/windows/configuration/wcd/wcd.md b/windows/configuration/wcd/wcd.md index 8c1f2f6053..3fe32ffa9b 100644 --- a/windows/configuration/wcd/wcd.md +++ b/windows/configuration/wcd/wcd.md @@ -5,7 +5,8 @@ ms.prod: windows-client author: aczechowski ms.localizationpriority: medium ms.author: aaroncz -ms.topic: article +ms.topic: reference +ms.collection: must-keep ms.reviewer: manager: aaroncz ms.technology: itpro-configure From 68681a628f4c944e55980cf9984d397d3fa940ee Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Fri, 18 Aug 2023 17:10:52 -0700 Subject: [PATCH 038/125] add must-keep collection --- windows/security/docfx.json | 2 +- .../assign-security-group-filters-to-the-gpo.md | 1 + .../windows-firewall/best-practices-configuring.md | 1 + .../windows-firewall/create-a-group-policy-object.md | 1 + .../windows-firewall/create-an-inbound-port-rule.md | 1 + .../windows-firewall/create-wmi-filters-for-the-gpo.md | 1 + ...gement-console-to-windows-firewall-with-advanced-security.md | 1 + .../windows-firewall/windows-firewall-with-advanced-security.md | 1 + 8 files changed, 8 insertions(+), 1 deletion(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 84fafe0fa1..48559f1650 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -231,7 +231,7 @@ "threat-protection/auditing/*.md": "tier3", "operating-system-security/data-protection/bitlocker/*.md": "tier1", "operating-system-security/data-protection/personal-data-encryption/*.md": "tier1", - "operating-system-security/network-security/windows-firewall/*.md": "tier3" + "operating-system-security/network-security/windows-firewall/*.md": [ "tier3", "must-keep" ] } }, "template": [], diff --git a/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md index ece353e83c..e6bba9c9db 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md @@ -5,6 +5,7 @@ ms.prod: windows-client ms.collection: - highpri - tier3 + - must-keep ms.topic: conceptual ms.date: 09/07/2021 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index cba1170eaa..a61bf25eec 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -6,6 +6,7 @@ ms.date: 11/09/2022 ms.collection: - highpri - tier3 + - must-keep ms.topic: best-practice --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md b/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md index f5c4d18144..11638e864b 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md @@ -5,6 +5,7 @@ ms.prod: windows-client ms.collection: - highpri - tier3 + - must-keep ms.topic: conceptual ms.date: 09/07/2021 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md index 7ccafddaa2..5751151190 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md @@ -5,6 +5,7 @@ ms.prod: windows-client ms.collection: - highpri - tier3 + - must-keep ms.topic: conceptual ms.date: 09/07/2021 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md index 08c06d4796..a2cad4e58d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md @@ -5,6 +5,7 @@ ms.prod: windows-client ms.collection: - highpri - tier3 + - must-keep ms.topic: conceptual ms.date: 09/07/2021 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md b/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md index 874e99e9c0..49aee564d3 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md @@ -5,6 +5,7 @@ ms.prod: windows-client ms.collection: - highpri - tier3 + - must-keep ms.topic: conceptual ms.date: 09/08/2021 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md b/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md index 83418c0d85..af1b573655 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md @@ -5,6 +5,7 @@ ms.prod: windows-client ms.collection: - highpri - tier3 + - must-keep ms.topic: conceptual ms.date: 09/08/2021 --- From 2fdf333a01da644ac4f3d791d55b7811ff6abbf5 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Fri, 18 Aug 2023 17:14:33 -0700 Subject: [PATCH 039/125] add must-keep collection --- .../applocker/applocker-overview.md | 1 + .../design/microsoft-recommended-driver-block-rules.md | 1 + .../windows-defender-application-control/wdac.md | 1 + windows/security/docfx.json | 2 +- 4 files changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md index eaf509458d..7c130ac1f2 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md @@ -4,6 +4,7 @@ description: This article provides a description of AppLocker and can help you d ms.collection: - highpri - tier3 +- must-keep ms.topic: conceptual ms.localizationpriority: medium ms.date: 06/07/2023 diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md index a190d84898..d38b2eff55 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md @@ -5,6 +5,7 @@ ms.localizationpriority: medium ms.collection: - highpri - tier3 +- must-keep ms.date: 06/06/2023 ms.topic: article --- diff --git a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md b/windows/security/application-security/application-control/windows-defender-application-control/wdac.md index 7ee7a13013..42fb2e18d7 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/wdac.md @@ -5,6 +5,7 @@ ms.localizationpriority: medium ms.collection: - highpri - tier3 +- must-keep ms.date: 04/06/2023 ms.topic: article --- diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 48559f1650..20fa610bfa 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -224,7 +224,7 @@ "operating-system-security/device-management/windows-security-configuration-framework/*.md": "jmunck" }, "ms.collection": { - "application-security/application-control/windows-defender-application-control/**/*.md": "tier3", + "application-security/application-control/windows-defender-application-control/**/*.md": [ "tier3", "must-keep" ], "identity-protection/hello-for-business/*.md": "tier1", "information-protection/pluton/*.md": "tier1", "information-protection/tpm/*.md": "tier1", From 705740d3e016f3a505de65c31704d2df59fd882d Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Fri, 18 Aug 2023 17:28:44 -0700 Subject: [PATCH 040/125] add must-keep collection --- windows/deployment/do/mcc-enterprise-appendix.md | 6 ++++-- windows/deployment/do/mcc-enterprise-update-uninstall.md | 7 +++++-- windows/deployment/do/mcc-isp-cache-node-configuration.md | 8 +++++--- windows/deployment/do/mcc-isp-update.md | 6 ++++-- 4 files changed, 18 insertions(+), 9 deletions(-) diff --git a/windows/deployment/do/mcc-enterprise-appendix.md b/windows/deployment/do/mcc-enterprise-appendix.md index 20462921af..1e998c0da5 100644 --- a/windows/deployment/do/mcc-enterprise-appendix.md +++ b/windows/deployment/do/mcc-enterprise-appendix.md @@ -6,10 +6,12 @@ ms.prod: windows-client ms.author: carmenf author: cmknox ms.reviewer: mstewart -ms.topic: article +ms.topic: how-to ms.date: 12/31/2017 ms.technology: itpro-updates -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep --- # Appendix diff --git a/windows/deployment/do/mcc-enterprise-update-uninstall.md b/windows/deployment/do/mcc-enterprise-update-uninstall.md index d79c144a59..410155b347 100644 --- a/windows/deployment/do/mcc-enterprise-update-uninstall.md +++ b/windows/deployment/do/mcc-enterprise-update-uninstall.md @@ -6,11 +6,14 @@ ms.prod: windows-client ms.author: carmenf author: cmknox ms.reviewer: mstewart -ms.topic: article +ms.topic: how-to ms.date: 12/31/2017 ms.technology: itpro-updates -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep --- + # Update or uninstall Microsoft Connected Cache for Enterprise and Education Throughout the preview phase, we'll send you security and feature updates for MCC. Follow these steps to perform the update. diff --git a/windows/deployment/do/mcc-isp-cache-node-configuration.md b/windows/deployment/do/mcc-isp-cache-node-configuration.md index b7bea13484..a4d800235c 100644 --- a/windows/deployment/do/mcc-isp-cache-node-configuration.md +++ b/windows/deployment/do/mcc-isp-cache-node-configuration.md @@ -1,15 +1,17 @@ --- title: Cache node configuration manager: aaroncz -description: Configuring a cache node on Azure portal +description: Configuring a cache node on Azure portal. ms.prod: windows-client ms.author: carmenf author: cmknox ms.reviewer: mstewart -ms.topic: article +ms.topic: reference ms.date: 12/31/2017 ms.technology: itpro-updates -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep --- # Cache node configuration diff --git a/windows/deployment/do/mcc-isp-update.md b/windows/deployment/do/mcc-isp-update.md index ab13ed3b58..5a3dcbd4fb 100644 --- a/windows/deployment/do/mcc-isp-update.md +++ b/windows/deployment/do/mcc-isp-update.md @@ -6,10 +6,12 @@ ms.prod: windows-client ms.author: carmenf author: cmknox ms.reviewer: mstewart -ms.topic: article +ms.topic: how-to ms.date: 12/31/2017 ms.technology: itpro-updates -ms.collection: tier3 +ms.collection: + - tier3 + - must-keep --- # Update or uninstall your cache node From 3f67863dd2e41e0523becf55a3f41e020930e9bb Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 21 Aug 2023 12:23:13 -0400 Subject: [PATCH 041/125] updates --- .../personal-data-encryption/index.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md index 6fe6c59028..0608ea1a7c 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md @@ -10,7 +10,7 @@ ms.date: 08/11/2023 Starting in Windows 11, version 22H2, Personal Data Encryption (PDE) is a security feature that provides file-based data encryption capabilities to Windows. PDE utilizes Windows Hello for Business to link *data encryption keys* with user credentials. When a user signs in to a device using Windows Hello for Business, decryption keys are released, and encrypted data is accessible to the user.\ -When a user logs off, decryption keys are discarded and data is inaccessible, even if another user signs in to the device. +When a user logs off, decryption keys are discarded and data is inaccessible, even if another user signs into the device. The use of Windows Hello for Business offers the following advantages: @@ -26,7 +26,10 @@ To use PDE, the following prerequisites must be met: - Windows 11, version 22H2 and later - The devices must be [Azure AD joined][AAD-1]. Domain-joined and hybrid Azure AD joined devices aren't supported -- Users must sign in using [Windows Hello for Business](../../../identity-protection/hello-for-business/index.md). Password and [security key][AAD-2] sign in aren't supported +- Users must sign in using [Windows Hello for Business](../../../identity-protection/hello-for-business/index.md) + +> [!IMPORTANT] +> If you sign in with a password or a [security key][AAD-2], you can't access PDE protected content. [!INCLUDE [personal-data-encryption-pde](../../../../../includes/licensing/personal-data-encryption-pde.md)] @@ -64,8 +67,8 @@ PDE is meant to work alongside BitLocker. PDE isn't a replacement for BitLocker, | Item | PDE | BitLocker | |--|--|--| | Release of decryption key | At user sign-in via Windows Hello for Business | At boot | -| Decryption keys discarded | When user signs out of Windows or one minute after Windows lock screen is engaged | At reboot | -| Files protected | Individual specified files | Entire volume/drive | +| Decryption keys discarded | When user signs out of Windows or one minute after Windows lock screen is engaged | At shutdown | +| Protected content | All files in protected folders | Entire volume/drive | | Authentication to access protected content | Windows Hello for Business | When BitLocker with TPM + PIN is enabled, BitLocker PIN plus Windows sign-in | ## Differences between PDE and EFS @@ -89,7 +92,7 @@ Encryption information including what encryption method is being used to protect The following are recommendations for using PDE: - Enable [BitLocker Drive Encryption](../bitlocker/index.md). Although PDE works without BitLocker, it's recommended to enable BitLocker. PDE is meant to work alongside BitLocker for increased security at it isn't a replacement for BitLocker -- Backup solution such as [OneDrive in Microsoft 365](/sharepoint/onedrive-overview). In certain scenarios, such as TPM resets or destructive PIN resets, the keys used by PDE to protect content will be lost making any PDE-protected concent inaccessible. The only way to recover such content is from a backup. If the files are synced to OneDrive, to regain access you must re-sync OneDrive +- Backup solution such as [OneDrive in Microsoft 365](/sharepoint/onedrive-overview). In certain scenarios, such as TPM resets or destructive PIN resets, the keys used by PDE to protect content will be lost making any PDE-protected content inaccessible. The only way to recover such content is from a backup. If the files are synced to OneDrive, to regain access you must re-sync OneDrive - [Windows Hello for Business PIN reset service](../../../identity-protection/hello-for-business/hello-feature-pin-reset.md). Destructive PIN resets will cause keys used by PDE to protect content to be lost, making any content protected with PDE inaccessible. After a destructive PIN reset, content protected with PDE must be recovered from a backup. For this reason, Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets - [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) offers additional security when authenticating with Windows Hello for Business via biometrics or PIN From 56891ddade85336904dca44b7034aa98d29b61b7 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 21 Aug 2023 13:04:52 -0400 Subject: [PATCH 042/125] removed "hybrid" --- .../hello-hybrid-cloud-kerberos-trust-provision.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md index d1059a1570..4765ae8d4e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md @@ -174,7 +174,7 @@ If you deployed Windows Hello for Business using the key trust model, and want t 1. [Set up Azure AD Kerberos in your hybrid environment](#deploy-azure-ad-kerberos). 1. [Enable cloud Kerberos trust via Group Policy or Intune](#configure-windows-hello-for-business-policy). -1. For hybrid Azure AD joined devices, sign out and sign in to the device using Windows Hello for Business. +1. For Azure AD joined devices, sign out and sign in to the device using Windows Hello for Business. > [!NOTE] > For hybrid Azure AD joined devices, users must perform the first sign in with new credentials while having line of sight to a DC. From 8977295d4c1523f1fac642f823263576b3fabbd2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 21 Aug 2023 11:52:40 -0700 Subject: [PATCH 043/125] endpoints-wufbr-8141818 --- .../update/includes/wufb-reports-endpoints.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/deployment/update/includes/wufb-reports-endpoints.md b/windows/deployment/update/includes/wufb-reports-endpoints.md index 1975275322..43db6286be 100644 --- a/windows/deployment/update/includes/wufb-reports-endpoints.md +++ b/windows/deployment/update/includes/wufb-reports-endpoints.md @@ -14,10 +14,11 @@ Devices must be able to contact the following endpoints in order to authenticate | **Endpoint** | **Function** | |---------------------------------------------------------|-----------| -| `https://v10c.events.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. DeviceCensus.exe must run on a regular cadence and contact this endpoint in order to receive most information for Windows Update for Business reports. | -| `https://v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier. | -| `https://settings-win.data.microsoft.com` | Required for Windows Update functionality. | -| `https://adl.windows.com` | Required for Windows Update functionality. | -| `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER), used to provide more advanced error reporting if certain Feature Update deployment failures occur. | -| `https://oca.telemetry.microsoft.com` | Online Crash Analysis, used to provide device-specific recommendations and detailed errors if there are certain crashes. | -| `https://login.live.com` | This endpoint facilitates your Microsoft account access and is required to create the primary identifier we use for devices. Without this service, devices won't be visible in the solution. The Microsoft Account Sign-in Assistant service must also be running (wlidsvc). | +| `*v10c.events.data.microsoft.com`

`eu-v10c.events.data.microsoft.com` for tenants with billing address in the [EU Data Boundary](/privacy/eudb/eu-data-boundary-learn) | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. DeviceCensus.exe must run on a regular cadence and contact this endpoint in order to receive most information for Windows Update for Business reports. | +| `umwatsonc.events.data.microsoft.com`

`eu-watsonc.events.data.microsoft.com` for tenants with billing address in the [EU Data Boundary](/privacy/eudb/eu-data-boundary-learn) | Windows Error Reporting (WER), used to provide more advanced error reporting if certain Feature Update deployment failures occur. | +| `v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier. | +| `settings-win.data.microsoft.com` | Used by applications to dynamically update their configuration. Required for Windows Update functionality. | +| `adl.windows.com` | Required for Windows Update functionality. | +| `oca.telemetry.microsoft.com` | Online Crash Analysis, used to provide device-specific recommendations and detailed errors if there are certain crashes. | +| `login.live.com` | This endpoint facilitates your Microsoft account access and is required to create the primary identifier we use for devices. Without this service, devices won't be visible in the solution. The Microsoft Account Sign-in Assistant service must also be running (wlidsvc). | +| `*.blob.core.windows.net` | Azure blob data storage.| \ No newline at end of file From eda79327b97ca4c00d5dc8898448fd0d1cc4ef2d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 21 Aug 2023 11:53:47 -0700 Subject: [PATCH 044/125] endpoints-wufbr-8141818 --- windows/deployment/update/includes/wufb-reports-endpoints.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/includes/wufb-reports-endpoints.md b/windows/deployment/update/includes/wufb-reports-endpoints.md index 43db6286be..111dad09a0 100644 --- a/windows/deployment/update/includes/wufb-reports-endpoints.md +++ b/windows/deployment/update/includes/wufb-reports-endpoints.md @@ -5,7 +5,7 @@ manager: aaroncz ms.technology: itpro-updates ms.prod: windows-client ms.topic: include -ms.date: 04/06/2022 +ms.date: 08/21/2023 ms.localizationpriority: medium --- @@ -14,7 +14,7 @@ Devices must be able to contact the following endpoints in order to authenticate | **Endpoint** | **Function** | |---------------------------------------------------------|-----------| -| `*v10c.events.data.microsoft.com`

`eu-v10c.events.data.microsoft.com` for tenants with billing address in the [EU Data Boundary](/privacy/eudb/eu-data-boundary-learn) | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. DeviceCensus.exe must run on a regular cadence and contact this endpoint in order to receive most information for Windows Update for Business reports. | +| `*v10c.events.data.microsoft.com`

`eu-v10c.events.data.microsoft.com` for tenants with billing address in the [EU Data Boundary](/privacy/eudb/eu-data-boundary-learn) | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. DeviceCensus.exe must run on a regular cadence and contact this endpoint in order to receive most information for Windows Update for Business reports. | | `umwatsonc.events.data.microsoft.com`

`eu-watsonc.events.data.microsoft.com` for tenants with billing address in the [EU Data Boundary](/privacy/eudb/eu-data-boundary-learn) | Windows Error Reporting (WER), used to provide more advanced error reporting if certain Feature Update deployment failures occur. | | `v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier. | | `settings-win.data.microsoft.com` | Used by applications to dynamically update their configuration. Required for Windows Update functionality. | From 1f3d8cb592c0a4ee13765563bbe21f4c55836848 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 21 Aug 2023 11:57:24 -0700 Subject: [PATCH 045/125] endpoints-wufbr-8141818 --- windows/deployment/update/includes/wufb-reports-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/includes/wufb-reports-endpoints.md b/windows/deployment/update/includes/wufb-reports-endpoints.md index 111dad09a0..388592c36c 100644 --- a/windows/deployment/update/includes/wufb-reports-endpoints.md +++ b/windows/deployment/update/includes/wufb-reports-endpoints.md @@ -17,7 +17,7 @@ Devices must be able to contact the following endpoints in order to authenticate | `*v10c.events.data.microsoft.com`

`eu-v10c.events.data.microsoft.com` for tenants with billing address in the [EU Data Boundary](/privacy/eudb/eu-data-boundary-learn) | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. DeviceCensus.exe must run on a regular cadence and contact this endpoint in order to receive most information for Windows Update for Business reports. | | `umwatsonc.events.data.microsoft.com`

