From 90a15ea0e19d8ce9c25b76bb101829841781e72d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 8 Jan 2024 15:58:26 -0800 Subject: [PATCH 01/34] dep-rsa1024-8644149 --- windows/whats-new/deprecated-features.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index c04bfd3133..a83a65af90 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -47,6 +47,7 @@ The features in this article are no longer being actively developed, and might b | Feature | Details and mitigation | Deprecation announced | |---|---|---| +| TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits | Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013 ([Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf)), recommending specifically that RSA keys should have a key length of 2048 bits or longer. This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows.

TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| January 2024| | Windows Mixed Reality | [Windows Mixed Reality](/windows/mixed-reality/enthusiast-guide/before-you-start) is deprecated and will be removed in a future release of Windows. This deprecation includes the [Mixed Reality Portal](/windows/mixed-reality/enthusiast-guide/install-windows-mixed-reality) app, and [Windows Mixed Reality for SteamVR](/windows/mixed-reality/enthusiast-guide/using-steamvr-with-windows-mixed-reality) and Steam VR Beta.

As of November 1, 2026, for consumer editions of Windows and November 1, 2027 for commercial editions of Windows, Windows Mixed Reality will no longer be available for download via the Mixed Reality Portal app, Windows Mixed Reality for SteamVR, and Steam VR beta, and we'll discontinue support. At that time, Windows Mixed Reality will no longer receive security updates, nonsecurity updates, bug fixes, technical support, or online technical content updates. Existing Windows Mixed Reality devices will continue to work with Steam until users upgrade to a version of Windows that doesn't include Windows Mixed Reality.

This deprecation doesn't impact HoloLens. We remain committed to HoloLens and our enterprise customers. | December 2023 | | Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities. | December 2023 | | Legacy console mode | The [legacy console mode](/windows/console/legacymode) is deprecated and no longer being updated. In future Windows releases, it will be available as an optional [Feature on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). This feature won't be installed by default. | December 2023 | From 69fbdf874e82a3fb76ff8843eb269f3436d99b69 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 8 Jan 2024 16:02:28 -0800 Subject: [PATCH 02/34] dep-rsa1024-8644149 --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index a83a65af90..566f837f0c 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -47,7 +47,7 @@ The features in this article are no longer being actively developed, and might b | Feature | Details and mitigation | Deprecation announced | |---|---|---| -| TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits | Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013 ([Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf)), recommending specifically that RSA keys should have a key length of 2048 bits or longer. This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows.

TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| January 2024| +| TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits | Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013 ([Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf)), recommending specifically that RSA keys should have a key length of 2048 bits or longer. This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows.

TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| January 2024| | Windows Mixed Reality | [Windows Mixed Reality](/windows/mixed-reality/enthusiast-guide/before-you-start) is deprecated and will be removed in a future release of Windows. This deprecation includes the [Mixed Reality Portal](/windows/mixed-reality/enthusiast-guide/install-windows-mixed-reality) app, and [Windows Mixed Reality for SteamVR](/windows/mixed-reality/enthusiast-guide/using-steamvr-with-windows-mixed-reality) and Steam VR Beta.

As of November 1, 2026, for consumer editions of Windows and November 1, 2027 for commercial editions of Windows, Windows Mixed Reality will no longer be available for download via the Mixed Reality Portal app, Windows Mixed Reality for SteamVR, and Steam VR beta, and we'll discontinue support. At that time, Windows Mixed Reality will no longer receive security updates, nonsecurity updates, bug fixes, technical support, or online technical content updates. Existing Windows Mixed Reality devices will continue to work with Steam until users upgrade to a version of Windows that doesn't include Windows Mixed Reality.

This deprecation doesn't impact HoloLens. We remain committed to HoloLens and our enterprise customers. | December 2023 | | Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities. | December 2023 | | Legacy console mode | The [legacy console mode](/windows/console/legacymode) is deprecated and no longer being updated. In future Windows releases, it will be available as an optional [Feature on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). This feature won't be installed by default. | December 2023 | From 5cd440133f2dda0fdb64fc52d640548ee5828e22 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 8 Jan 2024 16:04:42 -0800 Subject: [PATCH 03/34] dep-rsa1024-8644149 --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 566f837f0c..a3a8c47e8c 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -47,7 +47,7 @@ The features in this article are no longer being actively developed, and might b | Feature | Details and mitigation | Deprecation announced | |---|---|---| -| TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits | Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013 ([Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf)), recommending specifically that RSA keys should have a key length of 2048 bits or longer. This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows.

TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| January 2024| +| TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits | Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013, recommending specifically that RSA keys should have a key length of 2048 bits or longer. For more information, see [Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf). This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows.

TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| January 2024| | Windows Mixed Reality | [Windows Mixed Reality](/windows/mixed-reality/enthusiast-guide/before-you-start) is deprecated and will be removed in a future release of Windows. This deprecation includes the [Mixed Reality Portal](/windows/mixed-reality/enthusiast-guide/install-windows-mixed-reality) app, and [Windows Mixed Reality for SteamVR](/windows/mixed-reality/enthusiast-guide/using-steamvr-with-windows-mixed-reality) and Steam VR Beta.

As of November 1, 2026, for consumer editions of Windows and November 1, 2027 for commercial editions of Windows, Windows Mixed Reality will no longer be available for download via the Mixed Reality Portal app, Windows Mixed Reality for SteamVR, and Steam VR beta, and we'll discontinue support. At that time, Windows Mixed Reality will no longer receive security updates, nonsecurity updates, bug fixes, technical support, or online technical content updates. Existing Windows Mixed Reality devices will continue to work with Steam until users upgrade to a version of Windows that doesn't include Windows Mixed Reality.

This deprecation doesn't impact HoloLens. We remain committed to HoloLens and our enterprise customers. | December 2023 | | Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities. | December 2023 | | Legacy console mode | The [legacy console mode](/windows/console/legacymode) is deprecated and no longer being updated. In future Windows releases, it will be available as an optional [Feature on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). This feature won't be installed by default. | December 2023 | From 57e6a1167d2ff8da2c00d1f1c52544067d74dfdd Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Tue, 5 Mar 2024 09:32:33 -0700 Subject: [PATCH 04/34] Changes for CloudDesktop CSP --- .../client-management/mdm/clouddesktop-csp.md | 8 ++++---- .../mdm/clouddesktop-ddf-file.md | 16 ++++++++-------- .../client-management/mdm/personalization-csp.md | 12 +++++------- .../client-management/mdm/personalization-ddf.md | 16 ++++++++-------- 4 files changed, 25 insertions(+), 27 deletions(-) diff --git a/windows/client-management/mdm/clouddesktop-csp.md b/windows/client-management/mdm/clouddesktop-csp.md index 8e70090f67..94a0ef518c 100644 --- a/windows/client-management/mdm/clouddesktop-csp.md +++ b/windows/client-management/mdm/clouddesktop-csp.md @@ -1,7 +1,7 @@ --- title: CloudDesktop CSP description: Learn more about the CloudDesktop CSP. -ms.date: 01/18/2024 +ms.date: 03/05/2024 --- @@ -29,7 +29,7 @@ The following list shows the CloudDesktop configuration service provider nodes: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | @@ -40,7 +40,7 @@ The following list shows the CloudDesktop configuration service provider nodes: -This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Dedicated Mode (Cloud only): Dedicated mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. +This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Personal Mode (Cloud only): Personal mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. @@ -66,7 +66,7 @@ This node allows to configure different kinds of Boot to Cloud mode. Boot to clo |:--|:--| | 0 (Default) | Not Configured. | | 1 | Enable Boot to Cloud Shared PC Mode. | -| 2 | Enable Boot to Cloud Dedicated Mode (Cloud only). | +| 2 | Enable Boot to Cloud Personal Mode (Cloud only). | diff --git a/windows/client-management/mdm/clouddesktop-ddf-file.md b/windows/client-management/mdm/clouddesktop-ddf-file.md index 60be060ee6..aca87d7142 100644 --- a/windows/client-management/mdm/clouddesktop-ddf-file.md +++ b/windows/client-management/mdm/clouddesktop-ddf-file.md @@ -1,7 +1,7 @@ --- title: CloudDesktop DDF file description: View the XML file containing the device description framework (DDF) for the CloudDesktop configuration service provider. -ms.date: 01/31/2024 +ms.date: 03/05/2024 --- @@ -38,9 +38,9 @@ The following XML file contains the device description framework (DDF) for the C - 99.9.99999 - 9.9 - 0x4;0x30;0x31;0x7E;0x88;0xA1;0xA2;0xA4;0xA5;0xBC;0xBF;0xCD;0xD2; + 10.0.22621.3235 + 1.0 + 0x4;0x30;0x31;0x7E;0x87;0x88;0x88*;0xA1;0xA2;0xA4;0xA5;0xB4;0xBC;0xBD;0xBF; @@ -53,7 +53,7 @@ The following XML file contains the device description framework (DDF) for the C 0 - This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Dedicated Mode (Cloud only): Dedicated mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. + This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Personal Mode (Cloud only): Personal mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. @@ -68,8 +68,8 @@ The following XML file contains the device description framework (DDF) for the C - 99.9.99999 - 9.9 + 10.0.22621.3235 + 1.0 @@ -82,7 +82,7 @@ The following XML file contains the device description framework (DDF) for the C 2 - Enable Boot to Cloud Dedicated Mode (Cloud only) + Enable Boot to Cloud Personal Mode (Cloud only) diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md index 70775b2f69..614e47b8a9 100644 --- a/windows/client-management/mdm/personalization-csp.md +++ b/windows/client-management/mdm/personalization-csp.md @@ -1,7 +1,7 @@ --- title: Personalization CSP description: Learn more about the Personalization CSP. -ms.date: 01/31/2024 +ms.date: 03/05/2024 --- @@ -9,8 +9,6 @@ ms.date: 01/31/2024 # Personalization CSP -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - The Personalization CSP can set the lock screen, desktop background images and company branding on sign-in screen ([BootToCloud mode](policy-csp-clouddesktop.md#boottocloudmode) only). Setting these policies also prevents the user from changing the image. You can also use the Personalization settings in a provisioning package. @@ -38,7 +36,7 @@ The following list shows the Personalization configuration service provider node | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | @@ -77,7 +75,7 @@ This represents the status of the Company Logo. 1 - Successfully downloaded or c | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | @@ -116,7 +114,7 @@ An http or https Url to a jpg, jpeg or png image that needs to be downloaded and | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | @@ -127,7 +125,7 @@ An http or https Url to a jpg, jpeg or png image that needs to be downloaded and -This represents the name of the company. It can be at most 30 characters long. This setting is currently available only for boot to cloud shared pc mode to display the company name on sign-in screen. +The name of the company to be displayed on the sign-in screen. This setting is currently available for boot to cloud shared pc mode only. diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md index 07040a6851..87ccb6cf93 100644 --- a/windows/client-management/mdm/personalization-ddf.md +++ b/windows/client-management/mdm/personalization-ddf.md @@ -1,7 +1,7 @@ --- title: Personalization DDF file description: View the XML file containing the device description framework (DDF) for the Personalization configuration service provider. -ms.date: 01/31/2024 +ms.date: 03/05/2024 --- @@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB; @@ -101,7 +101,7 @@ The following XML file contains the device description framework (DDF) for the P - A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image. + A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image. @@ -148,7 +148,7 @@ The following XML file contains the device description framework (DDF) for the P - A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only. + A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only. @@ -162,7 +162,7 @@ The following XML file contains the device description framework (DDF) for the P - 99.9.99999 + 10.0.22621.3235 2.0 @@ -189,7 +189,7 @@ The following XML file contains the device description framework (DDF) for the P - 99.9.99999 + 10.0.22621.3235 2.0 @@ -203,7 +203,7 @@ The following XML file contains the device description framework (DDF) for the P - This represents the name of the company. It can be at most 30 characters long. This setting is currently available only for boot to cloud shared pc mode to display the company name on sign-in screen. + The name of the company to be displayed on the sign-in screen. This setting is currently available for boot to cloud shared pc mode only. @@ -217,7 +217,7 @@ The following XML file contains the device description framework (DDF) for the P - 99.9.99999 + 10.0.22621.3235 2.0 From 7b90087945b19e96c3626b5242242acb3d3808db Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Tue, 5 Mar 2024 12:33:03 -0700 Subject: [PATCH 05/34] Update CloudDesktop CSP --- windows/client-management/mdm/clouddesktop-csp.md | 4 ++-- windows/client-management/mdm/clouddesktop-ddf-file.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/clouddesktop-csp.md b/windows/client-management/mdm/clouddesktop-csp.md index 94a0ef518c..e249d20ca8 100644 --- a/windows/client-management/mdm/clouddesktop-csp.md +++ b/windows/client-management/mdm/clouddesktop-csp.md @@ -40,7 +40,7 @@ The following list shows the CloudDesktop configuration service provider nodes: -This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Personal Mode (Cloud only): Personal mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. +This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Dedicated Mode (Cloud only): Dedicated mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. @@ -66,7 +66,7 @@ This node allows to configure different kinds of Boot to Cloud mode. Boot to clo |:--|:--| | 0 (Default) | Not Configured. | | 1 | Enable Boot to Cloud Shared PC Mode. | -| 2 | Enable Boot to Cloud Personal Mode (Cloud only). | +| 2 | Enable Boot to Cloud Dedicated Mode (Cloud only). | diff --git a/windows/client-management/mdm/clouddesktop-ddf-file.md b/windows/client-management/mdm/clouddesktop-ddf-file.md index aca87d7142..98427f9e32 100644 --- a/windows/client-management/mdm/clouddesktop-ddf-file.md +++ b/windows/client-management/mdm/clouddesktop-ddf-file.md @@ -53,7 +53,7 @@ The following XML file contains the device description framework (DDF) for the C 0 - This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Personal Mode (Cloud only): Personal mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. + This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Dedicated Mode (Cloud only): Dedicated mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. @@ -82,7 +82,7 @@ The following XML file contains the device description framework (DDF) for the C 2 - Enable Boot to Cloud Personal Mode (Cloud only) + Enable Boot to Cloud Dedicated Mode (Cloud only) From 1c105c30963b86e0db13e655ef2e735d4c267f9d Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 12 Mar 2024 11:49:21 -0400 Subject: [PATCH 06/34] Refactor link lists in index.yml file --- windows/configuration/index.yml | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml index 8ca14120c5..b6023eda4e 100644 --- a/windows/configuration/index.yml +++ b/windows/configuration/index.yml @@ -32,14 +32,16 @@ landingContent: - title: Configure a Windows kiosk linkLists: - - linkListType: how-to-guide + - linkListType: concept links: - - text: Configure kiosks and restricted user experiences - url: assigned-access/index.md - text: What is Assigned Access? url: assigned-access/overview.md - text: What is Shell Launcher? url: assigned-access/shell-launcher/index.md + - linkListType: how-to-guide + links: + - text: Configure kiosks and restricted user experiences + url: assigned-access/index.md - linkListType: quickstart links: - text: Configure a kiosk with Assigned Access @@ -48,13 +50,27 @@ landingContent: url: assigned-access/shell-launcher/quickstart-kiosk.md - text: Configure a restricted user experience with Assigned Access url: assigned-access/quickstart-restricted-user-experience.md + - linkListType: reference + links: + - text: Assigned Access XML Schema Definition (XSD) + url: assigned-access/xsd.md + - text: Shell Launcher XML Schema Definition (XSD) + url: assigned-access/shell-launcher/xsd.md - title: Configure shared devices linkLists: + - linkListType: concept + links: + - text: Shared devices concepts + url: /windows/configuration/shared-pc/shared-devices-concepts - linkListType: how-to-guide links: - - text: Manage multi-user and guest devices - url: shared-devices-concepts.md + - text: Configure a shared or guest Windows device + url: /windows/configuration/shared-pc/set-up-shared-or-guest-pc + - linkListType: reference + links: + - text: Shared PC technical reference + url: /windows/configuration/shared-pc/shared-pc-technical - title: Use provisioning packages linkLists: From eb0d32226b4a14a10456e49a65cb85f49acca0f8 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 12 Mar 2024 15:27:56 -0400 Subject: [PATCH 07/34] Update Microsoft Store link and fix formatting in Remote Credential Guard --- windows/configuration/store/index.md | 56 +++++++++ ...op-employees-from-using-microsoft-store.md | 107 ------------------ windows/configuration/toc.yml | 2 +- .../remote-credential-guard.md | 2 +- 4 files changed, 58 insertions(+), 109 deletions(-) create mode 100644 windows/configuration/store/index.md delete mode 100644 windows/configuration/store/stop-employees-from-using-microsoft-store.md diff --git a/windows/configuration/store/index.md b/windows/configuration/store/index.md new file mode 100644 index 0000000000..f405109880 --- /dev/null +++ b/windows/configuration/store/index.md @@ -0,0 +1,56 @@ +--- +title: Configure access to the Microsoft Store +description: Learn how to configure access to the Microsoft Store. +ms.topic: how-to +ms.date: 03/12/2024 +--- + +# Configure access to the Microsoft Store + +Microsoft Store is a digital distribution platform that provides a way for the users to install applications on Windows devices. Organizations that manage Windows devices can configure access to Microsoft Store for devices in their organization. For some organizations, business policies require blocking access to Microsoft Store. + +This article describes how to configure access to the Microsoft Store app in your organization. + +## Prevent access to the Microsoft Store + +You can use configuration service provider (CSP) or group policy (GPO) settings to configure access to Microsoft Store. The CSP configuration is available to Windows Enterprise and Education editions only. + +[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../images/icons/intune.svg" border="false"::: **Intune/CSP**](#tab/intune) + +[!INCLUDE [intune-settings-catalog-1](../../../includes/configure/intune-settings-catalog-1.md)] + +| Category | Setting name | Value | +|--|--|--| +| **Administrative Templates > Windows Components > Store** | Turn off the Store application| Select **Enabled**| + +[!INCLUDE [intune-settings-catalog-2](../../../includes/configure/intune-settings-catalog-2.md)] + +Alternatively, you can configure devices using a [custom policy][INT-3] with the [Policy CSP][CSP-2]. + +| Setting | +|--| +|- **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/ADMX_WindowsStore/RemoveWindowsStore_2`
- **Data type:** string
- **Value:** ``| + +#### [:::image type="icon" source="../images/icons/group-policy.svg" border="false"::: **GPO**](#tab/gpo) + +[!INCLUDE [gpo-settings-1](../../../includes/configure/gpo-settings-1.md)] + +| Group policy path | Group policy setting | Value | +| - | - | - | +| **Computer Configuration\Administrative Templates\Windows Components\Store** | Turn off the Store application| **Enabled**| + +[!INCLUDE [gpo-settings-2](../../../includes/configure/gpo-settings-2.md)] + +--- + +## User experience + +When you prevent access to the Microsoft Store, users can't access the Store app. Here's a screenshot of the Store app when access is blocked: + + + + +[CSP-2]: /windows/client-management/mdm/policy-csp-admx-credssp +[INT-3]: /mem/intune/configuration/settings-catalog diff --git a/windows/configuration/store/stop-employees-from-using-microsoft-store.md b/windows/configuration/store/stop-employees-from-using-microsoft-store.md deleted file mode 100644 index a70a6b5922..0000000000 --- a/windows/configuration/store/stop-employees-from-using-microsoft-store.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Configure access to Microsoft Store -description: Learn how to configure access to Microsoft Store for client computers and mobile devices in your organization. -ms.topic: conceptual -ms.date: 11/29/2022 ---- - -# Configure access to Microsoft Store - -IT pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store. - -> [!IMPORTANT] -> All executable code including Microsoft Store applications should have an update and maintenance plan. Organizations that use Microsoft Store applications should ensure that the applications can be updated through the Microsoft Store over the internet, through the [Private Store](/microsoft-store/distribute-apps-from-your-private-store), or [distributed offline](/microsoft-store/distribute-offline-apps) to keep the applications up to date. - -## Options to configure access to Microsoft Store - -You can use either AppLocker or Group Policy to configure access to Microsoft Store. For Windows 10, configuring access to Microsoft Store is only supported on Windows 10 Enterprise edition. - -## Block Microsoft Store using AppLocker - -Applies to: Windows 10 Enterprise, Windows 10 Education - -AppLocker provides policy-based access control management for applications. You can block access to Microsoft Store app with AppLocker by creating a rule for packaged apps. You'll give the name of the Microsoft Store app as the packaged app that you want to block from client computers. - -For more information on AppLocker, see [What is AppLocker?](/windows/device-security/applocker/what-is-applocker) For more information on creating an AppLocker rule for app packages, see [Create a rule for packaged apps](/windows/device-security/applocker/create-a-rule-for-packaged-apps). - -**To block Microsoft Store using AppLocker:** - -1. Enter **`secpol`** in the search bar to find and start AppLocker. - -1. In the console tree of the snap-in, select **Application Control Policies**, select **AppLocker**, and then select **Packaged app Rules**. - -1. On the **Action** menu, or by right-clicking on **Packaged app Rules**, select **Create New Rule**. - -1. On **Before You Begin**, select **Next**. - -1. On **Permissions**, select the action (allow or deny) and the user or group that the rule should apply to, and then select **Next**. - -1. On **Publisher**, you