`eu-watsonc.events.data.microsoft.com` for tenants with billing address in the [EU Data Boundary](/privacy/eudb/eu-data-boundary-learn) | Windows Error Reporting (WER), used to provide more advanced error reporting if certain Feature Update deployment failures occur. | | `v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier. | -| `settings-win.data.microsoft.com` | Used by applications to dynamically update their configuration. Required for Windows Update functionality. | +| `settings-win.data.microsoft.com` | Used by Windows components and applications to dynamically update their configuration. Required for Windows Update functionality. | | `adl.windows.com` | Required for Windows Update functionality. | | `oca.telemetry.microsoft.com` | Online Crash Analysis, used to provide device-specific recommendations and detailed errors if there are certain crashes. | | `login.live.com` | This endpoint facilitates your Microsoft account access and is required to create the primary identifier we use for devices. Without this service, devices won't be visible in the solution. The Microsoft Account Sign-in Assistant service must also be running (wlidsvc). | From b33bae6f3b5411a1ebef37650e72af24bab89ad4 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 21 Aug 2023 12:00:03 -0700 Subject: [PATCH 046/125] endpoints-wufbr-8141818 --- windows/deployment/update/wufb-reports-prerequisites.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/wufb-reports-prerequisites.md b/windows/deployment/update/wufb-reports-prerequisites.md index bdd9e61896..c4f742616a 100644 --- a/windows/deployment/update/wufb-reports-prerequisites.md +++ b/windows/deployment/update/wufb-reports-prerequisites.md @@ -6,7 +6,7 @@ ms.prod: windows-client author: mestew ms.author: mstewart ms.topic: article -ms.date: 06/27/2023 +ms.date: 08/21/2023 ms.technology: itpro-updates --- @@ -68,7 +68,7 @@ Device names don't appear in Windows Update for Business reports unless you indi Microsoft is committed to providing you with effective controls over your data and ongoing transparency into our data handling practices. For more information about data handling and privacy for Windows diagnostic data, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization) and [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data). -## Data transmission requirements +## Endpoints [!INCLUDE [Endpoints for Windows Update for Business reports](./includes/wufb-reports-endpoints.md)] From 5f590f5d0cd3e5117630914c4aaacacc06c30f22 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 21 Aug 2023 15:34:17 -0700 Subject: [PATCH 047/125] metadata-standard --- .../deployment/update/check-release-health.md | 15 ++++++++++----- .../update/deployment-service-drivers.md | 17 +++++++++++------ 2 files changed, 21 insertions(+), 11 deletions(-) diff --git a/windows/deployment/update/check-release-health.md b/windows/deployment/update/check-release-health.md index c77bd7cf97..049418846b 100644 --- a/windows/deployment/update/check-release-health.md +++ b/windows/deployment/update/check-release-health.md @@ -1,14 +1,19 @@ --- title: How to check Windows release health description: Check the release health status of Microsoft 365 services before you call support to see if there's an active service interruption. -ms.date: 06/07/2023 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to ms.author: mstewart author: mestew manager: aaroncz -ms.reviewer: mstewart -ms.topic: how-to -ms.prod: windows-client -ms.technology: itpro-updates +ms.collection: + - tier2 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +ms.date: 06/07/2023 --- # How to check Windows release health diff --git a/windows/deployment/update/deployment-service-drivers.md b/windows/deployment/update/deployment-service-drivers.md index 15d3739ce1..9195ddf400 100644 --- a/windows/deployment/update/deployment-service-drivers.md +++ b/windows/deployment/update/deployment-service-drivers.md @@ -1,19 +1,24 @@ --- -title: Deploy drivers and firmware updates with Windows Update for Business deployment service. -description: Use Windows Update for Business deployment service to deploy driver and firmware updates. +title: Deploy drivers and firmware updates. +titlesuffix: Windows Update for Business deployment service +description: Use Windows Update for Business deployment service to deploy driver and firmware updates to devices. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.collection: + - tier1 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 06/22/2023 --- # Deploy drivers and firmware updates with Windows Update for Business deployment service -***(Applies to: Windows 11 & Windows 10)*** The Windows Update for Business deployment service is used to approve and schedule software updates. The deployment service exposes its capabilities through the [Microsoft Graph API](/graph/use-the-api). You can call the API directly, through a [Graph SDK](/graph/sdks/sdks-overview), or integrate them with a management tool such as [Microsoft Intune](/mem/intune). From f4db0ffc524e4c887b5a3e89df2e7f45a4b528db Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 21 Aug 2023 15:56:18 -0700 Subject: [PATCH 048/125] update ds --- .../update/create-deployment-plan.md | 34 +++++++++---------- .../deployment-service-expedited-updates.md | 22 +++++++----- .../deployment-service-feature-updates.md | 22 +++++++----- .../update/deployment-service-overview.md | 24 +++++++------ .../deployment-service-prerequisites.md | 22 +++++++----- .../update/deployment-service-troubleshoot.md | 24 +++++++------ 6 files changed, 83 insertions(+), 65 deletions(-) diff --git a/windows/deployment/update/create-deployment-plan.md b/windows/deployment/update/create-deployment-plan.md index 0f0a693609..89a981ff58 100644 --- a/windows/deployment/update/create-deployment-plan.md +++ b/windows/deployment/update/create-deployment-plan.md @@ -1,28 +1,28 @@ --- title: Create a deployment plan -description: Devise the number of deployment rings you need and how you want to populate them +description: Devise the number of deployment rings you need and how you want to populate each of the deployment rings. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.collection: + - tier2 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Create a deployment plan -**Applies to** - -- Windows 10 -- Windows 11 - A "service management" mindset means that the devices in your organization fall into a continuum, with the software update process being constantly planned, deployed, monitored, and optimized. And once you use this process for feature updates, quality updates become a lightweight procedure that is simple and fast to execute, ultimately increasing velocity. -When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We’ve found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows client are similar to the deployment groups most organizations constructed for previous major revision upgrades. They're simply a method to separate devices into a deployment timeline. +When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We've found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows client are similar to the deployment groups most organizations constructed for previous major revision upgrades. They're simply a method to separate devices into a deployment timeline. -At the highest level, each “ring” comprises a group of users or devices that receive a particular update concurrently. For each ring, IT administrators set criteria to control deferral time or adoption (completion) that should be met before deployment to the next broader ring of devices or users can occur. +At the highest level, each ring comprises a group of users or devices that receive a particular update concurrently. For each ring, IT administrators set criteria to control deferral time or adoption (completion) that should be met before deployment to the next broader ring of devices or users can occur. A common ring structure uses three deployment groups: @@ -31,7 +31,7 @@ A common ring structure uses three deployment groups: - Broad: Wide deployment > [!NOTE] -> Organizations often use different names for their “rings," for example: +> Organizations often use different names for their rings, for example: > - First > Fast > Broad > - Canaries > Early Adopters > Users > - Preview > Broad > Critical @@ -45,8 +45,8 @@ There are no definite rules for exactly how many rings to have for your deployme There are basically two strategies for moving deployments from one ring to the next. One is service-based, the other project based. -- "Red button" (service based): Assumes that content is good until proven bad. Content flows until an issue is discovered, at which point the IT administrator presses the “red button” to stop further distribution. -- Green button (project based): Assumes that content is bad until proven good. Once all validation has passed, the IT administrator presses the “green button” to push the content to the next ring. +- "Red button" (service based): Assumes that content is good until proven bad. Content flows until an issue is discovered, at which point the IT administrator presses the "red button" to stop further distribution. +- Green button (project based): Assumes that content is bad until proven good. Once all validation has passed, the IT administrator presses the "green button" to push the content to the next ring. When it comes to deployments, having manual steps in the process usually impedes update velocity. A "red button" strategy is better when that is your goal. @@ -84,7 +84,7 @@ Analytics can help with defining a good Limited ring of representative devices a ### Who goes in the Limited ring? -The most important part of this phase is finding a representative sample of devices and applications across your network. If possible, all hardware and all applications should be represented. It's important that the people selected for this ring are using their devices regularly to generate the data you'll need to make a decision for broader deployment across your organization. The IT department, lab devices, and users with the most cutting-edge hardware usually don’t have the applications or device drivers that are truly a representative sample of your network. +The most important part of this phase is finding a representative sample of devices and applications across your network. If possible, all hardware and all applications should be represented. It's important that the people selected for this ring are using their devices regularly to generate the data you'll need to make a decision for broader deployment across your organization. The IT department, lab devices, and users with the most cutting-edge hardware usually don't have the applications or device drivers that are truly a representative sample of your network. During your pilot and validate phases, you should focus on the following activities: @@ -93,11 +93,11 @@ During your pilot and validate phases, you should focus on the following activit - Assess and act if issues are encountered. - Move forward unless blocked. -When you deploy to the Limited ring, you’ll be able to gather data and react to incidents happening in the environment, quickly addressing any issues that might arise. Ensure you monitor for sufficient adoption within this ring. Your Limited ring represents your organization across the board. When you achieve sufficient adoption, you can have confidence that your broader deployment will run more smoothly. +When you deploy to the Limited ring, you'll be able to gather data and react to incidents happening in the environment, quickly addressing any issues that might arise. Ensure you monitor for sufficient adoption within this ring. Your Limited ring represents your organization across the board. When you achieve sufficient adoption, you can have confidence that your broader deployment will run more smoothly. ## Broad deployment -Once the devices in the Limited ring have had a sufficient stabilization period, it’s time for broad deployment across the network. +Once the devices in the Limited ring have had a sufficient stabilization period, it's time for broad deployment across the network. ### Who goes in the Broad deployment ring? diff --git a/windows/deployment/update/deployment-service-expedited-updates.md b/windows/deployment/update/deployment-service-expedited-updates.md index 14b6fec38a..08ccc946c9 100644 --- a/windows/deployment/update/deployment-service-expedited-updates.md +++ b/windows/deployment/update/deployment-service-expedited-updates.md @@ -1,20 +1,24 @@ --- -title: Deploy expedited updates with Windows Update for Business deployment service -description: Use Windows Update for Business deployment service to deploy expedited updates. +title: Deploy expedited updates +titlesuffix: Windows Update for Business deployment service +description: Learn how to use Windows Update for Business deployment service to deploy expedited updates to devices in your organization. ms.prod: windows-client -author: mestew -ms.localizationpriority: medium -ms.author: mstewart -manager: aaroncz -ms.topic: article ms.technology: itpro-updates +ms.topic: how-to +ms.author: mstewart +author: mestew +manager: aaroncz +ms.collection: + - tier1 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 02/14/2023 --- # Deploy expedited updates with Windows Update for Business deployment service - -***(Applies to: Windows 11 & Windows 10)*** In this article, you will: > [!div class="checklist"] diff --git a/windows/deployment/update/deployment-service-feature-updates.md b/windows/deployment/update/deployment-service-feature-updates.md index b1a289befa..8082e08e98 100644 --- a/windows/deployment/update/deployment-service-feature-updates.md +++ b/windows/deployment/update/deployment-service-feature-updates.md @@ -1,20 +1,24 @@ --- -title: Deploy feature updates with Windows Update for Business deployment service. -description: Use Windows Update for Business deployment service to deploy feature updates. +title: Deploy feature updates +titlesuffix: Windows Update for Business deployment service +description: Use Windows Update for Business deployment service to deploy feature updates to devices in your organization. ms.prod: windows-client -author: mestew -ms.localizationpriority: medium -ms.author: mstewart -manager: aaroncz -ms.topic: article ms.technology: itpro-updates +ms.topic: how-to +ms.author: mstewart +author: mestew +manager: aaroncz +ms.collection: + - tier1 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 02/14/2023 --- # Deploy feature updates with Windows Update for Business deployment service -***(Applies to: Windows 11 & Windows 10)*** - The Windows Update for Business deployment service is used to approve and schedule software updates. The deployment service exposes its capabilities through the [Microsoft Graph API](/graph/use-the-api). You can call the API directly, through a [Graph SDK](/graph/sdks/sdks-overview), or integrate them with a management tool such as [Microsoft Intune](/mem/intune). This article uses [Graph Explorer](/graph/graph-explorer/graph-explorer-overview) to walk through the entire process of deploying a feature update to clients. In this article, you will: diff --git a/windows/deployment/update/deployment-service-overview.md b/windows/deployment/update/deployment-service-overview.md index 4b8e52781b..edf25a6c88 100644 --- a/windows/deployment/update/deployment-service-overview.md +++ b/windows/deployment/update/deployment-service-overview.md @@ -1,20 +1,24 @@ --- -title: Windows Update for Business deployment service -description: Overview of deployment service to control approval, scheduling, and safeguarding of Windows updates +title: Overview of the deployment service +titlesuffix: Windows Update for Business deployment service +description: Overview of deployment service to control approval, scheduling, and safeguarding of Windows updates with the deployment service. ms.prod: windows-client -author: mestew -ms.localizationpriority: medium -ms.author: mstewart -manager: aaroncz -ms.topic: overview ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.topic: how-to +ms.author: mstewart +author: mestew +manager: aaroncz +ms.collection: + - tier1 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +ms.date: 02/14/2023 --- # Windows Update for Business deployment service -***(Applies to: Windows 11 & Windows 10)*** - The Windows Update for Business deployment service is a cloud service within the Windows Update for Business product family. It's designed to work with your existing [Windows Update for Business](waas-manage-updates-wufb.md) policies and [Windows Update for Business reports](wufb-reports-overview.md). The deployment service provides control over the approval, scheduling, and safeguarding of updates delivered from Windows Update to managed devices. The service is privacy focused and backed by leading industry compliance certifications. Windows Update for Business product family has three elements: diff --git a/windows/deployment/update/deployment-service-prerequisites.md b/windows/deployment/update/deployment-service-prerequisites.md index ad489103a6..85433eafeb 100644 --- a/windows/deployment/update/deployment-service-prerequisites.md +++ b/windows/deployment/update/deployment-service-prerequisites.md @@ -1,20 +1,24 @@ --- -title: Prerequisites for the Windows Update for Business deployment service -description: Prerequisites for using the Windows Update for Business deployment service. +title: Prerequisites for the deployment service +titlesuffix: Windows Update for Business deployment service +description: Prerequisites for using the Windows Update for Business deployment service for updating devices in your organization. ms.prod: windows-client -author: mestew -ms.localizationpriority: medium -ms.author: mstewart -manager: aaroncz -ms.topic: article ms.technology: itpro-updates +ms.topic: how-to +ms.author: mstewart +author: mestew +manager: aaroncz +ms.collection: + - tier1 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 02/14/2023 --- # Windows Update for Business deployment service prerequisites -***(Applies to: Windows 11 & Windows 10)*** - Before you begin the process of deploying updates with Windows Update for Business deployment service, ensure you meet the prerequisites. ## Azure and Azure Active Directory diff --git a/windows/deployment/update/deployment-service-troubleshoot.md b/windows/deployment/update/deployment-service-troubleshoot.md index f6be148c37..97a1577792 100644 --- a/windows/deployment/update/deployment-service-troubleshoot.md +++ b/windows/deployment/update/deployment-service-troubleshoot.md @@ -1,22 +1,24 @@ --- -title: Troubleshoot the Windows Update for Business deployment service +title: Troubleshoot the deployment service +titlesuffix: Windows Update for Business deployment service description: Solutions to common problems with the service ms.prod: windows-client -author: mestew -ms.localizationpriority: medium -ms.author: mstewart -manager: aaroncz -ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.topic: how-to +ms.author: mstewart +author: mestew +manager: aaroncz +ms.collection: + - tier1 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +ms.date: 02/14/2023 --- - - # Troubleshoot the Windows Update for Business deployment service -***(Applies to: Windows 11 & Windows 10)*** - This troubleshooting guide addresses the most common issues that IT administrators face when using the Windows Update for Business [deployment service](deployment-service-overview.md). For a general troubleshooting guide for Windows Update, see [Windows Update troubleshooting](/troubleshoot/windows-client/deployment/windows-update-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json). ## The device isn't receiving an update that I deployed From c2ab55ee716e8701d2e531b5ec66f64e9234b29c Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 21 Aug 2023 16:03:02 -0700 Subject: [PATCH 049/125] update ds --- windows/deployment/update/check-release-health.md | 2 +- windows/deployment/update/deployment-service-drivers.md | 2 +- .../deployment/update/deployment-service-expedited-updates.md | 2 +- .../deployment/update/deployment-service-feature-updates.md | 2 +- windows/deployment/update/deployment-service-overview.md | 2 +- windows/deployment/update/deployment-service-prerequisites.md | 2 +- windows/deployment/update/deployment-service-troubleshoot.md | 4 ++-- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/deployment/update/check-release-health.md b/windows/deployment/update/check-release-health.md index 049418846b..a5732df6ef 100644 --- a/windows/deployment/update/check-release-health.md +++ b/windows/deployment/update/check-release-health.md @@ -3,7 +3,7 @@ title: How to check Windows release health description: Check the release health status of Microsoft 365 services before you call support to see if there's an active service interruption. ms.prod: windows-client ms.technology: itpro-updates -ms.topic: how-to +ms.topic: conceptual ms.author: mstewart author: mestew manager: aaroncz diff --git a/windows/deployment/update/deployment-service-drivers.md b/windows/deployment/update/deployment-service-drivers.md index 9195ddf400..fb138c40e8 100644 --- a/windows/deployment/update/deployment-service-drivers.md +++ b/windows/deployment/update/deployment-service-drivers.md @@ -4,7 +4,7 @@ titlesuffix: Windows Update for Business deployment service description: Use Windows Update for Business deployment service to deploy driver and firmware updates to devices. ms.prod: windows-client ms.technology: itpro-updates -ms.topic: how-to +ms.topic: conceptual author: mestew ms.author: mstewart manager: aaroncz diff --git a/windows/deployment/update/deployment-service-expedited-updates.md b/windows/deployment/update/deployment-service-expedited-updates.md index 08ccc946c9..ece5c1e592 100644 --- a/windows/deployment/update/deployment-service-expedited-updates.md +++ b/windows/deployment/update/deployment-service-expedited-updates.md @@ -4,7 +4,7 @@ titlesuffix: Windows Update for Business deployment service description: Learn how to use Windows Update for Business deployment service to deploy expedited updates to devices in your organization. ms.prod: windows-client ms.technology: itpro-updates -ms.topic: how-to +ms.topic: conceptual ms.author: mstewart author: mestew manager: aaroncz diff --git a/windows/deployment/update/deployment-service-feature-updates.md b/windows/deployment/update/deployment-service-feature-updates.md index 8082e08e98..c5cab745c1 100644 --- a/windows/deployment/update/deployment-service-feature-updates.md +++ b/windows/deployment/update/deployment-service-feature-updates.md @@ -4,7 +4,7 @@ titlesuffix: Windows Update for Business deployment service description: Use Windows Update for Business deployment service to deploy feature updates to devices in your organization. ms.prod: windows-client ms.technology: itpro-updates -ms.topic: how-to +ms.topic: conceptual ms.author: mstewart author: mestew manager: aaroncz diff --git a/windows/deployment/update/deployment-service-overview.md b/windows/deployment/update/deployment-service-overview.md index edf25a6c88..b56ef4dffb 100644 --- a/windows/deployment/update/deployment-service-overview.md +++ b/windows/deployment/update/deployment-service-overview.md @@ -4,7 +4,7 @@ titlesuffix: Windows Update for Business deployment service description: Overview of deployment service to control approval, scheduling, and safeguarding of Windows updates with the deployment service. ms.prod: windows-client ms.technology: itpro-updates -ms.topic: how-to +ms.topic: conceptual ms.author: mstewart author: mestew manager: aaroncz diff --git a/windows/deployment/update/deployment-service-prerequisites.md b/windows/deployment/update/deployment-service-prerequisites.md index 85433eafeb..c75475842c 100644 --- a/windows/deployment/update/deployment-service-prerequisites.md +++ b/windows/deployment/update/deployment-service-prerequisites.md @@ -4,7 +4,7 @@ titlesuffix: Windows Update for Business deployment service description: Prerequisites for using the Windows Update for Business deployment service for updating devices in your organization. ms.prod: windows-client ms.technology: itpro-updates -ms.topic: how-to +ms.topic: conceptual ms.author: mstewart author: mestew manager: aaroncz diff --git a/windows/deployment/update/deployment-service-troubleshoot.md b/windows/deployment/update/deployment-service-troubleshoot.md index 97a1577792..a173ce5eb1 100644 --- a/windows/deployment/update/deployment-service-troubleshoot.md +++ b/windows/deployment/update/deployment-service-troubleshoot.md @@ -1,10 +1,10 @@ --- title: Troubleshoot the deployment service titlesuffix: Windows Update for Business deployment service -description: Solutions to common problems with the service +description: Solutions to commonly encountered problems when using the Windows Update for Business deployment service. ms.prod: windows-client ms.technology: itpro-updates -ms.topic: how-to +ms.topic: troubleshoot ms.author: mstewart author: mestew manager: aaroncz From 780344c406791b20e20d75ca68498f48f67bc522 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 21 Aug 2023 16:06:07 -0700 Subject: [PATCH 050/125] update ds --- windows/deployment/update/deployment-service-drivers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/deployment-service-drivers.md b/windows/deployment/update/deployment-service-drivers.md index fb138c40e8..40235bc9bf 100644 --- a/windows/deployment/update/deployment-service-drivers.md +++ b/windows/deployment/update/deployment-service-drivers.md @@ -1,5 +1,5 @@ --- -title: Deploy drivers and firmware updates. +title: Deploy drivers and firmware updates titlesuffix: Windows Update for Business deployment service description: Use Windows Update for Business deployment service to deploy driver and firmware updates to devices. ms.prod: windows-client From 38237c715d94882796e7533e7da14cde80b04788 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 22 Aug 2023 08:41:00 -0700 Subject: [PATCH 051/125] update ds --- windows/deployment/update/deployment-service-troubleshoot.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/deployment-service-troubleshoot.md b/windows/deployment/update/deployment-service-troubleshoot.md index a173ce5eb1..836eba7c18 100644 --- a/windows/deployment/update/deployment-service-troubleshoot.md +++ b/windows/deployment/update/deployment-service-troubleshoot.md @@ -4,7 +4,7 @@ titlesuffix: Windows Update for Business deployment service description: Solutions to commonly encountered problems when using the Windows Update for Business deployment service. ms.prod: windows-client ms.technology: itpro-updates -ms.topic: troubleshoot +ms.topic: troubleshooting ms.author: mstewart author: mestew manager: aaroncz From 0ca21596001172489cf1f5f93af25c3ead549399 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 22 Aug 2023 09:11:11 -0700 Subject: [PATCH 052/125] update kb number --- .../deployment/update/waas-configure-wufb.md | 23 +++++++++---------- .../update/waas-wufb-group-policy.md | 18 +++++++-------- 2 files changed, 20 insertions(+), 21 deletions(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 550d1eb323..6af6c31910 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -6,22 +6,21 @@ ms.prod: windows-client author: mestew ms.localizationpriority: medium ms.author: mstewart -ms.topic: article +ms.topic: conceptual ms.technology: itpro-updates +ms.collection: + - tier1 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.date: 08/22/2023 --- # Configure Windows Update for Business - -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 -- Windows Server 2019 -- Windows Server 2022 - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) > [!NOTE] @@ -244,8 +243,8 @@ The following options are available for the policy: | Policy | Sets registry key under HKLM\Software | | --- | --- | -| GPO for Windows 11, version 22H2 with [KBxxxxxxx](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | -| MDM for Windows 11, version 22H2 with [KBxxxxxxx](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
./Device/Vendor/MSFT/Policy/Config/Update/
**[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| GPO for Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| MDM for Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later:
./Device/Vendor/MSFT/Policy/Config/Update/
**[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | ## Enable features that are behind temporary enterprise feature control diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 2e5b11bdd0..70f5290f64 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -1,7 +1,8 @@ --- title: Configure Windows Update for Business via Group Policy -description: Walk through of how to configure Windows Update for Business settings using Group Policy. +description: Walk through of how to configure Windows Update for Business settings using Group Policy to update devices. ms.prod: windows-client +ms.technology: itpro-updates author: mestew ms.localizationpriority: medium ms.author: mstewart @@ -9,19 +10,18 @@ ms.collection: - highpri - tier2 manager: aaroncz -ms.topic: how-to -ms.technology: itpro-updates +ms.topic: conceptual +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.date: 08/22/2023 --- # Walkthrough: Use Group Policy to configure Windows Update for Business - -**Applies to** - -- Windows 10 -- Windows 11 - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) ## Overview From 816f329b90294fb143ccfceb1d615f43a4936c16 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 22 Aug 2023 09:21:02 -0700 Subject: [PATCH 053/125] update kb number --- windows/deployment/update/waas-wufb-group-policy.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 70f5290f64..11cda13e43 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -3,14 +3,14 @@ title: Configure Windows Update for Business via Group Policy description: Walk through of how to configure Windows Update for Business settings using Group Policy to update devices. ms.prod: windows-client ms.technology: itpro-updates +manager: aaroncz +ms.topic: conceptual author: mestew ms.localizationpriority: medium ms.author: mstewart ms.collection: - highpri - tier2 -manager: aaroncz -ms.topic: conceptual appliesto: - ✅ Windows 11 - ✅ Windows 10 From a0a9de8b43fab478f02ea62069b80bf2d11e998d Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 22 Aug 2023 14:27:48 -0400 Subject: [PATCH 054/125] service pricipal url updates --- .../hello-for-business/hello-feature-pin-reset.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 9f0e8d48ae..e330291c34 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -241,5 +241,5 @@ You may find that PIN reset from Settings only works post sign in. Also, the loc [CSP-1]: /windows/client-management/mdm/passportforwork-csp [CSP-2]: /windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls [INT-1]: /mem/intune/configuration/settings-catalog -[APP-1]: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&redirect_uri=https%3A%2F%2Fcred.microsoft.com&prompt=admin_consent -[APP-2]: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&prompt=admin_consent +[APP-1]: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent +[APP-2]: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent From 54c67931d64c3c6a66eba50d26425e6772a39a8d Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Tue, 22 Aug 2023 11:32:54 -0700 Subject: [PATCH 055/125] Removed preview deployment ring deferralday note --- .../windows-autopatch-manage-driver-and-firmware-updates.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md index df57df3874..0a0f8bf4ba 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md @@ -52,10 +52,7 @@ The `CreateDriverUpdatePolicy` is created for the Test, First, Fast, and Broad d | Policy name | DisplayName | Description | Approval Type | DeploymentDeferralInDays | | ----- | ----- | ----- | ----- | ----- | -| `CreateDriverUpdatePolicy` | Windows Autopatch – Driver Update Policy [Test/First/Fast/Broad] | Driver Update Policy for device Test/First/Fast/Broad group | Automatic | `0` | - -> [!NOTE] -> In public preview, the DeploymentDeferralInDays setting is set to `0` for all deployment rings. +| `CreateDriverUpdatePolicy` | Windows Autopatch – Driver Update Policy [**Test/First/Fast/Broad**] | Driver Update Policy for **Test/First/Fast/Broad** group | Automatic | `0` | ## Feedback and support From 5da0a0249697d4d8f050dd104ab9b46e853c5c09 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Tue, 22 Aug 2023 11:40:38 -0700 Subject: [PATCH 056/125] Tweak --- .../windows-autopatch-manage-driver-and-firmware-updates.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md index 0a0f8bf4ba..0804dbfd0c 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md @@ -54,6 +54,9 @@ The `CreateDriverUpdatePolicy` is created for the Test, First, Fast, and Broad d | ----- | ----- | ----- | ----- | ----- | | `CreateDriverUpdatePolicy` | Windows Autopatch – Driver Update Policy [**Test/First/Fast/Broad**] | Driver Update Policy for **Test/First/Fast/Broad** group | Automatic | `0` | +> [!NOTE] +> The DeploymentDeferralInDays setting is set to `0` for all deployment rings. + ## Feedback and support If you need support with this feature, and have enrolled your tenant into Windows Autopatch, [submit a support request](../operate/windows-autopatch-support-request.md). From b9b266da06e47debbe9a92e281d4967ebfc4ba4f Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 22 Aug 2023 14:52:47 -0400 Subject: [PATCH 057/125] Adding related articles --- windows/deployment/customize-boot-image.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/windows/deployment/customize-boot-image.md b/windows/deployment/customize-boot-image.md index deed6bd549..5aa3b3cdca 100644 --- a/windows/deployment/customize-boot-image.md +++ b/windows/deployment/customize-boot-image.md @@ -7,7 +7,7 @@ author: frankroj manager: aaroncz ms.author: frankroj ms.topic: article -ms.date: 07/26/2023 +ms.date: 08/22/2023 ms.technology: itpro-deploy appliesto: - ✅ Windows 11 @@ -1272,3 +1272,9 @@ The **boot.wim** that is part of Windows installation media isn't supported for ## Windows Server 2012 R2 This walk-through isn't intended for use with Windows Server 2012 R2. Although the steps in this article may work with Windows Server 2012 R2 when using older versions of the Windows ADK. However it may have compatibility problems with versions of the Windows ADK that are newer than the [ADK for Windows 10, version 2004](/windows-hardware/get-started/adk-install#other-adk-downloads). For server OSes, it's recommended to use Windows Server 2016 or later for this walk-through. For more information, see [Windows Server 2012 R2 Lifecycle](/lifecycle/products/windows-server-2012-r2). + +## Related articles + +- [Create bootable Windows PE media: Update the Windows PE add-on for the Windows ADK](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive) +- [Update Windows installation media with Dynamic Update: Update WinPE](/windows/deployment/update/media-dynamic-update#update-winpe) +- [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932: Updating bootable media](https://prod.support.services.microsoft.com/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d?preview=true#updatebootable5025885) From cab93b39b99966d38849c754600d228b17e629fa Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 22 Aug 2023 15:14:46 -0400 Subject: [PATCH 058/125] Adding related articles 2 --- windows/deployment/customize-boot-image.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/customize-boot-image.md b/windows/deployment/customize-boot-image.md index 5aa3b3cdca..a72e0b1d1d 100644 --- a/windows/deployment/customize-boot-image.md +++ b/windows/deployment/customize-boot-image.md @@ -1275,6 +1275,6 @@ This walk-through isn't intended for use with Windows Server 2012 R2. Although t ## Related articles -- [Create bootable Windows PE media: Update the Windows PE add-on for the Windows ADK](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive) +- [Create bootable Windows PE media: Update the Windows PE add-on for the Windows ADK](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive#update-the-windows-pe-add-on-for-the-windows-adk) - [Update Windows installation media with Dynamic Update: Update WinPE](/windows/deployment/update/media-dynamic-update#update-winpe) - [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932: Updating bootable media](https://prod.support.services.microsoft.com/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d?preview=true#updatebootable5025885) From 68793c1a645cc4f638fb19fe671de2566d822e48 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Tue, 22 Aug 2023 14:23:43 -0700 Subject: [PATCH 059/125] Updated policy settings --- ...s-autopatch-manage-driver-and-firmware-updates.md | 12 ++++++------ .../whats-new/windows-autopatch-whats-new-2023.md | 3 ++- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md index 0804dbfd0c..881bb60534 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md @@ -1,7 +1,7 @@ --- title: Manage driver and firmware updates description: This article explains how you can manage driver and firmware updates with Windows Autopatch -ms.date: 08/21/2023 +ms.date: 08/22/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to @@ -46,16 +46,16 @@ Switching the toggle between Automatic and Self-managed modes creates driver pro 1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 1. Navigate to **Devices** > **Driver updates for Windows 10 and later**. -1. Windows Autopatch creates four policies. The policy names begin with **Windows Autopatch – Driver Update Policy** and end with the name of the ring to which they're targeted in brackets. For example, **Windows Autopatch – Driver Update Policy [Test]**. +1. Windows Autopatch creates four policies. The policy names begin with **Windows Autopatch – Driver Update Policy** and end with the name of the deployment ring to which they're targeted in brackets. For example, **Windows Autopatch – Driver Update Policy [Test]**. The `CreateDriverUpdatePolicy` is created for the Test, First, Fast, and Broad deployment rings. The policy settings are defined in the following table: | Policy name | DisplayName | Description | Approval Type | DeploymentDeferralInDays | | ----- | ----- | ----- | ----- | ----- | -| `CreateDriverUpdatePolicy` | Windows Autopatch – Driver Update Policy [**Test/First/Fast/Broad**] | Driver Update Policy for **Test/First/Fast/Broad** group | Automatic | `0` | - -> [!NOTE] -> The DeploymentDeferralInDays setting is set to `0` for all deployment rings. +| `CreateDriverUpdatePolicy` | Windows Autopatch – Driver Update Policy [**Test**] | Driver Update Policy for device **Test** group | Automatic | `0` | +| `CreateDriverUpdatePolicy`| Windows Autopatch – Driver Update Policy [**First**] | Driver Update Policy for device **First** group | Automatic | `1` | +| `CreateDriverUpdatePolicy` |Windows Autopatch – Driver Update Policy [**Fast**] | Driver Update Policy for device **Fast** group | Automatic | `6` | +| `CreateDriverUpdatePolicy` | Windows Autopatch – Driver Update Policy [**Broad**] | Driver Update Policy for device **Broad** group | Automatic | `9` | ## Feedback and support diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index d814cd921f..08173d5804 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 08/21/2023 +ms.date: 08/22/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new @@ -27,6 +27,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | Article | Description | | ----- | ----- | +| [Manage driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)| Added [policy settings](../operate/windows-autopatch-manage-driver-and-firmware-updates.md#view-driver-and-firmware-policies-created-by-windows-autopatch) for all deployment rings | | [Manage driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md) | General Availability
  • [MC661218](https://admin.microsoft.com/adminportal/home#/MessageCenter)
| | [Exclude a device](../operate/windows-autopatch-exclude-device.md) | Renamed Deregister a device to [Exclude a device](../operate/windows-autopatch-exclude-device.md). Added the [Restore device](../operate/windows-autopatch-exclude-device.md#restore-a-device-or-multiple-devices-previously-excluded) feature
  • [MC667662](https://admin.microsoft.com/adminportal/home#/MessageCenter)
| | [Device alerts](../operate/windows-autopatch-device-alerts.md) | Added `'InstallSetupBlock'` to the [Alert resolutions section](../operate/windows-autopatch-device-alerts.md#alert-resolutions) | From c135236844fa8eb0dd3cfbff0e1422333b9a9d23 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 08:10:29 -0700 Subject: [PATCH 060/125] metadata, formatting, and wording tweaks --- windows/deployment/update/eval-infra-tools.md | 14 +-- .../update/feature-update-user-install.md | 117 +++++++++--------- .../deployment/update/fod-and-lang-packs.md | 30 +++-- 3 files changed, 83 insertions(+), 78 deletions(-) diff --git a/windows/deployment/update/eval-infra-tools.md b/windows/deployment/update/eval-infra-tools.md index 4a20d28511..6a83bab027 100644 --- a/windows/deployment/update/eval-infra-tools.md +++ b/windows/deployment/update/eval-infra-tools.md @@ -1,23 +1,21 @@ --- title: Evaluate infrastructure and tools -description: Steps to make sure your infrastructure is ready to deploy updates +description: Review the steps to ensure your infrastructure is ready to deploy updates to clients in your organization. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: article author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: medium -ms.topic: article -ms.technology: itpro-updates +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Evaluate infrastructure and tools -**Applies to** - -- Windows 10 -- Windows 11 - Before you deploy an update, it's best to assess your deployment infrastructure (that is, tools such as Configuration Manager, Microsoft Intune, or similar) and current configurations (such as security baselines, administrative templates, and policies that affect updates). Then, set some criteria to define your operational readiness. ## Infrastructure diff --git a/windows/deployment/update/feature-update-user-install.md b/windows/deployment/update/feature-update-user-install.md index 1385930bef..41a21d5d7c 100644 --- a/windows/deployment/update/feature-update-user-install.md +++ b/windows/deployment/update/feature-update-user-install.md @@ -1,20 +1,21 @@ --- -title: Best practices - deploy feature updates for user-initiated installations +title: Best practices - user-initiated feature update installation description: Learn recommendations and best practices for manually deploying a feature update for a user-initiated installation. ms.prod: windows-client -author: mestew -ms.localizationpriority: medium -ms.author: mstewart -ms.date: 07/10/2018 -manager: aaroncz -ms.topic: article ms.technology: itpro-updates +ms.topic: best-practice +author: mestew +ms.author: mstewart +manager: aaroncz +ms.localizationpriority: medium +appliesto: +- ✅ Windows 10 +- ✅ Microsoft Configuration Manager +ms.date: 07/10/2018 --- # Deploy feature updates for user-initiated installations (during a fixed service window) -**Applies to**: Windows 10 - Use the following steps to deploy a feature update for a user-initiated installation. ## Get ready to deploy feature updates @@ -22,7 +23,7 @@ Use the following steps to deploy a feature update for a user-initiated installa ### Step 1: Enable Peer Cache Use **Peer Cache** to help manage deployment of content to clients in remote locations. Peer Cache is a built-in Configuration Manager solution that enables clients to share content with other clients directly from their local cache. -[Enable Configuration Manager client in full OS to share content](/sccm/core/clients/deploy/about-client-settings#enable-configuration-manager-client-in-full-os-to-share-content) if you have clients in remote locations that would benefit from downloading feature update content from a peer instead of downloading it from a distribution point (or Microsoft Update). +[Enable Configuration Manager client in full OS to share content](/mem/configmgr/core/clients/deploy/about-client-settings#enable-configuration-manager-client-in-full-os-to-share-content) if you have clients in remote locations that would benefit from downloading feature update content from a peer instead of downloading it from a distribution point (or Microsoft Update). ### Step 2: Override the default Windows setup priority (Windows 10, version 1709 and later) @@ -35,7 +36,7 @@ If you're deploying **Feature update to Windows 10, version 1709** or later, by Priority=Normal ``` -You can use the new [Run Scripts](/sccm/apps/deploy-use/create-deploy-scripts) feature to run a PowerShell script like the sample below to create the SetupConfig.ini on target devices. +You can use the new [Run Scripts](/mem/configmgr/apps/deploy-use/create-deploy-scripts) feature to run a PowerShell script like the sample below to create the SetupConfig.ini on target devices. ``` #Parameters @@ -80,7 +81,7 @@ or documentation, even if Microsoft has been advised of the possibility of such ``` >[!NOTE] ->If you elect not to override the default setup priority, you will need to increase the [maximum run time](/sccm/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value. +> If you elect not to override the default setup priority, you will need to increase the [maximum run time](/mem/configmgr/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value. ## Manually deploy feature updates in a user-initiated installation @@ -89,77 +90,73 @@ The following sections provide the steps to manually deploy a feature update. ### Step 1: Specify search criteria for feature updates There are potentially a thousand or more feature updates displayed in the Configuration Manager console. The first step in the workflow for manually deploying a feature update is to identify the feature updates that you want to deploy. -1. In the Configuration Manager console, click **Software Library**. -2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed. +1. In the Configuration Manager console, select **Software Library**. +2. In the Software Library workspace, expand **Windows 10 Servicing**, and select **All Windows 10 Updates**. The synchronized feature updates are displayed. 3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps: - - In the **search** text box, type a search string that will filter the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update. - - Click **Add Criteria**, select the criteria that you want to use to filter software updates, click **Add**, and then provide the values for the criteria. For example, Title contains 1803, **Required** is greater than or equal to 1, and **Language** equals English. + - In the **search** text box, type a search string that filters for the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update. + - Select **Add Criteria**, select the criteria that you want to use to filter software updates, select **Add**, and then provide the values for the criteria. For example, Title contains 1803, **Required** is greater than or equal to 1, and **Language** equals English. 4. Save the search for future use. ### Step 2: Download the content for the feature update(s) -Before you deploy the feature updates, you can download the content as a separate step. Do this so you can verify that the content is available on the distribution points before you deploy the feature updates. This will help you to avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment. +Before you deploy the feature updates, you can download the content as a separate step. Do this download so you can verify that the content is available on the distribution points before you deploy the feature updates. Downloading first helps you avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment. 1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**. -2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Download**. +2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right-click, and select **Download**. The **Download Software Updates Wizard** opens. 3. On the **Deployment Package** page, configure the following settings: **Create a new deployment package**: Select this setting to create a new deployment package for the software updates that are in the deployment. Configure the following settings: - - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters. + - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It's limited to 50 characters. - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters. - - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page. + - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\\server\sharename\path, or select **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page. - >[!NOTE] - >The deployment package source location that you specify cannot be used by another software deployment package. + > [!IMPORTANT] + > - The deployment package source location that you specify cannot be used by another software deployment package. + > - The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files. + > - You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location. - >[!IMPORTANT] - >The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files. - - >[!IMPORTANT] - >You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location. - - Click **Next**. -4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs). + Select **Next**. +4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then select **Next**. For more information about distribution points, see [Distribution point configurations](/mem/configmgr/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs). >[!NOTE] - >The Distribution Points page is available only when you create a new software update deployment package. + > The Distribution Points page is available only when you create a new software update deployment package. 5. On the **Distribution Settings** page, specify the following settings: - - **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: **High**, **Medium**, or **Low**. Packages with identical priorities are sent in the order in which they were created. If there is no backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority. - - **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content is not available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](/sccm/core/plan-design/hierarchy/content-source-location-scenarios). + - **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: **High**, **Medium**, or **Low**. Packages with identical priorities are sent in the order in which they were created. If there's no backlog, the package processes immediately regardless of its priority. By default, packages are sent using Medium priority. + - **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content isn't available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](/mem/configmgr/core/plan-design/hierarchy/content-source-location-scenarios). - **Prestaged distribution point settings**: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options: - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point. - **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point. - - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting. + - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This setting is the default. - For more information about prestaging content to distribution points, see [Use Prestaged content](/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage). - Click **Next**. + For more information about prestaging content to distribution points, see [Use Prestaged content](/mem/configmgr/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage). + Select **Next**. 6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options: - **Download software updates from the Internet**: Select this setting to download the software updates from the location on the Internet. This is the default setting. - - **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard does not have Internet access. + - **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard doesn't have Internet access. >[!NOTE] - >When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard. + > When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard. - Click **Next**. -7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page. -8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates. -9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click **Close**. + Select **Next**. +7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then select **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page. +8. On the **Summary** page, verify the settings that you selected in the wizard, and then select **Next** to download the software updates. +9. On the **Completion** page, verify that the software updates were successfully downloaded, and then select **Close**. #### To monitor content status -1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. -2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. +1. To monitor the content status for the feature updates, select **Monitoring** in the Configuration Manager console. +2. In the Monitoring workspace, expand **Distribution Status**, and then select **Content Status**. 3. Select the feature update package that you previously identified to download the feature updates. -4. On the **Home** tab, in the Content group, click **View Status**. +4. On the **Home** tab, in the Content group, select **View Status**. ### Step 3: Deploy the feature update(s) After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s). -1. In the Configuration Manager console, click **Software Library**. -2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. -3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**. +1. In the Configuration Manager console, select **Software Library**. +2. In the Software Library workspace, expand **Windows 10 Servicing**, and select **All Windows 10 Updates**. +3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right select, and select **Deploy**. The **Deploy Software Updates Wizard** opens. 4. On the General page, configure the following settings: @@ -178,7 +175,7 @@ After you determine which feature updates you intend to deploy, you can manually >[!NOTE] >A software update group deployed as **Required** will be downloaded in background and honor BITS settings, if configured. - - **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that do not require any software updates in the deployment are not started. By default, this setting is not enabled and is available only when **Type of deployment** is set to **Required**. + - **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that don't require any software updates in the deployment aren't started. By default, this setting isn't enabled and is available only when **Type of deployment** is set to **Required**. >[!WARNING] >Before you can use this option, computers and networks must be configured for Wake On LAN. @@ -189,7 +186,7 @@ After you determine which feature updates you intend to deploy, you can manually - **Schedule evaluation**: Specify whether the available time and installation deadline times are evaluated according to UTC or the local time of the computer running the Configuration Manager console. - **Software available time**: Select **Specific time** to specify when the software updates will be available to clients: - - **Specific time**: Select this setting to make the feature update in the deployment available to clients at a specific date and time. Specify a date and time that corresponds with the start of your fixed servicing window. When the deployment is created, the client policy is updated and clients are made aware of the deployment at their next client policy polling cycle. However, the feature update in the deployment is not available for installation until after the specified date and time are reached and the required content has been downloaded. + - **Specific time**: Select this setting to make the feature update in the deployment available to clients at a specific date and time. Specify a date and time that corresponds with the start of your fixed servicing window. When the deployment is created, the client policy is updated and clients are made aware of the deployment at their next client policy polling cycle. However, the feature update in the deployment isn't available for installation until after the specified date and time are reached and the required content has been downloaded. - **Installation deadline**: Select **Specific time** to specify the installation deadline for the software updates in the deployment. @@ -198,7 +195,7 @@ After you determine which feature updates you intend to deploy, you can manually - **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. However, for the purposes of the fixed servicing window, set the installation deadline date and time to a future value, well beyond the fixed servicing window. - Required deployments for software updates can benefit from functionality called advanced download. When the software available time is reached, clients will start downloading the content based on a randomized time. The feature update will not be displayed in Software Center for installation until the content is fully downloaded. This ensures that the feature update installation will start immediately when initiated. + Required deployments for software updates can benefit from functionality called advanced download. When the software available time is reached, clients start downloading the content based on a randomized time. The feature update won't be displayed in Software Center for installation until the content is fully downloaded. This ensures that the feature update installation starts immediately when initiated. 7. On the User Experience page, configure the following settings: - **User notifications**: Specify **Display in Software Center and show all notifications**. @@ -214,25 +211,25 @@ After you determine which feature updates you intend to deploy, you can manually >[!NOTE] >When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window. - **Software updates deployment re-evaluation behavior upon restart**: Starting in Configuration Manager version 1606, select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. This enables the client to check for additional software updates that become applicable after the client restarts, and to then install them (and become compliant) during the same maintenance window. -8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page. +8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page. >[!NOTE] >You can review recent software updates alerts from the **Software Updates** node in the **Software Library** workspace. 9. On the Download Settings page, configure the following settings: - Specify whether the client will download and install the software updates when a client is connected to a slow network or is using a fallback content location. - - Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates is not available on a preferred distribution point. - - **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](/sccm/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache). - - **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates are not available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content. + - Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates isn't available on a preferred distribution point. + - **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](/mem/configmgr/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache). + - **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates aren't available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content. - Specify whether to allow clients to download after an installation deadline when they use metered Internet connections. Internet providers sometimes charge by the amount of data that you send and receive when you are on a metered Internet connection. >[!NOTE] - >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](/sccm/core/plan-design/hierarchy/content-source-location-scenarios). -10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. -11. Click **Next** to deploy the feature update(s). + >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](/mem/configmgr/core/plan-design/hierarchy/content-source-location-scenarios). +10. On the Summary page, review the settings. To save the settings to a deployment template, select **Save As Template**, enter a name and select the settings that you want to include in the template, and then select **Save**. To change a configured setting, select the associated wizard page and change the setting. +11. Select **Next** to deploy the feature update(s). ### Step 4: Monitor the deployment status After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status: 1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. -2. Click the software update group or software update for which you want to monitor the deployment status. -3. On the **Home** tab, in the **Deployment** group, click **View Status**. +2. Select the software update group or software update for which you want to monitor the deployment status. +3. On the **Home** tab, in the **Deployment** group, select **View Status**. diff --git a/windows/deployment/update/fod-and-lang-packs.md b/windows/deployment/update/fod-and-lang-packs.md index 2978105443..9aa7cbbc8a 100644 --- a/windows/deployment/update/fod-and-lang-packs.md +++ b/windows/deployment/update/fod-and-lang-packs.md @@ -1,21 +1,26 @@ --- -title: Make FoD and language packs available for WSUS/Configuration Manager -description: Learn how to make FoD and language packs available when you're using WSUS/Configuration Manager. +title: FoD and language packs for WSUS and Configuration Manager +description: Learn how to make FoD and language packs available to clients when you're using WSUS or Configuration Manager. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: article ms.author: mstewart author: mestew ms.localizationpriority: medium -ms.date: 03/13/2019 manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Microsoft Configuration Manager +- ✅ WSUS +ms.date: 03/13/2019 --- + # How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager -**Applies to** +This article describes how to make Features on Demand and language packs available when you're using WSUS or Configuration Manager for specific versions of Windows. -- Windows 10 -- Windows 11 +## Version information for Features on Demand and language packs In Windows 10 version 21H2 and later, non-Administrator user accounts can add both a display language and its corresponding language features. @@ -23,10 +28,15 @@ As of Windows 10 version 1709, you can't use Windows Server Update Services (WSU The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it's important to note this policy only allows specifying one alternate location and behaves differently across OS versions. -In Windows 10 versions 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions does not influence how language packs are acquired. +In Windows 10 versions 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions doesn't influence how language packs are acquired. In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It's currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location. -For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. +For all OS versions, changing the **Specify settings for optional component installation and component repair** policy doesn't affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](/windows/client-management/). + +## More resources + +- [WSUS documentation](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) +- [Configuration Manager documentation](https://docs.microsoft.com/mem/configmgr/) From 76ce05fcfb2b277bde50780a7c03217c6812531d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 09:37:15 -0700 Subject: [PATCH 061/125] metadata, formatting, and wording tweaks --- .../deployment/update/fod-and-lang-packs.md | 6 +- .../get-started-updates-channels-tools.md | 48 ++++++------- .../update/how-windows-update-works.md | 69 ++++++++----------- .../deployment/update/media-dynamic-update.md | 18 +++-- windows/deployment/update/optional-content.md | 33 ++++----- .../update/plan-define-readiness.md | 24 +++---- .../deployment/update/plan-define-strategy.md | 32 ++++----- 7 files changed, 107 insertions(+), 123 deletions(-) diff --git a/windows/deployment/update/fod-and-lang-packs.md b/windows/deployment/update/fod-and-lang-packs.md index 9aa7cbbc8a..972dd73a69 100644 --- a/windows/deployment/update/fod-and-lang-packs.md +++ b/windows/deployment/update/fod-and-lang-packs.md @@ -3,7 +3,7 @@ title: FoD and language packs for WSUS and Configuration Manager description: Learn how to make FoD and language packs available to clients when you're using WSUS or Configuration Manager. ms.prod: windows-client ms.technology: itpro-updates -ms.topic: article +ms.topic: conceptual ms.author: mstewart author: mestew ms.localizationpriority: medium @@ -38,5 +38,5 @@ Learn about other client management options, including using Group Policy and ad ## More resources -- [WSUS documentation](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) -- [Configuration Manager documentation](https://docs.microsoft.com/mem/configmgr/) +- [WSUS documentation](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) +- [Configuration Manager documentation](/mem/configmgr/) diff --git a/windows/deployment/update/get-started-updates-channels-tools.md b/windows/deployment/update/get-started-updates-channels-tools.md index bb423208bf..5dc206f1aa 100644 --- a/windows/deployment/update/get-started-updates-channels-tools.md +++ b/windows/deployment/update/get-started-updates-channels-tools.md @@ -1,23 +1,22 @@ --- title: Windows client updates, channels, and tools -description: Brief summary of the kinds of Windows updates, the channels they are served through, and the tools for managing them +description: Brief summary of the kinds of Windows updates, the channels they're served through, and the tools for managing them ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Windows client updates, channels, and tools -**Applies to** - -- Windows 10 -- Windows 11 - +This article provides a brief summary of the kinds of Windows updates, the channels they're served through, and the tools for managing them. ## How Windows updates work There are four phases to the Windows update process: @@ -26,18 +25,18 @@ There are four phases to the Windows update process: administrator. This process is invisible to the user. - **Download:** Once the device determines that an update is available, it begins downloading the update. The download process is also invisible to the user. With feature updates, download happens in multiple sequential phases. -- **Install:** After the update is downloaded, depending on the device’s Windows Update settings, the update is installed on the system. +- **Install:** After the update is downloaded, depending on the device's Windows Update settings, the update is installed on the system. - **Commit and restart:** Once installed, the device usually (but not always) must be restarted in order to complete the installation and begin using the update. Before that happens, a device is still running the previous version of the software. ## Types of updates -We include information here about many different update types you'll hear about, but the two overarching types that you have the most direct control over are *feature updates* and *quality updates*. +We include information here about many different update types you hear about, but the two overarching types that you have the most direct control over are *feature updates* and *quality updates*. -- **Feature updates:** Released annually. Feature updates add new features and functionality to Windows 10. Because they are delivered frequently (rather than every 3-5 years), they are easier to manage. -- **Quality updates:** Quality updates deliver both security and non-security fixes. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. They are typically released on the second Tuesday of each month, though they can be released at any time. The second-Tuesday releases are the ones that focus on security updates. Quality updates are *cumulative*, so installing the latest quality update is sufficient to get all the available fixes for a specific feature update, including any out-of-band security fixes and any *servicing stack updates* that might have been released previously. -- **Servicing stack updates:** The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates are not necessarily included in *every* monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). For more detail about servicing stack updates, see [Servicing stack updates](servicing-stack-updates.md). -- **Driver updates**: These update drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they are installed or not. +- **Feature updates:** Released annually. Feature updates add new features and functionality to Windows 10. Because they're delivered frequently (rather than every 3-5 years), they're easier to manage. +- **Quality updates:** Quality updates deliver both security and nonsecurity fixes. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. They're typically released on the second Tuesday of each month, though they can be released at any time. The second-Tuesday releases are the ones that focus on security updates. Quality updates are *cumulative*, so installing the latest quality update is sufficient to get all the available fixes for a specific feature update, including any out-of-band security fixes and any *servicing stack updates* that might have been released previously. +- **Servicing stack updates:** The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates aren't necessarily included in *every* monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically doesn't have updates released every month. You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). For more detail about servicing stack updates, see [Servicing stack updates](servicing-stack-updates.md). +- **Driver updates**: These update drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they're installed or not. - **Microsoft product updates:** These update other Microsoft products, such as Office. You can enable or disable Microsoft updates by using policies controlled by various servicing tools. @@ -50,13 +49,14 @@ The first step of controlling when and how devices install updates is assigning ### General Availability Channel -In the General Availability Channel, feature updates are released annually. As long as a device isn't set to defer feature updates, any device in this channel will install a feature update as soon as it's released. If you use Windows Update for Business, the channel provides three months of additional total deployment time before being required to update to the next release. +In the General Availability Channel, feature updates are released annually. As long as a device isn't set to defer feature updates, any device in this channel installs a feature update as soon as it's released. If you use Windows Update for Business, the channel provides three months of additional total deployment time before being required to update to the next release. ### Windows Insider Program for Business -Insider preview releases are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. There are actually three options within the Windows Insider Program for Business channel: +Insider preview releases are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. There are options within the Windows Insider Program for Business channel: +- Windows Insider Canary - Windows Insider Dev - Windows Insider Beta - Windows Insider Release Preview @@ -73,12 +73,12 @@ The General Availability Channel is the default servicing channel for all Window | Edition | General Availability Channel | Insider Program | Long-Term Servicing Channel | | --- | --- | --- | --- | -| Home | ![yes.](images/checkmark.png)|![no](images/crossmark.png) | ![no](images/crossmark.png)| -| Pro | ![yes.](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png)| -| Enterprise | ![yes.](images/checkmark.png) |![yes](images/checkmark.png) | ![no](images/crossmark.png)| -| Enterprise LTSC | ![no.](images/crossmark.png) |![no](images/crossmark.png) | ![yes](images/checkmark.png)| -| Pro Education | ![yes.](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png)| -| Education | ![yes.](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png)| +| Home | Yes|No | No| +| Pro | Yes | Yes | No| +| Enterprise | Yes |Yes | No| +| Enterprise LTSC | No |No | Yes| +| Pro Education | Yes | Yes | No| +| Education | Yes | Yes | No| ## Servicing tools @@ -104,4 +104,4 @@ Your individual devices connect to Microsoft endpoints directly to get the updat ### Hybrid scenarios -It is also possible to combine WSUS-based on-premises update distribution with cloud-based update delivery. +It's also possible to combine WSUS-based on-premises update distribution with cloud-based update delivery. diff --git a/windows/deployment/update/how-windows-update-works.md b/windows/deployment/update/how-windows-update-works.md index 907f34dd28..ef02459999 100644 --- a/windows/deployment/update/how-windows-update-works.md +++ b/windows/deployment/update/how-windows-update-works.md @@ -1,47 +1,38 @@ --- title: How Windows Update works -description: In this article, learn about the process Windows Update uses to download and install updates on a Windows client devices. +description: In this article, learn about the process Windows Update uses to download and install updates on Windows client devices. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # How Windows Update works -**Applies to** - -- Windows 10 -- Windows 11 - The Windows Update workflow has four core areas of functionality: -### Scan - -1. Orchestrator schedules the scan. -2. Orchestrator verifies admin approvals and policies for download. - - -### Download -1. Orchestrator starts downloads. -2. Windows Update downloads manifest files and provides them to the arbiter. -3. The arbiter evaluates the manifest and tells the Windows Update client to download files. -4. Windows Update client downloads files in a temporary folder. -5. The arbiter stages the downloaded files. - - -### Install -1. Orchestrator starts the installation. -2. The arbiter calls the installer to install the package. - - -### Commit -1. Orchestrator starts a restart. -2. The arbiter finalizes before the restart. +1. Scan + 1. Orchestrator schedules the scan. + 1. Orchestrator verifies admin approvals and policies for download. +1. Download + 1. Orchestrator starts downloads. + 1. Windows Update downloads manifest files and provides them to the arbiter. + 1. The arbiter evaluates the manifest and tells the Windows Update client to download files. + 1. Windows Update client downloads files in a temporary folder. + 1. The arbiter stages the downloaded files. +1. Install + 1. Orchestrator starts the installation. + 1. The arbiter calls the installer to install the package. +1. Commit + 1. Orchestrator starts a restart. + 1. The arbiter finalizes before the restart. ## How updating works @@ -52,7 +43,7 @@ During the updating process, the Windows Update Orchestrator operates in the bac The Windows Update Orchestrator on your PC checks the Microsoft Update server or your WSUS endpoint for new updates at random intervals. The randomization ensures that the Windows Update server isn't overloaded with requests all at the same time. The Update Orchestrator searches only for updates that have been added since the last time updates were searched, allowing it to find updates quickly and efficiently. -When checking for updates, the Windows Update Orchestrator evaluates whether the update is appropriate for your device. It uses guidelines defined by the publisher of the update, for example, Microsoft Office including enterprise group policies. +When devices check for updates, the Windows Update Orchestrator evaluates whether the update is appropriate for your device. It uses guidelines defined by the publisher of the update, for example, Microsoft Office including enterprise group policies. Make sure you're familiar with the following terminology related to Windows Update scan: @@ -61,8 +52,8 @@ Make sure you're familiar with the following terminology related to Windows Upda |Update|We use this term to mean several different things, but in this context it's the actual updated code or change.| |Bundle update|An update that contains 1-N child updates; doesn't contain payload itself.| |Child update|Leaf update that's bundled by another update; contains payload.| -|Detector update|A special "update" that contains "IsInstalled" applicability rule only and no payload. Used for prereq evaluation.| -|Category update|A special "detectoid" that has an **IsInstalled** rule that is always true. Used for grouping updates and to allow the device to filter updates. | +|Detector update|A special update that contains `IsInstalled` applicability rule only and no payload. Used for prerequisite evaluation.| +|Category update|A special `detectoid` that has an `IsInstalled` rule that is always true. Used for grouping updates and allowing the device to filter updates. | |Full scan|Scan with empty datastore.| |Delta scan|Scan with updates from previous scan already cached in datastore.| |Online scan|Scan that uses the network and to check an update server. | @@ -80,7 +71,7 @@ Windows Update does the following actions when it runs a scan. #### Starts the scan for updates When users start scanning in Windows Update through the Settings panel, the following occurs: -- The scan first generates a “ComApi” message. The caller (Microsoft Defender Antivirus) tells the Windows Update engine to scan for updates. +- The scan first generates a `ComApi` message. The caller (Microsoft Defender Antivirus) tells the Windows Update engine to scan for updates. - "Agent" messages: queueing the scan, then actually starting the work: - Updates are identified by the different IDs ("ID = 10", "ID = 11") and from the different thread ID numbers. - Windows Update uses the thread ID filtering to concentrate on one particular task. @@ -88,9 +79,9 @@ When users start scanning in Windows Update through the Settings panel, the foll ![Windows Update scan log 1.](images/update-scan-log-1.png) #### Proxy Behavior -For Windows Update (WU) scans URLs that are used for update detection ([MS-WUSP]: SimpleAuth Web Service | Microsoft Docs, [MS-WUSP]: Client Web Service | Microsoft Docs): +For Windows Update (WU) scans URLs that are used for update detection ([MS-WUSP: SimpleAuth Web Service](/openspecs/windows_protocols/ms-wusp/61235469-6c2f-4c08-9749-e35d52c16899), [MS-WUSP: Client Web Service](/openspecs/windows_protocols/ms-wusp/69093c08-da97-445e-a944-af0bef36e4ec)): - System proxy is attempted (set using the `netsh` command). -- If WUA fails to reach the service due to a certain proxy, service, or authentication error code, then user proxy is attempted (generally it is the logged-in user). +- If WUA fails to reach the service due to a certain proxy, service, or authentication error code, then user proxy is attempted (generally it's the logged-in user). > [!Note] > For intranet WSUS update service URLs, we provide an option via Windows Update policy to select the proxy behavior. @@ -130,13 +121,13 @@ Common update failure is caused due to network issues. To find the root of the i > [!NOTE] > If the search is against WSUS or Configuration Manager, you can ignore warning messages for the Service Locator Service. -- On sites that only use WSUS or Configuration Manager, the Service Locator Service might be blocked at the firewall. In this case the request will fail, and though the service can’t scan against Windows Update or Microsoft Update, it can still scan against WSUS or Configuration Manager, since it’s locally configured. +- On sites that only use WSUS or Configuration Manager, the Service Locator Service might be blocked at the firewall. In this case the request will fail, and though the service can't scan against Windows Update or Microsoft Update, it can still scan against WSUS or Configuration Manager, since it's locally configured. ![Windows Update scan log 3.](images/update-scan-log-3.png) ## Downloading updates ![Windows Update download step.](images/update-download-step.png) -Once the Windows Update Orchestrator determines which updates apply to your computer, it will begin downloading the updates, if you have selected the option to automatically download updates. It does operation in the background without interrupting your normal use of the device. +Once the Windows Update Orchestrator determines which updates apply to your computer, it begins downloading the updates, if you have selected the option to automatically download updates. It does operation in the background without interrupting your normal use of the device. To ensure that your other downloads aren't affected or slowed down because updates are downloading, Windows Update uses Delivery Optimization, which downloads updates and reduces bandwidth consumption. diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md index 2c7e5e39f8..e2f3ab0e3c 100644 --- a/windows/deployment/update/media-dynamic-update.md +++ b/windows/deployment/update/media-dynamic-update.md @@ -1,24 +1,22 @@ --- title: Update Windows installation media with Dynamic Update -description: Learn how to deploy feature updates to your mission critical devices +description: Learn how to acquire and apply Dynamic Update packages to existing Windows images prior to deployment ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates -ms.date: 07/17/2023 ms.reviewer: stevedia +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +ms.date: 07/17/2023 --- # Update Windows installation media with Dynamic Update -**Applies to** - -- Windows 10 -- Windows 11 - This article explains how to acquire and apply Dynamic Update packages to existing Windows images *prior to deployment* and includes Windows PowerShell scripts you can use to automate this process. Volume-licensed media is available for each release of Windows in the Volume Licensing Service Center (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. You can use Dynamic Update to ensure that Windows devices have the latest feature update packages as part of an in-place upgrade while preserving language pack and Features on Demand (FODs) that might have been previously installed. Dynamic Update also eliminates the need to install a separate quality update as part of the in-place upgrade process. diff --git a/windows/deployment/update/optional-content.md b/windows/deployment/update/optional-content.md index b088d43792..1245ce7f59 100644 --- a/windows/deployment/update/optional-content.md +++ b/windows/deployment/update/optional-content.md @@ -1,20 +1,21 @@ --- title: Migrating and acquiring optional Windows content -description: Keep language resources and Features on Demand during operating system updates +description: How to keep language resources and Features on Demand during operating system updates for your organization. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 03/15/2023 --- # Migrating and acquiring optional Windows content during updates -***(Applies to: Windows 11 & Windows 10)*** - This article provides some background on the problem of keeping language resources and Features on Demand during operating system updates and offers guidance to help you move forward in the short term and prepare for the long term. When you update the operating system, it's critical to keep language resources and Features on Demand (FODs). Many commercial organizations use Configuration Manager or other management tools to distribute and orchestrate Windows client setup using a local Windows image or WIM file (a *media-based* or *task-sequence-based* update). Others do in-place updates using an approved Windows client feature update by using Windows Server Update Services (WSUS), Configuration Manager, or equivalent tools (a *servicing-based* update). @@ -43,7 +44,7 @@ Windows Setup needs access to the optional content. Since optional content isn't ### User-initiated feature acquisition failure -The second challenge involves a failure to acquire features when a user requests them. Imagine a user running a device with a new version of Windows client, either by using a clean installation or an in-place update. The user visits **Settings**, and attempts to install a second language, more language experience features, or other optional content. Again, since these features aren't in the operating system, the packages need to be acquired. For a typical user with internet access, Windows will acquire the features from a nearby Microsoft content delivery network, and everything works as designed. For commercial users, some might not have internet access or have policies to prevent acquisition over the internet. In these situations, Windows must acquire the content from an alternative location. When the content can't be found, users are frustrated, and another help desk call could result. This pain point is sometimes referred to as *failure to acquire optional content*. +The second challenge involves a failure to acquire features when a user requests them. Imagine a user running a device with a new version of Windows client, either by using a clean installation or an in-place update. The user visits **Settings**, and attempts to install a second language, more language experience features, or other optional content. Again, since these features aren't in the operating system, the packages need to be acquired. For a typical user with internet access, Windows acquires the features from a nearby Microsoft content delivery network, and everything works as designed. For commercial users, some might not have internet access or have policies to prevent acquisition over the internet. In these situations, Windows must acquire the content from an alternative location. When the content can't be found, users are frustrated, and another help desk call could result. This pain point is sometimes referred to as *failure to acquire optional content*. ## Options for acquiring optional content @@ -77,7 +78,7 @@ Consider moving to Windows Update for Business. Not only will the optional conte Starting in March 2023, UUP has been integrated with WSUS and Configuration Manager to bring the same optional content and acquisition benefits of Windows Update to on-premises management solutions. For example: -- FODs and languages will automatically migrate for devices that perform an in-place update using an approved Windows 11, version 22H2 client feature update from WSUS. Similarly, updates such as the combined cumulative update, Setup updates, and Safe OS updates will be included and current based on the month that the feature update was approved. +- FODs and languages will automatically migrate for devices that perform an in-place update using an approved Windows 11, version 22H2 client feature update from WSUS. Similarly, updates such as the combined cumulative update, Setup updates, and Safe OS updates are included and current based on the month that the feature update was approved. - Devices that upgrade using a local Windows image but use WSUS or Configuration Manager for approving the combined cumulative update will benefit by having support for optional content acquisition in the updated Windows OS, as well as OS self-healing. @@ -94,9 +95,9 @@ If you're not ready to move to Windows Update, another option is to enable Dynam - **Latest cumulative update**: Installs the latest cumulative quality update. - **Driver updates**: Latest version of applicable drivers that have already been published by manufacturers into Windows Update and meant specifically for Dynamic Update. -In addition to these updates for the new operating system, Dynamic Update will acquire optional content during the update process to ensure that the device has this content present when the update completes. So, although the device isn't connected to Windows Update, it will fetch content from a nearby Microsoft content download network (CDN). This approach addresses the first pain point with optional content, but not user-initiated acquisition. By default, [Dynamic Update](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) is enabled by Windows Setup. You can enable or disable Dynamic Update by using the /DynamicUpdate option in Windows Setup. If you use the servicing-based approach, you can set this value with `setupconfig.ini`. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details. +In addition to these updates for the new operating system, Dynamic Update acquires optional content during the update process to ensure that the device has this content present when the update completes. So, although the device isn't connected to Windows Update, it fetches content from a nearby Microsoft content download network (CDN). This approach addresses the first pain point with optional content, but not user-initiated acquisition. By default, [Dynamic Update](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) is enabled by Windows Setup. You can enable or disable Dynamic Update by using the /DynamicUpdate option in Windows Setup. If you use the servicing-based approach, you can set this value with `setupconfig.ini`. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details. -Dynamic Update can be configured with additional options. For example, you might want to have the benefits of optional content migration without automatically acquiring the latest quality update. You can do that with the /DynamicUpdate NoLCU option of Windows Setup. Afterward, you would separately follow your existing process for testing and approving monthly updates. The downside of this approach is the device will reboot again for the latest cumulative update since it wasn't available during the feature update. +Dynamic Update can be configured with additional options. For example, you might want to have the benefits of optional content migration without automatically acquiring the latest quality update. You can do that with the /DynamicUpdate NoLCU option of Windows Setup. Afterward, you would separately follow your existing process for testing and approving monthly updates. The downside of this approach is the device reboots again for the latest cumulative update since it wasn't available during the feature update. One further consideration when using Dynamic Update is the effect on your network. One of the top blockers for this approach is the concern that each device will separately fetch this content from Microsoft. Setup downloads Dynamic Update content using Delivery Optimization when available. For devices that aren't connected to the internet, a subset of the Dynamic Update content is available by using WSUS and the Microsoft catalog. @@ -120,7 +121,7 @@ The benefit of this option is that the Windows image can include those additiona A partial solution to address the first pain point of failing to migrate optional content during upgrade is to inject a subset of optional content during the upgrade process. This approach uses the Windows Setup option [/InstallLangPacks](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) to add Language Packs and language capabilities such as text-to-speech recognition from a folder that contains the packages. This approach lets an IT pro take a subset of optional content and stage them within their network. If you use the servicing-based approach, you can configure InstallLangPacks using `setupconfig.ini`. For more information, see [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview). -When Setup runs, it will inject these packages into the new operating system during installation. It can be an alternative to enabling Dynamic Update or customizing the operating system image before deployment. You must take care with this approach, because the packages can't be renamed. Further, the content is coming from two separate release media ISOs. The key is to copy both the FOD packages and the FOD metadata .cab from the FOD ISO into the folder, and the architecture-specific Language Pack .cabs from the LPLIP ISO. We treat InstallLangPacks failures as fatal, and roll back the entire upgrade. The idea is to not leave the user in a bad state since media-based upgrades don't migrate FOD and languages (unless Dynamic Update is enabled). +When Setup runs, it injects these packages into the new operating system during installation. It can be an alternative to enabling Dynamic Update or customizing the operating system image before deployment. You must take care with this approach, because the packages can't be renamed. Further, the content is coming from two separate release media ISOs. The key is to copy both the FOD packages and the FOD metadata .cab from the FOD ISO into the folder, and the architecture-specific Language Pack .cab files from the LPLIP ISO. We treat InstallLangPacks failures as fatal, and roll back the entire upgrade. The idea is to not leave the user in a bad state since media-based upgrades don't migrate FOD and languages (unless Dynamic Update is enabled). This approach has some interesting benefits. The original Windows image doesn't need to be modified, possibly saving time and scripting. @@ -134,12 +135,12 @@ Several of the options address ways to address optional content migration issues - The file path to the alternate source must be a fully qualified path; multiple locations can be separated by a semicolon. - This setting doesn't support installing language packs from an alternate source file path, only Features on Demand. If the policy is configured to acquire content from Windows Update, language packs will be acquired. -- If this setting isn't configured or disabled, files will be downloaded from the default Windows Update location, for example Windows Update for Business or WSUS. +- If this setting isn't configured or disabled, files are downloaded from the default Windows Update location, for example Windows Update for Business or WSUS. For more information, see [Configure a Windows Repair Source](/windows-hardware/manufacture/desktop/configure-a-windows-repair-source). -## Learn more +## More resources For more information about the Unified Update Platform and the approaches outlined in this article, see the following resources: @@ -156,11 +157,11 @@ For more information about the Unified Update Platform and the approaches outlin ## Sample scripts -Options 4 and 6 involve the most scripting. Sample scripts for Option 4 already exist, so we'll look at sample scripts for [Option 6](#option-6-install-optional-content-after-deployment): Install Optional Content after Deployment. +Options 4 and 6 involve the most scripting. Sample scripts for Option 4 already exist, so let's look at sample scripts for [Option 6](#option-6-install-optional-content-after-deployment): Install Optional Content after Deployment. ### Creating an optional content repository -To get started, we'll build a repository of optional content and host on a network share. This content is a subset of content from the FOD and language pack ISOs that ship with each release. We'll configure this repository or repo with only those FODs our organization needs, using DISM /Export. For example, a superset based on taking inventory of optional features installed on existing devices. In this case, we exclude the Windows Mixed Reality feature. In addition, we copy all language packs to the root of the repository. +To get started, we build a repository of optional content and host on a network share. This content is a subset of content from the FOD and language pack ISOs that ship with each release. We configure this repository or repo with only those FODs our organization needs, using DISM /Export. For example, a superset based on taking inventory of optional features installed on existing devices. In this case, we exclude the Windows Mixed Reality feature. In addition, we copy all language packs to the root of the repository. @@ -573,7 +574,7 @@ Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction ignore | Out-Null ### Saving optional content in the source operating system -To save optional content state in the source operating system, we create a custom action script to run before the operating system installs. In this script, we save optional features and language resources to a file. We also make a local copy of the repo with only those files needed based on the languages installed on the source operating system. This action will limit the files to copy. +To save optional content state in the source operating system, we create a custom action script to run before the operating system installs. In this script, we save optional features and language resources to a file. We also make a local copy of the repo with only those files needed based on the languages installed on the source operating system. This action limits the files to copy. ```powershell diff --git a/windows/deployment/update/plan-define-readiness.md b/windows/deployment/update/plan-define-readiness.md index cf56100362..3116459b20 100644 --- a/windows/deployment/update/plan-define-readiness.md +++ b/windows/deployment/update/plan-define-readiness.md @@ -1,26 +1,26 @@ --- title: Define readiness criteria -description: Identify important roles and figure out how to classify apps +description: Identify important roles and figure out how to classify apps so you can plan and manage your deployment ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: medium -ms.topic: article -ms.technology: itpro-updates +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Define readiness criteria -**Applies to** - -- Windows 10 -- Windows 11 +Planning and managing a deployment involves a variety of distinct activities and roles best suited to each activity. This article describes how to identify important roles and figure out how to classify apps. ## Figure out roles and personnel -Planning and managing a deployment involves a variety of distinct activities and roles best suited to each. As you plan, it's worth figuring out which roles you'll need to carry out the deployment and who should fill them. Different roles are active at various phases of a deployment. Depending on the size and complexity of your organization, some of the roles could be filled by the same person. However, it's best to have an established *process manager*, who will oversee all of the tasks for the deployment. +As you plan, it's worth figuring out which roles you'll need to carry out the deployment and who should fill them. Different roles are active at various phases of a deployment. Depending on the size and complexity of your organization, some of the roles could be filled by the same person. However, it's best to have an established *process manager*, who will oversee all of the tasks for the deployment. ### Process manager @@ -50,13 +50,9 @@ This table sketches out one view of the other roles, with their responsibilities |Stakeholders | Represent groups affected by updates, for example, heads of finance, end-user services, or change management | Key decision maker for a business unit or department | Plan, pilot deployment, broad deployment | - - - - ## Set criteria for rating apps -Some apps in your environment are fundamental to your core business activities. Other apps help workers perform their roles, but aren’t critical to your business operations. Before you start inventorying and assessing the apps in your environment, you should establish some criteria for categorizing your apps, and then determine a priority for each. This process will help you understand how best to deploy updates and how to resolve any issues that could arise. +Some apps in your environment are fundamental to your core business activities. Other apps help workers perform their roles, but aren't critical to your business operations. Before you start inventorying and assessing the apps in your environment, you should establish some criteria for categorizing your apps, and then determine a priority for each. This process will help you understand how best to deploy updates and how to resolve any issues that could arise. In the Prepare phase, you'll apply the criteria you define now to every app in your organization. @@ -78,7 +74,7 @@ Here's an example priority rating system; the specifics could vary for your orga |---------|---------| |1 | Any issues or risks identified must be investigated and resolved as soon as possible. | |2 | Start investigating risks and issues within two business days and fix them *during* the current deployment cycle. | -|3 | Start investigating risks and issues within 10 business days. You don’t have to fix them all within the current deployment cycle. However, all issues must be fixed by the end of the next deployment cycle. | +|3 | Start investigating risks and issues within 10 business days. You don't have to fix them all within the current deployment cycle. However, all issues must be fixed by the end of the next deployment cycle. | |4 | Start investigating risks and issues within 20 business days. You can fix them in the current or any future development cycle. | Related to priority, but distinct, is the concept of severity. You should define a severity ranking as well, based on how you feel a problem with an app should affect the deployment cycle. diff --git a/windows/deployment/update/plan-define-strategy.md b/windows/deployment/update/plan-define-strategy.md index bc225337f8..4682330907 100644 --- a/windows/deployment/update/plan-define-strategy.md +++ b/windows/deployment/update/plan-define-strategy.md @@ -2,44 +2,42 @@ title: Define update strategy description: Two examples of a calendar-based approach to consistent update installation ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Define update strategy with a calendar -**Applies to** - -- Windows 10 -- Windows 11 - Traditionally, organizations treated the deployment of operating system updates (especially feature updates) as a discrete project that had a beginning, a middle, and an end. A release was "built" (usually in the form of an image) and then distributed to users and their devices. -Today, more organizations are treating deployment as a continual process of updates that roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process. Microsoft has been evolving its Windows 10 release cycles, update mechanisms, and relevant tools to support this model. Feature updates are released twice per year, around March and September. All releases of Windows 10 have 18 months of servicing for all editions. Fall releases of the Enterprise and Education editions have an extra 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. +Today, more organizations are treating deployment as a continual process of updates that roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process. Microsoft has been evolving its Windows release cycles, update mechanisms, and relevant tools to support this model. For more information about the Windows lifecycle, see [Windows lifecycle FAQ](/lifecycle/faq/windows). -We encourage you to deploy every available release and maintain a fast cadence for some portion of your environment. We also recognize that you might have a large number of devices, and a need for little or no disruption. So, you might choose to update annually. The 18/30 month lifecycle cadence lets you allow some portion of your environment to move faster while a majority can move less quickly. +We encourage you to deploy every available release and maintain a fast cadence for some portion of your environment. We also recognize that you might have a large number of devices, and a need for little or no disruption. The lifecycle cadence lets you allow some portion of your environment to move faster while the majority can move less quickly. ## Calendar approaches -You can use a calendar approach for either a faster twice-per-year cadence or an annual cadence. Depending on company size, installing feature updates less often than once annually risks devices going out of service and becoming vulnerable to security threats, because they'll stop receiving the monthly security updates. +You can use a calendar approach for either a faster twice-per-year cadence or an annual cadence. Depending on company size, installing feature updates less often than once annually risks devices going out of service and becoming vulnerable to security threats, because they stop receiving the monthly security updates once a version is out of support. -### Annual -Here's a calendar showing an example schedule that applies one Windows 10 feature update per calendar year, aligned with Microsoft Configuration Manager and Microsoft 365 Apps release cycles: +## Annual approach +Here's a calendar showing an example schedule that applies one Windows feature update per calendar year, aligned with Microsoft Configuration Manager and Microsoft 365 Apps release cycles: [ ![Calendar showing an annual update cadence.](images/annual-calendar.png) ](images/annual-calendar.png#lightbox) -This approach provides approximately 12 months of use from each feature update before the next update is due to be installed. By aligning to the Windows 10, version H2 feature update, each release will be serviced for 30 months from the time of availability, giving you more flexibility when applying future feature updates. +This approach provides approximately 12 months of use from each feature update before the next update is due to be installed by aligning to the Windows H2 feature update. This cadence might be most suitable for you if any of these conditions apply: -- You're just starting your journey with the Windows 10 servicing process. If you're unfamiliar with new processes that support Windows 10 servicing, moving from a project happening once every three to five years to a twice-a-year feature update process can be daunting. This approach gives you time to learn new approaches and tools to reduce effort and cost. +- You're just starting your journey with the Windows servicing process. If you're unfamiliar with new processes that support Windows servicing, moving from a project happening once every three to five years to a feature update process can be daunting. This approach gives you time to learn new approaches and tools to reduce effort and cost. -- You want to wait and see how successful other companies are at adopting a Windows 10 feature update. +- You want to wait and see how successful other companies are at adopting a Windows feature update. -- You want to go quickly with feature updates, and want the ability to skip a feature update while keeping Windows 10 serviced in case business priorities change. Aligning to the Windows 10 feature update released in the second half of each calendar year, you get extra servicing for Windows 10 (30 months of servicing compared to 18 months). +- You want to go quickly with feature updates, and want the ability to skip a feature update while keeping Windows serviced in case business priorities change. From 291e9f09e29eb8522f19c88f7f99d90578f5fac3 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 09:38:12 -0700 Subject: [PATCH 062/125] metadata, formatting, and wording tweaks --- windows/deployment/update/plan-define-strategy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/plan-define-strategy.md b/windows/deployment/update/plan-define-strategy.md index 4682330907..9f3f2e92b7 100644 --- a/windows/deployment/update/plan-define-strategy.md +++ b/windows/deployment/update/plan-define-strategy.md @@ -1,6 +1,6 @@ --- title: Define update strategy -description: Two examples of a calendar-based approach to consistent update installation +description: Example of using a calendar-based approach to achieve consistent update installation in your organization. ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual From 4e0818b3fa269054f32ebcacae8ade9e7d30291b Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 10:03:29 -0700 Subject: [PATCH 063/125] metadata, formatting, and wording tweaks --- .../update/plan-determine-app-readiness.md | 38 +++++++-------- .../update/prepare-deploy-windows.md | 48 +++++++++---------- 2 files changed, 41 insertions(+), 45 deletions(-) diff --git a/windows/deployment/update/plan-determine-app-readiness.md b/windows/deployment/update/plan-determine-app-readiness.md index b25c48f947..735e5a3095 100644 --- a/windows/deployment/update/plan-determine-app-readiness.md +++ b/windows/deployment/update/plan-determine-app-readiness.md @@ -1,37 +1,35 @@ --- title: Determine application readiness -manager: aaroncz -description: How to test your apps to know which need attention prior to deploying an update +description: How to test your apps to identify which need attention prior to deploying an update in your organization. ms.prod: windows-client -ms.localizationpriority: medium -ms.topic: article +ms.technology: itpro-updates +ms.topic: conceptual ms.author: mstewart author: mestew -ms.technology: itpro-updates +manager: aaroncz +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Determine application readiness -**Applies to** - -- Windows 10 -- Windows 11 - Before you deploy a Windows client update, you should know which apps will continue to work without problems, which need their own updates, and which just won't work and must be replaced. If you haven't already, it's worth [classifying your apps](plan-define-readiness.md) with respect to their criticality in your organization. ## Validation methods -You can choose from a variety of methods to validate apps. Exactly which ones to use will depend on the specifics of your environment. +You can choose from various methods to validate apps. Exactly which ones to use depends on the specifics of your environment. |Validation method |Description | |---------|---------| -|Full regression | A full quality assurance probing. Staff who know the application well and can validate its core functionality should do this. | -|Smoke testing | The application goes through formal validation. That is, a user validates the application following a detailed plan, ideally with limited, or no knowledge of the application they’re validating. | -|Automated testing | Software performs tests automatically. The software will let you know whether the tests have passed or failed, and will provide detailed reporting for you automatically. | -|Test in pilot | You pre-select users to be in the pilot deployment group and carry out the same tasks they do on a day-to-day basis to validate the application. Normally you use this method in addition to one of the other validation types. | -|Reactive response | Applications are validated in late pilot, and no specific users are selected. These applications normally aren't installed on many devices and aren’t handled by enterprise application distribution. | +|Full regression | A full quality assurance probing. Staff that know the application well and can validate its core functionality should do this validation. | +|Smoke testing | The application goes through formal validation. That is, a user validates the application following a detailed plan, ideally with limited, or no knowledge of the application they're validating. | +|Automated testing | Software performs tests automatically. The software lets you know whether the tests have passed or failed, and provides detailed reporting for you automatically. | +|Test in pilot | You preselect users to be in the pilot deployment group and carry out the same tasks they do on a day-to-day basis to validate the application. Normally you use this method in addition to one of the other validation types. | +|Reactive response | Applications are validated in late pilot, and no specific users are selected. These applications normally aren't installed on many devices and aren't handled by enterprise application distribution. | Combining the various validation methods with the app classifications you've previously established might look like this: @@ -46,7 +44,7 @@ Combining the various validation methods with the app classifications you've pre ### Identify users -Since your organization no doubt has a wide variety of users, each with different background and regular tasks, you'll have to choose which users are best suited for validation testing. Some factors to consider include: +Since your organization no doubt has a wide variety of users, each with different background and regular tasks, you have to choose which users are best suited for validation testing. Some factors to consider include: - **Location**: If users are in different physical locations, can you support them and get validation feedback from the region they're in? - **Application knowledge**: Do the users have appropriate knowledge of how the app is supposed to work? @@ -56,10 +54,10 @@ You could seek volunteers who enjoy working with new features and include them i ### Identify and set up devices for validation -In addition to users, it's important to carefully choose devices to participate in app validation as well. For example, ideally, your selection will include devices representing all of the hardware models in your environment. +In addition to users, it's important to carefully choose devices to participate in app validation as well. For example, ideally, your selection includes devices representing all of the hardware models in your environment. -There is more than one way to choose devices for app validation: +There's more than one way to choose devices for app validation: - **Existing pilot devices**: You might already have a list of devices that you regularly use for testing updates as part of release cycles. -- **Manual selection**: Some internal groups like operations will have expertise to help choose devices manually based on specifications, usage, or records of past support problems. +- **Manual selection**: Some internal groups like operations have expertise to help choose devices manually based on specifications, usage, or records of past support problems. - **Data-driven analysis**: With appropriate tools, you can use diagnostic data from devices to inform your choices. diff --git a/windows/deployment/update/prepare-deploy-windows.md b/windows/deployment/update/prepare-deploy-windows.md index a6c241bac8..ad9ebeff3a 100644 --- a/windows/deployment/update/prepare-deploy-windows.md +++ b/windows/deployment/update/prepare-deploy-windows.md @@ -2,28 +2,26 @@ title: Prepare to deploy Windows description: Final steps to get ready to deploy Windows, including preparing infrastructure, environment, applications, devices, network, capability, and users ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Prepare to deploy Windows -**Applies to** - -- Windows 10 -- Windows 11 - -Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows client. The planning phase will have left you with these useful items: +Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows client. The planning phase left you with these useful items: - A clear understanding of necessary personnel and their roles and criteria for [rating app readiness](plan-define-readiness.md) - A plan for [testing and validating](plan-determine-app-readiness.md) apps - An assessment of your [deployment infrastructure](eval-infra-tools.md) and definitions for operational readiness -- A [deployment plan](create-deployment-plan.md) that defines the rings you want to use +- A [deployment plan](create-deployment-plan.md) that defines the rings you want to use Now you're ready to actually start making changes in your environment to get ready to deploy. @@ -33,26 +31,26 @@ Now you're ready to actually start making changes in your environment to get rea - Update non-Microsoft security tools like security agents or servers. - Update non-Microsoft management tools like data loss prevention agents. -Your infrastructure probably includes many different components and tools. You’ll need to ensure your environment isn’t affected by issues due to the changes you make to the various parts of the infrastructure. Follow these steps: +Your infrastructure probably includes many different components and tools. You need to ensure your environment isn't affected by issues due to the changes you make to the various parts of the infrastructure. Follow these steps: -1. Review all of the infrastructure changes that you’ve identified in your plan. It’s important to understand the changes that need to be made and to detail how to implement them. This process prevents problems later on. +1. Review all of the infrastructure changes that you've identified in your plan. It's important to understand the changes that need to be made and to detail how to implement them. This process prevents problems later on. -2. Validate your changes. You’ll validate the changes for your infrastructure’s components and tools, to help you understand how your changes could affect your production environment. +2. Validate your changes. You validate the changes for your infrastructure's components and tools, to help you understand how your changes could affect your production environment. 3. Implement the changes. Once the changes have been validated, you can implement the changes across the wider infrastructure. -You should also look at your organization’s environment’s configuration and outline how you’ll implement any necessary changes previously identified in the plan phase to support the update. Consider what you’ll need to do for the various settings and policies that currently underpin the environment. For example: +You should also look at your organization's environment's configuration and outline how you'll implement any necessary changes previously identified in the plan phase to support the update. Consider what you need to do for the various settings and policies that currently underpin the environment. For example: -- Implement new draft security guidance. New versions of Windows can include new features that improve your environment’s security. Your security teams will want to make appropriate changes to security-related configurations. +- Implement new draft security guidance. New versions of Windows can include new features that improve your environment's security. Your security teams will want to make appropriate changes to security-related configurations. - Update security baselines. Security teams understand the relevant security baselines and will have to work to make sure all baselines fit into whatever guidance they have to adhere to. -However, your configuration will consist of many different settings and policies. It’s important to only apply changes where they are necessary, and where you gain a clear improvement. Otherwise, your environment might face issues that will slow down the update process. You want to ensure your environment isn’t affected adversely because of changes you make. For example: +However, your configuration will consist of many different settings and policies. It's important to only apply changes where they're necessary, and where you gain a clear improvement. Otherwise, your environment might face issues that slow down the update process. You want to ensure your environment isn't affected adversely because of changes you make. For example: -1. Review new security settings. Your security team will review the new security settings to understand how they can best be set to facilitate the update, and to also investigate the potential effects they might have on your environment. +1. Review new security settings. Your security team reviews the new security settings to understand how they can best be set to facilitate the update, and to also investigate the potential effects they might have on your environment. -2. Review security baselines for changes. Security teams will also review all the necessary security baselines, to ensure the changes can be implemented, and ensure your environment remains compliant. +2. Review security baselines for changes. Security teams also review all the necessary security baselines, to ensure the changes can be implemented, and ensure your environment remains compliant. 3. Implement and validate security settings and baseline changes. Your security teams will then implement all of the security settings and baselines, having addressed any potential outstanding issues. @@ -142,9 +140,9 @@ You can also create and run scripts to perform additional cleanup actions on dev - Compact the operating system by running **Compact.exe /CompactOS:always**. -- Remove Windows Features on Demand that the user doesn't need. See [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) for more guidance. +- Remove Windows Features on Demand that the user doesn't need. For more information, see [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). -- Move Windows Known Folders to OneDrive. See [Use Group Policy to control OneDrive sync settings](/onedrive/use-group-policy) for more information. +- Move Windows Known Folders to OneDrive. For more information, see [Use Group Policy to control OneDrive sync settings](/onedrive/use-group-policy). - Clean up the Software Distribution folder. Try deploying these commands as a batch file to run on devices to reset the download state of Windows Updates: @@ -167,9 +165,9 @@ You can also create and run scripts to perform additional cleanup actions on dev ## Prepare capability -In the plan phase, you determined the specific infrastructure and configuration changes that needed to be implemented to add new capabilities to the environment. Now you can move on to implementing those changes defined in the plan phase. You'll need to complete these higher-level tasks to gain those new capabilities: +In the plan phase, you determined the specific infrastructure and configuration changes that needed to be implemented to add new capabilities to the environment. Now you can move on to implementing those changes defined in the plan phase. You need to complete these higher-level tasks to gain those new capabilities: -- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions will come with new policies that you use to update ADMX templates. +- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions come with new policies that you use to update ADMX templates. - Validate new changes to understand how they affect the wider environment. @@ -177,12 +175,12 @@ In the plan phase, you determined the specific infrastructure and configuration ## Prepare users -Users often feel like they are forced into updating their devices randomly. They often don't fully understand why an update is needed, and they don't know when updates would be applied to their devices ahead of time. It's best to ensure that upcoming updates are communicated clearly and with adequate warning. +Users often feel like they're forced into updating their devices randomly. They often don't fully understand why an update is needed, and they don't know when updates would be applied to their devices ahead of time. It's best to ensure that upcoming updates are communicated clearly and with adequate warning. -You can employ a variety of measures to achieve this goal, for example: +You can employ various measures to achieve this goal, for example: - Send overview email about the update and how it will be deployed to the entire organization. - Send personalized emails to users about the update with specific details. - Set an opt-out deadline for employees that need to remain on the current version for a bit longer, due to a business need. -- Provide the ability to voluntarily update at users’ convenience. +- Provide the ability to voluntarily update at users' convenience. - Inform users of a mandatory installation date when the update will be installed on all devices. From 4fe9ce0f9a064117e4ecc16f0ea2310014ce3920 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 23 Aug 2023 10:16:48 -0700 Subject: [PATCH 064/125] Updates to Pause and resume feature --- ...-groups-windows-quality-update-overview.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md index 57b9aa5aad..34a3b93fab 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md @@ -1,7 +1,7 @@ --- title: Windows quality updates overview with Autopatch groups experience description: This article explains how Windows quality updates are managed with Autopatch groups -ms.date: 07/25/2023 +ms.date: 08/23/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -24,17 +24,17 @@ To release updates to devices in a gradual manner, Windows Autopatch deploys a s | Policy | Description | | ----- | ----- | | [Deferrals](/windows/client-management/mdm/policy-csp-update#update-deferqualityupdatesperiodindays) | Deferral policies delay the time the update is offered to the device by a specific number of days. The "offer" date for Windows quality updates is equal to the number of days specified in the deferral policy after the second Tuesday of each month. | -| [Deadlines](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Before the deadline, restarts can be scheduled by users or automatically scheduled outside of active hours. After the deadline passes, restarts will occur regardless of active hours and users won't be able to reschedule. The deadline for a specific device is set to be the specified number of days after the update is offered to the device. | +| [Deadlines](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Before the deadline, users can schedule restarts or automatically scheduled outside of active hours. After the deadline passes, restarts will occur regardless of active hours and users won't be able to reschedule. The deadline for a specific device is set to be the specified number of days after the update is offered to the device. | | [Grace periods](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinegraceperiod) | This policy specifies a minimum number of days after an update is downloaded until the device is automatically restarted. This policy overrides the deadline policy so that if a user comes back from vacation, it prevents the device from forcing a restart to complete the update as soon as it comes online. | -For devices in the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group), Windows Autopatch configures these policies differently across deployment rings to gradually release the update. Devices in the Test ring receive changes first and devices in the Last ring receive changes last. For more information about the Test and Last deployment rings, see [About the Test and Last deployment rings in Autopatch groups](../deploy/windows-autopatch-groups-overview.md#about-the-test-and-last-deployment-rings). With Windows Autopatch groups you can also customize the [Default Deployment Group’s deployment ring composition](../deploy/windows-autopatch-groups-overview.md#default-deployment-ring-composition) to add and/or remove deployment rings and can customize the update deployment cadences for each deployment ring. To learn more about customizing Windows Quality updates deployment cadence, see [Customize Windows Update settings](../operate/windows-autopatch-groups-windows-update.md). +For devices in the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group), Windows Autopatch configures these policies differently across deployment rings to gradually release the update. Devices in the Test ring receive changes first and devices in the Last ring receive changes last. For more information about the Test and Last deployment rings, see [About the Test and Last deployment rings in Autopatch groups](../deploy/windows-autopatch-groups-overview.md#about-the-test-and-last-deployment-rings). With Windows Autopatch groups, you can also customize the [Default Deployment Group’s deployment ring composition](../deploy/windows-autopatch-groups-overview.md#default-deployment-ring-composition) to add and/or remove deployment rings and can customize the update deployment cadences for each deployment ring. To learn more about customizing Windows Quality updates deployment cadence, see [Customize Windows Update settings](../operate/windows-autopatch-groups-windows-update.md). > [!IMPORTANT] > Deploying deferral, deadline, or grace period policies which conflict with Autopatch's policies will cause a device to be considered ineligible for management, it will still receive policies from Windows Autopatch that are not in conflict, but may not function as designed. These devices will be marked as ineligible in our device reporting and will not count towards our [service level objective](#service-level-objective). ## Service level objective -Windows Autopatch aims to keep at least 95% of eligible devices on the latest Windows quality update 21 days after release. Note that devices that have cadence type set to Schedule install won't be eligible for Windows quality update SLO. For more information about the Schedule Install cadence type, see [Deployment cadence types](../operate/windows-autopatch-groups-windows-update.md#deployment-cadence). +Windows Autopatch aims to keep at least 95% of eligible devices on the latest Windows quality update 21 days after release. Devices that have cadence type set to Schedule install aren't eligible for Windows quality update SLO. For more information about the Schedule Install cadence type, see [Deployment cadence types](../operate/windows-autopatch-groups-windows-update.md#deployment-cadence). > [!IMPORTANT] > Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Windows Update for Business service and Windows Autopatch don't offer Windows feature updates for devices that are part of the LTSC. You must either use [LTSC media](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) or the [Configuration Manager Operating System Deployment capabilities to perform an in-place upgrade](/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager) for Windows devices that are part of the LTSC. @@ -54,7 +54,7 @@ In the Release management blade, you can: For each [deployment ring](windows-autopatch-update-management.md#windows-autopatch-deployment-rings), the **Release schedule** tab contains: -- The status of the update. Releases will appear as **Active**. The update schedule is based on the values of the [Windows 10 Update Ring policies](/mem/intune/protect/windows-update-for-business-configure), which have been configured on your behalf. +- The status of the update. Releases appear as **Active**. The update schedule is based on the values of the [Windows 10 Update Ring policies](/mem/intune/protect/windows-update-for-business-configure), which have been configured on your behalf. - The date the update is available. - The target completion date of the update. - In the **Release schedule** tab, you can either [**Pause** and/or **Resume**](#pause-and-resume-a-release) a Windows quality update release. @@ -63,7 +63,7 @@ For each [deployment ring](windows-autopatch-update-management.md#windows-autopa Threat and vulnerability information about a new revision of Windows becomes available on the second Tuesday of each month. Windows Autopatch assesses that information shortly afterwards. If the service determines that it's critical to security, it may be expedited. The quality update is also evaluated on an ongoing basis throughout the release and Windows Autopatch may choose to expedite at any time during the release. -When running an expedited release, the regular goal of 95% of devices in 21 days no longer applies. Instead, Windows Autopatch greatly accelerates the release schedule of the release to update the environment more quickly. This approach requires an updated schedule for all devices outside of the Test ring since those devices are already getting the update quickly. +When expediting a release, the regular goal of 95% of devices in 21 days no longer applies. Instead, Windows Autopatch greatly accelerates the release schedule of the release to update the environment more quickly. This approach requires an updated schedule for all devices outside of the Test ring since those devices are already getting the update quickly. | Release type | Group | Deferral | Deadline | Grace period | | ----- | ----- | ----- | ----- | ----- | @@ -87,7 +87,7 @@ By default, the service expedites quality updates as needed. For those organizat Windows Autopatch schedules and deploys required Out of Band (OOB) updates released outside of the normal schedule. -For the deployment rings that have passed quality updates deferral date, the OOB release schedule will be expedited and deployed on the same day. For the deployment rings that have deferral upcoming, OOBs will be released as per the set deferral dates. +For the deployment rings that have passed quality updates deferral date, the OOB release schedule is expedited and deployed on the same day. For the deployment rings that have deferral upcoming, OOBs is released as per the set deferral dates. **To view deployed Out of Band quality updates:** @@ -114,19 +114,19 @@ If Windows Autopatch detects a [significant issue with a release](../operate/win 1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 1. Select **Devices** from the left navigation menu. 1. Under the **Windows Autopatch** section, select **Release management**. -1. In the **Release management** blade, got to the **Release schedule** tab and select **Windows quality updates**. -1. Select the Autopatch group that you want to pause or resume. Select either: **Pause** or **Resume**. Alternatively, you can select the **horizontal ellipses (...)** of the Autopatch group you want to pause or resume. Select, **Pause** or **Resume** from the dropdown menu. -1. Select a reason from the dropdown menu. -1. Optional. Enter details about why you're pausing or resuming the selected update. -1. If you're resuming an update, you can select one or more deployment rings. -1. Select **Okay**. +1. In the **Release management** blade, go to the **Release schedule** tab and select **Windows quality updates**. +1. Select the Autopatch group or deployment ring that you want to pause or resume. Select either: **Pause** or **Resume**. Alternatively, you can select the **horizontal ellipses (...)** of the Autopatch group or deployment ring you want to pause or resume. Select, **Pause** or **Resume** from the dropdown menu. +1. Optional. Enter the justification(s) about why you're pausing or resuming the selected update. +1. Optional. Select **This pause is related to Windows Update**. When you select this checkbox, you must provide information about how the pause is related to Windows Update. +1. If you're resuming an update, you can select one or more Autopatch groups or deployment rings. +1. Select **Pause or Resume deployment**. The three following statuses are associated with paused quality updates: | Status | Description | | ----- | ------ | -| Paused by Service | If the Windows Autopatch service has paused an update, the release will have the **Paused by Service** status. The Paused by Service only applies to rings that aren't Paused by the Tenant. | -| Paused by Tenant | If you've paused an update, the release will have the **Paused by Tenant** status. The Windows Autopatch service can't overwrite a tenant pause. You must select **Resume** to resume the update. | +| Paused by Service | If the Windows Autopatch service has paused an update, the release has the **Paused by Service** status. The Paused by Service only applies to rings that aren't Paused by the Tenant. | +| Paused by Tenant | If you've paused an update, the release has the **Paused by Tenant** status. The Windows Autopatch service can't overwrite a tenant pause. You must select **Resume** to resume the update. | ## Remediating Not ready and/or Not up to Date devices From 676d0cf69c0684d2b7ab7d7179f095afb75959d3 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 23 Aug 2023 10:25:52 -0700 Subject: [PATCH 065/125] Updated What's new with pause and resume update --- .../whats-new/windows-autopatch-whats-new-2023.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 08173d5804..7e051ce0a7 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 08/22/2023 +ms.date: 08/23/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new @@ -27,6 +27,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | Article | Description | | ----- | ----- | +| [Windows quality updates](../operate/windows-autopatch-groups-windows-quality-update-overview.md) | Added the **This pause is related to Windows Update** option to the [Pause and resume a release feature](../operate/windows-autopatch-groups-windows-quality-update-overview.md#pause-and-resume-a-release) | | [Manage driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)| Added [policy settings](../operate/windows-autopatch-manage-driver-and-firmware-updates.md#view-driver-and-firmware-policies-created-by-windows-autopatch) for all deployment rings | | [Manage driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md) | General Availability
  • [MC661218](https://admin.microsoft.com/adminportal/home#/MessageCenter)
| | [Exclude a device](../operate/windows-autopatch-exclude-device.md) | Renamed Deregister a device to [Exclude a device](../operate/windows-autopatch-exclude-device.md). Added the [Restore device](../operate/windows-autopatch-exclude-device.md#restore-a-device-or-multiple-devices-previously-excluded) feature
  • [MC667662](https://admin.microsoft.com/adminportal/home#/MessageCenter)
| From f4999d2e52abbe17fa6b3d143f2185474773fdff Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 10:37:23 -0700 Subject: [PATCH 066/125] metadata, formatting, and wording tweaks --- windows/deployment/update/PSFxWhitepaper.md | 46 +++++++++++---------- windows/deployment/update/release-cycle.md | 32 +++++++------- 2 files changed, 41 insertions(+), 37 deletions(-) diff --git a/windows/deployment/update/PSFxWhitepaper.md b/windows/deployment/update/PSFxWhitepaper.md index a0f9346acc..72d37a8849 100644 --- a/windows/deployment/update/PSFxWhitepaper.md +++ b/windows/deployment/update/PSFxWhitepaper.md @@ -2,20 +2,23 @@ title: Windows Updates using forward and reverse differentials description: A technique to produce compact software updates optimized for any origin and destination revision pair ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: reference author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +ms.date: 08/21/2021 --- # Windows Updates using forward and reverse differentials -Windows 10 monthly quality updates are cumulative, containing all previously +Windows monthly quality updates are cumulative, containing all previously released fixes to ensure consistency and simplicity. For an operating system -platform like Windows 10, which stays in support for multiple years, the size of +platform like Windows, which stays in support for multiple years, the size of monthly quality updates can quickly grow large, thus directly impacting network bandwidth consumption. @@ -23,8 +26,8 @@ Today, this problem is addressed by using express downloads, where differential downloads for every changed file in the update are generated based on selected historical revisions plus the base version. In this paper, we introduce a new technique to build compact software update packages that are applicable to any -revision of the base version, and then describe how Windows 10 quality updates -uses this technique. +revision of the base version, and then describe how Windows quality updates +use this technique. ## General Terms @@ -65,45 +68,44 @@ numerous advantages: - Efficient to install - Redistributable -Historically, download sizes of Windows 10 quality updates (Windows 10, version 1803 and older supported versions of Windows 10) are optimized by using express download. Express download is optimized such that updating Windows 10 systems will download the minimum number of bytes. This is achieved by generating differentials for every updated file based on selected historical base revisions of the same file + its base or RTM version. +Historically, download sizes of Windows quality updates (Windows 10, version 1803 and older supported versions of Windows 10) were optimized by using express download. Express download is optimized such that updating Windows systems download the minimum number of bytes. This is achieved by generating differentials for every updated file based on selected historical base revisions of the same file + its base or RTM version. -For example, if the October monthly quality update has updated Notepad.exe, differentials for Notepad.exe file changes from September to October, August to October, July to October, June to October, and from the original feature release to October are generated. All these differentials are stored in a Patch Storage File (PSF, also referred to as “express download files”) and hosted or cached on Windows Update or other update management or distribution servers (for example, Windows Server Update Services (WSUS), Microsoft Configuration Manager, or a non-Microsoft update management or distribution server that supports express updates). A device leveraging express updates uses network protocol to determine optimal differentials, then downloads only what is needed from the update distribution endpoints. +For example, if the October monthly quality update has updated Notepad.exe, differentials for Notepad.exe file changes from September to October, August to October, July to October, June to October, and from the original feature release to October are generated. All these differentials are stored in a Patch Storage File (PSF, also referred to as express download files) and hosted or cached on Windows Update or other update management or distribution servers (for example, Windows Server Update Services (WSUS), Microsoft Configuration Manager, or a non-Microsoft update management or distribution server that supports express updates). A device applying express updates uses network protocol to determine optimal differentials, then downloads only what is needed from the update distribution endpoints. -The flip side of express download is that the size of PSF files can be very large depending on the number of historical baselines against which differentials were calculated. Downloading and caching large PSF files to on-premises or remote update distribution servers is problematic for most organizations, hence they are unable to leverage express updates to keep their fleet of devices running Windows 10 up to date. Secondly, due to the complexity of generating differentials and size of the express files that need to be cached on update distribution servers, it is only feasible to generate express download files for the most common baselines, thus express updates are only applicable to selected baselines. Finally, calculation of optimal differentials is expensive in terms of system memory utilization, especially for low-cost systems, impacting their ability to download and apply an update seamlessly. +The flip side of express download is that the size of PSF files can be large depending on the number of historical baselines against which differentials were calculated. Downloading and caching large PSF files to on-premises or remote update distribution servers is problematic for most organizations, hence they're unable to use express updates to keep their fleet of devices running Windows up to date. Secondly, due to the complexity of generating differentials and size of the express files that need to be cached on update distribution servers, it's only feasible to generate express download files for the most common baselines, thus express updates are only applicable to selected baselines. Finally, calculation of optimal differentials is expensive in terms of system memory utilization, especially for low-cost systems, impacting their ability to download and apply an update seamlessly. -In the following sections, we describe how Windows 10 quality updates will leverage this technique based on forward and reverse differentials for newer releases of Windows 10 and Windows Server to overcome the challenges with express downloads. +In the following sections, we describe how quality updates use this technique based on forward and reverse differentials for newer releases of Windows and Windows Server to overcome the challenges with express downloads. ## High-level Design ### Update packaging -Windows 10 quality update packages will contain forward differentials from quality update RTM baselines (∆RTM→N) and reverse differentials back to RTM (∆N→RTM) for each file that has changed since RTM. By using the RTM version as the baseline, we ensure that all devices will have an identical payload. Update package metadata, content manifests, and forward and reverse differentials will be packaged into a cabinet file (.cab). This .cab file, and the applicability logic, will also be wrapped in Microsoft Standalone Update (.msu) format. +Windows quality update packages contain forward differentials from quality update RTM baselines (∆RTM→N) and reverse differentials back to RTM (∆N→RTM) for each file that has changed since RTM. By using the RTM version as the baseline, we ensure that all devices have an identical payload. Update package metadata, content manifests, and forward and reverse differentials are packaged into a cabinet file (.cab). This .cab file, and the applicability logic, will also be wrapped in Microsoft Standalone Update (.msu) format. -There can be cases where new files are added to the system during servicing. These files will not have RTM baselines, thus forward and reverse differentials cannot be used. In these scenarios, null differentials will be used to handle servicing. Null differentials are the slightly compressed and optimized version of the full binaries. Update packages can have either forward or reverse differentials, or null differential of any given binary in them. The following image symbolizes the content of a Windows 10 quality update installer: +There can be cases where new files are added to the system during servicing. These files won't have RTM baselines, thus forward and reverse differentials can't be used. In these scenarios, null differentials are used to handle servicing. Null differentials are the slightly compressed and optimized version of the full binaries. Update packages can have either forward or reverse differentials, or null differential of any given binary in them. The following image symbolizes the content of a Windows quality update installer: ![Outer box labeled .msu containing two sub-boxes: 1) Applicability Logic, 2) box labeled .cab containing four sub-boxes: 1) update metadata, 2) content manifests, 3) delta sub RTM transform to sub N (file 1, file2, etc.), and 4) delta sub N transform to RTM (file 1, file 2, etc.).](images/PSF4.png) ### Hydration and installation -Once the usual applicability checks are performed on the update package and are determined to be applicable, the Windows component servicing infrastructure will hydrate the full files during pre-installation and then proceed with the usual installation process. +Once the usual applicability checks are performed on the update package and are determined to be applicable, the Windows component servicing infrastructure hydrates the full files during preinstallation and then proceeds with the usual installation process. -Below is a high-level sequence of activities that the component servicing infrastructure will run in a transaction to complete installation of the update: +Below is a high-level sequence of activities that the component servicing infrastructure runs in a transaction to complete installation of the update: - Identify all files that are required to install the update. - Hydrate each of necessary files using current version (VN) of the file, reverse differential (VN--->RTM) of the file back to quality update RTM/base version and forward differential (VRTM--->R) from feature update RTM/base version to the target version. Also, use null differential hydration to hydrate null compressed files. -- Stage the hydrated files (full file), forward differentials (under ‘f’ folder) and reverse differentials (under ‘r’ folder) or null compressed files (under ‘n’ folder) in the component store (%windir%\\WinSxS folder). +- Stage the hydrated files (full file), forward differentials (under `f` folder) and reverse differentials (under `r` folder) or null compressed files (under `n` folder) in the component store (%windir%\\WinSxS folder). - Resolve any dependencies and install components. - Clean up older state (VN-1); the previous state VN is retained for uninstallation and restoration or repair. ### **Resilient Hydration** -To ensure resiliency against component store corruption or missing files that could occur due to susceptibility of certain types of hardware to file system corruption, a corruption repair service has been traditionally used to recover the component store automatically (“automatic corruption repair”) or on demand (“manual corruption repair”) using an online or local repair source. This service will continue to offer the ability to repair and recover content for -hydration and successfully install an update, if needed. +To ensure resiliency against component store corruption or missing files that could occur due to susceptibility of certain types of hardware to file system corruption, a corruption repair service has been traditionally used to recover the component store automatically (automatic corruption repair) or on demand (manual corruption repair) using an online or local repair source. This service will continue to offer the ability to repair and recover content for hydration and successfully install an update, if needed. -When corruption is detected during update operations, automatic corruption repair will start as usual and use the Baseless Patch Storage File published to Windows Update for each update to fix corrupted manifests, binary differentials, or hydrated or full files. Baseless patch storage files will contain reverse and forward differentials and full files for each updated component. Integrity of the repair files will be hash verified. +When corruption is detected during update operations, automatic corruption repair starts as usual and uses the Baseless Patch Storage File published to Windows Update for each update to fix corrupted manifests, binary differentials, or hydrated or full files. Baseless patch storage files contain reverse and forward differentials and full files for each updated component. Integrity of the repair files will be hash verified. -Corruption repair will use the component manifest to detect missing files and get hashes for corruption detection. During update installation, new registry flags for each differential staged on the machine will be set. When automatic corruption repair runs, it will scan hydrated files using the manifest and differential files using the flags. If the differential cannot be found or verified, it will be added to the list of corruptions to repair. +Corruption repair uses the component manifest to detect missing files and get hashes for corruption detection. During update installation, new registry flags for each differential staged on the machine are set. When automatic corruption repair runs, it scans hydrated files using the manifest and differential files using the flags. If the differential can't be found or verified, it's added to the list of corruptions to repair. ### Lazy automatic corruption repair -“Lazy automatic corruption repair” runs during update operations to detect corrupted binaries and differentials. While applying an update, if hydration of any file fails, "lazy" automatic corruption repair automatically starts, identifies the corrupted binary or differential file, and then adds it to the corruption list. Later, the update operation continues as far as it can go, so that "lazy" automatic corruption repair can collect as many corrupted files to fix as possible. At the end of the hydration section, the update fails, and automatic corruption repair starts. Automatic corruption repair runs as usual and at the end of its operation, adds the corruption list generated by "lazy" automatic corruption repair on top of the new list to repair. Automatic corruption repair then repairs the files on the corruption list and installation of the update will succeed on the next attempt. +"Lazy automatic corruption repair" runs during update operations to detect corrupted binaries and differentials. While applying an update, if hydration of any file fails, "lazy" automatic corruption repair automatically starts, identifies the corrupted binary or differential file, and then adds it to the corruption list. Later, the update operation continues as far as it can go, so that "lazy" automatic corruption repair can collect as many corrupted files to fix as possible. At the end of the hydration section, the update fails, and automatic corruption repair starts. Automatic corruption repair runs as usual and at the end of its operation, adds the corruption list generated by "lazy" automatic corruption repair on top of the new list to repair. Automatic corruption repair then repairs the files on the corruption list and installation of the update will succeed on the next attempt. diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md index 6061c9efab..ae7df5172a 100644 --- a/windows/deployment/update/release-cycle.md +++ b/windows/deployment/update/release-cycle.md @@ -1,19 +1,21 @@ --- title: Update release cycle for Windows clients -description: Learn about the release cycle of updates for Windows clients to stay productive and protected. +description: Learn about the release cycle for updates so Windows clients in your organization stay productive and protected. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 05/19/2023 --- # Update release cycle for Windows clients -***(Applies to: Windows 11 & Windows 10)*** Windows updates help you to stay productive and protected. They provide your users and IT administrators with the security fixes they need, and protect devices so that unpatched vulnerabilities can't be exploited. Updates for the Windows client OS are typically cumulative. They include all previously released fixes to guard against fragmentation of the operating system. Reliability and vulnerability issues can occur when only a subset of fixes is installed. @@ -23,11 +25,11 @@ This article provides details on the types of updates that Microsoft provides, a |Release type | Description | Release cycle | |---|---|---| -| [Monthly security update release](#monthly-security-update-release)| A cumulative update release that includes both security and non-security content | Second Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) | -| [Optional non-security preview release](#optional-non-security-preview-release)| An optional cumulative update release that's typically used for early validation of the monthly security update release| Fourth Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) | +| [Monthly security update release](#monthly-security-update-release)| A cumulative update release that includes both security and nonsecurity content | Second Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) | +| [Optional nonsecurity preview release](#optional-non-security-preview-release)| An optional cumulative update release that's typically used for early validation of the monthly security update release| Fourth Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) | | [Out-of-band (OOB) release](#oob-releases) | Resolves a recently identified issue or vulnerability | As needed | | [Annual feature update](#annual-feature-updates) | An update with new features and enhancements that also changes the Windows version | Once a year in the second half of the calendar year | -| [Continuous innovation for Windows 11](#continuous-innovation-for-windows-11)| Introduces new features and enhancements for Windows 11 | Periodically included in an optional non-security preview release then in the monthly security update releases | +| [Continuous innovation for Windows 11](#continuous-innovation-for-windows-11)| Introduces new features and enhancements for Windows 11 | Periodically included in an optional nonsecurity preview release then in the monthly security update releases | ## Monthly security update release @@ -42,7 +44,7 @@ Most people are familiar with the **monthly security update release**. The **mon - Latest cumulative update (LCU) -**Monthly security update releases** are cumulative. The release includes both new and previously released security fixes, along with non-security content introduced in the prior month's [**Optional non-security preview release**](#optional-non-security-preview-release). These updates help keep Windows devices secure and compliant by deploying stability fixes and addressing security vulnerabilities. Most organizations consider monthly security update releases as mandatory. +**Monthly security update releases** are cumulative. The release includes both new and previously released security fixes, along with nonsecurity content introduced in the prior month's [**Optional non-security preview release**](#optional-non-security-preview-release). These updates help keep Windows devices secure and compliant by deploying stability fixes and addressing security vulnerabilities. Most organizations consider monthly security update releases as mandatory. Monthly security update releases are available through the following channels: @@ -52,9 +54,9 @@ Monthly security update releases are available through the following channels: Many update management tools, such as [Microsoft Configuration Manager](/mem/configmgr/) and [Microsoft Intune](/mem/intune/), rely on these channels for update deployment. -## Optional non-security preview release +## Optional nonsecurity preview release -**Optional non-security preview releases** provide IT admins an opportunity for early validation of that content prior to the **monthly security update release**. Admins can test and validate production-quality releases ahead of the planned monthly security update release for the following month. These updates are optional, cumulative, non-security preview releases. New features might initially be deployed in the prior month's **optional non-security preview release**, then ship in the following **monthly security update release**. These releases are only offered to the most recent, supported versions of Windows. +**Optional non-security preview releases** provide IT admins an opportunity for early validation of that content prior to the **monthly security update release**. Admins can test and validate production-quality releases ahead of the planned monthly security update release for the following month. These updates are optional, cumulative, nonsecurity preview releases. New features might initially be deployed in the prior month's **optional non-security preview release**, then ship in the following **monthly security update release**. These releases are only offered to the most recent, supported versions of Windows. **Optional non-security preview releases** might commonly be referred to as: @@ -66,7 +68,7 @@ Many update management tools, such as [Microsoft Configuration Manager](/mem/con > [!Important] > Starting in April 2023, all **optional non-security preview releases** will be released on the fourth Tuesday of the month. This change in release cadence gives admins a consistent time cycle for testing and validating fixes and features. -To access the optional non-security preview release: +To access the optional nonsecurity preview release: - Navigate to **Settings** > **Update & Security** > **Windows Update** and select **Check for updates**. - Use [Windows Insider Program for Business](https://insider.windows.com/for-business) - Use the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx). @@ -78,12 +80,12 @@ To access the optional non-security preview release: Some key considerations about OOB releases include: - OOB releases are always cumulative. - - OOB releases supersede any prior monthly security update and optional non-security preview release. + - OOB releases supersede any prior monthly security update and optional nonsecurity preview release. - OOB releases generally require IT admins to deploy off-cycle. - Some OOB releases are classified as critical. - Critical OOB releases are automatically available to WSUS and Windows Update for Business, just like the monthly security update releases. -- Some OOB releases are classified as non-critical. - - Non-critical releases only go to the Microsoft Update Catalog for users or organizations to voluntarily obtain the update. +- Some OOB releases are classified as noncritical. + - Noncritical releases only go to the Microsoft Update Catalog for users or organizations to voluntarily obtain the update. ## Continuous innovation for Windows 11 From 0ce5a89a56934005786fc02e92923ae2c9f2eb40 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 10:43:13 -0700 Subject: [PATCH 067/125] metadata, formatting, and wording tweaks --- windows/deployment/update/safeguard-holds.md | 24 +++++++++----------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/windows/deployment/update/safeguard-holds.md b/windows/deployment/update/safeguard-holds.md index 6535bc2084..86232917dd 100644 --- a/windows/deployment/update/safeguard-holds.md +++ b/windows/deployment/update/safeguard-holds.md @@ -1,31 +1,29 @@ --- -title: Safeguard holds -description: What are safeguard holds, how can you tell if one is in effect, and what to do about it. +title: Safeguard holds for Windows +description: What are safeguard holds? How to can you tell if a safeguard hold is in effect, and what to do about it. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium ms.collection: - highpri - tier2 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Safeguard holds -**Applies to** - -- Windows 10 -- Windows 11 - Microsoft uses quality and compatibility data to identify issues that might cause a Windows client feature update to fail or roll back. When we find such an issue, we might apply safeguard holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use safeguard holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe effect (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround isn't immediately available. Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows client. -The safeguard holds lifespan varies depending on the time required to investigate and fix an issue. During this time, Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the safeguard hold. Once we release the safeguard hold, Windows Update will resume offering new operating system versions to devices. +The safeguard holds lifespan varies depending on the time required to investigate and fix an issue. During this time, Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the safeguard hold. Once we release the safeguard hold, Windows Update resumes offering new operating system versions to devices. Safeguard holds only affect devices that use the Windows Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services) to remain aware of known issues that might also be present in their environments. @@ -37,11 +35,11 @@ IT admins can use [Windows Update for Business reports](wufb-reports-overview.md Windows Update for Business reports identifies safeguard holds by their 8-digit identifiers. For safeguard holds associated with publicly discussed known issues, you can find more details about the issue on the [Windows release health](/windows/release-health/) dashboard by searching for the safeguard hold ID on the **Known issues** page for the relevant release. -On devices that use Windows Update (but not Windows Update for Business), the **Windows Update** page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users will see this message: +On devices that use Windows Update (but not Windows Update for Business), the **Windows Update** page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users see a message. ![Feature update message reading "The Windows 10 May 2020 Update is on its way. Once it's ready for your device, you'll see the update available on this page.](images/safeguard-hold-notification.png) -This message means that the device is protected by one or more safeguard holds. When the issue is resolved and the update is safe to install, we'll release the safeguard hold and the update can resume safely. +This message means that the device is protected by one or more safeguard holds. When the issue is resolved and the update is safe to install, we release the safeguard hold so the update can resume safely. ## What can I do? From bd48e607b7c2961a145c4de314a9c9906992be9e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 11:01:16 -0700 Subject: [PATCH 068/125] metadata, formatting, and wording tweaks --- .../deployment/update/safeguard-opt-out.md | 29 +++++++++---------- 1 file changed, 13 insertions(+), 16 deletions(-) diff --git a/windows/deployment/update/safeguard-opt-out.md b/windows/deployment/update/safeguard-opt-out.md index 96b29c913a..997aa9cab5 100644 --- a/windows/deployment/update/safeguard-opt-out.md +++ b/windows/deployment/update/safeguard-opt-out.md @@ -1,38 +1,35 @@ --- title: Opt out of safeguard holds -description: Steps to install an update even it if has a safeguard hold applied +description: How to install an update in your organization even when a safeguard hold for an known issue has been applied to it. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +ms.date: 10/21/2020 --- # Opt out of safeguard holds -**Applies to** - -- Windows 10 -- Windows 11 - Safeguard holds prevent a device with a known compatibility issue from being offered a new Windows client feature update by using Windows Update. We use safeguard holds to protect the device and user from a failed or poor update experience. We renew the offering once a fix is issued and is verified on an affected device. For more information about safeguard holds, see [Safeguard holds](safeguard-holds.md). ## How can I opt out of safeguard holds? -IT admins can, if necessary, opt devices out of safeguard protections by using the disable safeguards policy. In a Mobile Device Management (MDM) tool, use the **Update/DisableWUfBSafeguards** CSP. In Group Policy, use the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update and in Windows 11. +IT admins can, if necessary, opt devices out of safeguard protections by using the disable safeguards policy. In a Mobile Device Management (MDM) tool, use the **Update/DisableWUfBSafeguards** CSP. In Group Policy, use the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running the following operating systems: +- Windows 11 +- Windows 10, version 1809 or later with the October 2020 security update. > [!CAUTION] > Opting out of a safeguard hold can put devices at risk from known performance issues. We recommend opting out only in an IT environment and for validation purposes. You can also validate an upcoming Windows client feature update version without the safeguards being applied by using the Release Preview channel of the Windows Insider Program for Business. -Disabling safeguards does not guarantee your device will be able to successfully update. The update might still fail and will likely result in a bad experience since you are bypassing the protection against known issues. +Disabling safeguards doesn't guarantee your device will be able to successfully update. The update might still fail and will likely result in a bad experience since you're bypassing the protection against known issues. > [!NOTE] -> After a device installs a new Windows client version, the **Disable safeguards for Feature Updates** Group Policy will revert to “not configured” even if it was previously enabled. We do this to ensure the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update. - - - +> After a device installs a new Windows client version, the **Disable safeguards for Feature Updates** Group Policy will revert to **Not configured** even if it was previously enabled. We do this to ensure the admin is consciously disabling Microsoft's default protection from known issues for each new feature update. From 83abecd52f09763931007b1c07d8244d5ffd17d1 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 11:04:16 -0700 Subject: [PATCH 069/125] metadata, formatting, and wording tweaks --- windows/deployment/update/release-cycle.md | 4 ++-- windows/deployment/update/safeguard-opt-out.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md index ae7df5172a..6e7bc616ed 100644 --- a/windows/deployment/update/release-cycle.md +++ b/windows/deployment/update/release-cycle.md @@ -26,7 +26,7 @@ This article provides details on the types of updates that Microsoft provides, a |Release type | Description | Release cycle | |---|---|---| | [Monthly security update release](#monthly-security-update-release)| A cumulative update release that includes both security and nonsecurity content | Second Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) | -| [Optional nonsecurity preview release](#optional-non-security-preview-release)| An optional cumulative update release that's typically used for early validation of the monthly security update release| Fourth Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) | +| [Optional nonsecurity preview release](#optional-nonsecurity-preview-release)| An optional cumulative update release that's typically used for early validation of the monthly security update release| Fourth Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) | | [Out-of-band (OOB) release](#oob-releases) | Resolves a recently identified issue or vulnerability | As needed | | [Annual feature update](#annual-feature-updates) | An update with new features and enhancements that also changes the Windows version | Once a year in the second half of the calendar year | | [Continuous innovation for Windows 11](#continuous-innovation-for-windows-11)| Introduces new features and enhancements for Windows 11 | Periodically included in an optional nonsecurity preview release then in the monthly security update releases | @@ -44,7 +44,7 @@ Most people are familiar with the **monthly security update release**. The **mon - Latest cumulative update (LCU) -**Monthly security update releases** are cumulative. The release includes both new and previously released security fixes, along with nonsecurity content introduced in the prior month's [**Optional non-security preview release**](#optional-non-security-preview-release). These updates help keep Windows devices secure and compliant by deploying stability fixes and addressing security vulnerabilities. Most organizations consider monthly security update releases as mandatory. +**Monthly security update releases** are cumulative. The release includes both new and previously released security fixes, along with nonsecurity content introduced in the prior month's [**Optional non-security preview release**](#optional-nonsecurity-preview-release). These updates help keep Windows devices secure and compliant by deploying stability fixes and addressing security vulnerabilities. Most organizations consider monthly security update releases as mandatory. Monthly security update releases are available through the following channels: diff --git a/windows/deployment/update/safeguard-opt-out.md b/windows/deployment/update/safeguard-opt-out.md index 997aa9cab5..30227f3553 100644 --- a/windows/deployment/update/safeguard-opt-out.md +++ b/windows/deployment/update/safeguard-opt-out.md @@ -1,6 +1,6 @@ --- title: Opt out of safeguard holds -description: How to install an update in your organization even when a safeguard hold for an known issue has been applied to it. +description: How to install an update in your organization even when a safeguard hold for a known issue has been applied to it. ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -22,7 +22,7 @@ Safeguard holds prevent a device with a known compatibility issue from being off IT admins can, if necessary, opt devices out of safeguard protections by using the disable safeguards policy. In a Mobile Device Management (MDM) tool, use the **Update/DisableWUfBSafeguards** CSP. In Group Policy, use the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running the following operating systems: - Windows 11 -- Windows 10, version 1809 or later with the October 2020 security update. +- Windows 10, version 1809, or later, with the October 2020 security update. > [!CAUTION] > Opting out of a safeguard hold can put devices at risk from known performance issues. From 98c96272b09147cb2d5c7314fcaacced94fb2ff3 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 11:20:32 -0700 Subject: [PATCH 070/125] metadata, formatting, and wording tweaks --- windows/deployment/update/release-cycle.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md index 6e7bc616ed..bb6949ca8e 100644 --- a/windows/deployment/update/release-cycle.md +++ b/windows/deployment/update/release-cycle.md @@ -44,7 +44,7 @@ Most people are familiar with the **monthly security update release**. The **mon - Latest cumulative update (LCU) -**Monthly security update releases** are cumulative. The release includes both new and previously released security fixes, along with nonsecurity content introduced in the prior month's [**Optional non-security preview release**](#optional-nonsecurity-preview-release). These updates help keep Windows devices secure and compliant by deploying stability fixes and addressing security vulnerabilities. Most organizations consider monthly security update releases as mandatory. +**Monthly security update releases** are cumulative. The release includes both new and previously released security fixes, along with nonsecurity content introduced in the prior month's [**Optional nonsecurity preview release**](#optional-nonsecurity-preview-release). These updates help keep Windows devices secure and compliant by deploying stability fixes and addressing security vulnerabilities. Most organizations consider monthly security update releases as mandatory. Monthly security update releases are available through the following channels: @@ -56,9 +56,9 @@ Many update management tools, such as [Microsoft Configuration Manager](/mem/con ## Optional nonsecurity preview release -**Optional non-security preview releases** provide IT admins an opportunity for early validation of that content prior to the **monthly security update release**. Admins can test and validate production-quality releases ahead of the planned monthly security update release for the following month. These updates are optional, cumulative, nonsecurity preview releases. New features might initially be deployed in the prior month's **optional non-security preview release**, then ship in the following **monthly security update release**. These releases are only offered to the most recent, supported versions of Windows. +**Optional nonsecurity preview releases** provide IT admins an opportunity for early validation of that content prior to the **monthly security update release**. Admins can test and validate production-quality releases ahead of the planned monthly security update release for the following month. These updates are optional, cumulative, nonsecurity preview releases. New features might initially be deployed in the prior month's **optional nonsecurity preview release**, then ship in the following **monthly security update release**. These releases are only offered to the most recent, supported versions of Windows. -**Optional non-security preview releases** might commonly be referred to as: +**Optional nonsecurity preview releases** might commonly be referred to as: - C or D week releases (meaning the third or fourth week of the month) - Preview updates @@ -66,7 +66,7 @@ Many update management tools, such as [Microsoft Configuration Manager](/mem/con - LCU preview > [!Important] -> Starting in April 2023, all **optional non-security preview releases** will be released on the fourth Tuesday of the month. This change in release cadence gives admins a consistent time cycle for testing and validating fixes and features. +> Starting in April 2023, all **optional nonsecurity preview releases** will be released on the fourth Tuesday of the month. This change in release cadence gives admins a consistent time cycle for testing and validating fixes and features. To access the optional nonsecurity preview release: - Navigate to **Settings** > **Update & Security** > **Windows Update** and select **Check for updates**. @@ -89,7 +89,7 @@ Some key considerations about OOB releases include: ## Continuous innovation for Windows 11 -Starting with Windows 11, version 22H2, new features and enhancements are introduced periodically to provide continuous innovation for Windows 11. These features and enhancements use the normal update servicing channels you're already familiar with. At first, new features are introduced with an **optional non-security preview release** and gradually rolled out to unmanaged clients. These new features are released later as part of a **monthly security update release**. +Starting with Windows 11, version 22H2, new features and enhancements are introduced periodically to provide continuous innovation for Windows 11. These features and enhancements use the normal update servicing channels you're already familiar with. At first, new features are introduced with an **optional nonsecurity preview release** and gradually rolled out to unmanaged clients. These new features are released later as part of a **monthly security update release**. Some of the new features may be disruptive to organizations. By default, these select features are turned off temporarily for all managed devices until the next annual feature update is installed. In this scenario, a device is considered managed if it uses one of the following to determine which updates to install: From a4cd77de4753e7ce208a7beaf6c8870afe8843b2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 14:20:00 -0700 Subject: [PATCH 071/125] metadata, formatting, and wording tweaks --- .../update/servicing-stack-updates.md | 29 ++++++++----------- windows/deployment/update/update-baseline.md | 20 ++++++------- 2 files changed, 22 insertions(+), 27 deletions(-) diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 30228a83de..fd0efc4571 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -2,29 +2,26 @@ title: Servicing stack updates description: In this article, learn how servicing stack updates improve the code that installs the other updates. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: high ms.author: mstewart manager: aaroncz ms.collection: - highpri - tier2 -ms.topic: conceptual -ms.technology: itpro-updates +ms.localizationpriority: high +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server ms.date: 12/31/2017 --- # Servicing stack updates - -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server - ## What is a servicing stack update? -Servicing stack updates provide fixes to the servicing stack, the component that installs Windows updates. Additionally, it contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. +Servicing stack updates provide fixes to the servicing stack, the component that installs Windows updates. Additionally, it contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically doesn't have updates released every month. ## Why should servicing stack updates be installed and kept up to date? @@ -34,8 +31,6 @@ Servicing stack updates improve the reliability of the update process to mitigat Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical." ->[!NOTE] ->You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001). ## What's the difference between a servicing stack update and a cumulative update? @@ -49,18 +44,18 @@ Microsoft publishes all cumulative updates and SSUs for Windows 10, version 2004 Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update. -Typically, the improvements are reliability and performance improvements that do not require any specific special guidance. If there is any significant impact, it will be present in the release notes. +Typically, the improvements are reliability and performance improvements that don't require any specific special guidance. If there's any significant impact, it will be present in the release notes. ## Installation notes * Servicing stack updates contain the full servicing stack; as a result, typically administrators only need to install the latest servicing stack update for the operating system. -* Installing servicing stack update does not require restarting the device, so installation should not be disruptive. +* Installing servicing stack update doesn't require restarting the device, so installation shouldn't be disruptive. * Servicing stack update releases are specific to the operating system version (build number), much like quality updates. * Servicing stack updates can be delivered with Windows Update, or you can perform a search to install the latest available at [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). -* Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine. +* Once a servicing stack update is installed, it can't be removed or uninstalled from the machine. ## Simplifying on-premises deployment of servicing stack updates -With the Windows Update experience, servicing stack updates and cumulative updates are deployed together to the device. The update stack automatically orchestrates the installation, so both are applied correctly. Starting in February 2021, the cumulative update will include the latest servicing stack updates, to provide a single cumulative update payload to both Windows Server Update Services (WSUS) and Microsoft Catalog. If you use an endpoint management tool backed by WSUS, such as Configuration Manager, you will only have to select and deploy the monthly cumulative update. The latest servicing stack updates will automatically be applied correctly. Release notes and file information for cumulative updates, including those related to the servicing stack, will be in a single KB article. The combined monthly cumulative update will be available on Windows 10, version 2004 and later starting with the 2021 2C release, KB4601382. +With the Windows Update experience, servicing stack updates and cumulative updates are deployed together to the device. The update stack automatically orchestrates the installation, so both are applied correctly. Starting in February 2021, the cumulative update includes the latest servicing stack updates, to provide a single cumulative update payload to both Windows Server Update Services (WSUS) and Microsoft Catalog. If you use an endpoint management tool backed by WSUS, such as Configuration Manager, you'll only have to select and deploy the monthly cumulative update. The latest servicing stack updates will automatically be applied correctly. Release notes and file information for cumulative updates, including those related to the servicing stack, will be in a single KB article. The combined monthly cumulative update is available on Windows 10, version 2004 and later starting with the 2021 2C release, KB4601382. diff --git a/windows/deployment/update/update-baseline.md b/windows/deployment/update/update-baseline.md index 9173c21e30..b534f09c0c 100644 --- a/windows/deployment/update/update-baseline.md +++ b/windows/deployment/update/update-baseline.md @@ -1,35 +1,35 @@ --- -title: Update Baseline -description: Use an update baseline to optimize user experience and meet monthly update goals +title: Windows 10 Update Baseline +description: Use an update baseline to optimize user experience and meet monthly update goals in your organization. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 10 ms.date: 12/31/2017 --- # Update Baseline -**Applies to:** Windows 10 - > [!NOTE] -> Update Baseline is not currently available for Windows 11. +> Update Baseline isn't currently available for Windows 11. With the large number of different policies offered for Windows client, Update Baseline provides a clear list of recommended Windows Update policy settings for IT administrators who want the best user experience while also meeting their monthly update compliance goals. See [Policies included in the Update Baseline](#policies-included-in-the-update-baseline) for the full list of policy configurations. ## Why is Update Baseline needed? -Update Baseline is an industry-tested solution that improves update adoption rates while also maintaining a high-quality user experience. Whether you are just starting out, or you have been configuring policies for years, Update Baseline can help get you to a known good state with an excellent user experience. Applying the baseline is especially helpful for organizations that have many years of policy configurations to clear out lingering misconfigurations. +Update Baseline is an industry-tested solution that improves update adoption rates while also maintaining a high-quality user experience. Whether you're just starting out, or you have been configuring policies for years, Update Baseline can help get you to a known good state with an excellent user experience. Applying the baseline is especially helpful for organizations that have many years of policy configurations to clear out lingering misconfigurations. ## You can use Update Baseline to: - Ensure that user and device configuration settings are compliant with the baseline. - Set configuration settings. You can use Group Policy to configure a device with the setting values specified in the baseline. -Update Baseline doesn't affect your offering policies, whether you’re using deferrals or target version to manage which updates are offered to your devices and when. +Update Baseline doesn't affect your offering policies, whether you're using deferrals or target version to manage which updates are offered to your devices and when. ## Policies included in the Update Baseline From d36b6905e2f31028f93a91db58e5a9fe381c1ddd Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 14:43:01 -0700 Subject: [PATCH 072/125] metadata, formatting, and wording tweaks --- windows/deployment/update/update-policies.md | 75 +++++++++---------- windows/deployment/update/waas-branchcache.md | 27 +++---- .../deployment/update/waas-integrate-wufb.md | 33 ++++---- 3 files changed, 62 insertions(+), 73 deletions(-) diff --git a/windows/deployment/update/update-policies.md b/windows/deployment/update/update-policies.md index d4302cecac..b7fa2d5094 100644 --- a/windows/deployment/update/update-policies.md +++ b/windows/deployment/update/update-policies.md @@ -1,23 +1,21 @@ --- -title: Policies for update compliance, activity, and user experience -description: Explanation and recommendations for settings +title: Policies for update compliance and user experience +description: Explanation and recommendations for update compliance, activity, and user experience for your organization. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: medium -ms.topic: article -ms.technology: itpro-updates +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Policies for update compliance, activity, and user experience -**Applies to** - -- Windows 10 -- Windows 11 - Keeping devices up to date is the best way to keep them working smoothly and securely. ## Deadlines for update compliance @@ -30,7 +28,7 @@ deadline approaches, and then prioritize velocity as the deadline nears, while s Beginning with Windows 10, version 1903 and with the August 2019 security update for Windows 10, version 1709 and later (including Windows 11), a new policy was introduced to replace older deadline-like policies: **Specify deadlines for automatic updates and restarts**. -The older policies started enforcing deadlines once the device reached a “restart pending” state for +The older policies started enforcing deadlines once the device reached a `restart pending` state for an update. The new policy starts the countdown for the update installation deadline from when the update is published plus any deferral. In addition, this policy includes a configurable grace period and the option to opt out of automatic restarts until the deadline is reached (although we recommend always allowing automatic @@ -42,7 +40,7 @@ We recommend you set deadlines as follows: Notifications are automatically presented to the user at appropriate times, and users can choose to be reminded later, to reschedule, or to restart immediately, depending on how close the deadline is. We recommend that you -do **not** set any notification policies, because they are automatically configured with appropriate defaults. An exception is if you +do **not** set any notification policies, because they're automatically configured with appropriate defaults. An exception is if you have kiosks or digital signage. While three days for quality updates and seven days for feature updates is our recommendation, you might decide @@ -57,7 +55,7 @@ to a minimum of two days. ### Grace periods You can set a period of days for Windows to find a minimally disruptive automatic restart time before the restart is enforced. This -is especially useful in cases where a user has been away for many days (for example, on vacation) so that the device will not +is especially useful in cases where a user has been away for many days (for example, on vacation) so that the device won't be forced to update immediately when the user returns. We recommend you set the following: @@ -79,15 +77,15 @@ automatic restart. To take advantage of this feature, ensure **ConfigureDeadline Windows typically requires that a device is active and connected to the internet for at least six hours, with at least two of continuous activity, in order to successfully complete a system update. The device could have other physical circumstances that prevent successful installation of an update--for example, if a laptop is running low -on battery power, or the user has shut down the device before active hours end and the device cannot comply +on battery power, or the user has shut down the device before active hours end and the device can't comply with the deadline. -You can use the settings in this section to ensure that devices are actually available to install updates during the update compliance period. +You can use the settings in this section to ensure that devices are available to install updates during the update compliance period. ### Active hours -"Active hours" identify the period of time when a device is expected to be in use. Normally, restarts will occur outside of -these hours. Windows 10, version 1903 introduced "intelligent active hours," which allow the system to learn active hours based on a user’s activities, rather than you as an administrator having to make decisions for your organization or allowing the user to choose active hours that minimize the period when the system can install an update. +"Active hours" identify the period of time when a device is expected to be in use. Normally, restarts occur outside of +these hours. Windows 10, version 1903 introduced "intelligent active hours," which allow the system to learn active hours based on a user's activities, rather than you as an administrator having to make decisions for your organization or allowing the user to choose active hours that minimize the period when the system can install an update. > [!IMPORTANT] > If you used the **Configure Active Hours** setting in previous versions of Windows 10, these @@ -96,14 +94,12 @@ options must be **Disabled** in order to take advantage of intelligent active ho If you do set active hours, we recommend setting the following policies to **Disabled** in order to increase update velocity: -- [Delay automatic reboot](waas-restart.md#delay-automatic-reboot). While it’s possible to set the system to delay restarts for users who are logged -in, this might delay an update indefinitely if a user is always either logged in or shut down. Instead, we -recommend setting the following polices to **Disabled**: +- [Delay automatic reboot](waas-restart.md#delay-automatic-reboot). While it's possible to set the system to delay restarts for users who are logged in, this setting might delay an update indefinitely if a user is always either logged in or shut down. Instead, we recommend setting the following polices to **Disabled**: - **Turn off auto-restart during active hours** - **No auto-restart with logged on users for scheduled automatic updates** - - [Limit restart delays](waas-restart.md#limit-restart-delays). By using compliance deadlines, your users will receive notifications that -updates will occur, so we recommend that you set this policy to **Disabled**, to allow compliance deadlines to eliminate the user’s ability to delay a restart outside of compliance deadline settings. + - [Limit restart delays](waas-restart.md#limit-restart-delays). By using compliance deadlines, your users receive notifications that +updates will occur, so we recommend that you set this policy to **Disabled**, to allow compliance deadlines to eliminate the user's ability to delay a restart outside of compliance deadline settings. - **Do not allow users to approve updates and reboots**. Letting users approve or engage with the update process outside of the deadline policies decreases update velocity and increases risk. These policies should be set to **Disabled**: - [Update/RequireUpdateApproval](/windows/client-management/mdm/policy-csp-update#update-requireupdateapproval) @@ -113,8 +109,8 @@ updates will occur, so we recommend that you set this policy to **Disabled**, to - [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-engagedrestartsnoozescheduleforfeatureupdates) - [Update/EngagedRestartTransitionSchedule](/windows/client-management/mdm/policy-csp-update#update-engagedrestarttransitionschedule) -- [Configure automatic update](waas-wu-settings.md#configure-automatic-updates). By properly setting policies to configure automatic updates, you can increase update velocity by having clients contact a Windows Server Update Services (WSUS) server so it can manage them. We recommend that you set this policy to **Disabled**. However, if you need to provide values, ensure that you set downloads to install automatically by setting the [Group Policy](waas-manage-updates-wsus.md#configure-automatic-updates-and-update-service-location) to **4**. If you’re using Microsoft Intune, setting the value to [Reset to Default](/mem/intune/protect/windows-update-settings#user-experience-settings). -- **Allow auto Windows Update to download over metered networks**. Since more and more devices primarily use cellular data and do not have wi-fi access, consider allowing users to automatically download updates from a metered network. Though the default setting does not allow download over a metered network, setting this value to **1** can increase velocity by enabling users to get updates whether they are connected to the internet or not, provided they have cellular service. +- [Configure automatic update](waas-wu-settings.md#configure-automatic-updates). By properly setting policies to configure automatic updates, you can increase update velocity by having clients contact a Windows Server Update Services (WSUS) server so it can manage them. We recommend that you set this policy to **Disabled**. However, if you need to provide values, ensure that you set downloads to install automatically by setting the [Group Policy](waas-manage-updates-wsus.md#configure-automatic-updates-and-update-service-location) to **4**. If you're using Microsoft Intune, setting the value to [Reset to Default](/mem/intune/protect/windows-update-settings#user-experience-settings). +- **Allow auto Windows Update to download over metered networks**. Since more devices primarily use cellular data and don't have wi-fi access, consider allowing users to automatically download updates from a metered network. Though the default setting doesn't allow download over a metered network, setting this value to **1** can increase velocity by enabling users to get updates whether they're connected to the internet or not, provided they have cellular service. > [!IMPORTANT] > Older versions of Windows don't support intelligent active hours. If your device runs a version of Windows prior to Windows 10, version 1903, we recommend setting the following policies: @@ -127,11 +123,11 @@ recommend setting this value to **3** (corresponding to 3 AM). If 3:00 AM is in ### Power policies -Devices must actually be available during non-active hours in order to an update. They can't do this if power policies prevent them from waking up. In our organization, we strive to set a balance between security and eco-friendly configurations. We recommend the following settings to achieve what we feel are the appropriate tradeoffs: +Devices must actually be available during nonactive hours in order to an update. They can't do this if power policies prevent them from waking up. In our organization, we strive to set a balance between security and eco-friendly configurations. We recommend the following settings to achieve what we feel are the appropriate tradeoffs: -To a user, a device is either on or off, but for Windows, there are states that will allow an update to occur (active) and states that do not (inactive). Some states are considered active (sleep), but the user may think the device is off. Also, there are power statuses (plugged in/battery) that Windows checks before starting an update. +To a user, a device is either on or off, but for Windows, there are states that allow an update to occur (active) and states that don't (inactive). Some states are considered active (sleep), but the user may think the device is off. Also, there are power statuses (plugged in/battery) that Windows checks before starting an update. -You can override the default settings and prevent users from changing them in order to ensure that devices are available for updates during non-active hours. +You can override the default settings and prevent users from changing them in order to ensure that devices are available for updates during nonactive hours. > [!NOTE] > One way to ensure that devices can install updates when you need them to is to educate your users to keep devices plugged in during non-active hours. Even with the best policies, a device that isn't plugged in will not be updated, even in sleep mode. @@ -139,13 +135,12 @@ You can override the default settings and prevent users from changing them in or We recommend these power management settings: - Sleep mode (S1 or S0 Low Power Idle or [Modern Standby](/windows-hardware/design/device-experiences/modern-standby)). When a device is in sleep mode, the system -appears to be off but if an update is available, it can wake the device up in order to take an update. The +appears to be off but if an update is available, it can wake up the device in order to take an update. The power consumption in sleep mode is between working (system fully usable) and hibernate (S4 - lowest -power level before shutdown). When a device is not being used, the system will generally move to sleep +power level before shutdown). When a device isn't being used, the system will generally move to sleep mode before it goes to hibernate. Issues in velocity arise when the time between sleep and hibernate is -too short and Windows does not have time to complete an update. Sleep mode is an important setting -because the system can wake the system from sleep in order to start the update process, as long as there -is enough power. +too short and Windows doesn't have time to complete an update. Sleep mode is an important setting +because the system can wake the system from sleep in order to start the update process, as long as there's enough power. Set the following policies to **Enable** or **Do Not Configure** in order to allow the device to use sleep mode: - [Power/AllowStandbyStatesWhenSleepingOnBattery](/windows/client-management/mdm/policy-csp-power#power-allowstandbystateswhensleepingonbattery) @@ -156,15 +151,15 @@ sleep mode and the device has an opportunity to take an update: - [Power/SelectLidCloseActionOnBattery](/windows/client-management/mdm/policy-csp-power#power-selectlidcloseactiononbattery) - [Power/SelectLidCloseActionPluggedIn](/windows/client-management/mdm/policy-csp-power#power-selectlidcloseactionpluggedin) -- **Hibernate**. When a device is hibernating, power consumption is very low and the system cannot wake up -without user intervention, like pressing the power button. If a device is in this state, it cannot be updated +- **Hibernate**. When a device is hibernating, power consumption is low and the system can't wake up +without user intervention, like pressing the power button. If a device is in this state, it can't be updated unless it supports an ACPI Time and Alarm Device (TAD). That said, if a device supporting Traditional Sleep -(S3) is plugged in, and a Windows update is available, a hibernate state will be delayed until the update is complete. +(S3) is plugged in, and a Windows update is available, a hibernate state is delayed until the update is complete. > [!NOTE] > This does not apply to devices that support Modern Standby (S0 Low Power Idle). You can check which system sleep state (S3 or S0 Low Power Idle) a device supports by running `powercfg /a` at a command prompt. For more, see [Powercfg options](/windows-hardware/design/device-experiences/powercfg-command-line-options#option_availablesleepstates). -The default timeout on devices that support traditional sleep is set to three hours. We recommend that you do not reduce these policies in order to allow Windows Update the opportunity to restart the device before sending it into hibernation: +The default timeout on devices that support traditional sleep is set to three hours. We recommend that you don't reduce these policies in order to allow Windows Update the opportunity to restart the device before sending it into hibernation: - [Power/HibernateTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#power-hibernatetimeoutonbattery) - [Power/HibernateTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#power-hibernatetimeoutpluggedin) @@ -177,7 +172,7 @@ Each release of Windows client can introduce new policies to make the experience > If you are using Group Policy, note that we don't update the old ADMX templates and you must use the newer (1903) ADMX template in order to use the newer policy. Also, if you are > using an MDM tool (Microsoft or non-Microsoft), you can't use the new policy until it's available in the tool interface. -As administrators, you have set up and expect certain behaviors, so we expressly do not remove older policies since they were set up for your particular use cases. However, if you set a new policy without disabling a similar older policy, you could have conflicting behavior and updates might not perform as expected. +As administrators, you have set up and expect certain behaviors, so we expressly don't remove older policies since they were set up for your particular use cases. However, if you set a new policy without disabling a similar older policy, you could have conflicting behavior and updates might not perform as expected. > [!IMPORTANT] > We sometimes find that administrators set devices to get both Group Policy settings and MDM settings from an MDM server such as Microsoft Intune. Policy conflicts are handled differently, depending on how they are ultimately set up: @@ -192,11 +187,11 @@ As administrators, you have set up and expect certain behaviors, so we expressly The following are policies that you might want to disable because they could decrease update velocity or there are better policies to use that might conflict: - **Defer Feature Updates Period in Days**. For maximum update velocity, it's best to set this to **0** (no -deferral) so that the feature update can complete and monthly security updates will be offered again. Even if there is an urgent quality update that must be quickly deployed, it is best to use **Pause Feature +deferral) so that the feature update can complete and monthly security updates are offered again. Even if there's an urgent quality update that must be quickly deployed, it's best to use **Pause Feature Updates** rather than setting a deferral policy. You can choose a longer period if you don't want to stay up to date with the latest feature update. - **Defer Quality Updates Period in Days**. To minimize risk and maximize update velocity, the maximum time you might want to consider while evaluating the update with a different ring of devices is two to three days. - **Pause Feature Updates Start Time**. Set to **Disabled** unless there is a known issue requiring time for a resolution. -- **Pause Quality Updates Start Time**. Set to **Disabled** unless there is a known issue requiring time for a resolution. -- **Deadline No Auto Reboot**. Default is **Disabled – Set to 0** . We recommend that devices automatically try to restart when an update is received. Windows uses user interactions to dynamically identify the least disruptive time to restart. +- **Pause Quality Updates Start Time**. Set to **Disabled** unless there's a known issue requiring time for a resolution. +- **Deadline No Auto Reboot**. Default is **Disabled - Set to 0** . We recommend that devices automatically try to restart when an update is received. Windows uses user interactions to dynamically identify the least disruptive time to restart. -There are additional policies are no longer supported or have been superseded. +There are also additional policies are no longer supported or have been superseded. diff --git a/windows/deployment/update/waas-branchcache.md b/windows/deployment/update/waas-branchcache.md index 1329d93a6b..840ea3d5a7 100644 --- a/windows/deployment/update/waas-branchcache.md +++ b/windows/deployment/update/waas-branchcache.md @@ -2,31 +2,28 @@ title: Configure BranchCache for Windows client updates description: In this article, learn how to use BranchCache to optimize network bandwidth during update deployment. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Configure BranchCache for Windows client updates - -**Applies to** - -- Windows 10 -- Windows 11 - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and Microsoft Configuration Manager can use BranchCache to optimize network bandwidth during update deployment, and it's easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode. - Distributed Cache mode operates like the [Delivery Optimization](../do/waas-delivery-optimization.md) feature in Windows client: each client contains a cached version of the BranchCache-enabled files it requests and acts as a distributed cache for other clients requesting that same file. - >[!TIP] - >Distributed Cache mode is preferred to Hosted Cache mode for Windows clients updates to get the most benefit from peer-to-peer distribution. + > [!TIP] + > Distributed Cache mode is preferred to Hosted Cache mode for Windows clients updates to get the most benefit from peer-to-peer distribution. - In Hosted Cache mode, designated servers at specific locations act as a cache for files requested by clients in its area. Then, rather than clients retrieving files from a latent source, the hosted cache server provides the content on its behalf. @@ -36,7 +33,7 @@ For detailed information about how Distributed Cache mode and Hosted Cache mode Whether you use BranchCache with Configuration Manager or WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see [Client Configuration](/previous-versions/windows/it-pro/windows-7/dd637820(v=ws.10)) in the [BranchCache Early Adopter's Guide](/previous-versions/windows/it-pro/windows-7/dd637762(v=ws.10)). -In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows client, simply set the Delivery Optimization mode to Bypass to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. +In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows client, set the Delivery Optimization mode to Bypass to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. ## Configure servers for BranchCache @@ -44,8 +41,8 @@ You can use WSUS and Configuration Manager with BranchCache in Distributed Cache For a step-by-step guide to configuring BranchCache on Windows Server devices, see the [BranchCache Deployment Guide (Windows Server 2012)](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj572990(v=ws.11)) or [BranchCache Deployment Guide (Windows Server 2016)](/windows-server/networking/branchcache/deploy/branchcache-deployment-guide). -In addition to these steps, there is one requirement for WSUS to be able to use BranchCache in either operating mode: the WSUS server must be configured to download updates locally on the server to a shared folder. This way, you can select BranchCache publication for the share. For Configuration Manager, you can enable BranchCache on distribution points; no other server-side configuration is necessary for Distributed Cache mode. +In addition to these steps, there's one requirement for WSUS to be able to use BranchCache in either operating mode: the WSUS server must be configured to download updates locally on the server to a shared folder. This way, you can select BranchCache publication for the share. For Configuration Manager, you can enable BranchCache on distribution points; no other server-side configuration is necessary for Distributed Cache mode. ->[!NOTE] ->Configuration Manager only supports Distributed Cache mode. +> [!NOTE] +> Configuration Manager only supports Distributed Cache mode. diff --git a/windows/deployment/update/waas-integrate-wufb.md b/windows/deployment/update/waas-integrate-wufb.md index 007f114627..d94af9011d 100644 --- a/windows/deployment/update/waas-integrate-wufb.md +++ b/windows/deployment/update/waas-integrate-wufb.md @@ -2,23 +2,20 @@ title: Integrate Windows Update for Business description: Use Windows Update for Business deployments with management tools such as Windows Server Update Services (WSUS) and Microsoft Configuration Manager. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Integrate Windows Update for Business with management solutions - -**Applies to** - -- Windows 10 -- Windows 11 - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS) and Microsoft Configuration Manager. @@ -28,8 +25,8 @@ You can integrate Windows Update for Business deployments with existing manageme For Windows 10, version 1607 and later, devices can be configured to receive updates from both Windows Update (or Microsoft Update) and Windows Server Update Services (WSUS). In a joint WSUS and Windows Update for Business setup: -- Devices will receive their Windows content from Microsoft and defer these updates according to Windows Update for Business policy -- All other content synced from WSUS will be directly applied to the device; that is, updates to products other than Windows will not follow your Windows Update for Business deferral policies +- Devices receive their Windows content from Microsoft and defer these updates according to Windows Update for Business policy +- All other content synced from WSUS will be directly applied to the device; that is, updates to products other than Windows won't follow your Windows Update for Business deferral policies ### Configuration example \#1: Deferring Windows Update updates with other update content hosted on WSUS @@ -37,9 +34,9 @@ For Windows 10, version 1607 and later, devices can be configured to receive upd - Device is configured to defer Windows quality updates using Windows Update for Business - Device is also configured to be managed by WSUS -- Device is not configured to enable Microsoft Update (**Update/AllowMUUpdateService** = not enabled) +- Device isn't configured to enable Microsoft Update (**Update/AllowMUUpdateService** = not enabled) - Admin has opted to put updates to Office and other products on WSUS -- Admin has also put 3rd party drivers on WSUS +- Admin has also put third-party drivers on WSUS |Content|Metadata source|Payload source|Deferred?| |--- |--- |--- |--- | @@ -70,12 +67,12 @@ For Windows 10, version 1607 and later, devices can be configured to receive upd **Configuration:** - Device is configured to defer quality updates using Windows Update for Business and to be managed by WSUS -- Device is configured to “receive updates for other Microsoft products” along with updates to Windows (**Update/AllowMUUpdateService** = enabled) +- Device is configured to **receive updates for other Microsoft products** along with updates to Windows (**Update/AllowMUUpdateService** = enabled) - Admin has also placed Microsoft Update, non-Microsoft, and locally published update content on the WSUS server -In this example, the deferral behavior for updates to Office and other non-Windows products is slightly different than if WSUS were not enabled. +In this example, the deferral behavior for updates to Office and other non-Windows products is slightly different than if WSUS weren't enabled. - In a non-WSUS case, these updates would be deferred just as any update to Windows would be. -- However, with WSUS also configured, these updates are sourced from Microsoft but deferral policies are not applied. +- However, with WSUS also configured, these updates are sourced from Microsoft but deferral policies aren't applied. |Content|Metadata source|Payload source|Deferred?| |--- |--- |--- |--- | @@ -90,9 +87,9 @@ In this example, the deferral behavior for updates to Office and other non-Windo ## Integrate Windows Update for Business with Microsoft Configuration Manager -For Windows 10, version 1607, organizations already managing their systems with a Configuration Manager solution can also have their devices configured for Windows Update for Business (that is, setting deferral policies on those devices). Such devices will be visible in the Configuration Manager console, however they will appear with a detection state of **Unknown**. +For Windows 10, version 1607, organizations already managing their systems with a Configuration Manager solution can also have their devices configured for Windows Update for Business (that is, setting deferral policies on those devices). Such devices are visible in the Configuration Manager console, however they appear with a detection state of **Unknown**. :::image type="content" alt-text="Example of unknown devices." source="images/wufb-sccm.png" lightbox="images/wufb-sccm.png"::: -For more information, see [Integration with Windows Update for Business in Windows 10](/sccm/sum/deploy-use/integrate-windows-update-for-business-windows-10). +For more information, see [Integration with Windows Update for Business in Windows 10](/mem/configmgr/sum/deploy-use/integrate-windows-update-for-business-windows-10). From cd2af881cbbc840d53f29c0f803b5b86d4cf0011 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 15:15:52 -0700 Subject: [PATCH 073/125] metadata, formatting, and wording tweaks --- .../update/waas-manage-updates-wsus.md | 123 ++++++++---------- 1 file changed, 54 insertions(+), 69 deletions(-) diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index 93ab10c8bc..b1aee2ba14 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -1,33 +1,31 @@ --- -title: Deploy Windows client updates using Windows Server Update Services +title: Deploy updates using Windows Server Update Services description: WSUS allows companies to defer, selectively approve, choose when delivered, and determine which devices receive updates. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: how-to ms.collection: - highpri - tier2 -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ WSUS ms.date: 12/31/2017 --- # Deploy Windows client updates using Windows Server Update Services (WSUS) - -**Applies to** - -- Windows 10 -- Windows 11 - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that Microsoft Configuration Manager provides. +WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they're delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but doesn't provide all the scheduling options and deployment flexibility that Microsoft Configuration Manager provides. -When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining enterprise update management. If you’re currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 11. +When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining enterprise update management. If you're currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 11. @@ -46,7 +44,7 @@ To be able to use WSUS to manage and deploy Windows feature updates, you must us ## WSUS scalability -To use WSUS to manage all Windows updates, some organizations may need access to WSUS from a perimeter network, or they might have some other complex scenario. WSUS is highly scalable and configurable for organizations of any size or site layout. For specific information about scaling WSUS, including upstream and downstream server configuration, branch offices, WSUS load balancing, and other complex scenarios, see [Choose a Type of WSUS Deployment](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc720448(v=ws.10)). +To use WSUS to manage all Windows updates, some organizations may need access to WSUS from a perimeter network, or they might have some other complex scenario. WSUS is highly scalable and configurable for organizations of any size or site layout. For specific information about scaling WSUS, including upstream and downstream server configuration, branch offices, WSUS load balancing, and other complex scenarios, see [Deploy Windows Server Update Services](/windows-server/administration/windows-server-update-services/deploy/deploy-windows-server-update-services). @@ -68,19 +66,19 @@ When using WSUS to manage updates on Windows client devices, start by configurin >[!NOTE] >In this example, the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings are specified for the entire domain. This is not a requirement; you can target these settings to any security group by using Security Filtering or a specific OU. -4. In the **New GPO** dialog box, name the new GPO **WSUS – Auto Updates and Intranet Update Service Location**. +4. In the **New GPO** dialog box, name the new GPO **WSUS - Auto Updates and Intranet Update Service Location**. -5. Right-click the **WSUS – Auto Updates and Intranet Update Service Location** GPO, and then click **Edit**. +5. Right-click the **WSUS - Auto Updates and Intranet Update Service Location** GPO, and then select **Edit**. 6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. -7. Right-click the **Configure Automatic Updates** setting, and then click **Edit**. +7. Right-click the **Configure Automatic Updates** setting, and then select **Edit**. ![Configure Automatic Updates in the UI.](images/waas-wsus-fig4.png) 8. In the **Configure Automatic Updates** dialog box, select **Enable**. -9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**. +9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then select **OK**. ![Select Auto download and notify for install in the UI.](images/waas-wsus-fig5.png) @@ -88,7 +86,7 @@ When using WSUS to manage updates on Windows client devices, start by configurin > Use Regedit.exe to check that the following key is not enabled, because it can break Windows Store connectivity: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations > [!NOTE] - > There are three other settings for automatic update download and installation dates and times. This is simply the option this example uses. For more examples of how to control automatic updates and other related policies, see [Configure Automatic Updates by Using Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc720539(v=ws.10)). + > There are three other settings for automatic update download and installation dates and times. This is simply the option this example uses. For more examples of how to control automatic updates and other related policies, see [Configure Automatic Updates by Using Group Policy](/windows-server/administration/windows-server-update-services/deploy/4-configure-group-policy-settings-for-automatic-updates). 10. Right-click the **Specify intranet Microsoft update service location** setting, and then select **Edit**. @@ -117,13 +115,13 @@ You can use computer groups to target a subset of devices that have specific qua 1. Open the WSUS Administration Console. -2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**. +2. Go to *Server_Name*\Computers\All Computers, and then select **Add Computer Group**. ![Add Computer Group in the WSUS Administration UI.](images/waas-wsus-fig7.png) -3. Type **Ring 2 Pilot Business Users** for the name, and then click **Add**. +3. Type **Ring 2 Pilot Business Users** for the name, and then select **Add**. -4. Repeat these steps for the **Ring 3 Broad IT** and **Ring 4 Broad Business Users** groups. When you’re finished, there should be three deployment ring groups. +4. Repeat these steps for the **Ring 3 Broad IT** and **Ring 4 Broad Business Users** groups. When you're finished, there should be three deployment ring groups. Now that the groups have been created, add the computers to the computer groups that align with the desired deployment rings. You can do this through [Group Policy](#wsus-gp) or manually by using the [WSUS Administration Console](#wsus-admin). @@ -143,15 +141,15 @@ When new computers communicate with WSUS, they appear in the **Unassigned Comput 1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers\Unassigned Computers. - Here, you see the new computers that have received the GPO you created in the previous section and started communicating with WSUS. This example has only two computers; depending on how broadly you deployed your policy, you will likely have many computers here. + Here, you see the new computers that have received the GPO you created in the previous section and started communicating with WSUS. This example has only two computers; depending on how broadly you deployed your policy, you'll likely have many computers here. -2. Select both computers, right-click the selection, and then click **Change Membership**. +2. Select both computers, right-click the selection, and then select **Change Membership**. ![Select Change Membership in the UI.](images/waas-wsus-fig8.png) -3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**. +3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then select **OK**. - Because they were assigned to a group, the computers are no longer in the **Unassigned Computers** group. If you select the **Ring 2 Pilot Business Users** computer group, you will see both computers there. + Because they were assigned to a group, the computers are no longer in the **Unassigned Computers** group. If you select the **Ring 2 Pilot Business Users** computer group, you'll see both computers there. ### Search for multiple computers to add to groups @@ -159,15 +157,15 @@ Another way to add multiple computers to a deployment ring in the WSUS Administr **To search for multiple computers** -1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers, right-click **All Computers**, and then click **Search**. +1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers, right-click **All Computers**, and then select **Search**. 2. In the search box, type **WIN10**. -3. In the search results, select the computers, right-click the selection, and then click **Change Membership**. +3. In the search results, select the computers, right-click the selection, and then select **Change Membership**. ![Select Change Membership to search for multiple computers in the UI.](images/waas-wsus-fig9.png) -4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**. +4. Select the **Ring 3 Broad IT** deployment ring, and then select **OK**. You can now see these computers in the **Ring 3 Broad IT** computer group. @@ -180,11 +178,11 @@ The WSUS Administration Console provides a friendly interface from which you can **To configure WSUS to allow client-side targeting from Group Policy** -1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**. +1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then select **Computers**. ![Select Comptuers in the WSUS Administration Console.](images/waas-wsus-fig10.png) -2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**. +2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then select **OK**. >[!NOTE] >This option is exclusively either-or. When you enable WSUS to use Group Policy for group assignment, you can no longer manually add computers through the WSUS Administration Console until you change the option back. @@ -194,23 +192,23 @@ Now that WSUS is ready for client-side targeting, complete the following steps t **To configure client-side targeting** >[!TIP] ->When using client-side targeting, consider giving security groups the same names as your deployment rings. Doing so simplifies the policy-creation process and helps ensure that you don’t add computers to the incorrect rings. +>When using client-side targeting, consider giving security groups the same names as your deployment rings. Doing so simplifies the policy-creation process and helps ensure that you don't add computers to the incorrect rings. 1. Open Group Policy Management Console (gpmc.msc). 2. Expand Forest\Domains\\*Your_Domain*. -3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. +3. Right-click *Your_Domain*, and then select **Create a GPO in this domain, and Link it here**. -4. In the **New GPO** dialog box, type **WSUS – Client Targeting – Ring 4 Broad Business Users** for the name of the new GPO. +4. In the **New GPO** dialog box, type **WSUS - Client Targeting - Ring 4 Broad Business Users** for the name of the new GPO. -5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**. +5. Right-click the **WSUS - Client Targeting - Ring 4 Broad Business Users** GPO, and then select **Edit**. ![Select the WSUS ring 4 and edit in group policy.](images/waas-wsus-fig11.png) 6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. -7. Right-click **Enable client-side targeting**, and then click **Edit**. +7. Right-click **Enable client-side targeting**, and then select **Edit**. 8. In the **Enable client-side targeting** dialog box, select **Enable**. @@ -223,23 +221,23 @@ Now that WSUS is ready for client-side targeting, complete the following steps t 10. Close the Group Policy Management Editor. -Now you’re ready to deploy this GPO to the correct computer security group for the **Ring 4 Broad Business Users** deployment ring. +Now you're ready to deploy this GPO to the correct computer security group for the **Ring 4 Broad Business Users** deployment ring. **To scope the GPO to a group** -1. In GPMC, select the **WSUS – Client Targeting – Ring 4 Broad Business Users** policy. +1. In GPMC, select the **WSUS - Client Targeting - Ring 4 Broad Business Users** policy. -2. Click the **Scope** tab. +2. Select the **Scope** tab. 3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group. ![Remove the default AUTHENTICATED USERS security group in group policy.](images/waas-wsus-fig13.png) -The next time the clients in the **Ring 4 Broad Business Users** security group receive their computer policy and contact WSUS, they will be added to the **Ring 4 Broad Business Users** deployment ring. +The next time the clients in the **Ring 4 Broad Business Users** security group receive their computer policy and contact WSUS, they'll be added to the **Ring 4 Broad Business Users** deployment ring. ## Automatically approve and deploy feature updates -For clients that should have their feature updates approved as soon as they’re available, you can configure Automatic Approval rules in WSUS. +For clients that should have their feature updates approved as soon as they're available, you can configure Automatic Approval rules in WSUS. >[!NOTE] >WSUS respects the client device's servicing branch. If you approve a feature update while it is still in one branch, such as Insider Preview, WSUS will install the update only on devices that are in that servicing branch. When Microsoft releases the build for the [General Availability Channel](waas-overview.md#general-availability-channel), the devices in that will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS. @@ -250,32 +248,32 @@ This example uses Windows 10, but the process is the same for Windows 11. 1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Options, and then select **Automatic Approvals**. -2. On the **Update Rules** tab, click **New Rule**. +2. On the **Update Rules** tab, select **New Rule**. 3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes. ![Select the update and deadline check boxes in the WSUS Administration Console.](images/waas-wsus-fig14.png) -4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**. +4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then select **OK**. -5. In the **Edit the properties area**, click the **any product** link. Clear all check boxes except **Windows 10**, and then click **OK**. +5. In the **Edit the properties area**, select the **any product** link. Clear all check boxes except **Windows 10**, and then select **OK**. Windows 10 is under All Products\Microsoft\Windows. -6. In the **Edit the properties** area, click the **all computers** link. Clear all the computer group check boxes except **Ring 3 Broad IT**, and then click **OK**. +6. In the **Edit the properties** area, select the **all computers** link. Clear all the computer group check boxes except **Ring 3 Broad IT**, and then select **OK**. 7. Leave the deadline set for **7 days after the approval at 3:00 AM**. -8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**. +8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then select **OK**. ![Enter the ring 3 deployment name.](images/waas-wsus-fig15.png) -9. In the **Automatic Approvals** dialog box, click **OK**. +9. In the **Automatic Approvals** dialog box, select **OK**. >[!NOTE] - >WSUS does not honor any existing month/week/day [deferral settings](waas-configure-wufb.md#configure-when-devices-receive-feature-updates). That said, if you’re using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait. + >WSUS does not honor any existing month/week/day [deferral settings](waas-configure-wufb.md#configure-when-devices-receive-feature-updates). That said, if you're using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait. -Now, whenever Windows client feature updates are published to WSUS, they will automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week. +Now, whenever Windows client feature updates are published to WSUS, they'll automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week. > [!WARNING] > The auto approval rule runs after synchronization occurs. This means that the *next* upgrade for each Windows client version will be approved. If you select **Run Rule**, all possible updates that meet the criteria will be approved, potentially including older updates that you don't actually want--which can be a problem when the download sizes are very large. @@ -291,17 +289,17 @@ To simplify the manual approval process, start by creating a software update vie **To approve and deploy feature updates manually** -1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates. In the **Action** pane, click **New Update View**. +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates. In the **Action** pane, select **New Update View**. 2. In the **Add Update View** dialog box, select **Updates are in a specific classification** and **Updates are for a specific product**. -3. Under **Step 2: Edit the properties**, click **any classification**. Clear all check boxes except **Upgrades**, and then click **OK**. +3. Under **Step 2: Edit the properties**, select **any classification**. Clear all check boxes except **Upgrades**, and then select **OK**. -4. Under **Step 2: Edit the properties**, click **any product**. Clear all check boxes except **Windows 10**, and then click **OK**. +4. Under **Step 2: Edit the properties**, select **any product**. Clear all check boxes except **Windows 10**, and then select **OK**. Windows 10 is under All Products\Microsoft\Windows. -5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**. +5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then select **OK**. ![Enter All Windows 10 Upgrades for the name in the WSUS admin console.](images/waas-wsus-fig16.png) @@ -309,7 +307,7 @@ Now that you have the **All Windows 10 Upgrades** view, complete the following s 1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates\All Windows 10 Upgrades. -2. Right-click the feature update you want to deploy, and then click **Approve**. +2. Right-click the feature update you want to deploy, and then select **Approve**. ![Approve the feature you want to deploy in WSUS admin console.](images/waas-wsus-fig17.png) @@ -317,30 +315,17 @@ Now that you have the **All Windows 10 Upgrades** view, complete the following s ![Select Approve for install in the WSUS admin console.](images/waas-wsus-fig18.png) -4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**. +4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Deadline**, select **One Week**, and then select **OK**. ![Select a one week deadline in the WSUS admin console.](images/waas-wsus-fig19.png) -5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**. +5. If the **Microsoft Software License Terms** dialog box opens, select **Accept**. If the deployment is successful, you should receive a successful progress report. ![A sample successful deployment.](images/waas-wsus-fig20.png) -6. In the **Approval Progress** dialog box, click **Close**. - -
- -## Steps to manage updates for Windows client - -|  |  | -| --- | --- | -| ![done.](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | -| ![done.](images/checklistdone.png) | [Prepare servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md) | -| ![done.](images/checklistdone.png) | [Build deployment rings for Windows client updates](waas-deployment-rings-windows-10-updates.md) | -| ![done.](images/checklistdone.png) | [Assign devices to servicing channels for Windows client updates](waas-servicing-channels-windows-10-updates.md) | -| ![done.](images/checklistdone.png) | [Optimize update delivery for Windows client updates](../do/waas-optimize-windows-10-updates.md) | -| ![done.](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
or Deploy Windows client updates using Windows Server Update Services (this topic)
or [Deploy Windows client updates using Microsoft Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) | +6. In the **Approval Progress** dialog box, select **Close**. From 75c99d0f5e3ee132a2364a54599638c21f7bf1e8 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 15:21:23 -0700 Subject: [PATCH 074/125] metadata, formatting, and wording tweaks --- .../update/waas-manage-updates-wufb.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index 0b7e01ecae..a65532c789 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -3,14 +3,17 @@ title: Windows Update for Business manager: aaroncz description: Learn how Windows Update for Business lets you manage when devices receive updates from Windows Update. ms.prod: windows-client +ms.topic: overview author: mestew ms.localizationpriority: medium ms.author: mstewart -ms.topic: overview ms.collection: - highpri - tier2 -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- @@ -37,7 +40,7 @@ Specifically, Windows Update for Business lets you control update offerings and Windows Update for Business enables commercial customers to manage which Windows Updates are received when as well as the experience a device has when it receives them. -You can control Windows Update for Business policies by using either Mobile Device Management (MDM) tools such as Microsoft Intune or Group Policy management tools such as local group policy or the Group Policy Management Console (GPMC), as well as a variety of other non-Microsoft management tools. MDMs use Configuration Service Provider (CSP) policies instead of Group Policy. Intune additionally uses Cloud Policies. Not all policies are available in all formats (CSP, Group Policy, or Cloud policy). +You can control Windows Update for Business policies by using either Mobile Device Management (MDM) tools such as Microsoft Intune or Group Policy management tools such as local group policy or the Group Policy Management Console (GPMC), as well as various other non-Microsoft management tools. MDMs use Configuration Service Provider (CSP) policies instead of Group Policy. Intune additionally uses Cloud Policies. Not all policies are available in all formats (CSP, Group Policy, or Cloud policy). ### Manage deployment of Windows Updates @@ -62,10 +65,11 @@ You can control when updates are applied, for example by deferring when an updat ### Manage when updates are offered You can defer or pause the installation of updates for a set period of time. -#### Enroll in pre-release updates +#### Enroll in prerelease updates -The branch readiness level enables administrators to specify which channel of feature updates they want to receive. Today there are branch readiness level options for both pre-release and released updates: +The branch readiness level enables administrators to specify which channel of feature updates they want to receive. Today there are branch readiness level options for both prerelease and released updates: +- Windows Insider Canary - Windows Insider Dev - Windows Insider Beta - Windows Insider Preview @@ -81,7 +85,7 @@ A Windows Update for Business administrator can defer the installation of both f |---------|---------| |Feature updates | 365 days | |Quality updates | 30 days | -|Non-deferrable | none | +|Nondeferrable | none | @@ -107,7 +111,7 @@ For the best experience with Windows Update, follow these guidelines: ### Manage the end-user experience when receiving Windows Updates -Windows Update for Business provides controls to help meet your organization’s security standards as well as provide a great end-user experience. We do this by enabling you to set automatic updates at times that work well for people in your organization and set deadlines for quality and feature updates. Because Windows Update includes built-in intelligence, it's better to use fewer controls to manage the user experience. +Windows Update for Business provides controls to help meet your organization's security standards as well as provide a great end-user experience. We do this by enabling you to set automatic updates at times that work well for people in your organization and set deadlines for quality and feature updates. Because Windows Update includes built-in intelligence, it's better to use fewer controls to manage the user experience. #### Recommended experience settings From c61989ae80a1beac2974395a872f04f299a93dc4 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 15:31:31 -0700 Subject: [PATCH 075/125] metadata, formatting, and wording tweaks --- windows/deployment/update/waas-overview.md | 41 ++++++++++------------ 1 file changed, 19 insertions(+), 22 deletions(-) diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md index 2585696606..6f20706c2e 100644 --- a/windows/deployment/update/waas-overview.md +++ b/windows/deployment/update/waas-overview.md @@ -2,39 +2,36 @@ title: Overview of Windows as a service description: Windows as a service is a way to build, deploy, and service Windows. Learn how Windows as a service works. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: overview author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: overview +ms.localizationpriority: medium ms.collection: - highpri - tier2 -ms.technology: itpro-updates +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Overview of Windows as a service - -**Applies to** - -- Windows 10 -- Windows 11 - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) Windows as a service is a way to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. ## Building -Prior to Windows 10, Microsoft released new versions of Windows every few years. This traditional deployment schedule imposed a training burden on users because the feature revisions were often significant. That schedule also meant waiting long periods without new features — a scenario that doesn’t work in today’s rapidly changing world, a world in which new security, management, and deployment capabilities are necessary to address challenges. Windows as a service will deliver smaller feature updates two times per year, around March and September, to help address these issues. +Prior to Windows 10, Microsoft released new versions of Windows every few years. This traditional deployment schedule imposed a training burden on users because the feature revisions were often significant. That schedule also meant waiting long periods without new features — a scenario that doesn't work in today's rapidly changing world, a world in which new security, management, and deployment capabilities are necessary to address challenges. -In the past, when Microsoft developed new versions of Windows, it typically released technical previews near the end of the process, when Windows was nearly ready to ship. With Windows 10, new features will be delivered to the [Windows Insider community](https://insider.windows.com/) as soon as possible — during the development cycle, through a process called *flighting* — so that organizations can see exactly what Microsoft is developing and start their testing as soon as possible. +In the past, when Microsoft developed new versions of Windows, it typically released technical previews near the end of the process, when Windows was nearly ready to ship. With Windows 10, new features are delivered to the [Windows Insider community](/windows-insider/business/register) as soon as possible, during the development cycle, through a process called *flighting*. Organizations can see exactly what Microsoft is developing and start their testing as soon as possible. Microsoft also depends on receiving feedback from organizations throughout the development process so that it can make adjustments as quickly as possible rather than waiting until after release. For more information about the Windows Insider Program and how to sign up, see the section [Windows Insider](#windows-insider). -Of course Microsoft also performs extensive internal testing, with engineering teams installing new builds daily, and larger groups of employees installing builds frequently, all before those builds are ever released to the Windows Insider Program. +Of course, Microsoft also performs extensive internal testing, with engineering teams installing new builds daily, and larger groups of employees installing builds frequently, all before those builds are ever released to the Windows Insider Program. ## Deploying @@ -43,13 +40,13 @@ Deploying Windows 10 and Windows 11 is simpler than with previous versions of Wi ### Application compatibility -Application compatibility testing has historically been a burden when approaching a Windows deployment or upgrade. Application compatibility from the perspective of desktop applications, websites, and apps built on the Universal Windows Platform (UWP) has improved tremendously over older versions of Windows. For the most important business-critical applications, organizations should still perform testing on a regular basis to validate compatibility with new builds. +Application compatibility testing has historically been a burden when approaching a Windows deployment or upgrade. Application compatibility from the perspective of desktop applications, websites, and apps built on the Universal Windows Platform (UWP) has improved tremendously over older versions of Windows. For the most important business-critical applications, organizations should still perform testing regularly to validate compatibility with new builds. ## Servicing Traditional Windows servicing has included several release types: major revisions (for example, the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. With Windows 10 and Windows 11, there are two release types: feature updates that add new functionality and quality updates that provide security and reliability fixes. -Servicing channels are the first way to separate users into deployment groups for feature and quality updates. For more information about developing a deployment strategy that leverages servicing channels, see [Plan servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md). +Servicing channels are the first way to separate users into deployment groups for feature and quality updates. For more information about developing a deployment strategy that uses servicing channels, see [Plan servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md). For information about each servicing tool, see [Servicing tools](#servicing-tools). @@ -58,7 +55,7 @@ There are three servicing channels, each of which provides different levels of f There are currently three release channels for Windows clients: -- The **General Availability Channel** receives feature updates as soon as they are available. +- The **General Availability Channel** receives feature updates as soon as they're available. - The **Long-Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. - The **Windows Insider Program** provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update. @@ -75,9 +72,9 @@ New features are packaged into feature updates that you can deploy using existin ### Quality updates -Monthly updates in previous Windows versions were often overwhelming because of the sheer number of updates available each month. Many organizations selectively chose which updates they wanted to install and which they didn’t, and this created countless scenarios in which organizations deployed essential security updates but picked only a subset of non-security fixes. +Monthly updates in previous Windows versions were often overwhelming because of the sheer number of updates available each month. Many organizations selectively chose which updates they wanted to install and which they didn't, and this created countless scenarios in which organizations deployed essential security updates but picked only a subset of nonsecurity fixes. -Rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators see one cumulative monthly update that supersedes the previous month’s update, containing both security and non-security fixes. This approach makes updating simpler and ensures that devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from updates. +Rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators see one cumulative monthly update that supersedes the previous month's update, containing both security and non-security fixes. This approach makes updating simpler and ensures that devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from updates. ## Servicing channels @@ -88,9 +85,9 @@ There are three servicing channels. The [Windows Insider Program](#windows-insid ### General Availability Channel -In the General Availability Channel, feature updates are available annually. This servicing model is ideal for pilot deployments and testing of feature updates and for users such as developers who need to work with the latest features. Once the latest release has gone through pilot deployment and testing, you will be able to choose the timing at which it goes into broad deployment. +In the General Availability Channel, feature updates are available annually. This servicing model is ideal for pilot deployments and testing of feature updates and for users such as developers who need to work with the latest features. Once the latest release has gone through pilot deployment and testing, you'll be able to choose the timing at which it goes into broad deployment. -When Microsoft officially releases a feature update, we make it available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the General Availability Channel will be available but not necessarily immediately mandatory, depending on the policy of the management system. For more details about servicing tools, see [Servicing tools](#servicing-tools). +When Microsoft officially releases a feature update, we make it available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the General Availability Channel is available but not necessarily immediately mandatory, depending on the policy of the management system. For more information about servicing tools, see [Servicing tools](#servicing-tools). > [!NOTE] @@ -102,7 +99,7 @@ When Microsoft officially releases a feature update, we make it available to any ### Long-term Servicing Channel -Specialized systems—such as devices that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. It’s more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Enterprise LTSC devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSC clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools. +Specialized systems—such as devices that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don't need feature updates as frequently as other devices in the organization. It's more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Enterprise LTSC devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSC clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools. > [!NOTE] > @@ -113,12 +110,12 @@ Microsoft never publishes feature updates through Windows Update on devices that > [!NOTE] > LTSC releases will support the currently released processors and chipsets at the time of release of the LTSC. As future CPU generations are released, support will be created through future LTSC releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](/lifecycle/faq/windows). -The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSC editions. This edition of Windows doesn’t include a number of applications, such as Microsoft Edge, Microsoft Store, Cortana (though limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. These apps are not supported in the Enterprise LTSC editions, even if you install by using sideloading. +The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSC editions. This edition of Windows doesn't include some applications, such as Microsoft Edge, Microsoft Store, Cortana (though limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. These apps aren't supported in the Enterprise LTSC editions, even if you install by using sideloading. ### Windows Insider -For many IT pros, gaining visibility into feature updates early--before they’re available to the General Availability Channel — can be both intriguing and valuable for future end user communications as well as provide the means to test for any issues on the next General Availability release. Windows Insiders can consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. +For many IT pros, gaining visibility into feature updates early can be both intriguing and valuable for future end user communications as well as provide the means to test for any issues on the next General Availability release. Windows Insiders can consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about the Windows Insider Program for Business, go to [Windows Insider Program for Business](/windows-insider/business/register). From f29ef7f86b6396c134df431f3fbf7078bfc056af Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 15:35:13 -0700 Subject: [PATCH 076/125] metadata, formatting, and wording tweaks --- windows/deployment/update/waas-quick-start.md | 27 +++++++++---------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/windows/deployment/update/waas-quick-start.md b/windows/deployment/update/waas-quick-start.md index 825676e789..f027e7d657 100644 --- a/windows/deployment/update/waas-quick-start.md +++ b/windows/deployment/update/waas-quick-start.md @@ -2,38 +2,35 @@ title: Quick guide to Windows as a service (Windows 10) description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: high ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: high +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Quick guide to Windows as a service - -**Applies to** - -- Windows 10 -- Windows 11 - -Here is a quick guide to the most important concepts in Windows as a service. For more information, see the [extensive set of documentation](index.md). +Here's a quick guide to the most important concepts in Windows as a service. For more information, see the [extensive set of documentation](index.md). ## Definitions Some new terms have been introduced as part of Windows as a service, so you should know what these terms mean. - **Feature updates** are released annually. As the name suggests, these updates add new features, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years. -- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month, though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md). +- **Quality updates** deliver both security and nonsecurity fixes. They're typically released on the second Tuesday of each month, though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they're important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md). - **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and confirm compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. - **Servicing channels** allow organizations to choose when to deploy new features. - The **General Availability Channel** receives feature updates annually. - The **Long-Term Servicing Channel**, which is meant only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATMs, receives new feature releases every two to three years. - **Deployment rings** are groups of devices used to initially pilot, and then to broadly deploy, each feature update in an organization. -See [Overview of Windows as a service](waas-overview.md) for more information. +For more information, see [Overview of Windows as a service](waas-overview.md). For some interesting in-depth information about how cumulative updates work, see [Windows Updates using forward and reverse differentials](PSFxWhitepaper.md). @@ -41,15 +38,15 @@ For some interesting in-depth information about how cumulative updates work, see With each release in the General Availability Channel, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion. -Windows 10 Enterprise LTSC are separate **Long-Term Servicing Channel** versions. Each release is supported for a total of 10 years (five years standard support, five years extended support). New releases are expected about every three years. +Windows Enterprise LTSC versions are separate **Long-Term Servicing Channel** versions. Each release is supported for a total of 10 years (five years standard support, five years extended support). New releases are expected about every three years. For more information, see [Assign devices to servicing channels for Windows client updates](waas-servicing-channels-windows-10-updates.md). ## Staying up to date -To stay up to date, deploy feature updates at an appropriate time after their release. You can use various management and update tools such as Windows Update, Windows Update for Business, Windows Server Update Services, Microsoft Configuration Manager, and non-Microsoft products) to help with this process. [Upgrade Readiness](/windows/deployment/upgrade/upgrade-readiness-get-started), a free tool to streamline Windows upgrade projects, is another important tool to help. +To stay up to date, deploy feature updates at an appropriate time after their release. You can use various management and update tools such as Windows Update, Windows Update for Business, Windows Server Update Services, Microsoft Configuration Manager, and non-Microsoft products to help with this process. [Upgrade Readiness](/windows/deployment/upgrade/upgrade-readiness-get-started), a free tool to streamline Windows upgrade projects, is another important tool to help. -Extensive advanced testing isn’t required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin. +Extensive advanced testing isn't required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin. This process repeats with each new feature update. These are small deployment projects, compared to the large projects that were necessary with the old three-to-five-year Windows release cycles. From 7710f6f78cb0699dc2daff1dac5c6a238d960c97 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 15:53:41 -0700 Subject: [PATCH 077/125] metadata, formatting, and wording tweaks --- windows/deployment/update/waas-restart.md | 67 +++++++++++------------ 1 file changed, 32 insertions(+), 35 deletions(-) diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index e95825d0c0..7f1a071a49 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -1,36 +1,33 @@ --- title: Manage device restarts after updates -description: Use Group Policy settings, mobile device management (MDM), or Registry to configure when devices will restart after a Windows 10 update is installed. +description: Use Group Policy settings, mobile device management (MDM), or Registry to configure when devices will restart after a Windows update is installed. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: how-to ms.collection: - highpri - tier2 -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Manage device restarts after updates - -**Applies to** - -- Windows 10 -- Windows 11 - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -You can use Group Policy settings, mobile device management (MDM), or Registry (not recommended) to configure when devices will restart after a Windows update is installed. You can schedule update installation and set policies for restart, configure active hours for when restarts will not occur, or you can do both. +You can use Group Policy settings, mobile device management (MDM), or Registry (not recommended) to configure when devices will restart after a Windows update is installed. You can schedule update installation and set policies for restart, configure active hours for when restarts won't occur, or you can do both. ## Schedule update installation In Group Policy, within **Configure Automatic Updates**, you can configure a forced restart after a specified installation time. -To set the time, you need to go to **Configure Automatic Updates**, select option **4 - Auto download and schedule the install**, and then enter a time in the **Scheduled install time** dropdown. Alternatively, you can specify that installation will occur during the automatic maintenance time (configured using **Computer Configuration\Administrative Templates\Windows Components\Maintenance Scheduler**). +To set the time, you need to go to **Configure Automatic Updates**, select option **4 - Auto download and schedule the install**, and then enter a time in the **Scheduled install time** dropdown. Alternatively, you can specify that installation occurs during the automatic maintenance time (configured using **Computer Configuration\Administrative Templates\Windows Components\Maintenance Scheduler**). **Always automatically restart at the scheduled time** forces a restart after the specified installation time and lets you configure a timer to warn a signed-in user that a restart is going to occur. @@ -40,25 +37,25 @@ For a detailed description of these registry keys, see [Registry keys used to ma ## Delay automatic reboot -When **Configure Automatic Updates** is enabled in Group Policy, you can enable one of the following additional policies to delay an automatic reboot after update installation: +When **Configure Automatic Updates** is enabled in Group Policy, you can also enable one of the following policies to delay an automatic reboot after update installation: - **Turn off auto-restart for updates during active hours** prevents automatic restart during active hours. -- **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device will restart at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**. +- **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device restarts at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**. > [!NOTE] > When using Remote Desktop Protocol connections, only active RDP sessions are considered as logged on users. Devices that do not have locally logged on users, or active RDP sessions, will be restarted. -You can also use Registry, to prevent automatic restarts when a user is signed in. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4** and enable **NoAutoRebootWithLoggedOnUsers**. As with Group Policy, if a user schedules the restart in the update notification, it will override this setting. +You can also use Registry, to prevent automatic restarts when a user is signed in. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4** and enable **NoAutoRebootWithLoggedOnUsers**. As with Group Policy, if a user schedules the restart in the update notification, it overrides this setting. For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart). ## Configure active hours -*Active hours* identify the period of time when you expect the device to be in use. Automatic restarts after an update will occur outside of the active hours. +*Active hours* identify the period of time when you expect the device to be in use. Automatic restarts after an update occur outside of the active hours. By default, active hours are from 8 AM to 5 PM on PCs and from 5 AM to 11 PM on phones. Users can change the active hours manually. -Starting with Windows 10, version 1703, you can also specify the max active hours range. The specified range will be counted from the active hours start time. +Starting with Windows 10, version 1703, you can also specify the max active hours range. The specified range is counted from the active hours start time. Administrators can use multiple ways to set active hours for managed devices: @@ -78,7 +75,7 @@ MDM uses the [Update/ActiveHoursStart and Update/ActiveHoursEnd](/windows/client ### Configuring active hours through Registry -This method is not recommended, and should only be used when you can't use Group Policy or MDM. +This method isn't recommended, and should only be used when you can't use Group Policy or MDM. Any settings configured through Registry may conflict with any existing configuration that uses any of the methods mentioned above. Configure active hours by setting a combination of the following registry values: @@ -102,7 +99,7 @@ To configure active hours max range through MDM, use [**Update/ActiveHoursMaxRan ## Limit restart delays -After an update is installed, Windows attempts automatic restart outside of active hours. If the restart does not succeed after seven days (by default), the user will see a notification that restart is required. You can use the **Specify deadline before auto-restart for update installation** policy to change the delay from seven days to any number of days between two and 14. +After an update is installed, Windows attempts automatic restart outside of active hours. If the restart doesn't succeed after seven days (by default), the user will see a notification that restart is required. You can use the **Specify deadline before auto-restart for update installation** policy to change the delay from seven days to any number of days between 2 and 14. ## Control restart notifications @@ -120,15 +117,15 @@ Starting in Windows 11, version 22H2, **Apply only during active hours** was add To configure this behavior through MDM, use [**Update/UpdateNotificationLevel**](/windows/client-management/mdm/policy-csp-update#update-NoUpdateNotificationDuringActiveHours). -### Auto-restart notifications +### Auto restart notifications -Administrators can override the default behavior for the auto-restart required notification. By default, this notification will dismiss automatically. This setting was added in Windows 10, version 1703. +Administrators can override the default behavior for the auto restart required notification. By default, this notification dismisses automatically. This setting was added in Windows 10, version 1703. To configure this behavior through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select **Configure auto-restart required notification for updates**. When configured to **2 - User Action**, a user that gets this notification must manually dismiss it. To configure this behavior through MDM, use [**Update/AutoRestartRequiredNotificationDismissal**](/windows/client-management/mdm/policy-configuration-service-provider#update-AutoRestartRequiredNotificationDismissal) -You can also configure the period prior to an update that this notification will show up on. The default value is 15 minutes. +You can also configure the period prior to an update that this notification shows up. The default value is 15 minutes. To change it through Group Policy, select **Configure auto-restart-reminder notifications for updates** under **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select the period in minutes. @@ -141,20 +138,20 @@ To do so through Group Policy, go to **Computer Configuration\Administrative Tem To do so through MDM, use [**Update/SetAutoRestartNotificationDisable**](/windows/client-management/mdm/policy-configuration-service-provider#update-setautorestartnotificationdisable). -### Scheduled auto-restart warnings +### Scheduled auto restart warnings -Since users are not able to postpone a scheduled restart once the deadline has been reached, you can configure a warning reminder prior to the scheduled restart. You can also configure a warning prior to the restart, to notify users once the restart is imminent and allow them to save their work. +Since users aren't able to postpone a scheduled restart once the deadline has been reached, you can configure a warning reminder prior to the scheduled restart. You can also configure a warning prior to the restart, to notify users once the restart is imminent and allow them to save their work. -To configure both through Group Policy, find **Configure auto-restart warning notifications schedule for updates** under **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The warning reminder can be configured by **Reminder (hours)** and the warning prior to an imminent auto-restart can be configured by **Warning (mins)**. +To configure both through Group Policy, find **Configure auto-restart warning notifications schedule for updates** under **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The warning reminder can be configured by **Reminder (hours)** and the warning prior to an imminent auto restart can be configured by **Warning (mins)**. -In MDM, the warning reminder is configured using [**Update/ScheduleRestartWarning**](/windows/client-management/mdm/policy-configuration-service-provider#update-ScheduleRestartWarning) and the auto-restart imminent warning is configured using [**Update/ScheduleImminentRestartWarning**](/windows/client-management/mdm/policy-configuration-service-provider#update-ScheduleImminentRestartWarning). +In MDM, the warning reminder is configured using [**Update/ScheduleRestartWarning**](/windows/client-management/mdm/policy-configuration-service-provider#update-ScheduleRestartWarning) and the auto restart imminent warning is configured using [**Update/ScheduleImminentRestartWarning**](/windows/client-management/mdm/policy-configuration-service-provider#update-ScheduleImminentRestartWarning). ### Engaged restart -Engaged restart is the period of time when users are required to schedule a restart. Initially, Windows will auto-restart outside of working hours. Once the set period ends (seven days by default), Windows transitions to user scheduled restarts. +Engaged restart is the period of time when users are required to schedule a restart. Initially, Windows auto-restarts outside of working hours. Once the set period ends (seven days by default), Windows transitions to user scheduled restarts. The following settings can be adjusted for engaged restart: -* Period of time before auto-restart transitions to engaged restart. +* Period of time before auto restart transitions to engaged restart. * The number of days that users can snooze engaged restart reminder notifications. * The number of days before a pending restart automatically executes outside of working hours. @@ -164,11 +161,11 @@ In MDM, use [**Update/EngagedRestartTransitionSchedule**](/windows/client-manage ## Group Policy settings for restart -In the Group Policy editor, you will see a number of policy settings that pertain to restart behavior in **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The following table shows which policies apply to Windows 10. +In the Group Policy editor, you'll see policy settings that pertain to restart behavior in **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The following table shows which policies apply to Windows 10. | Policy | Applies to Windows 10 | Notes | | --- | --- | --- | -| Turn off auto-restart for updates during active hours | ![yes.](images/checkmark.png) | Use this policy to configure active hours, during which the device will not be restarted. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | +| Turn off auto-restart for updates during active hours | ![yes.](images/checkmark.png) | Use this policy to configure active hours, during which the device won't be restarted. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | | Always automatically restart at the scheduled time | ![yes.](images/checkmark.png) | Use this policy to configure a restart timer (between 15 and 180 minutes) that will start immediately after Windows Update installs important updates. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** policy is enabled. | | Specify deadline before auto-restart for update installation | ![yes.](images/checkmark.png) | Use this policy to specify how many days (between 2 and 14) an automatic restart can be delayed. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | | No auto-restart with logged on users for scheduled automatic updates installations | ![yes.](images/checkmark.png) | Use this policy to prevent automatic restart when a user is logged on. This policy applies only when the **Configure Automatic Updates** policy is configured to perform scheduled installations of updates. | @@ -190,8 +187,8 @@ The following tables list registry values that correspond to the Group Policy se | Registry key | Key type | Value | | --- | --- | --- | -| ActiveHoursEnd | REG_DWORD | 0-23: set active hours to end at a specific hour
starts with 12 AM (0) and ends with 11 PM (23) | -| ActiveHoursStart | REG_DWORD | 0-23: set active hours to start at a specific hour
starts with 12 AM (0) and ends with 11 PM (23) | +| ActiveHoursEnd | REG_DWORD | 0-23: set active hours to end at a specific hour
starts with 12 AM (0) and ends with 11 PM (23) | +| ActiveHoursStart | REG_DWORD | 0-23: set active hours to start at a specific hour
starts with 12 AM (0) and ends with 11 PM (23) | | SetActiveHours | REG_DWORD | 0: disable automatic restart after updates outside of active hours
1: enable automatic restart after updates outside of active hours | **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** @@ -201,8 +198,8 @@ The following tables list registry values that correspond to the Group Policy se | AlwaysAutoRebootAtScheduledTime | REG_DWORD | 0: disable automatic reboot after update installation at scheduled time
1: enable automatic reboot after update installation at a scheduled time | | AlwaysAutoRebootAtScheduledTimeMinutes | REG_DWORD | 15-180: set automatic reboot to occur after given minutes | | AUOptions | REG_DWORD | 2: notify for download and notify for installation of updates
3: automatically download and notify for installation of updates
4: Automatically download and schedule installation of updates
5: allow the local admin to configure these settings
**Note:** To configure restart behavior, set this value to **4** | -| NoAutoRebootWithLoggedOnUsers | REG_DWORD | 0: disable do not reboot if users are logged on
1: do not reboot after an update installation if a user is logged on
**Note:** If disabled: Automatic Updates will notify the user that the computer will automatically restart in 5 minutes to complete the installation | -| ScheduledInstallTime | REG_DWORD | 0-23: schedule update installation time to a specific hour
starts with 12 AM (0) and ends with 11 PM (23) | +| NoAutoRebootWithLoggedOnUsers | REG_DWORD | 0: disable don't reboot if users are logged on
1: don't reboot after an update installation if a user is logged on
**Note:** If disabled: Automatic Updates will notify the user that the computer will automatically restart in 5 minutes to complete the installation | +| ScheduledInstallTime | REG_DWORD | 0-23: schedule update installation time to a specific hour
starts with 12 AM (0) and ends with 11 PM (23) | There are three different registry combinations for controlling restart behavior: @@ -210,7 +207,7 @@ There are three different registry combinations for controlling restart behavior - To schedule a specific installation and reboot time, **AUOptions** should be **4**, **ScheduledInstallTime** should specify the installation time, and **AlwaysAutoRebootAtScheduledTime** set to **1** and **AlwaysAutoRebootAtScheduledTimeMinutes** should specify number of minutes to wait before rebooting. - To delay rebooting if a user is logged on, **AUOptions** should be **4**, while **NoAutoRebootWithLoggedOnUsers** is set to **1**. -## Related articles +## More resources - [Update Windows in the enterprise](index.md) - [Overview of Windows as a service](waas-overview.md) From c2256dfee7807359b345818c796f7e38b9d97a0d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 16:00:41 -0700 Subject: [PATCH 078/125] metadata, formatting, and wording tweaks --- .../update/waas-manage-updates-wufb.md | 1 - windows/deployment/update/waas-restart.md | 14 ++++---- ...s-servicing-channels-windows-10-updates.md | 34 ++++++++----------- 3 files changed, 22 insertions(+), 27 deletions(-) diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index a65532c789..db2f08ff46 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -5,7 +5,6 @@ description: Learn how Windows Update for Business lets you manage when devices ms.prod: windows-client ms.topic: overview author: mestew -ms.localizationpriority: medium ms.author: mstewart ms.collection: - highpri diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index 7f1a071a49..007852b8af 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -165,13 +165,13 @@ In the Group Policy editor, you'll see policy settings that pertain to restart b | Policy | Applies to Windows 10 | Notes | | --- | --- | --- | -| Turn off auto-restart for updates during active hours | ![yes.](images/checkmark.png) | Use this policy to configure active hours, during which the device won't be restarted. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | -| Always automatically restart at the scheduled time | ![yes.](images/checkmark.png) | Use this policy to configure a restart timer (between 15 and 180 minutes) that will start immediately after Windows Update installs important updates. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** policy is enabled. | -| Specify deadline before auto-restart for update installation | ![yes.](images/checkmark.png) | Use this policy to specify how many days (between 2 and 14) an automatic restart can be delayed. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | -| No auto-restart with logged on users for scheduled automatic updates installations | ![yes.](images/checkmark.png) | Use this policy to prevent automatic restart when a user is logged on. This policy applies only when the **Configure Automatic Updates** policy is configured to perform scheduled installations of updates. | -| Re-prompt for restart with scheduled installations | ![no.](images/crossmark.png) | | -| Delay Restart for scheduled installations | ![no.](images/crossmark.png) | | -| Reschedule Automatic Updates scheduled installations | ![no.](images/crossmark.png) | | +| Turn off auto-restart for updates during active hours | Yes | Use this policy to configure active hours, during which the device won't be restarted. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | +| Always automatically restart at the scheduled time | Yes | Use this policy to configure a restart timer (between 15 and 180 minutes) that will start immediately after Windows Update installs important updates. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** policy is enabled. | +| Specify deadline before auto-restart for update installation | Yes | Use this policy to specify how many days (between 2 and 14) an automatic restart can be delayed. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | +| No auto-restart with logged on users for scheduled automatic updates installations | Yes | Use this policy to prevent automatic restart when a user is logged on. This policy applies only when the **Configure Automatic Updates** policy is configured to perform scheduled installations of updates. | +| Re-prompt for restart with scheduled installations | No | | +| Delay Restart for scheduled installations | No | | +| Reschedule Automatic Updates scheduled installations | No | | >[!NOTE] diff --git a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md index 82f1a7f953..3fd3990153 100644 --- a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md @@ -1,24 +1,20 @@ --- -title: Assign devices to servicing channels for Windows client updates +title: Assign devices to servicing channels for updates description: Learn how to assign devices to servicing channels for Windows 10 updates locally, by using Group Policy, and by using MDM ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- -# Assign devices to servicing channels for Windows 10 updates - - -**Applies to** - -- Windows 10 -- Windows 11 - +# Assign devices to servicing channels for Windows updates > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) @@ -29,12 +25,12 @@ The General Availability Channel is the default servicing channel for all Window | Edition | General Availability Channel | Long-Term Servicing Channel | Insider Program | | --- | --- | --- | --- | -| Home | ![no.](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Pro | ![yes.](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Enterprise | ![yes.](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Enterprise LTSC | ![no.](images/crossmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | -| Pro Education | ![yes.](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Education | ![yes.](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Home | No | No | Yes | +| Pro | Yes | No | Yes | +| Enterprise | Yes | No | Yes | +| Enterprise LTSC | No | Yes | No | +| Pro Education | Yes | No | Yes | +| Education | Yes | No | Yes | >[!NOTE] @@ -46,7 +42,7 @@ The General Availability Channel is the default servicing channel for all Window ## Enroll devices in the Windows Insider Program -To get started with the Windows Insider Program for Business, follows these steps: +To get started with the Windows Insider Program for Business, follow these steps: 1. On the [Windows Insider](https://www.microsoft.com/windowsinsider/for-business) website, select **Register** to register your organizational Azure AD account. 2. Follow the prompts to register your tenant.
**Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register. From 62af401024597ba9d0f3f997de8da3d42640201f Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 16:05:24 -0700 Subject: [PATCH 079/125] metadata, formatting, and wording tweaks --- ...s-servicing-strategy-windows-10-updates.md | 32 ++++++++----------- 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md index 278ccbed60..31038c9fc0 100644 --- a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md @@ -2,40 +2,36 @@ title: Prepare a servicing strategy for Windows client updates description: A strong Windows client deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Prepare a servicing strategy for Windows client updates - -**Applies to** - -- Windows 10 -- Windows 11 - - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -Here’s an example of what this process might look like: +Here's an example of what this process might look like: -- **Configure test devices.** Configure test devices in the Windows Insider Program so that Insiders can test feature updates before they’re available to the General Availability Channel. Typically, this population would be a few test devices that IT staff members use to evaluate pre-release builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program for Business. +- **Configure test devices.** Configure test devices in the Windows Insider Program so that Insiders can test feature updates before they're available to the General Availability Channel. Typically, this population would be a few test devices that IT staff members use to evaluate prerelease builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program for Business. - **Identify excluded devices.** For some organizations, special-purpose devices, like devices that control factory or medical equipment or run ATMs, require a stricter, less frequent feature update cycle than the General Availability Channel can offer. For those devices, install the Enterprise LTSC edition to avoid feature updates for up to 10 years. Identify these devices, and separate them from the phased deployment and servicing cycles to help remove confusion for your administrators and ensure that devices are handled correctly. -- **Recruit volunteers.** The purpose of testing a deployment is to receive feedback. One effective way to recruit pilot users is to request volunteers. When doing so, clearly state that you’re looking for feedback rather than people to just “try it out” and that there could be occasional issues involved with accepting feature updates right away. With Windows as a service, the expectation is that there should be few issues, but if an issue does arise, you want testers to let you know as soon as possible. When considering whom to recruit for pilot groups, be sure to include members who provide the broadest set of applications and devices to validate the largest number of apps and devices possible. -- **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain will need to download an .admx package and copy it to their [Central Store](/troubleshoot/windows-server/group-policy/create-central-store-domain-controller) (or to the [PolicyDefinitions](/previous-versions/dotnet/articles/bb530196(v=msdn.10)) directory in the SYSVOL folder of a domain controller if not using a Central Store). You can manage new group policies from the latest release of Windows by using Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for “ADMX download for Windows build xxxx”. For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) -- **Choose a servicing tool.** Decide which product you’ll use to manage the Windows updates in your environment. If you’re currently using Windows Server Update Services (WSUS) or Microsoft Configuration Manager to manage your Windows updates, you can continue using those products to manage Windows 10 or Windows 11 updates. Alternatively, you can use Windows Update for Business. In addition to which product you’ll use, consider how you’ll deliver the updates. Multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools). +- **Recruit volunteers.** The purpose of testing a deployment is to receive feedback. One effective way to recruit pilot users is to request volunteers. When doing so, clearly state that you're looking for feedback rather than people to just "try it out" and that there could be occasional issues involved with accepting feature updates right away. With Windows as a service, the expectation is that there should be few issues, but if an issue does arise, you want testers to let you know as soon as possible. When considering whom to recruit for pilot groups, be sure to include members who provide the broadest set of applications and devices to validate the largest number of apps and devices possible. +- **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain needs to download an .admx package and copy it to their [Central Store](/troubleshoot/windows-server/group-policy/create-central-store-domain-controller) (or to the [PolicyDefinitions](/previous-versions/dotnet/articles/bb530196(v=msdn.10)) directory in the SYSVOL folder of a domain controller if not using a Central Store). You can manage new group policies from the latest release of Windows by using Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for "ADMX download for Windows build xxxx". For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) +- **Choose a servicing tool.** Decide which product you'll use to manage the Windows updates in your environment. If you're currently using Windows Server Update Services (WSUS) or Microsoft Configuration Manager to manage your Windows updates, you can continue using those products to manage Windows 10 or Windows 11 updates. Alternatively, you can use Windows Update for Business. In addition to which product you'll use, consider how you'll deliver the updates. Multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools). - **Prioritize applications.** First, create an application portfolio. This list should include everything installed in your organization and any webpages your organization hosts. Next, prioritize this list to identify those apps that are the most business critical. Because the expectation is that application compatibility with new versions of Windows will be high, only the most business-critical applications should be tested before the pilot phase; everything else can be tested afterwards. For more information about identifying compatibility issues withe applications, see [Manage Windows upgrades with Upgrade Analytics](/mem/configmgr/desktop-analytics/overview). Each time Microsoft releases a feature update, the IT department should use the following high-level process to help ensure that the broad deployment is successful: -1. **Validate compatibility of business critical apps.** Test your most important business-critical applications for compatibility with the new Windows 10 feature update running on your Windows Insider machines identified in the earlier “Configure test devices step of the previous section. The list of applications involved in this validation process should be small because most applications can be tested during the pilot phase. -2. **Target and react to feedback.** Microsoft expects application and device compatibility to be high, but it’s still important to have targeted groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this activity will represent most of the application compatibility testing in your environment. It shouldn't necessarily be a formal process but rather user validation by using a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your targeted groups running in the General Availability Channel that you identified in the “Recruit volunteers” step of the previous section. Be sure to communicate clearly that you’re looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan to address it. -3. **Deploy broadly.** Finally, focus on the large-scale deployment using deployment rings. Build deployment rings that target groups of computers in your selected update-management product. To reduce risk as much as possible, construct your deployment rings in a way that splits individual departments into multiple rings. This way, if you were to encounter an issue, you don’t prevent any critical business from continuing. By using this method, each deployment ring reduces risk as more people have been updated in any particular department. +1. **Validate compatibility of business critical apps.** Test your most important business-critical applications for compatibility with the new Windows 10 feature update running on your Windows Insider machines identified in the earlier "Configure test devices" step of the previous section. The list of applications involved in this validation process should be small because most applications can be tested during the pilot phase. +2. **Target and react to feedback.** Microsoft expects application and device compatibility to be high, but it's still important to have targeted groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this activity represents most of the application compatibility testing in your environment. It shouldn't necessarily be a formal process but rather user validation by using a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your targeted groups running in the General Availability Channel that you identified in the "Recruit volunteers" step of the previous section. Be sure to communicate clearly that you're looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan to address it. +3. **Deploy broadly.** Finally, focus on the large-scale deployment using deployment rings. Build deployment rings that target groups of computers in your selected update-management product. To reduce risk as much as possible, construct your deployment rings in a way that splits individual departments into multiple rings. This way, if you were to encounter an issue, you don't prevent any critical business from continuing. By using this method, each deployment ring reduces risk as more people have been updated in any particular department. From d0ad2b5a2cfd17b7cfef032bdc72d64369634972 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 23 Aug 2023 16:07:17 -0700 Subject: [PATCH 080/125] metadata, formatting, and wording tweaks --- windows/deployment/update/waas-manage-updates-wufb.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index db2f08ff46..58343cf36e 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -18,12 +18,6 @@ ms.date: 12/31/2017 # What is Windows Update for Business? - -**Applies to** - -- Windows 10 -- Windows 11 - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) Windows Update for Business is a free service that is available for the following editions of Windows 10 and Windows 11: From 26f75b57bd36b0e22bcbbc2d07cd50d8bc9f2269 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 23 Aug 2023 21:40:48 -0700 Subject: [PATCH 081/125] Autopatch deployment guide --- windows/deployment/windows-autopatch/TOC.yml | 2 + .../windows-autopatch-deployment-journey.png | Bin 0 -> 57811 bytes .../windows-autopatch-deployment-guide.md | 329 ++++++++++++++++++ 3 files changed, 331 insertions(+) create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-deployment-journey.png create mode 100644 windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md diff --git a/windows/deployment/windows-autopatch/TOC.yml b/windows/deployment/windows-autopatch/TOC.yml index ad017e7f92..d63bb90e3f 100644 --- a/windows/deployment/windows-autopatch/TOC.yml +++ b/windows/deployment/windows-autopatch/TOC.yml @@ -10,6 +10,8 @@ href: overview/windows-autopatch-roles-responsibilities.md - name: Privacy href: overview/windows-autopatch-privacy.md + - name: Windows Autopatch deployment journey + href: overview/windows-autopatch-deployment-guide.md - name: FAQ href: overview/windows-autopatch-faq.yml - name: Prepare diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-deployment-journey.png b/windows/deployment/windows-autopatch/media/windows-autopatch-deployment-journey.png new file mode 100644 index 0000000000000000000000000000000000000000..ca58a89191104f6bbb525451cda8548a11495262 GIT binary patch literal 57811 zcmeFZ1yfvGw*?9zArLHq;O;KL-QC?a0fKvQ4-z~LGz5p>PH=Z?JOp=lcjs-AbH4kX zTd&T0Kj3y%icO`v_nKqMnrn=?2~m`nKzfDq3JMAeNlH>w84BtJaQSQm?iuhykWd;L z_yO&xEFlb4GK9Ac{PO&xkem<{)Q>2HJENz!!rMt|IYL1pcRc-r?y=1?hJso)lM)qD zb=BW%LimQSmQb4JXxfb}_68jvAI!qdO&RJ6J-n5^YNGm@m8Fem^*LLpzdtv({z_oL zGKI#A=MN&auuQ*3ovf@wI)91dI+}%WbxwSJ{RLi>ySfb-WH_6{b?r01*!SL~xL~Hr zMbCME=J56|)!VsLyUIdsyhg*TMXyH716bSBs~!rG>CctZ3oOGwS6i=`TK`;)pd0!= znFs}yPTL9v^ZQCr!xtL%_myu66b$0;D=0l^Sgb!+_0RtA3jrkliD83(1N*!Oq>3YS z?KAZbUdf?O^W)xRgZoe1NVZ>4P^Pt)8ncal!eoJ_4(r=NekH#y-;AL`!b)^!7~w~I zZyMy@K#k!e+TC-Vu2{}lt)70=dr#p62l&ej4z~8j&^NUQoY-9Flcm{ES`erro!&%L{==rvQN z_U^aY^eUaLsBYAR63=~YpkU^>nWf!VbGD)_ZCPV*-*7cZi@T{%gLHfxf;loJUk$D` zxngR&%uUzX^dj)QnMPRfwpUx9&1)7oiy2P)1nH0RPIEq|@3~J(fWkJrRquk*AVg$h zmH7!1=7RcdHx0V}IilUJXllEhfV+6Apn7&A5-0DA%e|H)mg8V4mT94S8nD>G=@0G~ zh;}bR?vA_0aTo62sZ_lWSj0iJb1o?RYteE_L#?Af|6t0Awk+33Z3`3G=srzjvVf+& zrTyR<0$oD1VDbWWz?SF1(IzA>kujwk3KJTZlLrVUlpsqeDmX+t3KGKAw?Vty3K{yc{JfnP zvUS49w$Dh_dHuNbKx^TOV6w)RS2aM!)T%~0N4oNvw{*c z{LsLq@Akp~PF7s)Io8r1P^);cN}$t;m|C^mIvNBvkVcSfVUS~dLFXiwes#NDA_EIErFP^!Z3uQWP^$1m<4Gc^&*v=P& zoN&A`rslmDCCVA}Noktg)L_+Bcwo1q8ni^s7bwV+`jcq6 z#t~fnDh+d9^j`eb4+Ig7o=1P}y_dv;ZETv3gXbH zwVcaG<<+M&fvHDVH5cZNA1PcSU669Iyfz|d`AuCHuk@GJ zpj)a0-Ddl8@ErPE2xgnCjGuEW*b0q>zKcE9@GG(_Up&$`rU{64a0`9&@;qTo`^23f z*H4lLwM2{M-3@ju*d*31b;YW?d+S;Z$eITn)d5@{tFG1{mDQukWdgj|!2xHvsCmYs zeI63lQqf$qbIRrVTXG*A0QZyq==LMH_>nJ&4f-ZZS>sY^c4T9*Aju$8+h|H`=E@Y- zUL&1}8OyeqaQhq5?}+}(WY(0}Tt}?Bq2MuDPDKdZ!8oRvjd++<xyiJZZV&I2Yj39$7$nw(cTrDFmqsJd4`h`-aE{C{k$NbQwm=Pvp}dZk z9y7n^%o2hxu;UPuj@}C(JZb7Pk8M;lc^<=;%3RhlCAr|MyqL5m#V*rPJW02X=mgYw z#1?Qy7A3?xKLAcvU-TK5_bN%033ZQ@Rs$3Nyc?RjVmptgYI9*c;XS{tN-v#$^^z2K zjJL0v^cRe2X)RRPQd1nZhBtKZmLSs<|OzSv^P;m^KXf}Z=j(u!Xr!U+f9M_qBmL%!H2E% z#cumDqoz57uS3xP>J#`dD*@xRHr)NS zK{;zFZwBZ{W4YFk*=CA427kqZ;_=yj{&FCR9C;wgG~99l#Y!RzYj zq9kPl%J`gwh8Z3ey=x5G@rhZ#Ebmq9iy2LRSz7qiV~i$rh8jC{5C!jF4t& z4J3FrW8%At_z?#t`EV=oLoCK6e(;Ph^pKw&6lxd#SB%t_sp5^q5YWJ1`rjzsJqsFAoG4jVCR3Noyd{yjw2;0b2~=NZP?V}OZ*MD%5eMn8 zIovsA7w&a|&n5<1;?GDmvA(NANHwMVu(wE56tqf2^Np>_)lB9|74{_4#Y;ZGzrm{e zVu$$S?O8+^VqHMtJ-8QI@uDh$S7hy#yM*&KheL~|*QU?nPKv{1t(@jBLTrM1@RpwQ=8B&Rv0R`8#>Z05e`YQf*urtM@2m=2M+)W}3CY0tUf zS-`+@zFgZ~_A(N+$M(J4{}iReJXIGX3TojEp}i=8)PBf$kwv&jYN-u@T8n(PGST>B zm}Xg``6!nS9P7cqUm|xIB=Ay`d@ZoNtFe#9Tn=Ly8C1?4{jn3jP*=r@4r*^3TR9y))}(z8$2YR%$GR#E7eFybH>6%LeTJYFGg$U?!&Pe~HAk=4&tJU@96f*XmGnqwxZ+g~r9Gm1!$;*`ON4v7PuGqYWwx*giA zfwBYO!gT}QCPHqN=Q!jyz@Kw8=ui9*7?$DiW`+WYVy#I&gJ<`9Q>Yv?MBlgWw-lMr zVfO~av}TKisl^2dO-vT7`;n8Q!%Jqd9a? z^gV5>s3O6x9b|opP1&NxQGT@%gI8>We90&m0gG*sVPK- z?W}#rYU3F{h>INdJwQppG(=X=BsdWVd08Rp;J^_?Z@TNM7mA2TtgB@^hoS<_#s1Cw zUGF<0Ue`)lSJz0{aI)OXf{+#DYX&jG2Xymag@o7ir&QdP0RfEZXNuY^=NDq^R<7SL z#k`A+=d;U=O*bB~NHo~FKABk;zFO|3wwRLA+AR}qhYfGIrF94hnH8copA@8w01~{s zxUnxfG07a6T-0!lBx^+0`HQZElKx_?T@qy!uCVI`qu1-c`Tzl9c;&5eCvv{1xjiEV zQTt4j>z~mw?dg@gWm#F=(A2#JZfvU;`7+`#R_H+ixE^AM2PEGs)BkJ>{Jlh5Ue+Wn z=F5uf$W_Y<>dYjy0<<(4Z$c}Kgl~@dYeP zFS}BPvYIoL2a;AC9a$vUG4|AHU23RZR#26k>Jzqic)C)_N#;9JdJ(}dUxd#pJ|P62 zU@rJBBJ<_;S+|Ky925F$2<9(Y=dV_?gXXAkHPObfrrK|dt;c&)`wwKMrJ`z)z8&2f za;}B0h?m7ynxrF?LY=|QqTFl3zxn2kMSX*ddCeo%jvhT)9-l6g95BmkgWI?B4F`Gw zx?LIr^HS`KuJlcsIzmKTBPwiml^;3ZIJ{)W7OCMJ0~*@^dFaBtn5enXpYFmFPGKRm z-DvFAjT$ev{ezL~j_k(Cj%ehh^jaCZmO!~_`#a5$I}jrtGr`@w$U-lP#WxLjPzyqL z#3888D)E?>*$+YD!j4hmq7zrVRCng^6W!cHx!2sQ??=5j$d~X^Y6q;~FOr*0edR(p z2VcIUJW5+)tNqL%7xjh~GupvMP56+#t&dl(SXxCQKPKwTGk7D8S_6&7fP_wRIupmC z#|5LO$-*n^8otHk4AxepU_uu+|rf>P=Glwy6Ojbd;odRS}n|^_s|F`v`%~ zfRe?HaRCd*Td(7|9T&R8h>B}oL7-V;LiWK;;Y%{@0H??rDBst9@HOI5pTv4Venx8mb{iR* zhxR^5W+XJmJ3LcXA1sVJe8c2mA_f8Fysd8t3;P>^x;Lqf=L}Nye6AwlWWau^-`@D^ zRyufbb8Rt%^d%8+{>CSmfXS-Mx|SN6q}A{XYS31-tI;k%*2J`HcnP3SqDd~ z8%ova$1baE67|j8!(Ih#zrf`!N~zlEfc4s|pay-iBqf~TWAQ~vl3zD#Y2FsU7L2F&DzWn<`}YEs^qQ$5ACw-7V`H?}+_uSC0taTuYaxaDZXI zgBNgMm_{~rhyhYVW?QMLuKjJreCzvCW?Ff1#J(qUIkI6Gz?|skOHjnv#n&I%TdGH4!gYTW^_mlzz_B z8csg^FGRNGtghIszNJX6qNbJKET?FLm@A&Z025uBntwZ^M5}|w)psHKT*eWWw_d8O z1IwLHq0^Aj4)>1!;6IzsQ?O752w`1^NpbcD^l)ZZSyOrRB#~c7!VvF8_sTj_acQ4O zW6{wg(#a|1`^KuB?yPw{57(V$4SW4+e!fdA|Lg6a{hR|QGVA2iCrU_*X?t_P2fw5U zNbQn*^r25yST*Y&nA}SarBvp--O|y7UhD}bzmWQ35{HB5a5C4I;Ya50@ZiCsS@&EGIGXA2MF?qn=rttZ=oT+A?2wV|I0v(~%7zIwcP-G7 zuncCbnZdi5NG1lfjkdRrz6HPPwWGc!fF{*oH(G7@ojS_Imw$GWR5H(Tkr*_N%D|zv z3B;cCpqHP|I@B{@bX~m91f$fWvqy3er zVhB2HbMxCh0g~DTZH-!@^temah)(qVvz)-@+2^G?W5^KDf5PiCrQKc}MXfQC8JNKs zjsg0e0Ia$y#BzUCiC9Y|dBN(}u);S_H8KZp_mAJB5C8aGfo$@)S&SX#NH&t{U`*5u zygpkP(+(hK772+_?bq&MuLF~YNVB0CxU_Lf@`><|HVT@d87PTN#v8ejIs|*o ze1GjRXRN#Z+B;bJt_r#QQ}8I4CuOrf1aQ0}OIt^H>E$&Fj%TK5FeAS&Q`>^VI@Q}1^h_RdHJe9X|2V^A` z9X7J^Ve@7=!1@6C7+H82z1n$Z?;iR<@$_g1LNM1igk{G5YKN(1yKG(Ml5~k$1zhg5 zSlHS%GxORUe;2&BYKu_uXkWz$p>-Bag!@l(rk_d~dC#A`9ST@nTR21x+C)SX_ax@6 zhSR)ZU?avY*bd+>6fD96X-ro@eEXB-`FpyPU5vuXtb)M7uSZ ztpjnSpnp80dWY7XN;4=QPC8dNjqXDKzV;iA5rO+%1 zLr{3^-hV-kS1t-Pe)Lx3M>4S+m`%_Blf!NUb7R!htk1x)w|N6?x^QVqWVcF` zZj5Ch=V+fdX7q3!8MDqrkxWvr6M$Y>LZ*WaeUuC_4g)qWN3srM{kic^iPkumgprd* zb7vQOB@4*$A2+ism)au?8{lD3px`kx_r;GCGp-tbGa~!j)0E`;_*!kfVQRwdYeWv7 zD44|3KBN*VB6hC)avIl2Ltx%z5$49aGaQ=3t#PJ9DRGRQ>Ky56Zg|lRO$R!T7!{(1 zsU*F(E{Z4yao@Um16mS$@E^b!%mog@v?mDPPI9;G-jHy#MbjrRv5CI#E@Wi>_1)|# z;=kvaY*JV9`ny$p(LNCW_VPJw9NRnJgiCO%m{g3ZKUc5c0J&u zXf|0Tw|TWA*)kWmQlHfV>V~s@9FZ*Z8r8SGUs?Fq7OsxuJ}vFx1qoi)y|Q5>rNuM`!E1b}g2tZ#aiVAScU6mL8W9s$?K`c6yv6j31DwB} z3O9(nA^pw2KZAEqyrWeTsA^r0|*1fU)mA}$`+1nSbl?XWw5Ex^( z5KzePh^Yrn8Ht~oy6-`hM;&|&4hmzz^pvILV<;|7y|R%cJ;jNQJ!oI%eE&9_>m|*{ zbOaTBYKZr=zWp0Bsg|fdyn#Tw9w|wW16nsjC2fTE6~r<{)5^a$uBW#CrizOAznonM z^!5L7_Vp?t7nLSo7R#`h1qp<>MP%9k6b9<|7BmC1R5Xmw92O-kodbr_9MQVAA}yCb z#bYeiLpPm;D|YxLLf{^LO-k)_lZl(erEx9|_!k~ZyKX@~2ZpvWrThMu#QFy<_$Y1? zDT)E(;9j`cOv5>arDZwjg0&BtYh6tzpIBl(PyzO97?9}@dFqCe%f1#Hedm%X_7DeJ zI&QbzQ8jgVdu^kpMXf>_G&@;>An`L!g2@&`sUKF8$|(I5mJr;jHpkH=#(Y?7pHmB0 znYAckg1iyxvJ|Jc5s{75q5M<;gmlz9Wy6S@pcz=63jJ4RBSmdo&CwWd`k7B~y~l7< zCk$xXsT}JE3{=v54%dI!K7}nBc-SqseGs4|n&C5uzDr7i0Et<&9Zy zCU#|RR-3zG=o~~he`X>fx^Xi)91x%Y&k^5%zY@8nKe3`$lI)oyHltzt)lTw@Q*nlx zq{z3J5E7pn8_6~CNZI!!J|^+SZx14SD|NuH3H<3M3mK!qpIX4>fgNo0+)sf)Gks_z zDn;4UQK#nm7KNk8D%%b}o6Mo5P&S*&VX;7&pe`fp1tc^}c6KCtqC< z5TKz&wip|*>hC0*TzxV4c3&prO&)7ilr-)D`r$h+=FA$xjx8i}ix>3E@eC3$y1#=) z==)3(?SUOoVgQC9|0!?~`2MaEzXK;q_pcKn>7wzW%(`^9jY{bo`?^5MnRubaF&Q#o zBRqqm>`d8uEkznV*{5VMF~b8Jpz*pZ;?UoT(*a8j0=);Q9yBr_6G-chT$P0@BrSSG zc#et2gPwssYmP53cxwOdP6Lp(!JIl$pH<5TJCMkwr_|v^VL#&y4X#my+@Txzw*idD z?Xl!VzNfu0hL)w49LHLF)7Qqna)ibkn(2a><~uM(I~D@~Voe<`{V1)Li&g*~6|;ge zB+Jh3OQW*9x`ev=>SkZ|y>d@Ux)qYnU|%J=n2?UzWy4zhsDD6O!(w(P>yP+eB&t8% z1<5p#skTgSpF5H^gl3I-1QK^fqa#&OKWIX~hLGJKJ-F2!ZEj-lDnc+j--~QL(0f%F zRh?#iYjW(Bw(+5BMX!4TKn@L^o4x^vc7S#TcA`1kA2fIvbo3~6)aDlSS&du1bZ38u z5-MZ*cWvVNE5xiVTs8@^iKknBlMaDI9m$vD<kJtTdPqNoopn#(dz(&fFfhOv77B47tC!pS1BWZvKJtj zqy#Q}W?k`(TF8E9mw3B58u{E1ygQ(k#_>z?lBg7hYrGUoRf@$orZ^0%OKfC3SVjtLLIVxX!-ZT1D^CabL+<1jYFjKEDsd3{T*Q2h+dX>4mUztQRfI&v!- zBNz%`&+W7E4RnCzp5BnlUPXxihZO!YtFoz*!kvuCWf4K-&m!A}3yT7}riH zqh2Nz#`af7%-Jiu`ke~y#dU~Of7C@K1x+&-7SrD&@JlIDAdQD}0uHvV@AQDI5 zHPrV06r?0qIa3FVuj#yYdnf!m3-Zs;baq*JhKlGo-#2FAtJ1|3Zb(YHKfmpBfW$)Sz$}89e69$;7-@&{~~u%GUKL zVjCMyLq{cnR{n{)&PeH1l7r1;VQdyBqmK2I=fdL%V~{L=r5Cq0a$*~d?B=i*Gt^L+ z`Dj`vT36odr>HJ>5nq&p$EhRlv@&u*ev#z`)GWseC6I=h6wd;&7BHT2f>^(MPEB+o zGE7VRZrfx)5?@6jm~ z-xZ=~fk)M(@7PUo#*nA$77n~;WFlFArRN;szkKogU1fwL`d?Z>OVCK~gDG5D<-O|2 zTw9ZBNm-C~;1=!6o+g-PP%dC*5Z+utmgwn}-{%P7yU83~y}NL2TINB<0OpkhZ`-^D zJ+@Ea?mms(D$#f=&>0I|)YdeJ=_2WTxQhIY08BTf-vf{~Ik`O#QjpjjQ*5eRI>Bw^ zW7wIa+!qr0=X*8QJKf-^A`U`YWlEZkfq5m89LX${{^f0n zb5me)1E?Q&Yu`(E+$z!| zdsEqNYbC#=)ho;2X~JdID?1Pgbpg{!K!Sswujdkqv&9--*n?gRd{W~&{y_Y7ryv>z zo(B0RR2d47^PXm%!}_>}L6hBbyGHXx1fy41p@>wSY|~zOf7V8|_3S{h9*RKnB-p{5 zGya9!^{ay5=M_<50ay8jeIbMheySQ^JV{0SFR;FRNgTEqJsxLsE(edXx%b!Jw}eM` z@d6Jfwh8Bbm&1u3Lq#s0^uo#yeU}0UWgoIOR*_wIJ`lD%?k?V`A9w6dmU7TLldmBG zt8{}oR?&DPKo$1STWslfUZy&CC-|IC4*T4xq;c)LMsb@=9D7ypUw7nuT4^of$_*o2 zc*Gv&JHj4*SZndA=1F046VX$XUl6<-Q|mG3pDN_s|}up4a)fsoOmCzkW{`m{uc{&1)r0pTmp1 zVpH#Q+@sX>u7AN{i6xcZbe68+;48(uU7 z&+6ZVYCJ&}#&$kvVGpd~eRY=uqe1iBS!VOUe)^%vpylD*)_WIv*vo$Tqu1)$0xhy@ z+w%LCu7D)|@i!+y^##d|et^rq5XOqFcSZ#Y78FV&ljU)W!i*(^goIpECRaYPr1Dq} zZ8uZX8ysFGemf$4yv7H@gXz8y^WS`uM?YI_?eX)`ef-1XmHpzEYBeABkIRn8{FQN0 zAr!WGg?$iQAT&d-gtS!uglEB;pns?cs~}(9Y9tS`dt1M0)2;HbkGgOV{dIqf*EWa8 zt*pWBvwwrzqBnZCD+?@i46WEp95)yAk z3^1Ai#{uQj3 z_R*zWE5!<~9U-a1Mdc4xL+zV{4w`%fVPXr48sHcXAj!~=KbPkvU;TJ3`AH4p_Z&Ug z%=d=qK;tfJlZi+0ut}KL4rvG`=HH@$BKZp9b6DiqQu1JRfW5LXnCL|JuReg0DS7NZ z^J?+?u}2i*fr(-}k;_8-Z`k)Z&RW;tUkN;FNbsK1Xss-FL6WL=1pf`Vk!h=i#_RlH zx3(g*m%J>~AOJp2x8qaOd2XbC!_0{Zh$7daw%{Rdn~*~?9*v&M`|-W_kU|d2DW!i6 z>(5*#X^THWQC{*B4U8%G(eX)adsP3r#QZtuS?ia)mtD;sMSn;6ozrOO}kav}-MtGbI|6w)q_VD2bue5O= zRlP{_-BuYe*bi#5ny>$Kd$C{NpN`uKB|`bbVZ9F~_0eIGd_vpDz86H9Z0FC#tdXR9 z0;?(nZ%T*>|3BM_%!MH8%i3F)mN&l&<6Gq+?9+Rt7q4(7#S`HO%QcWbmnTz9IUjZ`DPAvk%qqu%p9vblS`LXy=A+Nox(^zK!=w4S& zd)#`XQtDZzA)yet=rZY6`b(JW?SsYivy`((f@%8I3JeQ5p_wt%*{hUX!kgP$pW~jF z5+()g>uP2Cs{MzL7u3oI!;~^1`$3m1P7b8{lvR;cNF4u;RMw|wsaSt>^HD8V_eBb`?U6Tr%jReuy#a2J zwz`Ty>t-|uE1Ah%dL-IkCEgg3>|M4B8qeyGPr-f64-LMB`^B5@1P_&SH_PU$HJ4>u zk>lEOa+$l8d{H=?dfE54ajBl0*ui!4Uxycj>WoP1os&uvDGyW&+=}_^W>Jp|tDEl% z_iJfUOH`+@^-7#Y!kyNJU&&D~3hr!gYgJi*IgMg6gmab9VeWjqx!*@DzKHkvV0=G+ zX>|?W+8``)--JgfLf1V4%VZ7xGH_N+fYmH2^-!*dgSjI#XcC^h1g79ZJBGc4&X>Xr z_}3Ls9(_L|Hwa63KA@L+r(ioh`I&eKYFDXjSz%0@{#wGU%@mb7sY<#M+ zIykJbhJ&Sn7JU-iTtc=KZ|IEbI!wjXGB8d}k?8#VyjZKkbaNyoRAa1|I1^Qe(H z>!oWO!eY?NVZXaxq>TqhGqw*Icq%kd#*BG44EAjX%}?Z1%HyENa=88@#l!uwss}%X z6f_KZ>~|wXg;yprhwlcDIQDIF!t70eNX@e(B6w*+vTz;d?p8l%`d~HauwJ)rJaRY= zspsZciDvcS*k;c~$`Lx5Vw^1v+dkY+RN2FFmax2cukkvhWgaKEa*CT!bs|DSM6{Z# zwSVuArja7lgJoE}v^^E&1(8jy6PirrLC1fbW|`*+-pAg+eF;0C=-$rNHWCWWzwtRu z>!w)8nZHuT%ls#-W|_uk8QXP(n#6_Ry-%b)pC(^jgx8E+Z($DE?;7vP_5)kk>hR_4 zqDzooW)I)J?GX1a9ZR1&AlrY&V;+=GY2(q`CdeT5L678xEkp^w`@v;W0Z~~+eRe5n zJ6NW}<+kl?p?kZ$XJc!P{L`vtodp&PO!0Tj5J+B7O44F`bfE`R%HR?_TXRf?o{(}t zMBmNBd>M$YOd!ph4IuK;z&6{;t90(ZX^N%QKIJD&y`&HAB#c)-4dqvNclU`RtB1TMhUxA1hL7=6mhu z_qS~n4ro3CX3p97;4AQ&RewZiknp*QMBqQmXG}P*D##kZZC?{a|Jy>#&maNzTq|}r z3teHNwBq|}!nwZX(RtD)d2rpzj6&)>TkD`RE=;)ee`*H`S(6d)h=#%Etc}5@Jc(}o zRhY{rxV&Y}ef1b40nfdP*#}1Xgr?O<6Hw2y`%AysI5Up9u+KQ`?-{9QJjZ#@Yizu( ztq!5%2()47aN8DMl05=B>D-;7x9b!Dt=O{2G>0X=}zU4Eqm5HDFv|^&Y}(i=X0~jz&oz z)!3UKX!+{)>XRC|v3Y(m%fvIxKaxwhR+r75CH}H)KH4E*X;w$!s(0;4lFa641;})d zanT*#`On!@C!R%AC0c5If%VfNLk`0xJyY28PuR%Mz&_QVAzsZ*_^8 zH#+oAY0vofk3KRO#?c!x_D4Ht2^HJ=utn~LKjam!kGDMMM*Yz?N1!VQp!dRqubAfK z*}NnSo>m^EQgLu4#YjczHoi6&tn2I)%*Bn-EV&LnFIfAmewL8J3Wdcv#{`2xmva|< zc!_A_Qc%v$X|nKj6l%9+xwKu|<`njpv~rhzo-j#;J&AYRvU5=0X>^E3qjR0=ApE9u zZ0rK};qDL&6w2ZW)tYy$1+``aBrX*m4Xx5E?6*36qlIf-ZUt6%TMO46Q}giemb@)T zV>whSSfst0+$U%mRk2|x7F}rpoamn`>#XT36+MbSASPz6h*!ufLHyR3Sy?-$mkN}K zVTxR%biLP;uS@J-(Z_u;hh;O@ z(Xq;q&#H&~D7IJzu5B?3y(4hsAL8D5JN(LYjQC^eLl-*>S;RrIF4K`rsW4bg2sfG8 zR?^(JitJ8Jvry~-4*&XtW1neEu6u+lb&(4yq}g429Va0aye(N~(`=RxdrCygeO z(lAz-#$ZK(l2iEM6lO7&wdMn7{NlZ+HyO}2fO)5*8jbD~Jk1*kt#mVo6*UhV83GJi z_q&u{%RMKDciFfEsh(>pi}e!x!wuf|Vj?Z&Y$^p+b<73I?6t{_8NZ_1Qt}*5f&k({ zB@2223z+FO=~rnUqZxv-3>hMsvZ%&C{9$LrA$s92(xy|QA>d$7URZvd$uGwNYA{(T z*$k&e`S^Cv+rEDuyW^fbjpHRFmtzBFUD&5LH2H=wkcZb8aU8fz_Pgi|3=S9Ow(O_B zjHi}apK|2M_hd;kP0!um&$>4lyox@Us}3iw%Ucr+H8wQ#)p)595Q<~i<;5HqM}}p1 z46*ebmdfC6hnl^Fl9;gC;yTrKx!2IHxHJsj{PYyi4jiq)sh7V}&{P~T9_Qk|U^hFs zCV6VsdY%?15mc^IkI(4V<&pevt7EVXSvm)Z;Opg9tiK=XDKo5_>szdI$1&;7s~Fqx zoJ_kr&`0eCtu=EuSksg=>*UfGnBHw|jOwlG%N49UyYxCcXOhre;)KsK+9S=}lb@46 zTh({i2vS*Ns8;zTbW)1>)qWibM!b-`bkga10XUD6@U0f#W0K-uho&0??SH&K-Ow&n zL9jG(*7KmCAXizZ+5AfA>Vtmw-jSkiJ-6LAAD{g)m`ZLobzd3ClF+U4oSd)TU?6XT zmY+_DSn3x!A84CLWXKXf!SYokFa2?Qx-PWkc&MzB5ZVc(v`N?srmVNrM90!$s`?Bb$C zr)J1FVg#AS$hRvb#bLoG$TqA>pSBH32Q%LD)nuaJaO(7lF#?V12-If70Z0aZb8spl z4l)lFhRk=EYoROQBClV)^UyJ5khy+Pr^{9^qy9LPl(qieOQCt&Cgn%OM_;|FpRj+O z9<4*t!eOUA(Q$veZDy=GG5v9ZXjftTBavTgax20B-aE%wjm5h$=FvaZ{@l56KHPr& zrj*8^rE_p=pRrWi5_ZbEt&et6yipLH{JCu6xx@M(LypVrW%G9pp_(JQMIfz4t%x$7 zs#6fJCD4X1Klt&Y3DI|2?z`$%~cmif>a(;DY+6Io3TL!P_e zvj>6R|5i-ne5<88vUkDgwqtf8FW%9XB{I_=R`aP3pw_i7n~5zZwJ`GyWKA(oxKBH& z)ato(GiAgaRe{^=Q*n;Q`_YpL#$ye0|8(jHpGR`0MzobY#3nVOrc2>Ah z?}RFxdH)&mo0$r#?o<#Pf|9@qskL$KkMLO4@K2-GLJub#<__I6J!7|>Geyz)0)#t@ z`>jlY2}kRJe^H~utYn|BRGofFqie;Xoi@j*_#7+Bf}zD57`F0^V$dBz)=(QT{RsonF59@&wzLVz z+ngnbt&{vdzSh}pg4*}ykGLt92YAk7_B}oq1Hf~xNjM%)t?Qn-)Nyx?(}vUfJHoqg zo`zc-Bgo5$cPcj>%yqJ5oLJw8& z<=539d)NU%g2!QM(~7g?yoyTBAetM$ZbxqPyj9Nu;3Otl16o~7Q&YLt)0ahb1RM0xlP9dd(YwpHKfaP`+WMH z8dM#K*bw4H;$^c5{lTOq@T_8bB774~>61iWw)eK@CmWOcjp}J3C8 z6B^W%wqI`RW@I+F#gKfwO52A|f$ep@6NSd$AEdZ4!rA$GL{wB#5#}pc7+s&89|xsA zr#c@8x#lZ8vB`s+_wP~6ZyN}&ed3Gj4U&sv!#E~_KWyuOny=;!_<66t-0{@fOSJQ~ zF6f#R>;tzY1`g3B0DZ!Hs}7N8Z3XVFpt;Bl@bQYmcj?t%{vr)%fOg;M=Fw5VU@tZF zQlG5kkUkBsMd6{o2d8PFjmM^bzf(`ha28X{Ij0b3gXS(NkOo zwzon}rnwj0n#Ai})OJK3?-_6uDoAG*&Bni6;qYDv?Iv7L8a_cgn!2&WTh3fBbtdV`Q~ z&z6vZ$I43t&NVM*Z5sA{H=Cze{O0ptX&aDxEZ9BPV9uoFbsaw#?b)1n*hjwOg|SLI zWVU{G$sawIQXp|Ws4<8ZW)_isAEEn*N_E{&k9hf0uXD-H_%R`VVB=DMqw&8lkc78(!Z?lBIotWfxP95yXpO&uOS))6e7 zi-?GrQEJ6tbE#!v`)b(m7(PbaQS+4~Y7m$^t@dRz-LcIl{nT5mLnP;jsu zDxw?kM;jtD0yLmC)F1ah^AXmkPlkU{0}wPs>AuwE)<{le3w?jro>nM^jZ`+U3+@N; z4=QZik2i`Ek8V-K2DjvRp!34$&Xk_`PxpwC$Q;Lo?GXQU!p(Oef|S|v6%gR>4c8(W zklB2kcH0c?UCr^1lLGAr>`OR{^J}P+zf{&=@^MA^CQ_#?;xmfucdhK7%GOgqS4nFP%E5^a;w%BNRqFrISLRl& zIk}NI{z?e_?OzO*D(}}lQiA8Vw>fy!d#6NuDf|E~q035)oMp=yPbj+7AGyBSY~fRnvK}B90Q*FhzB! z^aOBST_;LG`ak5VEKjW(n-r-)VoIjgk#~Qy4=lm+>HlFLUa5ZrINx)tgIOHs#{&*{ z1`WbGJohe1n7brGJyXJ;cZDVhR&^;dGNX5~1X^;H3_H{#$_&k_{n;msn1r})u$({y z6)u&O-r-IL&-s8EDQ$bny%k^loq~T9yY-z-KOh9*#@@_ zBU2OT;#a4w&hqgsLFR(03Iv;4jdq8dQkdE{)(PIB5pohCyec4^E_GSSEQ%! z_%Hglt`p~f=-ayjIq)g)@Hz&Ntg2jqB=%2f^~KN0Ny>yWNC+_umf;rDg8g2jmW1bm zV@TCFPxD3NX9Mmj;wPczDTsytDWl>@-rwJMOFPq*V^9zWAp)}^9aD{Nr_jTmHu1^N z`IqV#n*m{S07y_kiIHadBUAsE7D$7bm7kygBbDU|D|%S3*rz0oU3~kmiz}k zS{M$PkI+E+Ksq}+W6~aqo?6J}9~9i?T@MN#6HhYxj5FMm^3?ApqVm5)#BRaF#Kf60 zBav~22z?+0wh39`ftm^KFKyfj32qv%iL4q~HMnh4V7!Xf8XockTC=`y99d5i{eLCU z$*U{?WVIgH%d@jRfEGGKOnh3w(cFig-K%CwfqShKSId`xP6XCi_=@;H z!pW1=zm6-3%VD#(zt6^AS&WE;l)x{<0{Hy1R*Uz&!Nb1H#}v*bkKUniDOzOSD>Yh; z64t*ozUvJn`~PLtfgdXu7Z)$Dm6e&!bp5BoZL}<4{wYQ7v2{?vd%4gPclrnS61r`} z(s!AG`cF7d*c`Ztkp0u&02OS#*xaMjE-d}8BoKS~|Il^TVO4F5>u= zNu`k#rMv3@hwko1y1PN(T^sbi-tX^To`-*6$BJ3AX3czNb`OXOj@Zk;0nUbw7%p-7 zd!VXR%JpfIdI86*JZK>ZD6R%6bj`Jf6N)Nva$}@Z zfhOFk0nRgx+}>92^Xdd02sULt~>j z-`Crq6`0fa;r1pPY9PC%pMV$N8oD+zUSh2D8=89Ve&$D~=1C^bI9FmQ&L`5wd)H1AC^R%G1%uV%FL^~oG{)?p2r;$Ut8A?twR;ZO3_3npnMcvcR1CqIT| z-$6Z_?%#Lka(BmJk~o>+O9#-~J<5hz46h=EeDnA3}k2Zws46yUa*ifnbDi&^|8$q}8&+$-jF zAHz=HWIW(?tzwRI`Y9xt)w`2L_Frtk_7GTzTSc8+N;MLJ>rjN!?&H)^}f>dXP3<2qOUYrE$Dj=(1524;yA z5)c&!MdaM%@bU2<-z>CeGabHYP|XVZajT))@$LfV zHIt~PGsJ;GKOxm!U7x|F`I@z`{Fg(xzraI&d=p?maP+;qootG8{p8)RB6p9xAzc)# zL|#!*q34jp@cYR@kJco9Y;9TOzkKt%GG2(#6H50|3=XW{PjmpWr|yV8vMIJ7FMpTR zn*#(ycWTO zsD&0&@9)O@9QFXG5kasLBQRuu{?w~h#r##&@2g2&$b|ije?tOJ13TiVJ%-CJQt-;} zf4&W)S9LsIN>+D0-D^n0sls3%d(-h`LFMgMJ=|`CO?1ui?-nrw`lCPFWp6dV6DKN7 zPgd19K;=#Kwdq{D)geus>%Rx1D92%EURshz)+Ft5MyX{pML4ZWNe%)rNsIn>dkfrw zxzx&lP%%l1kkwYU(%PD??^zuL^jCHD(|pDVph%!mLFyub!C>^2hgy%*r{DWKw70Pi zs#qa~_)eTk2ApD-Q=%{hnRbT>LmWv$msDx2H2N%r`{3P|@-GB0SGt_hNp2Oe& z7l=m20XQC zPY(if(pIAZ`@LKV@ra38d0B5e-wTUSbAD6+nmtu5PY-rXJ~@rC7^>6X z3bPTYS9A01$Elt`b3H&~@_qleK5Eehsv78p<{v-4Dw1&gp5GR21A``@`5^V)ih}xk zgoXV+eIoQyVjM#v0(SdF1HY2DJUMN}sIvI`R*k_d)rNQ+batf1-;48+2dnV_-sO#` zzi)g4Ogkq>M?V3&h_%t;sKlB|=n?lKfnMl|joX4wYiP?KR~0WAU7AbSlLq(^u6THO zG{oYxRaLnul3xWk-6I7ooyZf1+TEZtE6lWbz0g3zTYQDGR1hO^;7exAuIg3$<4TI_42F`=OQ2Z=kUqj!Voz+oSkIPN22U<=O2OZjjnozetjNCx+ z$b;N_?~z}Wrd)y9+uIM>_f9L8S|%z|KLzR(#3Pb0*4#MF%)Y>4HC zR87-u@9y6K!#9iKAYkh0{#5ZfI6v1QeOKv|Ln#LvbWiM0+NQjuq@=dI|G179g;vcP zYytMYQg|dJY^@*g{>3)yte4$Ov1Tw^sjsTRWtf_H%N@lEjgj?8*^vTZ; zPhJU!`-~dnUpq()vj-y85E|A54vp>8_euV(@iJw|^hdd!EdbsEmw+?n|LvcQ*}cO0 z(;Lxe;*g|lgQHy0vJOiAE=g~t<)na<+5s^_f`FK-WFaT&XU%ruWT?}+t34?3aWof- z1H;q34a1xJhJ|7X@VJIgVQ9&&y&k_unsW?kvaJ0r?`#7PAO7f0>*Sh459=qnmk)Ad z5MPF@=3t2Ox0-GslzqDYolRCXPE6{=$T`nm-uOypoVBywm>-(!@uHuU{eeXOy^Uzo zu~j8A^Vc{hX)ngp5jryk@umiDdmdrFu4nCayZYIwZ@MY7spon1(HUFFz^|YntOtOB z&)8wx5b^{5Wlp=v@DD7G>Fe^mkt$yR!h}s-ZO& zduyTxqxb$xNLO5n&Ks1Bg(rf`ySsH6LkKUs4SZ+&W0_2YoedJ6eCm7y;*)CTszBxu zPOT_i?*U)>pQ(n=``_4R&J$=9rmB^m5weHB#pyi>8bC1 zW-}S;0^6U7!O3T{h?`H1ey=ZCRrH*u36xcQQF+d#2xXGYANW5?@atDv@>I^tb-r)V z&FD!oR?$Txhjs32={fHgT2sw^+rj-Uy(%b%fb0YiA0w^Bm`FJekq6!@Zv;C)b)tDW%RU zG=Y*Kt$!fK_d_JPtVnU?Bk}+y25t-jtZ!dvjnCbEIWsc@=BvS3&JAo5z03yC4tb$~ zWFMfIjDK}0`t-bVBVI@~(O^n487-4?msV@cPpRGc!+`n2eZ?|rOI!2X>!oAwllgt? zR+eQ9mxro_l6?^UD{K_O6rss5;{9A?HeP1bpSE8)`RL|S|Nh#jxKO;q?-}`r z$}Zy{DYaSvAp&3qq;1+ST(#e}dhxGUib1Xw=aqrX2M-=-Ii4IJ`yn#edSrW@46xA| z`Q`J09?q>W87UABKn|OlnyS`=6uMsfG9AfuauMY0Y>(6pc$~<8uV3!zy}g42LV@Ae zZ&u9d!9pzaOiiU)v6RnJDSdln$s9R<73g_ZgU zOjAzt!x& zEW0fPK8LjC%{FBz*PdLN&$!86Wjv7ah2+yc;2lSbX$S7h7cX9vX*f@8u`rI+N~5zc#U)^ov{* zi{et3Mxo{0O>%yg6+eIert_FMHEX^pua#+iy=hpt-iFq4F5orUX#=)>rU)hBkEtom z;GL%uV6r%aE~Ph9A-Bda0Q=rS`F-uIuF{qW*96I+p0p&`AvBJoCY7%|4x%RI#>m@T z!Xo+bqj;mz_U!n!7a8sb`Wu`|%SoyWA3}T8u}$y!2seXf*azPdum}-X0@q4{_=C}QU@JuWM6Tv;!s&#`q#e=g|lv|9)o7SafV&hb{`K@l*cAN(2_Hf#< zdW+f+3@6{V6?&SCIK6JpnKbo{(xXbDji#>8n*mFnq|;mjNZG)BZDeGm_x+g}Gz5Mi zvj$jjySuv)@wrU1vFt3NG>h?rJo4Z3jZ2-#C1M}bC*Cm>XHfmvO5MYO&mP#Xm-y;T ziEQUnQ&=szaO=)%VvHO!G4EUBpUiTWBsrwE>b!!~sOJoP~ znIFUrhY~WPZ!vB^p=TtpeUY3tc5K_)q;L2WL{CqelHli4OAId~VNud+=$liMkpspE zo{IRIMazRot{V=@Lv($eUSo#_b0w;)Y*}+^<=!<8h2q&Rk%H;gFDmNgxxU_?CFvDh zZ^8N2!BPeEdDSTnGOUE~h>wqW*mZwJko_ilB-!Fs!1J>LH3+L;4s@F6GRe9pBpvld zaQ=n`Gn?4bY<|o*$=Qrjem_=QPza??1;!30!<@|yEW7h4B>=|3eY9EiUbxutDO$Nh^-!EY^l@^ayw_KR|GeXJoyMhzLsnqp|(;L*V!)?lM!; z(&Fm1GoMilwNm(&G+UyPZ7BwdKu8iZKu~~~Z2hqzKNfFU^ZJ0nmh6bHfqODUY5u(# zQ8u`WO651UmxrsfNm@QhbXV^n0td@B*Ob|8uw*v#AUahk+&yn*-04Lj=icWdjkZ4KMh|P5%-xAdyglk__7Ka z)4Pa9(#_L7_j(sd+2$~U$uomL85y~ePVhK)fJyGfg3}Z=t`iSmTSrXEg*sE8Jj%MA zU3p^OqDW?!l|FmcDnn=zDJODOi9x=Ivju4-AV-~Fd427#%!k3#w$bwI_(3eOY~Wore6M1;rb@ zUde#3goC8NZ@A^_s-v!O0Z|c+l|_XFRvWIc7*6~jMXO0=WCM2K42JI2|L~wZepuzH zemAEYXL{r62M2x?k>u^0=S%rFRBxxoF|CMyaUF7b@laTalC-}M2@bCfl{h|TAgQ3g zXBpR0>HD`BNhZ4JNJVtH2C|3$q{%fxJk(A94iFjTbyF!g;?Hr&>XZBnT{f~~5kcMA zvxop|$%}%JG=@gpqdheVrl2F~{&1Cbc;p?C!R!fKV?KU;;$fjY!^(Fun`C=9M|*_! zT*u15^%ZuNf)=h`;|I^*4e-pZ$hN8z>$-V)d08MlrLa*<=)RP+fNYHh@Ogxd;cc4k zc0Pr@jypICaiu?K!e7QDBUV$GV*2MZzoVXxM}MDpp5~fF$T}4+zN;S@CCW@?t!i{x z6)n4)PKOxLqn>--4J)C8r@DwqNI>x}KhGF`uydi6zLVgb4-=v(XhFYtPn~Dq4a*9(pZx+yD7Ipe8u703Cy-EvEGj{ z9>I8I7bBJTcqeQc78<8lR){Q0A(1*mA$7^mC&zLwICYlY&NQYL;HC+2Z zEv|2!){@E46TiA1^DtURCoHg$&@!0NL;~pO{jax*2NRwhJ{PbXgnMDr4Zgv!v#5RC zNF6P|V!zi*tCaYHy&P5H;gUYSeE%~i=J^b;*vq$4t^$C!pNW+_c?3tl(8gLUBl}37 zq4c1RwJIrv5q$3ff;ya?o%Lu}Z(S~_S&#vf%er(({Ny_u3F!S;(kjA2Q7~FDD8TUa zeFnSknWpqa6FHS+e>ak^j#F7Dd9Uimix_=sdS!i**YjsBw}w9!C)c4+7>sxl9q+5euLY87l7e6^Fz*Z1pFlyq>|g zyYm;&L14Q}#Q%%S2bdUoR@Xv_%C9+n-VXqJ$f)prNXLK$=6PVIVIhki75$3MoxkkT zbQjsOH-;l;X?AzP&U`l-fD^YB>iCs-OZ&0m!PmsP1D*@s0-X!sP z{+rhT%V%Pagp+^QP$)Pil!LR-C`*M)pKj8IeVk~*h;ZS_osZUjiUtO5Yt$vSGMi%= zrj5Z)g|@A*5>3!j>2PKcI{@3v4PYEogticlq-?iKO$lSc@KB;5$Ah4%i5o7b`J-E< z@^tY@vZg3wlamNQ(FNapwk1=K1n*eR`5vGQ@G>luH_?*$^TTxAoFJW`E^|q-5&FQ% zZn>n9rZg^!*P4EEJaQ3sIpL=YQ?h1ZDE&Fh4?N)zI$t-y`Oc~F;~_{Up+9VKjXkzY8Z1;G?75g3GQ5gzOzFFnz7 zwojGK?IuxvwmjKUHNG2}!hveg9_7ewe8kOA>~zovmpFVE;?%%#b2P)A?I2p;wg*qc zJn^b(b{D^oC}KVeg_LjZCwt`r`DnoSb9{_9mNU;<;i+g}qN6j;&|IWJyyqXT7THcD zOmuX=Po3PGC?d(0Fa-++3EOei#f%IOpJ2}Pu5CrK3U%`R7jrE7v};(IK|Dpqw<`wk zeIW=?EoPJA+9)zvQ5Yt@n@9MA#UG7sBgsqvRw;p49rgr{ls}J5X%WaIBqZ~B3v5!a zQ8G#-8+wAS>Qf}``fog;l2L;VIUkruqT=d5u1b1zWBlQWGMA|RQLYJw6RFLRWh;zB z{Gu1>LnRj481zoIAe{COPZqVd8!8Oe(9j@8|Ci~v9@tPMjWMx+erOMS1OAVYaQ+ob z!HJXimgI9j3Y1hd-)QDy1B(1h!Z=Kxj1gpI4`6{)In~8YI=i`V-t4b35n}bavt~LXn)q!iKlkjzw6<3CvD6qcd-1IYlGeie6Pt$xJj+ zF>qkFL6Mf0E-YOd{9fTud!L>6*k^qF)9OyzsY=M_2O}&s>A|1XtQF?n-MyvOxpJ3z z6LfF$IfXW)w_TiN)^TyD(Q`zFt_GzKpy#yhMP1)fJ2iU^$Jp%Z>Z*HwKe_AcHApWL zL+MDUuH{PRZ!5G65fz9&PI{+@1C`!FIV7v0R`bfZbfzxn1EUOOX+r0PHqZBI*D=kN zzXx>icoTd>3+1dmKUmnWRH2ckV$MR|$GOiGs`pBr`m}p(MoDh;=KGU61;praL8hFjm&iKr4f%5gzatxxC@K8{+BCFnbLR z4G{MvfAM?YSv^(=WL4dVsY(t!8O7&wX*se@3thR-6Lj)WB%+uqqXK>I$f{V+ z{#k#dcX%(O?(X9r2CrY_2aovs-Jq z1><<7^2+mso*oa&whRM3yBw?fv)~$IRnVU4NP(f=$CN$csUZvzF1n)#nu$4{Aob*TdMTjW?Xd64U84zQgPYZ&f{t= zQ4_DZ$uxaDSysmNB+-2R2keCde7bwP66bRpNoc(scj&ywyz#Z$iVQ`kzjdrx>7W)Q zDNiV=MX}z6Hz1ADac`jZDz`OwA7YFPiLyzU3n;6f_1lhtlWXV1ss&=#@Y>OVZ*dfj z`uv2}6@eQdJuHqHNCM@%*~M=(E`}d*^@^e#_Fg5&>mI&vK2?bKtr<>1w6bq%kH?cG-Qt zpUS-qs+=1Ju0Cv@&Jc;jo5K*>X7^Bo0Z%9 zff#A;o%O$WzyxX}ibV`^Oo5>2UhDbs;~u6%7BBFXXnl!@SlrlPpV7)Rl%Kd|w^`&P z#xjF7ptk~_vxpP4m`G)2@)IGzGw&VFTsC!hoq(Mi#hDS;@P&M}t|Yd^(4YkmO|&NE zPQ6VPO|j4D-N4u30*`Fdk;4pfM+d+n(nau8E^y*$AVq-8-)xqQ8qSfinwH55SUu|D!7fg%JvNN?F22*dn-G6=-3cq~{cB2}6+pCN z7gOm->GbJh)SIzZm7$GI5~yTPhrw}E9bp`nm`V<7B|Q$4Wk0)9eA8ELc{RO{gZ&pj z6NqNV_gaoJ0$tPX zAQVnImyeNF;;gT)nA?v@M=US~8^@m^FwqAyG6ALH=a`LiPMGw?1BZ)`7IgFr9)Ait z)qHP{TD-lFRU8wu-|Sne*BYayX;Ebu-0*#rkdiOfLd>pJKQkm@G~SGK zPE(%Gv(XE}3j*(HNVR1((RT%y7HMTZ#iGoUEVKP!}z0g;h>utV&nMQw{ zrWO@n^7~+?LcEkxM#$yW{a`bPDp+~r_u1KrHIqZ05O)mP0}wpY_gN04@^jwLgB)h?80Z6 zj*#Tdm~z^9mpMGRm_S>vNB+!P^CFAhgeVy8pH>8(k36eQ=?%(3(R46&FdcZ65sn-n zQzDdh?>gnFVJ*!DBjjRkx%Co+4}l|iY*HC=FdpTDVP`h7y%Q74F2k&unZnsp)o0i_ zprguIwf5Pz`7ENR8j9D2aDF~MKCau!Qp|s0`6PBhMIPMztt#JC>IL!rZ_>wuCX$t?+skB<)w3=>KAHv z8RbyI%W_5B_(Vi3MR_&52L~Wg)*J+?K{k2PqyrTF3k?DYQXy2x1qyS5s2UNdZ#0Gn z!n!#5L4bQS1=-agUYi7W00iAX3|LLKYIg&qCa>JIiDNhbmbNMYRFd@F^Xb1|=YC`2 zcofXCUVG$p$H9mHb#3Emytzk!WT^q<`mp21*8zF%(j^tei>o5=wjLGAKyG$uerk|B zP`Z&mhjw?r*5(-%hi7D8TGm?cktHYqGYka=fwP?B76#Inh{#9+JUl48f`0Sn{E5th z-lhHen7Rq6^L#3HkIQHaCjUR37lXpUcwPGd6)x6o#p#XTzwD7-`FdV^Qu+Z;fqut< zSUld3{}Z*FVJ_5PMyzvTER#C+TAy}%ogUl9dmLi}BHp>qig7#Khy``z=@G>%+_DMA;&T zanGzB)kY;0ToE(}KlN&&g~K`z__$4T#ywjW5)UF?6ugtei89sC$od`ixtuM7n0?+8 zk@5p@G!m1iMgpOT{yo@ySJeJ$G>g8oYN}A-S+Aq~(c9G@v9)HAXKxORll<2iT=n0Y z=r|jmyI;3z&(EBp>l=7o%x#ab=+1W%^IX31D-!ujc5nckZNwxn}ZHR)3fp2Yn@6$VjJ@7jPg%i%~!sM zzmNy!=4H5?vFZmu3sON7h$j2v)5U=G0b(k>pIR=W*KSeVD69Q(PNFC%v~kd|Joq?{ z9S;9N*-K%OrJS%3CO93ISWUyu&6(;0*6BrT{XH@a^&9e6Y!FK_YBN}Z&_*+`V zd$W2Gp^me%7o+A*rLa$6cw#=RhYl&{o!5Ht*e>>Xix?FNgZq;=fsgUp;x!!gmS>Fl_#+(Z4Tt zgLfcaI3v=kRqun1{dVRx`TtN7zeM06#33{k+;wzvvRfO`4O4aa`%w3f^=bGeG7?M3 z2w)JP%1u8l{LcS!5|>>_fM`L$v_2C8u+0A+Z-1$SFbHikSK064iQK_>!L#sVf(R|LT72%MC-p%9+v8Vf*DZa6^1BKX)I zBfqu?{LBFY`LHginQZ`wcSXd<--qbT=pse(i@(ld!0^642B0FqXN1+&)f+30|APMU z)dRp#EE;d$jsd)JYL@}}8$V9SP)D0u#geRL3_=`pT9zwq%eqej{&|BkAQ#)?ec|W07W8y zUGv~8yUCCS&gIvK1wpX*qpp@#4Fp)iG@$$4EJ4HSm^e9&!~k81a#2u{-w^auYdA;K zV=L7&7sOceFY8P`!UHX!1^akIGEM^^U)p}PKm)X(J7n_;c{~E)3L%o01MUNO>s$VZ zJ%r}v-JoqH3$adZ+m~&I?#TVQ>BYywTgV8!S%$wFcnw7AKk6;@B%pxJFq0Lt{@0T&(71Es1UD)N&fpdIl#BT=W*=Qcv+)u`y=9G6oMCS4JV zBo|lTMTgYRtN3l76*miU=4dE~zKJcbq8WDe;=+39^@*Sp0F0cL zk>pxqvB+#d=*`opANla)n*4c{AbO6yj78eCeCLyeX#9i7P+x{h1tqTYpF4Z%`In;g z2yi_7v_@{8I~`n|vH9&a;7#|}qHP8g0qyA#7C~{r{qX}D99b(DrtmYZL~bifUdxHu0Nik`Pg)Y2)YvETDeW%4 ze)N6VVOn|?s6zk_{E?oQZ>Wae02wU2Hn6R%X^l=$Yh}lkc~P+M{3!0+@NBXb9EJa! z%v_L4({tEYq2jodIIYc4^5e>mDe}MTW5nQLg*L`V2}1i;>1zj|I0>?8a@9V{AtNDoS!d zFy&9k{*NYuB)`n9)Dto@Iqpo2Nxi#X3UdGyWv!;phLrCms|pfL!I(5PecVb#hO(f* z{C4mhsO-4jb&}e+_l!A6J8X3qMK!>FrhqTvsO`I}zsxg2^ryplBl_@T>kQ zjJiMr9QNVSmv26^D1|2Hty-CND$b2THK#Q|#5ztmEPOe?GbLMf(bYKseSQSEaZ5y> zJ!r-lm><*TAd30(FUdMFfQHqNbiV#L zoax#+KwT-r4lkfs!Wyfbi^sQsasOP`5=!GQ=`X}!e>O5$`7n;5bT&xP7f02i9-EU2 z142Om)Bw49?F2K@cNEL*w`x4m7|IsOED+&pj;U1Q7{$mJnj!=VtPXE5_5{HrA4Ta) zpL6HLqMCs*DvJ2kL`|rP5D4{<_1d(%Gyq{e{&8<}v#_=l8d#1szgPZ+0{jJmL%RPD zCCGAb&MJo~4_LRq^%|tBQ6RfP%%~c`j!}ZphvJd=k-=LDUX7Sm0j@?b@S^{(kbopL zgjf;gR0(T9e{q|Jv~*JRsGDbhy8Q1uC!jl}!JR-&mt$V69q0qcNdC~~Xbio^dOfD9 z)9Gwg@s*HHXQZfn33mqL@OkDiSHM^VtzH1hML}`34C2pWg^-}+9 z*Q7HZ%wpXyum`1xip(d?aK@lKx_`hcm*#E{$U2bFmK24wFT}n6*QU=>4XF+uI?oPA zGM4{ABY&AI*8!KMQEsT%gw>u0mHYb#KKc6^kcT7UbU%m8mk?}kzS(U5-o<%{wckq8 z?H(QF;^j5NQP=!;i>3YbnXm@bbm&NgD*Nx|K^Mzh+*KT40#l#8GWZ`p^e+_jo6k}B zdkf~sb8_AuZBxggg36))aH;>YcAqIrTtNe*J_tUs#H8T;d%NWf20?p@i|v2{OCps8 zr3(Jx`@b}fy2#czuhV`!m;iwCl92Ad8(9TSzwp+CH4Ts=2HfFE?AV~Z;lDkP6S83R z3dF%aUd~y36;!|Ymx*S|g_2laj6OFv-vF4PxcSJ9f1RRxcYrn4;9Z2hHPv&cH<|4} zj*lXQaUbUH^MGgy%Q$sR*v@qf z#D;Hj&mWN~E`wXnY9dN}jc%XK7Ej@ZyEdli4XMcQZrq3Y7jI(cv-DrnR_1je!Q?C~Fb@8uNE z@^_Nc&@*R7aOwnfYC z(S^sZ_$iSYpslY?6iym){%{#^9q*{4D=_?*LGuCxw!1qr$n|`ou09FkHa;#Qa%c{< z@#d-}JMojsy^F%_qnYXKX>>oQ9oUx=yOpwFk}bF{HeYB@o%oJRWqO6z=c=jF74;YK zHMmZGcB(DWkMG4<@Tl|@i;P-JR+Yt#56|V>F{vbrpjw}Nv~fK=2+mWXv*Y?ahJVzC zuhAy~rS(EEIYb+4-7P+D+G!C9POjhe`9k@G`Z&sPUEfLF7OVoyTit4$t(*gz^6G z`-0QP(W9%t4=^kNdfMl`A7KGqy>Howj>7S2?x|KPExH^l?>6%>Vd2 zn6b<8Ie36h@W|{@nz+S#Ra7;XgWbZK*bz2F6L&J@JB|J(+7-uv_*UT-dXD!eGDA9- zSEv`2Cq$rf*&{{+w80r|Un!A7Y*q&R{r#~mbctj@eSH27nIpX)&kX6zIcA#}yvGZ( zp9Z}ub<7tc(6CcG8l0e9b$sniAP4F_ z4TtY$ZtK}4k3@Z5I31lE(HlbMXw%z=V7UBS&)A>BwTG;CM}}8fKFjn7=}<*rhvo&cCuEonczKRyBsHPL7tBPGm+OSlpEa zpk%$JVlSJhM-#n8E0j*>4zhjMw`Q(+pX?cmm<}H@MSgMV)DU9BzZJHd+4Ic#Ox@BU zZ#B(9;MG*xcjPd8E7x_I=D?S*9UP&h8!lVvNnuw~LF|66B@~>-YtaXxGtYfs6ddgD zN8T>rdPHfyND>;O`!Hn(Bd74HqqqBMvCD}02Juxj2d@76upu<8lkc*QiNl9GXKR+u zaf$&!9YXXnExL4d%}$!6^0D{q`lW7)mu4D@W8{DwnXti{fy#2VRqWe(bm`PF%|tIF zrZ_=swMCoKAiH9fcVpU%Ee}^9=f=%Bqq9eYLFHZIZ!f`4@1zxhNB7+>(m6y zvO@-p&^k(AQ?A82*2T7S=*+{+GtC(y#fLLOc^Oq6meNt~K35K_Z&qiQAL#GnWHTAF z9W!1HhKJ;Hb|Jxw7|oQIGVgrX=1NdGs4U*9;7OO(kNol?U63t{b^KNj>;Xln{ORs` zl>C`kxb95X&gTAPiRGz0F7XR^*eEYNo$9>ov0kx9*k46@zJS6AW60(Z;CjCJu-`KC zj+p|T*u>L7LcaJ^#x^W!p_?9N&gP8WrPe{8yS^~Vi2YqzQtR2^Uz{M`?3L@Vve>=D zdj#+R`SVo?xGKp4R+DM}v}~{4D2*@2+}kYVfK` zQDo$MhjZIf4vZ)R`X%K=y3u?hP;qmO-O9Xl-m{0DhZUFIcQ7x4C924Xt4APH`;Pc% zz|R$)7xY=8N9k68PBiCJ-5s%uqZkze>4Zg=o!?)W{cPf)i5t(?wD31B9q(3BB)I#X ztnuy^-ZFjxRc1!(J3%EgY=wCBZW$bit4 zHZeVsn|c?v>mpAX18^IqcgR`1kdf(@!3xS^q+l$+MKP)LVYXiwHfh0&#qUi{a_E1~ zCR`{Pb9;~+KYk^hkS+b(2xdapzRFJ9#cAkBwv)CI)H#3-w<)*H2!e+oIO~w24kN00 z38>AKO9|V}tn6ll))fPdVbcT$wgn=Nk1B#NwL}Id946aoT#L?PyWcE~q%>){jSCtV zz~|QW&9Q;{|8aHr@pIe8^;Dr%wt_he!hzAJwsuZ)*EMklL(+!l9QWoX-!KaI;-3~P zgkrq}E)#HwsDjDI-N4r{UgP#gEz;*29N%m0jJEAYQ#;67L&Q`rrVu?mV?3%EM2xP4 zE|N~{PZ9CFNkEn>Rpw7Gr2z1VGMgc8p6!|vGv`1!sPEnfv#CT55UZ;g6J^Txa^-u% zSv2!&=MdGR_Ew7cHVoS%kpCh$_R&6w1BGZfLjv2I^|(cMGL)0)Rmz4@8f7H?D5hCV zla5U5#rmp48ok$TYT*2GwkQwAzf5E~8%`$vvP3_ziy4K=u3!=DV6Cx9qMum{dP)|= zcAM{Bu>P(U@i^~n-KprOi1iMpT*c1&YXhrvhbK zMOP!dPo3$kNj}8WNsgB?0y+JS5M>kBcVoLUn;Nx3sM{(9FW}0tx3t&E(ciqw=-$(T z`djQFMeySS3eD;>=ZHvH@;g(`Xu%+VYO>kX1Z?SDNsU*m5cKh(l#=a1>PO}Lh4-IM zhr-2P>t!I@itqg@(c7#HLm7K&GMty#(CJD4$o!*Iv8DxTN0O3R5#jYcQ<16AVp?I- zz13dl?+9^;R|F|s=s9Qb1oP0?)EzU+e0D_pNpUNyyA|^j3y%G#OjJ?*sb&w9dL#Wo z=(zej1&!IMr|Q$E+Y-xtw#lV!uUZ~u-rdwg1Gk5BW8a@0B_4qF`r!q@p|^dp6z=cqxX=O7!Hw@ZpB#fg2pK%o(*3^S3`rphfmcw zx8QrTnYfsSJxZpNTyI(3idor{^7vxKL0o;g{Lk6QMVSs*geK{lZlm=eF@%oi4JglX zC}3&7DIpgbj3r(;X2OoO45t#b6*k^~)=1A@h2O7~5HBR#cz7GtK(b&Nk*FrC7LkUx zX2VjIf?<@7EC&^b)RYoT@j^&6y^GPqeR;HR`z7 zj}pYBfA!L!P`?rbKoNf`tEI3I+e+7!wUJ6w5$~~tS1iDeg92_3v{Vh)%)7)|37DJj z>9!8liSk6XH|%MVVcvO;HsariFd@omppV&uHN(+UsD ze<}NT@e9$z1v zgavjXnG-rysihHf9$iIQjbSNzo<$2QQH4NZrNS1!kA+`7K|y%3`mKoyU9rq09^7SJ z?J1zzX)CVED0ku4>x@{%Yodv2P0Ud5?bROWsquV^OMJI0$17?+-lEAqb}U8WKp8ri zwEO&RhU&_D-6dnfnSpMRftO@-Ugbn6exT$LXTv8KO&dnsfk|fY`LAffG@tGOC^3-$ zrht!!hX*_twWtLiU_Y5VDV|ubL_Gws7-d|RpA$(atCP`{OwnC>#-e0}V95ngwv(LX z@LRfL+bnku@l6WC>MU~sl<1rnfx#eLtvl1;U+6#!&T1ac5`OljP8+U2w3Ag1cHk}) zS&}V#9^w9;`~4DmvBPIH9~h4)qQAXAD4_>O%A@pk`B~nc7w7#nBr|1G{l)!b$7(Sp z4tK(^O9QBL+w(YuNbF+UzNN2bI^9_|0}(-}^3g>?tO)1>h$ffb3z3*Z&zV+>URBE@ zEGxV^nX-+ZV<#o^as#QJ-_e{>gu~n<+#qx{cSdgZyE;c>OnN+Wz=19S|{wm$}AnY;tBG)saMq7oG1w}Ac zLpE+o%)>}4wJF>v8GC!zrIa4ct90f$9vpud@3K@38#q`;9_T2sna#Jud{e7ipZOga zjn2T|0VL8Cs_1=@4lRq3Q#02^A$=W%wqZ47=d9ORFjI?1^BrpG@_uBBKmPR{pc9yUe4oE++Z(RuaqB~58j6#$+(B=(?!v$mX z+(vnu6cW92x1D^ECHO57pw7V;m0LauN-z$ob?L7vq%?VF(%fmvX1eVOFCy#%ciBWw_wJ0=w}ty^?zEo!&$g;%?MCk8@Ap_&t5s&v z(L#afDJ#mDD`GuSJl`W2 zyrD!E65^rdc0k=uhe_a7mORE>A*w%t8e8t0*?*m|Z@Z}}ql~i=X=S3joqiF%yDAY4 zlubg{I@igfkU8Z@l&*CU9G)59zx{^gR(-t!N0LKDe_~0D#e>F{mCQ9Uy!61(!Y0 z65*&2h9%{>_HT1+0-=^ij?0;YoWj!l;!>;?!3jI;h|?JHJ?pHdn@xy`;2xc);Ajb+ zZivR}eRqa#IKCibj?H0@*UP_kA+PgD!%cs7{r1r+&u&N9C`UnOVt8llj_^di1;#@m zJ)8a~Foii6#BBb!ciw~b38wh~tci(m%L6BBOFKIb`7r|xJLf|ULDR;S_|w&PGtj%t zd*>q)59^E+6kBWYY{L~^X4nQG;{dnh3n3xa>+i`xXu}!?xp5A6a`P@EEESj*-!sog z8b6ILpc9|%_s+xy%n#rWhf&xBTbsV=k68}ZM`*f(ua#I=6>ZQpMHz{bD~9Nd(An`d zveL(m^FoBBUpbGK^E-L7nHIUv&x{#C#+mFhkL!Vosy2DRkbTB>R&l_$nJb-ja-@m~ zI(;;^?*Y#*&n`X4#<-rXlJMPqFp}_DpmyZXD9e|A85)W4iKn@_1oBVre^|pp^X?B| zs%l9R{}lVp>n#XCTVrW?$Y-mKgW^3e8mR+$%=xipoiR3R5phJsqZUAscF$*y?wNRt z^`vj;^gsv3{f?7JfXE3Cg6bc3d&fK*OJi!NV>kuQoxMteN##8u%Ihux#wxsU=SKjw z#CLG2iwu6xAtOKI@^YwN?mEW9=U^(p7em$=ay_LC?8^GOi6b|8Z1e|R*H+a^UkZ7Y z;01Sr=7%^vkW!f)x)FGv5}=$4{^_grZya(*++hk;D7aSv6R;Bz5dlhKnSvTg`1jJE z?w2FW%7Bx-#aT5E)oq7u@$}MsINj(<8073V8ANIlkzzT;fsehx3Po8itd`?f#F8$11dj2?M9e zgysroL>8P^er7AR63Y+!PHk%yGGpZAfRFbC|9t8KB3+yjz*hw_hkc@Nb;PoN^#SRz z3OkI#FIaC!pAXaQ;jprs2amP#dbfyjR`j(Ot#)MPm!v8WAs@+e-E#O89f~u;b>Unr zyIY(GFDYr5%OCY(dXF3%2p5{QvUg3w^|B4aEi&hX9$k>(2fj8TwB{{Sva z>S@%Qy?H;8OjuyA2M+X?h{V7uzQz|peOxShci^Y(vK~5GR)UE-b)29ApZq-dq@)bP=yuO1KC9vV5b|_S zbz`h*{(tSgXIxWR_rDFII0(py0wMx-qzQ_Mbd>=_1eD&3(p%^)B*Dr60s;ckMVj>9 zOF){^A|;`B>AfXD2>I`WZH?MS> zcL4hu0zpMNx^UtxAcWi@Jr=40u}ffGp5TbnsH?hr{40JSqplj(*E_lS+}XZIp)xLV zvDrW(b=~QB@A<)i;vpPk1QOVJ)4N_LbiY?&8L3kbt$)r9`yp#OnlWJMFxyriyTV4Y zb5$Yxi;Ysyg6Lcz3hb&nQ~;dcvvR;ySp%-Zf!tCfQ`3)E^M==C#uR<@g`o<9<2gk_ zjfqj~)T8WDT|cr*LYv9LV6(3W{cCD%Y0GkLO9cDJUfr_IFcw2pU#x7%hBc9i@mFFD zKV4p)dEkx-JM=0a?@ziTV^VUeWUM@MMZUv^OGEZod_dqK$SDGxcZ||Q0DJewTw`u&DenDyLDK68 zV88E3sq@2D>9RGRQ`#@l<#``B>Q8W*`?zOBNT~dkUK34|4BRdDeR(E3>r+jRn!y0b z)vaYo13@HYuAx3HW{LUo8fKe_Gu`t=)P76rJs zt71wQ2D9LQ;Xg=-u~Gy4nUi-1+d(mvNmQChE3)cN<&hAm0Db{TWUKP_%ulw) zuW%prJLiBn}6_&VMOi$N?8+r1H7v z8O=gqWg*_tUr|(l9cd=0tbiA?DYyiHmfCDs&i^~x=iQxw0y9MwmEip3sSB+KBg04T zU!PZSC_S+BFpx7!{wpM?0V2Y}TG>Kx)5QKeAjtk4C{HFpzMbx7{K3rpmwJ^yy9C@R zktqI~T+h`0l^yaxr1o=PpEiJ1o&kr<0AG)P?G|up2CYF)AGSVsKa>XPf&PtrMEgVd z$7kwi-v2v9S34lf{2EJVoj}P9Zcg5a@V^3jk(eVgbpKlWY-$fDr-JXk_kw{y#7ySY z|M5rKeKiPp6hnh9#Ih9pKS@!q0CxkxAk%VlF?>uP59aBAODmWJYk|Yw%>c1crL1w-tpgCj(g3o}L{~<8mwc>h4Bof;%m_Wv(|OLvJ%%pqTZD2>9U{gY9YbV!Pi@!f)H82A)_g! zl>eJ_7z`ZIP8_cq?P|}1HikYBXYsMNUWx7Xe=rq6nA%TR*)OQYl-SGtz{&khh%5l>oQPEMeIPMuTmOYJHw&P_;IF~Pxcyi7 z+*Lq{grZGf)j^}?ps=^{4g^oMGR!8-)IvY2I#3Jr5)kPPFh+g_9a4iQLO=d5{vkDZ z{~Hy4I=Z~S$!U_O6Le2Q;wr`GkexdCq<~8b4WO_L-{0Q{8mPjt93ap;_|2nRPac3E zP6#;%*qh5k<=uRYKfg6~5kNhi<=YbhkiaowVC!e0TY#eK zUe+9tgYn`gNk!etCu6MXY;yDg`w^%o^{YJc zf5GEfGK}s`i$JhO;Syo42Ev0vBl2$VRN+53g}@EYV&t9w9t$xdt8LtJ%BQ0tGUJdl z28(JB{ZD_uf2ZQ(&}f6ilnrG-9j_SKv5iaZWX**Lh$_;gH$olXV*FDO|9~@si|oc! z!~Yxoc)gYb>csnvFBl{xirh$BrF3zQb_uiZcxya+(lDx$&dW5xs7c2Vv27!1vrIqJ zYf%Jo>HYMZm+7NZ!HBM4Do+0lNR@?_ofq$IlHFz=^eS^dd(d{R#8 zfY%_q2_vYc6kp_+GmvJ=J_%O2?Y+SuS9 zE=*37<0RU0dYjczz@cGL>oCb+4=1xmR-~#gE>n`dyTV3x=BP&SU%5JVK8epoIjg*F zxzYMnYUmT42;SK{rAacT{w~VkRwU!`-|L%^M zt|i3n_DnMS5r@g`8%xRc((9KU3rj~mgQLn>IlO00@{1EHH>nBF=b<`N1xf8II4etx z@pGO~+%P{<%$KM zb-hUdaLG)q+`miIT8$oAj$a=p&oTrIGj$Vt2;}Bx8_J@_%gvnV-XMP#Nz|OXQ1 ze=#23ZhPb+$Kc2%3A-<&>nFBqKSn7gDMiMM5?(IASZ{0q`{Z&1(uXBCePC!11A^st zGUWt3<=!@6fI!z_QwPS>=h_5bd?i0kkAP~WQSn@f%-WK482QXqv-L-u%j{99-T{Le zR#x3g!%8lWZP18cyvD4mw_eU2l?P6#m(DC3$(9rpvo4UH@S(ND?wzbJC#$sd9bY~4 z2hh?K5S;TDSaX&+XS-wUnNY993aZC9-f8iW4MJ80*^6Ef#;A_(rHoz|Dxz{MnSfzu zrN;jxaIWG`>a$58V5>2yT%`6&WkW|IrVSFvvws1I;f zKTFReRD;HVuK~M58<+k9Z#1$G+m`&4IaVtq#