can select **Use an installed app package as a reference**, and then select **Select**. - -1. On **Select applications**, find and select **Store** under **Applications** column, and then select **OK**. Select **Next**. - - [Create a rule for packaged apps](/windows/device-security/applocker/create-a-rule-for-packaged-apps) has more information on reference options and setting the scope on packaged app rules. - -1. Optional: On **Exceptions**, specify conditions by which to exclude files from being affected by the rule. Conditions allow you to add exceptions based on the same rule reference and rule scope as you set before. Select **Next**. - -## Block Microsoft Store using configuration service provider - -Applies to: Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education - -If you have Windows 10 devices in your organization that are managed using a mobile device management (MDM) system, such as Microsoft Intune, you can block access to Microsoft Store app using the following configuration service providers (CSPs): - -- [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) -- [AppLocker CSP](/windows/client-management/mdm/applocker-csp) - -For more information, see [Configure an MDM provider](/microsoft-store/configure-mdm-provider-microsoft-store-for-business). - -For more information on the rules available via AppLocker on the different supported operating systems, see [Operating system requirements](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker#operating-system-requirements). - -> [!IMPORTANT] -> If you block access to the Store using CSP, you need to also configure [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) to enable in-box store apps to update while still blocking access to the store. - -## Block Microsoft Store using Group Policy - -Applies to: Windows 10 Enterprise, Windows 10 Education - -> [!NOTE] -> Not supported on Windows 10 Pro, starting with version 151. For more info, see [Knowledge Base article #3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). - -You can also use Group Policy to manage access to Microsoft Store. - -**To block Microsoft Store using Group Policy:** - -1. Enter **`gpedit`** in the search bar to find and start Group Policy Editor. - -1. In the console tree of the snap-in, select **Computer Configuration**, select **Administrative Templates**, select **Windows Components**, and then select **Store**. - -1. In the Setting pane, select **Turn off the Store application**, and then select **Edit policy setting**. - -1. On the **Turn off the Store application** setting page, select **Enabled**, and then select **OK**. - -> [!IMPORTANT] -> When you enable the policy to **Turn off the Store application**, it turns off app updates from the Microsoft Store. To allow store apps to update, disable the policy to **Turn off automatic download and install of Updates**. This policy is found under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store**. This configuration allows in-box store apps to update while still blocking access to the store. - -## Show private store only using Group Policy - -Applies to Windows 10 Enterprise, Windows 10 Education - -If you're using Microsoft Store for Business and you want employees to only see apps you're managing in your private store, you can use Group Policy to show only the private store. Microsoft Store app will still be available, but employees can't view or purchase apps. Employees can view and install apps that the admin has added to your organization's private store. - -**To show private store only in Microsoft Store app:** - -1. Enter **`gpedit`** in the search bar, and then select **Edit group policy (Control panel)** to find and start Group Policy Editor. - -1. In the console tree of the snap-in, go to **User Configuration** or **Computer Configuration** > **Administrative Templates** > **Windows Components**, and then select **Store**. - -1. Right-click **Only display the private store within the Microsoft Store app** in the right pane, and select **Edit**. - - The **Only display the private store within the Microsoft Store app** policy settings will open. - -1. On the **Only display the private store within the Microsoft Store app** setting page, select **Enabled**, and then select **OK**. - -## Related articles - -[Distribute apps using your private store](/microsoft-store/distribute-apps-from-your-private-store) - -[Manage access to private store](/microsoft-store/manage-access-to-private-store) diff --git a/windows/configuration/toc.yml b/windows/configuration/toc.yml index 60dc6990dc..c95d3d3c20 100644 --- a/windows/configuration/toc.yml +++ b/windows/configuration/toc.yml @@ -14,7 +14,7 @@ items: - name: Microsoft Store items: - name: Configure access to the Microsoft Store - href: store/stop-employees-from-using-microsoft-store.md + href: store/index.md - name: Find the AUMID of an installed app href: store/find-aumid.md - name: Manage Microsoft Store tips, "fun facts", and suggestions diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index dc9d66ddbd..1c91ad7cd3 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -169,7 +169,7 @@ Alternatively, you can configure devices using a [custom policy][INT-3] with the | Setting | |--| -|- **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/ADMX_CredSsp/RestrictedRemoteAdministration`
- **Data type:** string
- **Value:** ``

Possible values for `RestrictedRemoteAdministrationDrop` are:
- `0`: Disabled
- `1`: Require Restricted Admin
- `2`: Require Remote Credential Guard
- `3`: Restrict credential delegation | +|- **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/ADMX_CredSsp/RestrictedRemoteAdministration`
- **Data type:** string
- **Value:** ``

Possible values for `RestrictedRemoteAdministrationDrop` are:
- `0`: Disabled
- `1`: Require Restricted Admin
- `2`: Require Remote Credential Guard