2ej~qOnZsdID(!hAqx87abki8d zz>5m=C+M5wmw{ZK1wc;oOusVnpU~pNfx6UdUCsvXjK3=KNz{EJQZDoj4t+s%98@R3D-*{QmwhurgnhEjlE}AuAY__(UJo z`gV?7!{ISNjh?!=n{i13$o5^%Leu4nFgxgiLI7WVPJ8Vw!&ioy0^lHRR1|mUfz6(so4bCc_&$WkW~Mm~mJ}b| z>(_UhUy!%do*ZeM^;*`t6rp`Z;T0TJJ>2%~aq?QNJYttmjSZN5ufO(Q7S`^!p|b15 zk%H;2y^MFB*oVc}$nCBMd#AtPSOf7X!*{@Aj@VNKK~UvKCzZ=5VxH{9uTC?(W|5Yj z>N|2{t~N=!FR^t0_1c29iBx9p}RirDc~`}XURz>(Wo%Da(T6&z3ZIO6TVv$GtGNj0S}kV-%8rx9YZAW zj={pMFT4PeKEW3JUvR%C+^LBZ$_W9obKM3^+CWME_{7BXh3db7CR?lr$qs-S_T0j1 z3Fw!t7U%9ZYn^rTxXK-w4w&sxJwt#hA62*zCH2|+bg>fZIzhNQO=bo;TzN9$EZ#b^i zV?0{!Vmt za0kM-)UWk<9-G;IfXj8c2xcg}(Zn}kg+#OW zbbbd(Vy=PC<;HEwV!Wrs;|ZRa%IQqPK8EbkUuZ~vlP0OwR-)rJd>(dHo=l=r*$eYj zao@67K|a$SA_echwLr)o?GTr};%&c!9*hjM3q z$~g%cejM&S(qzI;FyX&m1K__9R2sm4A&BDv{CCTOw7UgEPIh8Qtt_VyI1%M18J=MKyok2t_#$F^3 z`f^MP_ucvRrpfL`Em$JVMs|6>OhCt@iSrT|HGYAAd>I__32%**II0v#W}mxGFoRwWBe*QAEaoBXOqF0Q8l2W%j= zJo8kS86Y8l9RDBbffO@%wBc@xh?IN0#UF#2q8MUd9f}yLD|IEhD$$g*Gf3{;R2aTE zf*Pw*lW1O;_jxLnID_Qe2$HF0{^zK7p{fFL4FJRqf*zlDqq#wT5Xth%AaTQ05dkD& z1HHI|;h8P#w;(MQ8uh>@l~QwE0m#@}5}z<~8^N*N&gnhx7$7mqE4GSAgEpb5%LL5+ z6s*cK=J#KR9=PXNE(LcXWnGMbC=BHfk;y?Xzn&psX=l)@5*SZSc`gp8x$~HPqH~Q? z{G1~{XecA{l1#AYP$!HD#pcMc>KK5R-mSl3g}ykl!A0KH8hO)B^Ov3++|YW=Eh#Eh z3en|odUtUpT$&2rnSF{Z*x^dpolYBS(J31JN*qQ{?u!~FOoA}?Wy$oM2Xx79bB)hh@XE_!wxn_o%Tz@d<>gVsX2Q!yeR-tDezaOMh7N{uC`lq?f! zJ<}w{+c{(1(DKzwXf*lj2%i$|&%%sTZ{sRqSd4G1*Pq%-Bo?aJ51v}>m9s}#JYR_d z7PECL0)6a&=lpv2obvjgD2aJ`j5uy1N&^==gIIjqFOb>%G=IIF?U5JhD=|KU;T5t= zTNft$Sks+n^QxkGT2M;Dj(vN!&00Cg5BzG(Q|ke{^j+0C67g0(cd+e@#OoJ+^gsD0f={W1?xaLP{W?=P0AD*R1iRvVMTt6+rO^x$jD>UQhUT zR7x6jaNp)a(8Nzq{rn*+?=R`TdlUOcmPeP_&?~Mp)yl_;JD!^X!F2w^7I*1_L2&`= znNWo^1mUKQkC|MY?CQ0O<9Zuj6CIh7oyWBHw;yDm>k2={_71a=6P;!d>S-oie=Cfb z^h#IlOMe6lCzOwf4;b)kvHNy_7~b48i_Yu3eqrzW`^w=-nz)IK%$MFak z3r879B%e0U9dfHJNxh;IJ6|8hpm?-sXvwdGmyBG~GwQkQ59_s8Oq9ghvh^%0l$tFd zR#-+0ZPMcV?bM`vNi@AVCovQ%%F4&-=~=l3jsq;hZPFmP1^YzRYvf+9$gq19qu~~j zI!sgmaKi4W?_dBiZ?ZTWU0l|R&C`n4_{)-f1YVoeVb%$b=dOzrPZ`7~1$P{_`+WnL z=#&b+RDRj{*3B?1n%})|ljb!AcrBG2zhOiJl3^2%hn--C;tFTT?JLM6*DO~2nIhUQ zRJNZ|Kd1YWSO*2T^RMO)u5#)xb4;3}PX@aUc8p!=FkU)gt1HN3UZbF)J|IlQ2Kx*u zn5N5Kf+=FmIr-=PGP}Lc#p+lKGEnmaCg<#nBoXr7bg^D<>do4maTof$Tdst@;g9VM zwr&`@LEIk$BBet%YFu-E`Zf=+w+7Qo?!pXvDbnUte9w%5+bfWU=?uew6tu#N9Zm=4 z#i9_T#+cc|j>dzvGd^nZ4?kZPE&=37mR?#2Y{cj9YxBp$^m*EU5YAc+apS&GG{;f8 z1%3+ejlN1^HIBQ~UbD3TD@LrI*^F2KDn-)VA5>Mq%>mi5yMrwt7r~DVRP1eF?{a*9 zF!HPjkq@KbmJ=ks{kb27__NHb@HM+E82A})e^wiK6TNt_#c{j(nK!Am(;iIfc2^$N z-Vb+5H($xdI>9kZRhiRs_lk!k(=+W_(0C4G@ww&v%3@eaav~+p+L1K(=)jgjaoU7_ zd(B)!yNV<2Ab-#C>4ees5@qj2=YkQ^o&fs$m`wW_w^JaE)~9>W-Ru17_6dfk5!YW- z2NvcO5Rx=yfr#y6d1ME|W8EZIfCzgN;*`#2#L|r2>!v&q629_F2g! zz9B|yxFGw=s}gBL0?7AzHBmamhAW{s%(~TCjpNxRoI8kw*2WyGEzH%0a&omm17Qg5 z{cMI~A@O)M>uoTjH10znf;gCu9ZxR9dSKyA;kO>aqkGFDqJTySnDzSXp05j!_)(T{ zy%bmNKa_5b)9Np>3j3M6tRDj(hm&Ve9=LoCvHdaHg#8{1x1n4wS75=Ks?J{q!Fj-4 z$T#o7_RSHf=o8;iYg?==CLnc>0W7w{^(ZKrfuknP_3x>X-z30>DmZ% z?czNyw!62{A!0LlzDF2#Cwq#%9i-dR6c(H^36)K7FCiglQJT2*k?kn8(qj#P zKDup+Z=Ltr)pFgdW04}VV*0^CuQQ|kAqQAh9+)L70BC1~K$dA(?`9)YY}MxX`i|QV z$>GsrUpve))8Vo1Scx^p37I1AuXc(>W-Ezz>0>nJ;=<;wlVQ6BxH6q85I-<@^i03F zU~$l`*^-Oo0r?A!#YXR-=%AF}l0m{fFvoHLo4KqlqYLmyK=@&|m8G9G>zLhB2L1dZ zvM`MNr`YvQwd0=M(ulEccl*7R^vCo-l`i6*TlN?C&%iMg5`U?Xn|tMOqjvL5az|Om zHZbC3rlagjqD{MVoaAP>wAW_^^Eh$JgOEQ!HUv>0I!$yVG#c;+?TCon{Y=c^^$fq{ zyOLYhoFcBkk~K^20-Z8R3)UZgZLWW^AEdAbBK9Xrx!xt_ec6-6Ps4{&_Mi*}SAV;d zUkNU?fsl^%%$bauIoEOA=%V@;3O%hk1&P)9gyD2o+&?7dc7sv*e$o$XR<~AgHNel9 zZ76DiOq4$C;!hd>{=LVpT7oC&5HGiUq}W_zKmtD50%Q$r&+?o)0Hgp?ym|W#9lelK zEYgk^w`J0HSHIUMF$9fBx|LdPP{j=Qc7dETY(1HgW)U$cRLUtqb#~5{&5hdv_%$OY4$&0r0NS}Dgh+?9;e^X>gn!e9 zQwaR64G*N&CVt@gOu0@|t z8gZ_S@1fvD0Q{Ig1DKvHleTF+?jTws{smK`u#K6KPI9D$O)EG2qj2y+VpO48M++ZF z84ryc>}LwV+KJUeIVS=LrGc5ui(WS>TZ4}o=csJ`@fX5Cl4He@bLicf2V1 z)r_ZHeh$=>oWz;nO8kIL`xh-c;DiIp1Hn)2^T(;O$k)p4{N8KtxPzs3SloPNkoYDO z?0eL-<^~iG;-`XaG}9^qEtRg}uRYgOxL zTN`s-bD(N`Qd%3uVr1uU{>7$ok}l7st@^s2`6ly;(v`(C5Q;h0iB`lE$Qv-IrU1!E zZ5aFdChGS1%ad(m2le9xp#P7{g0;GgQbIbJ2Kc1b&1V>3W~z<*4`q`ZVTi}1`mx=+ z`5__H+IoL_pDKJ{-XnLo`mmUNM4nmaXPCe{v663@Crf9)Uz_5ibGV#BNU#wcRGj6_ z28%!Nd`fKd$O9Gc5`FCx@`ZNQ0!ro$^W2jqPAU<)?(V}%B7@={*%K0JzWBR)7O`4w z_hhK5JQqIYBM6gMYpE3dLp=S=^RG|_ep^d3?8k+#ZTEBE zhrFilv%dhpCp^l;pw)8i@nX*MiMj6tShWF*iOSAvb~TrPDUWtM$e)P}Mtp|0+&T>d z3kt!~;HF*RW|Hv*#mH;I2?KZ2K#+_TU?Kr7()C)PwjIfoQIXzcA&{SJ);<3E=W zC&MJ(;6Q#x6aQR!~`DJ$(7q2v#ATS$g z!SKoARYNfu#-6qExk!se=!BUM$60jUYd-DQ!BL`_3c#<6(bJU^;}80~*GH^hZ+Ou% zoyk$Abs68nWZVR~>U(#2KvLL8fOYkE(c(kkO<3o=3F-P$IYr?WY`Y`C)il@}sb(`3 z)gaJC9SaX~6MAJm!ZJPu3D;I_e)^5a)F&Kdtgi$bTdj^Lm}L0xx>E4nP9a@fa=K^X za!2La-rbuR&I%7D8V$kP^4zjgRT@2jQD(7@WVA0@^xjcSJG8 z(NpTr$JF|(D9xCl6dVUqR*8#*@j=`-uMQmIs_s2u3`OO%rhvI-;Zn8HKv>V-6yAu# zb3CN$`N$;!} zh31OR&-<)?3wB56KUx9ImkP}t=xFhWn0D`_0GAAepvMEMtSh&?(M8!8o#IL=%yb@L zR}L@Vp{fGu;FNsMyYpE4Fu`eZwv1`0wY}HbMx9kZnIk^vlpru+ zKu(4@1I5J(kF>bLyr<1UBo5+X41lZ0BWv$k#JNVidA;OSt8s=0Y=X1?;{+!>5D?`+ zIP^#vNnT+3z|m+1Z}C@hk*34RoNX^9v@2ZZ z6yvw7G0ZqavRj{U8hIhKaYl=fm8)pBLH+K>c}9f@9kS<$z979k`xT&UY;cBF1oJ;W zgEIu!ojtlZzpT$qlW>TiQ6)3v+^gnmQaDMfvpb>lUkHkoV&8jY7M~Xh(W0yKx;V;Y z=o~;;J=nvL^_Q|eeM0#S<4S)*cO9!r6Q(YO+toVb(y&ToJ&doe=qRhq~T4y{I^CjX{?zrx6G6Fk{z zu3sG+FKRtFhF$jZ-}_o?@ap?U7r&r;$6)X-Czsc?{3E2%l^vEdbOM7{rxc~gNgKhW zAUz>JSyhZ$B3^BZbcV>5>S&aSW~$)ytjMesmyVR^7Q zwO%v>t5JT$!>WAlI8h-_5Pdn>v0Nhu_5m@aLH`kB({qEkV9YxX>ozPY8bjrxHw?*G+jj!L3{YIk)whf9% z?&-R}-ne?a;=Y;R;W^W?5UkyRQ=sRZf`0ivZ)p6@J;Ne%A4LriO+{*oqUsx2c#!gpeLmo`m`Za1E~hWrKF~eWJ< z21n#LW0BE+E}wE2|5IY-0~F(Y<;`Ij+zVKN%w-+d4Gau-%kH#?;qX42Ru0)89Amc> zyOz3Z;L*ahCR)V__7^Kyi-+uwy35U#EXnkJh>#b{(RNJ%;iS^3v$rBquIN4woYUH^ z5k6h}r28#qFBV+a#T48#_YZxnR6SHrQjneTU-SWC#^)87UDmt86f1aYxFObJMh4~b z(h|h$ZM#Z41tK^^&2l`pdzR07{@nHA@{h=#G48FLpLrI5d$TuYsIz=gjSRD#i!)^J z?2^sA!sX`6^qF-snW3y=!iL?urT3!J$cO3n`0dc|58GeZ%!jJoY(KJuHPW>|Sp!B# zgeMy=c(DWr)au12`}r>>n9UDAb+7!IvmI8(9NKCoGj~)WDMc_l!_~s$QCAp10@~ZIFFFSQY^f`S1$&@xIxx9~AtY4{i$?dA_zIiuYCPleg^2JZ%3J&$ zd2pxs9+A=0XU5nE-4G<1(J)lw>}yvkBB57$JH~fwqkm-)W$ArSs=57Yf(&9x2Bae` zX5F`ziLScqWT`ZJnL9FT*!*dUgqc5cRC7RqDO_jTu4K>d;yl&?#eZ;q zUi;gg&(UXl$LOd(uNVEuj4p5Zt{ZLZOqqsT;OO}@4n|hNkdC^5moJxC<(~5j`>V>I zS&L2nF|`(#-7aH?j1^C+OA*-v0uMj zBJEXNF?w<7)%cv3K@oL~cSKD&S4w@(fR5%+`DZ2a}f>(b1ZEFVga zvuD2xqnUu9H12Mq$}@W$MS}aH`xQ6R`H+elFq)QymrUyj-SNYw8s&VDe!f#iIPQnH65%b6_A5NtXp=W#ACp#E99}k z797738w_{LKQiS?-6wTK_lpyaOY$aVX8>j;Z{cI*CD^Q-YwEM81qqTiIk55r3lnq` zaDmQY>pRIXHfbng!Q|i&FkSu}df@h=g%lyfqN-cSzqpqrXg2w%8A$T38E0jDDFg)Y zRzL66ymJ{?(}GXVbPg@N+(Qd5hDsY+XTSwXcYt_u^l?okjY7jtL%UNQIl#{EuER_* zOO01_uSxc@7XR^$d8ogd*C@F_vQk`RJ`P{PWzwq4=vE^eZtnvJ5$RbvLf1n!Z0??C z0SV4o_1*f-d?go@;-wcE5xY#i-rIHwfH;@Ws+Rd60^IiMLZ$L_5_o2awyU0w`(z6p zV_pBG)GT$gX$w0y(UQ%Hi#fIV`cRxHtnR*1yO$z{Vz7T{#m62&I@>G5DqE~X7_#+< z*R+Vlj8yY1GlbljTYm38Fc|O4?;F>fu9Vquhj9S_r#|b9@__X29b+Yf_V8t+np)@A z!$~arQ@kotJElSfn&A-})atH3J)Qt%QOV$|c(oLX5kfjLh}vZ9##X=K3tlMyA{9Ts zTFAgcw#v@3QLFB+<`_sXnEm2D0GFhrcj)sZm0AHVh4!d2G*0V)cl0=r14!ugNqXVJ z5(u2+HBNKyY#x3Pv^D?poaY)u8RXsKqm`4|QN1Zrp!=2jcEQXA#L)16{2fiK#@Q!p z1ocf>Zi-CD;SCwYdnt0k9uo|CT>cc1Ek%rA&c7H2B+vbiH;S*HD!%ySZFaJmm=U!!%MXsG29-fcLYv zZr;oifrD+>OgPF8V?dRqQtyAWR;hn)8!UAY6XM$aZ{H8z8XNHL6<(PJT8DD zIeYr&6}*t|@Q3<%WJ8tbM%xEA482IvPO-w@EjeGXZ6&Hi=t7wGoCk5)aKUw*7Q=F> zuCIf`tn_)x1;MYS+}83FJDI>1Dx_Ct&^do$w`rwr>&3EUZCB8>R>P*VqLmLKL9(ox zZmGpYJJHx4H>xTC-vu|?K|w+DE%#=gQ@#!|X%1p1O5$naMHi_hNj@)taEec8SMxm| z@ZS`H1sFuW&V5fIYJ3A88Z)o8hu7vo)HzSKCe_#I5dcyS3%)l4hN1EVBwZ=Tkcws) z7P2SJ6Sg9c?uWC!&ZIwpILm?iCFQhZXN(DlpAJHS-B%5uOqUGDj|aVZV+$bRwzhQL zdVqQUO+g>Ag%yC~79<0-VI-1KJ7VxUOoYn0_~+Gf#X02WaRt%)OGs0K)u`kW8MdBCNC&Dz{VQNmPQDdZh0*BNnX??1j zQ#o$VrDhbf5u){wNJ7>KjpmZ%(7E2I{v+CA*$6936;yD=VRfcq+(x!_1mDMw0_!7v zn)HuY;xazD=LGHF*(skc6~-UQ$1@dnU}8NGJ%0$RKD6LZqX9uEhIO?K|m zl93TZ?ur&5P_Cn|mP@3lSNhmFJ0w~Yp%JI6xar_TwE+azSxYLgvmzjuQ1S%%)S`5J zU@w6a%aroxgM@bpqgC6f8#^+17Y)s&HGFnxm%6-t;Qe~_ZVjxkjSwo^%u3Q0+IQUk?;#j2cLGlfM`J6z0>a zt|j|movkQh7OT!&RpzD?Qaoi9JV}jtedr;hA1K32z0+kk0c`4Euz>2TZck;6>hn#a z270*o%bfc&WK!Xor;#R0R7(P?=z+_(I<_1QKPypQ8KF6H`uHNfL)5cp&#H!GU&kIc zbRx^J2pATXNGv%HjrBkBQMhpZ1BEzkS|LU7&>7Y$QIDleo6u)uR)=`j656x|&&!3; zIf&Hg6y@&&De72rxV^-Y+woh86brm}s!kjeJln@MCIyet#qs-F8g#<@%eMOqwoGhd zhJAjPo$`oBl~8TR1#648LuY4LjfEAZO7_&jWy7RE?OGPY5p5&NiNHrb&Q>v*{x>BCK zV;4AIVZA#`be+;7au~yL#ko2CB2<~&qq;uWyfvKfp{$3KL7VI!NlRBclBpH1oL(7H z&_DU3^beYY*^Od2ac7bu3+x}8!qftai?5C6Oj6(QJ7^tavfm8%H@sS|dhTtKZ#Vuz z_KY5OM%_jI&Cr>AVg~+{rLY`*n4g{ z*?}&>R-*Rj(tkVh`Vu2Pp)zU9U%_l^iAz*b_WIOjZo|S6?Kq`ky&O_B@6v#4zr_fc zM7tW5xq3~RoE79AJC%2os^U{KFvNJFbJfFA*ln$DY>Q;xpeEEjLT{u4*eCtj>F~B@C8Z{3<7Ocal2v<0Iqy7fi_K{Th4@@x97RL(6Y< zP1&_#U6vSU=R2&eLf2(FQKuB#U26_iY}_Fx2A%bbS0xAfefA34K!@$W8xazDioX>0&FsGS`%4q}tuH{iays+D-mu`b$iXsAuJ+CMCCC zC0{#b9C{yg>3mO)=~PH~hIb35;}D-@x97*=k4c|(d{Qi0jEUuzx;n)|cPW*>(>X|t zUS@S>Q#NAS(QzA32OOhnP)OW*3^tyM%OQo|&*-S2F zrpF1SYBuUo-`@({Fzdy;D>M!L^W9ySitVHJtql9~J?aVoA=5@t-{wb62M!52H$N}G zj8#P-%(gP9T2I;0MXmp36T{SB{-}Vj%a`Y}t-Q2`J!j0tR#{?A~T&;C5hWVrca42~@AH~c2 zsoTrkEA>gg^Q%^lxs{bt+{n~z`&CM{BmrIguL4G_CK-6ZwVaZxpSW z9)rx_%R>)C!4o07E8J;WbW63=&C#kgLpj?aRRbrG&aK1ZL`0yKp(SjYM=(%`oH*f# zMHa@3S(X|p<7{L!2X+RM#{}}BtNY{zpS3AMCau>f@TZsJ; zy~D79TAUZ*2=oKiyh-xN^vLUe=UWjE8n>8w&0+Ameq{FI-YayLGIg7$Q*{YnR0h;| ziD1$FtL-$wh4{pg)(Z?ZSzDMnrD6Z4M`$&xwh~}^Hgo5pGG5~r%(s7cjnZdvfGKkiXpQTVZtt%Cl0Hg$v-H|@(tt70vCa|?9qTGC#2 zz1@zGKR|^tCjc-y+*L_ zp$_k=tZf^>zs)G<*lw9Gp68{(6=j}8ceL^McLao_-hw7MSP8g)7+`9!K89Z4aaDhi zuBn!GfsI8vCPD9!0TaLx<>6|(51v<$xukXBq!})jtJfx= ztuHPe#i#HDT3kRIsNSP|O$DcVa}hjo4s3*kX#=2Pu4^;lC$YVr6s%DNDt@DVog0aT6W#)*v8(L>_-*}sj2d_KR z-dNtyupQzF9C(`<*ZgiA^CyXuI{qR`X8|S=9-2pPdoM~@OG}=b-upgUjOYEz2aC`t zT<0vHzNn#JNIu7(VouJ_zv!vq?|vy+^q8Q7JPJkL*_as|986)zHBh?=#}Ts04kJpb zt@>6~H`a&Bo#hN>=(KM4td+czL|GZ&n#}p1IV82|>K3m|_g=(V=6WpD)8=O%7q-M| zg`O1UD||lg1u}n8P`p2NOpwB(JrY$NrPX;UTxC8-)8}%{AdDh3)HV=*xc~cQ4Wemf zK_)V_*hpcqT0VZzl!9WF{gDr4?F;4VQT}j@mOk5Q4Iip0xT&U~K5DD!gYW<;+HmPz zVCct84I@AGCsD;k)(P)SZ9u??Ak&f46cSgx7Gge1<}V;gW?Qu_R z;4FJXGtgdy^ZgN7+0xj7+)K`rhEc`Uq-5x8?*qZt;$1fvkE)WrF9W@alGo9Z-z$F? z<5C|b^t;*=i5JItYTat!wEhjp(K!Hf!*1N*&Hd;XkU&Y{a}R`i2*96=hGxBTU&10+YE*2cl4dlYUQA$43BpB57RBS9N&998Xo&7 zF3S_AcC;AJmSwdO*=X*#0FrrpgPNTvfqN#PzigDp?Z)72ys_W8BqDUGvIy?HkUyIZ z%YyQI*e6j?`J9mGeui<`I$WRc&(_y-j|hGd2GvLHws_vYzNP%p8n36{bkC8_&U@%- z-oPPwRzhc#Ki7HZ6G6ZRnNf+>YXb^?l9OyjWZ3fH+gbsV%lNjeBa{ zE#H&{S12h>NG2Vk@L7ZYo=*!#m*IX+Pj0D7-)O+Vq;wUnS)Hzl3HDz18Ki^r)me59nFZ^o&&2$ z0l_^-C4-FnsX6M8E#OGJ8kj^t>v34R-aQ`@zr&z zFTl*HL1RKoVmCK(M9>_f-B`7$=Vv*E^ z3|k6{F>CO&T6WMsx2gxy4(*~9AGQfns zAw#eFTBx4BhB1>m^VE_k-=y?>CF6|nS1{6%U@qcadwKR(yZbeyThs07Z9T6QR`qK! z!nyMw07K9f=GnyrVrqW}PZhjnRS4S1>(iti(WFz;-v*K5+U2`cSl4l1C)^31nmO}% z3b{4Jw=-THEYQ*b%4?c~@Y1>L7Ao2^Hu}v}8rvV_y^>C-EFWN{ptwW}9=W=d{OW<< zFnNFtZ&#sq%Ib@1`BbIq&NnMCW_|-R*VrjJx@K$qRg#6YrB|`q?!0?u0~mM(S^nM~ z;6X&GN_zyDxV1eWC=OClytxBr75JQf1}qKu2p$420UzVT;9=lX`x|I;@bNhT#sl=Z s2<8a%uiXFtfdB7pK)pRUy3d(y_A;Q$ZW}By6ch@w%75hCGk*U60Hox>nE(I) literal 0 HcmV?d00001 diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md new file mode 100644 index 0000000000..2af7fed5dc --- /dev/null +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -0,0 +1,329 @@ +--- +title: Deployment guide +description: This guide explains how to successfully deploy Windows Autopatch in your environment +ms.date: 08/24/2023 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +ms.reviewer: hathind +ms.collection: + - tier2 +--- + +# Windows Autopatch deployment guide + +As organizations move to support hybrid and remote workforces, and continue to adopt cloud-based endpoint management with services such as Intune, managing updates is critical. + +Windows Autopatch is a cloud service that automates Windows, Microsoft 365 Apps for enterprise, Microsoft Edge, and Microsoft Teams updates to improve security and productivity across your organization. + +A successful Windows Autopatch deployment starts with planning and determining your objectives. Use this deployment guide to plan your move or migration to Windows Autopatch. + +This guide: + +- Helps you plan your deployment and adopt Windows Autopatch +- Lists and describes some common objectives +- Provides a recommended deployment plan +- Provides migration considerations for Windows Update for Business (WUfB) and Microsoft Configuration Manager +- Lists some common general considerations when deploying Windows Autopatch +- Provides suggested business case benefits and communication guidance +- Gives additional guidance and how to join the Autopatch community + +## Determine your objectives + +In this section, details some common objectives when using Windows Autopatch. + +Once an organization is onboarded, Windows Autopatch automatically creates multiple progressive deployment rings and applies the latest updates according to Windows Autopatch recommended practices and your organization's custom configuration. While there are options to adjust configurations such as quality update cadence, the service provides you with a baseline to begin establishing your update objectives. + +Use Windows Autopatch service to solve the following challenges: + +- Difficulty developing and defending update cadence and general best practices +- Increase visibility and improve issue reporting +- Achieving a consistent update success rate +- Standardize and optimize the configuration for devices, policies, tools and versions across their environment +- Transition to modern update management by configuring Intune and Windows Update for Business +- Make update processes more efficient and less reliant on IT admin resources +- Address vulnerabilities and Windows quality updates as soon as possible to improve security +- Assist with compliance to align with industry standards +- Invest more time on value-add IT projects rather than monthly updates +- Planning and managing Windows feature updates +- Transition to Windows 11 + +## Recommended deployment steps + +The following deployment steps can be used as a guide to help you to create your organization's specific deployment plan to adopt and deploy Windows Autopatch. + +:::image type="content" source="../media/windows-autopatch-deployment-journey.png" alt-text="Windows Autopatch deployment journey" lightbox="../media/windows-autopatch-deployment-journey.png"::: + +### Step 1: Prepare + +[Review the prerequisites](../prepare/windows-autopatch-prerequisites.md) and [enroll your tenant](../prepare/windows-autopatch-enroll-tenant.md) into the Windows Autopatch service. At this stage, your devices aren't affected. You can enroll your tenant and review the service options before registering your devices. + +| Steps | Description | +| ----- | ----- | +| **1A: Set up the service** |

  • Prepare your environment, review existing update policies and [General Considerations](#general-considerations)
  • Review and understand [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
  • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
  • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
  • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) completed successfully
| +| **1B: Confirm update service needs and configure your workloads** |
  • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md): Expedite preferences and cadence customizations
  • [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md): Servicing version preferences
  • [Driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md): Set to either Manual or Automatic
  • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md): Set to either Monthly Enterprise Channel or opt-out
  • [Microsoft Edge](../operate/windows-autopatch-edge.md): Required. Beta and Stable Channel
  • [Microsoft Teams](../operate/windows-autopatch-teams.md): Required. Automatic
| +| **1C: Consider your Autopatch groups distribution** | Organizations have a range of Windows devices including desktop computers, laptops and tablets that might be grouped across multiple logical or physical locations. When planning your Autopatch groups strategy, consider the Autopatch group structure that best fits your organizational needs. It's recommended to utilize the service defaults as much as possible. However, if necessary, you can customize the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) with additional deployment rings and/or [create your own Custom Autopatch group(s)](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group).

  • Review your device inventory and consider a representative mix of devices across your distribution
  • Review your Azure AD groups that you wish to use to register devices into the service
  • Review [device registration options](../deploy/windows-autopatch-device-registration-overview.md) and [register your first devices](../deploy/windows-autopatch-register-devices.md)
| +| **1D: Review network optimization** | It's important to [prepare your network](../prepare/windows-autopatch-configure-network.md) to ensure that your devices have access to updates in the most efficient way, without impacting your infrastructure.

A recommended approach to manage bandwidth consumption is to utilize [Delivery Optimization](../prepare/windows-autopatch-configure-network.md#delivery-optimization). You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages amongst multiple devices in your deployment. | + +### Step 2: Evaluate + +Evaluate Windows Autopatch with around 50 devices to ensure the service meets your needs. You can adjust this number based on your organizational make-up. It's recommended to monitor one update cycle during this evaluation step. + +| Steps | Description | +| ----- | ----- | +| **2A: Review reporting capabilities** |
  • [Windows quality update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports)
  • [Windows feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports)
  • [Windows Update for Business (WufB) reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report)
Windows Autopatch quality and feature update reports provide a progress view on the latest update cycle for your devices. These reports should be reviewed often to ensure you understand the update state of your Windows Autopatch devices.

There might be times when using Windows Autopatch for update deployment that it's beneficial to review Windows Update for Business (WUfB) reports.