- `3`: Restrict credential delegation | #### [:::image type="icon" source="../images/icons/group-policy.svg" border="false"::: **GPO**](#tab/gpo) From 22db99884e6355d22444528de8b8b78e7d656cf6 Mon Sep 17 00:00:00 2001 From: Sheng Pan Date: Wed, 13 Mar 2024 04:20:55 +0800 Subject: [PATCH 08/34] Remove external documentation links for testbase --- windows/whats-new/windows-11-plan.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/windows/whats-new/windows-11-plan.md b/windows/whats-new/windows-11-plan.md index fbb1d4e367..d8b9301431 100644 --- a/windows/whats-new/windows-11-plan.md +++ b/windows/whats-new/windows-11-plan.md @@ -99,15 +99,13 @@ It's important that organizations have adequate time to plan for Windows 11. Mic Microsoft's compatibility promise for Windows 10 is maintained for Windows 11. Data from the App Assure program shows that Windows 10 compatibility rates are over 99.7% for enterprise organizations, including line of business (LOB) apps. Microsoft remains committed to ensuring that the apps you rely upon continue to work as expected when you upgrade. Windows 11 is subject to the same app compatibility validation requirements that are in place for Windows 10 today, for both feature and quality updates. -#### App Assure and Test Base for Microsoft 365 +#### App Assure -If you run into compatibility issues or want to ensure that your organization's applications are compatible from day one, App Assure and Test Base for Microsoft 365 can help. +If you run into compatibility issues or want to ensure that your organization's applications are compatible from day one, App Assure can help. - **App Assure**: With enrollment in the [App Assure](/windows/compatibility/app-assure) service, any app compatibility issues that you find with Windows 11 can be resolved. Microsoft will help you remedy application issues at no cost. Since 2018, App Assure has evaluated almost 800,000 apps, and subscriptions are free for eligible customers with 150+ seats. -- **Test Base for Microsoft 365**: [Test Base](https://portal.azure.com/?feature.Win11=true%2F#view/Microsoft_Azure_Marketplace/GalleryItemDetailsBladeNopdl/id/Microsoft.TestBase) is a cloud testing platform that can help you evaluate applications readiness for Windows 11 upgrade or migration. IT administrators, software publishers, and system integrators can find desired test cases throughout the entire Windows validation lifecycle. Tests include, but aren't limited to, in-place upgrade validation, monthly quality updates, and tests against Windows preview features. - -You might already be using App Assure and Test Base in your Windows 10 environment. Both of these tools will continue to function with Windows 11. +You might already be using App Assure in your Windows 10 environment. The tool will continue to function with Windows 11. ## Next steps From 602b41570ec4487b5a4177dcd71d8da6877c55f3 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 12 Mar 2024 16:21:20 -0400 Subject: [PATCH 09/34] Update redirection URLs and remove unused file --- ...ing.redirection.windows-configuration.json | 14 ++++++-- .../store/images/store-blocked.png | Bin 0 -> 80351 bytes windows/configuration/store/index.md | 9 +++-- .../tips/manage-tips-and-suggestions.md | 32 ------------------ windows/configuration/toc.yml | 2 -- 5 files changed, 16 insertions(+), 41 deletions(-) create mode 100644 windows/configuration/store/images/store-blocked.png delete mode 100644 windows/configuration/tips/manage-tips-and-suggestions.md diff --git a/.openpublishing.redirection.windows-configuration.json b/.openpublishing.redirection.windows-configuration.json index ae975b34f1..d3f2f32f68 100644 --- a/.openpublishing.redirection.windows-configuration.json +++ b/.openpublishing.redirection.windows-configuration.json @@ -167,7 +167,7 @@ }, { "source_path": "windows/configuration/stop-employees-from-using-the-windows-store.md", - "redirect_url": "/windows/configuration/stop-employees-from-using-microsoft-store", + "redirect_url": "/windows/configuration/store", "redirect_document_id": false }, { @@ -392,7 +392,7 @@ }, { "source_path": "windows/configuration/manage-tips-and-suggestions.md", - "redirect_url": "/windows/configuration/tips/manage-tips-and-suggestions", + "redirect_url": "/windows/configuration/", "redirect_document_id": false }, { @@ -839,6 +839,16 @@ "source_path": "windows/configuration/taskbar/customize-taskbar-windows-11.md", "redirect_url": "/windows/configuration/taskbar", "redirect_document_id": false + }, + { + "source_path": "/windows/configuration/tips/manage-tips-and-suggestions.md", + "redirect_url": "/windows/configuration", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/stop-employees-from-using-microsoft-store.md", + "redirect_url": "/windows/configuration/store", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/configuration/store/images/store-blocked.png b/windows/configuration/store/images/store-blocked.png new file mode 100644 index 0000000000000000000000000000000000000000..c45c074f34cfa4b9bbbcdd0058b82df07663f993 GIT binary patch literal 80351 zcmXt91yGw!6Q)WF1xnH4P&Bv~FBEqVL5sV)1X@~J++9l`!GpWCv{-Np4#g!n1ed=b zoj)^~Oy0SB_SwC?z1_Qe!_-yfaIna*FfcH16y&8fF)$thFfblcJbU{0$?GirUw?m| zyU2swF)*+R{`)?_NY5nw`|yFgrkoT8e2`-6@1Mukk}8rI7?m;D*QQS}9te3TNK0z_ zJlJW){LZGJa~D)>y$AL^bHsI^V@p$6eWE}oudZ?N{MoB(e4@wFGA}Pa(=Z1^AfZPI z-#^lm(91tnz>XiQ+To~(i*hyz-2a*e56anwXK(Lq?-k?ny6@ivdTpp|DpFeQ34!Bj zFpW=>op&i5OoYFE@kyj{4SMAvdvd6{jZZ6GzS~Tu)^lpEeM&;hpWAzwpou))5U6uh zIrDtyd1JALEcP`*=ASjf%Z|~1d?|uC;BkXjAy9A!m-5w7C3f(~^ii~TT`vXX@<_2a zNbuy0L85J1wSHcH^-Mx-`q1r$ig^84w8ax;uQ=;Ee~Gzp0|u@&QLCIy)|*_d%s9=d z^Pzy>hTb}^m+rEng4zf6ZI-TPe;uYFD_O|9uN|HJTM_Rp0%wnAKc_Ff#~&XY3BUF$ zGGGhBJNu#;Xz=w&Brf%^5qP_PLGALo;K(|gC^6)XZZ^3JT67!4tr1~+C`TC{4lTF7 z;$iq*8$=L5M3m!;tcHy4dw1TXXB6x^BnV0WGFb=6EI{Y|phXaf$yr$;;pNb~1BV6b z@bJ3;Z6U8LE-aZR;fiCf<5$r{NvcVSR9z+Hi*7GCV%p4|DWf(WgAN<~O^gLpw}!5B zTJQRX2zbu#AfNn!>f=&Y9@dS!KIAGIELTTx5*es+Y&waIrSM{cTST~TRE>rM+Q-or zEJ_hnFaRD5dO90p?zY?@K+!?h+w)2s~((pHE#oz26aQ+tOQT zz}1oD1A$dp;W&DFGhESR@ebZqMk$w!E?F?<|F+LxnZ4<^h`QZGWaAzBX=u-N_n=vD zHQUP83{@`Cwi>Q!*81V$ETpq-2GyD`YCECY_}PzS;3cl+6k>*SFUZpxn}z9u8@ zVr`|iNcqDR6B;k1Mk=3pV#%dJmczGcnVhBf;;W-lTm5%WWn7FhRECc(syuhefakP5 zWzc=p>_R~rk@IM~NlT*6bYP_KkF!e-)FkxX_-afdXO)-#l z6Wm5YE`}EcHp$_NBqR=HuejvG6$zfwmm(yI+QJpd*Jz!OJh#R?I8YmnXBTJ(51Gz0 zKekk)(jKS`C~k7r+I@cMVX8Sshxa zp4>In>MtfCfp;_Q&k^9p^=v^Z`{1yB zO(VmmrA7L4r%ESvJS^x#9wk{hn?^-L2*+Zza>C-k-s4DtaK&jnSh<&wl1%3s#MZy% zSUgo6@i782svA4R`qVRsR4`qpQ%3z@dci>~5j5miRXBB8Zs%{XO-N*LB`O|nwy12N zQ6ysG*aa_`!71pwuqrC7*)rJ?B$w%gIwxEN%y^7g|8;bun1UdYjOdjha03g#$-Gg+ zQlltgqgm8s>21I*E0zB(YRt3c(ugFRTmNNF6z=kCsukwD%h{}otd6z!H8oXaEP#ww zqNLGzMZzTZhzNQC$6O`2#Jk*Gyl--RmaZ(gQq`Um$670Uc-RyC=Hc%wn$m6~PH`ug z+KM2fN$7WkcN`Ya#smCB4f2*T=vtLtI+weRZA-awbvxu0hHgI}6W}>BtZ#$;Hb1{{ z`8}5I&F5&2M4zQsj_7WzXcZU6GR-r;@XXT&XBERqQf^m;bVWZxlZZ9RN(*X^c!F14p}C!A=2j2I*|%GV2mtIpO3K73HAh8W!^UG>BzR zo)525FMUTQyZ>!EU=+;EIzUKtMWRl2J2&y`5?<+$ZFK@($-g7#^*nM{J?ssVNT+D; ze?mPap;jN!zcGJH)hBj^>(sc0%5mGvrftUeA+n#+;Q&a83Aoc-nk88vxf>?_#z*w|`ubvWzKma_tsl(jKHGaK9+dqe zsYtev=dwt`$?PaIO^t9Cs1APN6FHpM>Uh0<=2%2tK29eECs1edXqg>6P8F0eME+?~ z-MA?_e?Qmjr%yFyn?*ADTQEfD-3|en2ZM36iRp0w;PHW3tEwSXR+V8%$!=`iZz^Su%{II z#?ZWaXV}jV@+B*kqiy4pdaPucu%9+t)?NOdf>Mm$l%oQN{;$6h;y%I2tL$FU5q9wj zLDGpUN-d&XGMZ7?Ljnt{NW&~T_02S9qBi71%6*L>%=+nzv=Ljh6>`#iKA_4+X`rNi zER`rRYSDVwi;|~tK?j-o8vdCP+pZb6|N!=s_#j&$#Fh?_`gS4y`*mUNyT;x9z-H<&{3oJIvxp4t6CY(-`3B?9Q&z z6SE$Ds0^pdr*?LWaY{ zx2n;L!*UYlLM6zSS9Bd`76C|m^-(%j6l>g3MOBmH=OrmfYy}T34;EJYb6&+BX~`u5 zQW!ENtfM3HO+@%MIk-+Z{DmHES&@WYx;_Y0u*H=2vo7EXC7eI!S;!+Z-7%RF6DJ+JJ75Tk4zx>=x`3rz?+cW;>tup3}M7 zDP_e{7wks08QP24$*oM7CoM(}1#D}3vf4HfM0VzVrTbo;aZ9`Ebd@4o}A2mKIRRBFM_ti1g&S;ImK&Dy2*?M5qW&a_&QuI0zh9;kAlLZSM=4kUP1!4x*Ecn4cJ15- zV=QNFyPi(%Rd#oV4S=JxwRE6`P7Y%?gP`mZ7zv(|@$1Fa^|mkb|NU`~8l?SOX#Ayk z>{W{HR_bp%$X@hgzRGNRM7N!VZ{yY<0HuDEI63Z{B?0v-k;t~jZU;L3KffQEW>UXz zj;d@1eost}#VwDv)vrf&`nnQiU-jcKre%kc9X+7c1!-63G@pC#u?jye|9y4Ryc zH7=g3##%=hm(PF@RKnYc*|W{~x%fB>Mcr;uZr!g&B*l6gX?b5XXqQy$H+nz9cAQsy zB5#=Q@XEkoa&Y+)AmXhl{$`ZS##$$$iXc})qCr&C`ydGdaa#TMb>fQ+zvf$UuR~+M ztsoOhR$8X{V4Dq%#5pCXb=K?A6;<*vn!G>C%OIb*_a*2<7BCB@y@o=O8yW#Hmg; zw(mMOF{5%KYykka4q@+BYnAFncqCJpD~=akd((XGq3K2iTxRLEba*{4^$}|&1X9XW zT0|-_%=U;{k8G^n&}Zd02^vPuGS$fYDrcGd_U7m#Rls#>w0XsR6 znpT#%p>FC6MubLDpZ;Z~ay#~+btC7yUOZSMp_tk%_2jjWIN_S-6-kT7VECuneODfr z%SOCT329Tml%MW0jjl&n&pqF;eUI+<+YhSQbouW1$= zPKZQdYitjJwi; zZ@WJEwL2$m)=H2Kvl!5e9qX15hW@r>+h%=QDP!q7x5lyIEsqTw4~Mg{7#XE1?Ykhuf4p%!!*YQ-& c1Mrm4DFC@^@O=;FS zvaFdeFb~@spg5x&l`_jVm#&YmNoJn9zR;h*dvSW`Tq_Y3s3sF&&LE=hX}JTlZk}_? z^k3|L(S^4|q|D?uU4bfT`|%PtfK5{YiK9yH*7O0_9v zytZBZlj*)w*3Px(8-2&5a5ZF+V-5 zIP4q0x>>;4K@ZpG_B!4+I)z=1H`lG~ZwD@syAN;9of|rN2EVeLG&3k~t6t)@E_%X# zws4lQf)f7Yf6D_dQs!VcW`de;qLGH~&_qWyVqk`4@j7nMq}x}{QLPF@lM(3#?HOoe zl|8L%gJ+SkTBx9qME`up`H{3y7E!x~qd7kasP&-CSlwATx;73SkRkvSd}(*9yS9*W z)1?ec2$|Grw=83SRn_FU^pvV`Wi?kFLfA08)0{&ww)!*_J(Ya(xcPc_?+TMo!szpU zQcn|<9!t-SqGL5RUj>nrB;M=aM@nA!+>_@!=ljL5Bet@yd}J{!q%Yo}dnD+4$dHhvzh`EyXtyZ zYgA_XV>s7|&gRZlX+iz-v|229A_K7$Xr>4od%=QlX<|WKR{lb--i!j&>0P4|n;aF7 zp4`<*WBO8(5=QkaS(Hh2B*$W$ceP&JX>d}*C2CJk!$GkXvg~3+rKb<=43QaiW!Z1z z`7UTeJe*5kaxfARpB?aY7$|Igvs$T3N9;@q;nk!7= z55Z4H>l>e4wtRGO(m;wxCiU!`RZ1)LGBaBQ*zy?lJwY@HbXqFhiCfHtRa|qe#>n2n zV;qw+neAG<&PP}l%*wa$w+%dyFf?4I*ZqB8!si8Dy|}Spw;Z9Iff+7*-`kQOb zK(tc$IqS2fe>f>;(P`W4xm>U2pVw4En@nuUH7?q0xWD(dTwG}r*{fZx!3ZGB`xyrk z?T+)rea?y7++B@lYhcGvEE!O%2ir4SR8Cfb6D9KJ&c-k#Hd+7es~D^$8_7yAG2U2= zvOcTCxbd6pBl+G9U75}~+m!jgSqm($u3Lus0`J#nH5$K-H9Af0CR*(SYtrIY0GwJ4~a@Vm|h1q+>3!~Yl#guDT+~8|G zprv(jb?W%-Qn|faU`HL_q}4n}S-BF)h^7V$siA&AfukVd_HArLbdZ!jt9awt=<#Ky zfM>TLpHr9KzFOY{o#@55;&t~-#Pu0!&H@YUI2%FP^BgQjBKs_}%YFW?ZjZkcXF6re zF}ACF^pvEtto((gV}{4L9tPkd&-z*x>uQ6;z0jA!S-DAb4`6d4=HP}~!}fjgYt^Wk z>1*y|zKfdPz=(KM>p4)PzN(2X1EIK-O4yyw2*uJ3&w-5o8B8~u3Sopj+|I*Jj0)H( zMnlOTHQD;|?3um9>|eauNCj1n9@D8jV zcuc!v-7&a1_h%StW=_;!=wV!f=M|*@-Sz9Vpt(9<6)%r~#8X#Rqe`?NxVB5BQz%IQ zd2Q`uDTgTPN1}doJl3wKy7C0(4nNl@I_P~R)9FzHPk+Np)yS&WCB3%d`>aM-NUGLw zg)5uSxJSFND8CRRiLX?TyoAJbYhEjjQYxH}V@wVdW@2^Lt3o^G?wuE!JS3PU@d53r zt?1Qn_!e_Kru%QMLRfouy4Pz&?1b)^WgpYP*1P~el?(vh{E;8VgufmIF*#_QS=4+w zXr82k9fD?UO-WR z%RqRZa9t=eFIHF=(L{YYlmQ_fb289UxH~*gkNqQQhtt9>R=|WaN0*C}C`6 zqG5dCz>|DMEwXs>6)F)(l!euiZgX+E{kFV_^_{FwnKt(sg@qCkt=|#fIGk?w8Gq zTn<#R9CqH6pfXRxTT4R@7e-m$Jn30>@eDGN8Q9O*buQMFh<9kHjAOf`FAU3K`*7u$ z6=dg3i2VI~)4MiYaUSoDv-KGpTJD_+;ppdR>M zj-8odtvs+sUSf)57;auaGB~CNGs2X$Yr$MFEi4}Ip3KPa(bH;us&PzWhVZccv@|K{ zbmnGKo8L+-AN4gv0+*+nU3u?I*h!4{QD<3mU*h26ZY$Cw%U8)%!C+A**P7RP0SZHfVNFVFFl-m z`0d8q@@O}~7_=#9%H;A*3P?7KW;QYG$=hM-w_t)2wu&gW$J#uGoqokm$wlQp zo2D{|A=)vMv@lKD&pQ|Kdm9pONDEAU_p2w}^cj{QF0I##IyQu>qEb$&Q#=tZ=6zqa zeeDrMAEikDN`1v}1XRWC@yK<^340+hZ7fgo#vOrmHuhuy-Qp(-veFr0O`rR?*+E{+ z4q2Cl=iJm&I7fu5{1Pu^1FYzQ!b%yfDTQFo6hhzk_i#3c`6ov)@u)Q&hlFjhDQm%> zZnxuQE=S>0g6HjUqtKePygbYi_PQ@8KMXkJIxZCbm|zMxNxpACfoaKZD%Dw=9z=su9h9tB$| zSj#{Fc zt-D^z?|Ie>kc9|nHx48X!V+C{wbSohd;PSvhsy5~XNk!2j804{&^^IbugWJ=-(0j= z6Izx$DZjY&T*FGHu5Ko$=&VdbZiT(}8d^?-1mt|$ALk5>rSjhffcLFS=m{8PIF~W6 zo_Z_|oMLpz96(4_jYn$~kZiAYzYUSm}k(+-?Z zhL~4dfRp-+eAzho)Vj-}6_!OzoYy3K-st&<-FNoMh;~O^!FR>hZqy&Fp812z z<@!K*vp)QyUw*QnT!?0}$qM~xXr${CPg9*Op0Aw?ll!tJ(+h-zN!NoURpV0}v70~l zOt3$Hsw#XOSLKStH*Z4yvAS#;aeC<~=Dd-b4Mq|9{fZ&s{S;U~*TrG}2J4HmI7y8# z?#3;qKN6YYa2*B~vvLe~Gub*nK0Xfr@0b?@CsXeAWvMD90(OtiWt6bxD zHBZcKGRgBFksn{_iF!ptsyU2G*G;MTQ_PzcCpiuNxTbv^40+v&v@q*MQ-#(!<8Gd2 z2&jm*5u9nM0{an&vbt{`SCq6kofgfiB#3ZiJao!j{BzPXWF7rNSH`Gtc4xsfF;|K! z<=CuXsKJx}B)!}3S(SBrWkb!lXX1)9)fk1A!WEtVBavT59tx@0k2PI~f{~$3a9}OjYy@*f@zO{hZ zG`yS?8TmOqN=h4{e5LSjJ<11B>&^&&g7|`I#HS5Drj7?os&NyIS@;9 zBTjvna3}|%Kad~Iwkg%{@vuiBTL8qC=kWSibYE%Gt9Claudk$`wL15hu-@vN8;7RV zcqJRI9^|Bm&jC&Ao@aSp^Wx1OAI`#A+t~;-#aNNkZzO^z$HaFn>11w0JcXm-&qKSI z{9>v2Htyx7o6Dq?=!NmZrtBf;!&{DyhXc$P#J0Lhxa%eN<_xJwKGEX^- z{}Y-j$kDV(ciC?(u62I>S3Dc|C?O{^9dfiOCy{Q9E(VU2nA~h@gG?FL(uM*UTMwh0 z^Eu>MhnOU1X3$E`8Na=Ux^Yg$0n=CbLzA}8IuRdO%W&(5w`tBu$zrar0bwHUeI9HcVSJ;ax=^6Wn@AI!&KD#)R4zXmA+Gkp&u zOiI7F>gp;pteuRh6^P3xP{y_Mcjns*P3su%nu({lel=P+T&zbEZpYWstG++S{0s4; z<+w5i94UVA2~V%SGWg)DV9O@~Kxt{qK?rC5H?bYllaZLf8bOB6-yTch*lB%@mBsy! ze)$qrSl7baHbSHx{l)kQa$USyNZE7wCZbnA&=JqAR>835zj#F@b`%$r@7;Es6_T1H z&SigGWX;U-+OE7uKSIfoZf%RoW&gv;_0`8_mAQK zsYo8SJ6m6Z*%R-5hUhNklZD;={-TiU$gQEksEEbT8zT*ih-0-qN~7^F`YHX=kn@#s z+27Du?|UR^Y%@r^8|Y-0z`$iaqbRAKC+}IC9f)cqMQB6nd$d7CR^pjYn+l&sfK`m&e^n)bGwzZ`HTA2W$Bne_3bCByYud`nugm; zRN1HF(o&c0WzfeXd~RM1?JD9VFD5f9ECd-;uaW9MJ|8YKJ&~YoZu{a<8u#txw3nOL zm5Dxx)%V;2U1jTvG7K-eYdmZu%GfA%_doyqSm!V+8Ie(^PVUn(7X5m-zAX@+65KaC zyliFOvYPp2g_~0RZCb|c!F9>V)zUKKOpBw)lb_$cIB2U^E}ybM;imCcsbN3eT+`bk z00xgA{Kw#1vp!L13RyP(ml%YQR#!3d=rkcypBg4l)~>evb~x7{Vw4jSSXgC$Mj+Kq!sLaXKlX};{V1T!&5JGHa9!mT30p<-g9FW_D8?E zT$*fCP&@DBwLOzrgeCp@HovY!6>`bA>J=^H6xnp^c&tovHKX5~&!I@JgvUpIhR zB}i$Nk6pIUP(_?4k%T1*^KV&)Vu{meJ|Wxo>sO3GjQ)I7x&M4}va@j$8~t|OM}MwW ziG??SMnL99faylyVHM9ufMXId0fO;)b%4Ou!~ghW2>;-)XSfw&__?Rw$o*^6+)|df zt4QK7kF1x_)h#hNLh*s4#+SGi0@ycTreoT~$2V zsU7V{79#zPjzJzbCajCB%iQP~XQtg6DC+$dHX&aG3S;Bw&hccr+)5FbGw`C247x>- zyfpIW7u#NvQ1ccuOBxit@bMeQm&hY8Z_GsCj{1dh+6LDl-hxa7_Dt{f+f37=v8PKp zwS2IZQHSz;23wSh3FsKx3T+lkT)1Hxf|Pu#F90qcKJ~kHzxyQ1G@r6?bF#7piSQb( zU$`tdsU%l}l*#SnAC3S=@5HufS}#f#VRD)E@@jtb-J1jZVll=?