For example, when preparing to deploy Windows 11, you might find it useful to evaluate your devices using the [Windows feature update device readiness](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report) and [Windows feature update compatibility risks reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-compatibility-risks-report) in Intune.| +| **2B: Review operational changes** | As part of the introduction of Windows Autopatch, you should consider how the service integrates with your existing operational processes.
  • Identify service desk and end user computing process changes
  • Identify any alignment with third party support agreements
  • Review the default Windows Autopatch support process and alignment with your existing Premier and Unified support options
  • Identify IT admin process change & service interaction points
| +| **2C: Educate end users and key stakeholders**| Educate your end users by creating guides for the Windows Autopatch end user experience.
  • [Windows quality updates](../operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md)
  • [Windows feature updates](../operate/windows-autopatch-groups-windows-feature-update-overview.md)
    • [Microsoft 365 Apps for enterprise updates](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
  • [Microsoft Edge](../operate/windows-autopatch-edge.md)
  • [Microsoft Teams](../operate/windows-autopatch-teams.md)

Include your IT support and help desk in the early stages of the Windows Autopatch deployment and planning process. Early involvement allows your support staff to:
  • Gain knowledge and experience in identifying and resolving update issues more effectively
  • Prepare them for support production rollouts. Knowledgeable help desk and support teams also help end users adopt to changes

Your support staff can experience a walkthrough of the Windows Autopatch admin experience through the [Windows Autopatch demo site](https://aka.ms/autopatchdemo). | +| **2D: Pilot planning** | Identify target pilot group(s) of up to 500 devices. It's recommended to include a cross-section of your organizational make-up to ensure your pilot results are representative of your organizational environment. | + +### Step 3: Pilot + +Plan to pilot the service with around 500 devices to provide sufficient pilot coverage to be ready for deployment. You can adjust this number based on your organizational make-up. It's recommended to monitor one to two update cycles during the pilot step. + +| Steps | Description | +| ----- | ----- | +| **3A: Register devices** | Register pilot device group(s) | +| **3B: Monitor update process success** |
  • Quality update: One to two update cycles
  • Feature update: Set of pilot devices scheduled across several weeks
  • Drivers and firmware: One to two update cycles
  • Microsoft 365 Apps for enterprise (if not opted-out): One to two update cycles
  • Microsoft Edge: One to two update cycles
  • Microsoft Teams: One to two update cycles
    • | +| **3C: Review reports** |
    • [Quality update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports): Monitor data in the reports across one to two update cycles
    • [Feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports): Monitor data in the reports across the update schedule
    • [Windows Update for Business (WufB) reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report): Monitor data in the report across one to two update cycles
    | +| **3D: Implement operational changes** |
    • Pilot Service Desk, end user computing and third party (if applicable) process changes with pilot representatives
    • IT admins must:
      • Review deployment progress using Windows Autopatch reports
      • Respond to identified actions to help improve success rates
    | +| **3E: Communicate with stakeholders** | Review and action the stakeholder communications plan. | +| **3F: Deployment planning** | Prepare target deployment groups for phased deployment of Windows Autopatch. | + +### Step 4: Deploy + +Following a successful pilot, you can commence deployment to your broader organization. The pace at which you deploy is dependent on your own requirements; for example, deploying in groups of 500 to 5000 per week are commonly used approaches to complete the deployment of Windows Autopatch. + +| Steps | Description | +| ----- | ----- | +| **4A: Review reports** |
    • Review deployment progress using Windows Autopatch reports
    • Respond to identified actions to help improve success rates
    | +| **4B: Communicate with stakeholders** | Review and action the stakeholder communications plan | +| **4C: Complete operational changes** |
    • Service Desk readiness is complete and in place
    • IT admins take the required action(s) based on the Autopatch reports
    | + +## Migration considerations + +If you're an existing Windows Update for Business (WufB) or Configuration Manager customer, there are several considerations that could accelerate your deployment along a shorter path. + +### Why migrate from Windows Update for Business or Configuration Manager to Windows Autopatch? + +Customers who are using Windows Update for Business (WufB) or Configuration Manager are ideally placed to quickly adopt Windows Autopatch and take advantage of the key benefits that Windows Autopatch provides. + +When moving from Windows Update for Business (WufB) or Configuration Manager to Windows Autopatch, you can enhance and optimize the update experience that you're already familiar with. + +Once migrated, there are several configuration tasks that you no longer need to carry out: + +| Autopatch benefit | Configuration Manager | Windows Update for Business (WufB) | +| ----- | ----- | ----- | +| Automated setup and on-going configuration of Windows Update policies | Manage and perform recurring tasks such as:
    • Download updates
      • Distribute to distribution points
    • Target update collections
    | Manage "static" deployment ring policies | +| Automated management of deployment ring membership | Manually check collection membership and targets | Manage "static" deployment ring membership | +| Maintain minimum Windows feature version and progressively move between servicing versions | Spend time developing, testing and rolling-out task sequence | Set up and deploy Windows feature update policies | +| Service provides release management, signal monitoring, testing, and Windows Update deployment | Setup, target and monitor update test collections | Manage Test deployment rings and manually monitor update signals | +| Simple, integrated process to turn on the service as part of the Windows 365 provisioning policy | Manually target Cloud PCs in device collections | Manually target Cloud PCs in Azure AD groups | + +In addition to the reports, other benefits include: + +| Autopatch benefit | Configuration Manager and Windows Update for Business (WufB) | +| ----- | ----- | +| Windows quality and feature update reports with integrated alerts, deep filtering, and status-at-a-glance | Requires you to manually navigate and hunt for status and alerts | +| Filter by action needed with integrated resolution documentation | Requires you to research and discover possible actions relating to update issues | +| Better visibility for IT admins, Security compliance and proof for regulator | Requires you to pull together different reports and views across multiple admin portals | + +Service management benefits include: + +| Autopatch benefit | Configuration Manager and Windows Update for Business (WufB) | +| ----- | ----- | +| Windows automation and Microsoft Insights | First or third-party resources required to support and manage updates internally | +| Microsoft research and insights determine the 'go/no-go' for your update deployment | Limited signals and insights from your organization to determine the 'go/no-go' for your update deployment | +| Windows Autopatch might pause or roll back an update. The pause or rollback is dependent on the scope of impact and to prevent end user disruption | Manual intervention required, widening the potential impact of any update issues | +| By default, Windows Autopatch [expedites quality updates](../operate/windows-autopatch-groups-windows-quality-update-overview.md#expedited-releases) as needed. | Manual intervention required, widening the potential impact of any update issues | + +### Migrating from Windows Update for Business (WufB) to Windows Autopatch + +#### Assessing your readiness to migrate from Windows Update for Business (WufB) to Windows Autopatch + +When moving from Windows Update for Business (WufB) to Windows Autopatch, you can accelerate and simplify your adoption by assessing how ready you're to quickly migrate to the Windows Autopatch service by considering key differences that might impact your deployment: + +| Step | Assessment step | Recommendation | +| ----- | ----- | ----- | +| **One** | Use "user based" vs. "device based" targeting | Windows Autopatch doesn't support "user based" targeting. If your Windows Update deployment is "user based", you must plan to move to a device-based targeting model by adding and registering devices into Windows Autopatch. Use the [Consider your Autopatch groups guidance](#step-1-prepare) | +| **Two** | Use Microsoft Edge channels | Windows Autopatch deploys Microsoft Edge Stable channel to devices in all deployment rings except for the Test deployment ring. The Test deployment ring is configured for the Microsoft Edge Beta channel. If you're currently using different channels, you should prepare your teams to understand that your Windows Autopatch devices will start using these channels. For more information, see [Confirm update service needs and configure your workloads](#step-1-prepare). | +| **Three** | Use Microsoft 365 Apps for enterprise | Windows Autopatch deploys the Monthly Enterprise Channel to all Microsoft 365 Apps for enterprise clients. If your organization is utilizing a different channel and you don't wish to adopt the Monthly Enterprise Channel, you can opt out of updates for Microsoft 365 Apps for enterprise. For more information, see [Confirm update service needs and configure your workloads](#step-1-prepare) | +| **Four** | Prepare your policies | You should consider any existing policy configurations in your Windows Update for Business (WUfB), Intune or on-premises environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | +| **Five** | Use network optimization technologies | We recommend you consider your network optimization technologies as part of your Windows Autopatch deployment. However, if you're already using Windows Update for Business (WufB) it's likely you already have your network optimization solution in place. For more information, see [Review network optimization](#step-1-prepare) | + +### Optimized deployment path: Windows Update for Business (WufB) to Windows Autopatch + +Once you have assessed your readiness state to ensure you're aligned to Windows Autopatch readiness, you can optimize your deployment of Windows Autopatch to quickly migrate to the service. The following steps illustrate a recommended optimized deployment path: + +| Step | Example timeline | Task | +| ----- | ----- | ----- | +| **Step 1: Prepare > Set up the service** | Week one | Follow our standard guidance to turn on the Windows Autopatch service
    • Prepare your environment, review existing update policies and [General Considerations](#general-considerations)
    • Review and understand the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
    • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
    • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
    • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) have completed successfully
    | +| **Step 1: Prepare > Adjust the service configuration based on your migration readiness** | Week one |
    • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md)
    • [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md)
    • [Driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)
    • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
    • [Microsoft Edge](../operate/windows-autopatch-edge.md)
    • [Microsoft Teams](../operate/windows-autopatch-teams.md)
    • Use the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) or [create a Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)
    | +| **Step 2: Evaluate** | Week one to month two | Evaluate with around 50 devices for one update cycle to confirm the correct service configurations are in place | +| **Step 3: Pilot** | Month two to three | Pilot with around 500 - 5000 devices for one update cycle to ensure you can further validate with your key stakeholders and Service Desk teams | +| **Step 4: Deploy** | Month three to six | Phase deployments as necessary to migrate your estate. You can move as quickly as you feel comfortable | + +### Migrating from Configuration Manager to Windows Autopatch + +Regardless of if you're migrating from Configuration Manager to Microsoft Intune or if you're remaining with Configuration Manager, if you're currently using Configuration Manager to manage updates, you can migrate the update workloads to Windows Autopatch and take advantage of the key benefits for your Configuration Manager environment. + +#### Assessing your readiness to migrate from Configuration Manager to Windows Autopatch + +When moving from Configuration Manager to Windows Autopatch, the fastest path to quickly gain value from Windows Autopatch is to already have co-management and the requisite workloads moved to Intune. + +| Step | Assessment step | Recommendation | +| ----- | ----- | ----- | +| **One** | Turn on co-management | If you're using co-management across Configuration Manager and your managed devices, you meet the key requirements to use Windows Autopatch.

    If you don't have co-management, see [How to use co-management in Configuration Manager](/mem/configmgr/comanage/how-to-enable) | +| **Two** | Use required co-management workloads | Using Windows Autopatch requires that your managed devices use the following three co-management workloads:
    • Windows Update policies workload
    • Device configuration workload
    • Office Click-to-Run apps workload

    If you have these workloads configured, you meet the key requirements to use Windows Autopatch. If you don't have these workloads configured, review [How to switch Configuration Manager workloads to Intune](/mem/configmgr/comanage/how-to-switch-workloads) | +| **Three** | Prepare your policies | You should consider any existing policy configurations in your Configuration Manager (or on-premises) environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | +| **Four** | Ensure Configuration Manager collections or Azure AD device groups readiness | To move devices to Windows Autopatch, you must register devices with the Windows Autopatch service. To do so, use either Azure AD device groups, or Configuration Manager collections. Ensure you have either Azure AD device groups or Configuration Manager collections that allow you to evaluate, pilot and then migrate to the Windows Autopatch service. For more information, see [Register your devices](../deploy/windows-autopatch-register-devices.md#before-you-begin). | + +### Optimized deployment path: Configuration Manager to Windows Autopatch + +Once you have assessed your readiness state to ensure you're aligned to Windows Autopatch readiness, you can optimize your deployment of Windows Autopatch to quickly migrate to the service. The following steps illustrate a recommended optimized deployment path: + +| Step | Example timeline | Task | +| ----- | ----- | ----- | +| **Step 1: Prepare > Set up the service** | Week one | Follow our standard guidance to turn on the Windows Autopatch service
    • Prepare your environment, review existing update policies and [General Considerations](#general-considerations).
    • Review and understand the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
    • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
    • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
    • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) have completed successfully.
    | +| **Step 1: Prepare > Adjust the service configuration based on your migration readiness** | Week one |
    • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md)
    • [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md)
    • [Driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)
    • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
    • [Microsoft Edge](../operate/windows-autopatch-edge.md)
    • [Microsoft Teams](../operate/windows-autopatch-teams.md)
    • Use the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) or [create a Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)
    | +| **Step 2: Evaluate** | Week one to month two | Evaluate with around 50 devices for one update cycle to confirm the correct service configurations are in place | +| **Step 3: Pilot** | Month two to three | Pilot with around 500 - 5000 devices for one update cycle to ensure you can further validate with your key stakeholders and Service Desk teams | +| **Step 4: Deploy** | Month three to six | Phase deployments as necessary to migrate your estate. You can move as quickly as you feel comfortable | + +## General considerations + +As part of your planning process, you should consider any existing enterprise configurations in your environment that could affect your deployment of Windows Autopatch. + +Many organizations have existing policies and device management infrastructure, for example: + +- Group Policy Objects (GPO) +- Registry settings +- Configuration Manager +- Existing Mobile Device Management (MDM) policies +- Servicing profiles for Microsoft 365 Apps + +It's a useful exercise to create a baseline of your policies and existing settings to map out the configuration that could impact your move to Windows Autopatch. + +### Group policy + +Review existing policies and their structure. Some policies might apply globally, some apply at the site level, and some are specific to a device. The goal is to know and understand the intent of global policies, the intent of local policies, and so on. + +On-premises AD group policies are applied in the LSDOU order (Local, Site, Domain, and Organizational Unit (OU)). In this hierarchy, OU policies overwrite domain policies, domain policies overwrite site policies, and so on. + +| Area | Path | Recommendation | +| ----- | ----- | ----- | +| Windows Update Group Policy settings | `Computer Configuration\Administrative Templates\Windows Components\Windows Updates` | The most common Windows Update settings delivered through Group Policy can be found under this path. This is a good place for you to start your review. | +| Don't connect to any Windows Update Internet locations | `Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations` | This is a common setting for organizations that rely solely on intranet update locations such as Windows Server Update Services (WSUS) servers and can often be overlooked when moving to cloud update services such as Windows Update for Business (WufB)

    When turned on, this policy prevents contact with the public Windows Update service and won't establish connections to Windows Update. This might cause the connection to Windows Update for Business (WufB), and Delivery Optimization to stop working. | +| Scan Source policy | `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service` | You can choose what types of updates to get from either Windows Server Update Services (WSUS) or Windows Update for Business (WufB) service with the Windows Update Scan Source policy.

    You should review any scan source policy settings targeting devices to ensure:
    • That no conflicts exist that could affect update deployment through Windows Autopatch
    • Such policies aren't targeting devices enrolled into Windows Autopatch
    | + +### Registry settings + +Any policies, scripts or settings that create or edit values in the following registry keys might interfere with Windows and Office Update settings delivered through Autopatch. It's important to understand how these settings interact with each other and with the Windows and Office Update service as part of your Autopatch planning. + +| Key | Description | +| ----- | ----- | +| `HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState` (Intune MDM only cloud managed)

    `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate` (If GPO/WSUS/Configuration Manager is deployed) | This key contains general settings for Windows Update, such as the update source, the service branch, and the deferral periods for feature and quality updates. | +| `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU` (If GPO/WSUS/Configuration Manager is deployed) | This key contains settings for Automatic Updates, such as the schedule, the user interface, and the detection frequency. | +| `HKLM\SOFTWARE\Microsoft\PolicyManager\default\Update` (GPO/WSUS/Configuration Manager/Intune MDM Managed) | This key contains settings for update policies that are managed by Mobile Device Management (MDM) or Group Policy, such as pausing updates, excluding drivers, or configuring delivery optimization. | +| `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration` (GPO/Configuration Manager/Intune MDM Managed) | This key contains the registry keys for the Update Channel. This is a dynamic key that changes (depending on the configured settings) and the CDNBaseUrl (set when Microsoft 365 installs on the device).

    Look at the `UpdateChannel` value. The value tells you how frequently Office is updated.

    For more information, see [Manage Microsoft 365 Apps with Configuration Manager](/mem/configmgr/sum/deploy-use/manage-office-365-proplus-updates#bkmk_channel) to review the values, and what they're set to. Windows Autopatch currently supports the Monthly Enterprise Channel. If you opt into Office updates, it should be set to the Monthly Enterprise channel. | + +> [!NOTE] +> For more information about Windows Update Settings for Group Policy and Mobile Device Management (MDM), see [Manage additional Windows Update settings](/windows/deployment/update/waas-wu-settings). + +### Configuration Manager + +#### Windows and Microsoft 365 Apps for enterprise updates + +When Configuration Manager is deployed, and if Software Update policies are configured, the Software Update policies could conflict with Windows Update for Business and Office Update policies. + +Configuration Manager could require custom settings to disable software updates and assist with troubleshooting conflicting legacy, on-premises, configurations to ensure that Autopatch deliver Windows and Office updates. It's safe to implement this change if you aren't managing third party updates from Configuration Manager. + +To ensure that Software Update Policies don't conflict with Windows Update for Business (WufB) and Office Update policies, create a Software Update Policy in Configuration Manager that has: + +- Windows and Office Update configuration disabled +- Includes devices enrolled into Autopatch to remove any existing configuration(s). + +If this policy remains live, confirm that Autopatch devices aren't included in the live Software Update Policy in Configuration Manager. + +All devices that are enrolled in Autopatch use Windows and Office Update policies from the service, and any configurations that are applied through Configuration Manager Software Update Policies can be removed. + +For example, Configuration Manager Software Update Policy settings exclude Autopatch enrolled devices from receiving conflicting configuration for Windows and Office Updates: + +| Device setting | Recommended configuration | +| ----- | ----- | +| Enable software updates | No | +| Enable management of the Office 365 Client Agent | + +#### Existing Mobile Device Management (MDM) policies + +| Policy | Description | +| ----- | ----- | +| **MDM to win over GP** | As part of the tenant enrollment process, Autopatch deploys a Device configuration profile, which applies to all registered devices to set Mobile Device Management (MDM) to win over Group Policy (GP) with the "MDMWinsOverGP" CSP.

    When applied, any MDM policy that's set, and has an equivalent GP Policy, results in the GP service blocking the policy setting. Setting the value to 0 (zero) or deleting the policy removes the GP policy blocks and restore the saved GP policies.

    This setting doesn't apply to all scenarios. This setting doesn't work for:
    • User scoped settings. This setting applies to device scoped settings only
    • Any custom Group Policy Object (GPO) outside of ADMX. For example, Microsoft Edge or Chrome settings
    • Any Windows Update for Business policies (WUfB). When you use Windows Update for Business (WUfB), ensure all previous Group Policies (GP) are removed that relate to Windows Update to ensure that Autopatch policies can take effect.


    For more information and guidance on the expected behavior applied through this policy, see [ControlPolicyConflict Policy CSP](/windows/client-management/mdm/policy-csp-controlpolicyconflict). | +| **Windows Update for Business (WufB) policies** | If you have any existing *Deployment rings for Windows 10 and later or Windows feature update DSS policies* in place, ensure that the assignments don't target Windows Autopatch devices. This is to avoid creating policy conflicts and unexpected update behaviour, which could impact update compliance and end user experience. | +| **Update Policy CSP** | If any policies from the [Update Policy CSP](/windows/client-management/mdm/policy-csp-update) that aren't deployed and managed by Windows Autopatch are deployed to devices, policy conflicts and unexpected update behavior could occur and could affect update compliance and the end user experience. | + +#### Servicing profiles for Microsoft 365 Apps for enterprise + +You can use automation to deliver monthly updates to Microsoft 365 Apps for enterprise directly from the Office Content Delivery Network (CDN) using [Servicing profiles](/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise#compatibility-with-servicing-profiles). A servicing profile takes precedence over other policies, such as a Microsoft Intune policy or the Office Deployment Tool. The servicing profile affects all devices that meet the [device eligibility requirements](/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise#device-eligibility) regardless of existing management tools in your environment. + +You can consider retargeting servicing profiles to non-Windows Autopatch devices or if you plan to continue using them, you can [block Windows Autopatch delivered Microsoft 365 App updates](/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise#allow-or-block-microsoft-365-app-updates) for Windows Autopatch-enrolled devices. + +## Business case + +Part of your planning might require articulating the business benefits of moving to Windows Autopatch from your existing update solution(s). Windows Autopatch provides several resources to help when building your business case. + +- [How Windows Autopatch works for you](https://www.microsoft.com/microsoft-365/windows/autopatch) +- [What is Windows Autopatch?](https://techcommunity.microsoft.com/t5/windows-autopatch/windows-autopatch-resource-guide/m-p/3502461#_note3) +- [Forrester - The Projected Total Economic Impact™ Of Windows Autopatch: Cost Savings And Business Benefits Enabled By Windows Autopatch](https://techcommunity.microsoft.com/t5/windows-autopatch/windows-autopatch-resource-guide/m-p/3502461#_note6) +- [Windows Autopatch Skilling snack](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/skilling-snack-windows-autopatch/ba-p/3787448) + +## Stakeholder communications + +Change management relies on clear and helpful communication about upcoming changes. The best way to have a smooth deployment is to make sure end users and stakeholders are aware of all changes and disruptions. Your rollout communication plan should include all pertinent information, how to notify users, and when to communicate. + +- Identify groups being impacted by the Autopatch deployment +- Identify key stakeholders in the impacted groups +- Determine the types of communications needed +- Develop your messaging based on the Recommended deployment steps +- Create your stakeholder and communication plan schedule based on the Recommended deployment steps +- Have communications drafted and reviewed, and consider your delivery channels such as: + - Social media posts + - Internal messaging app (for example, Microsoft Teams) + - Internal team site + - Email + - Company blog + - Prerecorded on-demand videos + - Virtual meeting(s) + - In-person meetings + - Team workshops +- Deploy your stakeholder communication plan + +## Review your objectives and business case with stakeholders + +Review your original objectives and business case with your key stakeholders to ensure your outcomes have been met and to ensure your expected value has been achieved. + +## Need additional guidance? + +If you need assistance with your Windows Autopatch deployment journey, you have the following support options: + +- Microsoft Account Team +- [Microsoft FastTrack](/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request#microsoft-fasttrack) +- Windows Autopatch Service Engineering Team + - [Tenant enrollment support request](../prepare/windows-autopatch-enrollment-support-request.md) + - [General support request](../operate/windows-autopatch-support-request.md) + +First contact your Microsoft Account team who can work with you to establish any guidance or support you might need. If you don't have a Microsoft Account Team contact or wish to explore other routes, Microsoft FastTrack offers Microsoft 365 deployment guidance for customers with 150 or more licenses of an eligible subscription at no additional cost. Finally, you can also log a support request with the Windows Autopatch Service Engineering Team. + +### Windows Autopatch Private Community (APC) + +Once you're underway with your deployment, consider joining the [Windows Autopatch Private Community (APC)](https://aka.ms/WindowsAutopatchPrivateCommunity) where you can: + +- Engage directly with the Windows Autopatch Engineering Teams and other Autopatch customers. +- Gain access to exclusive virtual meetings, focus groups, surveys, Teams discussions and previews. + +### Windows Autopatch Technology Adoption Program (TAP) + +If you have at least 500 devices enrolled in the service and are willing to test and give Microsoft feedback at least once a year, consider signing up to the [Windows Autopatch Technology Adoption Program (TAP)](https://aka.ms/JoinWindowsAutopatchTAP) to try out new and upcoming Windows Autopatch features. From 17904c75b1fcb63416589c40c61ae9bf67d8a17e Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 23 Aug 2023 22:10:06 -0700 Subject: [PATCH 082/125] Tweak --- .../overview/windows-autopatch-deployment-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md index 2af7fed5dc..2bf8116671 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -255,7 +255,7 @@ For example, Configuration Manager Software Update Policy settings exclude Autop | Device setting | Recommended configuration | | ----- | ----- | | Enable software updates | No | -| Enable management of the Office 365 Client Agent | +| Enable management of the Office 365 Client Agent | No | #### Existing Mobile Device Management (MDM) policies From 843d42d85e92ee2bb69746df41c959c3c3ee5511 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 24 Aug 2023 09:48:38 -0400 Subject: [PATCH 083/125] author updates via docfx --- windows/security/docfx.json | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 20fa610bfa..817a43769a 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -77,7 +77,6 @@ "application-security//**/*.yml": "vinaypamnani-msft", "application-security/application-control/windows-defender-application-control/**/*.md": "jsuther1974", "application-security/application-control/windows-defender-application-control/**/*.yml": "jsuther1974", - "application-security/application-control/user-account-control/*.md": "paolomatarazzo", "hardware-security/**/*.md": "vinaypamnani-msft", "hardware-security/**/*.yml": "vinaypamnani-msft", "information-protection/**/*.md": "vinaypamnani-msft", @@ -98,8 +97,6 @@ "application-security//**/*.yml": "vinpa", "application-security/application-control/windows-defender-application-control/**/*.md": "jsuther", "application-security/application-control/windows-defender-application-control/**/*.yml": "jsuther", - "application-security/application-control/user-account-control/*.md": "paoloma", - "application-security/application-control/user-account-control/*.yml": "paoloma", "hardware-security//**/*.md": "vinpa", "hardware-security//**/*.yml": "vinpa", "information-protection/**/*.md": "vinpa", From fe91e56b211fd78f974fc4e18a9cce3be2961820 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 24 Aug 2023 08:34:50 -0700 Subject: [PATCH 084/125] Corrections and tweaks --- windows/deployment/windows-autopatch/TOC.yml | 2 +- .../windows-autopatch-deployment-guide.md | 87 ++++++++++--------- 2 files changed, 46 insertions(+), 43 deletions(-) diff --git a/windows/deployment/windows-autopatch/TOC.yml b/windows/deployment/windows-autopatch/TOC.yml index d63bb90e3f..575f19116b 100644 --- a/windows/deployment/windows-autopatch/TOC.yml +++ b/windows/deployment/windows-autopatch/TOC.yml @@ -10,7 +10,7 @@ href: overview/windows-autopatch-roles-responsibilities.md - name: Privacy href: overview/windows-autopatch-privacy.md - - name: Windows Autopatch deployment journey + - name: Windows Autopatch deployment guide href: overview/windows-autopatch-deployment-guide.md - name: FAQ href: overview/windows-autopatch-faq.yml diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md index 2bf8116671..e0bca63ffe 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -1,5 +1,5 @@ --- -title: Deployment guide +title: Windows Autopatch deployment guide description: This guide explains how to successfully deploy Windows Autopatch in your environment ms.date: 08/24/2023 ms.prod: windows-client @@ -34,11 +34,11 @@ This guide: ## Determine your objectives -In this section, details some common objectives when using Windows Autopatch. +This section details some common objectives when using Windows Autopatch. Once an organization is onboarded, Windows Autopatch automatically creates multiple progressive deployment rings and applies the latest updates according to Windows Autopatch recommended practices and your organization's custom configuration. While there are options to adjust configurations such as quality update cadence, the service provides you with a baseline to begin establishing your update objectives. -Use Windows Autopatch service to solve the following challenges: +Use Windows Autopatch to solve the following challenges: - Difficulty developing and defending update cadence and general best practices - Increase visibility and improve issue reporting @@ -58,49 +58,49 @@ The following deployment steps can be used as a guide to help you to create your :::image type="content" source="../media/windows-autopatch-deployment-journey.png" alt-text="Windows Autopatch deployment journey" lightbox="../media/windows-autopatch-deployment-journey.png"::: -### Step 1: Prepare +### Step one: Prepare [Review the prerequisites](../prepare/windows-autopatch-prerequisites.md) and [enroll your tenant](../prepare/windows-autopatch-enroll-tenant.md) into the Windows Autopatch service. At this stage, your devices aren't affected. You can enroll your tenant and review the service options before registering your devices. -| Steps | Description | +| Step | Description | | ----- | ----- | | **1A: Set up the service** |
    • Prepare your environment, review existing update policies and [General Considerations](#general-considerations)
    • Review and understand [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
    • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
    • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
    • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) completed successfully
    | | **1B: Confirm update service needs and configure your workloads** |
    • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md): Expedite preferences and cadence customizations
    • [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md): Servicing version preferences
    • [Driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md): Set to either Manual or Automatic
    • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md): Set to either Monthly Enterprise Channel or opt-out
    • [Microsoft Edge](../operate/windows-autopatch-edge.md): Required. Beta and Stable Channel
    • [Microsoft Teams](../operate/windows-autopatch-teams.md): Required. Automatic
    | | **1C: Consider your Autopatch groups distribution** | Organizations have a range of Windows devices including desktop computers, laptops and tablets that might be grouped across multiple logical or physical locations. When planning your Autopatch groups strategy, consider the Autopatch group structure that best fits your organizational needs. It's recommended to utilize the service defaults as much as possible. However, if necessary, you can customize the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) with additional deployment rings and/or [create your own Custom Autopatch group(s)](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group).

    • Review your device inventory and consider a representative mix of devices across your distribution
    • Review your Azure AD groups that you wish to use to register devices into the service
    • Review [device registration options](../deploy/windows-autopatch-device-registration-overview.md) and [register your first devices](../deploy/windows-autopatch-register-devices.md)
    | | **1D: Review network optimization** | It's important to [prepare your network](../prepare/windows-autopatch-configure-network.md) to ensure that your devices have access to updates in the most efficient way, without impacting your infrastructure.

    A recommended approach to manage bandwidth consumption is to utilize [Delivery Optimization](../prepare/windows-autopatch-configure-network.md#delivery-optimization). You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages amongst multiple devices in your deployment. | -### Step 2: Evaluate +### Step two: Evaluate Evaluate Windows Autopatch with around 50 devices to ensure the service meets your needs. You can adjust this number based on your organizational make-up. It's recommended to monitor one update cycle during this evaluation step. -| Steps | Description | +| Step | Description | | ----- | ----- | | **2A: Review reporting capabilities** |
    • [Windows quality update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports)
    • [Windows feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports)
    • [Windows Update for Business (WufB) reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report)
    Windows Autopatch quality and feature update reports provide a progress view on the latest update cycle for your devices. These reports should be reviewed often to ensure you understand the update state of your Windows Autopatch devices.

    There might be times when using Windows Autopatch for update deployment that it's beneficial to review Windows Update for Business (WUfB) reports.

    For example, when preparing to deploy Windows 11, you might find it useful to evaluate your devices using the [Windows feature update device readiness](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report) and [Windows feature update compatibility risks reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-compatibility-risks-report) in Intune.| | **2B: Review operational changes** | As part of the introduction of Windows Autopatch, you should consider how the service integrates with your existing operational processes.
    • Identify service desk and end user computing process changes
    • Identify any alignment with third party support agreements
    • Review the default Windows Autopatch support process and alignment with your existing Premier and Unified support options
    • Identify IT admin process change & service interaction points
    | -| **2C: Educate end users and key stakeholders**| Educate your end users by creating guides for the Windows Autopatch end user experience.
    • [Windows quality updates](../operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md)
    • [Windows feature updates](../operate/windows-autopatch-groups-windows-feature-update-overview.md)
      • [Microsoft 365 Apps for enterprise updates](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
    • [Microsoft Edge](../operate/windows-autopatch-edge.md)
    • [Microsoft Teams](../operate/windows-autopatch-teams.md)

    Include your IT support and help desk in the early stages of the Windows Autopatch deployment and planning process. Early involvement allows your support staff to:
    • Gain knowledge and experience in identifying and resolving update issues more effectively
    • Prepare them for support production rollouts. Knowledgeable help desk and support teams also help end users adopt to changes

    Your support staff can experience a walkthrough of the Windows Autopatch admin experience through the [Windows Autopatch demo site](https://aka.ms/autopatchdemo). | +| **2C: Educate end users and key stakeholders**| Educate your end users by creating guides for the Windows Autopatch end user experience.
    • [Windows quality updates](../operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md)
    • [Windows feature updates](../operate/windows-autopatch-groups-windows-feature-update-overview.md)
      • [Microsoft 365 Apps for enterprise updates](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
    • [Microsoft Edge](../operate/windows-autopatch-edge.md)
    • [Microsoft Teams](../operate/windows-autopatch-teams.md)

    Include your IT support and help desk in the early stages of the Windows Autopatch deployment and planning process. Early involvement allows your support staff to:
    • Gain knowledge and experience in identifying and resolving update issues more effectively
    • Prepare them to support production rollouts. Knowledgeable help desk and support teams also help end users adopt to changes

    Your support staff can experience a walkthrough of the Windows Autopatch admin experience through the [Windows Autopatch demo site](https://aka.ms/autopatchdemo). | | **2D: Pilot planning** | Identify target pilot group(s) of up to 500 devices. It's recommended to include a cross-section of your organizational make-up to ensure your pilot results are representative of your organizational environment. | -### Step 3: Pilot +### Step three: Pilot Plan to pilot the service with around 500 devices to provide sufficient pilot coverage to be ready for deployment. You can adjust this number based on your organizational make-up. It's recommended to monitor one to two update cycles during the pilot step. -| Steps | Description | +| Step | Description | | ----- | ----- | | **3A: Register devices** | Register pilot device group(s) | | **3B: Monitor update process success** |
    • Quality update: One to two update cycles
    • Feature update: Set of pilot devices scheduled across several weeks
    • Drivers and firmware: One to two update cycles
    • Microsoft 365 Apps for enterprise (if not opted-out): One to two update cycles
    • Microsoft Edge: One to two update cycles
    • Microsoft Teams: One to two update cycles
      • | | **3C: Review reports** |
      • [Quality update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports): Monitor data in the reports across one to two update cycles
      • [Feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports): Monitor data in the reports across the update schedule
      • [Windows Update for Business (WufB) reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report): Monitor data in the report across one to two update cycles
      | | **3D: Implement operational changes** |
      • Pilot Service Desk, end user computing and third party (if applicable) process changes with pilot representatives
      • IT admins must:
        • Review deployment progress using Windows Autopatch reports
        • Respond to identified actions to help improve success rates
      | -| **3E: Communicate with stakeholders** | Review and action the stakeholder communications plan. | +| **3E: Communicate with stakeholders** | Review and action your stakeholder communication plan. | | **3F: Deployment planning** | Prepare target deployment groups for phased deployment of Windows Autopatch. | -### Step 4: Deploy +### Step four: Deploy Following a successful pilot, you can commence deployment to your broader organization. The pace at which you deploy is dependent on your own requirements; for example, deploying in groups of 500 to 5000 per week are commonly used approaches to complete the deployment of Windows Autopatch. -| Steps | Description | +| Step | Description | | ----- | ----- | | **4A: Review reports** |
      • Review deployment progress using Windows Autopatch reports
      • Respond to identified actions to help improve success rates
      | -| **4B: Communicate with stakeholders** | Review and action the stakeholder communications plan | +| **4B: Communicate with stakeholders** | Review and action your stakeholder communication plan | | **4C: Complete operational changes** |
      • Service Desk readiness is complete and in place
      • IT admins take the required action(s) based on the Autopatch reports
      | ## Migration considerations @@ -117,7 +117,7 @@ Once migrated, there are several configuration tasks that you no longer need to | Autopatch benefit | Configuration Manager | Windows Update for Business (WufB) | | ----- | ----- | ----- | -| Automated setup and on-going configuration of Windows Update policies | Manage and perform recurring tasks such as:
      • Download updates
        • Distribute to distribution points
      • Target update collections
      | Manage "static" deployment ring policies | +| Automated setup and on-going configuration of Windows Update policies | Manage and perform recurring tasks such as:
      • Download updates
      • Distribute to distribution points
      • Target update collections
      | Manage "static" deployment ring policies | | Automated management of deployment ring membership | Manually check collection membership and targets | Manage "static" deployment ring membership | | Maintain minimum Windows feature version and progressively move between servicing versions | Spend time developing, testing and rolling-out task sequence | Set up and deploy Windows feature update policies | | Service provides release management, signal monitoring, testing, and Windows Update deployment | Setup, target and monitor update test collections | Manage Test deployment rings and manually monitor update signals | @@ -144,15 +144,15 @@ Service management benefits include: #### Assessing your readiness to migrate from Windows Update for Business (WufB) to Windows Autopatch -When moving from Windows Update for Business (WufB) to Windows Autopatch, you can accelerate and simplify your adoption by assessing how ready you're to quickly migrate to the Windows Autopatch service by considering key differences that might impact your deployment: +When moving from Windows Update for Business (WufB) to Windows Autopatch, you can accelerate and simplify your adoption by assessing your readiness to quickly migrate to the Windows Autopatch service by considering key differences that might impact your deployment: | Step | Assessment step | Recommendation | | ----- | ----- | ----- | -| **One** | Use "user based" vs. "device based" targeting | Windows Autopatch doesn't support "user based" targeting. If your Windows Update deployment is "user based", you must plan to move to a device-based targeting model by adding and registering devices into Windows Autopatch. Use the [Consider your Autopatch groups guidance](#step-1-prepare) | -| **Two** | Use Microsoft Edge channels | Windows Autopatch deploys Microsoft Edge Stable channel to devices in all deployment rings except for the Test deployment ring. The Test deployment ring is configured for the Microsoft Edge Beta channel. If you're currently using different channels, you should prepare your teams to understand that your Windows Autopatch devices will start using these channels. For more information, see [Confirm update service needs and configure your workloads](#step-1-prepare). | -| **Three** | Use Microsoft 365 Apps for enterprise | Windows Autopatch deploys the Monthly Enterprise Channel to all Microsoft 365 Apps for enterprise clients. If your organization is utilizing a different channel and you don't wish to adopt the Monthly Enterprise Channel, you can opt out of updates for Microsoft 365 Apps for enterprise. For more information, see [Confirm update service needs and configure your workloads](#step-1-prepare) | -| **Four** | Prepare your policies | You should consider any existing policy configurations in your Windows Update for Business (WUfB), Intune or on-premises environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | -| **Five** | Use network optimization technologies | We recommend you consider your network optimization technologies as part of your Windows Autopatch deployment. However, if you're already using Windows Update for Business (WufB) it's likely you already have your network optimization solution in place. For more information, see [Review network optimization](#step-1-prepare) | +| **1** | "user based" vs. "device based" targeting | Windows Autopatch doesn't support "user based" targeting. If your Windows Update deployment is "user based", you must plan to move to a device-based targeting model by adding and registering devices into Windows Autopatch. Use the [Consider your Autopatch groups guidance](#step-one-prepare) | +| **2** | Microsoft Edge channels | Windows Autopatch deploys Microsoft Edge Stable channel to devices in all deployment rings except for the Test deployment ring. The Test deployment ring is configured for the Microsoft Edge Beta channel. If you're currently using different channels, you should prepare your teams to understand that your Windows Autopatch devices will start using these channels. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare). | +| **3** | Microsoft 365 Apps for enterprise | Windows Autopatch deploys the Monthly Enterprise Channel to all Microsoft 365 Apps for enterprise clients. If your organization is utilizing a different channel and you don't wish to adopt the Monthly Enterprise Channel, you can opt out of updates for Microsoft 365 Apps for enterprise. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare) | +| **4** | Prepare your policies | You should consider any existing policy configurations in your Windows Update for Business (WUfB), Intune or on-premises environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | +| **5** | Network optimization technologies | We recommend you consider your network optimization technologies as part of your Windows Autopatch deployment. However, if you're already using Windows Update for Business (WufB) it's likely you already have your network optimization solution in place. For more information, see [Review network optimization](#step-one-prepare) | ### Optimized deployment path: Windows Update for Business (WufB) to Windows Autopatch @@ -160,11 +160,11 @@ Once you have assessed your readiness state to ensure you're aligned to Windows | Step | Example timeline | Task | | ----- | ----- | ----- | -| **Step 1: Prepare > Set up the service** | Week one | Follow our standard guidance to turn on the Windows Autopatch service
      • Prepare your environment, review existing update policies and [General Considerations](#general-considerations)
      • Review and understand the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
      • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
      • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
      • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) have completed successfully
      | -| **Step 1: Prepare > Adjust the service configuration based on your migration readiness** | Week one |
      • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md)
      • [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md)
      • [Driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)
      • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
      • [Microsoft Edge](../operate/windows-autopatch-edge.md)
      • [Microsoft Teams](../operate/windows-autopatch-teams.md)
      • Use the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) or [create a Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)
      | -| **Step 2: Evaluate** | Week one to month two | Evaluate with around 50 devices for one update cycle to confirm the correct service configurations are in place | -| **Step 3: Pilot** | Month two to three | Pilot with around 500 - 5000 devices for one update cycle to ensure you can further validate with your key stakeholders and Service Desk teams | -| **Step 4: Deploy** | Month three to six | Phase deployments as necessary to migrate your estate. You can move as quickly as you feel comfortable | +| **Step one: Prepare > Set up the service** | Week one | Follow our standard guidance to turn on the Windows Autopatch service
      • Prepare your environment, review existing update policies and [General Considerations](#general-considerations)
      • Review and understand the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
      • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
      • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
      • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) have completed successfully
      | +| **Step one: Prepare > Adjust the service configuration based on your migration readiness** | Week one |
      • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md)
      • [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md)
      • [Driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)
      • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
      • [Microsoft Edge](../operate/windows-autopatch-edge.md)
      • [Microsoft Teams](../operate/windows-autopatch-teams.md)
      • Use the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) or [create a Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)
      | +| **Step two: Evaluate** | Week one to month two | Evaluate with around 50 devices for one update cycle to confirm the correct service configurations are in place | +| **Step three: Pilot** | Month two to three | Pilot with around 500 - 5000 devices for one update cycle to ensure you can further validate with your key stakeholders and Service Desk teams | +| **Step four: Deploy** | Month three to six | Phase deployments as necessary to migrate your estate. You can move as quickly as you feel comfortable | ### Migrating from Configuration Manager to Windows Autopatch @@ -176,10 +176,10 @@ When moving from Configuration Manager to Windows Autopatch, the fastest path to | Step | Assessment step | Recommendation | | ----- | ----- | ----- | -| **One** | Turn on co-management | If you're using co-management across Configuration Manager and your managed devices, you meet the key requirements to use Windows Autopatch.

      If you don't have co-management, see [How to use co-management in Configuration Manager](/mem/configmgr/comanage/how-to-enable) | -| **Two** | Use required co-management workloads | Using Windows Autopatch requires that your managed devices use the following three co-management workloads:
      • Windows Update policies workload
      • Device configuration workload
      • Office Click-to-Run apps workload

      If you have these workloads configured, you meet the key requirements to use Windows Autopatch. If you don't have these workloads configured, review [How to switch Configuration Manager workloads to Intune](/mem/configmgr/comanage/how-to-switch-workloads) | -| **Three** | Prepare your policies | You should consider any existing policy configurations in your Configuration Manager (or on-premises) environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | -| **Four** | Ensure Configuration Manager collections or Azure AD device groups readiness | To move devices to Windows Autopatch, you must register devices with the Windows Autopatch service. To do so, use either Azure AD device groups, or Configuration Manager collections. Ensure you have either Azure AD device groups or Configuration Manager collections that allow you to evaluate, pilot and then migrate to the Windows Autopatch service. For more information, see [Register your devices](../deploy/windows-autopatch-register-devices.md#before-you-begin). | +| **1** | Turn on co-management | If you're using co-management across Configuration Manager and your managed devices, you meet the key requirements to use Windows Autopatch.

      If you don't have co-management, see [How to use co-management in Configuration Manager](/mem/configmgr/comanage/how-to-enable) | +| **2** | Use required co-management workloads | Using Windows Autopatch requires that your managed devices use the following three co-management workloads:
      • Windows Update policies workload
      • Device configuration workload
      • Office Click-to-Run apps workload

      If you have these workloads configured, you meet the key requirements to use Windows Autopatch. If you don't have these workloads configured, review [How to switch Configuration Manager workloads to Intune](/mem/configmgr/comanage/how-to-switch-workloads) | +| **3** | Prepare your policies | You should consider any existing policy configurations in your Configuration Manager (or on-premises) environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | +| **4** | Ensure Configuration Manager collections or Azure AD device groups readiness | To move devices to Windows Autopatch, you must register devices with the Windows Autopatch service. To do so, use either Azure AD device groups, or Configuration Manager collections. Ensure you have either Azure AD device groups or Configuration Manager collections that allow you to evaluate, pilot and then migrate to the Windows Autopatch service. For more information, see [Register your devices](../deploy/windows-autopatch-register-devices.md#before-you-begin). | ### Optimized deployment path: Configuration Manager to Windows Autopatch @@ -187,11 +187,11 @@ Once you have assessed your readiness state to ensure you're aligned to Windows | Step | Example timeline | Task | | ----- | ----- | ----- | -| **Step 1: Prepare > Set up the service** | Week one | Follow our standard guidance to turn on the Windows Autopatch service
      • Prepare your environment, review existing update policies and [General Considerations](#general-considerations).
      • Review and understand the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
      • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
      • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
      • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) have completed successfully.
      | -| **Step 1: Prepare > Adjust the service configuration based on your migration readiness** | Week one |
      • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md)
      • [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md)
      • [Driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)
      • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
      • [Microsoft Edge](../operate/windows-autopatch-edge.md)
      • [Microsoft Teams](../operate/windows-autopatch-teams.md)
      • Use the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) or [create a Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)
      | -| **Step 2: Evaluate** | Week one to month two | Evaluate with around 50 devices for one update cycle to confirm the correct service configurations are in place | -| **Step 3: Pilot** | Month two to three | Pilot with around 500 - 5000 devices for one update cycle to ensure you can further validate with your key stakeholders and Service Desk teams | -| **Step 4: Deploy** | Month three to six | Phase deployments as necessary to migrate your estate. You can move as quickly as you feel comfortable | +| **[Step one: Prepare > Set up the service](#step-one-prepare)** | Week one | Follow our standard guidance to turn on the Windows Autopatch service
      • Prepare your environment, review existing update policies and [General Considerations](#general-considerations).
      • Review and understand the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
      • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
      • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
      • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) have completed successfully.
      | +| **[Step one: Prepare > Adjust the service configuration based on your migration readiness](#step-one-prepare)** | Week one |
      • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md)
      • [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md)
      • [Driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)
      • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
      • [Microsoft Edge](../operate/windows-autopatch-edge.md)
      • [Microsoft Teams](../operate/windows-autopatch-teams.md)
      • Use the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) or [create a Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)
      | +| **[Step two: Evaluate](#step-two-evaluate)** | Week one to month two | Evaluate with around 50 devices for one update cycle to confirm the correct service configurations are in place | +| **[Step three: Pilot](#step-three-pilot)** | Month two to three | Pilot with around 500 - 5000 devices for one update cycle to ensure you can further validate with your key stakeholders and Service Desk teams | +| **[Step four: Deploy](#step-four-deploy)** | Month three to six | Phase deployments as necessary to migrate your estate. You can move as quickly as you feel comfortable | ## General considerations @@ -237,9 +237,9 @@ Any policies, scripts or settings that create or edit values in the following re #### Windows and Microsoft 365 Apps for enterprise updates -When Configuration Manager is deployed, and if Software Update policies are configured, the Software Update policies could conflict with Windows Update for Business and Office Update policies. +When Configuration Manager is deployed, and if Software Update policies are configured, the Software Update policies could conflict with Windows Update for Business and Office Update policies. -Configuration Manager could require custom settings to disable software updates and assist with troubleshooting conflicting legacy, on-premises, configurations to ensure that Autopatch deliver Windows and Office updates. It's safe to implement this change if you aren't managing third party updates from Configuration Manager. +Configuration Manager could require custom settings to disable software updates and assist with troubleshooting conflicting legacy, on-premises configurations to ensure that Autopatch delivers Windows and Office updates. It's safe to implement this change if you aren't managing third party updates from Configuration Manager. To ensure that Software Update Policies don't conflict with Windows Update for Business (WufB) and Office Update policies, create a Software Update Policy in Configuration Manager that has: @@ -257,11 +257,14 @@ For example, Configuration Manager Software Update Policy settings exclude Autop | Enable software updates | No | | Enable management of the Office 365 Client Agent | No | +> [!NOTE] +> There is no requirement to create a Configuration Manager Software Update Policy if the policies aren’t in use. + #### Existing Mobile Device Management (MDM) policies | Policy | Description | | ----- | ----- | -| **MDM to win over GP** | As part of the tenant enrollment process, Autopatch deploys a Device configuration profile, which applies to all registered devices to set Mobile Device Management (MDM) to win over Group Policy (GP) with the "MDMWinsOverGP" CSP.

      When applied, any MDM policy that's set, and has an equivalent GP Policy, results in the GP service blocking the policy setting. Setting the value to 0 (zero) or deleting the policy removes the GP policy blocks and restore the saved GP policies.

      This setting doesn't apply to all scenarios. This setting doesn't work for:
      • User scoped settings. This setting applies to device scoped settings only
      • Any custom Group Policy Object (GPO) outside of ADMX. For example, Microsoft Edge or Chrome settings
      • Any Windows Update for Business policies (WUfB). When you use Windows Update for Business (WUfB), ensure all previous Group Policies (GP) are removed that relate to Windows Update to ensure that Autopatch policies can take effect.


      For more information and guidance on the expected behavior applied through this policy, see [ControlPolicyConflict Policy CSP](/windows/client-management/mdm/policy-csp-controlpolicyconflict). | +| **MDM to win over GP** | As part of the tenant enrollment process, Autopatch deploys a Device configuration profile, which applies to all registered devices to set Mobile Device Management (MDM) to win over Group Policy (GP) with the "MDMWinsOverGP" CSP.

      When applied, any MDM policy that's set, and has an equivalent GP Policy, results in the GP service blocking the policy setting. Setting the value to 0 (zero) or deleting the policy removes the GP policy blocks and restore the saved GP policies.

      This setting doesn't apply to all scenarios. This setting doesn't work for:
      • User scoped settings. This setting applies to device scoped settings only
      • Any custom Group Policy Object (GPO) outside of ADMX. For example, Microsoft Edge or Chrome settings
      • Any Windows Update for Business policies (WUfB). When you use Windows Update for Business (WUfB), ensure all previous Group Policies (GP) are removed that relate to Windows Update to ensure that Autopatch policies can take effect


      For more information and guidance on the expected behavior applied through this policy, see [ControlPolicyConflict Policy CSP](/windows/client-management/mdm/policy-csp-controlpolicyconflict) | | **Windows Update for Business (WufB) policies** | If you have any existing *Deployment rings for Windows 10 and later or Windows feature update DSS policies* in place, ensure that the assignments don't target Windows Autopatch devices. This is to avoid creating policy conflicts and unexpected update behaviour, which could impact update compliance and end user experience. | | **Update Policy CSP** | If any policies from the [Update Policy CSP](/windows/client-management/mdm/policy-csp-update) that aren't deployed and managed by Windows Autopatch are deployed to devices, policy conflicts and unexpected update behavior could occur and could affect update compliance and the end user experience. | @@ -287,8 +290,8 @@ Change management relies on clear and helpful communication about upcoming chang - Identify groups being impacted by the Autopatch deployment - Identify key stakeholders in the impacted groups - Determine the types of communications needed -- Develop your messaging based on the Recommended deployment steps -- Create your stakeholder and communication plan schedule based on the Recommended deployment steps +- Develop your messaging based on the [Recommended deployment steps](#recommended-deployment-steps) +- Create your stakeholder and communication plan schedule based on the [Recommended deployment steps](#recommended-deployment-steps) - Have communications drafted and reviewed, and consider your delivery channels such as: - Social media posts - Internal messaging app (for example, Microsoft Teams) @@ -321,8 +324,8 @@ First contact your Microsoft Account team who can work with you to establish any Once you're underway with your deployment, consider joining the [Windows Autopatch Private Community (APC)](https://aka.ms/WindowsAutopatchPrivateCommunity) where you can: -- Engage directly with the Windows Autopatch Engineering Teams and other Autopatch customers. -- Gain access to exclusive virtual meetings, focus groups, surveys, Teams discussions and previews. +- Engage directly with the Windows Autopatch Engineering Teams and other Autopatch customers +- Gain access to exclusive virtual meetings, focus groups, surveys, Teams discussions and previews ### Windows Autopatch Technology Adoption Program (TAP) From 41c11a3e4fe8a6c36cc8d1a3ae73c45484d5f516 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 24 Aug 2023 08:38:36 -0700 Subject: [PATCH 085/125] ...baha --- .../overview/windows-autopatch-deployment-guide.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md index e0bca63ffe..33cd19f001 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -160,11 +160,11 @@ Once you have assessed your readiness state to ensure you're aligned to Windows | Step | Example timeline | Task | | ----- | ----- | ----- | -| **Step one: Prepare > Set up the service** | Week one | Follow our standard guidance to turn on the Windows Autopatch service
      • Prepare your environment, review existing update policies and [General Considerations](#general-considerations)
      • Review and understand the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
      • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
      • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
      • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) have completed successfully
      | -| **Step one: Prepare > Adjust the service configuration based on your migration readiness** | Week one |
      • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md)
      • [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md)
      • [Driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)
      • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
      • [Microsoft Edge](../operate/windows-autopatch-edge.md)
      • [Microsoft Teams](../operate/windows-autopatch-teams.md)
      • Use the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) or [create a Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)
      | -| **Step two: Evaluate** | Week one to month two | Evaluate with around 50 devices for one update cycle to confirm the correct service configurations are in place | -| **Step three: Pilot** | Month two to three | Pilot with around 500 - 5000 devices for one update cycle to ensure you can further validate with your key stakeholders and Service Desk teams | -| **Step four: Deploy** | Month three to six | Phase deployments as necessary to migrate your estate. You can move as quickly as you feel comfortable | +| **[Step one: Prepare > Set up the service](#step-one-prepare)** | Week one | Follow our standard guidance to turn on the Windows Autopatch service
      • Prepare your environment, review existing update policies and [General Considerations](#general-considerations)
      • Review and understand the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
      • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
      • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
      • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) have completed successfully
      | +| **[Step one: Prepare > Adjust the service configuration based on your migration readiness](#step-one-prepare)** | Week one |
      • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md)
      • [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md)
      • [Driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)
      • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
      • [Microsoft Edge](../operate/windows-autopatch-edge.md)
      • [Microsoft Teams](../operate/windows-autopatch-teams.md)
      • Use the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) or [create a Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)
      | +| **[Step two: Evaluate](#step-two-evaluate)** | Week one to month two | Evaluate with around 50 devices for one update cycle to confirm the correct service configurations are in place | +| **[Step three: Pilot](#step-three-pilot)** | Month two to three | Pilot with around 500 - 5000 devices for one update cycle to ensure you can further validate with your key stakeholders and Service Desk teams | +| **[Step four: Deploy](#step-four-deploy)** | Month three to six | Phase deployments as necessary to migrate your estate. You can move as quickly as you feel comfortable | ### Migrating from Configuration Manager to Windows Autopatch From 3d1be28e1b5a2e2eaeb791ac164222467c2f616e Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 24 Aug 2023 08:42:14 -0700 Subject: [PATCH 086/125] Tweak --- .../overview/windows-autopatch-deployment-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md index 33cd19f001..f3098d8081 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -148,7 +148,7 @@ When moving from Windows Update for Business (WufB) to Windows Autopatch, you ca | Step | Assessment step | Recommendation | | ----- | ----- | ----- | -| **1** | "user based" vs. "device based" targeting | Windows Autopatch doesn't support "user based" targeting. If your Windows Update deployment is "user based", you must plan to move to a device-based targeting model by adding and registering devices into Windows Autopatch. Use the [Consider your Autopatch groups guidance](#step-one-prepare) | +| **1** | "User based" vs. "device based" targeting | Windows Autopatch doesn't support "user based" targeting. If your Windows Update deployment is "user based", you must plan to move to a device-based targeting model by adding and registering devices into Windows Autopatch. Use the [Consider your Autopatch groups guidance](#step-one-prepare) | | **2** | Microsoft Edge channels | Windows Autopatch deploys Microsoft Edge Stable channel to devices in all deployment rings except for the Test deployment ring. The Test deployment ring is configured for the Microsoft Edge Beta channel. If you're currently using different channels, you should prepare your teams to understand that your Windows Autopatch devices will start using these channels. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare). | | **3** | Microsoft 365 Apps for enterprise | Windows Autopatch deploys the Monthly Enterprise Channel to all Microsoft 365 Apps for enterprise clients. If your organization is utilizing a different channel and you don't wish to adopt the Monthly Enterprise Channel, you can opt out of updates for Microsoft 365 Apps for enterprise. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare) | | **4** | Prepare your policies | You should consider any existing policy configurations in your Windows Update for Business (WUfB), Intune or on-premises environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | From 637b107813d5ab4a366e903ab887d60acbff1b1e Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 24 Aug 2023 09:10:31 -0700 Subject: [PATCH 087/125] TOC and image update --- windows/deployment/windows-autopatch/TOC.yml | 2 +- .../windows-autopatch-deployment-journey.png | Bin 57811 -> 58459 bytes .../windows-autopatch-deployment-guide.md | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/windows-autopatch/TOC.yml b/windows/deployment/windows-autopatch/TOC.yml index 575f19116b..2ee3c1c6fc 100644 --- a/windows/deployment/windows-autopatch/TOC.yml +++ b/windows/deployment/windows-autopatch/TOC.yml @@ -10,7 +10,7 @@ href: overview/windows-autopatch-roles-responsibilities.md - name: Privacy href: overview/windows-autopatch-privacy.md - - name: Windows Autopatch deployment guide + - name: Deployment guide href: overview/windows-autopatch-deployment-guide.md - name: FAQ href: overview/windows-autopatch-faq.yml diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-deployment-journey.png b/windows/deployment/windows-autopatch/media/windows-autopatch-deployment-journey.png index ca58a89191104f6bbb525451cda8548a11495262..fd79d4d7f9605d144b62901273db6400b694ae8d 100644 GIT binary patch literal 58459 zcmeFZbySq?w+0NNAT1y*-Ho8qqI4tOrF3_fbSN;Sv~+jF&?wy{&A`x|L-ReTzjMxe zzO~+Oeg7ZUa{0Ix&fNRjdtZCs``R<1ALPW*QHW6B;NZ|DB}5eA;GO`Fk4Bz80{(hO zCIt`t1@E9JE(BLP^kNJ6$77TCvhU&GDk4#D3?6*yC6@)8H)$CkAfuTDR%VZLEjR%iLf8N{M^&^lA8kiMfVq*yWs&P21b70|3Dw7Mt1>W9y*Qbd!sKDWXpYNz`a0tJj-l_S*BmRE!Ermls z`~3u`1CL1X=c(}#8vCCo$0r2(f1Wl`*xUX*jo|A0K41a7Ak+W7AOOQZF|22*H|e}h z(DulZ(EXM<1i5O-@gO^NS7Y<;d}&Mw*M)&3 z=d0-tZw+EfIBi|~CGWa@yZ>DyCF0;_dQTTM^8oX(gd#Tsc%2RfHH zv_x9a&5}x|Wpv)X%yQkx zC&TBO&m=Q6QXU;_mu^Fr_&?$u%sL%+l(|cb4n|Zp>-#c=|I#@a$xpg^hD46f-ZqJZ zfEKsnV4|}knw4LLO$}#?j%FJk((8F8jR{*H+_<^5tl}nNb3L1D#uJgH5y(Jrn^fpd zG~yH?S{`Z?3x+SH1vM0J-=^~qDnFt}MYBC?hZD}pfB*M*sXhIATV$E!ubZ7p6lovh zv?im;UL@k{eZm`lMyrzf0MlBzcz zzrM&}AqwA_(*8Mkb)~RRFYD@VB=W7x6pfDu)Wa#?hUXl|7~b&vo(C?1wikQb2(zd> z^P;H!z7OIiHhWtMjvF%9?Jl7kyhhxyMH_^s9>8KZbV)Yp2L^|70keI2`FgphDWODhT_7W{ zbS*f6U>Rj)L6yAyrgru1PJBq=W!5;sGG!Z_3E-9Gc1Lu$C!gVmM4+Ei#y!!wkCW+2 ziPj&3@OW?0e~~;!tTzv+fE8v%ppxY^EZ>M42Qt1FQ+Z6VybB~h|F=^3@8s-liJL&U zaq)$Z)qfaf3GuPL$9;W+Vgwb)uNk0bZ&RV-r(ALB)JyShFIuuz&Br!W7WIW6!ayWw z^WP$ZLwSUd5*qAt67ui@^TEuCUz@^QjbVBUonjp-+vcb*+f;-VpB;qEH@FXW9nhwq zz^a;$QSQju301K4eXIQ85fAkn5q6MLg`%RCaBTHIMsnk~n&>#_Dy z=o2?t>(~=)WLoMLm9Q8yhAymLt_RM7@~OP@=mcPv^@1>eY)OLVbK8KWr}Uh(N{ZTI zD#oT;5V;ep@Yo)MI7F>l${%|w3yPy`b$7GRe>@Y*rMC{xZpU6^rdX44Z0tt4#rC$q z`Ze*=TtZxaonsx(SsyD{1!j;jO1W2e?!3c{Fh2^PNX0_7|Jbn`k0@uv3OGHs+(;(0 zD#_(YwfF!quCwWT3^8(9t=C4YHCO)&YKvH$pu8UCN&{I*B{|&-l`=iTTJ@tT*3(|i zk5L^+p|^XWgJyflR)Ijn0aPQdzL(KfM??x+32H_kU)Ow!I;w9Hja{G4Hgs{bpviNG zP(&@)ojVi!|zBV>hIScKX&Woy9F|vW)$j%0UOgH_fp|3){s1pi+RA;F1!# z6g-aPl9>5y{X``xYKW$q8GXsup5AEtX*U}UHr=4{So0Ez=bT-79BT*H_b=Lg#NMc# z7>cp0x^aWCtE@;bIm&ZB(0=V{D9vbyp2jZHt{O<4|k zDMg#$lCn$Vf*^V<#@?^^9l@67x{F!50+WWo5N@%@2#I#Usd5rx5^lqNm8JMAiHx33 z6Iw2%!~$NJN9@#(L0mv7j9+R+ucJ)#l!yP33Lh6lTtpa1()!|U)%TuG67hI?mQw+Y z8hC`1I6k$qqs5d=s7pA2`=X8_K^g>`2xK;0#2i-5yM+@Gki>!0JF&}hOsy1D8-vJW z)vxNo;u_5(Cnypt$*!HfM@>bS7SyaRIT(NwH?XYhr2w_A?vX=HSB&?38-u)1M0WXt zfoCVcB#Apm@H&@zKw_SndEj_Fr6cZ8KL@$+6$GLpkp(r_Akd75))i*c8gRQsa}|iB zPDKh6#ePS@RLZ9AmAfEcDoPRS^-wWp=UHJu;QR6wN7eD@LekhU{B( z>Nx?XpypT_gG2LNg(|-G=yKd%C_z+wc{_N>SE}P@-_oJ67-3{7J#}&Nk*#?2ODR;Z zNMWlsxQ%xg)}WYp4LtG#R<^Gr1r)CYk-vs;oijEm#YuNmuVJYv?W%Hfib?$>*D^^8 z7auU}6zP+4mbP#+==9`L+=7YpgwZVJ^%>3Yj?7X2YDQd#x#D`0c8 z*mAYC+vu^Y!j4}dbDvizJ4V7{WgN}^#+qqoe<*UaK#FZ@ZNO8RP0G)nOLoyOJzk4e zem1tFgcR?SWYwd`%8h$&Q5X&@)Xk?gsyQ~5=UI@R> z^IZWjn*Z6S;HqMal-VQT(p{45;r&fI7VnBQcotx`&xd=A2a;9H@Pblrrg zAbA~jI7ai;MtFQ(lQMUYXO%jMMU$jZL@RMRVq}j!sc}q?k@kASuIDK%t2DTnq(~cF zuu%}+VFXt%PnqR=qT9Nr`{BESxI{#LYDw7T`IHF}i5e?E35>^vA)>7cYH$dRe|%RZ zTL48TzGP@pWBIyrJaLHA9E9?T${J~%&p#(SAXH9{kU>daZA<|=`Wy(Dde(szU%y2= zh%(jw1hX`C3LIPg4PupLP!D=6N!nOn7?hcOuO}!^Pc(K}Ic_YI=6Y_hC`K%Ya9Kzm zevhNgE{O9h{E&>N_O z)xf=_mKzsLz>roIZB zF9Mz9F)bLfl^RwX-!5dQw|6|NkxFY<1X2w@(Os$)J14rLS2xZo5?oI8nW*6_jflP> zKIFwmhD{QDLVIMFYbFrR_ZJpbt^k0iL%YW|P`iq&A)keP9sB8e*$q5tw|i;muwXJIbsA`3WjDBw(M-0{Hcw*aMK9;dkV=M)Oe9rsF(5{u*3wX;ex7C|t0~^O+*!L}7xTy>8%~`tjD?$3^T<*I2exKLl=oSA?WP zzYuzG#7|Mf%`5co)Km0oLN1S09)b#X#wrGw^V7JTfX`S^#H5ZGJw-V$~_sQ34 z(1gp{0xCfK{*sOjYRFJ@Y%Y@5V42aV`go^snH)mRv`ryB#%KYmIV1C3+T*4skV!l? zC3__*!>e#ucD+kVF%z9^nI;qgU%P{lyE+y5J^i%^EtAVH5E4MgAzi+F-ZNwMOi{@A zpQXd`ikOl8Ez4B;aipafv7@B4(8_ms)?_K}rSgD|djw8vEt+hdIOj)mcg7oi-;?&L z8p_1_K@OxuDzJHJFUV|EYg_JJyls+%Yj|$@5)N%WHzyg7L2qvx^J2_MT@f~IS3S=w zYwv^wV!80l01bK7P?>jYzDYzF5b@-FhyzH#c*j*Z3=NH9UfpI9Qwg4j>zmQb9v*Uj zw`v(z_XwFU)OoN%AaO2PMbqza&BlQW!g@l_TOAMp6x9!!oM-1E&X%r8_@XT(hI2WU zhQ{mn1e9EFc$`eF%1|H!4CdStGu!1t9T;D(&()x4I4-`5W2K>TL@&b;4E5aNXkG)& z1d#AOtU&Yc95OGapnFhnn@%@OEaZB|=Jl+vHh_!*S#fjHk%lUAeh(rcVpnB!IT|h9 z@x7YAB0HNGo}nk#?e%IzfwUNcC2mjvv4<$xK4oV0cNq5sBAV^n9_r0zE6OD^i1M0T z4Mbd(gQ}j4i7^8!tja*>>QcbkPuko5-6k@Xe7v8Fd_p0t$=}!x4V3QOJ@^sgNf-9Y zjI}bDs_O92I`NRcyFmk{qynp)dM~2*enNxT`C~k_QFjH7M z!~@}{k#sye?z3Lvac1Wz%eg@_?5D73LqubZ=OufSJ)nMwG>=4NJ;}GjOMULOuoa*l zR2yZY9>ASGox{9UN5=Z*O~i0Tf`7>)+CdUMR+;c!Iwjzm-95cTTzW*%9YQlPU9c21NB*QJSx0zXrY+IgTV0fm zfSnDoXogY1aRnWMXkYXI4EDa@xYgy%PR1i|;=6LIvrkIMO zDKg0Box(TwAdz)-vmpFn$L$)`uE3-ogS?qVi4|x4j*<)^L*2RKQYMp3REwZIEP@$PZZZ@a@M=fobDYxkz!Mq6HGutB<7|n(HW`t-xnm-+(LJrQl<)fz4`sns zq(zILqK!XQW+V@Piy&rQOb?+Fk{%6i`cBWX@~6APJdVd$YCCr32zOZ>%z(_jPGJKR zvZn+^kKdjGMh-$FVF5ig9bY)BBQk@?co`wG44~u}iDKEiLQiq(d#YdaqXzMf&;9c7 zTY7|!K*cW}bp0XoM-i33q};xP$a%xG$NX1$Aw%U?;HRpmTY6>`S&VemlrEY{6Cxo4 z74v1_H`11sY(!~P9BCzy2yv9bm4#TGs7f>4 z8qZ;05HXWf#H*Z``K>Kx(p;VX-<-4cIadQL7E28O6Jp z=e{N7@*y|yI125Bn2yoE zadbz2f|SskpDPy1ytV(HBR(SvLE4~HVhh7NH#g*`LsH=Y@s&fwFF+Q(-t6JY*(^9Z zQjyywxVhhcS2jgcyo1~nmy}oZeC-j26h#5$_zmi!U@`oaW1W>xK81~{OHcxA?2dx*r(8Z~s!o{VY zYbEkR@wHuiJ0$r5%5d-3B_0$Y&b|b2hLD(woT+FFJXO`X zgb)s~%aKwh6L^~G>%f&lb-7yS%U3tbGyodkXhly{u>!^EXf%XGdC#U~c}8oP59Sqw z9*a3ccV=M9q4&9JA?_N zX${J&*(+X&<~-uqrTL8r?XG8n5T=Wr0weV9PwK=3)VZ75ujJN_@cc@GyqGvNjPjmk zbo4_#$d_qxn4>Y$CD0|Ya)o6{Ls>jQ36ULEcCcuVH`q(28y|S|X6->u;Vo4g(;M?O zLQv%^zi)c@)zK&r3R6Ota1O@fu1^eCr)AYq3UN4^0AE%yKQT}b;;9}Gf^1l98EJ-Q z1~wCs?w>jcQL_x|FEVDvquXlHHpZ{*r2vh`+Dk?&4*ZT5{$aA(_`}KWSmMpmjtP9R z@IMw3Sr<>fIMen#CP$t8>(uzNKF{7;R zJKmoZg~&|Xddmn};qtZzI*kqNO7(%+0Z+Ti**GZ}4n0qcUf6SLrQX#YJ&s6CCUQ3z zKg=>pEEeD+VJN`yCYpT&(clTkF73hfx>D=toM!(`ic7x68Yms_-KV5Gav|b$4+AM9 z8wqQCIU~yP56>HRC!xfTiN=o6)=MbOXW&ebVvlfBGqE zFjMc4$YNl^2KC!j)*G-?s?3E^P|(5H>9}eJj&?jM6|%=9&EQ$^W9X~p64tN*|4u&h z`G|R~)P=G(x2EZZ#|O4e7BuAO?(cD>Ze%)sKwpW7iQ>_CmTUfx5>TTN{|Fe&)xjtQ zUxBO=%#ZO-#=aXPjd$pxn>2hOYZQ;r0La@F3?w)4GEfE-WzU^auh!C*df9j%1;%#g zSNCd15sqDl1-oR0?b5px-175APx+1P2tD8Djf_RChnkwz=lG$uX%$@|)~EQ!%ARb$ zLPMa)f|qmX35cJTb*K*ySEO0`LwIQcHk_a#tVQN1&p5V}(=$mm-M(+TnQ?zizBq&i zP4looa2`=@zz&%LIf{~u7(#BO;x6BVZQ6IP!y@>E%oG>e1If#Sw+Mim3;g>|fSANuLjNHgJ$ zm@&A77cA&?%7;V#ncKw6_KzwzIraO4WlY@`UIjPR)7L;R{v>YVVe0(DG$P5M;|p8B z#+yV8p*-r|cnylQKlZv3N#F72OLIGj4jmZOdYUG746fzaCV}fPK`A~ zd1B%P-DAHYf0B<|C;y2>I=>s%g#VJ?FZ$UxqoW?JPA#VW|B=7FDFZ7alsL@OKLQhc zRwMkd-JU1+COcsP3cx%3@?39annd{q5N2M8I|Llkz$c*2DDCtNGzzvT~4f zv>=u#%hS$+ISld$cFAXnMi?~W(w!{0W7KHzc(n1k5)HU(j~~ifJZ9p^aibXqKw0L! zM}M-J6Ov~KTz8-2(aOKz;Ot8tDPcR&|7JklWJ+^et+M%;jz*VcrmZJgMW_QxZtsoR z^epF|Qd~*N)>S~3>k@q^l^-I^0j@bEWjxrOWIvD;<8{(fqR~oyOzFVPlaTy_Axd}` zND01zV8QrrKluaFle$y?N0C3y+AK!}CF}R5$*2=izFeKePc-_?;Tj4Pl_$?N)7l^6 z9WyH+ly%;QP>{R)zaS`eF}}R;>AQ}lEOVjBCWp{Hw-0HSJ~hDDQyD2aq+JUz5y_#h<~2KapoYBW zRp_%^#9nu{izk=ifHHsE9nU6lvv9SbX>INJQV6-ONEtD2Na&F#oX0gHbC)Kzws&O_ zGK?1mP3y+h2_Iw0lUKe6E{Us0s#rCazS7?|DXAFOoMsKf!rw{veVRCy2r#B|ppj`` zQzpg8GSJVSe;2ue_J`A+gqquwiFyIS!f(Le?u?J&(%23T)-}Wv2d(PLzFk2U*?;#R!&4CAI7b5+%3=*$t;*`3 zR%Z)}8Of~+xh_*@3&7&|E9gs}7}z1I({pP6r*gfi$fmnhjeYh%oXtP~V+K`AuBPk67v z=s&Lmgd!s5-<@CZq8t>^8Ux{eX!EnJ2Vlaa}6&d_P1v4(i=<{|k;Vmz8+o^}!tU zPQ?cTkkoq9#T-u24A1%p6%KTEmQ@Y8}z&Mw4OIvk^$hIuiD zQ2u>JC5EthSYfRAKE2udO3H#~ya9ip!9!rCVs_7rX=bE=sNnVT(LliD2sn8qpEyN5 z6ipv9%93P_(K`I_kclYXB!99&@`2 zinV=7fv)|H2gYeE>za`w%8vFT-KSURXpti4Ab>hr<8ets^DeN_fQXt87PpsK`$|>R zquOuWNP$lp2$hW&UY=Cz)tx+FE31C?({?liw_$j}6r|8wD~&&JISi<>IS~u*W{7K(;>?)B{LTwWU3%Gao*)at>ZL=?K5~KhKK$)2Duo9sCe8^*QW=?O$l z=%#B?k8>h08)`pO#Y!}S&k=nnMDs2cj461`f051xZ~8Ky{wEr5A*_^A!j-MRJ1tZS z{&bCAt!ZU*kq$@ly=1Ac5`tE7?Cqf}GTc5QQpU};f?b0LVKSio>R-iUWaNa&b)`~r z0l8w&LFp*rM5N=kf?Tn?dp)Qn=%Cc)*EC^##pobvT7Jstb`j%Vfcpe%^5YK?F}OOzUEmf0fI zp0=?E^R;5%s|vb6vF~HM4;{4{K!7-qIUn(A)zRI*kyCJpRE*4Qjpb za_hI8btUd${7c!x?1l(5Z?&FcN{$daW8ruH2vnUXW`_jqF$*!t8wqRs=vg6ss^skLbD}L=y`LMT3NWH0W99lR(uD z;&NbShrSTITM*pQ88?Kt1>Az10`fWc0z!0oe`L0IY)cn+AxwN zn0{$O<}^TB$NgMFLRIkL)X+NgCVz-DE2z5m^BRGEMvAFq?o7b@9*zp?@mW=gKp}+6 z@0|J;#6{I$Yl~pMGWxI7tH0-J_4HlrJ#%A9&`xaZdgv_i!8!&5AwUF19N$;(pF6Tl)xjR8@TjNyb4n9p>@B?h7@Eje#es>pi%=D1A~@?;31 zLJI?PCf!c*i->WjCk<>wYKR>g_+mx^hqCGA?Uvq0Dvp3x_LeT7s?V%axtq<5UwfL! zkB$E_Za*1m;Dhv;Eb1;f^lf|q4VWqPcT3Q_bEp|Qm1!tk5!Te8$3o|{axx^NnjsHa zfZfZasrfb*dva0J3_Iuxj`WMl%;}_j6nKp;!tym?+E~x}ldv%fjz1TzjMN?tS=ua4 zwiYpJhFGv14+&SeGqpzGISo(s&0L03TFRy2;r{w&tA@2gDYHFgtZd9GO)>-BP&`g5 zcePijfSFz;ira#vG89*HEW!oAD?@|dpVZw8B?SDe#&g6--kgu)n0Zem+N(^;OGDb8 ze4*%AQ+WjX;SnH#6OlH~iQ0RvEu9*-K%ZI?E+jsYT^~!TL!w6I>faXqX=;W#Lx+cH z*3LH%^y#ky5g%IWFeQ;#=V6Z*(e1!WQg!;PbA<2QA@3+|W;a9`IlwqK^llo0Wfa$hXtiQq-*%S zz^D8?7r1x~FZ;hofN5NB2*kmQhonfTz<$&BTYbUr&5mx5?>M$$3XFHD>OFoh><(xpZB0>6U~Y(Bla2DVH*wvL~orAG|qWVk!DuW`AGYfm)D&-w@b^LJ*Srd%vQ9~NWY z+-$K4ykJu%?qJ6t^P$1^H^dWeUKYTh02Zix&;8+p&c_6>=nKm4^1qn2Uxw=*Zr6Ee zu`~ifEo-&ud5Uj(h7<-pxE6Fva;aCToG6AP!8oupefsCfz8TGq@{e0C(7Roex3;Xh zz2cENr$P@6)H1p_5@$y)4@rZA9+t9Zfn}CiR77=AV{JhqqGdG_r}@rSx2}nxpX?9be($NxG>@Cj%DKeuzc~L z5h@{@KmM;@<-bW59|B(x$!jP0j%}tr1p~GS0t+x7!$hviU!-{}+t7M*%>cJUAiq>F z8znG!b@Ks;|C|(9oBF@?vHx4agZuxvb@=@j3=JGkf8rz(QOxsGROn_R&VHp^hwd8eE{#2DZ*YXJG3AqD54>c>UdbzE zr1NHetf-@6PyYS~1reOH)qK6eivy6uVgpPm{m#T=ulWG=?mU#ur@vUO#bzqS!MJ(V z0xSAht>pkY_yx`D^zwso()+Gvz5DgLFf!dH=Mu9DCJLMUqP||@ko3l|i}xDJayRNv zvl|Pc@BG4qU%i7-w!o@6hi>{?-P>`}&x_5vJ-QgGB6gCUj(xaFa1f0L-|E~PE)IJx zdJlUJ_1@nl?mKos(VbLy+z^hG)UX8U!~coErkHih<$6N%%H)d2{SDcj)l@~emvFM^ z$=!*(?umh2$FRWi4>dinnyoTE@_##-ONHm9eMRmy_`+%2g~Ma z&&OKXC8uC;27s6ix%W2X3X+im&(SA}sO`evt{R0~=pb>KKdMv%yD#D2l&C8$731Z( z-7^?#F~i1kqzAdTQQd@fROA-l-At%-VfJPIakL5z61MV-O!)2L*&2%n6!)*e3D3PJ zx#SKSJ}%*tGM;P6)DtR^{41uZiQm3`bGZri5Ik|KGEU!59y>mZC<{dvywO{%u$p_r z+2a0w@q=1i4A(P3C)^|d%KVgzif0l|D!rc{;|81h&Q==r$K&5G6p`NljJy=9F1Z?? zK~3{mZm;o_dG)WS?$vQwsJTbgd%LqKEpV@aOwx40cDHV{w7bXosRZ@k+?G!fUUvUe zDgAy-Pq+wp?iUVpsweGXqHF!3BHJjSOMz4^}kPr~}Hm68D^q*nwSS5Ktz_@nze48*#1?q@yRf;( zrJ9rW(s@fh1*tWr|^H`n#jL`|i*kJL6Gv4lJ0wSW(SSGHh#II$v(qOW%vD)9C<+29ZRy zOjn>Xc`%vFW}#69lh6@?K!1}uo=vX>s5MhAp*2(KWR4d{-DEaH1Cz7~V0e`eet(MN ze|R%mAgT*~|7NhP>$Fg*c>_GX|LY=4@W%Ti)Zw~mQgOT8hV5cuD!s^OD!%USP^wO7 zGWI8&4cL7DmleKSpeU0OIXW6z2p66-*!%XXqN1X=S2D&|sJRVJnC>Xz)A|tau0xt= zal_(K&HWh{Qc`HcZ1w=Lx7P-?1Gh=f@u;hj$}Q$rvSJ^Yf{I}k$tmS;#?W|>_www6 zJZxN~RlT5gE1$JEOF#NHPf^xv&AQ=eP1UYfoTv~Xq}XR2tMq@acHA0MDN?ms1QT*< z(;aiQY5gQ^{3v;Ev3Lh*#&m7oEejWr zG<41Tk8)yPzPnS4HVbWt?kR#C;X{d=bTZ z-9?-|1yX8Q%wq}6S`ru}($`|Gr<%Zi?-5G;rT$7#<}G8OwH^yo!aL1c%bD%TB5`r? zyxd&Jwvh~|r7u3rd%DVj@u-c-$G&b#!(n(>&}&wd&2yot_O3C;d$sy0C3<<^!l&vb=I#7C(-+S+cNd*y37 zhcb6CQtR0hfm^eNv(E9KHZZf%)S{ZCB(Z5T57O5|O;XpG%sgBBoEUb&6lKjZ_MKvm zJ8yJftIZcEpJ;k)M*LV&v+}xBo3rDhp3k>spDn`>{^AJjMv-M$dbho`rBU%QklP?8 zLnsfF2Y;7N7O8&X+`hI%py6@gmF!K?xK@jM!0+8s<8abyA3EXovp=#8P7C2?txPxL zdK*}E^SP=HcjUTToqOBmq@Td%xfLtOb9$S`vx`D<-k=7)axxw(VP`lA;zlSoX%8Y( zu&9AzW;{uj%(k3j^vcuR)ZLnt9k&-y+1aUIY{&~(a$-qLE zLRJc7v-nK>e}UAC_)Dv>s^Tol`Auz_l5RJlzM1((MDXeJk#dr67cPtk;W=aTs524fn96mdHrmXm(BLP<5kdMIi7b+)x~~~3d+iCCJR;O>TI|+ zlsBIpziQjIB-U;0g3~I7e|xf0Bs*HF!{;K`ymK*}Hxsk)6Q1pMPD5O8JGs+(#Lg>n z>AKgr^ubodX}BGhktxEy9l+i>bN80hw*eS}mU1)2jMfEKUDvL<^GyO-;>O6%KgwM+ zW)D|=%Cz4|Ek2#|ITs*FV^+N0d&5*ljG>i0#%rehVR0G6;r*dI^lzKWffzmeW}2pO zpXZ=vhmD_q%)IYaDVxwRL)j`?xt91)Hi-1~aWQqYL66%B3^Vf18W6If!o>GW1FyAo zk}9!4X%^tG_DFBM#uB$SA?b_9z@q6Yn(e%P*Qxd8qMBiWz|j_CNx|kjA_4;SR`1)c z$M~hZ{)*`3s)vpP;;q1<%506B(np)W{FmFwYM|69@j(V7N-FwH)k3qsYb>#h0z=~QA)Wy`JAo^ObeWj z(7X=NhW^=S5ZRkN%QtRj+Cs}|TP1|fOmr~ogr7BJrTY<6>(2%;v~)lDDwzFkHsW_b z8w&bWM>nWx+qqU$Lm1vY#EuU2#)pascZUz^6l(=tN_}D??#E|u`leug3&Y_82rsw@ z1Tw-;tLz0v>x%6k73Afa0HN}0c{?T#zP47D-zu9#_D$Q$_=HA-J==3FDwhS>I`HP1 z_#7|ew1oJ_)MUCN*KJN*3tu+yv0(GnqRLJXg0o9Vyz46q-&V){`wC)f0h5SpD_|66 z@C3AD!->UA#IRu#CACFs`ugzN^2KX{|50x+h5{dbh%5nz%mp5|ZE-h-K} z^d=enij^X2ddhna-+Haw1twD_ZB$Z!9;4=hZd=v)6E15^gCN;jewDl+=%2kl z*jymKuDgl=10&}{wD(kF%mh7mtLE;2q|l$!;Sx_nJzWakS1<0gwZSm|71Eqzx~k$Z zxzu>JR&$F{{$+$ne+K#7t@;+2OP zGK7IinZhho<0_T7_(oOsn|A4&GPQVi7f7;oh^D>k8~OOB;kfuL(aNR#x@BHA^?v&l zI=`?_;E3+Uwk6N)5#~ZhyR}5+*fQ@!3JnqZ)`c+Zca`2j$ zc9D>r0|=4EIZ*MKzn%5L+=9yaR5XZFIBX=$e9x8+l?+(w-288!&7Q^Y2M;nN%j#~w zUNNR?G`(KvU$KAgB6_Q4Zhnm}cn9kPm`K&a{1<_~iuNmGP}5wqus)4l@~xV{SP^ue zU*(PW>E?~~?qUFe?b2(rKH|a|+?$%Z=d8(qcIiqqy_Q(QXBn+>-K z`K5&dZ9#iKYWfzRDq+-9)Oyp;m^t5f@l5)i&#jMEShVmQRwxbmtTxF{;EL9UKhO@< z2H0T=E6-JxJqv@^V{N$h8-tnSHT33lx(9AyG0N<6tedbDLNN{S83Rq0W8uxenKxn4 zC2i0gE@8bE)J*4da}Wm*3TWE0)1co1hHzmBTxzqwqD7w6xb2Q-?e4lNrwtitD*% z8u8(T5mJ^BRMJ4GCCbnmap@E;C9qQs{y|vIv``;B7jshgj=OE{2jp}I=>-$NnRz2`>g8bbL=Gu~*^ppVaWw5;W&RaJD*i{Wa z`fbOQOu^JtU%u4Lvi)(8oFI}*CNMk!W*qV$MD$Y2O@|?`tT$NQDx3-e(H$J$29{sR=fT3H6A3N6}Z< zpX~(g*MpRx6t&VdRF~7JJ@v;y@L7}5bry}DE>+efAl;*>qi|5fP3U(+IV8d4O0;9XVH z&>Wy+_(GX1BKP66CG?|=&@OUJii;nP;K@9ktA23lgH2@2ER&O$qo+^lAO*<7^we3!6Os(J0n> z5w~n2rTTic8yG=t;;J2#&n^(CmEIRpMoQ0zEgl^g))@OP;1z@It-4T^6@-2pySV+) zz0UK1$sOMjb@-SC7={iaVsAeOW~*lEEuNQ9X!elc2M#wP{WHOCul0d;veF4+_cHY{ zn^qC?+h}(M&}{=rJ5h<+P@0KOb@k=#+yQvAko0zX3Twuu_YOuX%k9?pw+*$sozGue(-v9WkEW_ByO~?GSoSmU?;gnH_9i2g&gU-J+;<_o8TVydVeK#d zKa-pcmLnw)QyWN((wacG)$T7mPgc9DA}E`Pn-_@d<~s3KB7S2NZ9aouJ_m|ZvnG}# zWM`=BkHfb)=SrCxxS_O8LON)87`n(l!QLhZfMM9$*_mr}Dxz)tKzm8NEYTqEWPkgu zhqovYpV_{@q_p z^>|_TuEc3TKqz(L>dUX_PtLoms-{Q2ZuB~iZ}MrrY8U72fD_!S^6%C=W#Md%fAVLT zF%o~#`_cDIPeZ57)J?C%v9*oR_@-2NgcmdC4wq@#b#puvP@|QOKIx>e97R-;s=DoY z8F4Y!u~3u!A%aOxBK^9D{HN9;y)<%C(0&L84Z|jBbsaU}ljBn7cjvQ3(0Ar2*1@dl z{H+h=JcB9zv~~1yF9qnf&g+L$cq-3zl|FGvw>TA@Wv+ac-5Q|j&U$-j=Hdi12`B;K z4AZ_Dc>D1xq=Bq%nmA^LpZ9!goV5}dt}tz(mp^puVS&2vs>ic7z@?`bYof*Q7rxFU zji2AL5FKlN>%WIZ+xR})z)iH-!yzoXZ z(K-QO1Y?NvW;DYMg*wj)5s%VihWu`CrcINmmb&w4caIYbHr*MFU}8 zY^NwThO5gn64C@YpZQ0cUh~}_-m_{QedpF>kq-z3OoBx!Z)2L6_Rk=CE53 zc1u)pXRW>Bu#XWBR=2;Z4c4?W&V(Y?L-G!g=d^MG_@qL}Ch-2M3erCidUfUQeTE_# zn-W%<$*`xFSkhnkyt`}MAZlJ}=d)?t>solPKZh@hky{DOR5i2e>JrFMSdq|dZwtD; zuVKTU&QnEip@f3USb(kRT=h$@PUN69u}#fJ4>j%P;{964-@9hv3yFJ|^*2regC#S! zS$*#NF-rayif&d1&}sXlimRrzeb{0R$x+?D+qjkZ-B}A0X)PHKft!v7kb^Aaq3z?_t48AHQ&7x zom|=Feevi<=`-e*qr!%dSS1zJ>7bofi1>o6O4XWOq{r9!7c3Lgi{jVLKWsfZUy9Ub z6;&4lk+gf{U&!z`k_ueOLx)ejl{H=z+{_&YcZpu{R9<(Kd`c}*tqrr#!wdAcQ!7pa zj=5W`+w4wzA1Jg*jexc=5YM8O2B=#6OuwuOi_cUlH_*>xjP2}VT3hb#Y&=haDW|gh z;ZU>r zN2SGgt(d2thkm-8RH|{iZvFy~`0q`$)`}R^IL#fi`5l zSi&jikmn*_d;ymh13-b>5bz%(67UA$$ld%Zo=)53=`0;-)xFD1xNlBGWs+fa^LOWm z$+7SpxSMQB2ye1Tee$*1*6$ZUvWTlpN`4lS^tug_x25}J7%t)bcT}++`7_f0=NPW! zGvfSD&rf7|lzwfz|7COKnui&eB9a}!a=I;28}osb=UX43BKBeJ2eJa+=;DaRwd8s7 zmd!iW2BYbnkA2VF#!#vSZ3jw>^x}8YW0y~`ZHDs}>5ZE^h{Db(xXP&tQGICM{nO#k zqV+OqzFyHT=s*b%$XAru(X0Z0}*>&G^iyffR^82Ve076`^&k-}{y-G6U26~1+%lkCs z18ty>ROSI>p?|8V4FH{R^75Kj8uXw6?hP#hv}8c?4Y$FvC=t90h7GyR%?;kDSrw*m z0pInI4-i=&fX07_?2op~_~@ujtIqm0@=HSm1hmvH;3xf{23Cxd;Ko|<^Xi1|{zo9b zt|@J+xzZXK`1S%(K+;i(0Fr`4gP1C*P`@( z{VGP)THJ$*`yc)Lf1rtiU}kP^ZfR)=AWB6=)t|sdMnJ%hS9RRuJNV{Zk-l%n2{)kK z-1Z8lLfw84nV)Yxl%&BoE{`5`y>DF4;r}U5=OAZ?hK9-}zd^^uRJ#|dP{0|lBK`{qE zG6O)KtY{Yy5a4s(WvB8t2I3d#WFA46e@8&gb-!X2kl2*cj&|j4%#nbmFHUVS3hkfp zt`SS@OqU((?Y(|eU4n*=p7`=TC*UK0jV9+ky_>;)<5c!#kDehw)jH=pQ~|unrS(hU zL8`l4N4NW581H|6#lyqH&u?jIsxDZYcN;D8B%Z05h2h#XEoVv( z)H?k?be(lTlv~rlL1ei~S+szH(%mUaDhMde(h|~0cZh`2NJ=B!xpaqg$I>7nv4pge z-&xRG-+lMb<>5Rh=FFKh^P5>>hOFP_)>dLn3>%uK4d~Fq z%{H340qc+PnQisky1PL_1Ez`?$iOaMIJd*U`eFI@!8hxr&WJAoWgkXzlw$`T^RYC% zz-Zz2bKX1Ad%bG8#dEl&wF@Z`jK797h1F-~05bABDh99-MKO%Qbm`cMA9-`Yqp>kr z9-I6a6uNqGyG78?cTZivZDp*rPw@L3&{&@WSDzzeke_!U-v0{v{_&tFNh*qoGqTji zfmlf%41(&t^Br7TnZd)z5jY6bJ8xogn@<^*rRpMMk&^8sSN|z+bkreK)YMVTTILK! zs{z5mv6hc1K`+Q#L>?i2V)Qz-!Cib+^?$Jf_S3de<32Jz{~59!yn@`6t$ui4K1N~^ zyd46^AQTV{W%Z|R+yZAk=bOjfl54Wdaoba9xJdeh$kkWme+11-jYsGfB)h!*8)yL! zHw}mhheKx}o>TP|prd?Bk8S@~jP(|XU7D#IeRy+|=OLkXCN+V& zO@|vso$=^3w1kaZFB$cN#VFFzfqI8K7YpasHgaays4lJt%)J%1KKm4z@^xJ|+Yin!2Bt$lWaGvz+4KxU0)s>?7SC0~p z*6Z;pp$E-HILA|UeNHo$_0{VfVNWTl8_46x< z*6<@P*dINQToX@m9okr}k+LZM!sLHN)P*I_bW#TfUJkK}zD4!P7g^7Y9u%51*`mH{ zHH>uB+2@S|fZ%L>Yi8feHSyqxyB?OWbr|@+I!3DpByzl1|4RZsZg7(%P!t-S0KsCa zUN63YkQ5Ss?36#(y4|~z1SkswQcFLcHR?wjs>tQhI$cvn@>ou5#FxGGaXoOGw~>9p zzt|q5tB%wtw3kE{EpG_Lc%7@WtZcAlCOReQhb1mj5pX6}ky>U0m}#Fs=uSF5ialuF`T<=p_fAufB(wAzo;ptR-6%On4R)WOk?3{I;8|m;oaDX5+vxD+ z+K31UsRL%QpAH;#Uy||re6UHL7us;j>z z=qH0}@#5Z)Z2j30B2bahgT%bzYn*j&<&SxP`^_mMrwymyr4IGkSy{J73f%VBOZxC* zvkeqAOoG(kG@{QJm77f({MDk`ScT<6Rz?CH*9hULdgbCrDSQT%{@GazzIQ~w+cMKO zHeTE5VkU^CGZ+~gjZ-N#4COf9FK~B#^QPYh0?y*gqKXsE4Gj&g1X>IRigAUk1)nOv z#hAzl?hjk{2`Yogq2TZKHlAQ*k14R`U=lFhS)eP3Vo+t+TvRaHS@s2lGHutgGBg3ia>P7~dholTW2tX)@_pNE zxVm*ulQ(8--CBK~<&5Jpqe`Lnz-O^<=N2w01qFS7Z@T&W_rjv=*&jZSZb&`P{aOEP zuewF+{0QE2Ud<}l2(;wIs(BpD5o>>K!eqX4n_g-3B$3#4z2wo4&gQ?j^zOBXw{St+TQLuW=;LqV=oD!wp01rj0?Yd(fjV*s~RK|CMbO6)* zqTBssAe@kd+roE#vfFcxI`5n&y!ftwflwRww@^8&RM}(|WxrfOE23cju4&ndS4^`B z8ettvr;h%;;rhv(oSXs_1BJ=oKNMG9&!>%f0!Xj#bM%;yu|Ho0v0ES0aWNJ+dd#4+ zJ>LqY$XCfNsF>#vis0bj(EEo(+1L#K7#7`otMbZeKe-=t+Y3Xh5(^hMwpSbSyJI9O z<>v9*S%Li+ui|Y-RSDGJysdfa_C2BtdEmVMYf7o4Br6*@bbZ}vl=fo3R}hc zYlhw~N<4N3e;gF}(W&p^GW9o+?WF3tT_}(bB$WgF<0r5cPybr*;_*VAcdS|71913j zzQ1jL0|$q(AHz++ZCtsEWe3XnT}(7h?Ae*yf;^@!u|efoK`Iwp#OSBL zD;J|Rj1Z`}Y1u07UrhvOWo6CGXzI#gretJD@Udw$ng8B2OGUs7q$}sI2lm_^2F`Dx z+(9Z>D%ewTaq;KwbH8h&(tOz7wp@6D>BEd7flNR^erP^eF`e(A&++_jQNK{P4d?Qq zwzt0@dIvZqB3~$r3n~xJ?{)YJ?7G9fJwos`^4?e5bfKB=#emKZCM0g3plNYouD!pj zdPyzQUjl{n$Vke&ckjU2+1=3Kv3lzYcy9URL+4|#0#VQG~cF-O_0+$sfLc)t1G6fb( zrLJK(-o*3^*1fV{=(c)VmX_C?hMyTdZ=VX@<`!H{4J5JL|a za0$y}VWIIyQfh?S;r^1`4G)D5R8_$SUnK*TQvc&sOAtA=se*>3SrFMly+__oVw@wx z#Ui!IzCn*GP>ish-A1Giu)eFtsqA28&~nzOL^Mj+_nakYX&QlkT=a#GH3Ye0Cx(@P zR6`zQ7ZaV`jQxE>tsC*qd}=?XNJHqnC!bntSH+v-*5uEe4;sq(yIoxb5S}2Sxj*9prM*+5X4?(op_JSiHeKQXP*48XC73$KJ@*`|&s?E{@@x zAece@%YdxNp2^lNHBkIZ4G+X!T(&R z883~XaWqPNimQ19_5vDxPFZ5OOm3&KCog}VL}Gtx`i+}3?R%-BGoiMHcD`W3;cPY8 z^eT5m|2{2!hO^Pv9S7Y%=YR)!@y38a0*K5oQc_Y3XhM*sh%e-KdwG3p+MI7EfBZ{c{?Y+`=PRv|Oy_-qf<&%T zZ0y3ieyi=i`j}|94Ng2e*FnEmb;|*$;;I)y-2NC^@8*iM9zSnr8ydD_p$~%Xd?^fk zQz+Fg7A4!6GqwFYTOzlIe1`UOMzN|Nv73vjF)>b^x910+y@AWR3)bd`BQVv3toC{6 z5hM1#)P8DGn(tRhUHZpX(VWuH)7Saj{~Rk-2o)98gu`SB#f+Md4&>_UpF&J(?y=98 z@iaa`GaB#saHUrxC0Ir)8_(>dM^{-%A1_Z=%K^e;C8j1}TC!(YyW&Y6E3Sa83^&e4 zRf=7UK-62BbeOQ#YE^bkq34we>BE0wq6J)TL)5pW=F?S3xDIC-0X;w0{y47)xAiO zyVxUE*r~wF!K7B!P1s*n3`otaELwJkr%3&MvFox!QOn%qG!h9FYI(=qmX$OSpY>x; zrP_>d-c}m^0v3%SGkRk{!nKd6ylT?B9jeM075dcGk@P32wuaN=zCE;jn=F%9SP-GM z>p&sm1W4}1ve9HbCMG8*2ikkHc&|lv6bCEQp+@DQh81GE&d1iNZQ~q>$_k^JolVKAj^8QKd&xRZ9n)Tv#|rKhFQxm@wj}VPRn;T&9`r*nLc=r>AUO?2?AJehcy6mGH33 zJ;1U$0zI~I>YBo%r+_>b(7eC>r-E6%Vsw14ff&srAtuglT8O_r*U?AxpHH&BEd_@p zfQ5qt0^YA~AQ0?l#S`r>dRCGZfo9g|0cyC-u0*F9!i%8-eB~IiNTnFVnN#lYK5+t> zf5KrB$=eow<*kAm`rBb(!(!=6G%CAW0~@BF5nQ8HqpDqg?xaaY#f)=MBNd%$$z^U# z*@bWL7LuPYqvH;_?pbj54IM(5)C&&2r~@RE5} zx1xkvn{x`GpEOVcCDf<|P2jul7CBXJ@~U%I3S*X|7HwZSMeT(ejuSS}Rt!4dC@i|+ zu5ATj;@&=^n#wVW`0!asUmEkNzODbM?Oq$>1k9n9wp2)2Gn{W01*2E$`T&@#qRWkTe`ZAWA|C42$jJ|P_}m^ zeKDef_GxDtGj9oE=KG8XZw^rJ*@`*o%arZF)A{&y32QX>x#+E3PqJ6>qj z@L?2xoI0c65R**D^IDUQG6j2UJzhN`T>Hhf;;(!Jl~&6%p>+$_Yn0Q%umK=f*zxlo zHINU|j>W}AaJL0P9Rq{5>mklFA*{+P>iXS6gVfKA6y?!QD#WVIXAEavyu*#@Q<{3v zT^AW6L>yZelf7?$_O(cshJs|^C?hwnF6{eq{rG+WBK;iZsM$n^UF|Rz+BS0~bfeqUX-)$kA4I!#ru&NEe2O$7-Fm!&O>2qKTb9JkKn%GiJziLZ!I5lr6kX~s zheK6dXG48HK}un9qY+Xzt$Yo;?DG+^wtd+Leq*coFb6_cn<{ntbh10ullo0?3qC_E z2VVw(7R#Y<}!!Vm_+c+;OhRLeKE2!}4B}>^7;12XMSS;^gEkk-yK) z(lFh0e&V3Fg{H||WvShN=gDg}R@Nfpk?e#7GImZSpQ&A+bSreh{VKSzjV+^nUrPu5 zmoyuSywx;JOI0yq>IJIeiQGG#T2gvvH^;4_9~e14%1%KYjiOi1Apsk923}HB`!ig)1pvwQaIG^DGVnY9f(3^&oh? z3WGe}?Om!-A@4{p3i(lGP8_+3DJ|<#fop0pLcNolXbrBr1>E%3W6mW@VzC96eC;QGxFoY1M_j+HV)MFyvAW zDaq>Trm*&|z#~bw*_p^Ump!-48#lgY@T~K8@r=(;->97`$9LS{TofeG?rOR?7&fK8 zs>06%kvXNpdgEV}=7Hr`x``@!?)QgX|L+K%^! z+Ixir$}G$(%bPd0{rKN#R#xxIbEO%V&HB8(FUd}Ls*IiDzHyPhmf$XM&6gN{j~odPn>W8v$RxV3lDKb>HZb5MJuIX%a`<~vqKWN$cSJI$wg z%Aq0A`GpQraev|dfPCBNcuX_ZA&i9N6YQNiVO&lT2pmI1H zYus=7h~}YRsr+G+iTV5 z>FN)6=Bgyg>KR~-=|*XyN&8m%IVo6$WPcn(N|$Ed_8WuiYJ=la!u@AM;o0MEVQ3-| z1}sMfbXMXYd6ll4)yq*kO03rBWr7)*471A+Bjc=gPV0TbE$$o1(^oLXSzF~CxrbvJ z!`nu;^TxSA5xY7ly!Yu~5LP$8Z`Jv?0vYy(sh{dJ01YxJYS~0)V}L^K&a>%S@69XC zTKR($EwI0z6sS|!CT#CeO4><+nL#!22>!W3V5_BScGQY5PfP8`)qpouyZ<jGPQkh5DS*Uin zzVsS<`-y^fT8|f5BXkMi@0DjyxtHh;q9sq;Q(1IQC@dI%D!&@3lkQZKAkvmCo0?2J zaA+mvDVSn^U=$}M|(1hF+V zH#b+z3U>^l=P#cTcCdMt6=NqI!rnf_aDFKffe{L5?M#vU+FYWT4k8R;?D zALC+x9eaKl+nn!hZL)^G>_y_Ua1^*_s`IrsUVe-3Y`4lU@(;Ncw-MDZbAd`@6^=IN z^@)uBkuwKE>4vf(@4Z69Sh>_*5`kmcwj0`)xUd=4k0N1S7o^(RSM$SIemHZxVme34 zd$IX?sOdy0$h7F|_9hj+6sDR{u`Vv^__S3tC zOgl+FJy^=(Bi0UGmp%NX=d?1Nx%<3T-=v$eb4r$of@C{L;fF=DqAA>R|8}S1#}^Z6 zx4PN1Kja)Z%s~mYL(7}@vB~V`nyj$NOfpEg^hXrxbxyy(&maoODXgc-Dr(ALPr-02zoHcqRd}(lri@^4@01tA*l|c0ZjqS)+l*X-hp17NQio0Hd=#h{ z?D7RxYQ)`N_97e@Do86w@QT<+kQbnZg1>v)NFpr$BM%2mGhf}=fN{!}d-|4}EmyC| zb<0!ZclouYn#y{CpKW8yTB<~42g99RN2c#zOsRHtM?NW@0Jq8H_M%(pn3@>Cut~TQ zwhKMmfIW!}Tv0UzQCz65Cl9GD8WU1$t?j1#pp5s^N^GZw-1SVLjDf0tT~55x& z!i~8`aKawsg#{ZMdkoPFh-Y52bv;RX4sHqNO4f1I{A=}=+^or8vTIN`S67h^B;HVw z#zi9!jSL%*%f<9_H18T0Pp|z4%R$)GEf7PEdpZ@RDOLl1ctxUDP!&^Sm+01k35ID; z0>acR`M^ZE)a1kTh}oUV6F?je<7x2cn+{ zHr2CzGmHUJp|c>|<%`E4FE5{?T#!GvMUs{(=O{v=Sf@%S@T>_%*P{fuHi|R-vAZ+2>@J&hkzW6e7b2Qw)>`yp| zQsM#!`G-RGEQOhV@d%5^>#`qN8VKi*t{sN8S7;3E!Or%56K0>bsJ9Fh$53#wvA3-y z9)^{mDj{YhLLzy#uQ3=?Ohhp1xRBas-iX@KtsL%(NiF5(~HG`c$p* ze!G}{pN<$C@Ej#&PehLqSbPjzCNu z6Ixu8D0W_6)l>2x(jb)hPj{Cfng9z6%cDoT4Y)M%SFj6TSr8tasHMu^O8oi7K9Mk+ z2hEf*vox!@-_ls0^)1v8PS=YP`y>p-27N2RQK3ZJ5<$Y7eC7lfe zy?MmmWP%2`0nuY&by5H*=O%=3>9Zfv+}E!<=FaAn-Xz*4k?VL}{j_O&Z!IA_OSNsG zZnFJWtI$dKmwgyxDVo#@{Su41oOy-qM>a0f;93gCF>!UNyJdGb1-A|?TG<PFWs5*vH&vqh4m(3Pix6vueO3mt203Wz~l>(YLcaVKHga(nbioeG1# zvbb-rL)OdP^FZzR;ixr-MQ;;TGs;2OCLcecnQD$VglB5`pe;_+sYZ^AsnkWKIuJNq zCtOzHDYcHxPq-f)+^*(7FKm|P&`^d)xEW5?>}MY;p^i=MI|>4ifV_{qXvcV=XfG? z#YROLYqUev%=P0-G`4lwmGuQH6Iec0xJ`#v!+G;kFfEKC({r!cEUD@{bB=KOF^y{a z?8I1^_z);;yvVCVW@3#(5o0~&{B%1ZJ;%dFRYqSi@Rcs~04(RmA-ITJu@j62aec#f zVj>vI@mYk;CiE`voYE#$+#QgnoZ{1T`bq_hk8;%3Hc;4m(t`3j`DmN+W1-QCBL0a3 zd_(P|N!T0JZuR|Rs|c#h{?dup9>Dn~E+HXJ@yE!$zAY3BBIgyqho=@cZdA)5ltF@< z?5~4zYvIFVJs&Nmjj>Z5bmjT1ZMQRVT_!Z9Plec#2_ML}T;_5GxlO5+SUb-Q93*;OovfFC>7zxN6^o}yRN^klfPwHVEq5I?Y)>*ytqLgQ^>nEOzI;Mz9PF zr&%4z%BXnz?8Bzgv%i|S>J&Y+YuK?EVGqbACbWmA@fL?xLlKF^R!2$aC)`8cMsXh^ zMafzMSPdpiA6mX#4&t>!fetZRFc$O>`)TNUY>*{5PwtVGSW>u&1P{#b4;}Z9M!CaC z4@>Y4VdYL!)UMDcXQxf^-+H5X%VQcsge^jJ^cmrSeu$SO1AMn?L*>n1Hlb|MZV@^@ z!6U2o(*6Ut>I8u(R;^%s$A-@GtthnecJtidi;yt7)9M8ooOEW365Xoqn~Qj27WOPgnge7>w?&OaIkf zRKav%qRa7(CrR?yajluMJh*F<;{}<-$5K^Lx`&N}vlFts23(*tkpMjdktcTM(HOfW zY)fj3oOV%mCLOb~IyJIG=$++wKFa3I)VJGq@zXgo2?S!$o7FkZM@Dhanw|uZe2Dc) z4=5^p5Wx3x3Z=#>r$XZ#YMLvy;He(F`e==VTrIWKjG#asaX`FL6$lH)AyEfYX`C3^|0Xii-h2)-kt|Bp~8= zV0o_Nqyl8=>({TqdnL1VCsTk>+v7^s>7kp(L>3^$69z%~%k+Z>kFx{Dx!>H}T6S2MpGpr^GRdZyxA8BeeZof$FfN zWLYhYFD9-r`eI!PE!Vf+wWpGjiJcwT7Fi(oyzpA2hbMCg&aImQ; z#7EZR0bdCvaP=Nt81N0nRR@igWrnw1gZ+<3OCB1Lu(m8Qo*a8$ve*%Uh=@uKqT zzS^F3$MU+GGA+0bZs5A&v4;6iZY*|HDT1C!SAtq57+$GsfhSXy{jn}%o8qXIV6LTL z6`CC)>OR)@1gqebnzAQ&_Ur3(U0lb>Y1Z#2ld4~-zuUm_Vd&%!fj}T2h||nWVoMXR z=Yh)SpPYQ3UD^)AtefP)yWwgMPI)+opnziahxCN9W-r+I5p*;Cra74rqhy@@AY8GJ zh0aLZrhF`waWl4jCiJ>JEOL?(j{s%IVh1T^X1s$azO3KK3>lvV@u@MIqm^WZ7tqt5FX1{!($uAxbZ!~mh8wq`~=7A1;a|QFBboUAMj&9XFYd+<+YVAZ9 z!C$)h6o4Qg6i6`3|LBo5N|G*cpWbQejG*sv8RsnJwg~ZRNXS6%pxvP5Wg8dpuKsjRg;o4@P0MK_6{C7Wd^tPzc>pU>W;@}X<$GvHU ziJc-N)r9J`l(z%}OQ;Fqk^6cx%kx3pUJ7J(8TJ@wLP>(wR5BUE$ zEas$!#E_A3SsjnYw}vR~fuW%{by?{<`uqEVg=i130iRfI@bup!ufQn13#wkZ5az5Y zyGJpqQPtU7Sq);9vi!?%1!Lp6fsMlZqOsuYU~dl?eAyL<+WY_A+FfM4ysqR*=02XR zIYb%%;wdU|0ZGP)-$7HBhPlTaD0=z;QBdi#8)8D_T!d$%33WW=k>vxBi}(i`7LF*| zV=4glfQ=J?YDN!2-9I0VRH|Nd?s>p<79sGMfS!Oa3*Y=eYoa!;u0Qe6?uMKK8dq{d-kUQwX*S9_ivo`Fy>)~&lGy^xi@fx|!LVjXk-*7_K zdDRw2ru%p4p?wMReZ-^;2Km(fqRDf8%l6>SI3^pl%=~|jq_nrCMHGYwi;~S=fsoBZ zfv>#S$c2HE5OU_1Td?BqVcKuTM90(#=PZpD_%Yjd5fpIeF#p)zt162xJkwO(JR0$; z{K!y1?qV~cT^-+vczF0pywp<(Kh{h+Hy^C(-&WQz{@~HEWX&OP#CN}-Ljh+0$UfxT zT&$g0B8Rf8MwSHZY{*I3(Y1RnU&K7d&2ptYJ#e$nUDw4_&(-KW`I>cKN#263F(Olq z%%#6#1$ZjG*RKDH0sfjke50+B0x;_n$APmqEnASzpOWUe-FM%;Di=?gTp z^?V259|P++MMvqSkn0w_@L z26rPaqV6c%j_6}KLd&BNh>9k1T4Zii(=*wh1*c2RtCv45VDxWclzOL}?`--K?{{?X zmweEh&eV)Y4-A5825Cg1t;q0v)l5UCB@FONb%T%z(|_(|!=N(tGYyz=#A;pBppoI8=C?^phQ%LQ1 zOa8~(#EgW_C*g2zUS0t8(SX6_$nE%0Z`N+v{PAQXgwo_PCnD{#wp$vq-X1Uo4ZDFy zD^QRz0h@#?T9Y4H=Sz47iT;4!ki_bb9^7;%18EK#$RCA9c{~FYKQTMNvhEr;z8~WH z`?o`rlO}hKLqUFq?UXF}1>0wH1K2qb5Dp~)5Rm#A@;9SVXzqZxA6nLNkB+?nYNjix+6PiQtl9>;yA)qiba) z6JTGBzrK?MeA|t#DqBQ=EMoxjF4ucG25m5gqJV$^!bB(`y;3eq{AGU|L4QBfe#Hp! zIy*Z9EWyyj%i&!E!z12K*6`&;BNGQG@S9*iHv0XAElUB6F6~O zl)Gl>3u@$`kM@V<$z8rb`906bRwHB0tDXt00X~s{Su^*5lOVtT%*jXz>pPyZx{lL@ zgm}yY6RBlzcDCMdfWk66Bi=5iLTN#ZeK(@OrBzdfOYm~I+hDk_ZlW=eDaK|07yo2tiOY{EBk)ypr=Psx4y{i|UYy|@PUJSeN4PY_HP0Ca&=KbhX<4bz^5I!X4{kMj0 zUk({?KlkuWJX#CYv(*MyU$lE){DFJ z@(NrxOuo5e07L?O9vdNNf(Qf&AB{Y5FpKNx(nD` z&5Ac)IpONMe)E+``jsDyK~_j`^R*YeK+EDEy>Qw$UXVW&oyv89HlD@2y!$Fb7O=Hf zb80}c!`}ra5}XtZ@@U}QYhZN~oHr}Kozv_Ytcv;Le>zXOgcdJm@Ny=Q=(8;N=}mz5 zx;u9~jEX)#6peB_MQCxKw*k+i_TT$}+`SOl65$rV#b+0tZIEf&S}HYun*7?zh6 z+^X5_KL7AtzTu+%B|sy-*Ecrqj2?FA6+E08lHoT4ROq+!PZ@ggU~yh2I2trt{6P;c z>c96o66gN7vbDwih|>p2`>t;Skv7}dbX<<7j{E`Ec*LEg$-3~OdE{0NX+dgb*+2;k zhqDQI9aRA{Aeh0Zkq~PY4K^~f<=3vfXjuiEQrlS{7@(zwjh^TP8aAO7vr^2p!{O;Z z1*jJ*9u8>sdmjJ?P7*fpUW%zwRG?53!#ombrQe&C1*y3Lf`W*{Vn7}oExF55<3Iiv z6qo}V$>7ziCYx&){cHu(VAufaf(HJEKrg<&P=VM_f8NavKnn35#@`tA&PN@yCUddvO=&=r7^BoZ31_1Xb#y!FCd$q;(~a ziIGaW-uGfJf-GI|AOK=MaB@+HW5}Dw zx)JT(;i0UIOiUd=>VH3X8#(D?Lvky*)WV?byj62k({39rv;Q_jdH{t%w;oeCX#`(z=Qd>|eUG7l!{mxS`S|io!yGve9WFOPBrw3B5E0ONG^#u3!Sl3t6S@ zT_)jw4-Xigpg*9~fZj5=tN51>{gOfb)gOwDsy`UsAI<>knn*(b-w5ij_q8uB>H!yA zQR;>^5Kg3Z&4K6fr%(PL?ePJ>B#S|*G)M+1<@6QfKE`Ei4AQgKSPPA`!1cJJ<~hIW z#FN2bCtJES-A8ug_e%(zy!AVA<}8_i%mpi1{8(I-no0wx;$LL(FKJYoIOAZ50$l`T zRN2_v=#EdV=H6GW(cNol{A9t!nrn%Il3g|G$5akbC-2l?br?dJ0Ht^*#EK@Jtc`yU00Joy?YJB*DSv z3Wm7*X_dXZ7-s8!kI=HXMyd50?vB$YHPiXHV12)_(|$#ku^kp$Du#Qd*#Sl!ettf| zOW-&x;1^bX*@eq@;y)1@+0||<#(1+7-QIR1dRolHt2a~i{T(6wq+ zoz7=)-RMSaLYZsxy$PDnm-PfnaF0->(<0C}lkTu!B?`pXlUzWrRrJ&|Q6q5`ZshE_=z6Sv#+3|==a2M>gwu>O%Y*4fD1tgyW$z! zn`F@FU7H^St(y~xPd>W0mQ~KC;w^u3%^I=xp^Z1Q;@nvB;O?&fIjZPHG^!>zh*FK{ ztUqvW$|o4f&=Din)^N3)y>4L(e&p`f&XlZrzL^hNe^IY*iM~mJ~ z_D`j(?)bWS%Q2oS4~LsYs!lNXSads~OhagVD^Xc2{)UidNQFgW`fy}CbIB*7Lo7Rk zuxmPCB#gt$=MST(yUb&_(ed&DlJSB2a6u*_?t>nig=J*^97(;gF>MIgn8<3m20g^x zZ+gIu=T6g)9}XY^=+l$xcc9e7=F4$a15dz&s!1i46OOqfGHUJI-!;%%WB`J~`N=Dx zQpo}ies{1};j`>rFWG*y%cQB73CGnC99S-0v*Ko48V;X~934iHN|@VlWHjCAL9}Y# z)EO<#W{d8A>qV4*8yx(f2}w!weuyORg2atvXD`%VsgFukAHK!mYTVIueuADogjLvn ziZ4RkbKD(avPB|&TS2ux_{Kvb7oL}yl*LP2>!23ZEQcg7=Tcc3Cuf7uj{&}|mp85M zMa~wLaiXnfy=O5|RU~?z|2DOrsS@0N!oEMr0De)L5I_RQb`)dMfKp*(Iv%@naj2t$ zE}iJylgvg^A8LK4W@z(9z9m|xFir68V>ojzBz}I!U$Uv{xIyMXIX7H`L7mWh}PL zTlERyBBaf#nQuFsDL$c|hzb*R|u8KeN^C-oyam<{o^&moivr zTKd@e^=o7=L8+&TpwTWK6!vby@;cEE6@ua*(?>IUpG{UN?(4AVXGZ^77qrF8{HD$I zX>*VB@4wc>R>a9xjAKf}pfBiG6I z?^_;s)&>z*?otNl*4P#Jv~q$Bg~ulPMlS;V;^bR&Ghg?omlnH4D3c6ierMX4Ky3pg ze;K0P5N`a{Wcun)?!MPssv~fe$#{$S!bmCa3Q`l?kS`vtHlLkeh+67Uo%={v>Wo6` zp<0@ggmwVlt14B&yZaP);bOVWVq#(jr*P?H&L9q5VTu8%sj<=koRi z=apG6AM&-M_?JwdZ@r$Z&E{KtuM2+hgCzLuphz|W|IkgDAl`9%1PZ+A{2-~uz%!Q< z6r{++UUNY+o$+ILfRCGY5^53+Wu!Zfh;luH$;RJ=KOjm*Nu|`P8-nBW3Gl>3wF8o z9_wEZI&U{IW50-!a9c#QDBOavh?QWk3Fa63RovWu0N{^eRSmjZCVLTGb@aA+pI^+53_s=2 zC}W=D3+>2^q{gLv4W^;&$>-z#qmXu2eQb|m-j(mn;xQrL+a;4aS*RxCf?o2{@qHS`q@O*R(CkssPpwMPHGzdC ziEz_QisKE@%lgXv2cW*PKWD_P0in7LkxfuuIRH|j(U#*je5Sbq3hxa=Yy(m4*x7Sf zq=z3Uu2uKm-yzPW$ycRE81EgJn(;0@E&cYAyl!mN9^pV)YRr=wH)4bYCc~)K>7OC= zUquaTv7NOi(qMw!A;W^E^!2Swh`kt`%m(3AYizl6WHAO4uU1RAp}R?e^~N)IU|;WY zndOM*IHa>;Hk8-6Xt{U-q`L#mF|E~hfT}Es;`o!P47E0q44ygE7QA(2i(SamO}U(qD^<(P zSp7}DYSegB489mj-(kC+*Cl0fOfFwa4T@?OmdEGRV{e$pq2lkZyQ!&F9rz4?cX)yc zF7TuKhj0DcNjS<&K6vWsZiZ1ehuMo%GPY!8MaGhf3!l1R7jE*^vfxFTrYVByW3(if zU8{=f%CDCuf1<~H_~C)`P%t4xd5ZCqRx0W!ev?6-o|u_vA$KQLKno_>Gp00TF{2jS zcmW_UZy_r7DKLuAHsOzMjCaJ_%AP5#K<$<#$W$G5jqg3=CL>$9`XN|jd%+oY^BB)Q zl>aHehnJPc0}bDSP3&hv>O+E5{!`K~mKk=+N^Nb^Q1Qh!Rkj|Fm58e(+%O20R^=SA zP!U23Q92f^1BD(94ejIEs*(s^`w)s6H5D1{U=S4v-L{eOclAmFvb@mh&2%-*y`vN} zQbkWzDc#Fr$}`jXc|T7EE6>~P%&^}yhhkzQDx77d1a>$Z$~a|<=}kGY-aG*wVE7z~As8Rz9n{_L+xR-fi#7@s`1IR5s4uo^g)YdeX zytDiUG$qgiCX&jCwe<}R-;+Pj{=<=Y?!&A!)Y{=sG;(a$cQp7z{Usb3827Y0Lo){n zM;;XCnS2+fIJTWU*-$CZT9t04m`pMuFoR3Rgk}^Bt>evo$6w(9l1i&8g&S77 zizFrw%;Y5(-QESPj}_^HOGWp4+vM?@C+v(S-4EV{3+mox-Z$kU86v1UysE|~wD$U% z;=ztT({;5FKBwjENKv=pyn^PwyjtpO5;)CyW$r4&-rn9D2^-|XU>+Q3 zN2p|d|F-y41Wz>+&Lv{9Ecl(4BP{d*iMG9lnqgl02F2c6Bk_cE84=;jI>WLsQg>ps zbq$U((anzbMiDzudqp`{MaQ58+AlmaM-@8nurS zMsXiHkC`igGQ5S=6d*>7sSm0-z#JKrFdg5y$^xH$=^igAxm9#9QWLkRVM2WMYKU=^~lvAwc-LK82HRX9Hrx30O2g{|lblh3mD z=g5&H4vW7e1{vF(0n1{AAif3fm3ZVHgwQ1+p5qb8_j105rp^IeDg|vD{ot-P zI?(g8Uu?c77wt}t!4{t#qm~mIgYgf_IEq?t2aYv+b+A}m+tss^IehcNu=GO{U(4pg ze8nzUjI(@s+3KhzTzV*q#)?F2&=c0b7M5mGo1;$8LH&1VbB#z_=gpfC3-oetBptd{ z2D77YMDf4r3d%8KrS;}@LU?o*Y0LBPmysUxH-tu2vo^%H4-XH6ys1w({E?$O5Zlzz z*be_zSNhzZT?Q?A2v1M&n<@h6hP;_+m)!V_(E2CEoC+O>z)53JPEsb$v25q)mY8`; zyNT)K z@^p$&fS6d@{B1r1aQCdNWQdeUa%U=5+Yd!Mv0Emm=uYOIg6=q>t@Az3`vd}|Itrj% z?a|RyTE;up`O2!bTSq?4fJl`>IM1SvHdfd!!VXF2d|X@2QcmFqj}C7~fl~F8e`bv< zqUFBfx9M0k@Mz_ax0-SH5^^&!Qv;a_b@b!= z+Py_(3Il{yZ|$8a=uDE5bbQ7MJ!D6@{!H4l3noNO$h4D>g4pP((%sl-G{@Yrh?%t< zVIDHBJXUxOcNE8I&av1^#}8wUU*pQ&j=VlEvygCw6pma}#ld2;C+?{V-7fxQglJ)j zrdO-lSX0)O$D9Ai@_L_0<1McwIo>?Y*o0D^9jTl90%jJIU51Je!N8!V?zu+lMw+~pmA$eZuhrly(E&CoS-jc|?zW*{>K`n|@1 zHg)jq3!QX8gb)<#&6SVG8z5A>==tKoMJ-ue<6^hx`qJN;F!3vwlt#D4@r3L;f7)e5 z*xFl)9^`ndVioqkSrl&O`x=!dXvNXsdB@l!p{egC#UV*}Lky=0A0lXF-4QK2(^yY? z%6V?`voJ;oTM2_RwYEo!LQjshqCy7IT$wDJlF_T&lYv(rVW89s$hYPGaPN+I!Yt|x z+d)5=vDqJ+xARnySBBu@?oX5^Tb!JBC5vk1(8Gr_W8uB(UIJ@qiFV5N?&4#dR`ZYz z%Jksq15fJl z;sh-o<0&#?1sG_2%Yz-`=+TyP`{CwSOln5M%G1FyU~8sx#>>4%$DeU_uVC42-YPF^ z77sqMk+&+>rm11XgHn(p&s3obEsOGRo`LBzmgkMbj|$)wO8vKzQ}5nEt5Gwm+exy_ zl<2G-tk(N>*Z|TiV0=37pkzd!6qP|DnIK=)B>E|%pz{sj#-X4sZR>q>G{FDGIo7bYUW3K_(}wZ4pY- z)Guy$3tgp`m=C!7xE7SS+4_Sd?xDrw2&F)*0Ov}PU6!B9r#`Wz&wkF=;my!N&Dj-b zqslYf_Mrqu*E64Gr`vzDIa`C*7iA^nWggeW{*w_quA~wne&624?U)4P1508XR zQ5DP}3N0Nq4mioNz6VTEQWVts&Wu};_#Ra5?Mzrd>hR^sZ(MB8&F5=F$(cHgswu;G ziPHk^GE=He{6}(|b+TfcUvc1mvDoX$xa7H+8^C-os2wp|RH?*U)Z(A;Qo*J-aU^Uu z5B6>`2Gf)bevQJ$Mj`Am4M^R8{2G+U2=Wsmr+1$5pv#US);?sNI4W>Gsc`M>PqqLt zx>ZAS*HAN6Iqqk0U6rHvdLizQE+Cz@$8=poLsY$e*8T6KC&*wzQ1(&K4XLd1pgXGM$Dlod7 zW1Y_@LcVv3@sT*>Ro=hDo6%8Eo6*vKU5OaVM@Euk8FBm7*n!H^T)S{oB`#Bk^;?3A z;P*n4!fue%SS@uTlRx>DK3r^-H4_i=(~ZTIu`*}wzzW_|K{iz+ErraLZA4`2aFkmbBrVFiOX^6p=pl|Hcycpe4DA_)x6rewm~p%YC*S zP&=aGz~KX9xUh47S`b;k*I`z5)tQO%A+q}|taYLz7v7z%6ZA$O4ctg$Fz8I_P zGy8P;kKk}LTp_Et2f}OdZ6KBn;yuU5$30h7u|ZkZ%+J{cs6o59n_?f@{Vkw98q;Ru zGvzM*U$tz8R71H@$|)z^qNl5*%sx=XfLkSBzNOof6_E}qBA`+P0RbT>z4scbh)6FA zND&031_-@FP(XSwk&Ym}w*&}D{`0}L_Hw=Z-ACW)mlLjw3!cm}=9u#t^Ed9{Ttr$% ztV%KFThoo2^SVF)Vw`j@q_D_0(93XR+xx*G%ztS_x9cqUUH@ui*UkE`ARMc-MY#_` zR0{?`a2^;K$m?)N^lvNaY+z>`yk|FInm>Tds&r5MsgF^7qTjceZc}FL>a5qKH2#&e z1tsp=vfiR?o{Fb9ie=VT#Eh>^Ux-7mF|_?j;dX!RY!vzjR;X6A1OdH^>338Fjl7sXchKT#|kDWrJnPy_TfZ!ve2ouUCU0^(HNvie>CiSxC~ zfX&FJ|D2Epw(~$QjLCw&gl6K(%3$jg6EN3=~}B?y+GGW;giU!wOrs zYtCcPN`{sJaM^azQL-l1seJfBq))#cO+mE#eciWm&7LbauqW+)xhV(bw_ESj(=_gq z$9sP6`A{*-n+b!z8CblqGs5-irDL&@5ze0WA+l;*ana zroK~Thwralqy3XYlyN$<>?;Xn&XmU@^9`Uu$&#^ntp$po ziHbfQ`&7*HUZjP4ctTgW0!NS8m6QTQ?YEe4}`g^qQE|F z1Go$zegHI9)4?&J6BQQj{u#&1*S(orqQ_AM$XSP+A*4Ok3JNS@_6=Byz`e7tXO_;yl=OWy;-EZT z)BaOr9o$a~QX$uNEA!Gx=S4n=#4sKC&_vmmiObz9ev@dUP;nXn#ZNzzk zBmM6^6Y?to3Cuu~#SiFnqFqbZMMcfNo#Y4W`>2~AHH8iX@S<#p+0!TxoH*mwa0p!t z(mtEdbp~!K@mfp4dB5-;2vgl0L|2KHP!v7d$b))jcTt^1?$?X z*t<4c>L2B%wMt)>xO6lN6w|J}O(KUgIVMcZ4CTfCj`1lX?*k(SG%JP4G0(w!)-Mz* z$^U{L0hRL$QIO6PipwPdBXY>2W(n-#2t~5{|?H4i|Qv|E$2V%>Rm5iD6QJ?r-+7cO8$QqW=XCSz4zPZ3}-0$Aqf zQ~&xcU^fE><~4|J|2wn~(olg`0Ns3s&_9?#3P6?uI!h|50?NOKMG6vFLQ<~ZSd0*w zljq0To(JH%8q)SvEdS3iguU+oE zv3?FNV<2JV_a}x=9cO{?QoF$5OPXBBqu)9z<++_WdHyeS=AVib2=O1rcI*vh^wJ`$ z*Q$VU5FaYk)gwsz5cjXAgJM2S8Tvl>-51(T6~SJmnq|U3c9{zVd%H)Hy6g38$#FU% z1E@f&XiKxd0uf`e-H*G4$T?!HC=defe9?kfn}$G&`*&js$K0`AFw`P^U1Fxsf0C%( zJv?{0u(>&+htSLAf zb947|!vwKWq!!J8K7t?NGao23*9O#^PA4FOm9(=6ByD{Ew6JK7IIv)t0@$5@gEARx zYF5LsAMCR&A2hA4;RLy)_dleJV6C~YBa(o8$W^m*EOWD)3uUBjm?^D4@f(}_r# z#V4-Ly%V;C`Z{@UyOb-^71$r!$tClb?YpL5bshjq6NUnv-!jD^JDjlYI9-Vuv7{Gx zW(H)15Ip*?&W?9UQHOdTTB0i^XU6AKWDefBdU>F*$pAN;dfY~?;?yq_M z3~XErUi2El)zwUnsbfBD7jmtYeVUf*hHZUdMrHHrg`6wP$0-KZx~5!_saRh**LXr^ zKd*V+v5_+U9=#$<;h3i)SanOyM@r7|bN`7u-2}qxzn0TSCilH4`6eIf-4^OciQOW# zfEWuxTO6CU{X^K=%r*ExbGj;iepy9)7ueG^#B3PV%(94=%2+987tFcqL7iFY7cdC( zZ)V0$eFbKBoCydgo$vaPant+*P&Hi#U4=xBzr0e9-lInZLZ~Ho58)93Au+pfLz zn(%ljAijqOVp!ceMn;`l%|I?zH(*g_QX3@`9)~;rpG;r79#)39soezTEDrpV5T`J! z*G0{r?&`|}zEYL@hz@-s~i4WNX^!qCEk zXBOWL4acQ@U^J4)#GzBBs*1P6B>q5nWaA+U*QxhWhR+E&?WNq!)y!F|g;K&XL%1RBC zFl}h#{)Lv!Vw(0Qf@Q$G=#7Q1XCD}%J}l5~g5IiQ?3Deq_+=#s@djv|rA)BMO!$(257&WZiqC^1;{wxSl5w|4?Tk;Nb1NJ>b0KF@f@) zJ@BQN1@85O5nRcx=} z9$5o(Zc`nZh1HQTL#L0AoY2yr!un{gOxD>-3_GGO*Y58F!;K$d=>i+i!&|274gO52 zrYQy3#LV?5>754H%13!mQj*&u&|~}rNshp}Stl}|Z7N;&R`J-T{F<1O;?d!G^rZ_u zNW$yGEj0CV94K01X?JC3A>B&`DXlJh|;RbuM{Ck!ifkG{GD32HgA>dK-m4>XX%01 zc0|DK9Ei@#3<4W~&f5)T$DuS>`8_0a&L7VX+C_2R{ z4DsxTRy;Dgud&^=?oa7<@7$T~5o6mPLoT$gzxTenb1vL-Id_KeU6(fodjG%ZZNUqb z{Ndg-ycB7Ha3JFjhcfKoI+Bp){|Fs#fc_T7)U??ZkH=)LRZr?i`1GAh-j9xx0eo@K zZ%Ja^xB-b|Vx_8@z(Z}M?GG4z zc9T%vBX!;9o8gT_@gEgrf|C2j=$nXhXR4eqjxwCyd+{pc#CR2-A(YQn|M=o7P?jyL zxpukfg*`SNf42J|IC*PrvH8X7?wo6x+rHMnA{I7eH6YZ`m+Zv>c?Tz|$DrT_Qzanq z!|Yp9r{TmOVnojsQd9TWw?gJ>7i!Rw^Lo>-sND!5P$o$~%=Pv}&n*^g^R#W#tn}{t z{bU?%5O1v9bR@nM#HRjHA7|xJxcw5*0vPf4s!~qs8ouM891T5`0Bw0NZCbm<(oIa7 z*V`V16R>eG!U|eud$F6Q*!mz};^*nvg@_4MH(R&YYlMu{K>+BO^t6BSF72ua_PjRx z!CN0ZuPd#2qvb8d-_^U;!Vm}yfQ?_ix9-2*2+Gdb{0Ns=b8EU3ST_|fc-C?$esKEc zy4-xwFkO4C)1sPC_yNd%3vaAmbN*gEI8^1aB_T6g3G1zMl%CT#C-viv&;BQOm7N5o zf5oA2RFM2O^g4eC^nxq`ea}I$%jyWQhn9JK)2WcUB_^)IF+tCvOD|AOuM)2hp51!g zx6@3-#2vICxL62;+DV5Rvy}4WKM5G58Q9LVG$Rw1yxC-M8^m@0i0unj7k>}s++v(6 zEG)c%I^b1s1?N&wgahQAIN#6kor%CL2&GgJSLVGtgwkgpu9Uyu@NsV+1qC8ZzG(@z zFtrV&)ZuJ1PH!YmFzwgER8-v2sE10~#Cb>k{S$^HQe8XPhf08=%;gs%sa9md=$j5b=mL6%xF6P!_M1HP%VeqU*{)5)Pr#R?iHDD!Q9cJqpVhq4SHE`z zkT>j6AgutPtB=R|sJ|qAeZc|mEFwu1gh5m9-c>9v{^R3AYL70Nr0tmPjyIO1?y~y_ zMCrW>F6MpB&GNI8q|z=wCgi;p=vIMQ5cehteY%BWf1|xYbXKs^G05EY^_NnA73uv} zH9`eA+R8Ke?6lf?_vIzY!9SFs{YP1o@VmqM?y|Ge(Mvgvw=Lpuvs<>HID)E(vh?O# z!BHZcif8NPZbwa3;>K7xptRgtSm*AwP zt$lXtGTjh2!OQ6pH0g05)70pCtsaccY3a@j;awO|cg^VwW79?jwoW>#YWoeuuH$)r zv8Z@gJA{Jw0flSx(mX!+XLfH{pgsF2>+-y|M>%kWvds{Gel zP7}CRPx-;4r+r$CZ)dX#PVm=3qbM-jiB{jR$!b`@&8#y+b=96A-e|&c;Fwx862?3eZt+8IGlAgUUGx z?$bv+t2i75(WI;sTq%34T~(N6i>}EezO`{H#pY-*DhY!#6T2^V>(gXpmNX{%9{tTf zA8aC7=I;T5KSz7trJaGP#pNbfz99?DL1wJ3jO6-=yG3$ofcN!&1YWhmR!W%M2T zhuhb@bIaWe~_&zK)eOez)SVJ=<$srJh9g?=0mzU)_a<(6XV1Q3QlE_ z0^j;|#JIP8R^1tq3$=DPDLl+a-EWpV^sdt<1>M6h)Z z2)+Gqb#r6-XHz%epWTEkG2ri=F$a_g4q4E@5?0*^5fFLn^Us!U>6}YP9m@^*JY4RL z&vT*D_t!_|lPU`(E8naKXNNW5$5>19fEq3F`W=gF^*vv#M$1;~QSOU{lu5HvVzs183_@X*5q5xHIdk7}}{L<0C$(d{R7_H|T)- zFj}eAIjCGZR-1*e1}O*<^)9`&pv2&JD@9qd+`;K@{izggAfo_mrXp*_5IvfZVPy|dJY2k*alhZW}+P0Hs5FPZtu zISPE(UikT`>Pc=!P3#0ml^Os|zMJFj!DMTVj2O#QbmZS4&h3wcOVHTrIk%T3oFCbA zYX}jlPkXg_&*nqT(48FqZYB3WqMuFzdYhpXFG+Wu1tZw(d0fW;M3OKakPOca6yIsD z|J4o%vh4~Vwn^#PevRV1)NVGo=tS(t`-g3Ey9}-z*S7k^Z=O)HnPbg(x+Y zSm9ynv(vA3QAt@jxRn_c3<@uP@aB@pr&n{JGMBu=cBcqxPaC=8Y4~9$7#|@?tl91y zayjk{?86ceQvZ}G)lfQJpz~6_&MO#~t^`M9V*N$7ZIh89pi=I@ubZ*5h)PIGOiaE<#Qui#;_9hDvHR=AbAxZ9j!7Y)e=e5Hzz-%Vh-=KUG8 zyqXM1Z7GmdXB25t(IYu-?CZLgq~rD_4NvsOOiFb@JJq)@d+cjDkNMF{&&PK|LBioV<&XL9WEMQOX3$+Bz(Wq{ejG=d1@nrU zw<-oE*}oz13Oh&XwQH(lMX@=R(;SU~X8Y3;be8QCvi=utA^L2Ua}ZI5ixH*Y@}^7q zlqaNnTD-~Bm(BcbB({)V>}t<&au6fpaq#U6Oia499=qT&Ftk0F2ZVKxlKNi9w)p4_ z|B|`DwlUNQdo{#<_d0Q4eA&mwqU3}<3IdX@W#!oV)?U}G-5lrgUTTLiX~U7(S`33X z>*rHk3A`AYKF84Aei=Lx>-lr<+^-Ud;C6t)`0+fGL4PyV1i1!WvC}ISNkDY}v6U0_ z`A+SQ1)GTT!f@a>sRN**#%rO9cxC$#&6G(FzC(&aG?pH-rNRw1EJzl_&r7p{P`Qgc z7lX#fOU(PhonTLo>aG&<6b#>~+|}PUJ+ZFycCO7i(Q<8nA0XHk0+4X@5G>Bax!t2O z!jq6B?=#9cnI9@tuZc{OLiVW8@tFB?adIYamYA}*P6Z_E<)$cmwx(su?8k#rjMsJb ze}N*dwWVnnKN`|xZ)#E*qwVU+mKNV%SZMf!4Ik$n+3UHFH8qzc%RRj`-d@zkFH>v0 zJ2&{Z622c7v+gCg)B?)X%ixkrdIl5*f=B5=#Q~?X(}C}b9|W;IwD)^8lIuX0ExNa4 zEATUZ=xH-)C@>Ut4o0(T34*Qwo_cf$S9)6#d|XO<>=J2Z~%aS^GeW?mIz%-y4rWC3fOeNCm z;4H#_3D<$fgfp6gE$h7N7_3-iS{IYL;8rYaR6KH1r!1?9OSK)O>_ z=h7LnT%tgoVd49y`>qqE+hevJ(giq1EokGTPjiayj98dB%?0m)S{$3WV6!w-q1H(ZCg+7o6kk0LY?`zWdpB zvcmldvN0Lte>@MO+G?rfYPTGX6NtgY0phNXO#B~Yx!?6HC_nxz<(i?gYmlO&r*a7y z!>1&Jw_p@_Y1w@CqSm=bh_Jag6Cv^zRtjnb=0VJuss<8E#k~%rJeOf=fqqKq^}~iP zkmiCufb9*@56DpEvz%vQH1{nHXpz5;fMnr4x*umWPw3L|?_rK*8=k5ax7UMGC!YKA za^ne=6vedxb$v^AWMiYF?fysyb`>%!uZ)UP1>3h)zD<_HqaJzB8q7Pt1L*Bm8k)^| zIcu6PEz-(2&v=)8uG878^TL$i2b|B!MQhlaK;J>@&71XQ66JTp;Wzq7GKURaORa0xawwjXF#&Na@GelO9Mr?TlT6_TaOp!zEDnu@pg6ka%hTbG(bIL3Fbn+q z-6xj|-+9z-g3OC$4b3Rmn7%7pbY>DJ+-TAeP^Nd))dFoZYjV1vAC#~Frj;71TJ^xG$a<@ z)sPDF10Mns8G%IkT79+i#v&zgFPV_Yprun2-lAkEinjLRj`uFlmVD0Y z2XdR#OmJ|%wuw8TttCE9w=n%DRzh6dtLKuugLg?#?V=Wk%heh&u|CE7bRMyT3D>*T z11JQe709dvTRrB)tcpR6^MvMYGcy3<9o4IY-?&-7h<#eoz+|I*L(h#^%+smYvszmB zAZDB5o#L-bBUE;vSdQsWefwSJ+`aA%txxF**#1s{E1hVx@%gO7YvzT+^;PBb*81pI zZ_sHx26X@Z-cOeSi=B58g;&P9`ohHE$;)E0fhI^gkGd8Qo?V@xPb}-EyD7}2Oo7u%5G6N(b5Di$o zU!UBvy{!#_i+-tPyIZ{W%7jaji=EkmV^uqa>hmiH6XOT1;3&aWMGJ!GayK<Supvr6Ps65la8eoAnki8Ybh)obToLYnJoXKEWr}vzYm!^K>&$ zT>GgEvM&l`V^||PGQNc+ofqZlrBcNp0#?gP zWbbBliAXM7Cx9Aru^q2hJ?b?s@Fa?S%>DZn20k1N*|ktXW!M+GxcgU;O*I21Q{GtbATU_86&Tq4eZA_d@*vM`<=@s~mUT`FoL zw9)8wgcpW6m%xN&G2oY(dPincw`?Me(6LF0q20eSsM9P|uP=Wv`<%*7e`5ea)6z*2 zLKK^=A#SjG@I93^^LlLNo9DWO5=+3`pr(Yi_|B| zH#7zPz5zC?hohSTGx|CfY!xRwu06NBap(-;-kt)>()b)-p zZ22{|{et&EieR})Ls6XqOO#n_xy>NWmkW7N2Bls}$v(&ksaeQj#iNJLdi~s<&-y@E zm(a{!w{SBD)w*>-9w^2&(JC=Nj7r|j2Pbb-E-*~8thR^^Tp`OlO7W+z18V4psnV-hrJo8x=ki;|c)ULJ5wG%vjYn)Ee4LS3P6< zZgciIDm!pB4kSCfp(Fv(5ZBjP`{i=oJxuh}FU9qb!Ip>*4t07KgFT@5hryi$jqSNs z1Y@P&wzP9XeqtZVDDO9J!B?E?8jPvCB?4k=tvw{CxUui2ZSHP4FB;8tc;n6zm;dPI zDEmmnNf9{%ek7tF?oW5)rw$G4W`?L@p3STKlj27VdQA8yCNl~E&;2u`s4NWMX z`@Hghh`q1;7qK_xFR{16Z(?u5X`z3_-jSkYd{%!E{x7-XbsF2XZMj!lG+()h43mtu zr*`U-x^N)cIeq4F<$+g9z-i*j>4Hdy2<{(Y)BGF3vS+-Sw`Jzto9Ng<;UFT*_DPv- zYP8G^=~QJ=<c!{P|%WD;OR{tWN=fa;-sV?wPoJ*L3^3cJf1k zWR6jUYz6}|fzcoe$6tCg+VlD$h2H0)doQVOjI}P^vabAA6Uv_dj7Zz6aG_2RaGuk1 zctP>7nT``yST7DWv-Jxs&m_z`JMLt%elAZrjv1l=((}%3XWCjR=QRz-)v(-KPgcfr z)SA6r`t3;cU**U4(wf_cZ%QDaGjI(P*6#w5T!4*@4w&+V-Wtq9b|_&t^6PS?$K5KLt5< znw4xB3(|2uyA|Kvh8#9;K|=OV3T?)L%U)Ym3e*ViV`+hE#~Sboa_C@Y-@|38ON!#+ z;N6a6oObdZgu2uiB*9`ZkRa0}Hejos#Py2tTI+@X) z(PZ>_7b;i17qQgpL|e1gaebEF=m1_$E|=G|UukDPQ&&_?Te5hzqOT}Te4Ojl-;4hF zsMFtaDO&wzC;93)OvmP29UnAwOhXaOWq>xETzYO;>I%|$5dq!)VlwB?ME4|iEv!@k9-&XXzij35^;**0$Z66&nQShY#PsdBO(XqU-eFn#(jPtSz zvX1B2ajR@@K?oM{TYd*e;sM1uU-dIRe=Fp9xS&_Rn49%um@yD@99Iy7JIr@w!*7k* z+WzSJt`$!4y+pL3t2JAF($mn)x7>PobC=p%g+Tj>X=uMg<{5DV$vTKOMHLgHHcz;N zYBM!wc4MgZUB?Ga4iKlo5^7BqPL2EgtjHxXY}9S45xGuW5RpFUr}W_wD||OfAI0Aov#c;TDG4Lo0=Gyp*X!rJB>WE^ajSf%bwS=| zjS`)Y{8r*7e@hKxCt~TFPG4JR@i+uASaWGufBLlruR^MD!`fagZ63{qM|RK70@Z&_ zEX&nEXRy)1o7ZTqJuTESj|0tp>!rOmY+c%Q!%6z*!boy!80W;z zFJsD3p~swL(z&wvTQ5o1?mzhc76V7+@J$jllB?Fen_1jaO|R&xw(-^<=zP|9?QN!% zBIC<&#Yfy9Tuv67pL<2SJE>Y)xjhWlT)}-Ub%DhAN(xb>U=v3Vq~yc0IOB1XK>pns zwddvJ+K-t-Lfi7M`j<%X6a`c`SgSs0w9mFRzYDsLAsLq9L(be97WRhDT}Jiy#3==7 zXfUP>C-MibK439#bc{Z*eO5`}EeafsdE)5LucSJRjl)t5Y{F0LfCPuBip#G^lifcQ zq>Rt7?q3SfbkuUyEyG?^NE*ckv@!XPMp?@!T`O0INR_}eaR&!`>5~|!$89(3!F&C> z#3X9`oyo_ax*y-3E>L*1?xVM>UVF-8HJDO{m|zQH&>AV;gQXt`E4&XAYQD@(CO;!f z;*={^L}>w!*q3Fn13YzNHPB)`3Yn3 zbwyUwcL0qw$e?Uvm;!&WV?@yTKa$-wl!vWs;!-5bW&Cv_W`da z?YVt0L{*?MPdJF;P@3rJA<2By+s80vQe4ZooRPbJTH;YaX~Ki;5nyVA1Daz|3}W5& zulU*HmKBU1ve~g-8hr{@+^zM9QKRfXr7^?f)b?GMLSOyFo2LUU!kY)=j0NJ1+Mkgy z^v~{#iqG9D^{a;r-lA{Z!lpTiKB;ais*ZCXO`maPa?%R5yf$nv2Wp5Eym}>_-_d0o zMa}es8fvl26R9NCj?t+zpas$$T8k_7M9stkHTnF{3CakD>xxB==`1iJRV~ zg*vk_C&DU*t7O|=d2y<3`DB6D$&$!fx&?(rvNZY+lh3hou8I>qVW2FTP_z3%A%V$N zRuDkPp?Z{4ORcyXQTa-KbOQ+}xog+$NDktprW@eC8KcqdnQ40764}i*qzK48AQU0q zU$1a^_JRSN5}D`w0GJYp$}vp6b5*OrQdXj91d;Rl!dkX#krv|G!Wx|(a`5uU6;=AM z-KBO^)Rl6PM6=4!XIcX^cXaKvuxp-CZJ4FCq^!x3@+&8FhobE^_(5(yh)7fe1XEDZ zkPqqkU_iqB@C8T#Tw01Jf9^L3^k(YYcLq*ij^Kh~r8!2eOseUF@f7!?xv+E#rMg2F z6G3eNUTyq1kio#&vb4%X9pOGfD>88G`OBl!7<#l!8OsO4d zBN=e(TQ$lEM7!mBHP0GlRMEo3d#G8|x@Rbn4-++m{Md(Fjf`F)>NJ1^=))Hl*RjnS zlw0aNRkgg}L5NneQ=g)VNgfa2cx5g9{mKR~6)tRN;#6($$)<Q42zf$rreYs__1bd(1!j#>{fo(qzM`S_W2OuOB_Xl^fE4a^@ z9%Tjaos~>UVmpjb6c0l@Xa~uNRexX80fNevlp9kqh-^n&d|0k#5otJcr2?C)$N{n3 z6m}%+9!K)Mh2Br|-6=#+@;pyg!|e}phUCZ9 z-VF`$Di*UnulSN{HVN7?g@hqYW@Y8@f%(1h4SO<0jH+4}eiJloamRA&j6Lu>vBe<6G`GwRMgF}q_s{}aSxkb+e7>veJ2>5EUfMMHEa)KV z%cQw2GF9v3hOTYx?vFq=Z=fh0I?Ge@`WRKWnYnqT$o8E)=7h+~8OQdvwp^JiG6@Hx zSFl8j{J}=oQ^ui7v=NCJ0(3=Nh`vsk5H*cXCU0}ebY%% zU2!svcd?x0VTo`F`q@&I$Be5b9I?%6u+O}!hcWKJ3*@KOwO8hDf53R5dw^E3_g9f-<3MfD=#B$X&fELZbyrsH<;!;KlMG0 zWsOU=O`qFwcRIeJQG)zEyR(gxe9^;o*GVr^mWZ#otMwbvfkfv!z3=#SWOiINl_uTg z-CpjRidNc>O^vGh1|_Qc8a||~^=z{A>MBs=hxsfDqlV z`40$; zRxx6RV)FH|M`MlaxQOlNl{D3H7X7Qu^x0n*B{Op-{+vn5=eO*RrY0^E2^wLA?FAS= z41G3im4<2NKveKY2FW?%t7BA@7z(#X^78T~-`Hi9kEvA7B=={k=;|i#{LjE&t?&A} z$X73=1s6v;>DPEZ?%R}M=@M#i`SDH^X{6a-+Wn+>Am~~3yPOfL?yz){<|66y243WE zWbTr_CWDjJn0h&{zEn)t(b|F0sZ6{_U3+0&OmFv>eK4r{Qi_wU@TIvN@Yi2YCe40Nt^BQ7A{o^2m@FUKV&U?H( zWV8mY7ncnM*H&(A73(N!w99j5&`mwn|C);*J)L~%bS%}4`x;)5emsO6g2bD+A1JEOG(8<)jsH|TidcMN1QS3a!H0O#8y4jdiGbG|Lru9S! zDS5@Ts$BOV>psSo()&cQSBzf)^0?jF!zEK3%>e^!kFURU6YpK|lS1D`kJ#*?eNPX8 zwElF^@d|i1$cn!2tT3j#qOwZmk*2F1wKGCDfW9a%Y$yDzn9aqYvS*=Hc`ywTx}%TAGWrs z>o$hP^fN|9k`Rj)#wFdMcw;nEf=I{sb=Qy9kIa5eR$ys)xk~l&M1pphPT-CWSh<}Y z9#cPC-wx4vJeZDPQh0e6_}H%mSuk(M_yP(_Yc+QJ7I*sxomOcUqBCgBqqiCkiSGr+ z2lr1dRK<$#!v?)M9AEE!HMOph>JZas66z`P_tZj-zV8A4p?-qI7Kb$SNw~hrr4zPe zGpE#r8&96p9i0;nlCimX;^a|}sqN39=naC-f1P9{=2hK&>X9pc4nb?+e8PS{rpuLh zXfrx*-F3`!bE|2>)7_V_f!Ui&^ky)6eVZEYPx8P)=}v3oTz1DpIRjl{b&^e3;`pCdb2AYRHFU+NXh zld@G@O!BbXDcOwQg3p1@U@`v2cW;3NP0dv*HQ(_h((u`8cD#+@UD=~GdwAR9Q;B?@ ziU)7|x;G{@Mf!zxgvhV2kkmK0uMt`;rRFwTL|L-PekYaWoX94e)WzlDAQPov{nGO% zI;5I2gPlJtUaSauYWB}o54f$e8sM^ZFbwvbz51Odf=W-lcYbCpFc z;qwsxTN&Zv3tTGihae9hWcpW6bq#E^#hzQ)1U;F&?VY|?ZcZ4*Hz$B~A!J{2? zQr}}le@T>)n=C1(&0SJX`xCz$T+G_qT8hk`?fx*WPWPj(^Ga}&xf0yS=xAOkRy3T+ zlZl${y>49h<5iI-CD#piLwNdL8Ml3Znf{6AoB2%ZHE1sYqccr&@*4AZrYRAyf6b=T zZgb8LcG>iuG*vVH@vdl$oLnEZjt&A_$2VPalU07=lbuKlRCa`I;V6>*S)CMv`-6;0 zR_=Gt4_+F*2W|VkeVLQ1`}mGrN(&QVi&7!R%bka?BJZ_D5!T%h=y?+4b8|Vm&3s*N zgPB^mRp8TNrnu6gCG?lWlZ@BqdILs^j4J-)iFt3iRFspiPkU3A&fbZs!$Y+79iv1zK^&S|W?*?a|gFby{E&AWacdF`^?$AX_lrU{O_N5$RE6d4O%a+ zu9j-HyF$BAbY1;n)=s{?Sh|`S$CsBmQ)w28ZnLL!)?;49N`IQmd0S7TA9{1;-;ZXv zW0Co;JIM90_O|nW=*JvQ&Jl;@|`QMg#EqvfHcRDx> z%_(z?Wxq;iFbfr6Ipt}<6i3c=x8@d-KP;7NDG2aG&m{zBPIugIpKj6b~XdaB(io;OVE{)7my4#wdb8|w4?`kY}Sk%$jCVF6Kr0~o_z z_+h&a@mmA;8C-Xk?lfPRSClqTo1Z@zqd=8NbJb2){{)h z;wGd8Vg$j=EUEj-1}qzCimL6mntm8ETSs_jE8cn#oUaLD_Cdx&1JkF~qVsx5Na~-Q zHz3(aoj^=>!02n&MBc-)X$=&wA=ON1t%l9RFcs?7t3_hHfig(XJC>+kSE9be41Nxm zdGx;q(EoC2oZ?88TP``q%##~ib+y<}V+_QS&gj zqm3_TZrT*&QL6fq)_1cG7f6jzZ}S{XP%(Ez=pUDIoSjoa?e$$)6~^RsdBMEi=~wZ; z2XUStU*di) zS&D^a%Er?j*14W&C9hH22X}V*);OH2J&@jp{2(jO?lfpX=v3kv -DqBMCGsm&JV zC=wC_1@LVKCrv4bQckTd)Tek3ne#__LS_>aS~i&$rh`)w%vRTu?uM1GwrNQXL3K3F zfbqNbX55cVY?eE!6z?)+_xZ+&Nou|iE{fvZnA5tcRz-%SM5b`OEf zweU8s$ekGW?hj5m{R}?5-Vu}7?djR71JY>>NT9Y4aHTkRX%}lax7TI9By;b@nR7f` za`D*hjg=_15>#n@nWyND0Wt9?l} zLYwQAP)Lp|vqzvS3n_{3B{1(KY061rSg-AOoJm^GCz<$!Mc>01_nP_4+wEmQp%Fwf zS+kC5{+N{)T-kl0aKuhqw&WoHzLHBxgJH28|M#x2mOo1jrsa4`GYc(u14 z(y=^gy`%m};pYenSoKw%8>Mdk=X(v=Jb%s+bQcTz(zVvjo(P&kbEy`Gzx%+p!V|8u zSqv5#Vv$Chmyz4jj31;SUb_bd+gI7c9PcNxqLxDg+z@wG^o=B%?2|urgr6D{s;qAi z8si%a9}>&uilQ)>uw&4Wfx^RRs1qFkj?#nIgVZhm=LDv$h~2rL9sFczPp!*r z;-^VSsO|s*qzZe|kDibyo#~MPD^(FzTlgRec*ypgmiZMpZZAGUP#Y{rl53KnebDC$ za23$c`yau>!6)=KcnJ6~_#HbcZgK4xSd!pl@CO)t@Torzh6{Xr&;I`p`2Rizqyz$% ZNO^Y9gDUfp(@{AlMLFer`F9Oo{y+MaEDitw literal 57811 zcmeFZ1yfvGw*?9zArLHq;O;KL-QC?a0fKvQ4-z~LGz5p>PH=Z?JOp=lcjs-AbH4kX zTd&T0Kj3y%icO`v_nKqMnrn=?2~m`nKzfDq3JMAeNlH>w84BtJaQSQm?iuhykWd;L z_yO&xEFlb4GK9Ac{PO&xkem<{)Q>2HJENz!!rMt|IYL1pcRc-r?y=1?hJso)lM)qD zb=BW%LimQSmQb4JXxfb}_68jvAI!qdO&RJ6J-n5^YNGm@m8Fem^*LLpzdtv({z_oL zGKI#A=MN&auuQ*3ovf@wI)91dI+}%WbxwSJ{RLi>ySfb-WH_6{b?r01*!SL~xL~Hr zMbCME=J56|)!VsLyUIdsyhg*TMXyH716bSBs~!rG>CctZ3oOGwS6i=`TK`;)pd0!= znFs}yPTL9v^ZQCr!xtL%_myu66b$0;D=0l^Sgb!+_0RtA3jrkliD83(1N*!Oq>3YS z?KAZbUdf?O^W)xRgZoe1NVZ>4P^Pt)8ncal!eoJ_4(r=NekH#y-;AL`!b)^!7~w~I zZyMy@K#k!e+TC-Vu2{}lt)70=dr#p62l&ej4z~8j&^NUQoY-9Flcm{ES`erro!&%L{==rvQN z_U^aY^eUaLsBYAR63=~YpkU^>nWf!VbGD)_ZCPV*-*7cZi@T{%gLHfxf;loJUk$D` zxngR&%uUzX^dj)QnMPRfwpUx9&1)7oiy2P)1nH0RPIEq|@3~J(fWkJrRquk*AVg$h zmH7!1=7RcdHx0V}IilUJXllEhfV+6Apn7&A5-0DA%e|H)mg8V4mT94S8nD>G=@0G~ zh;}bR?vA_0aTo62sZ_lWSj0iJb1o?RYteE_L#?Af|6t0Awk+33Z3`3G=srzjvVf+& zrTyR<0$oD1VDbWWz?SF1(IzA>kujwk3KJTZlLrVUlpsqeDmX+t3KGKAw?Vty3K{yc{JfnP zvUS49w$Dh_dHuNbKx^TOV6w)RS2aM!)T%~0N4oNvw{*c z{LsLq@Akp~PF7s)Io8r1P^);cN}$t;m|C^mIvNBvkVcSfVUS~dLFXiwes#NDA_EIErFP^!Z3uQWP^$1m<4Gc^&*v=P& zoN&A`rslmDCCVA}Noktg)L_+Bcwo1q8ni^s7bwV+`jcq6 z#t~fnDh+d9^j`eb4+Ig7o=1P}y_dv;ZETv3gXbH zwVcaG<<+M&fvHDVH5cZNA1PcSU669Iyfz|d`AuCHuk@GJ zpj)a0-Ddl8@ErPE2xgnCjGuEW*b0q>zKcE9@GG(_Up&$`rU{64a0`9&@;qTo`^23f z*H4lLwM2{M-3@ju*d*31b;YW?d+S;Z$eITn)d5@{tFG1{mDQukWdgj|!2xHvsCmYs zeI63lQqf$qbIRrVTXG*A0QZyq==LMH_>nJ&4f-ZZS>sY^c4T9*Aju$8+h|H`=E@Y- zUL&1}8OyeqaQhq5?}+}(WY(0}Tt}?Bq2MuDPDKdZ!8oRvjd++<xyiJZZV&I2Yj39$7$nw(cTrDFmqsJd4`h`-aE{C{k$NbQwm=Pvp}dZk z9y7n^%o2hxu;UPuj@}C(JZb7Pk8M;lc^<=;%3RhlCAr|MyqL5m#V*rPJW02X=mgYw z#1?Qy7A3?xKLAcvU-TK5_bN%033ZQ@Rs$3Nyc?RjVmptgYI9*c;XS{tN-v#$^^z2K zjJL0v^cRe2X)RRPQd1nZhBtKZmLSs<|OzSv^P;m^KXf}Z=j(u!Xr!U+f9M_qBmL%!H2E% z#cumDqoz57uS3xP>J#`dD*@xRHr)NS zK{;zFZwBZ{W4YFk*=CA427kqZ;_=yj{&FCR9C;wgG~99l#Y!RzYj zq9kPl%J`gwh8Z3ey=x5G@rhZ#Ebmq9iy2LRSz7qiV~i$rh8jC{5C!jF4t& z4J3FrW8%At_z?#t`EV=oLoCK6e(;Ph^pKw&6lxd#SB%t_sp5^q5YWJ1`rjzsJqsFAoG4jVCR3Noyd{yjw2;0b2~=NZP?V}OZ*MD%5eMn8 zIovsA7w&a|&n5<1;?GDmvA(NANHwMVu(wE56tqf2^Np>_)lB9|74{_4#Y;ZGzrm{e zVu$$S?O8+^VqHMtJ-8QI@uDh$S7hy#yM*&KheL~|*QU?nPKv{1t(@jBLTrM1@RpwQ=8B&Rv0R`8#>Z05e`YQf*urtM@2m=2M+)W}3CY0tUf zS-`+@zFgZ~_A(N+$M(J4{}iReJXIGX3TojEp}i=8)PBf$kwv&jYN-u@T8n(PGST>B zm}Xg``6!nS9P7cqUm|xIB=Ay`d@ZoNtFe#9Tn=Ly8C1?4{jn3jP*=r@4r*^3TR9y))}(z8$2YR%$GR#E7eFybH>6%LeTJYFGg$U?!&Pe~HAk=4&tJU@96f*XmGnqwxZ+g~r9Gm1!$;*`ON4v7PuGqYWwx*giA zfwBYO!gT}QCPHqN=Q!jyz@Kw8=ui9*7?$DiW`+WYVy#I&gJ<`9Q>Yv?MBlgWw-lMr zVfO~av}TKisl^2dO-vT7`;n8Q!%Jqd9a? z^gV5>s3O6x9b|opP1&NxQGT@%gI8>We90&m0gG*sVPK- z?W}#rYU3F{h>INdJwQppG(=X=BsdWVd08Rp;J^_?Z@TNM7mA2TtgB@^hoS<_#s1Cw zUGF<0Ue`)lSJz0{aI)OXf{+#DYX&jG2Xymag@o7ir&QdP0RfEZXNuY^=NDq^R<7SL z#k`A+=d;U=O*bB~NHo~FKABk;zFO|3wwRLA+AR}qhYfGIrF94hnH8copA@8w01~{s zxUnxfG07a6T-0!lBx^+0`HQZElKx_?T@qy!uCVI`qu1-c`Tzl9c;&5eCvv{1xjiEV zQTt4j>z~mw?dg@gWm#F=(A2#JZfvU;`7+`#R_H+ixE^AM2PEGs)BkJ>{Jlh5Ue+Wn z=F5uf$W_Y<>dYjy0<<(4Z$c}Kgl~@dYeP zFS}BPvYIoL2a;AC9a$vUG4|AHU23RZR#26k>Jzqic)C)_N#;9JdJ(}dUxd#pJ|P62 zU@rJBBJ<_;S+|Ky925F$2<9(Y=dV_?gXXAkHPObfrrK|dt;c&)`wwKMrJ`z)z8&2f za;}B0h?m7ynxrF?LY=|QqTFl3zxn2kMSX*ddCeo%jvhT)9-l6g95BmkgWI?B4F`Gw zx?LIr^HS`KuJlcsIzmKTBPwiml^;3ZIJ{)W7OCMJ0~*@^dFaBtn5enXpYFmFPGKRm z-DvFAjT$ev{ezL~j_k(Cj%ehh^jaCZmO!~_`#a5$I}jrtGr`@w$U-lP#WxLjPzyqL z#3888D)E?>*$+YD!j4hmq7zrVRCng^6W!cHx!2sQ??=5j$d~X^Y6q;~FOr*0edR(p z2VcIUJW5+)tNqL%7xjh~GupvMP56+#t&dl(SXxCQKPKwTGk7D8S_6&7fP_wRIupmC z#|5LO$-*n^8otHk4AxepU_uu+|rf>P=Glwy6Ojbd;odRS}n|^_s|F`v`%~ zfRe?HaRCd*Td(7|9T&R8h>B}oL7-V;LiWK;;Y%{@0H??rDBst9@HOI5pTv4Venx8mb{iR* zhxR^5W+XJmJ3LcXA1sVJe8c2mA_f8Fysd8t3;P>^x;Lqf=L}Nye6AwlWWau^-`@D^ zRyufbb8Rt%^d%8+{>CSmfXS-Mx|SN6q}A{XYS31-tI;k%*2J`HcnP3SqDd~ z8%ova$1baE67|j8!(Ih#zrf`!N~zlEfc4s|pay-iBqf~TWAQ~vl3zD#Y2FsU7L2F&DzWn<`}YEs^qQ$5ACw-7V`H?}+_uSC0taTuYaxaDZXI zgBNgMm_{~rhyhYVW?QMLuKjJreCzvCW?Ff1#J(qUIkI6Gz?|skOHjnv#n&I%TdGH4!gYTW^_mlzz_B z8csg^FGRNGtghIszNJX6qNbJKET?FLm@A&Z025uBntwZ^M5}|w)psHKT*eWWw_d8O z1IwLHq0^Aj4)>1!;6IzsQ?O752w`1^NpbcD^l)ZZSyOrRB#~c7!VvF8_sTj_acQ4O zW6{wg(#a|1`^KuB?yPw{57(V$4SW4+e!fdA|Lg6a{hR|QGVA2iCrU_*X?t_P2fw5U zNbQn*^r25yST*Y&nA}SarBvp--O|y7UhD}bzmWQ35{HB5a5C4I;Ya50@ZiCsS@&EGIGXA2MF?qn=rttZ=oT+A?2wV|I0v(~%7zIwcP-G7 zuncCbnZdi5NG1lfjkdRrz6HPPwWGc!fF{*oH(G7@ojS_Imw$GWR5H(Tkr*_N%D|zv z3B;cCpqHP|I@B{@bX~m91f$fWvqy3er zVhB2HbMxCh0g~DTZH-!@^temah)(qVvz)-@+2^G?W5^KDf5PiCrQKc}MXfQC8JNKs zjsg0e0Ia$y#BzUCiC9Y|dBN(}u);S_H8KZp_mAJB5C8aGfo$@)S&SX#NH&t{U`*5u zygpkP(+(hK772+_?bq&MuLF~YNVB0CxU_Lf@`><|HVT@d87PTN#v8ejIs|*o ze1GjRXRN#Z+B;bJt_r#QQ}8I4CuOrf1aQ0}OIt^H>E$&Fj%TK5FeAS&Q`>^VI@Q}1^h_RdHJe9X|2V^A` z9X7J^Ve@7=!1@6C7+H82z1n$Z?;iR<@$_g1LNM1igk{G5YKN(1yKG(Ml5~k$1zhg5 zSlHS%GxORUe;2&BYKu_uXkWz$p>-Bag!@l(rk_d~dC#A`9ST@nTR21x+C)SX_ax@6 zhSR)ZU?avY*bd+>6fD96X-ro@eEXB-`FpyPU5vuXtb)M7uSZ ztpjnSpnp80dWY7XN;4=QPC8dNjqXDKzV;iA5rO+%1 zLr{3^-hV-kS1t-Pe)Lx3M>4S+m`%_Blf!NUb7R!htk1x)w|N6?x^QVqWVcF` zZj5Ch=V+fdX7q3!8MDqrkxWvr6M$Y>LZ*WaeUuC_4g)qWN3srM{kic^iPkumgprd* zb7vQOB@4*$A2+ism)au?8{lD3px`kx_r;GCGp-tbGa~!j)0E`;_*!kfVQRwdYeWv7 zD44|3KBN*VB6hC)avIl2Ltx%z5$49aGaQ=3t#PJ9DRGRQ>Ky56Zg|lRO$R!T7!{(1 zsU*F(E{Z4yao@Um16mS$@E^b!%mog@v?mDPPI9;G-jHy#MbjrRv5CI#E@Wi>_1)|# z;=kvaY*JV9`ny$p(LNCW_VPJw9NRnJgiCO%m{g3ZKUc5c0J&u zXf|0Tw|TWA*)kWmQlHfV>V~s@9FZ*Z8r8SGUs?Fq7OsxuJ}vFx1qoi)y|Q5>rNuM`!E1b}g2tZ#aiVAScU6mL8W9s$?K`c6yv6j31DwB} z3O9(nA^pw2KZAEqyrWeTsA^r0|*1fU)mA}$`+1nSbl?XWw5Ex^( z5KzePh^Yrn8Ht~oy6-`hM;&|&4hmzz^pvILV<;|7y|R%cJ;jNQJ!oI%eE&9_>m|*{ zbOaTBYKZr=zWp0Bsg|fdyn#Tw9w|wW16nsjC2fTE6~r<{)5^a$uBW#CrizOAznonM z^!5L7_Vp?t7nLSo7R#`h1qp<>MP%9k6b9<|7BmC1R5Xmw92O-kodbr_9MQVAA}yCb z#bYeiLpPm;D|YxLLf{^LO-k)_lZl(erEx9|_!k~ZyKX@~2ZpvWrThMu#QFy<_$Y1? zDT)E(;9j`cOv5>arDZwjg0&BtYh6tzpIBl(PyzO97?9}@dFqCe%f1#Hedm%X_7DeJ zI&QbzQ8jgVdu^kpMXf>_G&@;>An`L!g2@&`sUKF8$|(I5mJr;jHpkH=#(Y?7pHmB0 znYAckg1iyxvJ|Jc5s{75q5M<;gmlz9Wy6S@pcz=63jJ4RBSmdo&CwWd`k7B~y~l7< zCk$xXsT}JE3{=v54%dI!K7}nBc-SqseGs4|n&C5uzDr7i0Et<&9Zy zCU#|RR-3zG=o~~he`X>fx^Xi)91x%Y&k^5%zY@8nKe3`$lI)oyHltzt)lTw@Q*nlx zq{z3J5E7pn8_6~CNZI!!J|^+SZx14SD|NuH3H<3M3mK!qpIX4>fgNo0+)sf)Gks_z zDn;4UQK#nm7KNk8D%%b}o6Mo5P&S*&VX;7&pe`fp1tc^}c6KCtqC< z5TKz&wip|*>hC0*TzxV4c3&prO&)7ilr-)D`r$h+=FA$xjx8i}ix>3E@eC3$y1#=) z==)3(?SUOoVgQC9|0!?~`2MaEzXK;q_pcKn>7wzW%(`^9jY{bo`?^5MnRubaF&Q#o zBRqqm>`d8uEkznV*{5VMF~b8Jpz*pZ;?UoT(*a8j0=);Q9yBr_6G-chT$P0@BrSSG zc#et2gPwssYmP53cxwOdP6Lp(!JIl$pH<5TJCMkwr_|v^VL#&y4X#my+@Txzw*idD z?Xl!VzNfu0hL)w49LHLF)7Qqna)ibkn(2a><~uM(I~D@~Voe<`{V1)Li&g*~6|;ge zB+Jh3OQW*9x`ev=>SkZ|y>d@Ux)qYnU|%J=n2?UzWy4zhsDD6O!(w(P>yP+eB&t8% z1<5p#skTgSpF5H^gl3I-1QK^fqa#&OKWIX~hLGJKJ-F2!ZEj-lDnc+j--~QL(0f%F zRh?#iYjW(Bw(+5BMX!4TKn@L^o4x^vc7S#TcA`1kA2fIvbo3~6)aDlSS&du1bZ38u z5-MZ*cWvVNE5xiVTs8@^iKknBlMaDI9m$vD<kJtTdPqNoopn#(dz(&fFfhOv77B47tC!pS1BWZvKJtj zqy#Q}W?k`(TF8E9mw3B58u{E1ygQ(k#_>z?lBg7hYrGUoRf@$orZ^0%OKfC3SVjtLLIVxX!-ZT1D^CabL+<1jYFjKEDsd3{T*Q2h+dX>4mUztQRfI&v!- zBNz%`&+W7E4RnCzp5BnlUPXxihZO!YtFoz*!kvuCWf4K-&m!A}3yT7}riH zqh2Nz#`af7%-Jiu`ke~y#dU~Of7C@K1x+&-7SrD&@JlIDAdQD}0uHvV@AQDI5 zHPrV06r?0qIa3FVuj#yYdnf!m3-Zs;baq*JhKlGo-#2FAtJ1|3Zb(YHKfmpBfW$)Sz$}89e69$;7-@&{~~u%GUKL zVjCMyLq{cnR{n{)&PeH1l7r1;VQdyBqmK2I=fdL%V~{L=r5Cq0a$*~d?B=i*Gt^L+ z`Dj`vT36odr>HJ>5nq&p$EhRlv@&u*ev#z`)GWseC6I=h6wd;&7BHT2f>^(MPEB+o zGE7VRZrfx)5?@6jm~ z-xZ=~fk)M(@7PUo#*nA$77n~;WFlFArRN;szkKogU1fwL`d?Z>OVCK~gDG5D<-O|2 zTw9ZBNm-C~;1=!6o+g-PP%dC*5Z+utmgwn}-{%P7yU83~y}NL2TINB<0OpkhZ`-^D zJ+@Ea?mms(D$#f=&>0I|)YdeJ=_2WTxQhIY08BTf-vf{~Ik`O#QjpjjQ*5eRI>Bw^ zW7wIa+!qr0=X*8QJKf-^A`U`YWlEZkfq5m89LX${{^f0n zb5me)1E?Q&Yu`(E+$z!| zdsEqNYbC#=)ho;2X~JdID?1Pgbpg{!K!Sswujdkqv&9--*n?gRd{W~&{y_Y7ryv>z zo(B0RR2d47^PXm%!}_>}L6hBbyGHXx1fy41p@>wSY|~zOf7V8|_3S{h9*RKnB-p{5 zGya9!^{ay5=M_<50ay8jeIbMheySQ^JV{0SFR;FRNgTEqJsxLsE(edXx%b!Jw}eM` z@d6Jfwh8Bbm&1u3Lq#s0^uo#yeU}0UWgoIOR*_wIJ`lD%?k?V`A9w6dmU7TLldmBG zt8{}oR?&DPKo$1STWslfUZy&CC-|IC4*T4xq;c)LMsb@=9D7ypUw7nuT4^of$_*o2 zc*Gv&JHj4*SZndA=1F046VX$XUl6<-Q|mG3pDN_s|}up4a)fsoOmCzkW{`m{uc{&1)r0pTmp1 zVpH#Q+@sX>u7AN{i6xcZbe68+;48(uU7 z&+6ZVYCJ&}#&$kvVGpd~eRY=uqe1iBS!VOUe)^%vpylD*)_WIv*vo$Tqu1)$0xhy@ z+w%LCu7D)|@i!+y^##d|et^rq5XOqFcSZ#Y78FV&ljU)W!i*(^goIpECRaYPr1Dq} zZ8uZX8ysFGemf$4yv7H@gXz8y^WS`uM?YI_?eX)`ef-1XmHpzEYBeABkIRn8{FQN0 zAr!WGg?$iQAT&d-gtS!uglEB;pns?cs~}(9Y9tS`dt1M0)2;HbkGgOV{dIqf*EWa8 zt*pWBvwwrzqBnZCD+?@i46WEp95)yAk z3^1Ai#{uQj3 z_R*zWE5!<~9U-a1Mdc4xL+zV{4w`%fVPXr48sHcXAj!~=KbPkvU;TJ3`AH4p_Z&Ug z%=d=qK;tfJlZi+0ut}KL4rvG`=HH@$BKZp9b6DiqQu1JRfW5LXnCL|JuReg0DS7NZ z^J?+?u}2i*fr(-}k;_8-Z`k)Z&RW;tUkN;FNbsK1Xss-FL6WL=1pf`Vk!h=i#_RlH zx3(g*m%J>~AOJp2x8qaOd2XbC!_0{Zh$7daw%{Rdn~*~?9*v&M`|-W_kU|d2DW!i6 z>(5*#X^THWQC{*B4U8%G(eX)adsP3r#QZtuS?ia)mtD;sMSn;6ozrOO}kav}-MtGbI|6w)q_VD2bue5O= zRlP{_-BuYe*bi#5ny>$Kd$C{NpN`uKB|`bbVZ9F~_0eIGd_vpDz86H9Z0FC#tdXR9 z0;?(nZ%T*>|3BM_%!MH8%i3F)mN&l&<6Gq+?9+Rt7q4(7#S`HO%QcWbmnTz9IUjZ`DPAvk%qqu%p9vblS`LXy=A+Nox(^zK!=w4S& zd)#`XQtDZzA)yet=rZY6`b(JW?SsYivy`((f@%8I3JeQ5p_wt%*{hUX!kgP$pW~jF z5+()g>uP2Cs{MzL7u3oI!;~^1`$3m1P7b8{lvR;cNF4u;RMw|wsaSt>^HD8V_eBb`?U6Tr%jReuy#a2J zwz`Ty>t-|uE1Ah%dL-IkCEgg3>|M4B8qeyGPr-f64-LMB`^B5@1P_&SH_PU$HJ4>u zk>lEOa+$l8d{H=?dfE54ajBl0*ui!4Uxycj>WoP1os&uvDGyW&+=}_^W>Jp|tDEl% z_iJfUOH`+@^-7#Y!kyNJU&&D~3hr!gYgJi*IgMg6gmab9VeWjqx!*@DzKHkvV0=G+ zX>|?W+8``)--JgfLf1V4%VZ7xGH_N+fYmH2^-!*dgSjI#XcC^h1g79ZJBGc4&X>Xr z_}3Ls9(_L|Hwa63KA@L+r(ioh`I&eKYFDXjSz%0@{#wGU%@mb7sY<#M+ zIykJbhJ&Sn7JU-iTtc=KZ|IEbI!wjXGB8d}k?8#VyjZKkbaNyoRAa1|I1^Qe(H z>!oWO!eY?NVZXaxq>TqhGqw*Icq%kd#*BG44EAjX%}?Z1%HyENa=88@#l!uwss}%X z6f_KZ>~|wXg;yprhwlcDIQDIF!t70eNX@e(B6w*+vTz;d?p8l%`d~HauwJ)rJaRY= zspsZciDvcS*k;c~$`Lx5Vw^1v+dkY+RN2FFmax2cukkvhWgaKEa*CT!bs|DSM6{Z# zwSVuArja7lgJoE}v^^E&1(8jy6PirrLC1fbW|`*+-pAg+eF;0C=-$rNHWCWWzwtRu z>!w)8nZHuT%ls#-W|_uk8QXP(n#6_Ry-%b)pC(^jgx8E+Z($DE?;7vP_5)kk>hR_4 zqDzooW)I)J?GX1a9ZR1&AlrY&V;+=GY2(q`CdeT5L678xEkp^w`@v;W0Z~~+eRe5n zJ6NW}<+kl?p?kZ$XJc!P{L`vtodp&PO!0Tj5J+B7O44F`bfE`R%HR?_TXRf?o{(}t zMBmNBd>M$YOd!ph4IuK;z&6{;t90(ZX^N%QKIJD&y`&HAB#c)-4dqvNclU`RtB1TMhUxA1hL7=6mhu z_qS~n4ro3CX3p97;4AQ&RewZiknp*QMBqQmXG}P*D##kZZC?{a|Jy>#&maNzTq|}r z3teHNwBq|}!nwZX(RtD)d2rpzj6&)>TkD`RE=;)ee`*H`S(6d)h=#%Etc}5@Jc(}o zRhY{rxV&Y}ef1b40nfdP*#}1Xgr?O<6Hw2y`%AysI5Up9u+KQ`?-{9QJjZ#@Yizu( ztq!5%2()47aN8DMl05=B>D-;7x9b!Dt=O{2G>0X=}zU4Eqm5HDFv|^&Y}(i=X0~jz&oz z)!3UKX!+{)>XRC|v3Y(m%fvIxKaxwhR+r75CH}H)KH4E*X;w$!s(0;4lFa641;})d zanT*#`On!@C!R%AC0c5If%VfNLk`0xJyY28PuR%Mz&_QVAzsZ*_^8 zH#+oAY0vofk3KRO#?c!x_D4Ht2^HJ=utn~LKjam!kGDMMM*Yz?N1!VQp!dRqubAfK z*}NnSo>m^EQgLu4#YjczHoi6&tn2I)%*Bn-EV&LnFIfAmewL8J3Wdcv#{`2xmva|< zc!_A_Qc%v$X|nKj6l%9+xwKu|<`njpv~rhzo-j#;J&AYRvU5=0X>^E3qjR0=ApE9u zZ0rK};qDL&6w2ZW)tYy$1+``aBrX*m4Xx5E?6*36qlIf-ZUt6%TMO46Q}giemb@)T zV>whSSfst0+$U%mRk2|x7F}rpoamn`>#XT36+MbSASPz6h*!ufLHyR3Sy?-$mkN}K zVTxR%biLP;uS@J-(Z_u;hh;O@ z(Xq;q&#H&~D7IJzu5B?3y(4hsAL8D5JN(LYjQC^eLl-*>S;RrIF4K`rsW4bg2sfG8 zR?^(JitJ8Jvry~-4*&XtW1neEu6u+lb&(4yq}g429Va0aye(N~(`=RxdrCygeO z(lAz-#$ZK(l2iEM6lO7&wdMn7{NlZ+HyO}2fO)5*8jbD~Jk1*kt#mVo6*UhV83GJi z_q&u{%RMKDciFfEsh(>pi}e!x!wuf|Vj?Z&Y$^p+b<73I?6t{_8NZ_1Qt}*5f&k({ zB@2223z+FO=~rnUqZxv-3>hMsvZ%&C{9$LrA$s92(xy|QA>d$7URZvd$uGwNYA{(T z*$k&e`S^Cv+rEDuyW^fbjpHRFmtzBFUD&5LH2H=wkcZb8aU8fz_Pgi|3=S9Ow(O_B zjHi}apK|2M_hd;kP0!um&$>4lyox@Us}3iw%Ucr+H8wQ#)p)595Q<~i<;5HqM}}p1 z46*ebmdfC6hnl^Fl9;gC;yTrKx!2IHxHJsj{PYyi4jiq)sh7V}&{P~T9_Qk|U^hFs zCV6VsdY%?15mc^IkI(4V<&pevt7EVXSvm)Z;Opg9tiK=XDKo5_>szdI$1&;7s~Fqx zoJ_kr&`0eCtu=EuSksg=>*UfGnBHw|jOwlG%N49UyYxCcXOhre;)KsK+9S=}lb@46 zTh({i2vS*Ns8;zTbW)1>)qWibM!b-`bkga10XUD6@U0f#W0K-uho&0??SH&K-Ow&n zL9jG(*7KmCAXizZ+5AfA>Vtmw-jSkiJ-6LAAD{g)m`ZLobzd3ClF+U4oSd)TU?6XT zmY+_DSn3x!A84CLWXKXf!SYokFa2?Qx-PWkc&MzB5ZVc(v`N?srmVNrM90!$s`?Bb$C zr)J1FVg#AS$hRvb#bLoG$TqA>pSBH32Q%LD)nuaJaO(7lF#?V12-If70Z0aZb8spl z4l)lFhRk=EYoROQBClV)^UyJ5khy+Pr^{9^qy9LPl(qieOQCt&Cgn%OM_;|FpRj+O z9<4*t!eOUA(Q$veZDy=GG5v9ZXjftTBavTgax20B-aE%wjm5h$=FvaZ{@l56KHPr& zrj*8^rE_p=pRrWi5_ZbEt&et6yipLH{JCu6xx@M(LypVrW%G9pp_(JQMIfz4t%x$7 zs#6fJCD4X1Klt&Y3DI|2?z`$%~cmif>a(;DY+6Io3TL!P_e zvj>6R|5i-ne5<88vUkDgwqtf8FW%9XB{I_=R`aP3pw_i7n~5zZwJ`GyWKA(oxKBH& z)ato(GiAgaRe{^=Q*n;Q`_YpL#$ye0|8(jHpGR`0MzobY#3nVOrc2>Ah z?}RFxdH)&mo0$r#?o<#Pf|9@qskL$KkMLO4@K2-GLJub#<__I6J!7|>Geyz)0)#t@ z`>jlY2}kRJe^H~utYn|BRGofFqie;Xoi@j*_#7+Bf}zD57`F0^V$dBz)=(QT{RsonF59@&wzLVz z+ngnbt&{vdzSh}pg4*}ykGLt92YAk7_B}oq1Hf~xNjM%)t?Qn-)Nyx?(}vUfJHoqg zo`zc-Bgo5$cPcj>%yqJ5oLJw8& z<=539d)NU%g2!QM(~7g?yoyTBAetM$ZbxqPyj9Nu;3Otl16o~7Q&YLt)0ahb1RM0xlP9dd(YwpHKfaP`+WMH z8dM#K*bw4H;$^c5{lTOq@T_8bB774~>61iWw)eK@CmWOcjp}J3C8 z6B^W%wqI`RW@I+F#gKfwO52A|f$ep@6NSd$AEdZ4!rA$GL{wB#5#}pc7+s&89|xsA zr#c@8x#lZ8vB`s+_wP~6ZyN}&ed3Gj4U&sv!#E~_KWyuOny=;!_<66t-0{@fOSJQ~ zF6f#R>;tzY1`g3B0DZ!Hs}7N8Z3XVFpt;Bl@bQYmcj?t%{vr)%fOg;M=Fw5VU@tZF zQlG5kkUkBsMd6{o2d8PFjmM^bzf(`ha28X{Ij0b3gXS(NkOo zwzon}rnwj0n#Ai})OJK3?-_6uDoAG*&Bni6;qYDv?Iv7L8a_cgn!2&WTh3fBbtdV`Q~ z&z6vZ$I43t&NVM*Z5sA{H=Cze{O0ptX&aDxEZ9BPV9uoFbsaw#?b)1n*hjwOg|SLI zWVU{G$sawIQXp|Ws4<8ZW)_isAEEn*N_E{&k9hf0uXD-H_%R`VVB=DMqw&8lkc78(!Z?lBIotWfxP95yXpO&uOS))6e7 zi-?GrQEJ6tbE#!v`)b(m7(PbaQS+4~Y7m$^t@dRz-LcIl{nT5mLnP;jsu zDxw?kM;jtD0yLmC)F1ah^AXmkPlkU{0}wPs>AuwE)<{le3w?jro>nM^jZ`+U3+@N; z4=QZik2i`Ek8V-K2DjvRp!34$&Xk_`PxpwC$Q;Lo?GXQU!p(Oef|S|v6%gR>4c8(W zklB2kcH0c?UCr^1lLGAr>`OR{^J}P+zf{&=@^MA^CQ_#?;xmfucdhK7%GOgqS4nFP%E5^a;w%BNRqFrISLRl& zIk}NI{z?e_?OzO*D(}}lQiA8Vw>fy!d#6NuDf|E~q035)oMp=yPbj+7AGyBSY~fRnvK}B90Q*FhzB! z^aOBST_;LG`ak5VEKjW(n-r-)VoIjgk#~Qy4=lm+>HlFLUa5ZrINx)tgIOHs#{&*{ z1`WbGJohe1n7brGJyXJ;cZDVhR&^;dGNX5~1X^;H3_H{#$_&k_{n;msn1r})u$({y z6)u&O-r-IL&-s8EDQ$bny%k^loq~T9yY-z-KOh9*#@@_ zBU2OT;#a4w&hqgsLFR(03Iv;4jdq8dQkdE{)(PIB5pohCyec4^E_GSSEQ%! z_%Hglt`p~f=-ayjIq)g)@Hz&Ntg2jqB=%2f^~KN0Ny>yWNC+_umf;rDg8g2jmW1bm zV@TCFPxD3NX9Mmj;wPczDTsytDWl>@-rwJMOFPq*V^9zWAp)}^9aD{Nr_jTmHu1^N z`IqV#n*m{S07y_kiIHadBUAsE7D$7bm7kygBbDU|D|%S3*rz0oU3~kmiz}k zS{M$PkI+E+Ksq}+W6~aqo?6J}9~9i?T@MN#6HhYxj5FMm^3?ApqVm5)#BRaF#Kf60 zBav~22z?+0wh39`ftm^KFKyfj32qv%iL4q~HMnh4V7!Xf8XockTC=`y99d5i{eLCU z$*U{?WVIgH%d@jRfEGGKOnh3w(cFig-K%CwfqShKSId`xP6XCi_=@;H z!pW1=zm6-3%VD#(zt6^AS&WE;l)x{<0{Hy1R*Uz&!Nb1H#}v*bkKUniDOzOSD>Yh; z64t*ozUvJn`~PLtfgdXu7Z)$Dm6e&!bp5BoZL}<4{wYQ7v2{?vd%4gPclrnS61r`} z(s!AG`cF7d*c`Ztkp0u&02OS#*xaMjE-d}8BoKS~|Il^TVO4F5>u= zNu`k#rMv3@hwko1y1PN(T^sbi-tX^To`-*6$BJ3AX3czNb`OXOj@Zk;0nUbw7%p-7 zd!VXR%JpfIdI86*JZK>ZD6R%6bj`Jf6N)Nva$}@Z zfhOFk0nRgx+}>92^Xdd02sULt~>j z-`Crq6`0fa;r1pPY9PC%pMV$N8oD+zUSh2D8=89Ve&$D~=1C^bI9FmQ&L`5wd)H1AC^R%G1%uV%FL^~oG{)?p2r;$Ut8A?twR;ZO3_3npnMcvcR1CqIT| z-$6Z_?%#Lka(BmJk~o>+O9#-~J<5hz46h=EeDnA3}k2Zws46yUa*ifnbDi&^|8$q}8&+$-jF zAHz=HWIW(?tzwRI`Y9xt)w`2L_Frtk_7GTzTSc8+N;MLJ>rjN!?&H)^}f>dXP3<2qOUYrE$Dj=(1524;yA z5)c&!MdaM%@bU2<-z>CeGabHYP|XVZajT))@$LfV zHIt~PGsJ;GKOxm!U7x|F`I@z`{Fg(xzraI&d=p?maP+;qootG8{p8)RB6p9xAzc)# zL|#!*q34jp@cYR@kJco9Y;9TOzkKt%GG2(#6H50|3=XW{PjmpWr|yV8vMIJ7FMpTR zn*#(ycWTO zsD&0&@9)O@9QFXG5kasLBQRuu{?w~h#r##&@2g2&$b|ije?tOJ13TiVJ%-CJQt-;} zf4&W)S9LsIN>+D0-D^n0sls3%d(-h`LFMgMJ=|`CO?1ui?-nrw`lCPFWp6dV6DKN7 zPgd19K;=#Kwdq{D)geus>%Rx1D92%EURshz)+Ft5MyX{pML4ZWNe%)rNsIn>dkfrw zxzx&lP%%l1kkwYU(%PD??^zuL^jCHD(|pDVph%!mLFyub!C>^2hgy%*r{DWKw70Pi zs#qa~_)eTk2ApD-Q=%{hnRbT>LmWv$msDx2H2N%r`{3P|@-GB0SGt_hNp2Oe& z7l=m20XQC zPY(if(pIAZ`@LKV@ra38d0B5e-wTUSbAD6+nmtu5PY-rXJ~@rC7^>6X z3bPTYS9A01$Elt`b3H&~@_qleK5Eehsv78p<{v-4Dw1&gp5GR21A``@`5^V)ih}xk zgoXV+eIoQyVjM#v0(SdF1HY2DJUMN}sIvI`R*k_d)rNQ+batf1-;48+2dnV_-sO#` zzi)g4Ogkq>M?V3&h_%t;sKlB|=n?lKfnMl|joX4wYiP?KR~0WAU7AbSlLq(^u6THO zG{oYxRaLnul3xWk-6I7ooyZf1+TEZtE6lWbz0g3zTYQDGR1hO^;7exAuIg3$<4TI_42F`=OQ2Z=kUqj!Voz+oSkIPN22U<=O2OZjjnozetjNCx+ z$b;N_?~z}Wrd)y9+uIM>_f9L8S|%z|KLzR(#3Pb0*4#MF%)Y>4HC zR87-u@9y6K!#9iKAYkh0{#5ZfI6v1QeOKv|Ln#LvbWiM0+NQjuq@=dI|G179g;vcP zYytMYQg|dJY^@*g{>3)yte4$Ov1Tw^sjsTRWtf_H%N@lEjgj?8*^vTZ; zPhJU!`-~dnUpq()vj-y85E|A54vp>8_euV(@iJw|^hdd!EdbsEmw+?n|LvcQ*}cO0 z(;Lxe;*g|lgQHy0vJOiAE=g~t<)na<+5s^_f`FK-WFaT&XU%ruWT?}+t34?3aWof- z1H;q34a1xJhJ|7X@VJIgVQ9&&y&k_unsW?kvaJ0r?`#7PAO7f0>*Sh459=qnmk)Ad z5MPF@=3t2Ox0-GslzqDYolRCXPE6{=$T`nm-uOypoVBywm>-(!@uHuU{eeXOy^Uzo zu~j8A^Vc{hX)ngp5jryk@umiDdmdrFu4nCayZYIwZ@MY7spon1(HUFFz^|YntOtOB z&)8wx5b^{5Wlp=v@DD7G>Fe^mkt$yR!h}s-ZO& zduyTxqxb$xNLO5n&Ks1Bg(rf`ySsH6LkKUs4SZ+&W0_2YoedJ6eCm7y;*)CTszBxu zPOT_i?*U)>pQ(n=``_4R&J$=9rmB^m5weHB#pyi>8bC1 zW-}S;0^6U7!O3T{h?`H1ey=ZCRrH*u36xcQQF+d#2xXGYANW5?@atDv@>I^tb-r)V z&FD!oR?$Txhjs32={fHgT2sw^+rj-Uy(%b%fb0YiA0w^Bm`FJekq6!@Zv;C)b)tDW%RU zG=Y*Kt$!fK_d_JPtVnU?Bk}+y25t-jtZ!dvjnCbEIWsc@=BvS3&JAo5z03yC4tb$~ zWFMfIjDK}0`t-bVBVI@~(O^n487-4?msV@cPpRGc!+`n2eZ?|rOI!2X>!oAwllgt? zR+eQ9mxro_l6?^UD{K_O6rss5;{9A?HeP1bpSE8)`RL|S|Nh#jxKO;q?-}`r z$}Zy{DYaSvAp&3qq;1+ST(#e}dhxGUib1Xw=aqrX2M-=-Ii4IJ`yn#edSrW@46xA| z`Q`J09?q>W87UABKn|OlnyS`=6uMsfG9AfuauMY0Y>(6pc$~<8uV3!zy}g42LV@Ae zZ&u9d!9pzaOiiU)v6RnJDSdln$s9R<73g_ZgU zOjAzt!x& zEW0fPK8LjC%{FBz*PdLN&$!86Wjv7ah2+yc;2lSbX$S7h7cX9vX*f@8u`rI+N~5zc#U)^ov{* zi{et3Mxo{0O>%yg6+eIert_FMHEX^pua#+iy=hpt-iFq4F5orUX#=)>rU)hBkEtom z;GL%uV6r%aE~Ph9A-Bda0Q=rS`F-uIuF{qW*96I+p0p&`AvBJoCY7%|4x%RI#>m@T z!Xo+bqj;mz_U!n!7a8sb`Wu`|%SoyWA3}T8u}$y!2seXf*azPdum}-X0@q4{_=C}QU@JuWM6Tv;!s&#`q#e=g|lv|9)o7SafV&hb{`K@l*cAN(2_Hf#< zdW+f+3@6{V6?&SCIK6JpnKbo{(xXbDji#>8n*mFnq|;mjNZG)BZDeGm_x+g}Gz5Mi zvj$jjySuv)@wrU1vFt3NG>h?rJo4Z3jZ2-#C1M}bC*Cm>XHfmvO5MYO&mP#Xm-y;T ziEQUnQ&=szaO=)%VvHO!G4EUBpUiTWBsrwE>b!!~sOJoP~ znIFUrhY~WPZ!vB^p=TtpeUY3tc5K_)q;L2WL{CqelHli4OAId~VNud+=$liMkpspE zo{IRIMazRot{V=@Lv($eUSo#_b0w;)Y*}+^<=!<8h2q&Rk%H;gFDmNgxxU_?CFvDh zZ^8N2!BPeEdDSTnGOUE~h>wqW*mZwJko_ilB-!Fs!1J>LH3+L;4s@F6GRe9pBpvld zaQ=n`Gn?4bY<|o*$=Qrjem_=QPza??1;!30!<@|yEW7h4B>=|3eY9EiUbxutDO$Nh^-!EY^l@^ayw_KR|GeXJoyMhzLsnqp|(;L*V!)?lM!; z(&Fm1GoMilwNm(&G+UyPZ7BwdKu8iZKu~~~Z2hqzKNfFU^ZJ0nmh6bHfqODUY5u(# zQ8u`WO651UmxrsfNm@QhbXV^n0td@B*Ob|8uw*v#AUahk+&yn*-04Lj=icWdjkZ4KMh|P5%-xAdyglk__7Ka z)4Pa9(#_L7_j(sd+2$~U$uomL85y~ePVhK)fJyGfg3}Z=t`iSmTSrXEg*sE8Jj%MA zU3p^OqDW?!l|FmcDnn=zDJODOi9x=Ivju4-AV-~Fd427#%!k3#w$bwI_(3eOY~Wore6M1;rb@ zUde#3goC8NZ@A^_s-v!O0Z|c+l|_XFRvWIc7*6~jMXO0=WCM2K42JI2|L~wZepuzH zemAEYXL{r62M2x?k>u^0=S%rFRBxxoF|CMyaUF7b@laTalC-}M2@bCfl{h|TAgQ3g zXBpR0>HD`BNhZ4JNJVtH2C|3$q{%fxJk(A94iFjTbyF!g;?Hr&>XZBnT{f~~5kcMA zvxop|$%}%JG=@gpqdheVrl2F~{&1Cbc;p?C!R!fKV?KU;;$fjY!^(Fun`C=9M|*_! zT*u15^%ZuNf)=h`;|I^*4e-pZ$hN8z>$-V)d08MlrLa*<=)RP+fNYHh@Ogxd;cc4k zc0Pr@jypICaiu?K!e7QDBUV$GV*2MZzoVXxM}MDpp5~fF$T}4+zN;S@CCW@?t!i{x z6)n4)PKOxLqn>--4J)C8r@DwqNI>x}KhGF`uydi6zLVgb4-=v(XhFYtPn~Dq4a*9(pZx+yD7Ipe8u703Cy-EvEGj{ z9>I8I7bBJTcqeQc78<8lR){Q0A(1*mA$7^mC&zLwICYlY&NQYL;HC+2Z zEv|2!){@E46TiA1^DtURCoHg$&@!0NL;~pO{jax*2NRwhJ{PbXgnMDr4Zgv!v#5RC zNF6P|V!zi*tCaYHy&P5H;gUYSeE%~i=J^b;*vq$4t^$C!pNW+_c?3tl(8gLUBl}37 zq4c1RwJIrv5q$3ff;ya?o%Lu}Z(S~_S&#vf%er(({Ny_u3F!S;(kjA2Q7~FDD8TUa zeFnSknWpqa6FHS+e>ak^j#F7Dd9Uimix_=sdS!i**YjsBw}w9!C)c4+7>sxl9q+5euLY87l7e6^Fz*Z1pFlyq>|g zyYm;&L14Q}#Q%%S2bdUoR@Xv_%C9+n-VXqJ$f)prNXLK$=6PVIVIhki75$3MoxkkT zbQjsOH-;l;X?AzP&U`l-fD^YB>iCs-OZ&0m!PmsP1D*@s0-X!sP z{+rhT%V%Pagp+^QP$)Pil!LR-C`*M)pKj8IeVk~*h;ZS_osZUjiUtO5Yt$vSGMi%= zrj5Z)g|@A*5>3!j>2PKcI{@3v4PYEogticlq-?iKO$lSc@KB;5$Ah4%i5o7b`J-E< z@^tY@vZg3wlamNQ(FNapwk1=K1n*eR`5vGQ@G>luH_?*$^TTxAoFJW`E^|q-5&FQ% zZn>n9rZg^!*P4EEJaQ3sIpL=YQ?h1ZDE&Fh4?N)zI$t-y`Oc~F;~_{Up+9VKjXkzY8Z1;G?75g3GQ5gzOzFFnz7 zwojGK?IuxvwmjKUHNG2}!hveg9_7ewe8kOA>~zovmpFVE;?%%#b2P)A?I2p;wg*qc zJn^b(b{D^oC}KVeg_LjZCwt`r`DnoSb9{_9mNU;<;i+g}qN6j;&|IWJyyqXT7THcD zOmuX=Po3PGC?d(0Fa-++3EOei#f%IOpJ2}Pu5CrK3U%`R7jrE7v};(IK|Dpqw<`wk zeIW=?EoPJA+9)zvQ5Yt@n@9MA#UG7sBgsqvRw;p49rgr{ls}J5X%WaIBqZ~B3v5!a zQ8G#-8+wAS>Qf}``fog;l2L;VIUkruqT=d5u1b1zWBlQWGMA|RQLYJw6RFLRWh;zB z{Gu1>LnRj481zoIAe{COPZqVd8!8Oe(9j@8|Ci~v9@tPMjWMx+erOMS1OAVYaQ+ob z!HJXimgI9j3Y1hd-)QDy1B(1h!Z=Kxj1gpI4`6{)In~8YI=i`V-t4b35n}bavt~LXn)q!iKlkjzw6<3CvD6qcd-1IYlGeie6Pt$xJj+ zF>qkFL6Mf0E-YOd{9fTud!L>6*k^qF)9OyzsY=M_2O}&s>A|1XtQF?n-MyvOxpJ3z z6LfF$IfXW)w_TiN)^TyD(Q`zFt_GzKpy#yhMP1)fJ2iU^$Jp%Z>Z*HwKe_AcHApWL zL+MDUuH{PRZ!5G65fz9&PI{+@1C`!FIV7v0R`bfZbfzxn1EUOOX+r0PHqZBI*D=kN zzXx>icoTd>3+1dmKUmnWRH2ckV$MR|$GOiGs`pBr`m}p(MoDh;=KGU61;praL8hFjm&iKr4f%5gzatxxC@K8{+BCFnbLR z4G{MvfAM?YSv^(=WL4dVsY(t!8O7&wX*se@3thR-6Lj)WB%+uqqXK>I$f{V+ z{#k#dcX%(O?(X9r2CrY_2aovs-Jq z1><<7^2+mso*oa&whRM3yBw?fv)~$IRnVU4NP(f=$CN$csUZvzF1n)#nu$4{Aob*TdMTjW?Xd64U84zQgPYZ&f{t= zQ4_DZ$uxaDSysmNB+-2R2keCde7bwP66bRpNoc(scj&ywyz#Z$iVQ`kzjdrx>7W)Q zDNiV=MX}z6Hz1ADac`jZDz`OwA7YFPiLyzU3n;6f_1lhtlWXV1ss&=#@Y>OVZ*dfj z`uv2}6@eQdJuHqHNCM@%*~M=(E`}d*^@^e#_Fg5&>mI&vK2?bKtr<>1w6bq%kH?cG-Qt zpUS-qs+=1Ju0Cv@&Jc;jo5K*>X7^Bo0Z%9 zff#A;o%O$WzyxX}ibV`^Oo5>2UhDbs;~u6%7BBFXXnl!@SlrlPpV7)Rl%Kd|w^`&P z#xjF7ptk~_vxpP4m`G)2@)IGzGw&VFTsC!hoq(Mi#hDS;@P&M}t|Yd^(4YkmO|&NE zPQ6VPO|j4D-N4u30*`Fdk;4pfM+d+n(nau8E^y*$AVq-8-)xqQ8qSfinwH55SUu|D!7fg%JvNN?F22*dn-G6=-3cq~{cB2}6+pCN z7gOm->GbJh)SIzZm7$GI5~yTPhrw}E9bp`nm`V<7B|Q$4Wk0)9eA8ELc{RO{gZ&pj z6NqNV_gaoJ0$tPX zAQVnImyeNF;;gT)nA?v@M=US~8^@m^FwqAyG6ALH=a`LiPMGw?1BZ)`7IgFr9)Ait z)qHP{TD-lFRU8wu-|Sne*BYayX;Ebu-0*#rkdiOfLd>pJKQkm@G~SGK zPE(%Gv(XE}3j*(HNVR1((RT%y7HMTZ#iGoUEVKP!}z0g;h>utV&nMQw{ zrWO@n^7~+?LcEkxM#$yW{a`bPDp+~r_u1KrHIqZ05O)mP0}wpY_gN04@^jwLgB)h?80Z6 zj*#Tdm~z^9mpMGRm_S>vNB+!P^CFAhgeVy8pH>8(k36eQ=?%(3(R46&FdcZ65sn-n zQzDdh?>gnFVJ*!DBjjRkx%Co+4}l|iY*HC=FdpTDVP`h7y%Q74F2k&unZnsp)o0i_ zprguIwf5Pz`7ENR8j9D2aDF~MKCau!Qp|s0`6PBhMIPMztt#JC>IL!rZ_>wuCX$t?+skB<)w3=>KAHv z8RbyI%W_5B_(Vi3MR_&52L~Wg)*J+?K{k2PqyrTF3k?DYQXy2x1qyS5s2UNdZ#0Gn z!n!#5L4bQS1=-agUYi7W00iAX3|LLKYIg&qCa>JIiDNhbmbNMYRFd@F^Xb1|=YC`2 zcofXCUVG$p$H9mHb#3Emytzk!WT^q<`mp21*8zF%(j^tei>o5=wjLGAKyG$uerk|B zP`Z&mhjw?r*5(-%hi7D8TGm?cktHYqGYka=fwP?B76#Inh{#9+JUl48f`0Sn{E5th z-lhHen7Rq6^L#3HkIQHaCjUR37lXpUcwPGd6)x6o#p#XTzwD7-`FdV^Qu+Z;fqut< zSUld3{}Z*FVJ_5PMyzvTER#C+TAy}%ogUl9dmLi}BHp>qig7#Khy``z=@G>%+_DMA;&T zanGzB)kY;0ToE(}KlN&&g~K`z__$4T#ywjW5)UF?6ugtei89sC$od`ixtuM7n0?+8 zk@5p@G!m1iMgpOT{yo@ySJeJ$G>g8oYN}A-S+Aq~(c9G@v9)HAXKxORll<2iT=n0Y z=r|jmyI;3z&(EBp>l=7o%x#ab=+1W%^IX31D-!ujc5nckZNwxn}ZHR)3fp2Yn@6$VjJ@7jPg%i%~!sM zzmNy!=4H5?vFZmu3sON7h$j2v)5U=G0b(k>pIR=W*KSeVD69Q(PNFC%v~kd|Joq?{ z9S;9N*-K%OrJS%3CO93ISWUyu&6(;0*6BrT{XH@a^&9e6Y!FK_YBN}Z&_*+`V zd$W2Gp^me%7o+A*rLa$6cw#=RhYl&{o!5Ht*e>>Xix?FNgZq;=fsgUp;x!!gmS>Fl_#+(Z4Tt zgLfcaI3v=kRqun1{dVRx`TtN7zeM06#33{k+;wzvvRfO`4O4aa`%w3f^=bGeG7?M3 z2w)JP%1u8l{LcS!5|>>_fM`L$v_2C8u+0A+Z-1$SFbHikSK064iQK_>!L#sVf(R|LT72%MC-p%9+v8Vf*DZa6^1BKX)I zBfqu?{LBFY`LHginQZ`wcSXd<--qbT=pse(i@(ld!0^642B0FqXN1+&)f+30|APMU z)dRp#EE;d$jsd)JYL@}}8$V9SP)D0u#geRL3_=`pT9zwq%eqej{&|BkAQ#)?ec|W07W8y zUGv~8yUCCS&gIvK1wpX*qpp@#4Fp)iG@$$4EJ4HSm^e9&!~k81a#2u{-w^auYdA;K zV=L7&7sOceFY8P`!UHX!1^akIGEM^^U)p}PKm)X(J7n_;c{~E)3L%o01MUNO>s$VZ zJ%r}v-JoqH3$adZ+m~&I?#TVQ>BYywTgV8!S%$wFcnw7AKk6;@B%pxJFq0Lt{@0T&(71Es1UD)N&fpdIl#BT=W*=Qcv+)u`y=9G6oMCS4JV zBo|lTMTgYRtN3l76*miU=4dE~zKJcbq8WDe;=+39^@*Sp0F0cL zk>pxqvB+#d=*`opANla)n*4c{AbO6yj78eCeCLyeX#9i7P+x{h1tqTYpF4Z%`In;g z2yi_7v_@{8I~`n|vH9&a;7#|}qHP8g0qyA#7C~{r{qX}D99b(DrtmYZL~bifUdxHu0Nik`Pg)Y2)YvETDeW%4 ze)N6VVOn|?s6zk_{E?oQZ>Wae02wU2Hn6R%X^l=$Yh}lkc~P+M{3!0+@NBXb9EJa! z%v_L4({tEYq2jodIIYc4^5e>mDe}MTW5nQLg*L`V2}1i;>1zj|I0>?8a@9V{AtNDoS!d zFy&9k{*NYuB)`n9)Dto@Iqpo2Nxi#X3UdGyWv!;phLrCms|pfL!I(5PecVb#hO(f* z{C4mhsO-4jb&}e+_l!A6J8X3qMK!>FrhqTvsO`I}zsxg2^ryplBl_@T>kQ zjJiMr9QNVSmv26^D1|2Hty-CND$b2THK#Q|#5ztmEPOe?GbLMf(bYKseSQSEaZ5y> zJ!r-lm><*TAd30(FUdMFfQHqNbiV#L zoax#+KwT-r4lkfs!Wyfbi^sQsasOP`5=!GQ=`X}!e>O5$`7n;5bT&xP7f02i9-EU2 z142Om)Bw49?F2K@cNEL*w`x4m7|IsOED+&pj;U1Q7{$mJnj!=VtPXE5_5{HrA4Ta) zpL6HLqMCs*DvJ2kL`|rP5D4{<_1d(%Gyq{e{&8<}v#_=l8d#1szgPZ+0{jJmL%RPD zCCGAb&MJo~4_LRq^%|tBQ6RfP%%~c`j!}ZphvJd=k-=LDUX7Sm0j@?b@S^{(kbopL zgjf;gR0(T9e{q|Jv~*JRsGDbhy8Q1uC!jl}!JR-&mt$V69q0qcNdC~~Xbio^dOfD9 z)9Gwg@s*HHXQZfn33mqL@OkDiSHM^VtzH1hML}`34C2pWg^-}+9 z*Q7HZ%wpXyum`1xip(d?aK@lKx_`hcm*#E{$U2bFmK24wFT}n6*QU=>4XF+uI?oPA zGM4{ABY&AI*8!KMQEsT%gw>u0mHYb#KKc6^kcT7UbU%m8mk?}kzS(U5-o<%{wckq8 z?H(QF;^j5NQP=!;i>3YbnXm@bbm&NgD*Nx|K^Mzh+*KT40#l#8GWZ`p^e+_jo6k}B zdkf~sb8_AuZBxggg36))aH;>YcAqIrTtNe*J_tUs#H8T;d%NWf20?p@i|v2{OCps8 zr3(Jx`@b}fy2#czuhV`!m;iwCl92Ad8(9TSzwp+CH4Ts=2HfFE?AV~Z;lDkP6S83R z3dF%aUd~y36;!|Ymx*S|g_2laj6OFv-vF4PxcSJ9f1RRxcYrn4;9Z2hHPv&cH<|4} zj*lXQaUbUH^MGgy%Q$sR*v@qf z#D;Hj&mWN~E`wXnY9dN}jc%XK7Ej@ZyEdli4XMcQZrq3Y7jI(cv-DrnR_1je!Q?C~Fb@8uNE z@^_Nc&@*R7aOwnfYC z(S^sZ_$iSYpslY?6iym){%{#^9q*{4D=_?*LGuCxw!1qr$n|`ou09FkHa;#Qa%c{< z@#d-}JMojsy^F%_qnYXKX>>oQ9oUx=yOpwFk}bF{HeYB@o%oJRWqO6z=c=jF74;YK zHMmZGcB(DWkMG4<@Tl|@i;P-JR+Yt#56|V>F{vbrpjw}Nv~fK=2+mWXv*Y?ahJVzC zuhAy~rS(EEIYb+4-7P+D+G!C9POjhe`9k@G`Z&sPUEfLF7OVoyTit4$t(*gz^6G z`-0QP(W9%t4=^kNdfMl`A7KGqy>Howj>7S2?x|KPExH^l?>6%>Vd2 zn6b<8Ie36h@W|{@nz+S#Ra7;XgWbZK*bz2F6L&J@JB|J(+7-uv_*UT-dXD!eGDA9- zSEv`2Cq$rf*&{{+w80r|Un!A7Y*q&R{r#~mbctj@eSH27nIpX)&kX6zIcA#}yvGZ( zp9Z}ub<7tc(6CcG8l0e9b$sniAP4F_ z4TtY$ZtK}4k3@Z5I31lE(HlbMXw%z=V7UBS&)A>BwTG;CM}}8fKFjn7=}<*rhvo&cCuEonczKRyBsHPL7tBPGm+OSlpEa zpk%$JVlSJhM-#n8E0j*>4zhjMw`Q(+pX?cmm<}H@MSgMV)DU9BzZJHd+4Ic#Ox@BU zZ#B(9;MG*xcjPd8E7x_I=D?S*9UP&h8!lVvNnuw~LF|66B@~>-YtaXxGtYfs6ddgD zN8T>rdPHfyND>;O`!Hn(Bd74HqqqBMvCD}02Juxj2d@76upu<8lkc*QiNl9GXKR+u zaf$&!9YXXnExL4d%}$!6^0D{q`lW7)mu4D@W8{DwnXti{fy#2VRqWe(bm`PF%|tIF zrZ_=swMCoKAiH9fcVpU%Ee}^9=f=%Bqq9eYLFHZIZ!f`4@1zxhNB7+>(m6y zvO@-p&^k(AQ?A82*2T7S=*+{+GtC(y#fLLOc^Oq6meNt~K35K_Z&qiQAL#GnWHTAF z9W!1HhKJ;Hb|Jxw7|oQIGVgrX=1NdGs4U*9;7OO(kNol?U63t{b^KNj>;Xln{ORs` zl>C`kxb95X&gTAPiRGz0F7XR^*eEYNo$9>ov0kx9*k46@zJS6AW60(Z;CjCJu-`KC zj+p|T*u>L7LcaJ^#x^W!p_?9N&gP8WrPe{8yS^~Vi2YqzQtR2^Uz{M`?3L@Vve>=D zdj#+R`SVo?xGKp4R+DM}v}~{4D2*@2+}kYVfK` zQDo$MhjZIf4vZ)R`X%K=y3u?hP;qmO-O9Xl-m{0DhZUFIcQ7x4C924Xt4APH`;Pc% zz|R$)7xY=8N9k68PBiCJ-5s%uqZkze>4Zg=o!?)W{cPf)i5t(?wD31B9q(3BB)I#X ztnuy^-ZFjxRc1!(J3%EgY=wCBZW$bit4 zHZeVsn|c?v>mpAX18^IqcgR`1kdf(@!3xS^q+l$+MKP)LVYXiwHfh0&#qUi{a_E1~ zCR`{Pb9;~+KYk^hkS+b(2xdapzRFJ9#cAkBwv)CI)H#3-w<)*H2!e+oIO~w24kN00 z38>AKO9|V}tn6ll))fPdVbcT$wgn=Nk1B#NwL}Id946aoT#L?PyWcE~q%>){jSCtV zz~|QW&9Q;{|8aHr@pIe8^;Dr%wt_he!hzAJwsuZ)*EMklL(+!l9QWoX-!KaI;-3~P zgkrq}E)#HwsDjDI-N4r{UgP#gEz;*29N%m0jJEAYQ#;67L&Q`rrVu?mV?3%EM2xP4 zE|N~{PZ9CFNkEn>Rpw7Gr2z1VGMgc8p6!|vGv`1!sPEnfv#CT55UZ;g6J^Txa^-u% zSv2!&=MdGR_Ew7cHVoS%kpCh$_R&6w1BGZfLjv2I^|(cMGL)0)Rmz4@8f7H?D5hCV zla5U5#rmp48ok$TYT*2GwkQwAzf5E~8%`$vvP3_ziy4K=u3!=DV6Cx9qMum{dP)|= zcAM{Bu>P(U@i^~n-KprOi1iMpT*c1&YXhrvhbK zMOP!dPo3$kNj}8WNsgB?0y+JS5M>kBcVoLUn;Nx3sM{(9FW}0tx3t&E(ciqw=-$(T z`djQFMeySS3eD;>=ZHvH@;g(`Xu%+VYO>kX1Z?SDNsU*m5cKh(l#=a1>PO}Lh4-IM zhr-2P>t!I@itqg@(c7#HLm7K&GMty#(CJD4$o!*Iv8DxTN0O3R5#jYcQ<16AVp?I- zz13dl?+9^;R|F|s=s9Qb1oP0?)EzU+e0D_pNpUNyyA|^j3y%G#OjJ?*sb&w9dL#Wo z=(zej1&!IMr|Q$E+Y-xtw#lV!uUZ~u-rdwg1Gk5BW8a@0B_4qF`r!q@p|^dp6z=cqxX=O7!Hw@ZpB#fg2pK%o(*3^S3`rphfmcw zx8QrTnYfsSJxZpNTyI(3idor{^7vxKL0o;g{Lk6QMVSs*geK{lZlm=eF@%oi4JglX zC}3&7DIpgbj3r(;X2OoO45t#b6*k^~)=1A@h2O7~5HBR#cz7GtK(b&Nk*FrC7LkUx zX2VjIf?<@7EC&^b)RYoT@j^&6y^GPqeR;HR`z7 zj}pYBfA!L!P`?rbKoNf`tEI3I+e+7!wUJ6w5$~~tS1iDeg92_3v{Vh)%)7)|37DJj z>9!8liSk6XH|%MVVcvO;HsariFd@omppV&uHN(+UsD ze<}NT@e9$z1v zgavjXnG-rysihHf9$iIQjbSNzo<$2QQH4NZrNS1!kA+`7K|y%3`mKoyU9rq09^7SJ z?J1zzX)CVED0ku4>x@{%Yodv2P0Ud5?bROWsquV^OMJI0$17?+-lEAqb}U8WKp8ri zwEO&RhU&_D-6dnfnSpMRftO@-Ugbn6exT$LXTv8KO&dnsfk|fY`LAffG@tGOC^3-$ zrht!!hX*_twWtLiU_Y5VDV|ubL_Gws7-d|RpA$(atCP`{OwnC>#-e0}V95ngwv(LX z@LRfL+bnku@l6WC>MU~sl<1rnfx#eLtvl1;U+6#!&T1ac5`OljP8+U2w3Ag1cHk}) zS&}V#9^w9;`~4DmvBPIH9~h4)qQAXAD4_>O%A@pk`B~nc7w7#nBr|1G{l)!b$7(Sp z4tK(^O9QBL+w(YuNbF+UzNN2bI^9_|0}(-}^3g>?tO)1>h$ffb3z3*Z&zV+>URBE@ zEGxV^nX-+ZV<#o^as#QJ-_e{>gu~n<+#qx{cSdgZyE;c>OnN+Wz=19S|{wm$}AnY;tBG)saMq7oG1w}Ac zLpE+o%)>}4wJF>v8GC!zrIa4ct90f$9vpud@3K@38#q`;9_T2sna#Jud{e7ipZOga zjn2T|0VL8Cs_1=@4lRq3Q#02^A$=W%wqZ47=d9ORFjI?1^BrpG@_uBBKmPR{pc9yUe4oE++Z(RuaqB~58j6#$+(B=(?!v$mX z+(vnu6cW92x1D^ECHO57pw7V;m0LauN-z$ob?L7vq%?VF(%fmvX1eVOFCy#%ciBWw_wJ0=w}ty^?zEo!&$g;%?MCk8@Ap_&t5s&v z(L#afDJ#mDD`GuSJl`W2 zyrD!E65^rdc0k=uhe_a7mORE>A*w%t8e8t0*?*m|Z@Z}}ql~i=X=S3joqiF%yDAY4 zlubg{I@igfkU8Z@l&*CU9G)59zx{^gR(-t!N0LKDe_~0D#e>F{mCQ9Uy!61(!Y0 z65*&2h9%{>_HT1+0-=^ij?0;YoWj!l;!>;?!3jI;h|?JHJ?pHdn@xy`;2xc);Ajb+ zZivR}eRqa#IKCibj?H0@*UP_kA+PgD!%cs7{r1r+&u&N9C`UnOVt8llj_^di1;#@m zJ)8a~Foii6#BBb!ciw~b38wh~tci(m%L6BBOFKIb`7r|xJLf|ULDR;S_|w&PGtj%t zd*>q)59^E+6kBWYY{L~^X4nQG;{dnh3n3xa>+i`xXu}!?xp5A6a`P@EEESj*-!sog z8b6ILpc9|%_s+xy%n#rWhf&xBTbsV=k68}ZM`*f(ua#I=6>ZQpMHz{bD~9Nd(An`d zveL(m^FoBBUpbGK^E-L7nHIUv&x{#C#+mFhkL!Vosy2DRkbTB>R&l_$nJb-ja-@m~ zI(;;^?*Y#*&n`X4#<-rXlJMPqFp}_DpmyZXD9e|A85)W4iKn@_1oBVre^|pp^X?B| zs%l9R{}lVp>n#XCTVrW?$Y-mKgW^3e8mR+$%=xipoiR3R5phJsqZUAscF$*y?wNRt z^`vj;^gsv3{f?7JfXE3Cg6bc3d&fK*OJi!NV>kuQoxMteN##8u%Ihux#wxsU=SKjw z#CLG2iwu6xAtOKI@^YwN?mEW9=U^(p7em$=ay_LC?8^GOi6b|8Z1e|R*H+a^UkZ7Y z;01Sr=7%^vkW!f)x)FGv5}=$4{^_grZya(*++hk;D7aSv6R;Bz5dlhKnSvTg`1jJE z?w2FW%7Bx-#aT5E)oq7u@$}MsINj(<8073V8ANIlkzzT;fsehx3Po8itd`?f#F8$11dj2?M9e zgysroL>8P^er7AR63Y+!PHk%yGGpZAfRFbC|9t8KB3+yjz*hw_hkc@Nb;PoN^#SRz z3OkI#FIaC!pAXaQ;jprs2amP#dbfyjR`j(Ot#)MPm!v8WAs@+e-E#O89f~u;b>Unr zyIY(GFDYr5%OCY(dXF3%2p5{QvUg3w^|B4aEi&hX9$k>(2fj8TwB{{Sva z>S@%Qy?H;8OjuyA2M+X?h{V7uzQz|peOxShci^Y(vK~5GR)UE-b)29ApZq-dq@)bP=yuO1KC9vV5b|_S zbz`h*{(tSgXIxWR_rDFII0(py0wMx-qzQ_Mbd>=_1eD&3(p%^)B*Dr60s;ckMVj>9 zOF){^A|;`B>AfXD2>I`WZH?MS> zcL4hu0zpMNx^UtxAcWi@Jr=40u}ffGp5TbnsH?hr{40JSqplj(*E_lS+}XZIp)xLV zvDrW(b=~QB@A<)i;vpPk1QOVJ)4N_LbiY?&8L3kbt$)r9`yp#OnlWJMFxyriyTV4Y zb5$Yxi;Ysyg6Lcz3hb&nQ~;dcvvR;ySp%-Zf!tCfQ`3)E^M==C#uR<@g`o<9<2gk_ zjfqj~)T8WDT|cr*LYv9LV6(3W{cCD%Y0GkLO9cDJUfr_IFcw2pU#x7%hBc9i@mFFD zKV4p)dEkx-JM=0a?@ziTV^VUeWUM@MMZUv^OGEZod_dqK$SDGxcZ||Q0DJewTw`u&DenDyLDK68 zV88E3sq@2D>9RGRQ`#@l<#``B>Q8W*`?zOBNT~dkUK34|4BRdDeR(E3>r+jRn!y0b z)vaYo13@HYuAx3HW{LUo8fKe_Gu`t=)P76rJs zt71wQ2D9LQ;Xg=-u~Gy4nUi-1+d(mvNmQChE3)cN<&hAm0Db{TWUKP_%ulw) zuW%prJLiBn}6_&VMOi$N?8+r1H7v z8O=gqWg*_tUr|(l9cd=0tbiA?DYyiHmfCDs&i^~x=iQxw0y9MwmEip3sSB+KBg04T zU!PZSC_S+BFpx7!{wpM?0V2Y}TG>Kx)5QKeAjtk4C{HFpzMbx7{K3rpmwJ^yy9C@R zktqI~T+h`0l^yaxr1o=PpEiJ1o&kr<0AG)P?G|up2CYF)AGSVsKa>XPf&PtrMEgVd z$7kwi-v2v9S34lf{2EJVoj}P9Zcg5a@V^3jk(eVgbpKlWY-$fDr-JXk_kw{y#7ySY z|M5rKeKiPp6hnh9#Ih9pKS@!q0CxkxAk%VlF?>uP59aBAODmWJYk|Yw%>c1crL1w-tpgCj(g3o}L{~<8mwc>h4Bof;%m_Wv(|OLvJ%%pqTZD2>9U{gY9YbV!Pi@!f)H82A)_g! zl>eJ_7z`ZIP8_cq?P|}1HikYBXYsMNUWx7Xe=rq6nA%TR*)OQYl-SGtz{&khh%5l>oQPEMeIPMuTmOYJHw&P_;IF~Pxcyi7 z+*Lq{grZGf)j^}?ps=^{4g^oMGR!8-)IvY2I#3Jr5)kPPFh+g_9a4iQLO=d5{vkDZ z{~Hy4I=Z~S$!U_O6Le2Q;wr`GkexdCq<~8b4WO_L-{0Q{8mPjt93ap;_|2nRPac3E zP6#;%*qh5k<=uRYKfg6~5kNhi<=YbhkiaowVC!e0TY#eK zUe+9tgYn`gNk!etCu6MXY;yDg`w^%o^{YJc zf5GEfGK}s`i$JhO;Syo42Ev0vBl2$VRN+53g}@EYV&t9w9t$xdt8LtJ%BQ0tGUJdl z28(JB{ZD_uf2ZQ(&}f6ilnrG-9j_SKv5iaZWX**Lh$_;gH$olXV*FDO|9~@si|oc! z!~Yxoc)gYb>csnvFBl{xirh$BrF3zQb_uiZcxya+(lDx$&dW5xs7c2Vv27!1vrIqJ zYf%Jo>HYMZm+7NZ!HBM4Do+0lNR@?_ofq$IlHFz=^eS^dd(d{R#8 zfY%_q2_vYc6kp_+GmvJ=J_%O2?Y+SuS9 zE=*37<0RU0dYjczz@cGL>oCb+4=1xmR-~#gE>n`dyTV3x=BP&SU%5JVK8epoIjg*F zxzYMnYUmT42;SK{rAacT{w~VkRwU!`-|L%^M zt|i3n_DnMS5r@g`8%xRc((9KU3rj~mgQLn>IlO00@{1EHH>nBF=b<`N1xf8II4etx z@pGO~+%P{<%$KM zb-hUdaLG)q+`miIT8$oAj$a=p&oTrIGj$Vt2;}Bx8_J@_%gvnV-XMP#Nz|OXQ1 ze=#23ZhPb+$Kc2%3A-<&>nFBqKSn7gDMiMM5?(IASZ{0q`{Z&1(uXBCePC!11A^st zGUWt3<=!@6fI!z_QwPS>=h_5bd?i0kkAP~WQSn@f%-WK482QXqv-L-u%j{99-T{Le zR#x3g!%8lWZP18cyvD4mw_eU2l?P6#m(DC3$(9rpvo4UH@S(ND?wzbJC#$sd9bY~4 z2hh?K5S;TDSaX&+XS-wUnNY993aZC9-f8iW4MJ80*^6Ef#;A_(rHoz|Dxz{MnSfzu zrN;jxaIWG`>a$58V5>2yT%`6&WkW|IrVSFvvws1I;f zKTFReRD;HVuK~M58<+k9Z#1$G+m`&4IaVtq#

      2ej~qOnZsdID(!hAqx87abki8d zz>5m=C+M5wmw{ZK1wc;oOusVnpU~pNfx6UdUCsvXjK3=KNz{EJQZDoj4t+s%98@R3D-*{QmwhurgnhEjlE}AuAY__(UJo z`gV?7!{ISNjh?!=n{i13$o5^%Leu4nFgxgiLI7WVPJ8Vw!&ioy0^lHRR1|mUfz6(so4bCc_&$WkW~Mm~mJ}b| z>(_UhUy!%do*ZeM^;*`t6rp`Z;T0TJJ>2%~aq?QNJYttmjSZN5ufO(Q7S`^!p|b15 zk%H;2y^MFB*oVc}$nCBMd#AtPSOf7X!*{@Aj@VNKK~UvKCzZ=5VxH{9uTC?(W|5Yj z>N|2{t~N=!FR^t0_1c29iBx9p}RirDc~`}XURz>(Wo%Da(T6&z3ZIO6TVv$GtGNj0S}kV-%8rx9YZAW zj={pMFT4PeKEW3JUvR%C+^LBZ$_W9obKM3^+CWME_{7BXh3db7CR?lr$qs-S_T0j1 z3Fw!t7U%9ZYn^rTxXK-w4w&sxJwt#hA62*zCH2|+bg>fZIzhNQO=bo;TzN9$EZ#b^i zV?0{!Vmt za0kM-)UWk<9-G;IfXj8c2xcg}(Zn}kg+#OW zbbbd(Vy=PC<;HEwV!Wrs;|ZRa%IQqPK8EbkUuZ~vlP0OwR-)rJd>(dHo=l=r*$eYj zao@67K|a$SA_echwLr)o?GTr};%&c!9*hjM3q z$~g%cejM&S(qzI;FyX&m1K__9R2sm4A&BDv{CCTOw7UgEPIh8Qtt_VyI1%M18J=MKyok2t_#$F^3 z`f^MP_ucvRrpfL`Em$JVMs|6>OhCt@iSrT|HGYAAd>I__32%**II0v#W}mxGFoRwWBe*QAEaoBXOqF0Q8l2W%j= zJo8kS86Y8l9RDBbffO@%wBc@xh?IN0#UF#2q8MUd9f}yLD|IEhD$$g*Gf3{;R2aTE zf*Pw*lW1O;_jxLnID_Qe2$HF0{^zK7p{fFL4FJRqf*zlDqq#wT5Xth%AaTQ05dkD& z1HHI|;h8P#w;(MQ8uh>@l~QwE0m#@}5}z<~8^N*N&gnhx7$7mqE4GSAgEpb5%LL5+ z6s*cK=J#KR9=PXNE(LcXWnGMbC=BHfk;y?Xzn&psX=l)@5*SZSc`gp8x$~HPqH~Q? z{G1~{XecA{l1#AYP$!HD#pcMc>KK5R-mSl3g}ykl!A0KH8hO)B^Ov3++|YW=Eh#Eh z3en|odUtUpT$&2rnSF{Z*x^dpolYBS(J31JN*qQ{?u!~FOoA}?Wy$oM2Xx79bB)hh@XE_!wxn_o%Tz@d<>gVsX2Q!yeR-tDezaOMh7N{uC`lq?f! zJ<}w{+c{(1(DKzwXf*lj2%i$|&%%sTZ{sRqSd4G1*Pq%-Bo?aJ51v}>m9s}#JYR_d z7PECL0)6a&=lpv2obvjgD2aJ`j5uy1N&^==gIIjqFOb>%G=IIF?U5JhD=|KU;T5t= zTNft$Sks+n^QxkGT2M;Dj(vN!&00Cg5BzG(Q|ke{^j+0C67g0(cd+e@#OoJ+^gsD0f={W1?xaLP{W?=P0AD*R1iRvVMTt6+rO^x$jD>UQhUT zR7x6jaNp)a(8Nzq{rn*+?=R`TdlUOcmPeP_&?~Mp)yl_;JD!^X!F2w^7I*1_L2&`= znNWo^1mUKQkC|MY?CQ0O<9Zuj6CIh7oyWBHw;yDm>k2={_71a=6P;!d>S-oie=Cfb z^h#IlOMe6lCzOwf4;b)kvHNy_7~b48i_Yu3eqrzW`^w=-nz)IK%$MFak z3r879B%e0U9dfHJNxh;IJ6|8hpm?-sXvwdGmyBG~GwQkQ59_s8Oq9ghvh^%0l$tFd zR#-+0ZPMcV?bM`vNi@AVCovQ%%F4&-=~=l3jsq;hZPFmP1^YzRYvf+9$gq19qu~~j zI!sgmaKi4W?_dBiZ?ZTWU0l|R&C`n4_{)-f1YVoeVb%$b=dOzrPZ`7~1$P{_`+WnL z=#&b+RDRj{*3B?1n%})|ljb!AcrBG2zhOiJl3^2%hn--C;tFTT?JLM6*DO~2nIhUQ zRJNZ|Kd1YWSO*2T^RMO)u5#)xb4;3}PX@aUc8p!=FkU)gt1HN3UZbF)J|IlQ2Kx*u zn5N5Kf+=FmIr-=PGP}Lc#p+lKGEnmaCg<#nBoXr7bg^D<>do4maTof$Tdst@;g9VM zwr&`@LEIk$BBet%YFu-E`Zf=+w+7Qo?!pXvDbnUte9w%5+bfWU=?uew6tu#N9Zm=4 z#i9_T#+cc|j>dzvGd^nZ4?kZPE&=37mR?#2Y{cj9YxBp$^m*EU5YAc+apS&GG{;f8 z1%3+ejlN1^HIBQ~UbD3TD@LrI*^F2KDn-)VA5>Mq%>mi5yMrwt7r~DVRP1eF?{a*9 zF!HPjkq@KbmJ=ks{kb27__NHb@HM+E82A})e^wiK6TNt_#c{j(nK!Am(;iIfc2^$N z-Vb+5H($xdI>9kZRhiRs_lk!k(=+W_(0C4G@ww&v%3@eaav~+p+L1K(=)jgjaoU7_ zd(B)!yNV<2Ab-#C>4ees5@qj2=YkQ^o&fs$m`wW_w^JaE)~9>W-Ru17_6dfk5!YW- z2NvcO5Rx=yfr#y6d1ME|W8EZIfCzgN;*`#2#L|r2>!v&q629_F2g! zz9B|yxFGw=s}gBL0?7AzHBmamhAW{s%(~TCjpNxRoI8kw*2WyGEzH%0a&omm17Qg5 z{cMI~A@O)M>uoTjH10znf;gCu9ZxR9dSKyA;kO>aqkGFDqJTySnDzSXp05j!_)(T{ zy%bmNKa_5b)9Np>3j3M6tRDj(hm&Ve9=LoCvHdaHg#8{1x1n4wS75=Ks?J{q!Fj-4 z$T#o7_RSHf=o8;iYg?==CLnc>0W7w{^(ZKrfuknP_3x>X-z30>DmZ% z?czNyw!62{A!0LlzDF2#Cwq#%9i-dR6c(H^36)K7FCiglQJT2*k?kn8(qj#P zKDup+Z=Ltr)pFgdW04}VV*0^CuQQ|kAqQAh9+)L70BC1~K$dA(?`9)YY}MxX`i|QV z$>GsrUpve))8Vo1Scx^p37I1AuXc(>W-Ezz>0>nJ;=<;wlVQ6BxH6q85I-<@^i03F zU~$l`*^-Oo0r?A!#YXR-=%AF}l0m{fFvoHLo4KqlqYLmyK=@&|m8G9G>zLhB2L1dZ zvM`MNr`YvQwd0=M(ulEccl*7R^vCo-l`i6*TlN?C&%iMg5`U?Xn|tMOqjvL5az|Om zHZbC3rlagjqD{MVoaAP>wAW_^^Eh$JgOEQ!HUv>0I!$yVG#c;+?TCon{Y=c^^$fq{ zyOLYhoFcBkk~K^20-Z8R3)UZgZLWW^AEdAbBK9Xrx!xt_ec6-6Ps4{&_Mi*}SAV;d zUkNU?fsl^%%$bauIoEOA=%V@;3O%hk1&P)9gyD2o+&?7dc7sv*e$o$XR<~AgHNel9 zZ76DiOq4$C;!hd>{=LVpT7oC&5HGiUq}W_zKmtD50%Q$r&+?o)0Hgp?ym|W#9lelK zEYgk^w`J0HSHIUMF$9fBx|LdPP{j=Qc7dETY(1HgW)U$cRLUtqb#~5{&5hdv_%$OY4$&0r0NS}Dgh+?9;e^X>gn!e9 zQwaR64G*N&CVt@gOu0@|t z8gZ_S@1fvD0Q{Ig1DKvHleTF+?jTws{smK`u#K6KPI9D$O)EG2qj2y+VpO48M++ZF z84ryc>}LwV+KJUeIVS=LrGc5ui(WS>TZ4}o=csJ`@fX5Cl4He@bLicf2V1 z)r_ZHeh$=>oWz;nO8kIL`xh-c;DiIp1Hn)2^T(;O$k)p4{N8KtxPzs3SloPNkoYDO z?0eL-<^~iG;-`XaG}9^qEtRg}uRYgOxL zTN`s-bD(N`Qd%3uVr1uU{>7$ok}l7st@^s2`6ly;(v`(C5Q;h0iB`lE$Qv-IrU1!E zZ5aFdChGS1%ad(m2le9xp#P7{g0;GgQbIbJ2Kc1b&1V>3W~z<*4`q`ZVTi}1`mx=+ z`5__H+IoL_pDKJ{-XnLo`mmUNM4nmaXPCe{v663@Crf9)Uz_5ibGV#BNU#wcRGj6_ z28%!Nd`fKd$O9Gc5`FCx@`ZNQ0!ro$^W2jqPAU<)?(V}%B7@={*%K0JzWBR)7O`4w z_hhK5JQqIYBM6gMYpE3dLp=S=^RG|_ep^d3?8k+#ZTEBE zhrFilv%dhpCp^l;pw)8i@nX*MiMj6tShWF*iOSAvb~TrPDUWtM$e)P}Mtp|0+&T>d z3kt!~;HF*RW|Hv*#mH;I2?KZ2K#+_TU?Kr7()C)PwjIfoQIXzcA&{SJ);<3E=W zC&MJ(;6Q#x6aQR!~`DJ$(7q2v#ATS$g z!SKoARYNfu#-6qExk!se=!BUM$60jUYd-DQ!BL`_3c#<6(bJU^;}80~*GH^hZ+Ou% zoyk$Abs68nWZVR~>U(#2KvLL8fOYkE(c(kkO<3o=3F-P$IYr?WY`Y`C)il@}sb(`3 z)gaJC9SaX~6MAJm!ZJPu3D;I_e)^5a)F&Kdtgi$bTdj^Lm}L0xx>E4nP9a@fa=K^X za!2La-rbuR&I%7D8V$kP^4zjgRT@2jQD(7@WVA0@^xjcSJG8 z(NpTr$JF|(D9xCl6dVUqR*8#*@j=`-uMQmIs_s2u3`OO%rhvI-;Zn8HKv>V-6yAu# zb3CN$`N$;!} zh31OR&-<)?3wB56KUx9ImkP}t=xFhWn0D`_0GAAepvMEMtSh&?(M8!8o#IL=%yb@L zR}L@Vp{fGu;FNsMyYpE4Fu`eZwv1`0wY}HbMx9kZnIk^vlpru+ zKu(4@1I5J(kF>bLyr<1UBo5+X41lZ0BWv$k#JNVidA;OSt8s=0Y=X1?;{+!>5D?`+ zIP^#vNnT+3z|m+1Z}C@hk*34RoNX^9v@2ZZ z6yvw7G0ZqavRj{U8hIhKaYl=fm8)pBLH+K>c}9f@9kS<$z979k`xT&UY;cBF1oJ;W zgEIu!ojtlZzpT$qlW>TiQ6)3v+^gnmQaDMfvpb>lUkHkoV&8jY7M~Xh(W0yKx;V;Y z=o~;;J=nvL^_Q|eeM0#S<4S)*cO9!r6Q(YO+toVb(y&ToJ&doe=qRhq~T4y{I^CjX{?zrx6G6Fk{z zu3sG+FKRtFhF$jZ-}_o?@ap?U7r&r;$6)X-Czsc?{3E2%l^vEdbOM7{rxc~gNgKhW zAUz>JSyhZ$B3^BZbcV>5>S&aSW~$)ytjMesmyVR^7Q zwO%v>t5JT$!>WAlI8h-_5Pdn>v0Nhu_5m@aLH`kB({qEkV9YxX>ozPY8bjrxHw?*G+jj!L3{YIk)whf9% z?&-R}-ne?a;=Y;R;W^W?5UkyRQ=sRZf`0ivZ)p6@J;Ne%A4LriO+{*oqUsx2c#!gpeLmo`m`Za1E~hWrKF~eWJ< z21n#LW0BE+E}wE2|5IY-0~F(Y<;`Ij+zVKN%w-+d4Gau-%kH#?;qX42Ru0)89Amc> zyOz3Z;L*ahCR)V__7^Kyi-+uwy35U#EXnkJh>#b{(RNJ%;iS^3v$rBquIN4woYUH^ z5k6h}r28#qFBV+a#T48#_YZxnR6SHrQjneTU-SWC#^)87UDmt86f1aYxFObJMh4~b z(h|h$ZM#Z41tK^^&2l`pdzR07{@nHA@{h=#G48FLpLrI5d$TuYsIz=gjSRD#i!)^J z?2^sA!sX`6^qF-snW3y=!iL?urT3!J$cO3n`0dc|58GeZ%!jJoY(KJuHPW>|Sp!B# zgeMy=c(DWr)au12`}r>>n9UDAb+7!IvmI8(9NKCoGj~)WDMc_l!_~s$QCAp10@~ZIFFFSQY^f`S1$&@xIxx9~AtY4{i$?dA_zIiuYCPleg^2JZ%3J&$ zd2pxs9+A=0XU5nE-4G<1(J)lw>}yvkBB57$JH~fwqkm-)W$ArSs=57Yf(&9x2Bae` zX5F`ziLScqWT`ZJnL9FT*!*dUgqc5cRC7RqDO_jTu4K>d;yl&?#eZ;q zUi;gg&(UXl$LOd(uNVEuj4p5Zt{ZLZOqqsT;OO}@4n|hNkdC^5moJxC<(~5j`>V>I zS&L2nF|`(#-7aH?j1^C+OA*-v0uMj zBJEXNF?w<7)%cv3K@oL~cSKD&S4w@(fR5%+`DZ2a}f>(b1ZEFVga zvuD2xqnUu9H12Mq$}@W$MS}aH`xQ6R`H+elFq)QymrUyj-SNYw8s&VDe!f#iIPQnH65%b6_A5NtXp=W#ACp#E99}k z797738w_{LKQiS?-6wTK_lpyaOY$aVX8>j;Z{cI*CD^Q-YwEM81qqTiIk55r3lnq` zaDmQY>pRIXHfbng!Q|i&FkSu}df@h=g%lyfqN-cSzqpqrXg2w%8A$T38E0jDDFg)Y zRzL66ymJ{?(}GXVbPg@N+(Qd5hDsY+XTSwXcYt_u^l?okjY7jtL%UNQIl#{EuER_* zOO01_uSxc@7XR^$d8ogd*C@F_vQk`RJ`P{PWzwq4=vE^eZtnvJ5$RbvLf1n!Z0??C z0SV4o_1*f-d?go@;-wcE5xY#i-rIHwfH;@Ws+Rd60^IiMLZ$L_5_o2awyU0w`(z6p zV_pBG)GT$gX$w0y(UQ%Hi#fIV`cRxHtnR*1yO$z{Vz7T{#m62&I@>G5DqE~X7_#+< z*R+Vlj8yY1GlbljTYm38Fc|O4?;F>fu9Vquhj9S_r#|b9@__X29b+Yf_V8t+np)@A z!$~arQ@kotJElSfn&A-})atH3J)Qt%QOV$|c(oLX5kfjLh}vZ9##X=K3tlMyA{9Ts zTFAgcw#v@3QLFB+<`_sXnEm2D0GFhrcj)sZm0AHVh4!d2G*0V)cl0=r14!ugNqXVJ z5(u2+HBNKyY#x3Pv^D?poaY)u8RXsKqm`4|QN1Zrp!=2jcEQXA#L)16{2fiK#@Q!p z1ocf>Zi-CD;SCwYdnt0k9uo|CT>cc1Ek%rA&c7H2B+vbiH;S*HD!%ySZFaJmm=U!!%MXsG29-fcLYv zZr;oifrD+>OgPF8V?dRqQtyAWR;hn)8!UAY6XM$aZ{H8z8XNHL6<(PJT8DD zIeYr&6}*t|@Q3<%WJ8tbM%xEA482IvPO-w@EjeGXZ6&Hi=t7wGoCk5)aKUw*7Q=F> zuCIf`tn_)x1;MYS+}83FJDI>1Dx_Ct&^do$w`rwr>&3EUZCB8>R>P*VqLmLKL9(ox zZmGpYJJHx4H>xTC-vu|?K|w+DE%#=gQ@#!|X%1p1O5$naMHi_hNj@)taEec8SMxm| z@ZS`H1sFuW&V5fIYJ3A88Z)o8hu7vo)HzSKCe_#I5dcyS3%)l4hN1EVBwZ=Tkcws) z7P2SJ6Sg9c?uWC!&ZIwpILm?iCFQhZXN(DlpAJHS-B%5uOqUGDj|aVZV+$bRwzhQL zdVqQUO+g>Ag%yC~79<0-VI-1KJ7VxUOoYn0_~+Gf#X02WaRt%)OGs0K)u`kW8MdBCNC&Dz{VQNmPQDdZh0*BNnX??1j zQ#o$VrDhbf5u){wNJ7>KjpmZ%(7E2I{v+CA*$6936;yD=VRfcq+(x!_1mDMw0_!7v zn)HuY;xazD=LGHF*(skc6~-UQ$1@dnU}8NGJ%0$RKD6LZqX9uEhIO?K|m zl93TZ?ur&5P_Cn|mP@3lSNhmFJ0w~Yp%JI6xar_TwE+azSxYLgvmzjuQ1S%%)S`5J zU@w6a%aroxgM@bpqgC6f8#^+17Y)s&HGFnxm%6-t;Qe~_ZVjxkjSwo^%u3Q0+IQUk?;#j2cLGlfM`J6z0>a zt|j|movkQh7OT!&RpzD?Qaoi9JV}jtedr;hA1K32z0+kk0c`4Euz>2TZck;6>hn#a z270*o%bfc&WK!Xor;#R0R7(P?=z+_(I<_1QKPypQ8KF6H`uHNfL)5cp&#H!GU&kIc zbRx^J2pATXNGv%HjrBkBQMhpZ1BEzkS|LU7&>7Y$QIDleo6u)uR)=`j656x|&&!3; zIf&Hg6y@&&De72rxV^-Y+woh86brm}s!kjeJln@MCIyet#qs-F8g#<@%eMOqwoGhd zhJAjPo$`oBl~8TR1#648LuY4LjfEAZO7_&jWy7RE?OGPY5p5&NiNHrb&Q>v*{x>BCK zV;4AIVZA#`be+;7au~yL#ko2CB2<~&qq;uWyfvKfp{$3KL7VI!NlRBclBpH1oL(7H z&_DU3^beYY*^Od2ac7bu3+x}8!qftai?5C6Oj6(QJ7^tavfm8%H@sS|dhTtKZ#Vuz z_KY5OM%_jI&Cr>AVg~+{rLY`*n4g{ z*?}&>R-*Rj(tkVh`Vu2Pp)zU9U%_l^iAz*b_WIOjZo|S6?Kq`ky&O_B@6v#4zr_fc zM7tW5xq3~RoE79AJC%2os^U{KFvNJFbJfFA*ln$DY>Q;xpeEEjLT{u4*eCtj>F~B@C8Z{3<7Ocal2v<0Iqy7fi_K{Th4@@x97RL(6Y< zP1&_#U6vSU=R2&eLf2(FQKuB#U26_iY}_Fx2A%bbS0xAfefA34K!@$W8xazDioX>0&FsGS`%4q}tuH{iays+D-mu`b$iXsAuJ+CMCCC zC0{#b9C{yg>3mO)=~PH~hIb35;}D-@x97*=k4c|(d{Qi0jEUuzx;n)|cPW*>(>X|t zUS@S>Q#NAS(QzA32OOhnP)OW*3^tyM%OQo|&*-S2F zrpF1SYBuUo-`@({Fzdy;D>M!L^W9ySitVHJtql9~J?aVoA=5@t-{wb62M!52H$N}G zj8#P-%(gP9T2I;0MXmp36T{SB{-}Vj%a`Y}t-Q2`J!j0tR#{?A~T&;C5hWVrca42~@AH~c2 zsoTrkEA>gg^Q%^lxs{bt+{n~z`&CM{BmrIguL4G_CK-6ZwVaZxpSW z9)rx_%R>)C!4o07E8J;WbW63=&C#kgLpj?aRRbrG&aK1ZL`0yKp(SjYM=(%`oH*f# zMHa@3S(X|p<7{L!2X+RM#{}}BtNY{zpS3AMCau>f@TZsJ; zy~D79TAUZ*2=oKiyh-xN^vLUe=UWjE8n>8w&0+Ameq{FI-YayLGIg7$Q*{YnR0h;| ziD1$FtL-$wh4{pg)(Z?ZSzDMnrD6Z4M`$&xwh~}^Hgo5pGG5~r%(s7cjnZdvfGKkiXpQTVZtt%Cl0Hg$v-H|@(tt70vCa|?9qTGC#2 zz1@zGKR|^tCjc-y+*L_ zp$_k=tZf^>zs)G<*lw9Gp68{(6=j}8ceL^McLao_-hw7MSP8g)7+`9!K89Z4aaDhi zuBn!GfsI8vCPD9!0TaLx<>6|(51v<$xukXBq!})jtJfx= ztuHPe#i#HDT3kRIsNSP|O$DcVa}hjo4s3*kX#=2Pu4^;lC$YVr6s%DNDt@DVog0aT6W#)*v8(L>_-*}sj2d_KR z-dNtyupQzF9C(`<*ZgiA^CyXuI{qR`X8|S=9-2pPdoM~@OG}=b-upgUjOYEz2aC`t zT<0vHzNn#JNIu7(VouJ_zv!vq?|vy+^q8Q7JPJkL*_as|986)zHBh?=#}Ts04kJpb zt@>6~H`a&Bo#hN>=(KM4td+czL|GZ&n#}p1IV82|>K3m|_g=(V=6WpD)8=O%7q-M| zg`O1UD||lg1u}n8P`p2NOpwB(JrY$NrPX;UTxC8-)8}%{AdDh3)HV=*xc~cQ4Wemf zK_)V_*hpcqT0VZzl!9WF{gDr4?F;4VQT}j@mOk5Q4Iip0xT&U~K5DD!gYW<;+HmPz zVCct84I@AGCsD;k)(P)SZ9u??Ak&f46cSgx7Gge1<}V;gW?Qu_R z;4FJXGtgdy^ZgN7+0xj7+)K`rhEc`Uq-5x8?*qZt;$1fvkE)WrF9W@alGo9Z-z$F? z<5C|b^t;*=i5JItYTat!wEhjp(K!Hf!*1N*&Hd;XkU&Y{a}R`i2*96=hGxBTU&10+YE*2cl4dlYUQA$43BpB57RBS9N&998Xo&7 zF3S_AcC;AJmSwdO*=X*#0FrrpgPNTvfqN#PzigDp?Z)72ys_W8BqDUGvIy?HkUyIZ z%YyQI*e6j?`J9mGeui<`I$WRc&(_y-j|hGd2GvLHws_vYzNP%p8n36{bkC8_&U@%- z-oPPwRzhc#Ki7HZ6G6ZRnNf+>YXb^?l9OyjWZ3fH+gbsV%lNjeBa{ zE#H&{S12h>NG2Vk@L7ZYo=*!#m*IX+Pj0D7-)O+Vq;wUnS)Hzl3HDz18Ki^r)me59nFZ^o&&2$ z0l_^-C4-FnsX6M8E#OGJ8kj^t>v34R-aQ`@zr&z zFTl*HL1RKoVmCK(M9>_f-B`7$=Vv*E^ z3|k6{F>CO&T6WMsx2gxy4(*~9AGQfns zAw#eFTBx4BhB1>m^VE_k-=y?>CF6|nS1{6%U@qcadwKR(yZbeyThs07Z9T6QR`qK! z!nyMw07K9f=GnyrVrqW}PZhjnRS4S1>(iti(WFz;-v*K5+U2`cSl4l1C)^31nmO}% z3b{4Jw=-THEYQ*b%4?c~@Y1>L7Ao2^Hu}v}8rvV_y^>C-EFWN{ptwW}9=W=d{OW<< zFnNFtZ&#sq%Ib@1`BbIq&NnMCW_|-R*VrjJx@K$qRg#6YrB|`q?!0?u0~mM(S^nM~ z;6X&GN_zyDxV1eWC=OClytxBr75JQf1}qKu2p$420UzVT;9=lX`x|I;@bNhT#sl=Z s2<8a%uiXFtfdB7pK)pRUy3d(y_A;Q$ZW}By6ch@w%75hCGk*U60Hox>nE(I) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md index f3098d8081..68f24c2b64 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -1,6 +1,6 @@ --- title: Windows Autopatch deployment guide -description: This guide explains how to successfully deploy Windows Autopatch in your environment +description: This guide explains how to successfully deploy Windows Autopatch in your environment ms.date: 08/24/2023 ms.prod: windows-client ms.technology: itpro-updates From 8d450ce62b7c997d579917f340854c6583f7b6d0 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 24 Aug 2023 09:15:28 -0700 Subject: [PATCH 088/125] Fixed image...again --- .../windows-autopatch-deployment-journey.png | Bin 58459 -> 58459 bytes .../windows-autopatch-deployment-guide.md | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-deployment-journey.png b/windows/deployment/windows-autopatch/media/windows-autopatch-deployment-journey.png index fd79d4d7f9605d144b62901273db6400b694ae8d..1e898235fa557878cfb7fae1e93e1bbaa71d46bd 100644 GIT binary patch delta 10528 zcmZ8lcRbtc+m1T)*ymJHMYU#Cl~S~3tF>2+h}c?c3$;obUz93}+O=!cj>Mipt7;Xc zV#J8OWA8Nb#yOvN{NB$ef9Cr<_kCU0ecktSPjpdFbWx)X8-Ob|D+)qFLdmfa_6`&_+*pN=+DNhirxGwv9fW4l1>Vm~(__d3`zsu%Jf_uqd)PD*R+ zDz`5!hG)RB7CV>b9#_BK;fboT-^zK!ln!2%6~Ud5@l`e^tlYrb%Dz%22s@J2VqmfpafbmNE@Af81Sy@?xiMsShkF{-ra`x_%oA<0M z$Z=WE%d*c_0n9RgXSQQ)1M78I5mKVy2B6YQ1TAb-GQ2>SH^j&{NFcoAG0c?W|?$BS* z+}JG8O;=M>d;9in2`s?!cn#(&(e~3;M@L6t-f7?*A;l(B<;>%FRefMrs?K%%S#9&~ z2iakhD>jL$RWDM@kQ$Lu+4Z6sIYtQY-NC_d^(~$zNcB!m^ya|OD_T>o;ieS(B=f+4 z-nBlZ(s@P?yQ)TGfr2AZJTY=OPImAp@KDhyr#P;NtxjBlntRoii&?}W>5_8t+y%NC z=pwD5=Qb8^(FS@PzLT)nWK2VWsQpy}q&WiElx&mt(-Uj989W1&;ak*JJbx7V1d z%LHeo5^8Yv%Jn+D$IW{z^2>My>vdq(-1;e5qTctZt6e_T2s2KV>(U8fqc`CmU=e84r+fx*|*_9d;$j85+D>1X>6GFTs#BU|qr z2wRmk5xbTL{P*iv3#zrgaoUtZ`m-P_%YU-Twz0CZ!WGXng(AdE^48cOvY$bBDVG=?=Qv z4Sr={@6J{6v+Q8nPHB17lQSUKBNaaNsr`^VQ%atde!*8Jk<`ca)a0D2zm;!BNwi75 zbh35(y?=hlX+z(#7ke-;{(uT*UDdSJ~+Qk(t%zlb@NAbq|u6+$2PNjX- zmnJPl_truL3xHf`^vlO56yy$9f8D8!iXr|;-Q;O4SM+kxiap0Gv?+}r_T#Lx4$)Q4 zcQ{0vuDrM6BlhIr-fw#o8~7zf!E20(;tK%7(XzVu)fxpu%xwU)6!saAKi-t=mNH=zR9VgZ9lqslzF9 zSyg}hINFk>UhA>_9&IA{%9TXbZ!A3&1-P$@b>^|e;v6EvY44|qw(au$MmUimi#`J6 zNN}>jc>JxBJVpZbDav-&OB*8P`--9 z0Giz_rlWPRNu1x*5dSW_qx=hzQK~2g(iy?edDMOJ1rxf9c_>%=^Y}<}FT-omaPO5zu*T!LsJ>=Xa7l*jC!MctpKkL3flt|O zgB%2eq+V}SE!!O6>$gBICsc*p9($IurBLikVp&-iZ}Es+7S*BLkT}cppuLbntE7in zw5DiTQpvaLVY0&Na@}1j1C?g*rG~PfyQ-I*f(U}p0flfk3c}_d2qq>p(uQlmuQiPJ zKIx3k57yr26e*~k+`K=IIs{y82?r66%O8;N?Ba5*jSz(8t#sK>W&Z>hh%3bC;j{r@ z4AV1e`xP{xp|CtB&+eio@Lowlj=Xf@{AB8lsNk&8C)GJ8=}YEU;ziXLH~*rZoS2YTQYx2ckK}itE_+Qrl%E3dRDp{d{^iSzis_iZ zl?Q_BmBR=qd}&JGB|6z*Tj3J7S^cy6A}IA_$hynQ6*n3lwM}B5RGTg#JJfPEb$P@T zZSzGm`)=o6xb%pFHJot5+q#KU&9p@%-Scmcmrn`Re?Qz*Xm+;wA)}YjX9hJ6*STwD zn>8F-VrwJt${Ub*IyqS`vdAV8Hw3>db{Hq&zPt7!!Em+Qj~&wN@pC(~uK%Z|S>a{jfv&K(w}vtULTT^!KfGm?-gnhzzzrzK$)P&jyw{It^_Nb^Ddz}| z@LWq<9{DImB&h#Ju_~mDg`9029oCCjUTN{iB#NI+vh*u2$-DPG?e)27T-bHx(EvXRVLVLe2uuIp{HOSt?Y4+n%Q7y~$ixiD6Wacbc z%8UQL*8sH*678t8@AcgnyPJ@zGJDxEhz-tyls3pos8-XPT;;+ep53Gv&{2>~7BR5* zSrCn-rS?W`HJX>tzvD)D%lt|9Uh^}COVrJ?06E4#Ec+yUotHEFsW5lpTOY}*Gy0gh zv?}G-Q`i)rAwlcdd;V|oiOQyA>Z4gsuREFi4m*oSw+93{2I2|W8%FOTeT?WXQnJ}q z&6X>HZ|)dE`5w`7Zrb^z*IGQcQo95xCr8=|FyT3noHK^lBwACv=h7dw#Fk4U)qc^; zKsitKi=|ISEJG9ef52Vd)Jjlf-55EYC3jTPaHwX&b?eX_T>M}}_m1op~h^)5g zV4=F(CKcblFnvL+3hGkVRzLKZR}Xq%T*I_o0xm5mDEKiLHYYL(f^&#{7PzO^t=4c?W1l}((>L#P4nN7m`%g#Yw2EDY$4C)r}!DUqI zteg~`?;WRI+KP+uKPU7n3FDC78av9un&g|XoQ5ix(13}hAkO}R=G4C4|NO0SqT`i1QdE|NYrppUpZuBll zb^5BYeOSmrXIMYi!dCZtpWW@(+u&s^q1AKo6m_#7WZo*!u0&`mgi>=egF9Dca+?f# z34tDvMB9nGp-j&H`SX!r$W@ypqHW}+*9jyxD%wGe12&J$U6hH;xA3i>7Dh$wqt}G5 z2iz2tn2a^{Ms`tkwNA6f=L2~O$r;8&mOHwXR{qied_HY$E%l{4ynx<}on%Dc&o$~N zvTWsahDe8wh=kFOHHr*a1(?E@P87|vHXb~tzP)0jlFfc<3KyBEiK|6BQaAg1>u@xP zEw|tmsBh=vl_N(|V(v6;3L$LS?UqvYfstm8%w=dN`(>vf%dHXsb@7gw^vem-&=zmO z8UAN{6GkpqkO88jx4|eHD*9cM*Tbh{RPHz)rJmOOs4pF}E!dr!c5!rAu+TA$0oT-8 zJt_1WT8X*6E>p()z!fQuQgjingsWNg4#7J&eG)8pggwOsQhH;CIO5f`ZOy>lAl`t( zoZQi@BeU^Hi5I}6t}hA|K z+nJA`IW6Ri5`Iv6$|p8sI%+fl&I8t?%>7ZfoPrtvLWAW3rLVu|IZBnf2-NSk=(hf4 zS&@%dV(OI>JkZD$#5aPq|8T)rJ%DHV3=SF)f#dn! z6s#5~kZxN&ihU;gG`5Lo`$+BOy|#i5PG3E}%+n>V$JEVky)h_Y8@`LWGKKDUIGa5U z2M&r_l!%$6*!TKf>-B7lK1Hb4+l}kxGQX_dG!kSrn2~fCfyMZm3D+OVg*tjk+T~Pqw^sy-{wVE=j5W-MR-yq9yOC zWVR+ahaI&1zm}un(!1}zJqW*7&>>$LR~g;}rM`_>IRHnQSs<5~x(_eO8k;|&r@YEK zw~&rWKW#$hBmbg(wN$h5@Ie`69+{T+MLEtt<|5c)Mb|102w&ArQk*8Sa6;RbLlV#!>Mv@2N!EF{`^V&G*upS?m=?el;%C<5eh?FsU5b zMAtp~IeoF1xal_;%n=|{N%I+KzEFlzUGw2Uy#6WG_AFqO>}ZVHO!actGc_PHfz#!) z#VG#c;w`;cnVRYn^ef*{rtqkz$_@@4aq}HBRKCOJYyN?)qoS*5BT`bMDUZ+mo#-g- z=O^4Lr^!OboYbx?AEw%O<=hi2=ly;bUsR>l$@kjkyI~8wjhoSm&K(Bg)D(n^$={RK zTlwJimYUMCV?%!=Apn2aL!Q>rPhgcdbTOhT=jx^-jw^1)@ftcx`}x$_!&ySUH6W~u znyKn}#t(n};U!Obu{0EE(bl6-vDT+<;{JgbU-gbXhTL8S=9~1ZudROIk5Sx|a)>Fz zj1G_W#lxnY6_Z{)2aM#roOX&>UgIpMNSwB#SrG%(u^*M5ZFaVsqaM#OqS5}|8@~!I z?ZOuhT>kcRm@25|H~$+qWk>BQ{z1r^%2zPSp1O69G||3ex{HIw(VA*B0EyeR+ZH!Z z*jMbRZ(sUFw1$w3w?eF%=DrNHE^$%XKDN->$E{GA*b^@Vz|bdk!lR%<%|X|ptt5x; z!^*OW4fN+gyIUJto%3cX9e%fKksURELEP2(`XVptZQ>vYlzwNWq&t>cS+UE^#vt79 zcJ^b-JV0Gw=)tSF56#L`DqE4|Wu*qTnP`YuxdoZ6TjT3dl$!}zm({p&rKmTil5KJa z&SWNd@8b+m&qtYL{E5fzXV3JB`6WJaJ7!X3w&hju%R5mr1&s~f00PUif+nPqF z7?$Y&@o9U;?KNzvu&}VhOLIrAFy%i))#o-i1&nqBwU0mDU=UZ_p2@S`793El{nX5e zCMo7u;m5@n+htL(K9IT3CW;q2w7|r~1-2c$Aics z;}2A&32~~Yr#`x8jPaM>rmWYvFv<9fJ@*pV3V&Qvdb#e zHOq#jafO`-)8$qa9 z2AYjpuVo0q&}yRz=2=3jQBrN)t1n&xwJCRvbd2!K@?|h1TT#nVxtr1uI{s?0C&_Sr zPYm=qcnGx4E_h5Ya(S;H?CVN<-X1J#ix94{{NZ~wWd{^tZ|RArM{X#|jPtyAF_`N~ z_&iEy&sNdmsULh8qV?6Bo)CoD=|oj2P8SC#`L9^&X zGp0mi*7cIXJAa>QFsgqGP0Vc)fUT(c6a=TvE09dd(M>rVY@&=3l$V*u!2-f6BX2T! z-8Kjw5KzC|5MmRwu1`m#tWdTfNn3S5(!lG}DpbIdykedy9C3!$3wX-z|JV(iN~?BB zWE3za%3qN(rUiI~8~^GqDRv$a#Wh8L#U7lNK&;QA zxf?L!PkQYa8grBX#Dz39`YlHp*FyZ3pO6YLJep&b$)Rsx2Eb>ond#|iaH)x|&Vs+Z zzyi&A-cCW*58%^&EkKh8sLE&#k zfpim*;LroYWy%_n)0MK~#0x88tHP%89F!MNtj~5+`hJ^%&HA~XV#9(TL7)8obbF1P zn)@V?3T2_2315fV)xK`5)(9=sO@LQoS99lR#$VN91 z4j+dzLjn5)EEBKn2Rjy;xAk;H7Eji#%Qo4WR3ioQyrM;HGr^}-kypz$kCUty!`oy0 za4s$@4HsVTuMF-j4*;Zt(UF{63LzI52Z}6PXJ>y1*SvI8Vb`C2MJ~%W1zd=~fXPW$ z(!E^wH!9H^C#@ zbVq|KxvSNtb--|>pj2JXi9C6S0i9;Ae6=yZI3G5cv~M0Hh`Wk&x#MGr*=ef5VEtLp zuVYT{5G9uaIUol3MT?OWJz|TCBk&Rr<+lpb&$vH0GBPqgUM#~ttx5&Fb@2A{i{)Yc z*^@)Z$=ic#@G3kQm5pe4;C@|`hhD;ymEOa3kohR#hCM2=Az(+xVlMN7PQ09KBmem4 zqo%Evsu=ZI#ATaT-Rv=*zN!&95mj^T-zX{4t z?Vqlrv>R$N75oh&%Xd$fv%Map3~sh<$5R}t;`xP|s`TpQm3h0+&5e~6bggoO=j6=9 zWa2xrA)0(F6Nm?lA&Gpq5Qc$DuTRl?Cyx)k!6t;ALuCArF}(axquuxy80&pUv=yhX z_fjchR0-<}d;%I9s%K-Fc7d*)R&EGhv?^mOozo66Jl7w7MX;OG=0HE=3V%I++^p_1 zKLLRUhqSMBG(DZ%O_D|~k6$5cY@b4R4k6SPIdly=SP;e3?w ztap|X81~LnZ#22ap*x&>0FX<*kJ+0N9}=U6QN9t;fF~j&#lt8l0#KoPOAV)1D9Fp> zmwFz5LpZo_(sN+-S0PeNKj43`zii_$>&-rsRjQZ?krTISxw(3r&Agmy+vK5@0g)_S z#W|Ef*PfJHYJuHqm%keZJ%{qrqgyU~<02A_L(aKpi<~=MHrEukaiVL6=RRM*>+0*7Z7@Z@gfBVeF$VU z)@W;=q&ZXeexu4^z-(fJ=D*`S=OQ>Ux2RlgWRoh{8Y|Xxh^cXIL=3o%i`tj0m#iYT zMw6@w@E`&Jn4)1iZE6;3ztVf?|5H<>U3#Z4iSbI05y1;-Zb%fV>iH!l} z15e=^cnzvr{XdDy1?)4XdaXu5;eXLfaF21#fC0zT_Q^6DGoO9+Ygv`en+?{`iB*87 z+iUXS95+3qC+lJM`g|p*v_t)@XCbsB=z@i3QSP#H>}z5jb!+H&OV7hG$RGEQ1P`hZ zbcpxjuaj4C$AQWgFR8_w%E`|$w{y#}qqPQz7b+B=J6Doxz~TF$ChK8b-e{HY()12z zDh7iYQ48pN$1VHeN$7>glcA(#;M5WGOe58cpxJL|p!0wvx&x;&aWEnzyRvi8||A~ETw>7yioMmUC?x4P!!zhWD^Yzn-mD+jAg8xagNAL}EiXiPJ4Nk4E(+DZB+ho6AcBcP($2D<@yj$O=u8B0e zjZ@>i<3BwOiby}kfaIG#uSLJ%usM*pg#?xEtSxy+-#z3|DqY>RbZ+)#L6eNd0Qmdg zWmD9@-{7VHmp0*iMXm5*v(J!9=hObwUz_Wjo3%3E(=P#&4=-I7=lEz)`s+LUZJs)h zB)fgqBS$YyzVqsvJGyY&AVs#64K2=+9J2PBu4>;kVRzn|~)ZFMB?bpsbB{jW-=97PA0BD5&$hwE{Kio5G*ICkdp6xq|aTv&| zsr}M>Zg$O38#Uzz;H2q9Ks}o|1;!$V5IS|yTP?ym;WQ+hb3m-JIiQ64f35CV%g^s< zfcJOZ?+tpSgOEdHfufWb4nZIgMsRTMPNtUViwr-Iy~{<1T(@u^D^69}oW4rhyM7rm zV4JVrvAc5K7by66($QRD-eB5Jr!=$Op-BIPJ<62j1cXTyS9)kcH$yI<@JH+4D1Bre zd7om~ zs)elaYLQ|7C8Srv>V4ur8hje0Y4LAg`(2io_ncx#{?ND@sUv6AdppIc*yE})%6KVR zcsw5mL7X@9S2=A@to;(3_;7)HqV4tvW~Npr8W?$EiWfmCcQ0vexThQ2^UzyXV+$_I(7QbBL#QxWi{3jI*HKd z*DQ;~B%O65&ng6B{*$UJ>T5-bLzMBzOL*z_K%kWia?^;y8jBr!=!Ml22L3?IRGsxX z3ezGKCwdL z_iKq@snQA?!{~c!?|)|gs&d#EuPQ7p?L8HG?s3juVcTTm>low7MD^^E5|jWTV%ctF zEaWqe&u;8Li$Egt9`?;emgLJRKtcFdzXFG;^plx4^HKRM;sb$!pPIt#8-FBy7v5O0x?pG9Q1oBs@1alc1d!Nun$DEExxTr7Nn_Jt40iQ-A$Zh zs<@qn8o2vkpX*#@+ogMjg-^l(tvIS^^f`RXGn%3b_>p-RuC`Uu=Q zEWjnG3Mp;5RQyfS#d(KTq

      1hTnBF9AA!x`l-;p`xsgxPG99>CploAtF`uwHwuH z@X6v@-|>u<_H0PYryBf96M)Lx3EU(7`sZ7T^KXHKlCb!nxjtr8%xoswmWj}&^jK(~ zqIStyhP1i8xnT-P#icbqv18qSB=RlhpYLSOzZ;2pyrn^6SV%5pH(BR-Ww5WZvLDhT z#cN%u1~(!F%i28-p#jhC63mFYqJbta?AgIyJ5nIf)0=Ie8HZTcv1^2Ie>Mb+7GPdd z7Z1&9c)3?-{n{z|@G8+{xdo-9B|gRe!<^sC8ore%O~Lg_>;*)%o$P}|nMsN_*5%^hJf`SW>AwKWJNAwaoKBCLvfeIU%&dq!Vry_#J^i6WgY zEwu^Qpc;}?kTP5>n!Svg@Lepu=0Zg|>mmigE8jNTf-`o3#4cQ*yvKdR)X=Sq$$Cxs z?kQ$_Ek~rc$*%Fxcs3@uQ!9n$>*sg$3TOM2`0;CooFt7}GFzG=r=tbp?sj`Us4m<4 z?K6=pn%pFZ$?u0E+U=RXbQwvCDjGIy5#~oOP;MmUfT)8ad}Vo!{Dx>>_B@UnLEwWq zM)RLg_8(7Dlc2_mbK-*p%&9Jgx?C*8M7mYd!eq;})v05Ewj8tJx75?;pwwa~Momc= zbRPX$!hqaz*?38#J>KX`aPtbOI$qGHspWWr%_a4loafTy@Ent~w2HP&Sa00~RyLp$ z_9!W>!+rn+x~_Jf%&5;Y#H+`M9w^CR>7-XJ`EDuC#vNnq9&mzvV)eJ!qQ%sXD4kjs zMF%e+`0XAJLwc9t+r^#yfiV;{y!w+;WjcOK^V%akwS!liZ+(O~jm~_SH%8m3woe<@A}%UHjrs$%7tG3`w;AW+)}3iSZUK)64H*y69n z+Fy#^VoJWs{R74L`+0KpVtuwBW*0mV{2VC-aj$JrEL7Mxb*nGCVTOQ^{VfQl!sE!TX^wruwXn z%U1+UNAaV}#+saZ5ymtxkypzkfhieIVD3l56_lou-|8=(@aYOvlgT-DqG$F2nwE~M zQX*l}!ILZ65nzfdBxe0cChe5taq825;>EtvtUy zxQ9SVy%2}PdQ~li%i@*ASRq@Ei4BLV_DL(6OCcpQxz5Dme%}T75eAV_nn?wE*h~Qw zq^x6BlsKj<-s+4mkk^TOdppUzMKq2jlak8YPata0TeXr^m#s{k=Sn7}V7c;9)24#` z6tlDkFL)hd5WjzPrj$_%6LjTT!pXcw{KBLE^Lua=1dxejYG*_MqlcW^56a&_nyPwF J%2jMa{tJ>NN%Q~! delta 10531 zcmZ8_cRbts_kVD4+fw(cJv-3aT2-rPtBRU6YX!BX#10AGT2)n4ZAvMnN)Rjdh-z!Z z9#KN5y|)-4`Nh58@9*>dejktgnfG~}^Bm`#*9+f4hwq>(GpYk7ox)%nnU;aAxu=v+ zB7w1yT*%nuHgB+T=fdUJl%wr8YvKd3bm3pV((3B!^7&z~tMDUp|A`lzs*CA;lhqy> zV+;D9N`vU!#h|X-GX>Q}@iaKAPm?Iux8e$Jo!XI^-fzg_a{lo)STo}Tg@dBH8R74d zu17P<91tu)JsjYj#`UKVfj!-(|Ro8G&;~ZU# z&y%84fF_T=@@6|60<1p-wFm~)NX#w=#T$l^q`LEo7DA+=M~ zLGaw+rJg%5+Bs%4I|G-~lSN*;p>`$$y(vPwCnN<$M)v)&QxuhVziH21P~LxOEb^zy z@r_c8Q}dPzarHrDJ7cC#7*1Q36#}0}%e8s(qxg|?SLUUeWV$r&Uyhobta2Ob=;-M0 zH{1vGP#0`Zd-QvUx@HKQmWc~p{uz*sqoV?YhNTD;Viaea3irpt>*9jRnVJBed#W@> z7Gs9WR6+F{aEQ5vT^A9_+OBfphfPOh*%W8%2Y2Qcs2!zSRX@LJ1rF-qbr+`|nrl(1 zi!&4Y@xx$(y|=$mRq1GHsqOQ@yGikJ;IRMEfs5N+x?<*)No+-zq*{~H{=$eigF=Oc zjTq|?DS0zQW2GZw386;Hs_Gxs8h(rC%%XYcSIr!mRQWhcP{;eltMOtVxMj06 z6PoDU5Cs@9mzizNSvK^1cF0y;zuK@=+n2dam|FdCv*ycQVC(#pRxMI-=jR#_jE`Is zdnPiuDX9|<9(|ApovIBoL4D5(+8(iwV%q7byN-q6Q>BuLsRW{$rCRzQbj81H+!;U3 zp|8&}d9|r3F&0|wrrqiXjt)Dgd_XD!z?ZeqP`9xdv73kLz8O)97`Zf?m z`>@-wBw&n1YKT#F^Q5i!NWO3M*!B>|IjqK1%Fo8j?G}cP=+L~0bky*8*l+b|*6f@W zhvXrVw$R~1laja1brw+<`!I3QQ*s?cWm81+;EEUB1RjqKNBIaD&^-_NQj6AtCO!}Q z0YJv^@Dl4bx1L}A@{>EcqkDJeG>W*0r-Wx|6xR^8Px?-KcEPR-Eq)VTZOjX% zb?@be&A9B6G$#4g;;S#oU19P{TCh=u0_!PgkH(E6hNpDAbk?`2j>GAt~FV|`IhrDEd=bJFoeAm|fG;QDHYIzd8X*-MgVAa$t9+o_KZHL2E*;#ay zCVKINybg08^_+KRF6+2Bn5&aN)>sO{Z%2lzrmArBOeY~E_|kGUTk)}?>1k=euhne> zrETHpyU|Y(Do0Tyo50@@&K$aqoe9DVrpil6jWlwSR0~{Xl3`GYmccamZ!I%Y)>^Y; zRqu*%575cVk3jr>oVr)x;@O)n?}hG*?PwOQf28-!DWIPM%WRX*S(q!$a4gOIb)c-I z6w-f1(sKIa4bip{^a77gxk|rISDI zg{>PkJgM8%MmZZJbjxPrNBsM0NiCuq^{YVXX*Myqk0T)NqRNsUr)_X~Iw$hKRP`S` zzB|5-3nB6qlX(yL?IhKvljuB~SDodMmY&(k>_^u|EZb!F@0!)ph?t@G+@v!?gM0C5FI9Gm4y3<(LO|*Q}65^@aTlr+nQo+A$#}SOUpReK-$u&(N5Vp6yC(8}_f_UuE z;P#M(?pDFlM(B|ALvxAc8iTfqW-b1B*UlQx5!P0o67$|H7n`c8qf`85<5H2p=_u~+ zkh$H(uOG>q%4UU|?tyMM2SHYNk$EC4<9SADER!bS3Xn7%Yox|Nt47Pni0u1=He!~< z@ZSd60r5m+^h9*|(T29w5YO};Lbp7lIDR@bxS#C;heY7K>_Q;9?C0?s1f@cm9kprr zDqD<75P?4RSxnf9iiaPVV5j&KeCwJl#G_Z8JCzfKq0Q<_hUd22`x15lKd@Rt~Ng;CQN_3z)?4E_Isow z?xRn$jr&Nyg$9q^{ST(Q3!O;rx)-~u{vUwSj6o1y{HLh&E0Il8?wtK9DaDP>e$WNc zgR~jX2Rr`DjtkwPq`xVvfAk4gf1;37C?XNRGe&ieX8KO2PaK+OaZJh9i^f3BAvxRg z6n6xJ&-b{uK8coAo`uVD2C%v9Fzn0V*lQz7xa~-X%%}1?^%jx3H^KWdm^(gu5Wr26 zPg>gUYO?TK$M^BEI(0E-d=2j=JhiNY;ArQtp|!|~;U5f7os&7m6pV0_4X)cx+A&m?l6Ni4_4BNi~tzs;KM5HRiJSK5?SIV`n6{-l|^=Y2Q^_ z4En(##1Pm<;om*4w#zcAc1tx!UqPRF)$uka8~#Ji1vsonO0VYW0L=nagtQNUGBV>v zo9u$Ml4kD=cGDtDM=DDgk5vD{h5Ep47f+Hz-%bd=dBR|mSMl&A)2)fll{+4FKO19& zO06mEomxE2(w4HA{33DYvgX)r!lJ&{IaB)3hdYZ3dH$r-yw)udVbdGa*A9H*{RoJL59-i zMjFw!ooZ=}zU2!$Syj2Bt)xV~A_-5jPbEV2t)=IsW{EK>c)YkczG__RXcqd? zn94Pj({hu;L49ZGVPY*u0@g`$`GWT6e3_CW$1oNZlHmZP4^i@5gG+Wpq+!&&>2!eu zSb>Zxe%E-3uT4S3e~Q56YB{OAA>`XAm(}{5nhRYU@bH^w){aT6?SJ+DJ@~nV#u;!& zqtS%2*4k4Jai*>A)veu&Bz}ET$nz+Vbm6_gy7msFbcH137j;n{)?NrRzSw`h=oQT` zV$(aZ>t{EpQNL0r)KT79#FUK%u{Tf0@5y_*JFQ*4tTVJQeKV8dl>m zw!P01YCvZH%!@nfR=FC(wwvA})h~;ED5y=!lDz8i5F-GHDV8VUIpZb2 zC$DNPOx?95-&qXRNWO_#2vH6{))h7Q#U6lqBoME#`2J^ApynMTqL(}*ET6Nf+5Jg0 za-{Lf7;K?K!j?OEGT?asO?oEd&PJ1~Ny@#y`;dbkUzJ1sesiG{Jh3dsSFKIR&J^qzQ zM6?u1Op#5q>Ni8%`2%xYu2~s&iDQl}^T4oyc19ICi7&9zxJM(aS&EAbuh{pe4AFJF zV^r&vJu)|z%1EzcP|$np>N+G^Qefn!Ph77kajeIbt3vF-o(t5?#2?l@8x{%LSyUVTNA74)$zdvaFb=t_i{uQ|-B`rxuwCjKCz zi#H4(@1dp#$kZ59*XL-eKuO2Phxt>)vzohZW2jf;P35VU$t34bb5@@cnai|vHvyY{ z_ln>C`kTBEi&=K@U@|w8LhsM^0sVr-{Oc9Mr?G|%t@5EMkR<@-a#}}4~ z^T$DKIHt;fRdb9!u&(2ey1fea*Uev{_SGgJ_(Pejlfyi}7>9l){v>^>X78O=p6}Mx zD?vbg1cBYg!u<0$C3}?RS)mE>uQoaH#pDc;uYLnhQu&?4YiAF5svf(_w0dj&Nq2YG z@}RCUdViOe6!9mFf+g=|>DjflDf3l3!TfE0sPO#;&DrvY!B7pH-R!IkT=ThIT)^}Q z(%e8_zjv;>|Bg~8NL_w+kd8(5nBI10!r?*}7KEQtS0a5pHBt@UJ;pJWnJ$u#1Ktxl_0N*Jh|UkLkI~l(;SOP`0CUeV4WE1M9#IIJ?Br zTXzm}{S-_Zx+)q{gYfyYFkV0N7>LZ6x5n3K=CW6>R7<;iq46xdiQMYa1uUifNv9KQ z>~W;iZW#|KfX5F(n9lU0|FFFh@r+Pq$Q2UkM;&`jr++Q;4W@CR z_{GbMsgoind9q!k0SNb&d~6+5v8R+%d=)3ZA=(c%)DG0i;V+XX*Rs!cUE(u;RsRe0 zneP>i)IIovsJr|HPf`SR4(4LNdyHj#sVFL8s70ZmLtpfiTpqAvsMTyO$O|Zv>I8S! zo?Yl#Jzo}bzUuuv$CB1ET`uRxDfI7_F=GJa!01R7u!l zs-CFtTwK#hFr(T7#<~_(Y1ATE&K$b&-d)K;&a?-vfv9;>TMxF~U%|G-U#pSNaIK56 zHV1}T?^}79A8Z82cM(@MGQUn$)m%Ggg-h_-k}UE&d$VY8A1R88!T~gFZ|UfmKDIig z+5~h|PR$*)NevW$y?Y`F#AS_Wj&wzIkz*&XVg5)u!=r@j2OLXiE1Wwas*B?+u}CgE ze@IRH-E&t7*N zYfG+3w?#h22GJGO%gEe_ej}Kq@zEjdTK28!WMrW)^fb2Etb*npU!9g9O#YZs13M@; z9SIU>XJ@o|1t1W3!aJ>UiT=wkr_Vch{o=Mc7gEnA$ztX%8d0qkP0z>mW5Z5a;Y#%mmb48<{Y`!4KqPbasFTZtU3Y;pCP#oi@?X?oCD+4%-;$|oK>0U~uh>cAHIUvpZy~HwnZ+F|5h!ZiKmr_2U$(7ucMt0*X|ukXaY1SK}R849yaL>C=S#J^eH*bT(mAAujxJ-$*wwTM3aA|N8?;l9p=lu^hHCJ6j&sjGoty zn`M}KO{+WceUlWoYhTCOkm^3P-p*P0ZTW6N5#g`d%u-26Ujhqdl|nWJV#~2*#1}-) zLfds#-q~XX>EB;Kmng4jnHY%-fx4QSn$ACk)b(i%>SnWs3Jk2QviANz_BSxS-O9TzNPt|Er$UitwrXUMFTbokUBKRlqs|GU7+d!dIAg0VboSLnH!9yk-0Vgs+qWH@i+T6@NLgqcLk^uoOIB zcI&0`AoD{~4ewob9tm#8M&Ik(x;HRhcF?fv>jX3cZ1xZm6WT?sVigG~DcS!M$}j)^ z%BwT5a8JJC&B&rdUmpFC5cP!QYBc@yuCQm{XW;WzjOB9H__c6N&HoI;@p_Q8?by z`0+74HT|Ya>aZHOjMK`RWnf)Avsf9$Iy;B>zB!)udG=pKKvxn|o*7yIV!6U*r%)!3 zL6ZCTBI_(JQ~@hXad+=J1x@<4R8$WsCoI;!_^!ytH6ya7Hrnn)V-_8ElH7SNnufl1 z#!#bgMBs=BWeh!68It^>4E3kihR%u$iS?Mv_E2I7y?q*5JI4SHu%WcWEgsq+Q68U< zyI)cJ+?kSo?X7X=!&<(gHBm0>-A%Kyw-5+KN$ei*?r%lU%Ta&Qzpgz;>f0ZH|9F3E zaXc|IKR3G|KxyzI*Z}?30JC>%V+OqHAgl8deD(EMhGq_dKZv?&*dD z({r7PI1c#ZnK)jpmk+4z_8VE9${nplL>aotbboMpe`v&SopmYU3#(hgPTL73O?q%(s@9*rv9ieO&Z{)+Hm^A>zsKebO_2p}j4K{CX7b{&tvfKHe^IlBug;7pC z@rxe4w87guKL}8`X-$&W1=DK|!M`gfEl2$1iZ>B;nGTuQpF1`Qp*1&iazJe_nrO1F z$3B67#tAj0MHqJ#jjDQhBs0c#P-oi1Mq4}2(t6X32dtduWxOxZoi78F(BkRnkQA}( zoytm(PM=?vtE9Vx4~N}y`mJA~QXkCB)|rgLCNpW?%{K_0dOAE%|Hr#0_u!waG)oNN z;@HhlVotW|Gmkj=f6urJwtHk6)1YD$h_7I*S{AyW1G*%?ji3n#&>7)nl*X*sn^@AA z&5rc^c7L`e4FsDF%{L4Ot_#?a3N49TM-~l?hm0+d|IlWjg-E(sh<=Q69NGIQTQE5~ zIqBgMBQH#@eIaxMEG6^VtRPnMsgmb!vCgII8v_do5C3uBCjHY~DX5vaovnZb{m2ok z^K!nsE_EUXu#`>8X7t_04@K@#i31u#UiDeeC-nEjr3gWu>w z9!@e*O|FvXxpb;%nW8`)}y(4#SS%Rb#+Ha&#%LKSHok1s(VD7@nh z=4IhXvr6rIvMz5@b<<%#T5Rx@Q`fJT`Jcspy3KaVoXrI)J~OQ6W%z#aPRj$-X*QqF zzALgg((5^R-o?o2cT&X!Jw3Q(b2N%NM}At-JFiPpO!nTpw-m-f%kd~7>t+?MpvPaP z1VoeUk6${bQIq?h2^LJPADwm=GrBv=xua#dulAhSR)lUW%M0vBpT$$AUsx!zYM1Cu ze9PM*Y5*W+6kSN@ij~pUlk?m%3j-136^^z4CuB+Dbp!n@nUcK?PBdAuqA;yo9Puq? zl)U=}ouc~9I~+P2PkSk3@=2@105PLRq{%M>972iT>f-!4Uz%dy$R+xZ26I4(wg1kw zLkmsKc4|Y~t+)z6TsB7Dy3QEOBDY;Eup&%W|oaJNzl{LW*i9hKFcR3%Oz#E_~XDBopQ#%pYHFiM$y|I84q<$9_p8#y zz}!4_U+?Gi8GHIK>inrh)KX1VVrr{BeyOjsxSU=Gt9Is?>h{&k@3u0wb7~8MvrbR$!7gC^(#2!V9}(oK3gI4`^<-g_1dGIuzej!~$w?_l z9ouppzB|EMQhv6HUL^H>wfd>LS6el)cb#GbX-P=>#*;3mv?>6RVf`UXVo5N1Mik^# zPOudY)O?We83fQxL7-5mo12@f>wDF^(2Wx-%_-;8-;G(isda;aPL965l}|<$+b&h# z5s0tg>_%$YSbr8~vkqcx)hb#(vEr2a8u`FdK6pC z&W!lyv*%}@mGDOr;*U8yBn>2samrh{OA-Cc^vN!&&5p6eFUNGyj@N%&DEc;!M-wy5 zPKvv`B#IVhTtJ{thG8@SrcYq3Ol6#9SL~R;#Md1M{!_(we!-ySaFAzRj#$zgVjGeK zu9r-sinEzW5QW?Zfn)^exj-knT_y0Vep45z8zsp>W&FidFr})vQD{AC@wnO+?KUDU zXYrW^1Udr~u_zUyWXPx=OJG{-ycj&wUAOo0yv6QtdyOlwE^lon*d5n9gR`Y(lmns* zqZ}2}WxGSNx1R0^Ec7Snh2Wu&@9zz62>Um{QK1f!ASy@9)C^*#GcE>CKZPi;mel67 zySuf3Kz3Tx?}N{zlN?h$l^bhG(vvPUHdpPlty%9fSHaPO z01)UR6+)RelP~BL=SAburvcMmdAH6@u}FLj(4Le+FNAE8m?g)ADuu*(h=ZXtAk4k9 zGg1sxS4}n_CH%1~j%whmFSBgo)xPSGu;}Azv3Rsvtzj+!^M`AHtUP{=<#`!j;AjTV z^O?f8m(WwQKUSw<09{)5RQ2)Pg~0$q!%8_V2Z*H1)?e7rdkk8X&m| z>#PKXY}bh6ZbkW1;V%5aJM8`{<@xzkXblp&_ipN?m|QeAiw1NLh&ijKbhQ_?kW|2C zqA2)|{jEuCLx7k9U*W{w4l=6os%2MQ{j51_%-v*geNSog?_}vbHr!VWqd3hIKB~*M z{-U}pZKJzAwOIN2XSqOA8Ps5D>y`FGyUw?-n+nFqOMbj=FK1D$KyKDfj1*$!0oxGl zih7*I^;fddMF5Ns9tq>80fk+mau3SY&s01J*-aA3G`FAPm5@_Nv*kW)mvF;+t8K#P zky&)@mM*0e&qEOUK}+T1UKZ+A$EC;qE3;NFqjOnMW@FThulbwap=NcPn$rbl;oc#Nds=0_BTM4z{q8GwjSxuzLyh{evz>=OMIp1F5V?w&!D_DnR;m8>&lE zsVsz%wKG(Rt(sQ6alcris}qa`I*{*GpJy`%JnAY+!c$8(K% Date: Thu, 24 Aug 2023 09:20:36 -0700 Subject: [PATCH 089/125] test suffix --- windows/deployment/update/deployment-service-feature-updates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/deployment-service-feature-updates.md b/windows/deployment/update/deployment-service-feature-updates.md index c5cab745c1..f3b7b2340d 100644 --- a/windows/deployment/update/deployment-service-feature-updates.md +++ b/windows/deployment/update/deployment-service-feature-updates.md @@ -1,6 +1,6 @@ --- title: Deploy feature updates -titlesuffix: Windows Update for Business deployment service +titlesuffix: "" description: Use Windows Update for Business deployment service to deploy feature updates to devices in your organization. ms.prod: windows-client ms.technology: itpro-updates From 7285caf2772d5687e2d75ae2b29da86ec5537f1b Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 24 Aug 2023 09:39:22 -0700 Subject: [PATCH 090/125] Final tweak --- .../windows-autopatch-deployment-guide.md | 25 +++++++++++-------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md index f3098d8081..69cab728bf 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -109,7 +109,7 @@ If you're an existing Windows Update for Business (WufB) or Configuration Manage ### Why migrate from Windows Update for Business or Configuration Manager to Windows Autopatch? -Customers who are using Windows Update for Business (WufB) or Configuration Manager are ideally placed to quickly adopt Windows Autopatch and take advantage of the key benefits that Windows Autopatch provides. +Customers who are using Windows Update for Business (WufB) or Configuration Manager can quickly adopt Windows Autopatch and take advantage of the key benefits that Windows Autopatch provides. When moving from Windows Update for Business (WufB) or Configuration Manager to Windows Autopatch, you can enhance and optimize the update experience that you're already familiar with. @@ -149,8 +149,8 @@ When moving from Windows Update for Business (WufB) to Windows Autopatch, you ca | Step | Assessment step | Recommendation | | ----- | ----- | ----- | | **1** | "User based" vs. "device based" targeting | Windows Autopatch doesn't support "user based" targeting. If your Windows Update deployment is "user based", you must plan to move to a device-based targeting model by adding and registering devices into Windows Autopatch. Use the [Consider your Autopatch groups guidance](#step-one-prepare) | -| **2** | Microsoft Edge channels | Windows Autopatch deploys Microsoft Edge Stable channel to devices in all deployment rings except for the Test deployment ring. The Test deployment ring is configured for the Microsoft Edge Beta channel. If you're currently using different channels, you should prepare your teams to understand that your Windows Autopatch devices will start using these channels. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare). | -| **3** | Microsoft 365 Apps for enterprise | Windows Autopatch deploys the Monthly Enterprise Channel to all Microsoft 365 Apps for enterprise clients. If your organization is utilizing a different channel and you don't wish to adopt the Monthly Enterprise Channel, you can opt out of updates for Microsoft 365 Apps for enterprise. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare) | +| **2** | Microsoft Edge channels | Windows Autopatch deploys Microsoft Edge Stable channel to devices in all deployment rings except for the Test deployment ring. The Test deployment ring is configured for the Microsoft Edge Beta channel. If you're currently using different channels, your teams should understand that your Windows Autopatch devices use these channels. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare). | +| **3** | Microsoft 365 Apps for enterprise | Windows Autopatch deploys the Monthly Enterprise Channel to all Microsoft 365 Apps for enterprise clients. If your organization is using a different channel and you don't wish to adopt the Monthly Enterprise Channel, you can opt out Microsoft 365 Apps for enterprise updates. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare) | | **4** | Prepare your policies | You should consider any existing policy configurations in your Windows Update for Business (WUfB), Intune or on-premises environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | | **5** | Network optimization technologies | We recommend you consider your network optimization technologies as part of your Windows Autopatch deployment. However, if you're already using Windows Update for Business (WufB) it's likely you already have your network optimization solution in place. For more information, see [Review network optimization](#step-one-prepare) | @@ -172,7 +172,7 @@ Regardless of if you're migrating from Configuration Manager to Microsoft Intune #### Assessing your readiness to migrate from Configuration Manager to Windows Autopatch -When moving from Configuration Manager to Windows Autopatch, the fastest path to quickly gain value from Windows Autopatch is to already have co-management and the requisite workloads moved to Intune. +When you migrate from Configuration Manager to Windows Autopatch, the fastest path to quickly gain value from Windows Autopatch is to already have co-management and the requisite workloads moved to Intune. | Step | Assessment step | Recommendation | | ----- | ----- | ----- | @@ -216,7 +216,7 @@ On-premises AD group policies are applied in the LSDOU order (Local, Site, Domai | Area | Path | Recommendation | | ----- | ----- | ----- | | Windows Update Group Policy settings | `Computer Configuration\Administrative Templates\Windows Components\Windows Updates` | The most common Windows Update settings delivered through Group Policy can be found under this path. This is a good place for you to start your review. | -| Don't connect to any Windows Update Internet locations | `Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations` | This is a common setting for organizations that rely solely on intranet update locations such as Windows Server Update Services (WSUS) servers and can often be overlooked when moving to cloud update services such as Windows Update for Business (WufB)

      When turned on, this policy prevents contact with the public Windows Update service and won't establish connections to Windows Update. This might cause the connection to Windows Update for Business (WufB), and Delivery Optimization to stop working. | +| Don't connect to any Windows Update Internet locations | `Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations` | This is a common setting for organizations that rely solely on intranet update locations such as Windows Server Update Services (WSUS) servers and can often be overlooked when moving to cloud update services such as Windows Update for Business (WufB)

      When turned on, this policy prevents contact with the public Windows Update service and won't establish connections to Windows Update, and might cause the connection to Windows Update for Business (WufB), and Delivery Optimization to stop working. | | Scan Source policy | `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service` | You can choose what types of updates to get from either Windows Server Update Services (WSUS) or Windows Update for Business (WufB) service with the Windows Update Scan Source policy.

      You should review any scan source policy settings targeting devices to ensure:
      • That no conflicts exist that could affect update deployment through Windows Autopatch
      • Such policies aren't targeting devices enrolled into Windows Autopatch
      | ### Registry settings @@ -239,7 +239,7 @@ Any policies, scripts or settings that create or edit values in the following re When Configuration Manager is deployed, and if Software Update policies are configured, the Software Update policies could conflict with Windows Update for Business and Office Update policies. -Configuration Manager could require custom settings to disable software updates and assist with troubleshooting conflicting legacy, on-premises configurations to ensure that Autopatch delivers Windows and Office updates. It's safe to implement this change if you aren't managing third party updates from Configuration Manager. +Configuration Manager could require custom settings to disable software updates and assist with troubleshooting conflicting legacy, on-premises configurations to ensure that Autopatch deliver Windows and Office updates. It's safe to implement this change if you aren't managing third party updates from Configuration Manager. To ensure that Software Update Policies don't conflict with Windows Update for Business (WufB) and Office Update policies, create a Software Update Policy in Configuration Manager that has: @@ -265,7 +265,7 @@ For example, Configuration Manager Software Update Policy settings exclude Autop | Policy | Description | | ----- | ----- | | **MDM to win over GP** | As part of the tenant enrollment process, Autopatch deploys a Device configuration profile, which applies to all registered devices to set Mobile Device Management (MDM) to win over Group Policy (GP) with the "MDMWinsOverGP" CSP.

      When applied, any MDM policy that's set, and has an equivalent GP Policy, results in the GP service blocking the policy setting. Setting the value to 0 (zero) or deleting the policy removes the GP policy blocks and restore the saved GP policies.

      This setting doesn't apply to all scenarios. This setting doesn't work for:
      • User scoped settings. This setting applies to device scoped settings only
      • Any custom Group Policy Object (GPO) outside of ADMX. For example, Microsoft Edge or Chrome settings
      • Any Windows Update for Business policies (WUfB). When you use Windows Update for Business (WUfB), ensure all previous Group Policies (GP) are removed that relate to Windows Update to ensure that Autopatch policies can take effect


      For more information and guidance on the expected behavior applied through this policy, see [ControlPolicyConflict Policy CSP](/windows/client-management/mdm/policy-csp-controlpolicyconflict) | -| **Windows Update for Business (WufB) policies** | If you have any existing *Deployment rings for Windows 10 and later or Windows feature update DSS policies* in place, ensure that the assignments don't target Windows Autopatch devices. This is to avoid creating policy conflicts and unexpected update behaviour, which could impact update compliance and end user experience. | +| **Windows Update for Business (WufB) policies** | If you have any existing *Deployment rings for Windows 10 and later or Windows feature update DSS policies* in place, ensure that the assignments don't target Windows Autopatch devices. This is to avoid creating policy conflicts and unexpected update behavior, which could impact update compliance and end user experience. | | **Update Policy CSP** | If any policies from the [Update Policy CSP](/windows/client-management/mdm/policy-csp-update) that aren't deployed and managed by Windows Autopatch are deployed to devices, policy conflicts and unexpected update behavior could occur and could affect update compliance and the end user experience. | #### Servicing profiles for Microsoft 365 Apps for enterprise @@ -287,7 +287,7 @@ Part of your planning might require articulating the business benefits of moving Change management relies on clear and helpful communication about upcoming changes. The best way to have a smooth deployment is to make sure end users and stakeholders are aware of all changes and disruptions. Your rollout communication plan should include all pertinent information, how to notify users, and when to communicate. -- Identify groups being impacted by the Autopatch deployment +- Identify groups impacted by the Autopatch deployment - Identify key stakeholders in the impacted groups - Determine the types of communications needed - Develop your messaging based on the [Recommended deployment steps](#recommended-deployment-steps) @@ -325,8 +325,13 @@ First contact your Microsoft Account team who can work with you to establish any Once you're underway with your deployment, consider joining the [Windows Autopatch Private Community (APC)](https://aka.ms/WindowsAutopatchPrivateCommunity) where you can: - Engage directly with the Windows Autopatch Engineering Teams and other Autopatch customers -- Gain access to exclusive virtual meetings, focus groups, surveys, Teams discussions and previews +- Gain access to: + - Exclusive virtual meetings + - Focus groups + - Surveys + - Teams discussions + - Previews ### Windows Autopatch Technology Adoption Program (TAP) -If you have at least 500 devices enrolled in the service and are willing to test and give Microsoft feedback at least once a year, consider signing up to the [Windows Autopatch Technology Adoption Program (TAP)](https://aka.ms/JoinWindowsAutopatchTAP) to try out new and upcoming Windows Autopatch features. +If you have at least 500 devices enrolled in the service, and will test and give Microsoft feedback at least once a year, consider signing up to the [Windows Autopatch Technology Adoption Program (TAP)](https://aka.ms/JoinWindowsAutopatchTAP) to try out new and upcoming Windows Autopatch features. From c6390ac45430f38fbaa6f1b2fa5001c9f533512e Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 24 Aug 2023 09:43:35 -0700 Subject: [PATCH 091/125] Added to What's new --- .../whats-new/windows-autopatch-whats-new-2023.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 7e051ce0a7..a439a1529c 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -27,6 +27,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | Article | Description | | ----- | ----- | +| [Deployment guide](../overview/windows-autopatch-deployment-guide.md) | New guide. This guide explains how to successfully deploy Windows Autopatch in your environment | | [Windows quality updates](../operate/windows-autopatch-groups-windows-quality-update-overview.md) | Added the **This pause is related to Windows Update** option to the [Pause and resume a release feature](../operate/windows-autopatch-groups-windows-quality-update-overview.md#pause-and-resume-a-release) | | [Manage driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)| Added [policy settings](../operate/windows-autopatch-manage-driver-and-firmware-updates.md#view-driver-and-firmware-policies-created-by-windows-autopatch) for all deployment rings | | [Manage driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md) | General Availability
      • [MC661218](https://admin.microsoft.com/adminportal/home#/MessageCenter)
      | From 5d2ad5a46a1ea5cde3546df09144c3f7b1a89cd8 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 24 Aug 2023 11:14:05 -0700 Subject: [PATCH 092/125] WUfB consistency --- .../windows-autopatch-deployment-guide.md | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md index 69cab728bf..5d0efaad00 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -75,7 +75,7 @@ Evaluate Windows Autopatch with around 50 devices to ensure the service meets yo | Step | Description | | ----- | ----- | -| **2A: Review reporting capabilities** |
      • [Windows quality update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports)
      • [Windows feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports)
      • [Windows Update for Business (WufB) reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report)
      Windows Autopatch quality and feature update reports provide a progress view on the latest update cycle for your devices. These reports should be reviewed often to ensure you understand the update state of your Windows Autopatch devices.

      There might be times when using Windows Autopatch for update deployment that it's beneficial to review Windows Update for Business (WUfB) reports.

      For example, when preparing to deploy Windows 11, you might find it useful to evaluate your devices using the [Windows feature update device readiness](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report) and [Windows feature update compatibility risks reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-compatibility-risks-report) in Intune.| +| **2A: Review reporting capabilities** |
      • [Windows quality update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports)
      • [Windows feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports)
      • [Windows Update for Business (WUfB) reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report)
      Windows Autopatch quality and feature update reports provide a progress view on the latest update cycle for your devices. These reports should be reviewed often to ensure you understand the update state of your Windows Autopatch devices.

      There might be times when using Windows Autopatch for update deployment that it's beneficial to review Windows Update for Business (WUfB) reports.

      For example, when preparing to deploy Windows 11, you might find it useful to evaluate your devices using the [Windows feature update device readiness](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report) and [Windows feature update compatibility risks reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-compatibility-risks-report) in Intune.| | **2B: Review operational changes** | As part of the introduction of Windows Autopatch, you should consider how the service integrates with your existing operational processes.
      • Identify service desk and end user computing process changes
      • Identify any alignment with third party support agreements
      • Review the default Windows Autopatch support process and alignment with your existing Premier and Unified support options
      • Identify IT admin process change & service interaction points
      | | **2C: Educate end users and key stakeholders**| Educate your end users by creating guides for the Windows Autopatch end user experience.
      • [Windows quality updates](../operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md)
      • [Windows feature updates](../operate/windows-autopatch-groups-windows-feature-update-overview.md)
        • [Microsoft 365 Apps for enterprise updates](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
      • [Microsoft Edge](../operate/windows-autopatch-edge.md)
      • [Microsoft Teams](../operate/windows-autopatch-teams.md)

      Include your IT support and help desk in the early stages of the Windows Autopatch deployment and planning process. Early involvement allows your support staff to:
      • Gain knowledge and experience in identifying and resolving update issues more effectively
      • Prepare them to support production rollouts. Knowledgeable help desk and support teams also help end users adopt to changes

      Your support staff can experience a walkthrough of the Windows Autopatch admin experience through the [Windows Autopatch demo site](https://aka.ms/autopatchdemo). | | **2D: Pilot planning** | Identify target pilot group(s) of up to 500 devices. It's recommended to include a cross-section of your organizational make-up to ensure your pilot results are representative of your organizational environment. | @@ -88,7 +88,7 @@ Plan to pilot the service with around 500 devices to provide sufficient pilot co | ----- | ----- | | **3A: Register devices** | Register pilot device group(s) | | **3B: Monitor update process success** |
      • Quality update: One to two update cycles
      • Feature update: Set of pilot devices scheduled across several weeks
      • Drivers and firmware: One to two update cycles
      • Microsoft 365 Apps for enterprise (if not opted-out): One to two update cycles
      • Microsoft Edge: One to two update cycles
      • Microsoft Teams: One to two update cycles
        • | -| **3C: Review reports** |
        • [Quality update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports): Monitor data in the reports across one to two update cycles
        • [Feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports): Monitor data in the reports across the update schedule
        • [Windows Update for Business (WufB) reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report): Monitor data in the report across one to two update cycles
        | +| **3C: Review reports** |
        • [Quality update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports): Monitor data in the reports across one to two update cycles
        • [Feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports): Monitor data in the reports across the update schedule
        • [Windows Update for Business (WUfB) reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report): Monitor data in the report across one to two update cycles
        | | **3D: Implement operational changes** |
        • Pilot Service Desk, end user computing and third party (if applicable) process changes with pilot representatives
        • IT admins must:
          • Review deployment progress using Windows Autopatch reports
          • Respond to identified actions to help improve success rates
        | | **3E: Communicate with stakeholders** | Review and action your stakeholder communication plan. | | **3F: Deployment planning** | Prepare target deployment groups for phased deployment of Windows Autopatch. | @@ -105,17 +105,17 @@ Following a successful pilot, you can commence deployment to your broader organi ## Migration considerations -If you're an existing Windows Update for Business (WufB) or Configuration Manager customer, there are several considerations that could accelerate your deployment along a shorter path. +If you're an existing Windows Update for Business (WUfB) or Configuration Manager customer, there are several considerations that could accelerate your deployment along a shorter path. ### Why migrate from Windows Update for Business or Configuration Manager to Windows Autopatch? -Customers who are using Windows Update for Business (WufB) or Configuration Manager can quickly adopt Windows Autopatch and take advantage of the key benefits that Windows Autopatch provides. +Customers who are using Windows Update for Business (WUfB) or Configuration Manager can quickly adopt Windows Autopatch and take advantage of the key benefits that Windows Autopatch provides. -When moving from Windows Update for Business (WufB) or Configuration Manager to Windows Autopatch, you can enhance and optimize the update experience that you're already familiar with. +When moving from Windows Update for Business (WUfB) or Configuration Manager to Windows Autopatch, you can enhance and optimize the update experience that you're already familiar with. Once migrated, there are several configuration tasks that you no longer need to carry out: -| Autopatch benefit | Configuration Manager | Windows Update for Business (WufB) | +| Autopatch benefit | Configuration Manager | Windows Update for Business (WUfB) | | ----- | ----- | ----- | | Automated setup and on-going configuration of Windows Update policies | Manage and perform recurring tasks such as:
        • Download updates
        • Distribute to distribution points
        • Target update collections
        | Manage "static" deployment ring policies | | Automated management of deployment ring membership | Manually check collection membership and targets | Manage "static" deployment ring membership | @@ -125,7 +125,7 @@ Once migrated, there are several configuration tasks that you no longer need to In addition to the reports, other benefits include: -| Autopatch benefit | Configuration Manager and Windows Update for Business (WufB) | +| Autopatch benefit | Configuration Manager and Windows Update for Business (WUfB) | | ----- | ----- | | Windows quality and feature update reports with integrated alerts, deep filtering, and status-at-a-glance | Requires you to manually navigate and hunt for status and alerts | | Filter by action needed with integrated resolution documentation | Requires you to research and discover possible actions relating to update issues | @@ -133,18 +133,18 @@ In addition to the reports, other benefits include: Service management benefits include: -| Autopatch benefit | Configuration Manager and Windows Update for Business (WufB) | +| Autopatch benefit | Configuration Manager and Windows Update for Business (WUfB) | | ----- | ----- | | Windows automation and Microsoft Insights | First or third-party resources required to support and manage updates internally | | Microsoft research and insights determine the 'go/no-go' for your update deployment | Limited signals and insights from your organization to determine the 'go/no-go' for your update deployment | | Windows Autopatch might pause or roll back an update. The pause or rollback is dependent on the scope of impact and to prevent end user disruption | Manual intervention required, widening the potential impact of any update issues | | By default, Windows Autopatch [expedites quality updates](../operate/windows-autopatch-groups-windows-quality-update-overview.md#expedited-releases) as needed. | Manual intervention required, widening the potential impact of any update issues | -### Migrating from Windows Update for Business (WufB) to Windows Autopatch +### Migrating from Windows Update for Business (WUfB) to Windows Autopatch -#### Assessing your readiness to migrate from Windows Update for Business (WufB) to Windows Autopatch +#### Assessing your readiness to migrate from Windows Update for Business (WUfB) to Windows Autopatch -When moving from Windows Update for Business (WufB) to Windows Autopatch, you can accelerate and simplify your adoption by assessing your readiness to quickly migrate to the Windows Autopatch service by considering key differences that might impact your deployment: +When moving from Windows Update for Business (WUfB) to Windows Autopatch, you can accelerate and simplify your adoption by assessing your readiness to quickly migrate to the Windows Autopatch service by considering key differences that might impact your deployment: | Step | Assessment step | Recommendation | | ----- | ----- | ----- | @@ -152,9 +152,9 @@ When moving from Windows Update for Business (WufB) to Windows Autopatch, you ca | **2** | Microsoft Edge channels | Windows Autopatch deploys Microsoft Edge Stable channel to devices in all deployment rings except for the Test deployment ring. The Test deployment ring is configured for the Microsoft Edge Beta channel. If you're currently using different channels, your teams should understand that your Windows Autopatch devices use these channels. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare). | | **3** | Microsoft 365 Apps for enterprise | Windows Autopatch deploys the Monthly Enterprise Channel to all Microsoft 365 Apps for enterprise clients. If your organization is using a different channel and you don't wish to adopt the Monthly Enterprise Channel, you can opt out Microsoft 365 Apps for enterprise updates. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare) | | **4** | Prepare your policies | You should consider any existing policy configurations in your Windows Update for Business (WUfB), Intune or on-premises environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | -| **5** | Network optimization technologies | We recommend you consider your network optimization technologies as part of your Windows Autopatch deployment. However, if you're already using Windows Update for Business (WufB) it's likely you already have your network optimization solution in place. For more information, see [Review network optimization](#step-one-prepare) | +| **5** | Network optimization technologies | We recommend you consider your network optimization technologies as part of your Windows Autopatch deployment. However, if you're already using Windows Update for Business (WUfB) it's likely you already have your network optimization solution in place. For more information, see [Review network optimization](#step-one-prepare) | -### Optimized deployment path: Windows Update for Business (WufB) to Windows Autopatch +### Optimized deployment path: Windows Update for Business (WUfB) to Windows Autopatch Once you have assessed your readiness state to ensure you're aligned to Windows Autopatch readiness, you can optimize your deployment of Windows Autopatch to quickly migrate to the service. The following steps illustrate a recommended optimized deployment path: @@ -216,8 +216,8 @@ On-premises AD group policies are applied in the LSDOU order (Local, Site, Domai | Area | Path | Recommendation | | ----- | ----- | ----- | | Windows Update Group Policy settings | `Computer Configuration\Administrative Templates\Windows Components\Windows Updates` | The most common Windows Update settings delivered through Group Policy can be found under this path. This is a good place for you to start your review. | -| Don't connect to any Windows Update Internet locations | `Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations` | This is a common setting for organizations that rely solely on intranet update locations such as Windows Server Update Services (WSUS) servers and can often be overlooked when moving to cloud update services such as Windows Update for Business (WufB)

        When turned on, this policy prevents contact with the public Windows Update service and won't establish connections to Windows Update, and might cause the connection to Windows Update for Business (WufB), and Delivery Optimization to stop working. | -| Scan Source policy | `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service` | You can choose what types of updates to get from either Windows Server Update Services (WSUS) or Windows Update for Business (WufB) service with the Windows Update Scan Source policy.

        You should review any scan source policy settings targeting devices to ensure:
        • That no conflicts exist that could affect update deployment through Windows Autopatch
        • Such policies aren't targeting devices enrolled into Windows Autopatch
        | +| Don't connect to any Windows Update Internet locations | `Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations` | This is a common setting for organizations that rely solely on intranet update locations such as Windows Server Update Services (WSUS) servers and can often be overlooked when moving to cloud update services such as Windows Update for Business (WUfB)

        When turned on, this policy prevents contact with the public Windows Update service and won't establish connections to Windows Update, and might cause the connection to Windows Update for Business (WUfB), and Delivery Optimization to stop working. | +| Scan Source policy | `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service` | You can choose what types of updates to get from either Windows Server Update Services (WSUS) or Windows Update for Business (WUfB) service with the Windows Update Scan Source policy.

        You should review any scan source policy settings targeting devices to ensure:
        • That no conflicts exist that could affect update deployment through Windows Autopatch
        • Such policies aren't targeting devices enrolled into Windows Autopatch
        | ### Registry settings @@ -241,7 +241,7 @@ When Configuration Manager is deployed, and if Software Update policies are conf Configuration Manager could require custom settings to disable software updates and assist with troubleshooting conflicting legacy, on-premises configurations to ensure that Autopatch deliver Windows and Office updates. It's safe to implement this change if you aren't managing third party updates from Configuration Manager. -To ensure that Software Update Policies don't conflict with Windows Update for Business (WufB) and Office Update policies, create a Software Update Policy in Configuration Manager that has: +To ensure that Software Update Policies don't conflict with Windows Update for Business (WUfB) and Office Update policies, create a Software Update Policy in Configuration Manager that has: - Windows and Office Update configuration disabled - Includes devices enrolled into Autopatch to remove any existing configuration(s). @@ -265,7 +265,7 @@ For example, Configuration Manager Software Update Policy settings exclude Autop | Policy | Description | | ----- | ----- | | **MDM to win over GP** | As part of the tenant enrollment process, Autopatch deploys a Device configuration profile, which applies to all registered devices to set Mobile Device Management (MDM) to win over Group Policy (GP) with the "MDMWinsOverGP" CSP.

        When applied, any MDM policy that's set, and has an equivalent GP Policy, results in the GP service blocking the policy setting. Setting the value to 0 (zero) or deleting the policy removes the GP policy blocks and restore the saved GP policies.

        This setting doesn't apply to all scenarios. This setting doesn't work for:
        • User scoped settings. This setting applies to device scoped settings only
        • Any custom Group Policy Object (GPO) outside of ADMX. For example, Microsoft Edge or Chrome settings
        • Any Windows Update for Business policies (WUfB). When you use Windows Update for Business (WUfB), ensure all previous Group Policies (GP) are removed that relate to Windows Update to ensure that Autopatch policies can take effect


        For more information and guidance on the expected behavior applied through this policy, see [ControlPolicyConflict Policy CSP](/windows/client-management/mdm/policy-csp-controlpolicyconflict) | -| **Windows Update for Business (WufB) policies** | If you have any existing *Deployment rings for Windows 10 and later or Windows feature update DSS policies* in place, ensure that the assignments don't target Windows Autopatch devices. This is to avoid creating policy conflicts and unexpected update behavior, which could impact update compliance and end user experience. | +| **Windows Update for Business (WUfB) policies** | If you have any existing *Deployment rings for Windows 10 and later or Windows feature update DSS policies* in place, ensure that the assignments don't target Windows Autopatch devices. This is to avoid creating policy conflicts and unexpected update behavior, which could impact update compliance and end user experience. | | **Update Policy CSP** | If any policies from the [Update Policy CSP](/windows/client-management/mdm/policy-csp-update) that aren't deployed and managed by Windows Autopatch are deployed to devices, policy conflicts and unexpected update behavior could occur and could affect update compliance and the end user experience. | #### Servicing profiles for Microsoft 365 Apps for enterprise From b35d59760cc1cc0c73fccf6a60c12d7f17ad22c2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 24 Aug 2023 14:52:40 -0700 Subject: [PATCH 093/125] pull-8762-mainchange --- windows/deployment/do/TOC.yml | 4 +--- windows/deployment/do/mcc-enterprise-deploy.md | 6 +++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/windows/deployment/do/TOC.yml b/windows/deployment/do/TOC.yml index 1697bfc141..136f9e7998 100644 --- a/windows/deployment/do/TOC.yml +++ b/windows/deployment/do/TOC.yml @@ -38,13 +38,11 @@ - name: Requirements href: mcc-enterprise-prerequisites.md - name: Deploy Microsoft Connected Cache - href: mcc-enterprise-portal-deploy.md + href: mcc-enterprise-deploy.md - name: Update or uninstall MCC href: mcc-enterprise-update-uninstall.md - name: Appendix href: mcc-enterprise-appendix.md - - name: MCC for Enterprise and Education (early preview) - href: mcc-enterprise-deploy.md - name: MCC for ISPs items: - name: MCC for ISPs Overview diff --git a/windows/deployment/do/mcc-enterprise-deploy.md b/windows/deployment/do/mcc-enterprise-deploy.md index cdcf5c1b5d..53d2940cc1 100644 --- a/windows/deployment/do/mcc-enterprise-deploy.md +++ b/windows/deployment/do/mcc-enterprise-deploy.md @@ -1,5 +1,5 @@ --- -title: MCC for Enterprise and Education (early preview) +title: Deploying your cache node manager: aaroncz description: How to deploy a Microsoft Connected Cache (MCC) for Enterprise and Education cache node ms.prod: windows-client @@ -12,7 +12,7 @@ ms.technology: itpro-updates ms.collection: tier3 --- -# Deploying your enterprise cache node +# Deploying your cache node **Applies to** @@ -130,7 +130,7 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p - Downloads, installs, and deploys EFLOW - Enables Microsoft Update so EFLOW can stay up to date - Creates a virtual machine -- Enables the firewall and opens ports 80 for inbound and outbound traffic. Port 80 is used by MCC. +- Enables the firewall and opens ports 80 and 22 for inbound and outbound traffic. Port 80 is used by MCC, and port 22 is used for SSH communications. - Configures Connected Cache tuning settings. - Creates the necessary *FREE* Azure resource - IoT Hub/IoT Edge. - Deploys the MCC container to server. From a9b6ef6df8465e13db4ca0ad33a5fc9e81fb954e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 24 Aug 2023 14:57:08 -0700 Subject: [PATCH 094/125] delete cmm-enterprise-portal-deploy --- .../do/mcc-enterprise-portal-deploy.md | 145 ------------------ 1 file changed, 145 deletions(-) delete mode 100644 windows/deployment/do/mcc-enterprise-portal-deploy.md diff --git a/windows/deployment/do/mcc-enterprise-portal-deploy.md b/windows/deployment/do/mcc-enterprise-portal-deploy.md deleted file mode 100644 index eea23e3bad..0000000000 --- a/windows/deployment/do/mcc-enterprise-portal-deploy.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: Deploying your cache node -manager: aaroncz -description: How to deploy Microsoft Connected Cache (MCC) for Enterprise and Education cache node -ms.prod: windows-client -ms.author: carmenf -author: cmknox -ms.reviewer: mstewart -ms.topic: article -ms.date: 12/31/2017 -ms.technology: itpro-updates -ms.collection: tier3 ---- - -# Deploying your cache node - -**Applies to** - -- Windows 10 -- Windows 11 - -## Create the Microsoft Connected Cache resource - -1. Navigate to Azure portal by using the [following link](https://aka.ms/mcc-enterprise-preview): - > [!IMPORTANT] - > You must access Azure portal using this link (https://aka.ms/mcc-enterprise-preview) in order to find the correct Microsoft Connected Cache resource. - - ![Screenshot of Azure portal "Create a resource" page, where you search for the Microsoft Connected Cache resource](images/ent-mcc-portal-create.png) - -1. In the search bar by **Get Started**, search for `Microsoft Connected Cache for Enterprise`. - ![Screenshot of Azure portal after searching for the Microsoft Connected Cache resource](images/ent-mcc-portal-resource.png) -1. Select **Create** to create your Microsoft Connected Cache resource. When prompted, choose the subscription, resource group, and location of your cache node. Also, enter a name for your cache node. -1. The creation of the cache node may take a few minutes. After a successful creation, you'll see a “Deployment complete” page as below. Select **Go to resource**. -![Screenshot of Azure portal after the deployment is complete](images/ent-mcc-deployment-complete.png) - -## Create, provision, and deploy the cache node in Azure portal - -To create, provision, and deploy the cache node in Azure portal, follow these steps: -1. Open Azure portal and navigate to the Microsoft Connected Cache for Enterprise (preview) resource. -1. Navigate to **Settings** > **Cache nodes** and select **Create Cache Node**. -1. Provide a name for your cache node and select **Create** to create your cache node. -1. You may need to refresh to see the cache node. Select the cache node to configure it. -1. Fill out the Basics and Storage fields. Enter the cache drive size in GB - this has a minimum size of 50 GB. - - ![Screenshot of Azure portal on the Provisioning page, where the user can configure their cache node.](images/ent-mcc-provisioning.png) -Once complete, select **Save** at the top of the page and select **Provision server**. -1. To deploy your cache node, download the installer by selecting **Download provisioning package**. -1. Run the provided provisioning script - note that this is unique to each cache node. - -## Verify proper functioning MCC server - -#### Verify client side - -Connect to the EFLOW VM and check if MCC is properly running: - -1. Open PowerShell as an Administrator. -2. Enter the following commands: - - ```powershell - Connect-EflowVm - sudo -s - iotedge list - ``` - - :::image type="content" source="./images/ent-mcc-connect-eflowvm.png" alt-text="Screenshot of running connect-EflowVm, sudo -s, and iotedge list from PowerShell." lightbox="./images/ent-mcc-connect-eflowvm.png"::: - -You should see MCC, edgeAgent, and edgeHub running. If you see edgeAgent or edgeHub but not MCC, try this command in a few minutes. The MCC container can take a few minutes to deploy. - -#### Verify server side - -For a validation of properly functioning MCC, execute the following command in the EFLOW VM or any device in the network. Replace with the IP address of the cache server. - -```powershell -wget [http:///mscomtest/wuidt.gif?cacheHostOrigin=au.download.windowsupdate.com] -``` - -A successful test result will display a status code of 200 along with additional information. - -:::image type="content" source="./images/ent-mcc-verify-server-ssh.png" alt-text="Screenshot of a successful wget with an SSH client." lightbox="./images/ent-mcc-verify-server-ssh.png"::: - - :::image type="content" source="./images/ent-mcc-verify-server-powershell.png" alt-text="Screenshot of a successful wget using PowerShell." lightbox="./images/ent-mcc-verify-server-powershell.png"::: - -Similarly, enter the following URL from a browser in the network: - -`http:///mscomtest/wuidt.gif?cacheHostOrigin=au.download.windowsupdate.com` - -If the test fails, see the [common issues](#common-issues) section for more information. - -### Monitoring your metrics - -To view the metrics associated with your cache nodes, navigate to the **Overview** > **Monitoring** tab within the Azure portal. - -:::image type="content" source="./images/mcc-isp-metrics.png" alt-text="Screenshot of the Azure portal displaying the metrics view in the Overview tab."::: - -You can choose to monitor the health and performance of all cache nodes or one at a time by using the dropdown menu. The **Egress bits per second** graph shows your inbound and outbound traffic of your cache nodes over time. You can change the time range (1 hour, 12 hours, 1 day, 7 days, 14 days, and 30 days) by selecting the time range of choice on the top bar. - -If you're unable to view metrics for your cache node, it may be that your cache node is unhealthy, inactive, or hasn't been fully configured. - - -### Intune (or other management software) configuration for MCC - -For an [Intune](/mem/intune/) deployment, create a **Configuration Profile** and include the Cache Host eFlow IP Address or FQDN: - -:::image type="content" source="./images/ent-mcc-intune-do.png" alt-text="Screenshot of Intune showing the Delivery Optimization cache server host names."::: - -## Common Issues - -#### PowerShell issues - -If you're seeing errors similar to this error: `The term Get- isn't recognized as the name of a cmdlet, function, script file, or operable program.` - -1. Ensure you're running Windows PowerShell version 5.x. - -1. Run \$PSVersionTable and ensure you're running version 5.x and *not version 6 or 7*. - -1. Ensure you have Hyper-V enabled: - - **Windows 10:** [Enable Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v) - - **Windows Server:** [Install the Hyper-V role on Windows Server](/windows-server/virtualization/hyper-v/get-started/install-the-hyper-v-role-on-windows-server) - -#### Verify Running MCC Container - -Connect to the Connected Cache server and check the list of running IoT Edge modules using the following commands: - -```bash -Connect-EflowVm -sudo iotedge list -``` - -:::image type="content" source="./images/ent-mcc-iotedge-list.png" alt-text="Screenshot of the iotedge list command." lightbox="./images/ent-mcc-iotedge-list.png"::: - -If edgeAgent and edgeHub containers are listed, but not "MCC", you may view the status of the IoT Edge security manager by using the command: - -```bash -sudo journalctl -u iotedge -f -``` - -This command will provide the current status of the starting, stopping of a container, or the container pull and start. - -:::image type="content" source="./images/ent-mcc-journalctl.png" alt-text="Screenshot of the output from journalctl -u iotedge -f." lightbox="./images/ent-mcc-journalctl.png"::: - - -> [!NOTE] -> You should consult the IoT Edge troubleshooting guide ([Common issues and resolutions for Azure IoT Edge](/azure/iot-edge/troubleshoot)) for any issues you may encounter configuring IoT Edge, but we've listed a few issues that we encountered during our internal validation. From 0138693df014279798d904b7921be742dcfe2118 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 24 Aug 2023 15:00:03 -0700 Subject: [PATCH 095/125] temp redir of mcc-enterprise-portal-deploy to mcc-enterprise-deploy --- .openpublishing.redirection.windows-deployment.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.openpublishing.redirection.windows-deployment.json b/.openpublishing.redirection.windows-deployment.json index 49fd3e464e..06fc754819 100644 --- a/.openpublishing.redirection.windows-deployment.json +++ b/.openpublishing.redirection.windows-deployment.json @@ -750,6 +750,11 @@ "redirect_url": "/windows/deployment/windows-10-subscription-activation", "redirect_document_id": false }, + { + "source_path": "windows/deployment/do/mcc-enterprise-portal-deploy.md", + "redirect_url": "/windows/deployment/do/mcc-enterprise-deploy", + "redirect_document_id": false + }, { "source_path": "windows/deployment/windows-autopatch/deploy/index.md", "redirect_url": "/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts", From 2950b19dc2f01f742de2b24a41d4cfb6600b80b6 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 25 Aug 2023 07:16:05 -0400 Subject: [PATCH 096/125] Acceptance note --- .../hello-for-business/hello-feature-pin-reset.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index e330291c34..d46d1075a5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -68,7 +68,9 @@ To register the applications, follow these steps: :::row-end::: :::row::: :::column span="3"::: - 3. Review the permissions requested by the *Microsoft Pin Reset Service Production* application and select **Accept** to confirm consent to both applications to access your organization + 3. Review the permissions requested by the *Microsoft Pin Reset Service Production* application and select **Accept** to confirm consent to both applications to access your organization. + >[!NOTE] + >After accepance, the redirect page will show a blank page. This is a known behavior. :::column-end::: :::column span="1"::: :::image type="content" alt-text="Screenshot showing the PIN reset service permissions final page." source="images/pinreset/pin-reset-service-prompt-2.png" lightbox="images/pinreset/pin-reset-service-prompt-2.png" border="true"::: @@ -178,7 +180,7 @@ The _PIN reset_ configuration can be viewed by running [**dsregcmd /status**](/a **Applies to:** Azure AD joined devices -PIN reset on Azure AD-joined devices uses a flow called *web sign-in* to authenticate users in the lock screen. Web sign-in only allows navigation to specific domains. If web sign-in attempts to navigate to a domain that isn't allowed, it displays a page with the error message: *We can't open that page right now*.\ +PIN reset on Azure AD-joined devices uses a flow called *web sign-in* to authenticate users in the lock screen. Web sign-in only allows navigation to specific domains. If web sign-in attempts to navigate to a domain that isn't allowed, it displays a page with the error message: *"We can't open that page right now"*.\ If you have a federated environment and authentication is handled using AD FS or a third-party identity provider, then you must configure your devices with a policy to allow a list of domains that can be reached during PIN reset flows. When set, it ensures that authentication pages from that identity provider can be used during Azure AD joined PIN reset. [!INCLUDE [intune-settings-catalog-1](../../../../includes/configure/intune-settings-catalog-1.md)] @@ -196,7 +198,7 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the |
      • OMA-URI: `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`
      • Data type: String
      • Value: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be **signin.contoso.com;portal.contoso.com**
        • | > [!NOTE] -> For Azure Government, there is a known issue with PIN reset on Azure AD Joined devices failing. When the user attempts to launch PIN reset, the PIN reset UI shows an error page that says, "We can't open that page right now." The ConfigureWebSignInAllowedUrls policy can be used to work around this issue. If you are experiencing this problem and you are using Azure US Government cloud, set **login.microsoftonline.us** as the value for the ConfigureWebSignInAllowedUrls policy. +> For Azure Government, there is a known issue with PIN reset on Azure AD Joined devices failing. When the user attempts to launch PIN reset, the PIN reset UI shows an error page that says, *"We can't open that page right now"*. The ConfigureWebSignInAllowedUrls policy can be used to work around this issue. If you are experiencing this problem and you are using Azure US Government cloud, set **login.microsoftonline.us** as the value for the ConfigureWebSignInAllowedUrls policy. ## Use PIN reset From 5488c268d7912bb48fa134b66a9fb213a44c7a17 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Fri, 25 Aug 2023 09:27:02 -0700 Subject: [PATCH 097/125] Tweak --- .../overview/windows-autopatch-deployment-guide.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md index 5d0efaad00..fb1b851773 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -225,10 +225,10 @@ Any policies, scripts or settings that create or edit values in the following re | Key | Description | | ----- | ----- | -| `HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState` (Intune MDM only cloud managed)

        `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate` (If GPO/WSUS/Configuration Manager is deployed) | This key contains general settings for Windows Update, such as the update source, the service branch, and the deferral periods for feature and quality updates. | -| `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU` (If GPO/WSUS/Configuration Manager is deployed) | This key contains settings for Automatic Updates, such as the schedule, the user interface, and the detection frequency. | -| `HKLM\SOFTWARE\Microsoft\PolicyManager\default\Update` (GPO/WSUS/Configuration Manager/Intune MDM Managed) | This key contains settings for update policies that are managed by Mobile Device Management (MDM) or Group Policy, such as pausing updates, excluding drivers, or configuring delivery optimization. | -| `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration` (GPO/Configuration Manager/Intune MDM Managed) | This key contains the registry keys for the Update Channel. This is a dynamic key that changes (depending on the configured settings) and the CDNBaseUrl (set when Microsoft 365 installs on the device).

        Look at the `UpdateChannel` value. The value tells you how frequently Office is updated.

        For more information, see [Manage Microsoft 365 Apps with Configuration Manager](/mem/configmgr/sum/deploy-use/manage-office-365-proplus-updates#bkmk_channel) to review the values, and what they're set to. Windows Autopatch currently supports the Monthly Enterprise Channel. If you opt into Office updates, it should be set to the Monthly Enterprise channel. | +| `HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState`
        (Intune MDM only cloud managed)

        `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate`
        (If GPO/WSUS/Configuration Manager is deployed) | This key contains general settings for Windows Update, such as the update source, the service branch, and the deferral periods for feature and quality updates. | +| `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU`
        (If GPO/WSUS/Configuration Manager is deployed) | This key contains settings for Automatic Updates, such as the schedule, the user interface, and the detection frequency. | +| `HKLM\SOFTWARE\Microsoft\PolicyManager\default\Update`
        (GPO/WSUS/Configuration Manager/Intune MDM Managed) | This key contains settings for update policies that are managed by Mobile Device Management (MDM) or Group Policy, such as pausing updates, excluding drivers, or configuring delivery optimization. | +| `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration`
        (GPO/Configuration Manager/Intune MDM Managed) | This key contains the registry keys for the Update Channel. This is a dynamic key that changes (depending on the configured settings) and the CDNBaseUrl (set when Microsoft 365 installs on the device).

        Look at the `UpdateChannel` value. The value tells you how frequently Office is updated.

        For more information, see [Manage Microsoft 365 Apps with Configuration Manager](/mem/configmgr/sum/deploy-use/manage-office-365-proplus-updates#bkmk_channel) to review the values, and what they're set to. Windows Autopatch currently supports the Monthly Enterprise Channel. If you opt into Office updates, it should be set to the Monthly Enterprise channel. | > [!NOTE] > For more information about Windows Update Settings for Group Policy and Mobile Device Management (MDM), see [Manage additional Windows Update settings](/windows/deployment/update/waas-wu-settings). From 6e7e0f50c77febcba1e33dac101afc186fd76ff2 Mon Sep 17 00:00:00 2001 From: David Strome Date: Fri, 25 Aug 2023 16:19:11 -0700 Subject: [PATCH 098/125] Create test.txt --- test.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 test.txt diff --git a/test.txt b/test.txt new file mode 100644 index 0000000000..c0c17bba9a --- /dev/null +++ b/test.txt @@ -0,0 +1 @@ +test file to test sync From 0b192dc0c33981e53c8bba4ff32738d15378480a Mon Sep 17 00:00:00 2001 From: David Strome Date: Fri, 25 Aug 2023 17:02:03 -0700 Subject: [PATCH 099/125] Delete test.txt --- test.txt | 1 - 1 file changed, 1 deletion(-) delete mode 100644 test.txt diff --git a/test.txt b/test.txt deleted file mode 100644 index c0c17bba9a..0000000000 --- a/test.txt +++ /dev/null @@ -1 +0,0 @@ -test file to test sync From 468aac185b1e74d2d70351a8a3655f980b2f5f0d Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 28 Aug 2023 10:59:46 -0600 Subject: [PATCH 100/125] Update waas-delivery-optimization-reference.md Fix errors in text. --- windows/deployment/do/waas-delivery-optimization-reference.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization-reference.md b/windows/deployment/do/waas-delivery-optimization-reference.md index 2103cab516..2735892b16 100644 --- a/windows/deployment/do/waas-delivery-optimization-reference.md +++ b/windows/deployment/do/waas-delivery-optimization-reference.md @@ -276,9 +276,7 @@ Starting in Windows 10, version 1803, allows you to delay the use of an HTTP sou MDM Setting: **DelayCacheServerFallbackForeground** -Starting in Windows 10, version 1903, allows you to delay the fallback from cache server to the HTTP source for foreground content download by X seconds. If the 'Delay foreground download from HTTP' policy is set, it will apply first (to allow downloads from peers) and then this policy will be applied. **By default, this policy isn't set.** - -By default this policy isn't set. So, +Starting in Windows 10, version 1903, allows you to delay the fallback from cache server to the HTTP source for foreground content download by X seconds. If the 'Delay foreground download from HTTP policy is set, it will apply first (to allow downloads from peers) and then this policy will be applied. **By default, this policy isn't set.** ### Delay Background Download Cache Server Fallback (in secs) From 0f9111e56df4c35c95251d048d53ee705ec32b1a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 28 Aug 2023 11:45:43 -0700 Subject: [PATCH 101/125] update suffix meta --- windows/deployment/update/deployment-service-drivers.md | 2 +- .../deployment/update/deployment-service-expedited-updates.md | 2 +- windows/deployment/update/deployment-service-feature-updates.md | 2 +- windows/deployment/update/deployment-service-overview.md | 2 +- windows/deployment/update/deployment-service-prerequisites.md | 2 +- windows/deployment/update/deployment-service-troubleshoot.md | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/deployment/update/deployment-service-drivers.md b/windows/deployment/update/deployment-service-drivers.md index 40235bc9bf..39d270bf63 100644 --- a/windows/deployment/update/deployment-service-drivers.md +++ b/windows/deployment/update/deployment-service-drivers.md @@ -1,6 +1,6 @@ --- title: Deploy drivers and firmware updates -titlesuffix: Windows Update for Business deployment service +titleSuffix: Windows Update for Business deployment service description: Use Windows Update for Business deployment service to deploy driver and firmware updates to devices. ms.prod: windows-client ms.technology: itpro-updates diff --git a/windows/deployment/update/deployment-service-expedited-updates.md b/windows/deployment/update/deployment-service-expedited-updates.md index ece5c1e592..dfa61b9776 100644 --- a/windows/deployment/update/deployment-service-expedited-updates.md +++ b/windows/deployment/update/deployment-service-expedited-updates.md @@ -1,6 +1,6 @@ --- title: Deploy expedited updates -titlesuffix: Windows Update for Business deployment service +titleSuffix: Windows Update for Business deployment service description: Learn how to use Windows Update for Business deployment service to deploy expedited updates to devices in your organization. ms.prod: windows-client ms.technology: itpro-updates diff --git a/windows/deployment/update/deployment-service-feature-updates.md b/windows/deployment/update/deployment-service-feature-updates.md index f3b7b2340d..61ed9e5d63 100644 --- a/windows/deployment/update/deployment-service-feature-updates.md +++ b/windows/deployment/update/deployment-service-feature-updates.md @@ -1,6 +1,6 @@ --- title: Deploy feature updates -titlesuffix: "" +titleSuffix: Windows Update for Business deployment service description: Use Windows Update for Business deployment service to deploy feature updates to devices in your organization. ms.prod: windows-client ms.technology: itpro-updates diff --git a/windows/deployment/update/deployment-service-overview.md b/windows/deployment/update/deployment-service-overview.md index b56ef4dffb..58d36aae43 100644 --- a/windows/deployment/update/deployment-service-overview.md +++ b/windows/deployment/update/deployment-service-overview.md @@ -1,6 +1,6 @@ --- title: Overview of the deployment service -titlesuffix: Windows Update for Business deployment service +titleSuffix: Windows Update for Business deployment service description: Overview of deployment service to control approval, scheduling, and safeguarding of Windows updates with the deployment service. ms.prod: windows-client ms.technology: itpro-updates diff --git a/windows/deployment/update/deployment-service-prerequisites.md b/windows/deployment/update/deployment-service-prerequisites.md index c75475842c..de71ad0223 100644 --- a/windows/deployment/update/deployment-service-prerequisites.md +++ b/windows/deployment/update/deployment-service-prerequisites.md @@ -1,6 +1,6 @@ --- title: Prerequisites for the deployment service -titlesuffix: Windows Update for Business deployment service +titleSuffix: Windows Update for Business deployment service description: Prerequisites for using the Windows Update for Business deployment service for updating devices in your organization. ms.prod: windows-client ms.technology: itpro-updates diff --git a/windows/deployment/update/deployment-service-troubleshoot.md b/windows/deployment/update/deployment-service-troubleshoot.md index 836eba7c18..2d4052bbba 100644 --- a/windows/deployment/update/deployment-service-troubleshoot.md +++ b/windows/deployment/update/deployment-service-troubleshoot.md @@ -1,6 +1,6 @@ --- title: Troubleshoot the deployment service -titlesuffix: Windows Update for Business deployment service +titleSuffix: Windows Update for Business deployment service description: Solutions to commonly encountered problems when using the Windows Update for Business deployment service. ms.prod: windows-client ms.technology: itpro-updates From 20dded1df6dd13129965b53ee8d01655dc695059 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 28 Aug 2023 14:48:49 -0400 Subject: [PATCH 102/125] Update AllowOptionalContent policy --- .../mdm/policy-csp-update.md | 123 +++++++++--------- 1 file changed, 62 insertions(+), 61 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 3ec573368b..cf9c04b176 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -4,7 +4,7 @@ description: Learn more about the Update Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 08/10/2023 +ms.date: 08/28/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -25,11 +25,11 @@ ms.topic: reference Update CSP policies are listed below based on the group policy area: - [Windows Insider Preview](#windows-insider-preview) - - [AllowOptionalContent](#allowoptionalcontent) - [ConfigureDeadlineNoAutoRebootForFeatureUpdates](#configuredeadlinenoautorebootforfeatureupdates) - [ConfigureDeadlineNoAutoRebootForQualityUpdates](#configuredeadlinenoautorebootforqualityupdates) - [Manage updates offered from Windows Update](#manage-updates-offered-from-windows-update) - [AllowNonMicrosoftSignedUpdate](#allownonmicrosoftsignedupdate) + - [AllowOptionalContent](#allowoptionalcontent) - [AutomaticMaintenanceWakeUp](#automaticmaintenancewakeup) - [BranchReadinessLevel](#branchreadinesslevel) - [DeferFeatureUpdatesPeriodInDays](#deferfeatureupdatesperiodindays) @@ -107,65 +107,6 @@ Update CSP policies are listed below based on the group policy area: ## Windows Insider Preview - -### AllowOptionalContent - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
        ❌ User | ✅ Pro
        ✅ Enterprise
        ✅ Education
        ✅ Windows SE
        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/Update/AllowOptionalContent -``` - - - - -This policy enables devices to get offered optional updates and users interact with the 'Get the latest updates as soon as they're available' toggle on the Windows Update Settings page. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `int` | -| Access Type | Add, Delete, Get, Replace | -| Default Value | 0 | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| 0 (Default) | Device doesn't receive optional updates. | -| 1 | Device receives optional updates and user can install from WU Settings page. | -| 2 | Device receives optional updates and install them as soon as they're available. | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | AllowOptionalContent | -| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | - - - - - - - - ### ConfigureDeadlineNoAutoRebootForFeatureUpdates @@ -335,6 +276,66 @@ Allows the IT admin to manage whether Automatic Updates accepts updates signed b + +### AllowOptionalContent + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
        ❌ User | ✅ Pro
        ✅ Enterprise
        ✅ Education
        ✅ Windows SE
        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AllowOptionalContent +``` + + + + +This policy enables devices to get offered optional updates and users interact with the 'Get the latest updates as soon as they're available' toggle on the Windows Update Settings page. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Don't receive optional updates. | +| 1 | Automatically receive optional updates (including CFRs). | +| 2 | Automatically receive optional updates. | +| 3 | Users can select which optional updates to receive. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AllowOptionalContent | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | + + + + + + + + ### AutomaticMaintenanceWakeUp From d63de69b85e7377723a0af8ded8d29c37c2b42c7 Mon Sep 17 00:00:00 2001 From: Harman Thind <63820404+hathin@users.noreply.github.com> Date: Mon, 28 Aug 2023 12:19:59 -0700 Subject: [PATCH 103/125] Update windows-autopatch-exclude-device.md Device action in UI reads 'restore excluded device' not 'restore device' --- .../operate/windows-autopatch-exclude-device.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md index e3b0793469..c41dd12e0c 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md @@ -53,4 +53,4 @@ You can view the excluded devices in the **Not registered** tab to make it easie 1. Select **Windows Autopatch** in the left navigation menu. 1. Select **Devices**. 1. In the **Not registered** tab, select the device(s) you want to restore. -1. Once a device or multiple devices are selected, select **Device actions**. Then, select **Restore device**. +1. Once a device or multiple devices are selected, select **Device actions**. Then, select **Restore excluded device**. From 643f0526891cf7154f8df1b643c2dc10ef6ff754 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 28 Aug 2023 14:22:28 -0700 Subject: [PATCH 104/125] meta2upd --- windows/deployment/update/waas-wu-settings.md | 13 ++++++------ .../deployment/update/waas-wufb-csp-mdm.md | 21 ++++++++----------- .../update/waas-wufb-group-policy.md | 2 +- .../update/windows-update-error-reference.md | 13 +++++------- .../deployment/update/windows-update-logs.md | 8 ++++--- .../update/windows-update-overview.md | 13 +++++++----- .../update/windows-update-security.md | 11 ++++++---- .../update/wufb-compliancedeadlines.md | 19 ++++++++--------- .../update/wufb-reports-admin-center.md | 11 +++++++--- .../wufb-reports-configuration-intune.md | 15 +++++++------ 10 files changed, 68 insertions(+), 58 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index 0c088b2aee..5ffafc24a9 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -1,23 +1,24 @@ --- title: Manage additional Windows Update settings -description: In this article, learn about additional settings to control the behavior of Windows Update. +description: In this article, learn about additional settings to control the behavior of Windows Update in your organization. ms.prod: windows-client -ms.localizationpriority: medium +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart manager: aaroncz -ms.topic: how-to ms.collection: - highpri - tier2 -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 04/25/2023 --- # Manage additional Windows Update settings -***(Applies to: Windows 11 & Windows 10)*** - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) You can use Group Policy settings or mobile device management (MDM) to configure the behavior of Windows Update on your Windows 10 devices. You can configure the update detection frequency, select when updates are received, specify the update service location and more. diff --git a/windows/deployment/update/waas-wufb-csp-mdm.md b/windows/deployment/update/waas-wufb-csp-mdm.md index fbbb54d9b6..3d79d66cd5 100644 --- a/windows/deployment/update/waas-wufb-csp-mdm.md +++ b/windows/deployment/update/waas-wufb-csp-mdm.md @@ -2,23 +2,20 @@ title: Configure Windows Update for Business by using CSPs and MDM description: Walk through demonstration of how to configure Windows Update for Business settings using Configuration Service Providers and MDM. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 02/28/2023 --- # Walkthrough: Use CSPs and MDMs to configure Windows Update for Business - -**Applies to** - -- Windows 10 -- Windows 11 - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) @@ -176,9 +173,9 @@ There are additional settings that affect the notifications. We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you have set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) policy with these values: -**0** (default) – Use the default Windows Update notifications
        -**1** – Turn off all notifications, excluding restart warnings
        -**2** – Turn off all notifications, including restart warnings +**0** (default) - Use the default Windows Update notifications
        +**1** - Turn off all notifications, excluding restart warnings
        +**2** - Turn off all notifications, including restart warnings > [!NOTE] > Option **2** creates a poor experience for personal devices; it's only recommended for kiosk devices where automatic restarts have been disabled. diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 11cda13e43..7c431a1818 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -195,7 +195,7 @@ Still more options are available in **Computer Configuration > Administrative Te Every Windows device provides users with various controls they can use to manage Windows Updates. They can access these controls by Search to find Windows Updates or by going selecting **Updates and Security** in **Settings**. We provide the ability to disable a variety of these controls that are accessible to users. -Users with access to update pause settings can prevent both feature and quality updates for 7 days. You can prevent users from pausing updates through the Windows Update settings page by using **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Remove access to “Pause updates**. +Users with access to update pause settings can prevent both feature and quality updates for 7 days. You can prevent users from pausing updates through the Windows Update settings page by using **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Remove access to Pause updates**. When you disable this setting, users will see **Some settings are managed by your organization** and the update pause settings are greyed out. If you use Windows Server Update Server (WSUS), you can prevent users from scanning Windows Update. To do this, use **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Remove access to use all Windows Update features**. diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md index 2280794391..ca1a517e89 100644 --- a/windows/deployment/update/windows-update-error-reference.md +++ b/windows/deployment/update/windows-update-error-reference.md @@ -2,23 +2,20 @@ title: Windows Update error code list by component description: Learn about reference information for Windows Update error codes, including automatic update errors, UI errors, and reporter errors. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: reference author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 09/18/2018 -ms.topic: article -ms.technology: itpro-updates --- # Windows Update error codes by component -**Applies to** - -- Windows 10 -- Windows 11 - - This section lists the error codes for Microsoft Windows Update. ## Automatic Update Errors diff --git a/windows/deployment/update/windows-update-logs.md b/windows/deployment/update/windows-update-logs.md index b4ab1cd282..2279f4318c 100644 --- a/windows/deployment/update/windows-update-logs.md +++ b/windows/deployment/update/windows-update-logs.md @@ -2,20 +2,22 @@ title: Windows Update log files description: Learn about the Windows Update log files and how to merge and convert Windows Update trace files (.etl files) into a single readable WindowsUpdate.log file. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: troubleshooting author: mestew ms.author: mstewart manager: aaroncz -ms.topic: troubleshooting ms.collection: - highpri - tier2 -ms.technology: itpro-updates +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 12/31/2017 --- # Windows Update log files ->Applies to: Windows 10 The following table describes the log files created by Windows Update. diff --git a/windows/deployment/update/windows-update-overview.md b/windows/deployment/update/windows-update-overview.md index cf56c12408..7965aa2782 100644 --- a/windows/deployment/update/windows-update-overview.md +++ b/windows/deployment/update/windows-update-overview.md @@ -2,12 +2,15 @@ title: Get started with Windows Update description: An overview of learning resources for Windows Update, including documents on architecture, log files, and common errors. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 09/18/2018 -ms.topic: article -ms.technology: itpro-updates --- # Get started with Windows Update @@ -31,7 +34,7 @@ To understand the changes to the Windows Update architecture that UUP introduces ![Windows Update terminology.](images/update-terminology.png) -- **Update UI** – The user interface to initiate Windows Update check and history. Available under **Settings --> Update & Security --> Windows Update**. +- **Update UI** - The user interface to initiate Windows Update check and history. Available under **Settings --> Update & Security --> Windows Update**. - **Update Session Orchestrator (USO)**- A Windows OS component that orchestrates the sequence of downloading and installing various update types from Windows Update. Update types- @@ -51,5 +54,5 @@ To understand the changes to the Windows Update architecture that UUP introduces Additional components include the following- -- **CompDB** – A generic term to refer to the XML describing information about target build composition, available diff packages, and conditional rules. -- **Action List** – The payload and additional information needed to perform an update. The action list is consumed by the UpdateAgent, as well as other installers to determine what payload to download. It's also consumed by the "Install Agent" to determine what actions need to be taken, such as installing or removing packages. +- **CompDB** - A generic term to refer to the XML describing information about target build composition, available diff packages, and conditional rules. +- **Action List** - The payload and additional information needed to perform an update. The action list is consumed by the UpdateAgent, as well as other installers to determine what payload to download. It's also consumed by the "Install Agent" to determine what actions need to be taken, such as installing or removing packages. diff --git a/windows/deployment/update/windows-update-security.md b/windows/deployment/update/windows-update-security.md index 9cf0c08919..ab1ed81b28 100644 --- a/windows/deployment/update/windows-update-security.md +++ b/windows/deployment/update/windows-update-security.md @@ -1,13 +1,16 @@ --- title: Windows Update security manager: aaroncz -description: Overview of the security for Windows Update. +description: Overview of the security for Windows Update including security for the metadata exchange and content download. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart -ms.topic: article -ms.date: 10/25/2022 -ms.technology: itpro-updates +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +ms.date: 08/28/2023 --- # Windows Update security diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index 96a06feeab..e29c2d0a8e 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -1,22 +1,21 @@ --- -title: Enforce compliance deadlines with policies in Windows Update for Business (Windows 10) +title: Enforce compliance deadlines with policies +titleSuffix: Windows Update for Business description: This article contains information on how to enforce compliance deadlines using Windows Update for Business. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 05/12/2023 --- # Enforcing compliance deadlines for updates -**Applies to** - -- Windows 10 -- Windows 11 - Deploying feature or quality updates for many organizations is only part of the equation for managing their device ecosystem. The ability to enforce update compliance is the next important part. Windows Update for Business provides controls to manage deadlines for when devices should migrate to newer versions. With a current version, it's best to use the new policy introduced in June 2019 to Windows 10, version 1709 and later: **Specify deadlines for automatic updates and restarts**. In MDM, this policy is available as four separate settings: @@ -26,13 +25,13 @@ With a current version, it's best to use the new policy introduced in June 2019 - Update/ConfigureDeadlineGracePeriod - Update/ConfigureDeadlineNoAutoReboot -### Policy setting overview +## Policy setting overview |Policy|Description | |-|-| | (Windows 10, version 1709 and later) Specify deadlines for automatic updates and restarts | This policy includes a deadline and a configurable grace period with the option to opt out of automatic restarts until the deadline is reached. This is the recommended policy for Windows 10, version 1709 and later.| -### Suggested configurations +## Suggested configurations |Policy|Location|Quality update deadline in days|Feature update deadline in days|Grace period in days| |-|-|-|-|-| diff --git a/windows/deployment/update/wufb-reports-admin-center.md b/windows/deployment/update/wufb-reports-admin-center.md index 8d7b1f616c..0e0b313437 100644 --- a/windows/deployment/update/wufb-reports-admin-center.md +++ b/windows/deployment/update/wufb-reports-admin-center.md @@ -1,19 +1,24 @@ --- title: Microsoft 365 admin center software updates page +titleSuffix: Windows Update for Business reports manager: aaroncz description: Microsoft admin center populates Windows Update for Business reports data into the software updates page. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart ms.localizationpriority: medium -ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Update for Business reports +- ✅ Microsoft 365 admin center ms.date: 04/26/2023 -ms.technology: itpro-updates --- # Microsoft 365 admin center software updates page -***(Applies to: Windows 11 & Windows 10 using [Windows Update for Business reports](wufb-reports-overview.md) and the [Microsoft 365 admin center](/microsoft-365/admin/admin-overview/admin-center-overview))*** The **Software updates** page in the [Microsoft 365 admin center](https://admin.microsoft.com) displays a high-level overview of the installation status for Microsoft 365 Apps and Windows updates in your environment. [Quality updates](quality-updates.md) that contain security fixes are typically released on the second Tuesday of each month. Ensuring these updates are installed is important because they help protect you from known vulnerabilities. The **Software updates** page allows you to easily determine the overall update compliance for your devices. diff --git a/windows/deployment/update/wufb-reports-configuration-intune.md b/windows/deployment/update/wufb-reports-configuration-intune.md index dc875c8675..57c5ad98f2 100644 --- a/windows/deployment/update/wufb-reports-configuration-intune.md +++ b/windows/deployment/update/wufb-reports-configuration-intune.md @@ -1,20 +1,23 @@ --- -title: Configuring Microsoft Intune devices for Windows Update for Business reports -manager: aaroncz +title: Configuring Microsoft Intune devices +titleSuffix: Windows Update for Business reports description: Configuring devices that are enrolled in Microsoft Intune for Windows Update for Business reports ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart +manager: aaroncz ms.localizationpriority: medium -ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ managed by Microsoft Intune ms.date: 03/08/2023 -ms.technology: itpro-updates --- # Configuring Microsoft Intune devices for Windows Update for Business reports -***(Applies to: Windows 11 & Windows 10 managed by [Microsoft Intune](/mem/intune/fundamentals/what-is-intune)*** - This article is targeted at configuring devices enrolled to [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) for Windows Update for Business reports, within Microsoft Intune itself. Configuring devices for Windows Update for Business reports in Microsoft Intune breaks down to the following steps: From 972db41c06af87ef362983a6095c5a787b1380f2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 28 Aug 2023 14:32:20 -0700 Subject: [PATCH 105/125] meta2upd --- .../update/windows-update-error-reference.md | 56 +++++++++---------- .../wufb-reports-configuration-intune.md | 2 +- 2 files changed, 29 insertions(+), 29 deletions(-) diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md index ca1a517e89..cf907c749f 100644 --- a/windows/deployment/update/windows-update-error-reference.md +++ b/windows/deployment/update/windows-update-error-reference.md @@ -34,14 +34,14 @@ This section lists the error codes for Microsoft Windows Update. | Error code | Message | Description | |------------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------| -| 0x80243001 | `WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION` | The results of download and installation could not be read from the registry due to an unrecognized data format version. | -| 0x80243002 | `WU_E_INSTALLATION_RESULTS_INVALID_DATA` | The results of download and installation could not be read from the registry due to an invalid data format. | -| 0x80243003 | `WU_E_INSTALLATION_RESULTS_NOT_FOUND` | The results of download and installation are not available; the operation may have failed to start. | +| 0x80243001 | `WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION` | The results of download and installation couldn't be read from the registry due to an unrecognized data format version. | +| 0x80243002 | `WU_E_INSTALLATION_RESULTS_INVALID_DATA` | The results of download and installation couldn't be read from the registry due to an invalid data format. | +| 0x80243003 | `WU_E_INSTALLATION_RESULTS_NOT_FOUND` | The results of download and installation aren't available; the operation may have failed to start. | | 0x80243004 | `WU_E_TRAYICON_FAILURE` | A failure occurred when trying to create an icon in the taskbar notification area. | | 0x80243FFD | `WU_E_NON_UI_MODE` | Unable to show UI when in non-UI mode; Windows Update client UI modules may not be installed. | | 0x80243FFE | `WU_E_WUCLTUI_UNSUPPORTED_VERSION` | Unsupported version of Windows Update client UI exported functions. | | 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | -| 0x8024043D | `WU_E_SERVICEPROP_NOTAVAIL` | The requested service property is not available. | +| 0x8024043D | `WU_E_SERVICEPROP_NOTAVAIL` | The requested service property isn't available. | ## Inventory errors @@ -57,25 +57,25 @@ This section lists the error codes for Microsoft Windows Update. | Error code | Message | Description | |------------|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------| -| 0x8024E001 | `WU_E_EE_UNKNOWN_EXPRESSION` | An expression evaluator operation could not be completed because an expression was unrecognized. | -| 0x8024E002 | `WU_E_EE_INVALID_EXPRESSION` | An expression evaluator operation could not be completed because an expression was invalid. | -| 0x8024E003 | `WU_E_EE_MISSING_METADATA` | An expression evaluator operation could not be completed because an expression contains an incorrect number of metadata nodes. | -| 0x8024E004 | `WU_E_EE_INVALID_VERSION` | An expression evaluator operation could not be completed because the version of the serialized expression data is invalid. | -| 0x8024E005 | `WU_E_EE_NOT_INITIALIZED` | The expression evaluator could not be initialized. | -| 0x8024E006 | `WU_E_EE_INVALID_ATTRIBUTEDATA` | An expression evaluator operation could not be completed because there was an invalid attribute. | -| 0x8024E007 | `WU_E_EE_CLUSTER_ERROR` | An expression evaluator operation could not be completed because the cluster state of the computer could not be determined. | +| 0x8024E001 | `WU_E_EE_UNKNOWN_EXPRESSION` | An expression evaluator operation couldn't be completed because an expression was unrecognized. | +| 0x8024E002 | `WU_E_EE_INVALID_EXPRESSION` | An expression evaluator operation couldn't be completed because an expression was invalid. | +| 0x8024E003 | `WU_E_EE_MISSING_METADATA` | An expression evaluator operation couldn't be completed because an expression contains an incorrect number of metadata nodes. | +| 0x8024E004 | `WU_E_EE_INVALID_VERSION` | An expression evaluator operation couldn't be completed because the version of the serialized expression data is invalid. | +| 0x8024E005 | `WU_E_EE_NOT_INITIALIZED` | The expression evaluator couldn't be initialized. | +| 0x8024E006 | `WU_E_EE_INVALID_ATTRIBUTEDATA` | An expression evaluator operation couldn't be completed because there was an invalid attribute. | +| 0x8024E007 | `WU_E_EE_CLUSTER_ERROR` | An expression evaluator operation couldn't be completed because the cluster state of the computer couldn't be determined. | | 0x8024EFFF | `WU_E_EE_UNEXPECTED` | There was an expression evaluator error not covered by another `WU_E_EE_*` error code. | ## Reporter errors | Error code | Message | Description | |------------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------| -| 0x80247001 | `WU_E_OL_INVALID_SCANFILE` | An operation could not be completed because the scan package was invalid. | -| 0x80247002 | `WU_E_OL_NEWCLIENT_REQUIRED` | An operation could not be completed because the scan package requires a greater version of the Windows Update Agent. | +| 0x80247001 | `WU_E_OL_INVALID_SCANFILE` | An operation couldn't be completed because the scan package was invalid. | +| 0x80247002 | `WU_E_OL_NEWCLIENT_REQUIRED` | An operation couldn't be completed because the scan package requires a greater version of the Windows Update Agent. | | 0x80247FFF | `WU_E_OL_UNEXPECTED` | Search using the scan package failed. | | 0x8024F001 | `WU_E_REPORTER_EVENTCACHECORRUPT` | The event cache file was defective. | -| 0x8024F002 | `WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED` | The XML in the event namespace descriptor could not be parsed. | -| 0x8024F003 | `WU_E_INVALID_EVENT` | The XML in the event namespace descriptor could not be parsed. | +| 0x8024F002 | `WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED` | The XML in the event namespace descriptor couldn't be parsed. | +| 0x8024F003 | `WU_E_INVALID_EVENT` | The XML in the event namespace descriptor couldn't be parsed. | | 0x8024F004 | `WU_E_SERVER_BUSY` | The server rejected an event because the server was too busy. | | 0x8024FFFF | `WU_E_REPORTER_UNEXPECTED` | There was a reporter error not covered by another error code. | @@ -84,7 +84,7 @@ The components that download the `Wuredir.cab` file and then parse the `Wuredir. | Error code | Message | Description | |----------- |------------------------------|------------------------------------------------------------------------------------------| -| 0x80245001 | `WU_E_REDIRECTOR_LOAD_XML` | The redirector XML document could not be loaded into the DOM class. | +| 0x80245001 | `WU_E_REDIRECTOR_LOAD_XML` | The redirector XML document couldn't be loaded into the DOM class. | | 0x80245002 | `WU_E_REDIRECTOR_S_FALSE` | The redirector XML document is missing some required information. | | 0x80245003 | `WU_E_REDIRECTOR_ID_SMALLER` | The redirectorId in the downloaded redirector cab is less than in the cached cab. | | 0x80245FFF | `WU_E_REDIRECTOR_UNEXPECTED` | The redirector failed for reasons not covered by another `WU_E_REDIRECTOR_*` error code. | @@ -121,9 +121,9 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | 0x80244010 | `WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS` | The number of round trips to the server exceeded the maximum limit. | | 0x80244011 | `WU_E_PT_SUS_SERVER_NOT_SET` | WUServer policy value is missing in the registry. | | 0x80244012 | `WU_E_PT_DOUBLE_INITIALIZATION` | Initialization failed because the object was already initialized. | -| 0x80244013 | `WU_E_PT_INVALID_COMPUTER_NAME` | The computer name could not be determined. | +| 0x80244013 | `WU_E_PT_INVALID_COMPUTER_NAME` | The computer name couldn't be determined. | | 0x80244015 | `WU_E_PT_REFRESH_CACHE_REQUIRED` | The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. | -| 0x80244016 | `WU_E_PT_HTTP_STATUS_BAD_REQUEST` | Same as HTTP status 400 - the server could not process the request due to invalid syntax. | +| 0x80244016 | `WU_E_PT_HTTP_STATUS_BAD_REQUEST` | Same as HTTP status 400 - the server couldn't process the request due to invalid syntax. | | 0x80244017 | `WU_E_PT_HTTP_STATUS_DENIED` | Same as HTTP status 401 - the requested resource requires user authentication. | | 0x80244018 | `WU_E_PT_HTTP_STATUS_FORBIDDEN` | Same as HTTP status 403 - server understood the request but declined to fulfill it. | | 0x80244019 | `WU_E_PT_HTTP_STATUS_NOT_FOUND` | Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier). | @@ -144,14 +144,14 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | 0x80244028 | `WU_E_PT_NO_AUTH_COOKIES_CREATED` | Windows Update Agent was unable to create any valid authentication cookies. | | 0x80244029 | `WU_E_PT_INVALID_CONFIG_PROP` | A configuration property value was wrong. | | 0x8024402A | `WU_E_PT_CONFIG_PROP_MISSING` | A configuration property value was missing. | -| 0x8024402B | `WU_E_PT_HTTP_STATUS_NOT_MAPPED` | The HTTP request could not be completed and the reason did not correspond to any of the `WU_E_PT_HTTP_*` error codes. | +| 0x8024402B | `WU_E_PT_HTTP_STATUS_NOT_MAPPED` | The HTTP request couldn't be completed and the reason did not correspond to any of the `WU_E_PT_HTTP_*` error codes. | | 0x8024402C | `WU_E_PT_WINHTTP_NAME_NOT_RESOLVED` | Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved. | | 0x8024402F | `WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS` | External cab file processing completed with some errors. | | 0x80244030 | `WU_E_PT_ECP_INIT_FAILED` | The external cab processor initialization did not complete. | | 0x80244031 | `WU_E_PT_ECP_INVALID_FILE_FORMAT` | The format of a metadata file was invalid. | | 0x80244032 | `WU_E_PT_ECP_INVALID_METADATA` | External cab processor found invalid metadata. | -| 0x80244033 | `WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST` | The file digest could not be extracted from an external cab file. | -| 0x80244034 | `WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE` | An external cab file could not be decompressed. | +| 0x80244033 | `WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST` | The file digest couldn't be extracted from an external cab file. | +| 0x80244034 | `WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE` | An external cab file couldn't be decompressed. | | 0x80244035 | `WU_E_PT_ECP_FILE_LOCATION_ERROR` | External cab processor was unable to get file locations. | | 0x80244FFF | `WU_E_PT_UNEXPECTED` | A communication error not covered by another `WU_E_PT_*` error code. | | 0x8024502D | `WU_E_PT_SAME_REDIR_ID` | Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery. | @@ -161,12 +161,12 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | Error code | Message | Description | |------------|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------| -| 0x80246001 | `WU_E_DM_URLNOTAVAILABLE` | A download manager operation could not be completed because the requested file does not have a URL. | -| 0x80246002 | `WU_E_DM_INCORRECTFILEHASH` | A download manager operation could not be completed because the file digest was not recognized. | -| 0x80246003 | `WU_E_DM_UNKNOWNALGORITHM` | A download manager operation could not be completed because the file metadata requested an unrecognized hash algorithm. | -| 0x80246004 | `WU_E_DM_NEEDDOWNLOADREQUEST` | An operation could not be completed because a download request is required from the download handler. | -| 0x80246005 | `WU_E_DM_NONETWORK` | A download manager operation could not be completed because the network connection was unavailable. | -| 0x80246006 | `WU_E_DM_WRONGBITSVERSION` | A download manager operation could not be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. | +| 0x80246001 | `WU_E_DM_URLNOTAVAILABLE` | A download manager operation couldn't be completed because the requested file does not have a URL. | +| 0x80246002 | `WU_E_DM_INCORRECTFILEHASH` | A download manager operation couldn't be completed because the file digest was not recognized. | +| 0x80246003 | `WU_E_DM_UNKNOWNALGORITHM` | A download manager operation couldn't be completed because the file metadata requested an unrecognized hash algorithm. | +| 0x80246004 | `WU_E_DM_NEEDDOWNLOADREQUEST` | An operation couldn't be completed because a download request is required from the download handler. | +| 0x80246005 | `WU_E_DM_NONETWORK` | A download manager operation couldn't be completed because the network connection was unavailable. | +| 0x80246006 | `WU_E_DM_WRONGBITSVERSION` | A download manager operation couldn't be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. | | 0x80246007 | `WU_E_DM_NOTDOWNLOADED` | The update has not been downloaded. | | 0x80246008 | `WU_E_DM_FAILTOCONNECTTOBITS` | A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). | | 0x80246009 | `WU_E_DM_BITSTRANSFERERROR` | A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error. | @@ -178,7 +178,7 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | Error code | Message | Description | |------------|----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| -| 0x80242000 | `WU_E_UH_REMOTEUNAVAILABLE` | A request for a remote update handler could not be completed because no remote process is available. | +| 0x80242000 | `WU_E_UH_REMOTEUNAVAILABLE` | A request for a remote update handler couldn't be completed because no remote process is available. | | 0x80242001 | `WU_E_UH_LOCALONLY` | A request for a remote update handler could not be completed because the handler is local only. | | 0x80242002 | `WU_E_UH_UNKNOWNHANDLER` | A request for an update handler could not be completed because the handler could not be recognized. | | 0x80242003 | `WU_E_UH_REMOTEALREADYACTIVE` | A remote update handler could not be created because one already exists. | diff --git a/windows/deployment/update/wufb-reports-configuration-intune.md b/windows/deployment/update/wufb-reports-configuration-intune.md index 57c5ad98f2..1bd96158cf 100644 --- a/windows/deployment/update/wufb-reports-configuration-intune.md +++ b/windows/deployment/update/wufb-reports-configuration-intune.md @@ -12,7 +12,7 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -- ✅ managed by Microsoft Intune +- ✅ devices managed by Microsoft Intune ms.date: 03/08/2023 --- From 27d5e4ac4304dd763917db786d1fb01b41956dd5 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 28 Aug 2023 14:48:10 -0700 Subject: [PATCH 106/125] meta2upd --- .../deployment/update/wufb-reports-configuration-intune.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/wufb-reports-configuration-intune.md b/windows/deployment/update/wufb-reports-configuration-intune.md index 1bd96158cf..1756de73a9 100644 --- a/windows/deployment/update/wufb-reports-configuration-intune.md +++ b/windows/deployment/update/wufb-reports-configuration-intune.md @@ -10,9 +10,8 @@ ms.author: mstewart manager: aaroncz ms.localizationpriority: medium appliesto: -- ✅ Windows 11 -- ✅ Windows 10 -- ✅ devices managed by Microsoft Intune +- ✅ Windows 11 and Windows 10 +- devices managed by Microsoft Intune ms.date: 03/08/2023 --- From eff163e72d61db95f6023325757f86f1869a0e92 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 28 Aug 2023 14:50:59 -0700 Subject: [PATCH 107/125] meta2upd --- .../deployment/update/wufb-reports-configuration-intune.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/wufb-reports-configuration-intune.md b/windows/deployment/update/wufb-reports-configuration-intune.md index 1756de73a9..f687ea54b4 100644 --- a/windows/deployment/update/wufb-reports-configuration-intune.md +++ b/windows/deployment/update/wufb-reports-configuration-intune.md @@ -1,7 +1,7 @@ --- title: Configuring Microsoft Intune devices titleSuffix: Windows Update for Business reports -description: Configuring devices that are enrolled in Microsoft Intune for Windows Update for Business reports +description: How to configure devices to use Windows Update for Business reports from Microsoft Intune. ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -10,8 +10,7 @@ ms.author: mstewart manager: aaroncz ms.localizationpriority: medium appliesto: -- ✅ Windows 11 and Windows 10 -- devices managed by Microsoft Intune +- ✅ Windows 11 and Windows 10 devices managed by Microsoft Intune ms.date: 03/08/2023 --- From 3362219a1f9b4d4fe6473b69fa8b89730ef0cfbf Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 28 Aug 2023 14:51:32 -0700 Subject: [PATCH 108/125] meta2upd --- windows/deployment/update/wufb-reports-configuration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-configuration-intune.md b/windows/deployment/update/wufb-reports-configuration-intune.md index f687ea54b4..395856651d 100644 --- a/windows/deployment/update/wufb-reports-configuration-intune.md +++ b/windows/deployment/update/wufb-reports-configuration-intune.md @@ -1,5 +1,5 @@ --- -title: Configuring Microsoft Intune devices +title: Configure devices using Microsoft Intune titleSuffix: Windows Update for Business reports description: How to configure devices to use Windows Update for Business reports from Microsoft Intune. ms.prod: windows-client From f0bcc4be7fd7076f44a60ef8e15c7dfcd17381d9 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 28 Aug 2023 15:28:33 -0700 Subject: [PATCH 109/125] meta3upd --- .../update/wufb-reports-configuration-manual.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/windows/deployment/update/wufb-reports-configuration-manual.md b/windows/deployment/update/wufb-reports-configuration-manual.md index 1d156ad5b7..d0a105f319 100644 --- a/windows/deployment/update/wufb-reports-configuration-manual.md +++ b/windows/deployment/update/wufb-reports-configuration-manual.md @@ -1,19 +1,23 @@ --- -title: Manually configuring devices for Windows Update for Business reports -manager: aaroncz -description: How to manually configure devices for Windows Update for Business reports +title: Manually configure devices to send data +titleSuffix: Windows Update for Business reports +description: How to manually configure devices for Windows Update for Business reports using a PowerShell script. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart +manager: aaroncz ms.localizationpriority: medium ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 11/15/2022 -ms.technology: itpro-updates --- # Manually configuring devices for Windows Update for Business reports -***(Applies to: Windows 11 & Windows 10)*** There are a number of requirements to consider when manually configuring devices for Windows Update for Business reports. These requirements can potentially change with newer versions of Windows client. The [Windows Update for Business reports configuration script](wufb-reports-configuration-script.md) will be updated when any configuration requirements change so only a redeployment of the script will be required. From 8ea37be708416c5801b0f123dddfa1f763dbcfeb Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 28 Aug 2023 15:40:44 -0700 Subject: [PATCH 110/125] meta3upd --- .../update/wufb-reports-configuration-script.md | 15 +++++++++------ windows/deployment/update/wufb-reports-do.md | 17 ++++++++++------- .../deployment/update/wufb-reports-enable.md | 14 ++++++++------ windows/deployment/update/wufb-reports-faq.yml | 7 ++++--- windows/deployment/update/wufb-reports-help.md | 17 +++++++++-------- .../deployment/update/wufb-reports-overview.md | 12 +++++++----- 6 files changed, 47 insertions(+), 35 deletions(-) diff --git a/windows/deployment/update/wufb-reports-configuration-script.md b/windows/deployment/update/wufb-reports-configuration-script.md index 69feacba6f..10af47e205 100644 --- a/windows/deployment/update/wufb-reports-configuration-script.md +++ b/windows/deployment/update/wufb-reports-configuration-script.md @@ -1,19 +1,22 @@ --- -title: Windows Update for Business reports configuration script -manager: aaroncz -description: Downloading and using the Windows Update for Business reports configuration script +title: Configure clients with a script +titleSuffix: Windows Update for Business reports +description: How to get and use the Windows Update for Business reports configuration script to configure devices for Windows Update for Business reports. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart +manager: aaroncz ms.localizationpriority: medium -ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 07/11/2023 -ms.technology: itpro-updates --- # Configuring devices through the Windows Update for Business reports configuration script -***(Applies to: Windows 11 & Windows 10)*** The Windows Update for Business reports configuration script is the recommended method of configuring devices to send data to Microsoft for use with Windows Update for Business reports. The script configures the registry keys backing policies, ensures required services are running, and more. This script is a recommended complement to configuring the required policies documented in [Manually configure devices for Windows Update for Business reports](wufb-reports-configuration-manual.md), as it can provide feedback on whether there are any configuration issues outside of policies being configured. diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index ddb2f0861d..05cfa795ab 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -1,19 +1,22 @@ --- -title: Delivery Optimization data in Windows Update for Business reports -manager: aaroncz -description: Provides information about Delivery Optimization data in Windows Update for Business reports +title: Delivery Optimization data in reports +titleSuffix: Windows Update for Business reports +description: This article provides information about Delivery Optimization data in Windows Update for Business reports. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart -ms.topic: article +manager: aaroncz +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 04/12/2023 -ms.technology: itpro-updates --- # Delivery Optimization data in Windows Update for Business reports - -***(Applies to: Windows 11 & Windows 10)*** [Delivery Optimization](../do/waas-delivery-optimization.md) (DO) is a Windows feature that can be used to reduce bandwidth consumption by sharing the work of downloading updates among multiple devices in your environment. You can use DO with many other deployment methods, but it's a cloud-managed solution, and access to the DO cloud services is a requirement. diff --git a/windows/deployment/update/wufb-reports-enable.md b/windows/deployment/update/wufb-reports-enable.md index c29c9dced3..27a5b5ad14 100644 --- a/windows/deployment/update/wufb-reports-enable.md +++ b/windows/deployment/update/wufb-reports-enable.md @@ -1,19 +1,21 @@ --- title: Enable Windows Update for Business reports -manager: aaroncz -description: How to enable Windows Update for Business reports through the Azure portal +titleSuffix: Windows Update for Business reports +description: How to enable the Windows Update for Business reports service through the Azure portal or the Microsoft 365 admin center. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart -ms.topic: article +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 07/11/2023 -ms.technology: itpro-updates --- # Enable Windows Update for Business reports -***(Applies to: Windows 11 & Windows 10)*** - After verifying the [prerequisites](wufb-reports-prerequisites.md) are met, you can start to set up Windows Update for Business reports. The two main steps for setting up Windows Update for Business reports are: 1. [Add Windows Update for Business reports](#bkmk_add) to your Azure subscription. This step has the following phases: diff --git a/windows/deployment/update/wufb-reports-faq.yml b/windows/deployment/update/wufb-reports-faq.yml index 98ba761d81..60f9460966 100644 --- a/windows/deployment/update/wufb-reports-faq.yml +++ b/windows/deployment/update/wufb-reports-faq.yml @@ -1,14 +1,15 @@ ### YamlMime:FAQ metadata: - title: Windows Update for Business reports - Frequently Asked Questions (FAQ) + title: Frequently Asked Questions (FAQ) + titleSuffix: Windows Update for Business reports description: Answers to frequently asked questions about Windows Update for Business reports. ms.prod: windows-client + ms.technology: itpro-updates ms.topic: faq - ms.date: 06/20/2023 manager: aaroncz author: mestew ms.author: mstewart - ms.technology: itpro-updates + ms.date: 06/20/2023 title: Frequently Asked Questions about Windows Update for Business reports summary: | This article answers frequently asked questions about Windows Update for Business reports. diff --git a/windows/deployment/update/wufb-reports-help.md b/windows/deployment/update/wufb-reports-help.md index 90184b8f3e..49268fb5a7 100644 --- a/windows/deployment/update/wufb-reports-help.md +++ b/windows/deployment/update/wufb-reports-help.md @@ -1,20 +1,21 @@ --- -title: Windows Update for Business reports feedback, support, and troubleshooting -manager: aaroncz -description: Windows Update for Business reports support information. +title: Feedback, support, and troubleshooting +titleSuffix: Windows Update for Business reports +description: Windows Update for Business reports support, feedback, and troubleshooting information. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: article author: mestew ms.author: mstewart -ms.topic: article +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 02/10/2023 -ms.technology: itpro-updates --- # Windows Update for Business reports feedback, support, and troubleshooting - -***(Applies to: Windows 11 & Windows 10)*** - There are several resources that you can use to find help with Windows Update for Business reports. Whether you're just getting started or an experienced administrator, use the following resources when you need help with Windows Update for Business reports: - Send [product feedback about Windows Update for Business reports](#send-product-feedback) diff --git a/windows/deployment/update/wufb-reports-overview.md b/windows/deployment/update/wufb-reports-overview.md index 13c5e19777..a4321c74d6 100644 --- a/windows/deployment/update/wufb-reports-overview.md +++ b/windows/deployment/update/wufb-reports-overview.md @@ -1,19 +1,21 @@ --- title: Windows Update for Business reports overview -manager: aaroncz +titleSuffix: Windows Update for Business reports description: Overview of Windows Update for Business reports to explain what it's used for and the cloud services it relies on. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: overview author: mestew ms.author: mstewart -ms.topic: article +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 11/15/2022 -ms.technology: itpro-updates --- # Windows Update for Business reports overview -***(Applies to: Windows 11 & Windows 10)*** - Windows Update for Business reports is a cloud-based solution that provides information about your Azure Active Directory-joined devices' compliance with Windows updates. Windows Update for Business reports is offered through the [Azure portal](https://portal.azure.com), and it's included as part of the Windows 10 or Windows 11 prerequisite licenses. Windows Update for Business reports helps you: - Monitor security, quality, driver, and feature updates for Windows 11 and Windows 10 devices From 330f229594c29410168d579f7a2b6ac2b586d0a8 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 28 Aug 2023 16:16:54 -0700 Subject: [PATCH 111/125] meta3upd --- .../update/wufb-reports-prerequisites.md | 12 +++++++----- .../update/wufb-reports-schema-ucclient.md | 18 +++++++++++------- ...-reports-schema-ucclientreadinessstatus.md | 17 +++++++++++------ ...ufb-reports-schema-ucclientupdatestatus.md | 17 +++++++++++------ .../wufb-reports-schema-ucdevicealert.md | 18 +++++++++++------- ...ufb-reports-schema-ucdoaggregatedstatus.md | 19 ++++++++++++------- .../update/wufb-reports-schema-ucdostatus.md | 19 +++++++++++-------- ...fb-reports-schema-ucserviceupdatestatus.md | 18 +++++++++++------- .../wufb-reports-schema-ucupdatealert.md | 18 +++++++++++------- .../deployment/update/wufb-reports-schema.md | 16 +++++++++------- windows/deployment/update/wufb-reports-use.md | 12 +++++++----- .../update/wufb-reports-workbook.md | 15 ++++++++------- windows/deployment/update/wufb-wsus.md | 18 ++++++++---------- 13 files changed, 128 insertions(+), 89 deletions(-) diff --git a/windows/deployment/update/wufb-reports-prerequisites.md b/windows/deployment/update/wufb-reports-prerequisites.md index bdd9e61896..742a32e9c3 100644 --- a/windows/deployment/update/wufb-reports-prerequisites.md +++ b/windows/deployment/update/wufb-reports-prerequisites.md @@ -1,19 +1,21 @@ --- title: Windows Update for Business reports prerequisites -manager: aaroncz +titleSuffix: Windows Update for Business reports description: Prerequisites for Windows Update for Business reports ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart -ms.topic: article +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 06/27/2023 -ms.technology: itpro-updates --- # Windows Update for Business reports prerequisites -***(Applies to: Windows 11 & Windows 10)*** - Before you begin the process of adding Windows Update for Business reports to your Azure subscription, ensure you meet the prerequisites. ## Azure and Azure Active Directory diff --git a/windows/deployment/update/wufb-reports-schema-ucclient.md b/windows/deployment/update/wufb-reports-schema-ucclient.md index 364bed3d49..6cf7e6e2a8 100644 --- a/windows/deployment/update/wufb-reports-schema-ucclient.md +++ b/windows/deployment/update/wufb-reports-schema-ucclient.md @@ -1,21 +1,25 @@ --- -title: Windows Update for Business reports Data Schema - UCClient -manager: aaroncz -description: UCClient schema +title: UCClient data schema +titleSuffix: Windows Update for Business reports +description: UCClient schema for Windows Update for Business reports. UCClient acts as an individual device's record. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: reference author: mestew ms.author: mstewart -ms.topic: reference +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 08/09/2023 -ms.technology: itpro-updates --- # UCClient -***(Applies to: Windows 11 & Windows 10)*** - UCClient acts as an individual device's record. It contains data such as the currently installed build, the device's name, the OS edition, and active hours (quantitative). +## Schema for UCClient + |Field |Type |Example |Description | |---|---|---|---| | **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD Device ID | diff --git a/windows/deployment/update/wufb-reports-schema-ucclientreadinessstatus.md b/windows/deployment/update/wufb-reports-schema-ucclientreadinessstatus.md index de73ebfc5b..2e6bcaa89c 100644 --- a/windows/deployment/update/wufb-reports-schema-ucclientreadinessstatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucclientreadinessstatus.md @@ -1,21 +1,26 @@ --- -title: Windows Update for Business reports Data Schema - UCClientReadinessStatus -manager: aaroncz -description: UCClientReadinessStatus schema +title: UCClientReadinessStatus data schema +titleSuffix: Windows Update for Business reports +description: UCClientReadinessStatus schema for Windows Update for Business reports. UCClientReadinessStatus is an individual device's record about Windows 11 readiness. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: reference author: mestew ms.author: mstewart -ms.topic: reference +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 06/06/2022 -ms.technology: itpro-updates --- # UCClientReadinessStatus -***(Applies to: Windows 10)*** UCClientReadinessStatus is an individual device's record about its readiness for updating to Windows 11. If the device isn't capable of running Windows 11, the record includes which Windows 11 [hardware requirements](/windows/whats-new/windows-11-requirements#hardware-requirements) the device doesn't meet. +## Schema for UCClientReadinessStatus + |Field |Type |Example |Description | |---|---|---|---| | **DeviceName** | [string](/azure/kusto/query/scalar-data-types/string) | `JohnPC-Contoso` | Client-provided device name | diff --git a/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md b/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md index 1c71d9d355..1373eed6d6 100644 --- a/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md @@ -1,21 +1,26 @@ --- -title: Windows Update for Business reports Data Schema - UCClientUpdateStatus -manager: aaroncz -description: UCClientUpdateStatus schema +title: UCClientUpdateStatus data schema +titleSuffix: Windows Update for Business reports +description: UCClientUpdateStatus schema for Windows Update for Business reports. UCClientUpdateStatus combines the latest client-based data with the latest service data. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: reference author: mestew ms.author: mstewart -ms.topic: reference +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 06/05/2023 -ms.technology: itpro-updates --- # UCClientUpdateStatus -***(Applies to: Windows 11 & Windows 10)*** Update Event that combines the latest client-based data with the latest service-based data to create a complete picture for one device (client) and one update. +## Schema for UCClientUpdateStatus + | Field | Type | Example | Description | |---|---|---|---| | **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | A string corresponding to the Azure AD tenant to which the device belongs. | diff --git a/windows/deployment/update/wufb-reports-schema-ucdevicealert.md b/windows/deployment/update/wufb-reports-schema-ucdevicealert.md index e515e80e13..8c95d45cd9 100644 --- a/windows/deployment/update/wufb-reports-schema-ucdevicealert.md +++ b/windows/deployment/update/wufb-reports-schema-ucdevicealert.md @@ -1,21 +1,25 @@ --- -title: Windows Update for Business reports Data Schema - UCDeviceAlert -manager: aaroncz -description: UCDeviceAlert schema +title: UCDeviceAlert data schema +titleSuffix: Windows Update for Business reports +description: UCDeviceAlert schema for Windows Update for Business reports. UCDeviceAlert is an individual device's record about an alert. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: reference author: mestew ms.author: mstewart -ms.topic: reference +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 06/06/2022 -ms.technology: itpro-updates --- # UCDeviceAlert -***(Applies to: Windows 11 & Windows 10)*** - These alerts are activated as a result of an issue that is device-specific. It isn't specific to the combination of a specific update and a specific device. Like UpdateAlerts, the AlertType indicates where the Alert comes from (ServiceDeviceAlert, ClientDeviceAlert). For example, an EndOfService alert is a ClientDeviceAlert, as a build no longer being serviced (EOS) is a client-wide state. Meanwhile, DeviceRegistrationIssues in the Windows Update for Business deployment service will be a ServiceDeviceAlert, as it's a device-wide state in the service to not be correctly registered. +# Schema for UCDeviceAlert + |Field |Type |Example |Description | |---|---|---|---| | **AlertClassification** | [string](/azure/kusto/query/scalar-data-types/string) | `Error` | Whether this alert is an Error, a Warning, or Informational | diff --git a/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md b/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md index 25c5d1ae59..3a05686271 100644 --- a/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md @@ -1,22 +1,27 @@ --- -title: Windows Update for Business reports Data Schema - UCDOAggregatedStatus -ms.reviewer: carmenf -manager: aaroncz -description: UCDOAggregatedStatus schema +title: UCDOAggregatedStatus data schema +titleSuffix: Windows Update for Business reports +description: UCDOAggregatedStatus schema for Windows Update for Business reports. UCDOAggregatedStatus is an aggregation of all UDDOStatus records across the tenant. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: reference author: mestew ms.author: mstewart -ms.topic: reference +manager: aaroncz +ms.reviewer: carmenf +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 11/17/2022 -ms.technology: itpro-updates --- # UCDOAggregatedStatus -***(Applies to: Windows 11 & Windows 10)*** UCDOAggregatedStatus is an aggregation of all individual UDDOStatus records across the tenant and summarizes bandwidth savings across all devices enrolled using [Delivery Optimization and Microsoft Connected Cache](/windows/deployment/do). +# Schema for UCDOAggregatedStatus + |Field |Type |Example |Description | |---|---|---|---| | **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD Device ID | diff --git a/windows/deployment/update/wufb-reports-schema-ucdostatus.md b/windows/deployment/update/wufb-reports-schema-ucdostatus.md index 7897c27f1c..a76acc8512 100644 --- a/windows/deployment/update/wufb-reports-schema-ucdostatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucdostatus.md @@ -1,22 +1,25 @@ --- -title: Windows Update for Business reports Data Schema - UCDOStatus -ms.reviewer: carmenf -manager: aaroncz -description: UCDOStatus schema +title: UCDOStatus data schema +titleSuffix: Windows Update for Business reports +description: UCDOStatus schema for Windows Update for Business reports. UCDOStatus provides information, for a single device, on its DO and MCC bandwidth utilization. ms.prod: windows-client +ms.topic: reference author: mestew ms.author: mstewart -ms.topic: reference +manager: aaroncz +ms.reviewer: carmenf +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 11/17/2022 -ms.technology: itpro-updates --- # UCDOStatus -***(Applies to: Windows 11 & Windows 10)*** - UCDOStatus provides information, for a single device, on its bandwidth utilization across content types in the event they use [Delivery Optimization and Microsoft Connected Cache](/windows/deployment/do). +## Data schema for UCDOStatus + |Field |Type |Example |Description | |---|---|---|---| | **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD Device ID | diff --git a/windows/deployment/update/wufb-reports-schema-ucserviceupdatestatus.md b/windows/deployment/update/wufb-reports-schema-ucserviceupdatestatus.md index 8e8e34ea82..52989b6baf 100644 --- a/windows/deployment/update/wufb-reports-schema-ucserviceupdatestatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucserviceupdatestatus.md @@ -1,21 +1,25 @@ --- -title: Windows Update for Business reports Data Schema - UCServiceUpdateStatus -manager: aaroncz -description: UCServiceUpdateStatus schema +title: UCServiceUpdateStatus data schema +titleSuffix: Windows Update for Business reports +description: UCServiceUpdateStatus schema for Windows Update for Business reports. UCServiceUpdateStatus has service-side information for one device and one update. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: reference author: mestew ms.author: mstewart -ms.topic: reference +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 06/06/2022 -ms.technology: itpro-updates --- # UCServiceUpdateStatus -***(Applies to: Windows 11 & Windows 10)*** - Update Event that comes directly from the service-side. The event has only service-side information for one device (client), and one update, in one deployment. This event has certain fields removed from it in favor of being able to show data in near real time. +## Schema for UCServiceUpdateStatus + | Field | Type | Example | Description | |---|---|---|---| | **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | If this DeviceUpdateEvent is from content deployed by a deployment scheduler service policy, this GUID will map to that policy, otherwise it will be empty. | diff --git a/windows/deployment/update/wufb-reports-schema-ucupdatealert.md b/windows/deployment/update/wufb-reports-schema-ucupdatealert.md index db70047ed0..c85d070cc9 100644 --- a/windows/deployment/update/wufb-reports-schema-ucupdatealert.md +++ b/windows/deployment/update/wufb-reports-schema-ucupdatealert.md @@ -1,21 +1,25 @@ --- -title: Windows Update for Business reports Data Schema - UCUpdateAlert -manager: aaroncz -description: UCUpdateAlert schema +title: UCUpdateAlert data schema +titleSuffix: Windows Update for Business reports +description: UCUpdateAlert schema for Windows Update for Business reports. UCUpdateAlert is an alert for both client and service updates. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: reference author: mestew ms.author: mstewart -ms.topic: reference +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 06/06/2022 -ms.technology: itpro-updates --- # UCUpdateAlert -***(Applies to: Windows 11 & Windows 10)*** - Alert for both client and service updates. Contains information that needs attention, relative to one device (client), one update, and one deployment (if relevant). Certain fields may be blank depending on the UpdateAlert's AlertType field; for example, ServiceUpdateAlert won't necessarily contain client-side statuses. +## Schema for UCUpdateAlert + |Field |Type |Example |Description | |---|---|---|---| | **AlertClassification** | [string](/azure/kusto/query/scalar-data-types/string) | `Error` | Whether this alert is an Error, a Warning, or Informational | diff --git a/windows/deployment/update/wufb-reports-schema.md b/windows/deployment/update/wufb-reports-schema.md index cbcae6c319..05721c32db 100644 --- a/windows/deployment/update/wufb-reports-schema.md +++ b/windows/deployment/update/wufb-reports-schema.md @@ -1,19 +1,21 @@ --- title: Windows Update for Business reports data schema -manager: aaroncz -description: An overview of Windows Update for Business reports data schema +titleSuffix: Windows Update for Business reports +description: An overview of Windows Update for Business reports data schema to power additional dashboards and data analysis tools. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: reference author: mestew ms.author: mstewart -ms.topic: reference +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 11/15/2022 -ms.technology: itpro-updates --- -# Windows Update for Business reports schema +# Windows Update for Business reports schema -***(Applies to: Windows 11 & Windows 10)*** - When the visualizations provided in the default experience don't fulfill your reporting needs, or if you need to troubleshoot issues with devices, it's valuable to understand the schema for Windows Update for Business reports and have a high-level understanding of the capabilities of [Azure Monitor log queries](/azure/azure-monitor/log-query/query-language) to power additional dashboards, integration with external data analysis tools, automated alerting, and more. ## Schema diff --git a/windows/deployment/update/wufb-reports-use.md b/windows/deployment/update/wufb-reports-use.md index 6b58c8cffb..2b4f1b8b1a 100644 --- a/windows/deployment/update/wufb-reports-use.md +++ b/windows/deployment/update/wufb-reports-use.md @@ -1,19 +1,21 @@ --- title: Use the Windows Update for Business reports data -manager: aaroncz +titleSuffix: Windows Update for Business reports description: How to use the Windows Update for Business reports data for custom solutions using tools like Azure Monitor Logs. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart -ms.topic: article +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 11/15/2022 -ms.technology: itpro-updates --- # Use Windows Update for Business reports -***(Applies to: Windows 11 & Windows 10)*** - In this article, you'll learn how to use Windows Update for Business reports to monitor Windows updates for your devices. To configure your environment for use with Windows Update for Business reports, see [Enable Windows Update for Business reports](wufb-reports-enable.md). ## Display Windows Update for Business reports data diff --git a/windows/deployment/update/wufb-reports-workbook.md b/windows/deployment/update/wufb-reports-workbook.md index df61f9ca36..d024ceda0d 100644 --- a/windows/deployment/update/wufb-reports-workbook.md +++ b/windows/deployment/update/wufb-reports-workbook.md @@ -1,20 +1,21 @@ --- title: Use the workbook for Windows Update for Business reports -manager: aaroncz -description: How to use the Windows Update for Business reports workbook. +titleSuffix: Windows Update for Business reports +description: How to use the Windows Update for Business reports workbook from the Azure portal. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew ms.author: mstewart -ms.topic: article +manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 ms.date: 06/23/2023 -ms.technology: itpro-updates --- # Windows Update for Business reports workbook -***(Applies to: Windows 11 & Windows 10)*** - - [Windows Update for Business reports](wufb-reports-overview.md) presents information commonly needed by updates administrators in an easy-to-use format. Windows Update for Business reports uses [Azure Workbooks](/azure/azure-monitor/visualize/workbooks-getting-started) to give you a visual representation of your compliance data. The workbook is broken down into tab sections: - [Summary](#summary-tab) diff --git a/windows/deployment/update/wufb-wsus.md b/windows/deployment/update/wufb-wsus.md index c6bd179c95..d6c5cd1459 100644 --- a/windows/deployment/update/wufb-wsus.md +++ b/windows/deployment/update/wufb-wsus.md @@ -2,22 +2,20 @@ title: Use Windows Update for Business and Windows Server Update Services (WSUS) together description: Learn how to use Windows Update for Business and WSUS together using the new scan source policy. ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: conceptual author: mestew -ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.localizationpriority: medium +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +ms.date: 01/13/2022 --- # Use Windows Update for Business and WSUS together -**Applies to** - -- Windows 10 -- Windows 11 - > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) The Windows update scan source policy enables you to choose what types of updates to get from either [WSUS](waas-manage-updates-wsus.md) or Windows Update for Business service. @@ -79,4 +77,4 @@ The policy can be configured using the following two methods: > [!NOTE] -> Editing the registry to change the behavior of update policies isn't recommended. Use Group Policy or the Configuration Service Provider (CSP) policy instead of directly writing to the registry. However, if you choose to edit the registry, ensure you've configured the `UseUpdateClassPolicySource` registry key too, or the scan source won't be alterred. +> Editing the registry to change the behavior of update policies isn't recommended. Use Group Policy or the Configuration Service Provider (CSP) policy instead of directly writing to the registry. However, if you choose to edit the registry, ensure you've configured the `UseUpdateClassPolicySource` registry key too, or the scan source won't be altered. From 67f6b1b053ac016bd8ee641192efead4b377a73a Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Mon, 28 Aug 2023 17:39:46 -0700 Subject: [PATCH 112/125] refresh and rename app overview --- ...ection.windows-application-management.json | 11 +- .../apps-in-windows-10.md | 160 -------------- windows/application-management/index.yml | 2 +- .../overview-windows-apps.md | 200 ++++++++++++++++++ windows/application-management/toc.yml | 2 +- .../client-tools/mandatory-user-profile.md | 2 +- windows/whats-new/windows-11-overview.md | 2 +- 7 files changed, 212 insertions(+), 167 deletions(-) delete mode 100644 windows/application-management/apps-in-windows-10.md create mode 100644 windows/application-management/overview-windows-apps.md diff --git a/.openpublishing.redirection.windows-application-management.json b/.openpublishing.redirection.windows-application-management.json index 963abce1b0..4b1866c772 100644 --- a/.openpublishing.redirection.windows-application-management.json +++ b/.openpublishing.redirection.windows-application-management.json @@ -7,17 +7,22 @@ }, { "source_path": "windows/application-management/msix-app-packaging-tool.md", - "redirect_url": "/windows/application-management/apps-in-windows-10", + "redirect_url": "/windows/application-management/overview-windows-apps", "redirect_document_id": false }, { "source_path": "windows/application-management/provisioned-apps-windows-client-os.md", - "redirect_url": "/windows/application-management/apps-in-windows-10", + "redirect_url": "/windows/application-management/overview-windows-apps#windows-apps", "redirect_document_id": false }, { "source_path": "windows/application-management/system-apps-windows-client-os.md", - "redirect_url": "/windows/application-management/apps-in-windows-10", + "redirect_url": "/windows/application-management/overview-windows-apps#windows-apps", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/apps-in-windows-10.md", + "redirect_url": "/windows/application-management/overview-windows-apps", "redirect_document_id": false } ] diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md deleted file mode 100644 index d8e784b9e5..0000000000 --- a/windows/application-management/apps-in-windows-10.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -title: Overview of apps on Windows client devices -description: Learn more and understand the different types of apps that run on Windows 10 and Windows 11. For example, learn more about UWP, WPF, Win32, and Windows Forms apps, including the best way to install these apps. -author: aczechowski -ms.author: aaroncz -manager: aaroncz -ms.date: 02/09/2023 -ms.topic: overview -ms.prod: windows-client -ms.technology: itpro-apps -ms.localizationpriority: medium -ms.collection: tier2 -appliesto: - - ✅ Windows 11 - - ✅ Windows 10 ---- - -# Overview of apps on Windows client devices - -## Before you begin - -As organizations become more global, and to support employees working from anywhere, it's recommended to use a Mobile Device Management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. You can use the Microsoft Intune family of products. This family includes Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises. - -In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started: - -- [Endpoint Management at Microsoft](/mem/endpoint-manager-overview) -- [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide) -- [What is Configuration Manager?](/mem/configmgr/core/understand/introduction) - -## App types - -There are different types of apps that can run on your Windows client devices. This section lists some of the common apps used on Windows devices. - -- **Microsoft 365 apps**: These apps are used for business and productivity, and include Outlook, Word, Teams, OneNote, and more. Depending on the licenses your organization has, you may already have these apps. When you use an MDM provider, these apps can also be deployed to mobile devices, including smartphones. - - For more information on the Microsoft 365 license options, and what you get, see [Transform your enterprise with Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans). - -- **Power Apps**: These apps connect to business data available online and on-premises, and can run in a web browser, and on mobile devices. They can be created by business analysts and professional developers. For more information, see [What is Power Apps?](/powerapps/powerapps-overview). - -- **.NET apps**: These apps can be desktop apps that run on the device, or web apps. Some common .NET apps include: - - - **Windows Presentation Foundation (WPF)**: Using .NET, you can create a WPF desktop app that runs on the device, or create a WPF web app. This app is commonly used by organizations that create line of business (LOB) desktop apps. For more information, see [WPF Application Development](/dotnet/desktop/wpf/app-development). - - **Windows Forms (WinForm)**: Using .NET, you can create a Windows Forms desktop app that runs on the device, and doesn't require a web browser or internet access. Just like Win32 apps, WinForm apps can access the local hardware and file system of the computer where the app is running. For more information, see [Desktop Guide (Windows Forms .NET)](/dotnet/desktop/winforms/overview). - -- **Windows apps**: - - > [!TIP] - > Starting with Windows 10, you can use the **Windows UI Library (WinUI 3)** to create .NET, Win32 desktop, and UWP apps. This library includes native Windows UI controls and other user interface elements familiar to Windows users. For more information, see [Windows UI Library (WinUI)](/windows/apps/winui/). - - - **Apps**: All apps installed in `C:\Program Files\WindowsApps`. There are two classes of apps: - - - **Provisioned**: Installed in user account the first time you sign in with a new user account. To get a list of all the provisioned apps, use Windows PowerShell: `Get-AppxProvisionedPackage -Online | Format-Table DisplayName, PackageName` The output lists all the provisioned apps, and their package names. For more information, see [Get-AppxProvisionedPackage](/powershell/module/dism/get-appxprovisionedpackage). - - - **Installed**: Installed as part of the OS. - - - **Universal Windows Platform (UWP) apps**: These apps run and can be installed on many Windows platforms, including tablets, Microsoft HoloLens, Xbox, and more. All UWP apps are Windows apps. Not all Windows apps are UWP apps. - - For more information, see [What's a Universal Windows Platform (UWP) app?](/windows/uwp/get-started/universal-application-platform-guide). - - - **Win32 apps**: These apps are traditional Windows apps that run on the device, and are often called desktop apps. They require direct access to Windows and the device hardware, and typically don't require a web browser. These apps run in 32-bit mode on 64-bit devices, and don't depend on a managed runtime environment, like .NET. - - For more information, see [Get started developing apps for Windows desktop](/windows/apps/get-started) and [Make your apps great on Windows 11](/windows/apps/get-started/make-apps-great-for-windows). - - - **System apps**: Apps installed in the `C:\Windows\` directory. These apps are part of the Windows OS. To get a list of all the system apps, use Windows PowerShell: `Get-AppxPackage -PackageTypeFilter Main | ? { $_.SignatureKind -eq "System" } | Sort Name | Format-Table Name, InstallLocation` The output lists all the system apps, and their installation location. For more information, see [Get-AppxPackage](/powershell/module/appx/get-appxpackage). - -- **Web apps** and **Progressive web apps (PWA)**: These apps run on a server, and don't run on the end user device. To use these apps, users must use a web browser and have internet access. **Progressive web apps** are designed to work for all users, work with any browser, and work on any platform. - - Web apps are typically created in Visual Studio, and can be created with different languages. For more information, see [Create a Web App](https://azure.microsoft.com/get-started/web-app/). When the app is created and ready to be used, you deploy the web app to a web server. Using Azure, you can host your web apps in the cloud, instead of on-premises. For more information, see [App Service overview](/azure/app-service/overview). - - Using an MDM provider, you can create shortcuts to your web apps and progressive web apps on devices. - -## Android™️ apps - -Starting with Windows 11, users in the [Windows Insider program](https://insider.windows.com/) can use the Microsoft Store to search, download, and install Android™️ apps. This feature uses the Windows Subsystem for Android, and allows users to interact with Android apps, just like others apps installed from the Microsoft Store. - -For more information, see: - -- [Windows Subsystem for Android](https://support.microsoft.com/windows/abed2335-81bf-490a-92e5-fe01b66e5c48) -- [Windows Subsystem for Android developer information](/windows/android/wsa) - -## Add or deploy apps to devices - -When your apps are ready, you can add or deploy these apps to your Windows devices. This section lists some common options. - -> [!NOTE] -> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. Customers may continue to use the current capabilities for free apps until that time. There will be no support for Microsoft Store for Business and Education for Windows 11. ->Visit [Evolving the Microsoft Store for Business and Education](https://aka.ms/windows/msfb_evolution) for more information about the new Microsoft Store experience for both Windows 11 and Windows 10, and learn about other options for getting and managing apps. - -- **Manually install**: On your devices, users can install apps from the Microsoft Store, from the internet, and from an organization shared drive. These apps, and more, are listed in **Settings** > **Apps** > **Apps and Features**. - - If you want to prevent users from downloading apps on organization owned devices, use an MDM provider, like Microsoft Intune. For example, you can create a policy that allows or prevents users from sideloading apps, only allow the private store, and more. For more information on the features you can restrict, see [Windows client device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10). - - For an overview of the different types of device policies you can create, see [Apply features and settings on your devices using device profiles in Microsoft Intune](/mem/intune/configuration/device-profiles). - -- **Mobile device management (MDM)**: Use an MDM provider, like Microsoft Intune (cloud) or Configuration Manager (on-premises), to deploy apps. For example, you can create app policies that deploy Microsoft 365 apps, deploy Win32 apps, create shortcuts to web apps, add Store apps, and more. - - For more information, see: - - - [Add apps to Microsoft Intune](/mem/intune/apps/apps-add) - - [Application management in Configuration Manager](/mem/configmgr/apps/understand/introduction-to-application-management) - -- **Microsoft Store**: When you use the Microsoft Store app, Windows users can download apps from the public store. And, they can download apps provided by your organization, which is called the "private store". If your organization creates its own apps, you can use **[Windows Package Manager](/windows/package-manager)** to add apps to the private store. - - To help manage the Microsoft Store on your devices, you can use policies: - - - On premises, you can use Administrative Templates in Group Policy to control access to the Microsoft Store app: - - `User Configuration\Administrative Templates\Windows Components\Store` - - `Computer Configuration\Administrative Templates\Windows Components\Store` - - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to control access to the Microsoft Store app. - - For more information, see: - - - [Microsoft Store for Business and Education](/microsoft-store/) - - [Evolving the Microsoft Store for Business and Education](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/evolving-the-microsoft-store-for-business-and-education/ba-p/2569423) - -- **MSIX for desktop apps**: MSIX packages your UWP, Win32, WPF, and WinForm desktop application files. MSIX reliably installs apps, helps optimize disk storage space, and reduces duplicate files. If your organization typically uses `.EXE` or `.MSI` files to install desktop apps, then you should look into MSIX. - - To deploy MSIX packages and their apps, you can: - - - Use an MDM provider, like Microsoft Intune and Configuration Manager. - - Use an App Installer. User users double-click an installer file, or select a link on a web page. - - And more. - - For more information, see: - - - [What is MSIX?](/windows/msix/overview) - - [MSIX app distribution for enterprises](/windows/msix/desktop/managing-your-msix-deployment-enterprise) - -- **Windows Package Manager**: Windows Package Manager is a command line tool commonly used by developers to install Windows apps. Using the command line, you can get apps from the Microsoft Store or from GitHub (and more), and install these apps on Windows devices. It's helpful if you want to bypass user interfaces for getting apps from organizations and from developers. - - If your organization uses `.EXE`, `.MSIX`, or `.MSI` files, then Windows Package Manager might be the right deployment option for your organization. - - For more information, see [Windows Package Manager](/windows/package-manager). - -- **Azure Virtual desktop with MSIX app attach**: With Azure virtual desktop, you can virtualize the Windows client OS desktop, and use virtual apps on this desktop. With MSIX app attach, you dynamically deliver MSIX packaged apps to users and user groups. - - The benefit is to use the cloud to deliver virtual apps in real time, and as-needed. Users use the apps as if they're installed locally. - - If you currently use App-V, and want to reduce your on-premises footprint, then **Azure Virtual desktop with MSIX app attach** might be the right deployment for your organization. - - For more information, see: - - - [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) - - [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal) - -- **Application Virtualization (App-V)**: App-V allows Win32 apps to be used as virtual apps. - - > [!NOTE] - > [!INCLUDE [Application Virtualization will be end of life in April 2026](./includes/app-v-end-life-statement.md)] - - On an on-premises server, you install and configure the App-V server components, and then install your Win32 apps. On Windows Enterprise client devices, you use the App-V client components to run the virtualized apps. They allow users to open the virtual apps using the icons and file names they're familiar with. Users use the apps as if they're installed locally. - - The benefit is to deliver virtual apps in real time, and as-needed. For more information, see [Application Virtualization (App-V) for Windows overview](./app-v/appv-for-windows.md). - - To help manage App-V on your devices, you can use policies: - - - On premises, you can use Administrative Templates in Group Policy to deploy App-V policies (`Computer Configuration\Administrative Templates\System\App-V`). - - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to deploy App-V policies. - - diff --git a/windows/application-management/index.yml b/windows/application-management/index.yml index 30b7ab9bfc..b08cd77d57 100644 --- a/windows/application-management/index.yml +++ b/windows/application-management/index.yml @@ -24,7 +24,7 @@ landingContent: - linkListType: how-to-guide links: - text: Overview of apps in Windows - url: apps-in-windows-10.md + url: overview-windows-apps.md - text: Add or hide Windows features url: add-apps-and-features.md - text: Sideload LOB apps diff --git a/windows/application-management/overview-windows-apps.md b/windows/application-management/overview-windows-apps.md new file mode 100644 index 0000000000..135c557b56 --- /dev/null +++ b/windows/application-management/overview-windows-apps.md @@ -0,0 +1,200 @@ +--- +title: Overview of apps on Windows client devices +description: Learn about the different types of apps that run on Windows. For example, Universal Windows Platform (UWP), Windows Presentation Foundation (WPF), Win32, and Windows Forms apps. This article also includes the best way to install these apps. +author: aczechowski +ms.author: aaroncz +manager: aaroncz +ms.date: 08/28/2023 +ms.topic: overview +ms.prod: windows-client +ms.technology: itpro-apps +ms.localizationpriority: medium +ms.collection: tier2 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 +--- + +# Overview of apps on Windows client devices + +There are different types of apps that can run on your Windows client devices. This article provides an overview of some of the common apps used on Windows devices. It also explains the basics of how to install these apps. + +## Windows app types + +### Microsoft 365 apps + +These apps are used for business and productivity, and include Outlook, Word, Teams, OneNote, and more. Depending on the licenses your organization has, you may already have these apps. When you use an MDM provider, these apps can also be deployed to mobile devices, including smartphones. + +For more information on the Microsoft 365 license options, and what you get, see [Find the right Microsoft 365 enterprise plan for your organization](https://www.microsoft.com/microsoft-365/enterprise/microsoft365-plans-and-pricing). + +For more information on deploying Microsoft 365 apps, see the [Deployment guide for Microsoft 365 Apps](/DeployOffice/deployment-guide-microsoft-365-apps). + +### Power Apps + +These apps are custom, low-code apps to connect to business data, modernize processes, and solve unique challenges. Power Apps are available online and on-premises, can run in a web browser, and on mobile devices. They can be created by business analysts and professional developers. + +For more information, see [What is Power Apps?](/power-apps/powerapps-overview). + +### .NET apps + +These apps can be desktop apps that run on the device, or web apps. Some common .NET apps include: + +- **Windows Presentation Foundation (WPF)**: Using .NET, you can create a WPF desktop app that runs on the device, or create a WPF web app. This app is commonly used by organizations that create line of business (LOB) desktop apps. For more information, see [WPF application development](/dotnet/desktop/wpf/app-development). + +- **Windows Forms (WinForm)**: Using .NET, you can create a Windows Forms desktop app that runs on the device, and doesn't require a web browser or internet access. Just like Win32 apps, WinForm apps can access the local hardware and file system of the computer where the app is running. For more information, see [Desktop Guide (Windows Forms .NET)](/dotnet/desktop/winforms/overview). + +### Windows apps + +> [!TIP] +> Starting with Windows 10, you can use the **Windows UI Library (WinUI 3)** to create .NET, Win32 desktop, and UWP apps. This library includes native Windows UI controls and other user interface elements familiar to Windows users. For more information, see [Windows UI Library (WinUI)](/windows/apps/winui/). + +- **Apps**: All apps installed in the protected directory `C:\Program Files\WindowsApps`. There are two classes of these apps: + + - **Installed**: Installed as part of the OS. + + - **Provisioned**: Installed the first time you sign in with a new user account. + + > [!TIP] + > To get a list of all provisioned apps, use Windows PowerShell: + > + > ```powershell + > Get-AppxProvisionedPackage -Online | Format-Table DisplayName, PackageName + > ``` + > + > The output lists all the provisioned apps, and their package names. For more information, see [Get-AppxProvisionedPackage](/powershell/module/dism/get-appxprovisionedpackage). + +- **Universal Windows Platform (UWP) apps**: These apps run and can be installed on many Windows platforms, including tablets, Microsoft HoloLens, Xbox, and more. All UWP apps are Windows apps. Not all Windows apps are UWP apps. + + For more information, see [What's a Universal Windows Platform (UWP) app?](/windows/uwp/get-started/universal-application-platform-guide). + +- **Win32 apps**: These apps are traditional Windows apps that run on the device, and are often called desktop apps. They require direct access to Windows and the device hardware, and typically don't require a web browser. These apps run in 32-bit mode on 64-bit devices, and don't depend on a managed runtime environment, like .NET. + + For more information, see [Get started developing apps for Windows desktop](/windows/apps/get-started) and [Top 11 things you can do to make your app great on Windows 11](/windows/apps/get-started/make-apps-great-for-windows). + +- **System apps**: Apps installed in the system root directory `C:\Windows\`. These apps are part of the Windows OS. + + > [!TIP] + > To get a list of all the system apps, use Windows PowerShell: + > + > ```powershell + > `Get-AppxPackage -PackageTypeFilter Main | ? { $_.SignatureKind -eq "System" } | Sort Name | Format-Table Name, InstallLocation + > ``` + > + > The output lists all the system apps, and their installation location. For more information, see [Get-AppxPackage](/powershell/module/appx/get-appxpackage). + +### Web apps + +Web apps and progressive web apps (PWA) run on a server, and don't run on the end user device. To use these apps, users must use a web browser and have network access. **Progressive web apps** are designed to work for all users, work with any browser, and work on any platform. + +Web apps are typically created in Visual Studio, and can be created with different languages. For more information, see [Create a web app](/visualstudio/get-started/csharp/tutorial-aspnet-core). When the app is created and ready to be used, you deploy the web app to a web server. Using Azure, you can host your web apps in the cloud, instead of on-premises. For more information, see [App Service overview](/azure/app-service/overview). + +When you use an MDM provider like Microsoft Intune, you can create shortcuts to your web apps and progressive web apps on devices. For more information, see [Add web apps to Microsoft Intune](/mem/intune/apps/web-app). + +## Android™️ apps + +Starting with Windows 11, you can install Android™️ apps. This feature uses the Windows Subsystem for Android, and allows users to interact with mobile apps just like others apps. + +For more information, see the following articles: + +- [Apps from the Amazon Appstore](https://support.microsoft.com/windows/apps-from-the-amazon-appstore-abed2335-81bf-490a-92e5-fe01b66e5c48) + +- [Windows Subsystem for Android developer information](/windows/android/wsa) + +## Add or deploy apps to devices + +When your apps are ready, you can add or deploy these apps to your Windows devices. This section lists some common options. + +### Manually install + +On your devices, users can install apps from the Microsoft Store, from the internet, and from an organization shared drive. These apps, and more, are listed in **Settings** > **Apps** > **Apps and Features**. + +If you want to prevent users from downloading apps on organization owned devices, use an MDM provider, like Microsoft Intune. For example, you can create a policy that allows or prevents users from sideloading apps, only allow the private store, and more. For more information on the features you can restrict, see [Windows client device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10). + +For an overview of the different types of device policies you can create, see [Apply features and settings on your devices using device profiles in Microsoft Intune](/mem/intune/configuration/device-profiles). + +### Management service + +Use an MDM provider like Microsoft Intune, or an on-premises solution like Configuration Manager. For example, you can create app policies that deploy Microsoft 365 apps, deploy Win32 apps, create shortcuts to web apps, or add Store apps. + +For more information, see: + +- [Add apps to Microsoft Intune](/mem/intune/apps/apps-add) +- [Application management in Configuration Manager](/mem/configmgr/apps/understand/introduction-to-application-management) + +### Microsoft Store + +When you use the Microsoft Store app, Windows users can download apps from the public store. They can also download apps provided by your organization, which is called the *private store*. If your organization creates its own apps, you can use [Windows Package Manager](/windows/package-manager) to add apps to the private store. + +> [!NOTE] +> Retirement of the Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. Customers may continue to use the current capabilities for free apps until that time. There will be no support for Microsoft Store for Business and Education for Windows 11. +> +> For more information, see [Evolving the Microsoft Store for Business and Education](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/evolving-the-microsoft-store-for-business-and-education/bc-p/3771217). This blog post describes the new Microsoft Store experience for both Windows 11 and Windows 10. To learn about other options for getting and managing apps, see [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps-microsoft). + +To help manage the Microsoft Store on your devices, you can use policies: + +- On premises, you can use administrative templates in group policy to control access to the Microsoft Store app: + - `User Configuration\Administrative Templates\Windows Components\Store` + - `Computer Configuration\Administrative Templates\Windows Components\Store` + +- Using Microsoft Intune, you can use [administrative templates](/mem/intune/configuration/administrative-templates-windows) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) to control access to the Microsoft Store app. + +### MSIX for desktop apps + +MSIX packages your UWP, Win32, WPF, and WinForm desktop application files. MSIX reliably installs apps, helps optimize disk storage space, and reduces duplicate files. If your organization typically uses `.EXE` or `.MSI` files to install desktop apps, then you should look into MSIX. + +To deploy MSIX packages and their apps, you can: + +- Use a management service, like Microsoft Intune and Configuration Manager. +- Use an App Installer. User users double-click an installer file, or select a link on a web page. + +For more information, see the following articles: + +- [What is MSIX?](/windows/msix/overview) +- [MSIX app distribution for enterprises](/windows/msix/desktop/managing-your-msix-deployment-enterprise) + +### Windows Package Manager + +Windows Package Manager is a command line tool commonly used by developers to install Windows apps. Using the command line, you can get apps from services like the Microsoft Store or GitHub, and install these apps on Windows devices. It's helpful if you want to bypass user interfaces for getting apps from organizations and from developers. + +If your organization uses `.EXE`, `.MSIX`, or `.MSI` files, then Windows Package Manager might be the right deployment option. + +For more information, see [Windows Package Manager](/windows/package-manager). + +### Azure Virtual desktop with MSIX app attach + +With Azure virtual desktop, you can virtualize the Windows client OS desktop, and use virtual apps on this desktop. With MSIX app attach, you dynamically deliver MSIX packaged apps to users and user groups. + +The benefit is to use the cloud to deliver virtual apps in real time, and as-needed. Users use the apps as if they're installed locally. + +If you currently use App-V, and want to reduce your on-premises footprint, then **Azure Virtual desktop with MSIX app attach** might be the right deployment for your organization. + +For more information, see the following articles: + +- [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) +- [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal) + +### Application Virtualization (App-V) + +App-V allows Win32 apps to be used as virtual apps. + +> [!NOTE] +> [!INCLUDE [Application Virtualization will be end of life in April 2026](./includes/app-v-end-life-statement.md)] + +On an on-premises server, you install and configure the App-V server components, and then install your Win32 apps. On Windows Enterprise client devices, you use the App-V client components to run the virtualized apps. They allow users to open the virtual apps using the icons and file names they're familiar with. Users use the apps as if they're installed locally. + +The benefit is to deliver virtual apps in real time, and as-needed. For more information, see [Application Virtualization (App-V) for Windows overview](./app-v/appv-for-windows.md). + +## Manage apps + +To help manage your devices, and help manage apps on your devices, use a management service like Microsoft Intune and Configuration Manager. For more information, see the following articles: + +- [Overview of endpoint management](/mem/endpoint-manager-overview) +- [Manage your apps and app data in Microsoft Intune](/mem/intune/fundamentals/manage-apps) +- [Introduction to application management in Configuration Manager](/mem/configmgr/apps/understand/introduction-to-application-management) + +## Application compatibility + +Microsoft is committed to making sure your business-critical apps work on the latest versions of Windows. For more information, see the following articles: + +- [Compatibility for Windows 11](/windows/compatibility/windows-11/) +- [FastTrack App Assure program](/windows/compatibility/app-assure) diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index cc596076a4..be08bb1e0f 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -4,7 +4,7 @@ items: - name: Application management items: - name: Overview of apps in Windows - href: apps-in-windows-10.md + href: overview-windows-apps.md - name: Add or hide Windows features href: add-apps-and-features.md - name: Sideload line of business (LOB) apps diff --git a/windows/client-management/client-tools/mandatory-user-profile.md b/windows/client-management/client-tools/mandatory-user-profile.md index e83331a476..5c867f498d 100644 --- a/windows/client-management/client-tools/mandatory-user-profile.md +++ b/windows/client-management/client-tools/mandatory-user-profile.md @@ -51,7 +51,7 @@ First, you create a default user profile with the customizations that you want, 1. [Create an answer file (Unattend.xml)](/windows-hardware/customize/desktop/wsim/create-or-open-an-answer-file) that sets the [CopyProfile](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-copyprofile) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user's profile folder to the default user profile. You can use [Windows System Image Manager](/windows-hardware/customize/desktop/wsim/windows-system-image-manager-technical-reference), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. -1. Uninstall any application you don't need or want from the PC. For examples on how to uninstall Windows Application see [Remove-AppxProvisionedPackage](/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps&preserve-view=true). For a list of uninstallable applications, see [Understand the different apps included in Windows](/windows/application-management/apps-in-windows-10). +1. Uninstall any application you don't need or want from the PC. For examples on how to uninstall Windows Application see [Remove-AppxProvisionedPackage](/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps&preserve-view=true). For a list of uninstallable applications, see [Understand the different apps included in Windows](/windows/application-management/overview-windows-apps). > [!NOTE] > It is highly recommended to uninstall unwanted or unneeded apps as it will speed up user sign-in times. diff --git a/windows/whats-new/windows-11-overview.md b/windows/whats-new/windows-11-overview.md index 90928f5742..2bab9205d6 100644 --- a/windows/whats-new/windows-11-overview.md +++ b/windows/whats-new/windows-11-overview.md @@ -152,7 +152,7 @@ For more information on the security features you can configure, manage, and enf - Your Windows 10 apps will also work on Windows 11. **[App Assure](https://www.microsoft.com/fasttrack/microsoft-365/app-assure)** is also available if there are some issues. - You can continue to use **MSIX packages** for your UWP, Win32, WPF, and WinForm desktop application files. Continue to use **Windows Package Manager** to install Windows apps. You can create **Azure virtual desktops** that run Windows 11. Use **Azure Virtual desktop with MSIX app attach** to virtualize desktops and apps. For more information on these features, see [Overview of apps on Windows client devices](/windows/application-management/apps-in-windows-10). + You can continue to use **MSIX packages** for your UWP, Win32, WPF, and WinForm desktop application files. Continue to use **Windows Package Manager** to install Windows apps. You can create **Azure virtual desktops** that run Windows 11. Use **Azure Virtual desktop with MSIX app attach** to virtualize desktops and apps. For more information on these features, see [Overview of apps on Windows client devices](/windows/application-management/overview-windows-apps). In the **Settings** app > **Apps**, users can manage some of the app settings. For example, they can get apps anywhere, but let the user know if there's a comparable app in the Microsoft Store. They can also choose which apps start when they sign in. From fc9f77862aa3da9f4c27f4fd775e98fbd3f49121 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 29 Aug 2023 10:44:10 -0400 Subject: [PATCH 113/125] adjusted sentence referencing FFL --- .../hello-for-business/passwordless-strategy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 9dafd8be5b..690c5f984c 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -317,7 +317,7 @@ The following image shows the SCRIL setting for a user in Active Directory Admin > 1. Enable the setting. > 1. Save changes again. > -> When you upgrade the domain to Windows Server 2016 domain forest functional level or later, the domain controller automatically does this action for you. +> When you upgrade the domain functional level to Windows Server 2016 or later, the domain controller automatically does this action for you. The following image shows the SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2016: From f9563b2851939f23f63d20f20f0884996c45e789 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 29 Aug 2023 08:03:37 -0700 Subject: [PATCH 114/125] meta3upd --- windows/deployment/update/wufb-reports-configuration-manual.md | 1 - windows/deployment/update/wufb-reports-schema-ucdevicealert.md | 2 +- .../update/wufb-reports-schema-ucdoaggregatedstatus.md | 2 +- 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/wufb-reports-configuration-manual.md b/windows/deployment/update/wufb-reports-configuration-manual.md index d0a105f319..3f3c8c7937 100644 --- a/windows/deployment/update/wufb-reports-configuration-manual.md +++ b/windows/deployment/update/wufb-reports-configuration-manual.md @@ -9,7 +9,6 @@ author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: medium -ms.topic: article appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/deployment/update/wufb-reports-schema-ucdevicealert.md b/windows/deployment/update/wufb-reports-schema-ucdevicealert.md index 8c95d45cd9..435324d2db 100644 --- a/windows/deployment/update/wufb-reports-schema-ucdevicealert.md +++ b/windows/deployment/update/wufb-reports-schema-ucdevicealert.md @@ -18,7 +18,7 @@ ms.date: 06/06/2022 These alerts are activated as a result of an issue that is device-specific. It isn't specific to the combination of a specific update and a specific device. Like UpdateAlerts, the AlertType indicates where the Alert comes from (ServiceDeviceAlert, ClientDeviceAlert). For example, an EndOfService alert is a ClientDeviceAlert, as a build no longer being serviced (EOS) is a client-wide state. Meanwhile, DeviceRegistrationIssues in the Windows Update for Business deployment service will be a ServiceDeviceAlert, as it's a device-wide state in the service to not be correctly registered. -# Schema for UCDeviceAlert +## Schema for UCDeviceAlert |Field |Type |Example |Description | |---|---|---|---| diff --git a/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md b/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md index 3a05686271..a7012d9409 100644 --- a/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md @@ -20,7 +20,7 @@ ms.date: 11/17/2022 UCDOAggregatedStatus is an aggregation of all individual UDDOStatus records across the tenant and summarizes bandwidth savings across all devices enrolled using [Delivery Optimization and Microsoft Connected Cache](/windows/deployment/do). -# Schema for UCDOAggregatedStatus +## Schema for UCDOAggregatedStatus |Field |Type |Example |Description | |---|---|---|---| From 9b9e024c001259651f333aff844be8cac3c1e5d6 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 29 Aug 2023 08:45:29 -0700 Subject: [PATCH 115/125] meta3upd --- .../update/windows-update-error-reference.md | 518 +++++++++--------- 1 file changed, 259 insertions(+), 259 deletions(-) diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md index cf907c749f..1f93ca12bc 100644 --- a/windows/deployment/update/windows-update-error-reference.md +++ b/windows/deployment/update/windows-update-error-reference.md @@ -22,72 +22,72 @@ This section lists the error codes for Microsoft Windows Update. | Error code | Message | Description | |------------|---------------------------------|--------------------------------------------------------------------------------------------------------| -| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | -| 0x8024A000 | `WU_E_AU_NOSERVICE` | Automatic Updates was unable to service incoming requests. | -| 0x8024A002 | `WU_E_AU_NONLEGACYSERVER` | The old version of the Automatic Updates client has stopped because the WSUS server has been upgraded. | -| 0x8024A003 | `WU_E_AU_LEGACYCLIENTDISABLED` | The old version of the Automatic Updates client was disabled. | -| 0x8024A004 | `WU_E_AU_PAUSED` | Automatic Updates was unable to process incoming requests because it was paused. | -| 0x8024A005 | `WU_E_AU_NO_REGISTERED_SERVICE` | No unmanaged service is registered with `AU`. | -| 0x8024AFFF | `WU_E_AU_UNEXPECTED` | An Automatic Updates error not covered by another `WU_E_AU*` code. | +| `0x80243FFF` | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | +| `0x8024A000` | `WU_E_AU_NOSERVICE` | Automatic Updates was unable to service incoming requests. | +| `0x8024A002` | `WU_E_AU_NONLEGACYSERVER` | The old version of the Automatic Updates client has stopped because the WSUS server has been upgraded. | +| `0x8024A003` | `WU_E_AU_LEGACYCLIENTDISABLED` | The old version of the Automatic Updates client was disabled. | +| `0x8024A004` | `WU_E_AU_PAUSED` | Automatic Updates was unable to process incoming requests because it was paused. | +| `0x8024A005` | `WU_E_AU_NO_REGISTERED_SERVICE` | No unmanaged service is registered with `AU`. | +| `0x8024AFFF` | `WU_E_AU_UNEXPECTED` | An Automatic Updates error not covered by another `WU_E_AU*` code. | ## Windows Update UI errors | Error code | Message | Description | |------------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------| -| 0x80243001 | `WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION` | The results of download and installation couldn't be read from the registry due to an unrecognized data format version. | -| 0x80243002 | `WU_E_INSTALLATION_RESULTS_INVALID_DATA` | The results of download and installation couldn't be read from the registry due to an invalid data format. | -| 0x80243003 | `WU_E_INSTALLATION_RESULTS_NOT_FOUND` | The results of download and installation aren't available; the operation may have failed to start. | -| 0x80243004 | `WU_E_TRAYICON_FAILURE` | A failure occurred when trying to create an icon in the taskbar notification area. | -| 0x80243FFD | `WU_E_NON_UI_MODE` | Unable to show UI when in non-UI mode; Windows Update client UI modules may not be installed. | -| 0x80243FFE | `WU_E_WUCLTUI_UNSUPPORTED_VERSION` | Unsupported version of Windows Update client UI exported functions. | -| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | -| 0x8024043D | `WU_E_SERVICEPROP_NOTAVAIL` | The requested service property isn't available. | +| `0x80243001` | `WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION` | The results of download and installation couldn't be read from the registry due to an unrecognized data format version. | +| `0x80243002` | `WU_E_INSTALLATION_RESULTS_INVALID_DATA` | The results of download and installation couldn't be read from the registry due to an invalid data format. | +| `0x80243003` | `WU_E_INSTALLATION_RESULTS_NOT_FOUND` | The results of download and installation aren't available; the operation may have failed to start. | +| `0x80243004` | `WU_E_TRAYICON_FAILURE` | A failure occurred when trying to create an icon in the taskbar notification area. | +| `0x80243FFD` | `WU_E_NON_UI_MODE` | Unable to show UI when in non-UI mode; Windows Update client UI modules may not be installed. | +| `0x80243FFE` | `WU_E_WUCLTUI_UNSUPPORTED_VERSION` | Unsupported version of Windows Update client UI exported functions. | +| `0x80243FFF` | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | +| `0x8024043D` | `WU_E_SERVICEPROP_NOTAVAIL` | The requested service property isn't available. | ## Inventory errors | Error code | Message | Description | |------------|--------------------------------------------|-------------------------------------------------------------------------------| -| 0x80249001 | `WU_E_INVENTORY_PARSEFAILED` | Parsing of the rule file failed. | -| 0x80249002 | `WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED` | Failed to get the requested inventory type from the server. | -| 0x80249003 | `WU_E_INVENTORY_RESULT_UPLOAD_FAILED` | Failed to upload inventory result to the server. | -| 0x80249004 | `WU_E_INVENTORY_UNEXPECTED` | There was an inventory error not covered by another error code. | -| 0x80249005 | `WU_E_INVENTORY_WMI_ERROR` | A WMI error occurred when enumerating the instances for a particular class. | +| `0x80249001` | `WU_E_INVENTORY_PARSEFAILED` | Parsing of the rule file failed. | +| `0x80249002` | `WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED` | Failed to get the requested inventory type from the server. | +| `0x80249003` | `WU_E_INVENTORY_RESULT_UPLOAD_FAILED` | Failed to upload inventory result to the server. | +| `0x80249004` | `WU_E_INVENTORY_UNEXPECTED` | There was an inventory error not covered by another error code. | +| `0x80249005` | `WU_E_INVENTORY_WMI_ERROR` | A WMI error occurred when enumerating the instances for a particular class. | ## Expression evaluator errors | Error code | Message | Description | |------------|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------| -| 0x8024E001 | `WU_E_EE_UNKNOWN_EXPRESSION` | An expression evaluator operation couldn't be completed because an expression was unrecognized. | -| 0x8024E002 | `WU_E_EE_INVALID_EXPRESSION` | An expression evaluator operation couldn't be completed because an expression was invalid. | -| 0x8024E003 | `WU_E_EE_MISSING_METADATA` | An expression evaluator operation couldn't be completed because an expression contains an incorrect number of metadata nodes. | -| 0x8024E004 | `WU_E_EE_INVALID_VERSION` | An expression evaluator operation couldn't be completed because the version of the serialized expression data is invalid. | -| 0x8024E005 | `WU_E_EE_NOT_INITIALIZED` | The expression evaluator couldn't be initialized. | -| 0x8024E006 | `WU_E_EE_INVALID_ATTRIBUTEDATA` | An expression evaluator operation couldn't be completed because there was an invalid attribute. | -| 0x8024E007 | `WU_E_EE_CLUSTER_ERROR` | An expression evaluator operation couldn't be completed because the cluster state of the computer couldn't be determined. | -| 0x8024EFFF | `WU_E_EE_UNEXPECTED` | There was an expression evaluator error not covered by another `WU_E_EE_*` error code. | +| `0x8024E001` | `WU_E_EE_UNKNOWN_EXPRESSION` | An expression evaluator operation couldn't be completed because an expression was unrecognized. | +| `0x8024E002` | `WU_E_EE_INVALID_EXPRESSION` | An expression evaluator operation couldn't be completed because an expression was invalid. | +| `0x8024E003` | `WU_E_EE_MISSING_METADATA` | An expression evaluator operation couldn't be completed because an expression contains an incorrect number of metadata nodes. | +| `0x8024E004` | `WU_E_EE_INVALID_VERSION` | An expression evaluator operation couldn't be completed because the version of the serialized expression data is invalid. | +| `0x8024E005` | `WU_E_EE_NOT_INITIALIZED` | The expression evaluator couldn't be initialized. | +| `0x8024E006` | `WU_E_EE_INVALID_ATTRIBUTEDATA` | An expression evaluator operation couldn't be completed because there was an invalid attribute. | +| `0x8024E007` | `WU_E_EE_CLUSTER_ERROR` | An expression evaluator operation couldn't be completed because the cluster state of the computer couldn't be determined. | +| `0x8024EFFF` | `WU_E_EE_UNEXPECTED` | There was an expression evaluator error not covered by another `WU_E_EE_*` error code. | ## Reporter errors | Error code | Message | Description | |------------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------| -| 0x80247001 | `WU_E_OL_INVALID_SCANFILE` | An operation couldn't be completed because the scan package was invalid. | -| 0x80247002 | `WU_E_OL_NEWCLIENT_REQUIRED` | An operation couldn't be completed because the scan package requires a greater version of the Windows Update Agent. | -| 0x80247FFF | `WU_E_OL_UNEXPECTED` | Search using the scan package failed. | -| 0x8024F001 | `WU_E_REPORTER_EVENTCACHECORRUPT` | The event cache file was defective. | -| 0x8024F002 | `WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED` | The XML in the event namespace descriptor couldn't be parsed. | -| 0x8024F003 | `WU_E_INVALID_EVENT` | The XML in the event namespace descriptor couldn't be parsed. | -| 0x8024F004 | `WU_E_SERVER_BUSY` | The server rejected an event because the server was too busy. | -| 0x8024FFFF | `WU_E_REPORTER_UNEXPECTED` | There was a reporter error not covered by another error code. | +| `0x80247001` | `WU_E_OL_INVALID_SCANFILE` | An operation couldn't be completed because the scan package was invalid. | +| `0x80247002` | `WU_E_OL_NEWCLIENT_REQUIRED` | An operation couldn't be completed because the scan package requires a greater version of the Windows Update Agent. | +| `0x80247FFF` | `WU_E_OL_UNEXPECTED` | Search using the scan package failed. | +| `0x8024F001` | `WU_E_REPORTER_EVENTCACHECORRUPT` | The event cache file was defective. | +| `0x8024F002` | `WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED` | The XML in the event namespace descriptor couldn't be parsed. | +| `0x8024F003` | `WU_E_INVALID_EVENT` | The XML in the event namespace descriptor couldn't be parsed. | +| `0x8024F004` | `WU_E_SERVER_BUSY` | The server rejected an event because the server was too busy. | +| `0x8024FFFF` | `WU_E_REPORTER_UNEXPECTED` | There was a reporter error not covered by another error code. | ## Redirector errors The components that download the `Wuredir.cab` file and then parse the `Wuredir.cab` file generate the following errors. | Error code | Message | Description | |----------- |------------------------------|------------------------------------------------------------------------------------------| -| 0x80245001 | `WU_E_REDIRECTOR_LOAD_XML` | The redirector XML document couldn't be loaded into the DOM class. | -| 0x80245002 | `WU_E_REDIRECTOR_S_FALSE` | The redirector XML document is missing some required information. | -| 0x80245003 | `WU_E_REDIRECTOR_ID_SMALLER` | The redirectorId in the downloaded redirector cab is less than in the cached cab. | -| 0x80245FFF | `WU_E_REDIRECTOR_UNEXPECTED` | The redirector failed for reasons not covered by another `WU_E_REDIRECTOR_*` error code. | +| `0x80245001` | `WU_E_REDIRECTOR_LOAD_XML` | The redirector XML document couldn't be loaded into the DOM class. | +| `0x80245002` | `WU_E_REDIRECTOR_S_FALSE` | The redirector XML document is missing some required information. | +| `0x80245003` | `WU_E_REDIRECTOR_ID_SMALLER` | The redirectorId in the downloaded redirector cab is less than in the cached cab. | +| `0x80245FFF` | `WU_E_REDIRECTOR_UNEXPECTED` | The redirector failed for reasons not covered by another `WU_E_REDIRECTOR_*` error code. | ## Protocol Talker errors The following errors map to `SOAPCLIENT_ERROR`s through the `Atlsoap.h` file. These errors are obtained when the `CClientWebService` object calls the `GetClientError()` method. @@ -95,17 +95,17 @@ The following errors map to `SOAPCLIENT_ERROR`s through the `Atlsoap.h` file. Th | Error code | Message | Description | |------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| -| 0x80244000 | `WU_E_PT_SOAPCLIENT_BASE` | `WU_E_PT_SOAPCLIENT_*` error codes map to the `SOAPCLIENT_ERROR` enum of the ATL Server Library. | -| 0x80244001 | `WU_E_PT_SOAPCLIENT_INITIALIZE` | Same as `SOAPCLIENT_INITIALIZE_ERROR` - initialization of the `SOAP` client failed possibly because of an MSXML installation failure. | -| 0x80244002 | `WU_E_PT_SOAPCLIENT_OUTOFMEMORY` | Same as `SOAPCLIENT_OUTOFMEMORY` - `SOAP` client failed because it ran out of memory. | -| 0x80244003 | `WU_E_PT_SOAPCLIENT_GENERATE` | Same as `SOAPCLIENT_GENERATE_ERROR` - `SOAP` client failed to generate the request. | -| 0x80244004 | `WU_E_PT_SOAPCLIENT_CONNECT` | Same as `SOAPCLIENT_CONNECT_ERROR` - `SOAP` client failed to connect to the server. | -| 0x80244005 | `WU_E_PT_SOAPCLIENT_SEND` | Same as `SOAPCLIENT_SEND_ERROR` - `SOAP` client failed to send a message for reasons of `WU_E_WINHTTP_*` error codes. | -| 0x80244006 | `WU_E_PT_SOAPCLIENT_SERVER` | Same as `SOAPCLIENT_SERVER_ERROR` - `SOAP` client failed because there was a server error. | -| 0x80244007 | `WU_E_PT_SOAPCLIENT_SOAPFAULT` | Same as `SOAPCLIENT_SOAPFAULT` - `SOAP` client failed because there was a SOAP fault for reasons of `WU_E_PT_SOAP_*` error codes. | -| 0x80244008 | `WU_E_PT_SOAPCLIENT_PARSEFAULT` | Same as `SOAPCLIENT_PARSEFAULT_ERROR` - `SOAP` client failed to parse a `SOAP` fault. | -| 0x80244009 | `WU_E_PT_SOAPCLIENT_READ` | Same as `SOAPCLIENT_READ_ERROR` - `SOAP` client failed while reading the response from the server. | -| 0x8024400A | `WU_E_PT_SOAPCLIENT_PARSE` | Same as `SOAPCLIENT_PARSE_ERROR` - `SOAP` client failed to parse the response from the server. | +| `0x80244000` | `WU_E_PT_SOAPCLIENT_BASE` | `WU_E_PT_SOAPCLIENT_*` error codes map to the `SOAPCLIENT_ERROR` enum of the ATL Server Library. | +| `0x80244001` | `WU_E_PT_SOAPCLIENT_INITIALIZE` | Same as `SOAPCLIENT_INITIALIZE_ERROR` - initialization of the `SOAP` client failed possibly because of an MSXML installation failure. | +| `0x80244002` | `WU_E_PT_SOAPCLIENT_OUTOFMEMORY` | Same as `SOAPCLIENT_OUTOFMEMORY` - `SOAP` client failed because it ran out of memory. | +| `0x80244003` | `WU_E_PT_SOAPCLIENT_GENERATE` | Same as `SOAPCLIENT_GENERATE_ERROR` - `SOAP` client failed to generate the request. | +| `0x80244004` | `WU_E_PT_SOAPCLIENT_CONNECT` | Same as `SOAPCLIENT_CONNECT_ERROR` - `SOAP` client failed to connect to the server. | +| `0x80244005` | `WU_E_PT_SOAPCLIENT_SEND` | Same as `SOAPCLIENT_SEND_ERROR` - `SOAP` client failed to send a message for reasons of `WU_E_WINHTTP_*` error codes. | +| `0x80244006` | `WU_E_PT_SOAPCLIENT_SERVER` | Same as `SOAPCLIENT_SERVER_ERROR` - `SOAP` client failed because there was a server error. | +| `0x80244007` | `WU_E_PT_SOAPCLIENT_SOAPFAULT` | Same as `SOAPCLIENT_SOAPFAULT` - `SOAP` client failed because there was a SOAP fault for reasons of `WU_E_PT_SOAP_*` error codes. | +| `0x80244008` | `WU_E_PT_SOAPCLIENT_PARSEFAULT` | Same as `SOAPCLIENT_PARSEFAULT_ERROR` - `SOAP` client failed to parse a `SOAP` fault. | +| `0x80244009` | `WU_E_PT_SOAPCLIENT_READ` | Same as `SOAPCLIENT_READ_ERROR` - `SOAP` client failed while reading the response from the server. | +| `x8024400A` | `WU_E_PT_SOAPCLIENT_PARSE` | Same as `SOAPCLIENT_PARSE_ERROR` - `SOAP` client failed to parse the response from the server. | ## Other Protocol Talker errors The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These errors are obtained from the `m_fault.m_soapErrCode` member of the `CClientWebService` object when `GetClientError()` returns `SOAPCLIENT_SOAPFAULT`. @@ -113,253 +113,253 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | Error code | Message | Description | |------------|----------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 0x8024400B | `WU_E_PT_SOAP_VERSION` | Same as `SOAP_E_VERSION_MISMATCH` - `SOAP` client found an unrecognizable namespace for the `SOAP` envelope. | -| 0x8024400C | `WU_E_PT_SOAP_MUST_UNDERSTAND` | Same as `SOAP_E_MUST_UNDERSTAND` - `SOAP` client was unable to understand a header. | -| 0x8024400D | `WU_E_PT_SOAP_CLIENT` | Same as `SOAP_E_CLIENT` - `SOAP` client found the message was malformed; fix before resending. | -| 0x8024400E | `WU_E_PT_SOAP_SERVER` | Same as `SOAP_E_SERVER` - The `SOAP` message could not be processed due to a server error; resend later. | -| 0x8024400F | `WU_E_PT_WMI_ERROR` | There was an unspecified Windows Management Instrumentation (WMI) error. | -| 0x80244010 | `WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS` | The number of round trips to the server exceeded the maximum limit. | -| 0x80244011 | `WU_E_PT_SUS_SERVER_NOT_SET` | WUServer policy value is missing in the registry. | -| 0x80244012 | `WU_E_PT_DOUBLE_INITIALIZATION` | Initialization failed because the object was already initialized. | -| 0x80244013 | `WU_E_PT_INVALID_COMPUTER_NAME` | The computer name couldn't be determined. | -| 0x80244015 | `WU_E_PT_REFRESH_CACHE_REQUIRED` | The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. | -| 0x80244016 | `WU_E_PT_HTTP_STATUS_BAD_REQUEST` | Same as HTTP status 400 - the server couldn't process the request due to invalid syntax. | -| 0x80244017 | `WU_E_PT_HTTP_STATUS_DENIED` | Same as HTTP status 401 - the requested resource requires user authentication. | -| 0x80244018 | `WU_E_PT_HTTP_STATUS_FORBIDDEN` | Same as HTTP status 403 - server understood the request but declined to fulfill it. | -| 0x80244019 | `WU_E_PT_HTTP_STATUS_NOT_FOUND` | Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier). | -| 0x8024401A | `WU_E_PT_HTTP_STATUS_BAD_METHOD` | Same as HTTP status 405 - the HTTP method is not allowed. | -| 0x8024401B | `WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ` | Same as HTTP status 407 - proxy authentication is required. | -| 0x8024401C | `WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT` | Same as HTTP status 408 - the server timed out waiting for the request. | -| 0x8024401D | `WU_E_PT_HTTP_STATUS_CONFLICT` | Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource. | -| 0x8024401E | `WU_E_PT_HTTP_STATUS_GONE` | Same as HTTP status 410 - requested resource is no longer available at the server. | -| 0x8024401F | `WU_E_PT_HTTP_STATUS_SERVER_ERROR` | Same as HTTP status 500 - an error internal to the server prevented fulfilling the request. | -| 0x80244020 | `WU_E_PT_HTTP_STATUS_NOT_SUPPORTED` | Same as HTTP status 500 - server does not support the functionality required to fulfill the request. | -| 0x80244021 | `WU_E_PT_HTTP_STATUS_BAD_GATEWAY` | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfill the request. | -| 0x80244022 | `WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL` | Same as HTTP status 503 - the service is temporarily overloaded. | -| 0x80244023 | `WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT` | Same as HTTP status 503 - the request was timed out waiting for a gateway. | -| 0x80244024 | `WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP` | Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request. | -| 0x80244025 | `WU_E_PT_FILE_LOCATIONS_CHANGED` | Operation failed due to a changed file location; refresh internal state and resend. | -| 0x80244026 | `WU_E_PT_REGISTRATION_NOT_SUPPORTED` | Operation failed because Windows Update Agent does not support registration with a non-WSUS server. | -| 0x80244027 | `WU_E_PT_NO_AUTH_PLUGINS_REQUESTED` | The server returned an empty authentication information list. | -| 0x80244028 | `WU_E_PT_NO_AUTH_COOKIES_CREATED` | Windows Update Agent was unable to create any valid authentication cookies. | -| 0x80244029 | `WU_E_PT_INVALID_CONFIG_PROP` | A configuration property value was wrong. | -| 0x8024402A | `WU_E_PT_CONFIG_PROP_MISSING` | A configuration property value was missing. | -| 0x8024402B | `WU_E_PT_HTTP_STATUS_NOT_MAPPED` | The HTTP request couldn't be completed and the reason did not correspond to any of the `WU_E_PT_HTTP_*` error codes. | -| 0x8024402C | `WU_E_PT_WINHTTP_NAME_NOT_RESOLVED` | Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved. | -| 0x8024402F | `WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS` | External cab file processing completed with some errors. | -| 0x80244030 | `WU_E_PT_ECP_INIT_FAILED` | The external cab processor initialization did not complete. | -| 0x80244031 | `WU_E_PT_ECP_INVALID_FILE_FORMAT` | The format of a metadata file was invalid. | -| 0x80244032 | `WU_E_PT_ECP_INVALID_METADATA` | External cab processor found invalid metadata. | -| 0x80244033 | `WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST` | The file digest couldn't be extracted from an external cab file. | -| 0x80244034 | `WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE` | An external cab file couldn't be decompressed. | -| 0x80244035 | `WU_E_PT_ECP_FILE_LOCATION_ERROR` | External cab processor was unable to get file locations. | -| 0x80244FFF | `WU_E_PT_UNEXPECTED` | A communication error not covered by another `WU_E_PT_*` error code. | -| 0x8024502D | `WU_E_PT_SAME_REDIR_ID` | Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery. | -| 0x8024502E | `WU_E_PT_NO_MANAGED_RECOVER` | A redirector recovery action did not complete because the server is managed. | +| `0x8024400B` | `WU_E_PT_SOAP_VERSION` | Same as `SOAP_E_VERSION_MISMATCH` - `SOAP` client found an unrecognizable namespace for the `SOAP` envelope. | +| `0x8024400C` | `WU_E_PT_SOAP_MUST_UNDERSTAND` | Same as `SOAP_E_MUST_UNDERSTAND` - `SOAP` client was unable to understand a header. | +| `0x8024400D` | `WU_E_PT_SOAP_CLIENT` | Same as `SOAP_E_CLIENT` - `SOAP` client found the message was malformed; fix before resending. | +|`0x8024400E` | `WU_E_PT_SOAP_SERVER` | Same as `SOAP_E_SERVER` - The `SOAP` message could not be processed due to a server error; resend later. | +| `0x8024400F` | `WU_E_PT_WMI_ERROR` | There was an unspecified Windows Management Instrumentation (WMI) error. | +| `0x80244010` | `WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS` | The number of round trips to the server exceeded the maximum limit. | +| `0x80244011` | `WU_E_PT_SUS_SERVER_NOT_SET` | WUServer policy value is missing in the registry. | +| `0x80244012` | `WU_E_PT_DOUBLE_INITIALIZATION` | Initialization failed because the object was already initialized. | +| `0x80244013` | `WU_E_PT_INVALID_COMPUTER_NAME` | The computer name couldn't be determined. | +| `0x80244015` | `WU_E_PT_REFRESH_CACHE_REQUIRED` | The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. | +| `0x80244016` | `WU_E_PT_HTTP_STATUS_BAD_REQUEST` | Same as HTTP status 400 - the server couldn't process the request due to invalid syntax. | +| `0x80244017`` | `WU_E_PT_HTTP_STATUS_DENIED` | Same as HTTP status 401 - the requested resource requires user authentication. | +| `0x80244018` | `WU_E_PT_HTTP_STATUS_FORBIDDEN` | Same as HTTP status 403 - server understood the request but declined to fulfill it. | +| `0x80244019` | `WU_E_PT_HTTP_STATUS_NOT_FOUND` | Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier). | +| `0x8024401A` | `WU_E_PT_HTTP_STATUS_BAD_METHOD` | Same as HTTP status 405 - the HTTP method is not allowed. | +| `0x8024401B` | `WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ` | Same as HTTP status 407 - proxy authentication is required. | +| `0x8024401C` | `WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT` | Same as HTTP status 408 - the server timed out waiting for the request. | +| `0x8024401D` | `WU_E_PT_HTTP_STATUS_CONFLICT` | Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource. | +| `0x8024401E` | `WU_E_PT_HTTP_STATUS_GONE` | Same as HTTP status 410 - requested resource is no longer available at the server. | +| `0x8024401F` | `WU_E_PT_HTTP_STATUS_SERVER_ERROR` | Same as HTTP status 500 - an error internal to the server prevented fulfilling the request. | +| `0x80244020` | `WU_E_PT_HTTP_STATUS_NOT_SUPPORTED` | Same as HTTP status 500 - server does not support the functionality required to fulfill the request. | +|`0x80244021` | `WU_E_PT_HTTP_STATUS_BAD_GATEWAY` | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfill the request. | +| `0x80244022` | `WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL` | Same as HTTP status 503 - the service is temporarily overloaded. | +| `0x80244023` | `WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT` | Same as HTTP status 503 - the request was timed out waiting for a gateway. | +| `0x80244024` | `WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP` | Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request. | +| `0x80244025` | `WU_E_PT_FILE_LOCATIONS_CHANGED` | Operation failed due to a changed file location; refresh internal state and resend. | +| `0x80244026` | `WU_E_PT_REGISTRATION_NOT_SUPPORTED` | Operation failed because Windows Update Agent does not support registration with a non-WSUS server. | +| `0x80244027` | `WU_E_PT_NO_AUTH_PLUGINS_REQUESTED` | The server returned an empty authentication information list. | +| `0x80244028` | `WU_E_PT_NO_AUTH_COOKIES_CREATED` | Windows Update Agent was unable to create any valid authentication cookies. | +| `0x80244029` | `WU_E_PT_INVALID_CONFIG_PROP` | A configuration property value was wrong. | +| `0x8024402A` | `WU_E_PT_CONFIG_PROP_MISSING` | A configuration property value was missing. | +| `0x8024402B` | `WU_E_PT_HTTP_STATUS_NOT_MAPPED` | The HTTP request couldn't be completed and the reason did not correspond to any of the `WU_E_PT_HTTP_*` error codes. | +| `0x8024402C` | `WU_E_PT_WINHTTP_NAME_NOT_RESOLVED` | Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved. | +| `0x8024402F` | `WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS` | External cab file processing completed with some errors. | +| `0x80244030` | `WU_E_PT_ECP_INIT_FAILED` | The external cab processor initialization did not complete. | +| `0x80244031` | `WU_E_PT_ECP_INVALID_FILE_FORMAT` | The format of a metadata file was invalid. | +| `0x80244032` | `WU_E_PT_ECP_INVALID_METADATA` | External cab processor found invalid metadata. | +| `0x80244033` | `WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST` | The file digest couldn't be extracted from an external cab file. | +| `0x80244034` | `WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE` | An external cab file couldn't be decompressed. | +| `0x80244035` | `WU_E_PT_ECP_FILE_LOCATION_ERROR` | External cab processor was unable to get file locations. | +| `0x80244FFF` | `WU_E_PT_UNEXPECTED` | A communication error not covered by another `WU_E_PT_*` error code. | +| `0x8024502D` | `WU_E_PT_SAME_REDIR_ID` | Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery. | +| `0x8024502E` | `WU_E_PT_NO_MANAGED_RECOVER` | A redirector recovery action did not complete because the server is managed. | ## Download Manager errors | Error code | Message | Description | |------------|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------| -| 0x80246001 | `WU_E_DM_URLNOTAVAILABLE` | A download manager operation couldn't be completed because the requested file does not have a URL. | -| 0x80246002 | `WU_E_DM_INCORRECTFILEHASH` | A download manager operation couldn't be completed because the file digest was not recognized. | -| 0x80246003 | `WU_E_DM_UNKNOWNALGORITHM` | A download manager operation couldn't be completed because the file metadata requested an unrecognized hash algorithm. | -| 0x80246004 | `WU_E_DM_NEEDDOWNLOADREQUEST` | An operation couldn't be completed because a download request is required from the download handler. | -| 0x80246005 | `WU_E_DM_NONETWORK` | A download manager operation couldn't be completed because the network connection was unavailable. | -| 0x80246006 | `WU_E_DM_WRONGBITSVERSION` | A download manager operation couldn't be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. | -| 0x80246007 | `WU_E_DM_NOTDOWNLOADED` | The update has not been downloaded. | -| 0x80246008 | `WU_E_DM_FAILTOCONNECTTOBITS` | A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). | -| 0x80246009 | `WU_E_DM_BITSTRANSFERERROR` | A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error. | -| 0x8024600A | `WU_E_DM_DOWNLOADLOCATIONCHANGED` | A download must be restarted because the location of the source of the download has changed. | -| 0x8024600B | `WU_E_DM_CONTENTCHANGED` | A download must be restarted because the update content changed in a new revision. | -| 0x80246FFF | `WU_E_DM_UNEXPECTED` | There was a download manager error not covered by another `WU_E_DM_*` error code. | +| `0x80246001` | `WU_E_DM_URLNOTAVAILABLE` | A download manager operation couldn't be completed because the requested file does not have a URL. | +| `0x80246002` | `WU_E_DM_INCORRECTFILEHASH` | A download manager operation couldn't be completed because the file digest was not recognized. | +| `0x80246003` | `WU_E_DM_UNKNOWNALGORITHM` | A download manager operation couldn't be completed because the file metadata requested an unrecognized hash algorithm. | +| `0x80246004` | `WU_E_DM_NEEDDOWNLOADREQUEST` | An operation couldn't be completed because a download request is required from the download handler. | +| `0x80246005` | `WU_E_DM_NONETWORK` | A download manager operation couldn't be completed because the network connection was unavailable. | +| `0x80246006` | `WU_E_DM_WRONGBITSVERSION` | A download manager operation couldn't be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. | +| `0x80246007` | `WU_E_DM_NOTDOWNLOADED` | The update has not been downloaded. | +| `0x80246008` | `WU_E_DM_FAILTOCONNECTTOBITS` | A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). | +| `0x80246009` | `WU_E_DM_BITSTRANSFERERROR` | A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error. | +| `0x8024600A` | `WU_E_DM_DOWNLOADLOCATIONCHANGED` | A download must be restarted because the location of the source of the download has changed. | +| `0x8024600B` | `WU_E_DM_CONTENTCHANGED` | A download must be restarted because the update content changed in a new revision. | +| `0x80246FFF` | `WU_E_DM_UNEXPECTED` | There was a download manager error not covered by another `WU_E_DM_*` error code. | ## Update Handler errors | Error code | Message | Description | |------------|----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| -| 0x80242000 | `WU_E_UH_REMOTEUNAVAILABLE` | A request for a remote update handler couldn't be completed because no remote process is available. | -| 0x80242001 | `WU_E_UH_LOCALONLY` | A request for a remote update handler could not be completed because the handler is local only. | -| 0x80242002 | `WU_E_UH_UNKNOWNHANDLER` | A request for an update handler could not be completed because the handler could not be recognized. | -| 0x80242003 | `WU_E_UH_REMOTEALREADYACTIVE` | A remote update handler could not be created because one already exists. | -| 0x80242004 | `WU_E_UH_DOESNOTSUPPORTACTION` | A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). | -| 0x80242005 | `WU_E_UH_WRONGHANDLER` | An operation did not complete because the wrong handler was specified. | -| 0x80242006 | `WU_E_UH_INVALIDMETADATA` | A handler operation could not be completed because the update contains invalid metadata. | -| 0x80242007 | `WU_E_UH_INSTALLERHUNG` | An operation could not be completed because the installer exceeded the time limit. | -| 0x80242008 | `WU_E_UH_OPERATIONCANCELLED` | An operation being done by the update handler was canceled. | -| 0x80242009 | `WU_E_UH_BADHANDLERXML` | An operation could not be completed because the handler-specific metadata is invalid. | -| 0x8024200A | `WU_E_UH_CANREQUIREINPUT` | A request to the handler to install an update could not be completed because the update requires user input. | -| 0x8024200B | `WU_E_UH_INSTALLERFAILURE` | The installer failed to install (uninstall) one or more updates. | -| 0x8024200C | `WU_E_UH_FALLBACKTOSELFCONTAINED` | The update handler should download self-contained content rather than delta-compressed content for the update. | -| 0x8024200D | `WU_E_UH_NEEDANOTHERDOWNLOAD` | The update handler did not install the update because it needs to be downloaded again. | -| 0x8024200E | `WU_E_UH_NOTIFYFAILURE` | The update handler failed to send notification of the status of the install (uninstall) operation. | -| 0x8024200F | `WU_E_UH_INCONSISTENT_FILE_NAMES` | The file names contained in the update metadata and in the update package are inconsistent. | -| 0x80242010 | `WU_E_UH_FALLBACKERROR` | The update handler failed to fall back to the self-contained content. | -| 0x80242011 | `WU_E_UH_TOOMANYDOWNLOADREQUESTS` | The update handler has exceeded the maximum number of download requests. | -| 0x80242012 | `WU_E_UH_UNEXPECTEDCBSRESPONSE` | The update handler has received an unexpected response from CBS. | -| 0x80242013 | `WU_E_UH_BADCBSPACKAGEID` | The update metadata contains an invalid CBS package identifier. | -| 0x80242014 | `WU_E_UH_POSTREBOOTSTILLPENDING` | The post-reboot operation for the update is still in progress. | -| 0x80242015 | `WU_E_UH_POSTREBOOTRESULTUNKNOWN` | The result of the post-reboot operation for the update could not be determined. | -| 0x80242016 | `WU_E_UH_POSTREBOOTUNEXPECTEDSTATE` | The state of the update after its post-reboot operation has completed is unexpected. | -| 0x80242017 | `WU_E_UH_NEW_SERVICING_STACK_REQUIRED` | The OS servicing stack must be updated before this update is downloaded or installed. | -| 0x80242FFF | `WU_E_UH_UNEXPECTED` | An update handler error not covered by another `WU_E_UH_*` code. | +| `0x80242000` | `WU_E_UH_REMOTEUNAVAILABLE` | A request for a remote update handler couldn't be completed because no remote process is available. | +| `0x80242001`| `WU_E_UH_LOCALONLY` | A request for a remote update handler could not be completed because the handler is local only. | +| `0x80242002` | `WU_E_UH_UNKNOWNHANDLER` | A request for an update handler could not be completed because the handler could not be recognized. | +| `0x80242003` | `WU_E_UH_REMOTEALREADYACTIVE` | A remote update handler could not be created because one already exists. | +| `0x80242004` | `WU_E_UH_DOESNOTSUPPORTACTION` | A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). | +|`0x80242005` | `WU_E_UH_WRONGHANDLER` | An operation did not complete because the wrong handler was specified. | +| `0x80242006` | `WU_E_UH_INVALIDMETADATA` | A handler operation could not be completed because the update contains invalid metadata. | +| `0x80242007` | `WU_E_UH_INSTALLERHUNG` | An operation could not be completed because the installer exceeded the time limit. | +| `0x80242008` | `WU_E_UH_OPERATIONCANCELLED` | An operation being done by the update handler was canceled. | +| `0x80242009` | `WU_E_UH_BADHANDLERXML` | An operation could not be completed because the handler-specific metadata is invalid. | +| `0x8024200A` | `WU_E_UH_CANREQUIREINPUT` | A request to the handler to install an update could not be completed because the update requires user input. | +| `0x8024200B` | `WU_E_UH_INSTALLERFAILURE` | The installer failed to install (uninstall) one or more updates. | +| `0x8024200C` | `WU_E_UH_FALLBACKTOSELFCONTAINED` | The update handler should download self-contained content rather than delta-compressed content for the update. | +| `0x8024200D` | `WU_E_UH_NEEDANOTHERDOWNLOAD` | The update handler did not install the update because it needs to be downloaded again. | +| `0x8024200E` | `WU_E_UH_NOTIFYFAILURE` | The update handler failed to send notification of the status of the install (uninstall) operation. | +| `0x8024200F` | `WU_E_UH_INCONSISTENT_FILE_NAMES` | The file names contained in the update metadata and in the update package are inconsistent. | +| `0x80242010` | `WU_E_UH_FALLBACKERROR` | The update handler failed to fall back to the self-contained content. | +| `0x80242011` | `WU_E_UH_TOOMANYDOWNLOADREQUESTS` | The update handler has exceeded the maximum number of download requests. | +| `0x80242012` | `WU_E_UH_UNEXPECTEDCBSRESPONSE` | The update handler has received an unexpected response from CBS. | +| `0x80242013` | `WU_E_UH_BADCBSPACKAGEID` | The update metadata contains an invalid CBS package identifier. | +| `0x80242014` | `WU_E_UH_POSTREBOOTSTILLPENDING` | The post-reboot operation for the update is still in progress. | +| `0x80242015` | `WU_E_UH_POSTREBOOTRESULTUNKNOWN` | The result of the post-reboot operation for the update could not be determined. | +| `0x80242016` | `WU_E_UH_POSTREBOOTUNEXPECTEDSTATE` | The state of the update after its post-reboot operation has completed is unexpected. | +| `0x80242017` | `WU_E_UH_NEW_SERVICING_STACK_REQUIRED` | The OS servicing stack must be updated before this update is downloaded or installed. | +| `0x80242FFF` | `WU_E_UH_UNEXPECTED` | An update handler error not covered by another `WU_E_UH_*` code. | ## Data Store errors | Error code | Message | Description | |------------|--------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 0x80248000 | `WU_E_DS_SHUTDOWN` | An operation failed because Windows Update Agent is shutting down. | -| 0x80248001 | `WU_E_DS_INUSE` | An operation failed because the data store was in use. | -| 0x80248002 | `WU_E_DS_INVALID` | The current and expected states of the data store do not match. | -| 0x80248003 | `WU_E_DS_TABLEMISSING` | The data store is missing a table. | -| 0x80248004 | `WU_E_DS_TABLEINCORRECT` | The data store contains a table with unexpected columns. | -| 0x80248005 | `WU_E_DS_INVALIDTABLENAME` | A table could not be opened because the table is not in the data store. | -| 0x80248006 | `WU_E_DS_BADVERSION` | The current and expected versions of the data store do not match. | -| 0x80248007 | `WU_E_DS_NODATA` | The information requested is not in the data store. | -| 0x80248008 | `WU_E_DS_MISSINGDATA` | The data store is missing required information or has a NULL in a table column that requires a non-null value. | -| 0x80248009 | `WU_E_DS_MISSINGREF` | The data store is missing required information or has a reference to missing license terms file localized property or linked row. | -| 0x8024800A | `WU_E_DS_UNKNOWNHANDLER` | The update was not processed because its update handler could not be recognized. | -| 0x8024800B | `WU_E_DS_CANTDELETE` | The update was not deleted because it is still referenced by one or more services. | -| 0x8024800C | `WU_E_DS_LOCKTIMEOUTEXPIRED` | The data store section could not be locked within the allotted time. | -| 0x8024800D | `WU_E_DS_NOCATEGORIES` | The category was not added because it contains no parent categories and is not a top-level category itself. | -| 0x8024800E | `WU_E_DS_ROWEXISTS` | The row was not added because an existing row has the same primary key. | -| 0x8024800F | `WU_E_DS_STOREFILELOCKED` | The data store could not be initialized because it was locked by another process. | -| 0x80248010 | `WU_E_DS_CANNOTREGISTER` | The data store is not allowed to be registered with COM in the current process. | -| 0x80248011 | `WU_E_DS_UNABLETOSTART` | Could not create a data store object in another process. | -| 0x80248013 | `WU_E_DS_DUPLICATEUPDATEID` | The server sent the same update to the client with two different revision IDs. | -| 0x80248014 | `WU_E_DS_UNKNOWNSERVICE` | An operation did not complete because the service is not in the data store. | -| 0x80248015 | `WU_E_DS_SERVICEEXPIRED` | An operation did not complete because the registration of the service has expired. | -| 0x80248016 | `WU_E_DS_DECLINENOTALLOWED` | A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline. | -| 0x80248017 | `WU_E_DS_TABLESESSIONMISMATCH` | A table was not closed because it is not associated with the session. | -| 0x80248018 | `WU_E_DS_SESSIONLOCKMISMATCH` | A table was not closed because it is not associated with the session. | -| 0x80248019 | `WU_E_DS_NEEDWINDOWSSERVICE` | A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service. | -| 0x8024801A | `WU_E_DS_INVALIDOPERATION` | A request was declined because the operation is not allowed. | -| 0x8024801B | `WU_E_DS_SCHEMAMISMATCH` | The schema of the current data store and the schema of a table in a backup XML document do not match. | -| 0x8024801C | `WU_E_DS_RESETREQUIRED` | The data store requires a session reset; release the session and retry with a new session. | -| 0x8024801D | `WU_E_DS_IMPERSONATED` | A data store operation did not complete because it was requested with an impersonated identity. | -| 0x80248FFF | `WU_E_DS_UNEXPECTED` | A data store error not covered by another `WU_E_DS_*` code. | +| `0x80248000` | `WU_E_DS_SHUTDOWN` | An operation failed because Windows Update Agent is shutting down. | +| `0x80248001` | `WU_E_DS_INUSE` | An operation failed because the data store was in use. | +| `0x80248002` | `WU_E_DS_INVALID` | The current and expected states of the data store do not match. | +| `0x80248003` | `WU_E_DS_TABLEMISSING` | The data store is missing a table. | +| `0x80248004` | `WU_E_DS_TABLEINCORRECT` | The data store contains a table with unexpected columns. | +| `0x80248005` | `WU_E_DS_INVALIDTABLENAME` | A table could not be opened because the table is not in the data store. | +| `0x80248006` | `WU_E_DS_BADVERSION` | The current and expected versions of the data store do not match. | +| `0x80248007` | `WU_E_DS_NODATA` | The information requested is not in the data store. | +| `0x80248008` | `WU_E_DS_MISSINGDATA` | The data store is missing required information or has a NULL in a table column that requires a non-null value. | +| `0x80248009` | `WU_E_DS_MISSINGREF` | The data store is missing required information or has a reference to missing license terms file localized property or linked row. | +| `0x8024800A` | `WU_E_DS_UNKNOWNHANDLER` | The update was not processed because its update handler could not be recognized. | +| `0x8024800B` | `WU_E_DS_CANTDELETE` | The update was not deleted because it is still referenced by one or more services. | +| `0x8024800C` | `WU_E_DS_LOCKTIMEOUTEXPIRED` | The data store section could not be locked within the allotted time. | +| `0x8024800D` | `WU_E_DS_NOCATEGORIES` | The category was not added because it contains no parent categories and is not a top-level category itself. | +| `0x8024800E` | `WU_E_DS_ROWEXISTS` | The row was not added because an existing row has the same primary key. | +| `0x8024800F` | `WU_E_DS_STOREFILELOCKED` | The data store could not be initialized because it was locked by another process. | +| `0x80248010` | `WU_E_DS_CANNOTREGISTER` | The data store is not allowed to be registered with COM in the current process. | +| `0x80248011` | `WU_E_DS_UNABLETOSTART` | Could not create a data store object in another process. | +| `0x80248013` | `WU_E_DS_DUPLICATEUPDATEID` | The server sent the same update to the client with two different revision IDs. | +| `0x80248014` | `WU_E_DS_UNKNOWNSERVICE` | An operation did not complete because the service is not in the data store. | +| `0x80248015` | `WU_E_DS_SERVICEEXPIRED` | An operation did not complete because the registration of the service has expired. | +| `0x80248016` | `WU_E_DS_DECLINENOTALLOWED` | A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline. | +| `0x80248017` | `WU_E_DS_TABLESESSIONMISMATCH` | A table was not closed because it is not associated with the session. | +| `0x80248018` | `WU_E_DS_SESSIONLOCKMISMATCH` | A table was not closed because it is not associated with the session. | +| `0x80248019` | `WU_E_DS_NEEDWINDOWSSERVICE` | A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service. | +| `0x8024801A` | `WU_E_DS_INVALIDOPERATION` | A request was declined because the operation is not allowed. | +| `0x8024801B` | `WU_E_DS_SCHEMAMISMATCH` | The schema of the current data store and the schema of a table in a backup XML document do not match. | +| `0x8024801C` | `WU_E_DS_RESETREQUIRED` | The data store requires a session reset; release the session and retry with a new session. | +| `0x8024801D` | `WU_E_DS_IMPERSONATED` | A data store operation did not complete because it was requested with an impersonated identity. | +| `0x80248FFF` | `WU_E_DS_UNEXPECTED` | A data store error not covered by another `WU_E_DS_*` code. | ## Driver Util errors The PnP enumerated device is removed from the System Spec because one of the hardware IDs or the compatible IDs matches an installed printer driver. This is not a fatal error, and the device is merely skipped. | Error code | Message | Description | |------------|-------------------------------|------------------------------------------------------------------------------------------------| -| 0x8024C001 | `WU_E_DRV_PRUNED` | A driver was skipped. | -| 0x8024C002 | `WU_E_DRV_NOPROP_OR_LEGACY` | A property for the driver could not be found. It may not conform with required specifications. | -| 0x8024C003 | `WU_E_DRV_REG_MISMATCH` | The registry type read for the driver does not match the expected type. | -| 0x8024C004 | `WU_E_DRV_NO_METADATA` | The driver update is missing metadata. | -| 0x8024C005 | `WU_E_DRV_MISSING_ATTRIBUTE` | The driver update is missing a required attribute. | -| 0x8024C006 | `WU_E_DRV_SYNC_FAILED` | Driver synchronization failed. | -| 0x8024C007 | `WU_E_DRV_NO_PRINTER_CONTENT` | Information required for the synchronization of applicable printers is missing. | -| 0x8024CFFF | `WU_E_DRV_UNEXPECTED` | A driver error not covered by another `WU_E_DRV_*` code. | +| `0x8024C001` | `WU_E_DRV_PRUNED` | A driver was skipped. | +| `0x8024C002` | `WU_E_DRV_NOPROP_OR_LEGACY` | A property for the driver could not be found. It may not conform with required specifications. | +| `0x8024C003` | `WU_E_DRV_REG_MISMATCH` | The registry type read for the driver does not match the expected type. | +| `0x8024C004` | `WU_E_DRV_NO_METADATA` | The driver update is missing metadata. | +| `0x8024C005` | `WU_E_DRV_MISSING_ATTRIBUTE` | The driver update is missing a required attribute. | +| `0x8024C006` | `WU_E_DRV_SYNC_FAILED` | Driver synchronization failed. | +| `0x8024C007` | `WU_E_DRV_NO_PRINTER_CONTENT` | Information required for the synchronization of applicable printers is missing. | +| `0x8024CFFF` | `WU_E_DRV_UNEXPECTED` | A driver error not covered by another `WU_E_DRV_*` code. | ## Windows Update error codes | Error code | Message | Description | |------------|-----------------------------------|--------------------------------------------------------------| -| 0x80240001 | `WU_E_NO_SERVICE` | Windows Update Agent was unable to provide the service. -| 0x80240002 | `WU_E_MAX_CAPACITY_REACHED` | The maximum capacity of the service was exceeded. -| 0x80240003 | `WU_E_UNKNOWN_ID` | An ID cannot be found. -| 0x80240004 | `WU_E_NOT_INITIALIZED` | The object could not be initialized. -| 0x80240005 | `WU_E_RANGEOVERLAP` | The update handler requested a byte range overlapping a previously requested range. -| 0x80240006 | `WU_E_TOOMANYRANGES` | The requested number of byte ranges exceeds the maximum number (2^31 - 1). -| 0x80240007 | `WU_E_INVALIDINDEX` | The index to a collection was invalid. -| 0x80240008 | `WU_E_ITEMNOTFOUND` | The key for the item queried could not be found. -| 0x80240009 | `WU_E_OPERATIONINPROGRESS` | Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously. -| 0x8024000A | `WU_E_COULDNOTCANCEL` | Cancellation of the operation was not allowed. -| 0x8024000B | `WU_E_CALL_CANCELLED` | Operation was canceled. -| 0x8024000C | `WU_E_NOOP` | No operation was required. -| 0x8024000D | `WU_E_XML_MISSINGDATA` | Windows Update Agent could not find required information in the update's XML data. -| 0x8024000E | `WU_E_XML_INVALID` | Windows Update Agent found invalid information in the update's XML data. -| 0x8024000F | `WU_E_CYCLE_DETECTED` | Circular update relationships were detected in the metadata. -| 0x80240010 | `WU_E_TOO_DEEP_RELATION` | Update relationships too deep to evaluate were evaluated. -| 0x80240011 | `WU_E_INVALID_RELATIONSHIP` | An invalid update relationship was detected. -| 0x80240012 | `WU_E_REG_VALUE_INVALID` | An invalid registry value was read. -| 0x80240013 | `WU_E_DUPLICATE_ITEM` | Operation tried to add a duplicate item to a list. -| 0x80240016 | `WU_E_INSTALL_NOT_ALLOWED` | Operation tried to install while another installation was in progress or the system was pending a mandatory restart. -| 0x80240017 | `WU_E_NOT_APPLICABLE` | Operation was not performed because there are no applicable updates. -| 0x80240018 | `WU_E_NO_USERTOKEN` | Operation failed because a required user token is missing. -| 0x80240019 | `WU_E_EXCLUSIVE_INSTALL_CONFLICT` | An exclusive update cannot be installed with other updates at the same time. -| 0x8024001A | `WU_E_POLICY_NOT_SET` | A policy value was not set. -| 0x8024001B | `WU_E_SELFUPDATE_IN_PROGRESS` | The operation could not be performed because the Windows Update Agent is self-updating. -| 0x8024001D | `WU_E_INVALID_UPDATE` | An update contains invalid metadata. -| 0x8024001E | `WU_E_SERVICE_STOP` | Operation did not complete because the service or system was being shut down. -| 0x8024001F | `WU_E_NO_CONNECTION` | Operation did not complete because the network connection was unavailable. -| 0x80240020 | `WU_E_NO_INTERACTIVE_USER` | Operation did not complete because there is no logged-on interactive user. -| 0x80240021 | `WU_E_TIME_OUT` | Operation did not complete because it timed out. -| 0x80240022 | `WU_E_ALL_UPDATES_FAILED` | Operation failed for all the updates. -| 0x80240023 | `WU_E_EULAS_DECLINED` | The license terms for all updates were declined. -| 0x80240024 | `WU_E_NO_UPDATE` | There are no updates. -| 0x80240025 | `WU_E_USER_ACCESS_DISABLED` | Group Policy settings prevented access to Windows Update. -| 0x80240026 | `WU_E_INVALID_UPDATE_TYPE` | The type of update is invalid. -| 0x80240027 | `WU_E_URL_TOO_LONG` | The URL exceeded the maximum length. -| 0x80240028 | `WU_E_UNINSTALL_NOT_ALLOWED` | The update could not be uninstalled because the request did not originate from a WSUS server. -| 0x80240029 | `WU_E_INVALID_PRODUCT_LICENSE` | Search may have missed some updates before there is an unlicensed application on the system. -| 0x8024002A | `WU_E_MISSING_HANDLER` | A component required to detect applicable updates was missing. -| 0x8024002B | `WU_E_LEGACYSERVER` | An operation did not complete because it requires a newer version of server. -| 0x8024002C | `WU_E_BIN_SOURCE_ABSENT` | A delta-compressed update could not be installed because it required the source. -| 0x8024002D | `WU_E_SOURCE_ABSENT` | A full-file update could not be installed because it required the source. -| 0x8024002E | `WU_E_WU_DISABLED` | Access to an unmanaged server is not allowed. -| 0x8024002F | `WU_E_CALL_CANCELLED_BY_POLICY` | Operation did not complete because the DisableWindowsUpdateAccess policy was set. -| 0x80240030 | `WU_E_INVALID_PROXY_SERVER` | The format of the proxy list was invalid. -| 0x80240031 | `WU_E_INVALID_FILE` | The file is in the wrong format. -| 0x80240032 | `WU_E_INVALID_CRITERIA` | The search criteria string was invalid. -| 0x80240033 | `WU_E_EULA_UNAVAILABLE` | License terms could not be downloaded. -| 0x80240034 | `WU_E_DOWNLOAD_FAILED` | Update failed to download. -| 0x80240035 | `WU_E_UPDATE_NOT_PROCESSED` | The update was not processed. -| 0x80240036 | `WU_E_INVALID_OPERATION` | The object's current state did not allow the operation. -| 0x80240037 | `WU_E_NOT_SUPPORTED` | The functionality for the operation is not supported. -| 0x80240038 | `WU_E_WINHTTP_INVALID_FILE` | The downloaded file has an unexpected content type. -| 0x80240039 | `WU_E_TOO_MANY_RESYNC` | Agent is asked by server to resync too many times. -| 0x80240040 | `WU_E_NO_SERVER_CORE_SUPPORT` | `WUA API` method does not run on Server Core installation. -| 0x80240041 | `WU_E_SYSPREP_IN_PROGRESS` | Service is not available while sysprep is running. -| 0x80240042 | `WU_E_UNKNOWN_SERVICE` | The update service is no longer registered with `AU`. -| 0x80240043 | `WU_E_NO_UI_SUPPORT` | There is no support for `WUA UI`. -| 0x80240FFF | `WU_E_UNEXPECTED` | An operation failed due to reasons not covered by another error code. -| 0x80070422 | | Windows Update service stopped working or is not running. +| `0x80240001` | `WU_E_NO_SERVICE` | Windows Update Agent was unable to provide the service. +| `0x80240002` | `WU_E_MAX_CAPACITY_REACHED` | The maximum capacity of the service was exceeded. +| `0x80240003` | `WU_E_UNKNOWN_ID` | An ID cannot be found. +| `0x80240004` | `WU_E_NOT_INITIALIZED` | The object could not be initialized. +| `0x80240005` | `WU_E_RANGEOVERLAP` | The update handler requested a byte range overlapping a previously requested range. +| `0x80240006` | `WU_E_TOOMANYRANGES` | The requested number of byte ranges exceeds the maximum number (2^31 - 1). +| `0x80240007` | `WU_E_INVALIDINDEX` | The index to a collection was invalid. +| `0x80240008` | `WU_E_ITEMNOTFOUND` | The key for the item queried could not be found. +| `0x80240009` | `WU_E_OPERATIONINPROGRESS` | Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously. +| `0x8024000A` | `WU_E_COULDNOTCANCEL` | Cancellation of the operation was not allowed. +| `0x8024000B` | `WU_E_CALL_CANCELLED` | Operation was canceled. +| `0x8024000C` | `WU_E_NOOP` | No operation was required. +| `0x8024000D` | `WU_E_XML_MISSINGDATA` | Windows Update Agent could not find required information in the update's XML data. +| `0x8024000E` | `WU_E_XML_INVALID` | Windows Update Agent found invalid information in the update's XML data. +| `0x8024000F` | `WU_E_CYCLE_DETECTED` | Circular update relationships were detected in the metadata. +| `0x80240010` | `WU_E_TOO_DEEP_RELATION` | Update relationships too deep to evaluate were evaluated. +| `0x80240011` | `WU_E_INVALID_RELATIONSHIP` | An invalid update relationship was detected. +| `0x80240012` | `WU_E_REG_VALUE_INVALID` | An invalid registry value was read. +| `0x80240013` | `WU_E_DUPLICATE_ITEM` | Operation tried to add a duplicate item to a list. +| `0x80240016` | `WU_E_INSTALL_NOT_ALLOWED` | Operation tried to install while another installation was in progress or the system was pending a mandatory restart. +| `0x80240017` | `WU_E_NOT_APPLICABLE` | Operation was not performed because there are no applicable updates. +| `0x80240018` | `WU_E_NO_USERTOKEN` | Operation failed because a required user token is missing. +| `0x80240019` | `WU_E_EXCLUSIVE_INSTALL_CONFLICT` | An exclusive update cannot be installed with other updates at the same time. +| `0x8024001A` | `WU_E_POLICY_NOT_SET` | A policy value was not set. +| `0x8024001B` | `WU_E_SELFUPDATE_IN_PROGRESS` | The operation could not be performed because the Windows Update Agent is self-updating. +| `0x8024001D` | `WU_E_INVALID_UPDATE` | An update contains invalid metadata. +| `0x8024001E` | `WU_E_SERVICE_STOP` | Operation did not complete because the service or system was being shut down. +| `0x8024001F` | `WU_E_NO_CONNECTION` | Operation did not complete because the network connection was unavailable. +| `0x80240020` | `WU_E_NO_INTERACTIVE_USER` | Operation did not complete because there is no logged-on interactive user. +| `0x80240021` | `WU_E_TIME_OUT` | Operation did not complete because it timed out. +| `0x80240022` | `WU_E_ALL_UPDATES_FAILED` | Operation failed for all the updates. +| `0x80240023` | `WU_E_EULAS_DECLINED` | The license terms for all updates were declined. +| `0x80240024` | `WU_E_NO_UPDATE` | There are no updates. +| `0x80240025` | `WU_E_USER_ACCESS_DISABLED` | Group Policy settings prevented access to Windows Update. +| `0x80240026` | `WU_E_INVALID_UPDATE_TYPE` | The type of update is invalid. +| `0x80240027` | `WU_E_URL_TOO_LONG` | The URL exceeded the maximum length. +| `0x80240028` | `WU_E_UNINSTALL_NOT_ALLOWED` | The update could not be uninstalled because the request did not originate from a WSUS server. +| `0x80240029` | `WU_E_INVALID_PRODUCT_LICENSE` | Search may have missed some updates before there is an unlicensed application on the system. +| `0x8024002A` | `WU_E_MISSING_HANDLER` | A component required to detect applicable updates was missing. +| `0x8024002B` | `WU_E_LEGACYSERVER` | An operation did not complete because it requires a newer version of server. +| `0x8024002C` | `WU_E_BIN_SOURCE_ABSENT` | A delta-compressed update could not be installed because it required the source. +| `0x8024002D` | `WU_E_SOURCE_ABSENT` | A full-file update could not be installed because it required the source. +| `0x8024002E` | `WU_E_WU_DISABLED` | Access to an unmanaged server is not allowed. +| `0x8024002F` | `WU_E_CALL_CANCELLED_BY_POLICY` | Operation did not complete because the DisableWindowsUpdateAccess policy was set. +| `0x80240030` | `WU_E_INVALID_PROXY_SERVER` | The format of the proxy list was invalid. +| `0x80240031` | `WU_E_INVALID_FILE` | The file is in the wrong format. +| `0x80240032` | `WU_E_INVALID_CRITERIA` | The search criteria string was invalid. +| `0x80240033` | `WU_E_EULA_UNAVAILABLE` | License terms could not be downloaded. +| `0x80240034` | `WU_E_DOWNLOAD_FAILED` | Update failed to download. +| `0x80240035` | `WU_E_UPDATE_NOT_PROCESSED` | The update was not processed. +| `0x80240036` | `WU_E_INVALID_OPERATION` | The object's current state did not allow the operation. +| `0x80240037` | `WU_E_NOT_SUPPORTED` | The functionality for the operation is not supported. +| `0x80240038` | `WU_E_WINHTTP_INVALID_FILE` | The downloaded file has an unexpected content type. +| `0x80240039` | `WU_E_TOO_MANY_RESYNC` | Agent is asked by server to resync too many times. +| `0x80240040` | `WU_E_NO_SERVER_CORE_SUPPORT` | `WUA API` method does not run on Server Core installation. +| `0x80240041` | `WU_E_SYSPREP_IN_PROGRESS` | Service is not available while sysprep is running. +| `0x80240042` | `WU_E_UNKNOWN_SERVICE` | The update service is no longer registered with `AU`. +| `0x80240043` | `WU_E_NO_UI_SUPPORT` | There is no support for `WUA UI`. +| `0x80240FFF` | `WU_E_UNEXPECTED` | An operation failed due to reasons not covered by another error code. +| `0x80070422` | | Windows Update service stopped working or is not running. ## Windows Update success codes | Error code | Message | Description | |------------|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------| -| 0x00240001 | `WU_S_SERVICE_STOP` | Windows Update Agent was stopped successfully. | -| 0x00240002 | `WU_S_SELFUPDATE` | Windows Update Agent updated itself. | -| 0x00240003 | `WU_S_UPDATE_ERROR` | Operation completed successfully but there were errors applying the updates. | -| 0x00240004 | `WU_S_MARKED_FOR_DISCONNECT` | A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing. | -| 0x00240005 | `WU_S_REBOOT_REQUIRED` | The system must be restarted to complete installation of the update. | -| 0x00240006 | `WU_S_ALREADY_INSTALLED` | The update to be installed is already installed on the system. | -| 0x00240007 | `WU_S_ALREADY_UNINSTALLED` | The update to be removed is not installed on the system. | -| 0x00240008 | `WU_S_ALREADY_DOWNLOADED` | The update to be downloaded has already been downloaded. | +| `0x00240001` | `WU_S_SERVICE_STOP` | Windows Update Agent was stopped successfully. | +| `0x00240002` | `WU_S_SELFUPDATE` | Windows Update Agent updated itself. | +| `0x00240003` | `WU_S_UPDATE_ERROR` | Operation completed successfully but there were errors applying the updates. | +| `0x00240004` | `WU_S_MARKED_FOR_DISCONNECT` | A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing. | +| `0x00240005` | `WU_S_REBOOT_REQUIRED` | The system must be restarted to complete installation of the update. | +| `0x00240006` | `WU_S_ALREADY_INSTALLED` | The update to be installed is already installed on the system. | +| `0x00240007` | `WU_S_ALREADY_UNINSTALLED` | The update to be removed is not installed on the system. | +| `0x00240008` | `WU_S_ALREADY_DOWNLOADED` | The update to be downloaded has already been downloaded. | ## Windows Installer minor errors The following errors are used to indicate that part of a search fails because of Windows Installer problems. Another part of the search may successfully return updates. All Windows Installer minor codes must share the same error code range so that the caller can tell that they are related to Windows Installer. | Error code | Message | Description | |------------|------------------------------|---------------------------------------------------------------------------------------------| -| 0x80241001 | `WU_E_MSI_WRONG_VERSION` | Search may have missed some updates because the Windows Installer is less than version 3.1. | -| 0x80241002 | `WU_E_MSI_NOT_CONFIGURED` | Search may have missed some updates because the Windows Installer is not configured. | -| 0x80241003 | `WU_E_MSP_DISABLED` | Search may have missed some updates because policy has disabled Windows Installer patching. | -| 0x80241004 | `WU_E_MSI_WRONG_APP_CONTEXT` | An update could not be applied because the application is installed per-user. | -| 0x80241FFF | `WU_E_MSP_UNEXPECTED` | Search may have missed some updates because there was a failure of the Windows Installer. | +| `0x80241001` | `WU_E_MSI_WRONG_VERSION` | Search may have missed some updates because the Windows Installer is less than version 3.1. | +| `0x80241002` | `WU_E_MSI_NOT_CONFIGURED` | Search may have missed some updates because the Windows Installer is not configured. | +| `0x80241003` | `WU_E_MSP_DISABLED` | Search may have missed some updates because policy has disabled Windows Installer patching. | +| `0x80241004` | `WU_E_MSI_WRONG_APP_CONTEXT` | An update could not be applied because the application is installed per-user. | +| `0x80241FFF` | `WU_E_MSP_UNEXPECTED` | Search may have missed some updates because there was a failure of the Windows Installer. | ## Windows Update Agent update and setup errors | Error code | Message | Description | |------------|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------| -| 0x8024D001 | `WU_E_SETUP_INVALID_INFDATA` | Windows Update Agent could not be updated because an INF file contains invalid information. | -| 0x8024D002 | `WU_E_SETUP_INVALID_IDENTDATA` | Windows Update Agent could not be updated because the `wuident.cab` file contains invalid information. | -| 0x8024D003 | `WU_E_SETUP_ALREADY_INITIALIZED` | Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice. | -| 0x8024D004 | `WU_E_SETUP_NOT_INITIALIZED` | Windows Update Agent could not be updated because setup initialization never completed successfully. | -| 0x8024D005 | `WU_E_SETUP_SOURCE_VERSION_MISMATCH` | Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions. | -| 0x8024D006 | `WU_E_SETUP_TARGET_VERSION_GREATER` | Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file. | -| 0x8024D007 | `WU_E_SETUP_REGISTRATION_FAILED` | Windows Update Agent could not be updated because `regsvr32.exe` returned an error. | -| 0x8024D009 | `WU_E_SETUP_SKIP_UPDATE` | An update to the Windows Update Agent was skipped due to a directive in the `wuident.cab` file. | -| 0x8024D00A | `WU_E_SETUP_UNSUPPORTED_CONFIGURATION` | Windows Update Agent could not be updated because the current system configuration is not supported. | -| 0x8024D00B | `WU_E_SETUP_BLOCKED_CONFIGURATION` | Windows Update Agent could not be updated because the system is configured to block the update. | -| 0x8024D00C | `WU_E_SETUP_REBOOT_TO_FIX` | Windows Update Agent could not be updated because a restart of the system is required. | -| 0x8024D00D | `WU_E_SETUP_ALREADYRUNNING` | Windows Update Agent setup is already running. | -| 0x8024D00E | `WU_E_SETUP_REBOOTREQUIRED` | Windows Update Agent setup package requires a reboot to complete installation. | -| 0x8024D00F | `WU_E_SETUP_HANDLER_EXEC_FAILURE` | Windows Update Agent could not be updated because the setup handler failed during execution. | -| 0x8024D010 | `WU_E_SETUP_INVALID_REGISTRY_DATA` | Windows Update Agent could not be updated because the registry contains invalid information. | -| 0x8024D013 | `WU_E_SETUP_WRONG_SERVER_VERSION` | Windows Update Agent could not be updated because the server does not contain update information for this version. | -| 0x8024DFFF | `WU_E_SETUP_UNEXPECTED` | Windows Update Agent could not be updated because of an error not covered by another `WU_E_SETUP_*` error code. | +| `0x8024D001` | `WU_E_SETUP_INVALID_INFDATA` | Windows Update Agent could not be updated because an INF file contains invalid information. | +| `0x8024D002` | `WU_E_SETUP_INVALID_IDENTDATA` | Windows Update Agent could not be updated because the `wuident.cab` file contains invalid information. | +| `0x8024D003` | `WU_E_SETUP_ALREADY_INITIALIZED` | Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice. | +| `0x8024D004` | `WU_E_SETUP_NOT_INITIALIZED` | Windows Update Agent could not be updated because setup initialization never completed successfully. | +| `0x8024D005` | `WU_E_SETUP_SOURCE_VERSION_MISMATCH` | Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions. | +| `0x8024D006` | `WU_E_SETUP_TARGET_VERSION_GREATER` | Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file. | +| `0x8024D007` | `WU_E_SETUP_REGISTRATION_FAILED` | Windows Update Agent could not be updated because `regsvr32.exe` returned an error. | +| `0x8024D009` | `WU_E_SETUP_SKIP_UPDATE` | An update to the Windows Update Agent was skipped due to a directive in the `wuident.cab` file. | +| `0x8024D00A` | `WU_E_SETUP_UNSUPPORTED_CONFIGURATION` | Windows Update Agent could not be updated because the current system configuration is not supported. | +| `0x8024D00B` | `WU_E_SETUP_BLOCKED_CONFIGURATION` | Windows Update Agent could not be updated because the system is configured to block the update. | +| `0x8024D00C` | `WU_E_SETUP_REBOOT_TO_FIX` | Windows Update Agent could not be updated because a restart of the system is required. | +| `0x8024D00D` | `WU_E_SETUP_ALREADYRUNNING` | Windows Update Agent setup is already running. | +| `0x8024D00E` | `WU_E_SETUP_REBOOTREQUIRED` | Windows Update Agent setup package requires a reboot to complete installation. | +| `0x8024D00F` | `WU_E_SETUP_HANDLER_EXEC_FAILURE` | Windows Update Agent could not be updated because the setup handler failed during execution. | +| `0x8024D010` | `WU_E_SETUP_INVALID_REGISTRY_DATA` | Windows Update Agent could not be updated because the registry contains invalid information. | +| `0x8024D013` | `WU_E_SETUP_WRONG_SERVER_VERSION` | Windows Update Agent could not be updated because the server does not contain update information for this version. | +| `0x8024DFFF` | `WU_E_SETUP_UNEXPECTED` | Windows Update Agent could not be updated because of an error not covered by another `WU_E_SETUP_*` error code. | From 8cd78dbee887b14cd1a24cc4857120a03c4a7438 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 29 Aug 2023 08:47:33 -0700 Subject: [PATCH 116/125] meta3upd --- .../update/windows-update-error-reference.md | 192 +++++++++--------- 1 file changed, 96 insertions(+), 96 deletions(-) diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md index 1f93ca12bc..f69e4c5796 100644 --- a/windows/deployment/update/windows-update-error-reference.md +++ b/windows/deployment/update/windows-update-error-reference.md @@ -116,7 +116,7 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | `0x8024400B` | `WU_E_PT_SOAP_VERSION` | Same as `SOAP_E_VERSION_MISMATCH` - `SOAP` client found an unrecognizable namespace for the `SOAP` envelope. | | `0x8024400C` | `WU_E_PT_SOAP_MUST_UNDERSTAND` | Same as `SOAP_E_MUST_UNDERSTAND` - `SOAP` client was unable to understand a header. | | `0x8024400D` | `WU_E_PT_SOAP_CLIENT` | Same as `SOAP_E_CLIENT` - `SOAP` client found the message was malformed; fix before resending. | -|`0x8024400E` | `WU_E_PT_SOAP_SERVER` | Same as `SOAP_E_SERVER` - The `SOAP` message could not be processed due to a server error; resend later. | +|`0x8024400E` | `WU_E_PT_SOAP_SERVER` | Same as `SOAP_E_SERVER` - The `SOAP` message couldn't be processed due to a server error; resend later. | | `0x8024400F` | `WU_E_PT_WMI_ERROR` | There was an unspecified Windows Management Instrumentation (WMI) error. | | `0x80244010` | `WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS` | The number of round trips to the server exceeded the maximum limit. | | `0x80244011` | `WU_E_PT_SUS_SERVER_NOT_SET` | WUServer policy value is missing in the registry. | @@ -126,28 +126,28 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | `0x80244016` | `WU_E_PT_HTTP_STATUS_BAD_REQUEST` | Same as HTTP status 400 - the server couldn't process the request due to invalid syntax. | | `0x80244017`` | `WU_E_PT_HTTP_STATUS_DENIED` | Same as HTTP status 401 - the requested resource requires user authentication. | | `0x80244018` | `WU_E_PT_HTTP_STATUS_FORBIDDEN` | Same as HTTP status 403 - server understood the request but declined to fulfill it. | -| `0x80244019` | `WU_E_PT_HTTP_STATUS_NOT_FOUND` | Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier). | -| `0x8024401A` | `WU_E_PT_HTTP_STATUS_BAD_METHOD` | Same as HTTP status 405 - the HTTP method is not allowed. | +| `0x80244019` | `WU_E_PT_HTTP_STATUS_NOT_FOUND` | Same as HTTP status 404 - the server can't find the requested URI (Uniform Resource Identifier). | +| `0x8024401A` | `WU_E_PT_HTTP_STATUS_BAD_METHOD` | Same as HTTP status 405 - the HTTP method isn't allowed. | | `0x8024401B` | `WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ` | Same as HTTP status 407 - proxy authentication is required. | | `0x8024401C` | `WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT` | Same as HTTP status 408 - the server timed out waiting for the request. | -| `0x8024401D` | `WU_E_PT_HTTP_STATUS_CONFLICT` | Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource. | +| `0x8024401D` | `WU_E_PT_HTTP_STATUS_CONFLICT` | Same as HTTP status 409 - the request wasn't completed due to a conflict with the current state of the resource. | | `0x8024401E` | `WU_E_PT_HTTP_STATUS_GONE` | Same as HTTP status 410 - requested resource is no longer available at the server. | | `0x8024401F` | `WU_E_PT_HTTP_STATUS_SERVER_ERROR` | Same as HTTP status 500 - an error internal to the server prevented fulfilling the request. | -| `0x80244020` | `WU_E_PT_HTTP_STATUS_NOT_SUPPORTED` | Same as HTTP status 500 - server does not support the functionality required to fulfill the request. | +| `0x80244020` | `WU_E_PT_HTTP_STATUS_NOT_SUPPORTED` | Same as HTTP status 500 - server doesn't support the functionality required to fulfill the request. | |`0x80244021` | `WU_E_PT_HTTP_STATUS_BAD_GATEWAY` | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfill the request. | | `0x80244022` | `WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL` | Same as HTTP status 503 - the service is temporarily overloaded. | | `0x80244023` | `WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT` | Same as HTTP status 503 - the request was timed out waiting for a gateway. | -| `0x80244024` | `WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP` | Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request. | +| `0x80244024` | `WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP` | Same as HTTP status 505 - the server doesn't support the HTTP protocol version used for the request. | | `0x80244025` | `WU_E_PT_FILE_LOCATIONS_CHANGED` | Operation failed due to a changed file location; refresh internal state and resend. | -| `0x80244026` | `WU_E_PT_REGISTRATION_NOT_SUPPORTED` | Operation failed because Windows Update Agent does not support registration with a non-WSUS server. | +| `0x80244026` | `WU_E_PT_REGISTRATION_NOT_SUPPORTED` | Operation failed because Windows Update Agent doesn't support registration with a non-WSUS server. | | `0x80244027` | `WU_E_PT_NO_AUTH_PLUGINS_REQUESTED` | The server returned an empty authentication information list. | | `0x80244028` | `WU_E_PT_NO_AUTH_COOKIES_CREATED` | Windows Update Agent was unable to create any valid authentication cookies. | | `0x80244029` | `WU_E_PT_INVALID_CONFIG_PROP` | A configuration property value was wrong. | | `0x8024402A` | `WU_E_PT_CONFIG_PROP_MISSING` | A configuration property value was missing. | -| `0x8024402B` | `WU_E_PT_HTTP_STATUS_NOT_MAPPED` | The HTTP request couldn't be completed and the reason did not correspond to any of the `WU_E_PT_HTTP_*` error codes. | -| `0x8024402C` | `WU_E_PT_WINHTTP_NAME_NOT_RESOLVED` | Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved. | +| `0x8024402B` | `WU_E_PT_HTTP_STATUS_NOT_MAPPED` | The HTTP request couldn't be completed and the reason didn't correspond to any of the `WU_E_PT_HTTP_*` error codes. | +| `0x8024402C` | `WU_E_PT_WINHTTP_NAME_NOT_RESOLVED` | Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name can't be resolved. | | `0x8024402F` | `WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS` | External cab file processing completed with some errors. | -| `0x80244030` | `WU_E_PT_ECP_INIT_FAILED` | The external cab processor initialization did not complete. | +| `0x80244030` | `WU_E_PT_ECP_INIT_FAILED` | The external cab processor initialization didn't complete. | | `0x80244031` | `WU_E_PT_ECP_INVALID_FILE_FORMAT` | The format of a metadata file was invalid. | | `0x80244032` | `WU_E_PT_ECP_INVALID_METADATA` | External cab processor found invalid metadata. | | `0x80244033` | `WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST` | The file digest couldn't be extracted from an external cab file. | @@ -155,19 +155,19 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | `0x80244035` | `WU_E_PT_ECP_FILE_LOCATION_ERROR` | External cab processor was unable to get file locations. | | `0x80244FFF` | `WU_E_PT_UNEXPECTED` | A communication error not covered by another `WU_E_PT_*` error code. | | `0x8024502D` | `WU_E_PT_SAME_REDIR_ID` | Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery. | -| `0x8024502E` | `WU_E_PT_NO_MANAGED_RECOVER` | A redirector recovery action did not complete because the server is managed. | +| `0x8024502E` | `WU_E_PT_NO_MANAGED_RECOVER` | A redirector recovery action didn't complete because the server is managed. | ## Download Manager errors | Error code | Message | Description | |------------|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------| -| `0x80246001` | `WU_E_DM_URLNOTAVAILABLE` | A download manager operation couldn't be completed because the requested file does not have a URL. | -| `0x80246002` | `WU_E_DM_INCORRECTFILEHASH` | A download manager operation couldn't be completed because the file digest was not recognized. | +| `0x80246001` | `WU_E_DM_URLNOTAVAILABLE` | A download manager operation couldn't be completed because the requested file doesn't have a URL. | +| `0x80246002` | `WU_E_DM_INCORRECTFILEHASH` | A download manager operation couldn't be completed because the file digest wasn't recognized. | | `0x80246003` | `WU_E_DM_UNKNOWNALGORITHM` | A download manager operation couldn't be completed because the file metadata requested an unrecognized hash algorithm. | | `0x80246004` | `WU_E_DM_NEEDDOWNLOADREQUEST` | An operation couldn't be completed because a download request is required from the download handler. | | `0x80246005` | `WU_E_DM_NONETWORK` | A download manager operation couldn't be completed because the network connection was unavailable. | | `0x80246006` | `WU_E_DM_WRONGBITSVERSION` | A download manager operation couldn't be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. | -| `0x80246007` | `WU_E_DM_NOTDOWNLOADED` | The update has not been downloaded. | +| `0x80246007` | `WU_E_DM_NOTDOWNLOADED` | The update hasn't been downloaded. | | `0x80246008` | `WU_E_DM_FAILTOCONNECTTOBITS` | A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). | | `0x80246009` | `WU_E_DM_BITSTRANSFERERROR` | A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error. | | `0x8024600A` | `WU_E_DM_DOWNLOADLOCATIONCHANGED` | A download must be restarted because the location of the source of the download has changed. | @@ -179,19 +179,19 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | Error code | Message | Description | |------------|----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| | `0x80242000` | `WU_E_UH_REMOTEUNAVAILABLE` | A request for a remote update handler couldn't be completed because no remote process is available. | -| `0x80242001`| `WU_E_UH_LOCALONLY` | A request for a remote update handler could not be completed because the handler is local only. | -| `0x80242002` | `WU_E_UH_UNKNOWNHANDLER` | A request for an update handler could not be completed because the handler could not be recognized. | -| `0x80242003` | `WU_E_UH_REMOTEALREADYACTIVE` | A remote update handler could not be created because one already exists. | -| `0x80242004` | `WU_E_UH_DOESNOTSUPPORTACTION` | A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). | -|`0x80242005` | `WU_E_UH_WRONGHANDLER` | An operation did not complete because the wrong handler was specified. | -| `0x80242006` | `WU_E_UH_INVALIDMETADATA` | A handler operation could not be completed because the update contains invalid metadata. | -| `0x80242007` | `WU_E_UH_INSTALLERHUNG` | An operation could not be completed because the installer exceeded the time limit. | +| `0x80242001`| `WU_E_UH_LOCALONLY` | A request for a remote update handler couldn't be completed because the handler is local only. | +| `0x80242002` | `WU_E_UH_UNKNOWNHANDLER` | A request for an update handler couldn't be completed because the handler couldn't be recognized. | +| `0x80242003` | `WU_E_UH_REMOTEALREADYACTIVE` | A remote update handler couldn't be created because one already exists. | +| `0x80242004` | `WU_E_UH_DOESNOTSUPPORTACTION` | A request for the handler to install (uninstall) an update couldn't be completed because the update doesn't support install (uninstall). | +|`0x80242005` | `WU_E_UH_WRONGHANDLER` | An operation didn't complete because the wrong handler was specified. | +| `0x80242006` | `WU_E_UH_INVALIDMETADATA` | A handler operation couldn't be completed because the update contains invalid metadata. | +| `0x80242007` | `WU_E_UH_INSTALLERHUNG` | An operation couldn't be completed because the installer exceeded the time limit. | | `0x80242008` | `WU_E_UH_OPERATIONCANCELLED` | An operation being done by the update handler was canceled. | -| `0x80242009` | `WU_E_UH_BADHANDLERXML` | An operation could not be completed because the handler-specific metadata is invalid. | -| `0x8024200A` | `WU_E_UH_CANREQUIREINPUT` | A request to the handler to install an update could not be completed because the update requires user input. | +| `0x80242009` | `WU_E_UH_BADHANDLERXML` | An operation couldn't be completed because the handler-specific metadata is invalid. | +| `0x8024200A` | `WU_E_UH_CANREQUIREINPUT` | A request to the handler to install an update couldn't be completed because the update requires user input. | | `0x8024200B` | `WU_E_UH_INSTALLERFAILURE` | The installer failed to install (uninstall) one or more updates. | | `0x8024200C` | `WU_E_UH_FALLBACKTOSELFCONTAINED` | The update handler should download self-contained content rather than delta-compressed content for the update. | -| `0x8024200D` | `WU_E_UH_NEEDANOTHERDOWNLOAD` | The update handler did not install the update because it needs to be downloaded again. | +| `0x8024200D` | `WU_E_UH_NEEDANOTHERDOWNLOAD` | The update handler didn't install the update because it needs to be downloaded again. | | `0x8024200E` | `WU_E_UH_NOTIFYFAILURE` | The update handler failed to send notification of the status of the install (uninstall) operation. | | `0x8024200F` | `WU_E_UH_INCONSISTENT_FILE_NAMES` | The file names contained in the update metadata and in the update package are inconsistent. | | `0x80242010` | `WU_E_UH_FALLBACKERROR` | The update handler failed to fall back to the self-contained content. | @@ -199,7 +199,7 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | `0x80242012` | `WU_E_UH_UNEXPECTEDCBSRESPONSE` | The update handler has received an unexpected response from CBS. | | `0x80242013` | `WU_E_UH_BADCBSPACKAGEID` | The update metadata contains an invalid CBS package identifier. | | `0x80242014` | `WU_E_UH_POSTREBOOTSTILLPENDING` | The post-reboot operation for the update is still in progress. | -| `0x80242015` | `WU_E_UH_POSTREBOOTRESULTUNKNOWN` | The result of the post-reboot operation for the update could not be determined. | +| `0x80242015` | `WU_E_UH_POSTREBOOTRESULTUNKNOWN` | The result of the post-reboot operation for the update couldn't be determined. | | `0x80242016` | `WU_E_UH_POSTREBOOTUNEXPECTEDSTATE` | The state of the update after its post-reboot operation has completed is unexpected. | | `0x80242017` | `WU_E_UH_NEW_SERVICING_STACK_REQUIRED` | The OS servicing stack must be updated before this update is downloaded or installed. | | `0x80242FFF` | `WU_E_UH_UNEXPECTED` | An update handler error not covered by another `WU_E_UH_*` code. | @@ -210,43 +210,43 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These |------------|--------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `0x80248000` | `WU_E_DS_SHUTDOWN` | An operation failed because Windows Update Agent is shutting down. | | `0x80248001` | `WU_E_DS_INUSE` | An operation failed because the data store was in use. | -| `0x80248002` | `WU_E_DS_INVALID` | The current and expected states of the data store do not match. | +| `0x80248002` | `WU_E_DS_INVALID` | The current and expected states of the data store don't match. | | `0x80248003` | `WU_E_DS_TABLEMISSING` | The data store is missing a table. | | `0x80248004` | `WU_E_DS_TABLEINCORRECT` | The data store contains a table with unexpected columns. | -| `0x80248005` | `WU_E_DS_INVALIDTABLENAME` | A table could not be opened because the table is not in the data store. | -| `0x80248006` | `WU_E_DS_BADVERSION` | The current and expected versions of the data store do not match. | -| `0x80248007` | `WU_E_DS_NODATA` | The information requested is not in the data store. | +| `0x80248005` | `WU_E_DS_INVALIDTABLENAME` | A table couldn't be opened because the table isn't in the data store. | +| `0x80248006` | `WU_E_DS_BADVERSION` | The current and expected versions of the data store don't match. | +| `0x80248007` | `WU_E_DS_NODATA` | The information requested isn't in the data store. | | `0x80248008` | `WU_E_DS_MISSINGDATA` | The data store is missing required information or has a NULL in a table column that requires a non-null value. | | `0x80248009` | `WU_E_DS_MISSINGREF` | The data store is missing required information or has a reference to missing license terms file localized property or linked row. | -| `0x8024800A` | `WU_E_DS_UNKNOWNHANDLER` | The update was not processed because its update handler could not be recognized. | -| `0x8024800B` | `WU_E_DS_CANTDELETE` | The update was not deleted because it is still referenced by one or more services. | -| `0x8024800C` | `WU_E_DS_LOCKTIMEOUTEXPIRED` | The data store section could not be locked within the allotted time. | -| `0x8024800D` | `WU_E_DS_NOCATEGORIES` | The category was not added because it contains no parent categories and is not a top-level category itself. | -| `0x8024800E` | `WU_E_DS_ROWEXISTS` | The row was not added because an existing row has the same primary key. | -| `0x8024800F` | `WU_E_DS_STOREFILELOCKED` | The data store could not be initialized because it was locked by another process. | -| `0x80248010` | `WU_E_DS_CANNOTREGISTER` | The data store is not allowed to be registered with COM in the current process. | -| `0x80248011` | `WU_E_DS_UNABLETOSTART` | Could not create a data store object in another process. | +| `0x8024800A` | `WU_E_DS_UNKNOWNHANDLER` | The update wasn't processed because its update handler couldn't be recognized. | +| `0x8024800B` | `WU_E_DS_CANTDELETE` | The update wasn't deleted because it's still referenced by one or more services. | +| `0x8024800C` | `WU_E_DS_LOCKTIMEOUTEXPIRED` | The data store section couldn't be locked within the allotted time. | +| `0x8024800D` | `WU_E_DS_NOCATEGORIES` | The category wasn't added because it contains no parent categories and isn't a top-level category itself. | +| `0x8024800E` | `WU_E_DS_ROWEXISTS` | The row wasn't added because an existing row has the same primary key. | +| `0x8024800F` | `WU_E_DS_STOREFILELOCKED` | The data store couldn't be initialized because it was locked by another process. | +| `0x80248010` | `WU_E_DS_CANNOTREGISTER` | The data store isn't allowed to be registered with COM in the current process. | +| `0x80248011` | `WU_E_DS_UNABLETOSTART` | Couldn't create a data store object in another process. | | `0x80248013` | `WU_E_DS_DUPLICATEUPDATEID` | The server sent the same update to the client with two different revision IDs. | -| `0x80248014` | `WU_E_DS_UNKNOWNSERVICE` | An operation did not complete because the service is not in the data store. | -| `0x80248015` | `WU_E_DS_SERVICEEXPIRED` | An operation did not complete because the registration of the service has expired. | -| `0x80248016` | `WU_E_DS_DECLINENOTALLOWED` | A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline. | -| `0x80248017` | `WU_E_DS_TABLESESSIONMISMATCH` | A table was not closed because it is not associated with the session. | -| `0x80248018` | `WU_E_DS_SESSIONLOCKMISMATCH` | A table was not closed because it is not associated with the session. | -| `0x80248019` | `WU_E_DS_NEEDWINDOWSSERVICE` | A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service. | -| `0x8024801A` | `WU_E_DS_INVALIDOPERATION` | A request was declined because the operation is not allowed. | -| `0x8024801B` | `WU_E_DS_SCHEMAMISMATCH` | The schema of the current data store and the schema of a table in a backup XML document do not match. | +| `0x80248014` | `WU_E_DS_UNKNOWNSERVICE` | An operation didn't complete because the service isn't in the data store. | +| `0x80248015` | `WU_E_DS_SERVICEEXPIRED` | An operation didn't complete because the registration of the service has expired. | +| `0x80248016` | `WU_E_DS_DECLINENOTALLOWED` | A request to hide an update was declined because it's a mandatory update or because it was deployed with a deadline. | +| `0x80248017` | `WU_E_DS_TABLESESSIONMISMATCH` | A table wasn't closed because it isn't associated with the session. | +| `0x80248018` | `WU_E_DS_SESSIONLOCKMISMATCH` | A table wasn't closed because it isn't associated with the session. | +| `0x80248019` | `WU_E_DS_NEEDWINDOWSSERVICE` | A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it's a built-in service and/or Automatic Updates can't fall back to another service. | +| `0x8024801A` | `WU_E_DS_INVALIDOPERATION` | A request was declined because the operation isn't allowed. | +| `0x8024801B` | `WU_E_DS_SCHEMAMISMATCH` | The schema of the current data store and the schema of a table in a backup XML document don't match. | | `0x8024801C` | `WU_E_DS_RESETREQUIRED` | The data store requires a session reset; release the session and retry with a new session. | -| `0x8024801D` | `WU_E_DS_IMPERSONATED` | A data store operation did not complete because it was requested with an impersonated identity. | +| `0x8024801D` | `WU_E_DS_IMPERSONATED` | A data store operation didn't complete because it was requested with an impersonated identity. | | `0x80248FFF` | `WU_E_DS_UNEXPECTED` | A data store error not covered by another `WU_E_DS_*` code. | ## Driver Util errors -The PnP enumerated device is removed from the System Spec because one of the hardware IDs or the compatible IDs matches an installed printer driver. This is not a fatal error, and the device is merely skipped. +The PnP enumerated device is removed from the System Spec because one of the hardware IDs or the compatible IDs matches an installed printer driver. This isn't a fatal error, and the device is merely skipped. | Error code | Message | Description | |------------|-------------------------------|------------------------------------------------------------------------------------------------| | `0x8024C001` | `WU_E_DRV_PRUNED` | A driver was skipped. | -| `0x8024C002` | `WU_E_DRV_NOPROP_OR_LEGACY` | A property for the driver could not be found. It may not conform with required specifications. | -| `0x8024C003` | `WU_E_DRV_REG_MISMATCH` | The registry type read for the driver does not match the expected type. | +| `0x8024C002` | `WU_E_DRV_NOPROP_OR_LEGACY` | A property for the driver couldn't be found. It may not conform with required specifications. | +| `0x8024C003` | `WU_E_DRV_REG_MISMATCH` | The registry type read for the driver doesn't match the expected type. | | `0x8024C004` | `WU_E_DRV_NO_METADATA` | The driver update is missing metadata. | | `0x8024C005` | `WU_E_DRV_MISSING_ATTRIBUTE` | The driver update is missing a required attribute. | | `0x8024C006` | `WU_E_DRV_SYNC_FAILED` | Driver synchronization failed. | @@ -259,17 +259,17 @@ The PnP enumerated device is removed from the System Spec because one of the har |------------|-----------------------------------|--------------------------------------------------------------| | `0x80240001` | `WU_E_NO_SERVICE` | Windows Update Agent was unable to provide the service. | `0x80240002` | `WU_E_MAX_CAPACITY_REACHED` | The maximum capacity of the service was exceeded. -| `0x80240003` | `WU_E_UNKNOWN_ID` | An ID cannot be found. -| `0x80240004` | `WU_E_NOT_INITIALIZED` | The object could not be initialized. +| `0x80240003` | `WU_E_UNKNOWN_ID` | An ID can't be found. +| `0x80240004` | `WU_E_NOT_INITIALIZED` | The object couldn't be initialized. | `0x80240005` | `WU_E_RANGEOVERLAP` | The update handler requested a byte range overlapping a previously requested range. | `0x80240006` | `WU_E_TOOMANYRANGES` | The requested number of byte ranges exceeds the maximum number (2^31 - 1). | `0x80240007` | `WU_E_INVALIDINDEX` | The index to a collection was invalid. -| `0x80240008` | `WU_E_ITEMNOTFOUND` | The key for the item queried could not be found. -| `0x80240009` | `WU_E_OPERATIONINPROGRESS` | Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously. -| `0x8024000A` | `WU_E_COULDNOTCANCEL` | Cancellation of the operation was not allowed. +| `0x80240008` | `WU_E_ITEMNOTFOUND` | The key for the item queried couldn't be found. +| `0x80240009` | `WU_E_OPERATIONINPROGRESS` | Another conflicting operation was in progress. Some operations such as installation can't be performed twice simultaneously. +| `0x8024000A` | `WU_E_COULDNOTCANCEL` | Cancellation of the operation wasn't allowed. | `0x8024000B` | `WU_E_CALL_CANCELLED` | Operation was canceled. | `0x8024000C` | `WU_E_NOOP` | No operation was required. -| `0x8024000D` | `WU_E_XML_MISSINGDATA` | Windows Update Agent could not find required information in the update's XML data. +| `0x8024000D` | `WU_E_XML_MISSINGDATA` | Windows Update Agent couldn't find required information in the update's XML data. | `0x8024000E` | `WU_E_XML_INVALID` | Windows Update Agent found invalid information in the update's XML data. | `0x8024000F` | `WU_E_CYCLE_DETECTED` | Circular update relationships were detected in the metadata. | `0x80240010` | `WU_E_TOO_DEEP_RELATION` | Update relationships too deep to evaluate were evaluated. @@ -277,46 +277,46 @@ The PnP enumerated device is removed from the System Spec because one of the har | `0x80240012` | `WU_E_REG_VALUE_INVALID` | An invalid registry value was read. | `0x80240013` | `WU_E_DUPLICATE_ITEM` | Operation tried to add a duplicate item to a list. | `0x80240016` | `WU_E_INSTALL_NOT_ALLOWED` | Operation tried to install while another installation was in progress or the system was pending a mandatory restart. -| `0x80240017` | `WU_E_NOT_APPLICABLE` | Operation was not performed because there are no applicable updates. +| `0x80240017` | `WU_E_NOT_APPLICABLE` | Operation wasn't performed because there are no applicable updates. | `0x80240018` | `WU_E_NO_USERTOKEN` | Operation failed because a required user token is missing. -| `0x80240019` | `WU_E_EXCLUSIVE_INSTALL_CONFLICT` | An exclusive update cannot be installed with other updates at the same time. -| `0x8024001A` | `WU_E_POLICY_NOT_SET` | A policy value was not set. -| `0x8024001B` | `WU_E_SELFUPDATE_IN_PROGRESS` | The operation could not be performed because the Windows Update Agent is self-updating. +| `0x80240019` | `WU_E_EXCLUSIVE_INSTALL_CONFLICT` | An exclusive update can't be installed with other updates at the same time. +| `0x8024001A` | `WU_E_POLICY_NOT_SET` | A policy value wasn't set. +| `0x8024001B` | `WU_E_SELFUPDATE_IN_PROGRESS` | The operation couldn't be performed because the Windows Update Agent is self-updating. | `0x8024001D` | `WU_E_INVALID_UPDATE` | An update contains invalid metadata. -| `0x8024001E` | `WU_E_SERVICE_STOP` | Operation did not complete because the service or system was being shut down. -| `0x8024001F` | `WU_E_NO_CONNECTION` | Operation did not complete because the network connection was unavailable. -| `0x80240020` | `WU_E_NO_INTERACTIVE_USER` | Operation did not complete because there is no logged-on interactive user. -| `0x80240021` | `WU_E_TIME_OUT` | Operation did not complete because it timed out. +| `0x8024001E` | `WU_E_SERVICE_STOP` | Operation didn't complete because the service or system was being shut down. +| `0x8024001F` | `WU_E_NO_CONNECTION` | Operation didn't complete because the network connection was unavailable. +| `0x80240020` | `WU_E_NO_INTERACTIVE_USER` | Operation didn't complete because there's no logged-on interactive user. +| `0x80240021` | `WU_E_TIME_OUT` | Operation didn't complete because it timed out. | `0x80240022` | `WU_E_ALL_UPDATES_FAILED` | Operation failed for all the updates. | `0x80240023` | `WU_E_EULAS_DECLINED` | The license terms for all updates were declined. | `0x80240024` | `WU_E_NO_UPDATE` | There are no updates. | `0x80240025` | `WU_E_USER_ACCESS_DISABLED` | Group Policy settings prevented access to Windows Update. | `0x80240026` | `WU_E_INVALID_UPDATE_TYPE` | The type of update is invalid. | `0x80240027` | `WU_E_URL_TOO_LONG` | The URL exceeded the maximum length. -| `0x80240028` | `WU_E_UNINSTALL_NOT_ALLOWED` | The update could not be uninstalled because the request did not originate from a WSUS server. -| `0x80240029` | `WU_E_INVALID_PRODUCT_LICENSE` | Search may have missed some updates before there is an unlicensed application on the system. +| `0x80240028` | `WU_E_UNINSTALL_NOT_ALLOWED` | The update couldn't be uninstalled because the request didn't originate from a WSUS server. +| `0x80240029` | `WU_E_INVALID_PRODUCT_LICENSE` | Search may have missed some updates before there's an unlicensed application on the system. | `0x8024002A` | `WU_E_MISSING_HANDLER` | A component required to detect applicable updates was missing. -| `0x8024002B` | `WU_E_LEGACYSERVER` | An operation did not complete because it requires a newer version of server. -| `0x8024002C` | `WU_E_BIN_SOURCE_ABSENT` | A delta-compressed update could not be installed because it required the source. -| `0x8024002D` | `WU_E_SOURCE_ABSENT` | A full-file update could not be installed because it required the source. -| `0x8024002E` | `WU_E_WU_DISABLED` | Access to an unmanaged server is not allowed. -| `0x8024002F` | `WU_E_CALL_CANCELLED_BY_POLICY` | Operation did not complete because the DisableWindowsUpdateAccess policy was set. +| `0x8024002B` | `WU_E_LEGACYSERVER` | An operation didn't complete because it requires a newer version of server. +| `0x8024002C` | `WU_E_BIN_SOURCE_ABSENT` | A delta-compressed update couldn't be installed because it required the source. +| `0x8024002D` | `WU_E_SOURCE_ABSENT` | A full-file update couldn't be installed because it required the source. +| `0x8024002E` | `WU_E_WU_DISABLED` | Access to an unmanaged server isn't allowed. +| `0x8024002F` | `WU_E_CALL_CANCELLED_BY_POLICY` | Operation didn't complete because the DisableWindowsUpdateAccess policy was set. | `0x80240030` | `WU_E_INVALID_PROXY_SERVER` | The format of the proxy list was invalid. | `0x80240031` | `WU_E_INVALID_FILE` | The file is in the wrong format. | `0x80240032` | `WU_E_INVALID_CRITERIA` | The search criteria string was invalid. -| `0x80240033` | `WU_E_EULA_UNAVAILABLE` | License terms could not be downloaded. +| `0x80240033` | `WU_E_EULA_UNAVAILABLE` | License terms couldn't be downloaded. | `0x80240034` | `WU_E_DOWNLOAD_FAILED` | Update failed to download. -| `0x80240035` | `WU_E_UPDATE_NOT_PROCESSED` | The update was not processed. -| `0x80240036` | `WU_E_INVALID_OPERATION` | The object's current state did not allow the operation. -| `0x80240037` | `WU_E_NOT_SUPPORTED` | The functionality for the operation is not supported. +| `0x80240035` | `WU_E_UPDATE_NOT_PROCESSED` | The update wasn't processed. +| `0x80240036` | `WU_E_INVALID_OPERATION` | The object's current state didn't allow the operation. +| `0x80240037` | `WU_E_NOT_SUPPORTED` | The functionality for the operation isn't supported. | `0x80240038` | `WU_E_WINHTTP_INVALID_FILE` | The downloaded file has an unexpected content type. | `0x80240039` | `WU_E_TOO_MANY_RESYNC` | Agent is asked by server to resync too many times. -| `0x80240040` | `WU_E_NO_SERVER_CORE_SUPPORT` | `WUA API` method does not run on Server Core installation. -| `0x80240041` | `WU_E_SYSPREP_IN_PROGRESS` | Service is not available while sysprep is running. +| `0x80240040` | `WU_E_NO_SERVER_CORE_SUPPORT` | `WUA API` method doesn't run on Server Core installation. +| `0x80240041` | `WU_E_SYSPREP_IN_PROGRESS` | Service isn't available while sysprep is running. | `0x80240042` | `WU_E_UNKNOWN_SERVICE` | The update service is no longer registered with `AU`. -| `0x80240043` | `WU_E_NO_UI_SUPPORT` | There is no support for `WUA UI`. +| `0x80240043` | `WU_E_NO_UI_SUPPORT` | There's no support for `WUA UI`. | `0x80240FFF` | `WU_E_UNEXPECTED` | An operation failed due to reasons not covered by another error code. -| `0x80070422` | | Windows Update service stopped working or is not running. +| `0x80070422` | | Windows Update service stopped working or isn't running. ## Windows Update success codes @@ -328,38 +328,38 @@ The PnP enumerated device is removed from the System Spec because one of the har | `0x00240004` | `WU_S_MARKED_FOR_DISCONNECT` | A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing. | | `0x00240005` | `WU_S_REBOOT_REQUIRED` | The system must be restarted to complete installation of the update. | | `0x00240006` | `WU_S_ALREADY_INSTALLED` | The update to be installed is already installed on the system. | -| `0x00240007` | `WU_S_ALREADY_UNINSTALLED` | The update to be removed is not installed on the system. | +| `0x00240007` | `WU_S_ALREADY_UNINSTALLED` | The update to be removed isn't installed on the system. | | `0x00240008` | `WU_S_ALREADY_DOWNLOADED` | The update to be downloaded has already been downloaded. | ## Windows Installer minor errors -The following errors are used to indicate that part of a search fails because of Windows Installer problems. Another part of the search may successfully return updates. All Windows Installer minor codes must share the same error code range so that the caller can tell that they are related to Windows Installer. +The following errors are used to indicate that part of a search fails because of Windows Installer problems. Another part of the search may successfully return updates. All Windows Installer minor codes must share the same error code range so that the caller can tell that they're related to Windows Installer. | Error code | Message | Description | |------------|------------------------------|---------------------------------------------------------------------------------------------| | `0x80241001` | `WU_E_MSI_WRONG_VERSION` | Search may have missed some updates because the Windows Installer is less than version 3.1. | -| `0x80241002` | `WU_E_MSI_NOT_CONFIGURED` | Search may have missed some updates because the Windows Installer is not configured. | +| `0x80241002` | `WU_E_MSI_NOT_CONFIGURED` | Search may have missed some updates because the Windows Installer isn't configured. | | `0x80241003` | `WU_E_MSP_DISABLED` | Search may have missed some updates because policy has disabled Windows Installer patching. | -| `0x80241004` | `WU_E_MSI_WRONG_APP_CONTEXT` | An update could not be applied because the application is installed per-user. | +| `0x80241004` | `WU_E_MSI_WRONG_APP_CONTEXT` | An update couldn't be applied because the application is installed per-user. | | `0x80241FFF` | `WU_E_MSP_UNEXPECTED` | Search may have missed some updates because there was a failure of the Windows Installer. | ## Windows Update Agent update and setup errors | Error code | Message | Description | |------------|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------| -| `0x8024D001` | `WU_E_SETUP_INVALID_INFDATA` | Windows Update Agent could not be updated because an INF file contains invalid information. | -| `0x8024D002` | `WU_E_SETUP_INVALID_IDENTDATA` | Windows Update Agent could not be updated because the `wuident.cab` file contains invalid information. | -| `0x8024D003` | `WU_E_SETUP_ALREADY_INITIALIZED` | Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice. | -| `0x8024D004` | `WU_E_SETUP_NOT_INITIALIZED` | Windows Update Agent could not be updated because setup initialization never completed successfully. | -| `0x8024D005` | `WU_E_SETUP_SOURCE_VERSION_MISMATCH` | Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions. | -| `0x8024D006` | `WU_E_SETUP_TARGET_VERSION_GREATER` | Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file. | -| `0x8024D007` | `WU_E_SETUP_REGISTRATION_FAILED` | Windows Update Agent could not be updated because `regsvr32.exe` returned an error. | +| `0x8024D001` | `WU_E_SETUP_INVALID_INFDATA` | Windows Update Agent couldn't be updated because an INF file contains invalid information. | +| `0x8024D002` | `WU_E_SETUP_INVALID_IDENTDATA` | Windows Update Agent couldn't be updated because the `wuident.cab` file contains invalid information. | +| `0x8024D003` | `WU_E_SETUP_ALREADY_INITIALIZED` | Windows Update Agent couldn't be updated because of an internal error that caused setup initialization to be performed twice. | +| `0x8024D004` | `WU_E_SETUP_NOT_INITIALIZED` | Windows Update Agent couldn't be updated because setup initialization never completed successfully. | +| `0x8024D005` | `WU_E_SETUP_SOURCE_VERSION_MISMATCH` | Windows Update Agent couldn't be updated because the versions specified in the INF don't match the actual source file versions. | +| `0x8024D006` | `WU_E_SETUP_TARGET_VERSION_GREATER` | Windows Update Agent couldn't be updated because a WUA file on the target system is newer than the corresponding source file. | +| `0x8024D007` | `WU_E_SETUP_REGISTRATION_FAILED` | Windows Update Agent couldn't be updated because `regsvr32.exe` returned an error. | | `0x8024D009` | `WU_E_SETUP_SKIP_UPDATE` | An update to the Windows Update Agent was skipped due to a directive in the `wuident.cab` file. | -| `0x8024D00A` | `WU_E_SETUP_UNSUPPORTED_CONFIGURATION` | Windows Update Agent could not be updated because the current system configuration is not supported. | -| `0x8024D00B` | `WU_E_SETUP_BLOCKED_CONFIGURATION` | Windows Update Agent could not be updated because the system is configured to block the update. | -| `0x8024D00C` | `WU_E_SETUP_REBOOT_TO_FIX` | Windows Update Agent could not be updated because a restart of the system is required. | +| `0x8024D00A` | `WU_E_SETUP_UNSUPPORTED_CONFIGURATION` | Windows Update Agent couldn't be updated because the current system configuration isn't supported. | +| `0x8024D00B` | `WU_E_SETUP_BLOCKED_CONFIGURATION` | Windows Update Agent couldn't be updated because the system is configured to block the update. | +| `0x8024D00C` | `WU_E_SETUP_REBOOT_TO_FIX` | Windows Update Agent couldn't be updated because a restart of the system is required. | | `0x8024D00D` | `WU_E_SETUP_ALREADYRUNNING` | Windows Update Agent setup is already running. | | `0x8024D00E` | `WU_E_SETUP_REBOOTREQUIRED` | Windows Update Agent setup package requires a reboot to complete installation. | -| `0x8024D00F` | `WU_E_SETUP_HANDLER_EXEC_FAILURE` | Windows Update Agent could not be updated because the setup handler failed during execution. | -| `0x8024D010` | `WU_E_SETUP_INVALID_REGISTRY_DATA` | Windows Update Agent could not be updated because the registry contains invalid information. | -| `0x8024D013` | `WU_E_SETUP_WRONG_SERVER_VERSION` | Windows Update Agent could not be updated because the server does not contain update information for this version. | -| `0x8024DFFF` | `WU_E_SETUP_UNEXPECTED` | Windows Update Agent could not be updated because of an error not covered by another `WU_E_SETUP_*` error code. | +| `0x8024D00F` | `WU_E_SETUP_HANDLER_EXEC_FAILURE` | Windows Update Agent couldn't be updated because the setup handler failed during execution. | +| `0x8024D010` | `WU_E_SETUP_INVALID_REGISTRY_DATA` | Windows Update Agent couldn't be updated because the registry contains invalid information. | +| `0x8024D013` | `WU_E_SETUP_WRONG_SERVER_VERSION` | Windows Update Agent couldn't be updated because the server doesn't contain update information for this version. | +| `0x8024DFFF` | `WU_E_SETUP_UNEXPECTED` | Windows Update Agent couldn't be updated because of an error not covered by another `WU_E_SETUP_*` error code. | From 33c5601b9e8dafc2c0202e30395f37a88cb26cb1 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 29 Aug 2023 08:51:21 -0700 Subject: [PATCH 117/125] meta3upd --- windows/deployment/update/windows-update-error-reference.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md index f69e4c5796..98e57b9f16 100644 --- a/windows/deployment/update/windows-update-error-reference.md +++ b/windows/deployment/update/windows-update-error-reference.md @@ -111,8 +111,8 @@ The following errors map to `SOAPCLIENT_ERROR`s through the `Atlsoap.h` file. Th The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These errors are obtained from the `m_fault.m_soapErrCode` member of the `CClientWebService` object when `GetClientError()` returns `SOAPCLIENT_SOAPFAULT`. -| Error code | Message | Description | -|------------|----------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Error code | Message | Description | +|---|---|---| | `0x8024400B` | `WU_E_PT_SOAP_VERSION` | Same as `SOAP_E_VERSION_MISMATCH` - `SOAP` client found an unrecognizable namespace for the `SOAP` envelope. | | `0x8024400C` | `WU_E_PT_SOAP_MUST_UNDERSTAND` | Same as `SOAP_E_MUST_UNDERSTAND` - `SOAP` client was unable to understand a header. | | `0x8024400D` | `WU_E_PT_SOAP_CLIENT` | Same as `SOAP_E_CLIENT` - `SOAP` client found the message was malformed; fix before resending. | From 87c7df625e957747c8625398b04d4a28f8b2ea4d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 29 Aug 2023 09:03:12 -0700 Subject: [PATCH 118/125] meta3upd --- .../deployment/update/windows-update-error-reference.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md index 98e57b9f16..c37d7cc3d2 100644 --- a/windows/deployment/update/windows-update-error-reference.md +++ b/windows/deployment/update/windows-update-error-reference.md @@ -108,11 +108,11 @@ The following errors map to `SOAPCLIENT_ERROR`s through the `Atlsoap.h` file. Th | `x8024400A` | `WU_E_PT_SOAPCLIENT_PARSE` | Same as `SOAPCLIENT_PARSE_ERROR` - `SOAP` client failed to parse the response from the server. | ## Other Protocol Talker errors -The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These errors are obtained from the `m_fault.m_soapErrCode` member of the `CClientWebService` object when `GetClientError()` returns `SOAPCLIENT_SOAPFAULT`. +The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These errors are obtained from the `m_fault.m_soapErrCode` member of the `CClientWebService` object when `GetClientError()` returns `SOAPCLIENT_SOAPFAULT`. -| Error code | Message | Description | -|---|---|---| +| Error code | Message | Description | +|------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| | `0x8024400B` | `WU_E_PT_SOAP_VERSION` | Same as `SOAP_E_VERSION_MISMATCH` - `SOAP` client found an unrecognizable namespace for the `SOAP` envelope. | | `0x8024400C` | `WU_E_PT_SOAP_MUST_UNDERSTAND` | Same as `SOAP_E_MUST_UNDERSTAND` - `SOAP` client was unable to understand a header. | | `0x8024400D` | `WU_E_PT_SOAP_CLIENT` | Same as `SOAP_E_CLIENT` - `SOAP` client found the message was malformed; fix before resending. | @@ -124,7 +124,7 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | `0x80244013` | `WU_E_PT_INVALID_COMPUTER_NAME` | The computer name couldn't be determined. | | `0x80244015` | `WU_E_PT_REFRESH_CACHE_REQUIRED` | The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. | | `0x80244016` | `WU_E_PT_HTTP_STATUS_BAD_REQUEST` | Same as HTTP status 400 - the server couldn't process the request due to invalid syntax. | -| `0x80244017`` | `WU_E_PT_HTTP_STATUS_DENIED` | Same as HTTP status 401 - the requested resource requires user authentication. | +| `0x80244017` | `WU_E_PT_HTTP_STATUS_DENIED` | Same as HTTP status 401 - the requested resource requires user authentication. | | `0x80244018` | `WU_E_PT_HTTP_STATUS_FORBIDDEN` | Same as HTTP status 403 - server understood the request but declined to fulfill it. | | `0x80244019` | `WU_E_PT_HTTP_STATUS_NOT_FOUND` | Same as HTTP status 404 - the server can't find the requested URI (Uniform Resource Identifier). | | `0x8024401A` | `WU_E_PT_HTTP_STATUS_BAD_METHOD` | Same as HTTP status 405 - the HTTP method isn't allowed. | From f112807ad00e09fae8b2ff4a6b5f22efefa8cf97 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 29 Aug 2023 09:18:21 -0700 Subject: [PATCH 119/125] meta3upd --- windows/deployment/update/wufb-reports-schema.md | 2 +- windows/deployment/update/wufb-wsus.md | 7 ++----- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/windows/deployment/update/wufb-reports-schema.md b/windows/deployment/update/wufb-reports-schema.md index 05721c32db..8a4fc45ecb 100644 --- a/windows/deployment/update/wufb-reports-schema.md +++ b/windows/deployment/update/wufb-reports-schema.md @@ -18,7 +18,7 @@ ms.date: 11/15/2022 When the visualizations provided in the default experience don't fulfill your reporting needs, or if you need to troubleshoot issues with devices, it's valuable to understand the schema for Windows Update for Business reports and have a high-level understanding of the capabilities of [Azure Monitor log queries](/azure/azure-monitor/log-query/query-language) to power additional dashboards, integration with external data analysis tools, automated alerting, and more. -## Schema +## Schemas for Windows Update for Business reports The following table summarizes the different tables that are part of the Windows Update for Business reports solution. To learn how to navigate Azure Monitor Logs to find this data, see [Get started with log queries in Azure Monitor](/azure/azure-monitor/log-query/get-started-queries). diff --git a/windows/deployment/update/wufb-wsus.md b/windows/deployment/update/wufb-wsus.md index d6c5cd1459..295f638ff4 100644 --- a/windows/deployment/update/wufb-wsus.md +++ b/windows/deployment/update/wufb-wsus.md @@ -68,13 +68,10 @@ The policy can be configured using the following two methods: 2. Configuration Service Provider (CSP) Policies: **SetPolicyDrivenUpdateSourceFor<Update Type>**: > [!NOTE] -> You should configure **all** of these policies if you are using CSPs. +> - You should configure **all** of these policies if you are using CSPs. +> - Editing the registry to change the behavior of update policies isn't recommended. Use Group Policy or the Configuration Service Provider (CSP) policy instead of directly writing to the registry. However, if you choose to edit the registry, ensure you've configured the `UseUpdateClassPolicySource` registry key too, or the scan source won't be altered. - [Update/SetPolicyDrivenUpdateSourceForDriverUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourcefordriver) - [Update/SetPolicyDrivenUpdateSourceForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourceforfeature) - [Update/SetPolicyDrivenUpdateSourceForOtherUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourceforother) - [Update/SetPolicyDrivenUpdateSourceForQualityUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourceforquality) - - -> [!NOTE] -> Editing the registry to change the behavior of update policies isn't recommended. Use Group Policy or the Configuration Service Provider (CSP) policy instead of directly writing to the registry. However, if you choose to edit the registry, ensure you've configured the `UseUpdateClassPolicySource` registry key too, or the scan source won't be altered. From 5ac33f104793fd4f94e0196062ee150d96df7b83 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 29 Aug 2023 11:08:41 -0700 Subject: [PATCH 120/125] meta edit --- .../deployment/update/deployment-service-expedited-updates.md | 2 +- windows/deployment/update/deployment-service-feature-updates.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/deployment-service-expedited-updates.md b/windows/deployment/update/deployment-service-expedited-updates.md index f99226eb91..a7e5e6a58f 100644 --- a/windows/deployment/update/deployment-service-expedited-updates.md +++ b/windows/deployment/update/deployment-service-expedited-updates.md @@ -14,7 +14,7 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 08/22/2023 +ms.date: 08/29/2023 --- # Deploy expedited updates with Windows Update for Business deployment service diff --git a/windows/deployment/update/deployment-service-feature-updates.md b/windows/deployment/update/deployment-service-feature-updates.md index 339fe7edfd..f9ba6dd147 100644 --- a/windows/deployment/update/deployment-service-feature-updates.md +++ b/windows/deployment/update/deployment-service-feature-updates.md @@ -14,7 +14,7 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 08/22/2023 +ms.date: 08/29/2023 --- # Deploy feature updates with Windows Update for Business deployment service From b4027f3f837f77461c44fce469ee75fc127d2dd0 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Wed, 30 Aug 2023 14:15:12 -0700 Subject: [PATCH 121/125] Clarification updates to SAC and Intune topics --- .../deployment/deploy-wdac-policies-using-intune.md | 11 +++++++---- .../windows-defender-application-control/wdac.md | 8 ++++---- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md b/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md index 1909066094..2f3a217b19 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md @@ -2,7 +2,7 @@ title: Deploy WDAC policies using Mobile Device Management (MDM) description: You can use an MDM like Microsoft Intune to configure Windows Defender Application Control (WDAC). Learn how with this step-by-step guide. ms.localizationpriority: medium -ms.date: 01/23/2023 +ms.date: 08/30/2023 ms.topic: how-to --- @@ -28,10 +28,10 @@ Intune's built-in Windows Defender Application Control support allows you to con - [Optional] Reputable apps as defined by the Intelligent Security Graph (ISG) > [!NOTE] -> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. You can use Intune's custom OMA-URI feature to deploy your own multiple-policy format WDAC policies and leverage features available on Windows 10 1903+ or Windows 11 as described later in this topic. +> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. Use the [improved Intune WDAC experience](mem/intune/protect/endpoint-security-app-control-policy), currently in public preview, to create and deploy multiple-policy format files. Or, you can use Intune's custom OMA-URI feature to deploy your own multiple-policy format WDAC policies and leverage features available on Windows 10 1903+ or Windows 11 as described later in this topic. > [!NOTE] -> Intune currently uses the AppLocker CSP to deploy its built-in policies. The AppLocker CSP always requests a device restart when it applies WDAC policies. You can use Intune's custom OMA-URI feature with the ApplicationControl CSP to deploy your own WDAC policies without a restart. +> Intune currently uses the AppLocker CSP to deploy its built-in policies. The AppLocker CSP always requests a device restart when it applies WDAC policies. Use the [improved Intune WDAC experience](mem/intune/protect/endpoint-security-app-control-policy), currently in public preview, to deploy your own WDAC policies without a restart. Or, you can use Intune's custom OMA-URI feature with the ApplicationControl CSP. To use Intune's built-in WDAC policies, configure [Endpoint Protection for Windows 10 (and later)](/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json). @@ -46,6 +46,9 @@ You should now have one or more WDAC policies converted into binary form. If not Beginning with Windows 10 1903, custom OMA-URI policy deployment can use the [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp), which has support for multiple policies and rebootless policies. +> [!NOTE] +> You must convert your custom policy XML to binary form before deploying with OMA-URI. + The steps to use Intune's custom OMA-URI functionality are: 1. Open the Microsoft Intune portal and [create a profile with custom settings](/mem/intune/configuration/custom-settings-windows-10). @@ -53,7 +56,7 @@ The steps to use Intune's custom OMA-URI functionality are: 2. Specify a **Name** and **Description** and use the following values for the remaining custom OMA-URI settings: - **OMA-URI**: `./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy` - **Data type**: Base64 (file) - - **Certificate file**: Upload your binary format policy file. To do this, change your {GUID}.cip file to {GUID}.bin. You don't need to upload a Base64 file, as Intune will convert the uploaded .bin file to Base64 on your behalf. + - **Certificate file**: Upload your binary format policy file. To do this, change your {GUID}.cip file to {GUID}.bin. You don't need to upload a Base64 file, as Intune converts the uploaded .bin file to Base64 on your behalf. > [!div class="mx-imgBorder"] > ![Configure custom WDAC.](../images/wdac-intune-custom-oma-uri.png) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md b/windows/security/application-security/application-control/windows-defender-application-control/wdac.md index 42fb2e18d7..22e5196913 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/wdac.md @@ -6,7 +6,7 @@ ms.collection: - highpri - tier3 - must-keep -ms.date: 04/06/2023 +ms.date: 08/30/2023 ms.topic: article --- @@ -33,9 +33,9 @@ Windows 10 and Windows 11 include two technologies that can be used for applicat ## WDAC and Smart App Control -Starting in Windows 11 version 22H2, [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) provides application control for consumers. Smart App Control is based on WDAC, allowing enterprise customers to create a policy that offers the same security and compatibility with the ability to customize it to run line-of-business (LOB) apps. To make it easier to implement this policy, an [example policy](design/example-wdac-base-policies.md) is provided. The example policy includes **Enabled:Conditional Windows Lockdown Policy** rule which isn't supported for WDAC enterprise policies. This rule must be removed before you use the example policy. To use this example policy as a starting point for creating your own policy, see [Create a custom base policy using an example WDAC base policy](design/create-wdac-policy-for-lightly-managed-devices.md#create-a-custom-base-policy-using-an-example-wdac-base-policy). +Starting in Windows 11 version 22H2, [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) provides application control for consumers. Smart App Control is based on WDAC, allowing enterprise customers to create a policy that offers the same security and compatibility with the ability to customize it to run line-of-business (LOB) apps. To make it easier to implement this policy, an [example policy](design/example-wdac-base-policies.md) is provided. The example policy includes **Enabled:Conditional Windows Lockdown Policy** option that isn't supported for WDAC enterprise policies. This rule must be removed before you use the example policy. To use this example policy as a starting point for creating your own policy, see [Create a custom base policy using an example WDAC base policy](design/create-wdac-policy-for-lightly-managed-devices.md#create-a-custom-base-policy-using-an-example-wdac-base-policy). -Smart App Control is only available on clean installation of Windows 11 version 22H2 or later, and starts in evaluation mode. Smart App Control will automatically turn off for enterprise managed devices unless the user has turned it on first. To turn Smart App Control on or off across your organization's endpoints, you can set the **VerifiedAndReputablePolicyState** (DWORD) registry value under `HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy` to one of the values listed below. After you change the registry value, you must either restart the device or use [CiTool.exe -r](/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands#refresh-the-wdac-policies-on-the-system) for the change to take effect. +Smart App Control is only available on clean installation of Windows 11 version 22H2 or later, and starts in evaluation mode. Smart App Control is automatically turned off for enterprise managed devices unless the user has turned it on first. To turn off Smart App Control across your organization's endpoints, you can set the **VerifiedAndReputablePolicyState** (DWORD) registry value under `HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy` as shown in the following table. After you change the registry value, you must either restart the device or use [CiTool.exe -r](/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands#refresh-the-wdac-policies-on-the-system) for the change to take effect. | Value | Description | |-------|-------------| @@ -48,7 +48,7 @@ Smart App Control is only available on clean installation of Windows 11 version ### Smart App Control Enforced Blocks -Smart App Control enforces the [Microsoft Recommended Driver Block rules](design/microsoft-recommended-driver-block-rules.md) and the [Microsoft Recommended Block Rules](design/applications-that-can-bypass-wdac.md), with a few exceptions for compatibility considerations. The following are not blocked by Smart App Control: +Smart App Control enforces the [Microsoft Recommended Driver Block rules](design/microsoft-recommended-driver-block-rules.md) and the [Microsoft Recommended Block Rules](design/applications-that-can-bypass-wdac.md), with a few exceptions for compatibility considerations. The following aren't blocked by Smart App Control: - Infdefaultinstall.exe - Microsoft.Build.dll From e4bf4bc218407019f36e2a3b3de6812e71624ed0 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Wed, 30 Aug 2023 14:18:31 -0700 Subject: [PATCH 122/125] Update deploy-wdac-policies-using-intune.md --- .../deployment/deploy-wdac-policies-using-intune.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md b/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md index 2f3a217b19..6d222ba179 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md @@ -28,10 +28,10 @@ Intune's built-in Windows Defender Application Control support allows you to con - [Optional] Reputable apps as defined by the Intelligent Security Graph (ISG) > [!NOTE] -> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. Use the [improved Intune WDAC experience](mem/intune/protect/endpoint-security-app-control-policy), currently in public preview, to create and deploy multiple-policy format files. Or, you can use Intune's custom OMA-URI feature to deploy your own multiple-policy format WDAC policies and leverage features available on Windows 10 1903+ or Windows 11 as described later in this topic. +> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. Use the [improved Intune WDAC experience](/mem/intune/protect/endpoint-security-app-control-policy), currently in public preview, to create and deploy multiple-policy format files. Or, you can use Intune's custom OMA-URI feature to deploy your own multiple-policy format WDAC policies and leverage features available on Windows 10 1903+ or Windows 11 as described later in this topic. > [!NOTE] -> Intune currently uses the AppLocker CSP to deploy its built-in policies. The AppLocker CSP always requests a device restart when it applies WDAC policies. Use the [improved Intune WDAC experience](mem/intune/protect/endpoint-security-app-control-policy), currently in public preview, to deploy your own WDAC policies without a restart. Or, you can use Intune's custom OMA-URI feature with the ApplicationControl CSP. +> Intune currently uses the AppLocker CSP to deploy its built-in policies. The AppLocker CSP always requests a device restart when it applies WDAC policies. Use the [improved Intune WDAC experience](/mem/intune/protect/endpoint-security-app-control-policy), currently in public preview, to deploy your own WDAC policies without a restart. Or, you can use Intune's custom OMA-URI feature with the ApplicationControl CSP. To use Intune's built-in WDAC policies, configure [Endpoint Protection for Windows 10 (and later)](/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json). From 484d285b11755c057ff289a0ccd084051cc003d6 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 30 Aug 2023 14:41:00 -0700 Subject: [PATCH 123/125] Add lightbox for readability This change also applies the preferred style of image reference on the Learn platform. --- .../deployment/deploy-wdac-policies-using-intune.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md b/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md index 6d222ba179..c7086b6b5e 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md @@ -58,8 +58,7 @@ The steps to use Intune's custom OMA-URI functionality are: - **Data type**: Base64 (file) - **Certificate file**: Upload your binary format policy file. To do this, change your {GUID}.cip file to {GUID}.bin. You don't need to upload a Base64 file, as Intune converts the uploaded .bin file to Base64 on your behalf. - > [!div class="mx-imgBorder"] - > ![Configure custom WDAC.](../images/wdac-intune-custom-oma-uri.png) + :::image type="content" alt-text="Configure custom WDAC." source="../images/wdac-intune-custom-oma-uri.png" lightbox="../images/wdac-intune-custom-oma-uri.png"::: > [!NOTE] > For the _Policy GUID_ value, do not include the curly brackets. From ca175998302885536edebf7567c675f4482307c1 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 31 Aug 2023 10:42:04 -0400 Subject: [PATCH 124/125] Update citool-commands.md --- .../operations/citool-commands.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/citool-commands.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/citool-commands.md index 53788ab824..170525c906 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/citool-commands.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/operations/citool-commands.md @@ -3,6 +3,8 @@ title: Managing CI Policies and Tokens with CiTool description: Learn how to use Policy Commands, Token Commands, and Miscellaneous Commands in CiTool ms.topic: how-to ms.date: 04/05/2023 +appliesto: +- ✅ Windows 11 --- # CiTool technical reference From ba4efc0485ee7e5f5fa87431380a157f0405843e Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 31 Aug 2023 08:25:36 -0700 Subject: [PATCH 125/125] Updates to RandR and What's new --- .../windows-autopatch-roles-responsibilities.md | 11 +++++++---- .../whats-new/windows-autopatch-whats-new-2023.md | 8 +++++++- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md index 1a0e660f16..425952dd5a 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md @@ -1,7 +1,7 @@ --- title: Roles and responsibilities description: This article describes the roles and responsibilities provided by Windows Autopatch and what the customer must do -ms.date: 08/08/2023 +ms.date: 08/31/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -30,6 +30,7 @@ This article outlines your responsibilities and Windows Autopatch's responsibili | Review the [prerequisites](../prepare/windows-autopatch-prerequisites.md) | :heavy_check_mark: | :x: | | Review the [FAQ](../overview/windows-autopatch-faq.yml) | :heavy_check_mark: | :x: | | [Review the service data platform and privacy compliance details](../overview/windows-autopatch-privacy.md) | :heavy_check_mark: | :x: | +| Consult the [Deployment guide](../overview/windows-autopatch-deployment-guide.md) | :heavy_check_mark: | :x: | | Ensure device [prerequisites](../prepare/windows-autopatch-prerequisites.md) are met and in place prior to enrollment | :heavy_check_mark: | :x: | | Ensure [infrastructure and environment prerequisites](../prepare/windows-autopatch-configure-network.md) are met and in place prior to enrollment | :heavy_check_mark: | :x: | | Prepare to remove your devices from existing unsupported [Windows update](../references/windows-autopatch-windows-update-unsupported-policies.md) and [Microsoft 365](../references/windows-autopatch-microsoft-365-policies.md) policies | :heavy_check_mark: | :x: | @@ -38,6 +39,8 @@ This article outlines your responsibilities and Windows Autopatch's responsibili | [Manage and respond to tenant enrollment support requests](../prepare/windows-autopatch-enrollment-support-request.md) | :x: | :heavy_check_mark: | | Identify stakeholders for deployment communications | :heavy_check_mark: | :x: | +For more information and assistance with preparing for your Windows Autopatch deployment journey, see [Need additional guidance](../overview/windows-autopatch-deployment-guide.md#need-additional-guidance). + ## Deploy | Task | Your responsibility | Windows Autopatch | @@ -46,7 +49,7 @@ This article outlines your responsibilities and Windows Autopatch's responsibili | [Deploy and configure Windows Autopatch service configuration](../references/windows-autopatch-changes-to-tenant.md) | :x: | :heavy_check_mark: | | Educate users on the Windows Autopatch end user update experience
        • [Windows quality update end user experience](../operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md)
        • [Windows feature update end user experience](../operate/windows-autopatch-groups-manage-windows-feature-update-release.md)
        • [Microsoft 365 Apps for enterprise end user experience](../operate/windows-autopatch-microsoft-365-apps-enterprise.md#end-user-experience)
        • [Microsoft Edge end user experience](../operate/windows-autopatch-edge.md)
        • [Microsoft Teams end user experience](../operate/windows-autopatch-teams.md#end-user-experience)
        | :heavy_check_mark: | :x: | | Review network optimization
        • [Prepare your network](../prepare/windows-autopatch-configure-network.md)
        • [Delivery Optimization](../prepare/windows-autopatch-configure-network.md#delivery-optimization) | :heavy_check_mark: | :x: | -| Review existing configurations
          • Remove your devices from existing unsupported [Windows Update](../references/windows-autopatch-windows-update-unsupported-policies.md) and [Microsoft 365](../references/windows-autopatch-microsoft-365-policies.md) policies
          | :heavy_check_mark: | :x: | +| Review existing configurations
          • Remove your devices from existing unsupported [Windows Update](../references/windows-autopatch-windows-update-unsupported-policies.md) and [Microsoft 365](../references/windows-autopatch-microsoft-365-policies.md) policies
          • Consult [General considerations](../overview/windows-autopatch-deployment-guide.md#general-considerations)
          | :heavy_check_mark: | :x: | | Confirm your update service needs and configure your workloads
          • [Turn on or off expedited Windows quality updates](../operate/windows-autopatch-groups-windows-quality-update-overview.md#expedited-releases)
          • [Allow or block Microsoft 365 Apps for enterprise updates](../operate/windows-autopatch-microsoft-365-apps-enterprise.md#allow-or-block-microsoft-365-app-updates)
          • [Manage driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md)
          • [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md)
          • Decide your [Windows feature update versions(s)](../operate/windows-autopatch-groups-windows-feature-update-overview.md)
          | :heavy_check_mark: | :x: | | [Consider your Autopatch groups distribution](../deploy/windows-autopatch-groups-overview.md)
          • [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group)
          • [Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)
          | :heavy_check_mark: | :x: | | [Register devices](../deploy/windows-autopatch-register-devices.md)
          • [Review your device registration options](../deploy/windows-autopatch-device-registration-overview.md)
          • [Register your first devices](../deploy/windows-autopatch-register-devices.md) | :heavy_check_mark: | :x: | @@ -83,11 +86,11 @@ This article outlines your responsibilities and Windows Autopatch's responsibili | [Pause updates (Windows Autopatch initiated)](../operate/windows-autopatch-groups-windows-quality-update-signals.md) | :x: | :heavy_check_mark: | | [Pause updates (initiated by you)](../operate/windows-autopatch-groups-windows-quality-update-overview.md#pause-and-resume-a-release) | :heavy_check_mark: | :x: | | Run [on-going post-registration device readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md) | :x: | :heavy_check_mark: | -| Maintain existing configurations
            • Remove your devices from existing and unsupported [Windows update](../references/windows-autopatch-windows-update-unsupported-policies.md) and [Microsoft 365](../references/windows-autopatch-microsoft-365-policies.md) policies
            | :heavy_check_mark: | :x: | +| Maintain existing configurations
            • Remove your devices from existing and unsupported [Windows update](../references/windows-autopatch-windows-update-unsupported-policies.md) and [Microsoft 365](../references/windows-autopatch-microsoft-365-policies.md) policies
            • Consult [General considerations](../overview/windows-autopatch-deployment-guide.md#general-considerations)
            | :heavy_check_mark: | :x: | | Understand the health of [Up to date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-devices) devices and investigate devices that are
            • [Not up to date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#not-up-to-date-devices)
            • [Not ready](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#not-ready-devices)
            • have [Device alerts](../operate/windows-autopatch-device-alerts.md)
            | [Raise, manage and resolve a service incident if an update management area isn't meeting the service level objective](windows-autopatch-overview.md#update-management) | :x: | :heavy_check_mark: | | [Exclude a device](../operate/windows-autopatch-exclude-device.md) | :heavy_check_mark: | :x: | -| [Register a device that was previously excluded (upon customers request)](../operate/windows-autopatch-exclude-device.md) | :x: | :heavy_check_mark: | +| [Register a device that was previously excluded](../operate/windows-autopatch-exclude-device.md#restore-a-device-or-multiple-devices-previously-excluded) | :heavy_check_mark: | :x: | | [Request unenrollment from Windows Autopatch](../operate/windows-autopatch-unenroll-tenant.md) | :heavy_check_mark: | :x: | | [Remove Windows Autopatch data from the service and exclude devices](../operate/windows-autopatch-unenroll-tenant.md#microsofts-responsibilities-during-unenrollment) | :x: | :heavy_check_mark: | | [Maintain update configuration & update devices post unenrollment from Windows Autopatch](../operate/windows-autopatch-unenroll-tenant.md#your-responsibilities-after-unenrolling-your-tenant) | :heavy_check_mark: | :x: | diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index a439a1529c..0eb84588e2 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 08/23/2023 +ms.date: 08/31/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new @@ -34,6 +34,12 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | [Exclude a device](../operate/windows-autopatch-exclude-device.md) | Renamed Deregister a device to [Exclude a device](../operate/windows-autopatch-exclude-device.md). Added the [Restore device](../operate/windows-autopatch-exclude-device.md#restore-a-device-or-multiple-devices-previously-excluded) feature
            • [MC667662](https://admin.microsoft.com/adminportal/home#/MessageCenter)
            | | [Device alerts](../operate/windows-autopatch-device-alerts.md) | Added `'InstallSetupBlock'` to the [Alert resolutions section](../operate/windows-autopatch-device-alerts.md#alert-resolutions) | +## August service releases + +| Message center post number | Description | +| ----- | ----- | +| [MC671811](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Windows Autopatch Service Improvements | + ## July 2023 ### July feature releases or updates