-9d6pSztV}a*i>| zz-XJH(dQ=y8#^#2aZWPS>eZ-!;KmETUm+>OadDmW>o$JZ`(hcV**?OQZKvIeuKM9@ zf)clvBsO=sMkhmei`bi8D?_mMyIBcXiTHt&@b-B^^&tmN>S-^hDzN-fGkaxWnZcOk z-^*)%Kbu6J-KkZzTE%R1U;C|C1!>*UpcyOZK=+3;jj+xd_~uPXLNhNhk^joClZ7BZ z9I-Qo^1OnUBg;6iN+~(2AnePV4e@WrhbK7&F#$_v!t1{iw$kl6at#*OoIH@=z-(Q3 z!xyi)o4}f&mUlq#YHLjZBFlE;R>^j0YGq6Htcg0yuUTY_D_v;Li;WU2#e*E9QqH+p zpJ;4!hSj&9mTxWI-jvk@v|Epr;a;aE1G_z3&Ib6z8zN5O4v;Y?Z$|dMk4|lyvj`%G z8D*tk=&ZaE%|Dm-ISv<5v2<=n}hXYS+~0x5hsz& z`+4PttzqIPb(6yqt!uwL4x=!)j&trr#cu1fbLZ;nMna>7Y+1p##pavrK|T_GLvn2j z^}?#76LR9IgCby&c^`CC4MR&>2N&6SF=t7o`1R@Jh(s&;y~ozxqc|B0d#gQ_S+8M@ z`c}-W)-9|{q@|!GAL8dSOnyWt?dgay#hkl)I;}(N5)`9WGxdAX{jhj^&c7Y4f;;Ar z0zsY!f4W6)EG@HSOISU|CM0sfSGXfA8}m7VeuteN+mx#L?Y{HPo1meq_riAz8^e1U zXR^f6IU{(uS<3AJckZ^RZKo!VQIbHPT^=!-YvI?v_-PH=iNfo zx^j2J`lMhUWE(rVSQA5BM=j}(8@2gmb|LI^-s91H#RgZFTYn>->^ zY2ti2K-!YHy-E3nXRTT!fJM6&<}>vcFME&oZ*?~)v4Q*e-UKs;ozBM6W~ew@mjJeu z?YBv8X`D$nFJ5zT^4bZ(l>;41s62PME%q{orj{q}F8I@^rGF8J=NJW6`hkzwolDpl zC9bv@YTV9WvO7%|Z>PE>!ztyc-(NW|KzTfIzPhfLiR1){-<+d|a={zd!t+aeXHcU_ zW0hv-^Vd<`=1DkgFXZ?PrwGM}w}x-U0JmR=5((7W`5osgd9y{*?eG2`#oZ+D0-jp# z!^y|5Uz9JMC#XU*;H?1A$}Sc+;P1UG@^of^V;3iDd=Z)?t_^Q&2VcK&1oR`ceoK7B zKI{3;0Zz&ocJ@ih|MlG#Y>#=`oteDwmP9gEOZ#C7Q{<&+plN_rh9sexIA4|dXC)Gu z4lvKht&6WZlzN*IE4bDL`!Pa?gy^1M<`mvXTia-#8pZCtDe1|8bt8|hk&WSbAu0w< zS=G0@y4$8G6i@wEqt@9*!!AsJ}cih zv*YY!tN>q=YL6dSCrkU*_rHF>kt`o_twrDuQkgJoo{us)@bgETa!|3 zI7+|CAmR}BH-)$#tMf@ z5_2lTt9u+%QzSeBa&$D*_YxWkX><^ZKtO-RpJGdVUGQT)_YsaQH>0lVs8)O%JHe4} ztu6~MBks-0MX)}^!Sk~oHv)H!IcY%VV#?}H_^Trk0lDuQq@)s&m{{xZd{dN;vGKzZ zNi^WJXNVpf3p;r0KHa&LWc+#3SQVXU^}b3sIVI%#6$dlx%W2uk{KOD7Z?^b|}L1-iED&d{4d?to(UuOPu&QZ<~6r1T3l3 zvh-Ccq{zgL$ppwnJ^xD}+5XOSSm(45w_gu@(g#d;c9uMHoUB~yj7KYB4vDa19sa9G zwP-Z7&rN81Pc9V+)EL+w;%oaihF&60(r&A=u0c%Hmx>3zujgum@`M5QX|@dxXiElw zd&$@nwWQ8``s(0I(eixtI$^Oy;{Ql}jE+@M7kw=l&g*7)+Eoqp2QNuatN4cbCOr_$ zglPVr59tf>b+?Q#YWwFI{m&&|W&ovM)*!-b7Y=o`h4J?G(&|7x4&wesw&iWg>*HUg z9G|n)(39-a4`K+goQ87VZ%6##<1zz!WY%AHcSiI4EMWHQLKidI19cV|`F0m)Aj<|X zM!k2YE%6Dc4w-MthK%K4t5Rb>j}&5c#rX{b4SD4R=i2U#2z$TtDtXQWwrW*5?3UG^ z2s|X>b!3ShAoDl+!mq64^aTZkBJ~~9QomX<SYoH%9mh z=3_G6NyYa|UktD=euUmTE%0>rln|!%(k371uw(z9j@zh{lMZdE%YkU-ZLK|W2 zva{h%;ouw2N|I`E6F+nPY~X%L{?00`$=ca$LfbV1ll)h}(bd0~KD?3x2<2e6tuY0urfu#a|bc;F}V5^2F)_Y2NeyC+EkGjSIp2IQHeiXDFyTq4UK^7d+b#x$Y~C00H|hbP0;)yy?`w zGrS{|KH}e!IW^_M@ar_mZR*<~QIdGTI5K{ei&wg|h(!B~O%ZD>Lk7xf zQah!uK0@O>fh8SC+j%&u5;x8M%xz#znJABu_`8B%(=eH5{Is=zup*)VJ^p6K+c1qF zH|UmZQi|(F7_7>(3^Ho*heIdn*9c5%tndRV27jo17$ncL{_s}c22Zu zEfMA$>>JM!_nqI#r5@=oL@=rDGK6@|;=Q@xL#-wF5xstG%d}$Itu||5jJnuJ%>8tSu!L|1BM~Xi3 zAysJ%ohiEE;VREKn{+1jfAE!2RAUJM=J&vXGCF}D^>co=gvjI<3*)!^^IF&^`CD)I zC#-dc)i#9AEn|inWO<{Wv@$^vkM3p}8KGoau68NlQtEs(L0RN)N$uM3oXVKj8H!|b zoMlGP#I84ANd9}12jg7mu z!CZ`p$McX#u`i6`NeVFiuP4TjnOucYz(9-jgE3{vzn9@(R(p1)Uj$U;=X9grL^ifo zbNr_4gB1U3n;EaBumiw+s!a*_10Zff0uPfk{7dqdV+<<5C9nP9&t_m{Jz^V0I>#>} zLL>MKPUt>m{|isF$E=2EcCa^tznYQ8max6ki@%nu|)^ zK=MYTjFZXn-Y+WKuTB+8NQpREr5q#TXQ)w6gnEM<@i4bGq$*5eWoc=Sjb5qa-S=*i z#tx=aIG|@LPv|$fShtN69V_dzgyC8?D#OhBR!4bj^0sC&36lhnAFaRzK$g}skIw6u zqEbSA?VJV$GSm8TPc)gkD0JKeck^Ff)k>@R$v%Fd&*1VT^0jSA&FZU2qF7IUpnjM5 zkVYh8rbCbss>IK%D}A0+>X4`ZL+W4tLt=B`nCCZr)daB>25PSlbUW&L*cSC#d8psP z_H$$I$@U9cskGa6vkT_#lP|))!i{ybemWrunJ4{pLn0|1;5c|RR6zCTQ^UjFl^CjX1F)T8AyZ5B}_#o)ch zpjaKUfW%ONa3z8?gK=g+?uvRDJD{4!#FjP?xn6yFan-lY5YP5%{gs8<@%?1@xL2_l zn{5(6m<&I)8+bZa4kbW+Mg^8l-eCTx?bNeU9T0~Ap@jsBHQ7?n9t*%~!LhTOL3L6b zSS=im75pt35*X;TwTIFrSq}w^X*h2 zVckwSo<6J3j@C3i-7TvUth**Y`$cR*NYm%f_^ddTy)-eq`#P*UVG6TV<&OyOC)P)& z9xD+*pfRI&?aMKw0i_sWfP=h=B9_^|bW?!C7FLeapU(p>TW0XYyV^i~RMY~-*9vB| z0`qgOA|>pR}4k74RV7ruFj=oaENJK2RmEafz?B&3W%N^!L1} zB~Kk^noiYTVGyJVRq!VR!l$_rV}qa#z(uL!N3a*gk|*sylW)b#XCK;klYOk4^gJ@o z5}m0tHU-^XiYXEjJ!Jp%k&J*Nzcy?4@Mgr@=-5Vs|SluEz1YCe0N=` zoYL9^gmtc-G2S_xy!f}3la*&b=ZgTnZdCTOaOLT?!FP_|UtD`TC^&Abnrh|ZotA-Y zX>hvN7o%b%jeL@GL-C*u@kNDz&t#(%FXS+e@?ZYICk2}}H-A3nv5v3`9|+Fa=vPn9 zAI<{CGz1%H8C@YxekxE|yY~xCt#OR8Ma)&Z`6?MdEq z$5R(XRV|ZM^XzD9q;`|W{Lmp)#jwQe_x0UY0pu`^g;5k!iTn^RGdyDPt`wH#tt9!GW)GAs?B3*n@{8j?#y5tfV1{nP!+}kL+91tB$*VZ zk#Sdf4E4yk-_K(Vs?{j^wA94al}u9D3h-pt(lZaF|CIQ)_PFY}3B+gERoPo?#G)Q$ z)NWPe;!(t$I4M_I>&e^MI54Zy{NwB`Ju5^(1Z}LLe+Z@AI3rU zH|g)i^Stri3ZAdiaG397E+J~rJ&e{!Ll2VJWv>pU=9SJT$-E&*T!?$f6UBC4uwZ-- zGV`4{5+V}&H6uU$%hwO2p4Fi!WfUXXV9(q993HeJ^#hXIP!y3y0LFj;nrpa6c(OsAx5e zh*`r8RaRQRc|KBoMDhd@{t+=?CLE`el1xaQ&dj~8z~;pH^yfzR*z9u6ZxECd2c?m= zD^1n{)gt}3U4a|hi{qk`y%4*>vrmv)>hSUP#b{!0xg!ykNr>e-anf6;$Emc9HwXJ$ zVDIICs!3~Xj;)bd?H0XCl{Lc~Z5nE% zF|iLqtC|&(L?--XcXJS7^=)VO@!$iDFR|8Q0nA1jgG7VZgCSMMU)*@#E<%lF1yp7R zU%dGW?VrcFC*u(sjX(IiB-WeaJ;Ai2@n@8Zg{ruvfQRKJI=Hq?IhV_7?WMZzeN#Va zvgdL1Yw=9E7$HeWxQUV8OIVJngBNi;ygH`LyPogARv)82#z>PG=oE6-?HF(*lP#7S zwb>)SIlM5iOiSlwutZAvXIbVAyuC;K0FGtZWHv;NlXTnUan)?i0yp0oQ9JdL;|Xv@7N9!$K=fvA-vD;X=myp4vy>I%Q}Cl0H?PLf{9AkJ9xtwyW?P zqBr4@z1w_<5XYvYfVb21zk1&SzGElRX^?7#JI4?G;6J<_Ew8mtO`O;z z62c#q$(-QH?copvIk#Q|c#qL3l665c&~GB>YGo3`f_G?{EX$(tBvyVFIvno*?DRvM z+gu|Z=MNH)vOB@gY&@nbyW=OSBB^m0Rg@}#8jva4-!X=znCFmj-kWuk*wN@PZV{PK z3N$#VOq~QJ`{~*aEI`% z?dk7@>IdmGV|o3nzOS-)-Y6PnVjb&J7>?Dmt2A0s3+`&>^`uJqOmdj0m}xda${0GG z*?{1Qey#T>>4F`20bH95^am%n=OB0-&b1r zB6Nu2SV3p}BrCDiXdiZpeH4{uh4Xso;~GdHZ$?0w+qy8Ql|6L?h=Ym(~JKi z_=i%&j?{yq$Poq9{8Ws}40aObyqldmxf!uXpsFZw7>pR&>q=%HvvkCWZQk zOawETTdMpoeV|NUL`~4*KHApDe)V;X0}SV z;2C3ayq*(wP@Y+){ZWR2#NUZCNBtT}38eeq_*e^jjQP#})BYoloa)EF^+zW+%M8DX zf7{f2)vF6$g5xY-k>?;AKwnr#J{5R1pE1V;#i7)V5Gd5qp0Sfdi~C*#hoD#ZH8Mv} ziB^!cz!|#6orG?`$b?LA-3DUN-=$Z*;3z%+ghz)(p;K7!(rmPs!R~)7U3Wax{~xE) zK&h-`wGe0Tj8h8PS!X+(k)6Gc6QRtqx3agh$8oj`XUEyH$Kh%E@i{chF2s_@s>cSRavQ%0Y)L}@pKYAd;o&Tv>l&gymZL&aUA_g^e;0z zaJ*ag?llFne~jSF+l)`P%1%4$ICwt?$LZEJ$|=eVl{+O5%(w?d znMUY|S`VR&EjXUnjnP;a{+ldD3=_(cKBt%^zo<6Ai1$ z7;*&_Tk(psWc!A(=2TjMzP}Ud(sw1dp;*7te-OC@$C$i8kkpCys{7{1EJ=l5wq1sq?ZT|9 zgQc?dzXiol)$Tr3+4%23`kJX~A7^UZkK3J3Tf=1;v*O{V>obJctI6_eh} zCp`R_Q0u96$BtD`zN;!Vo4yI8{x}x*K1MLnJ{0u`q&#}VAv?(8t$W<}f+8bL{gkre zAmg2F01?a8R@B({eJu4;^}x4*m8;MG;twY}z<}$5YY+&iJl(l5)^tKYX@e?Td>|i- zshs+m6PS$Wc)3ZhVeaS%{x8hOM5zoK|40q1y$P|mIPXhN=OJIfi)m<%Ci4~_<@z=i zEXYH#wTnDoW+DsKr^EkyX*CwQ?P)aA)BTJ7D5z?LVZc(UTkq%Qg_0_k^QKnzWXB7# zgr5&P6g$~jvQo^f|6|D*e^3@H(W&VeY5iJyMf=LN7$ZjY`9q}1dEbP4rIHSJC16uq zHJbxPZ z3_CgyMfi3_bxqL_jL9|Ttlcs}TSB92ThV>syE6a5{{o|aYMF$|S!|-ScJ*S0kK^`6 zp9T#l&ccynzjf#88J$z~xA)q)FZQ#GT;4d4Fi-MJ-BJSCYuIaAJ<)U(5il$ZR_ms7 zKI;nRN4$J0(En!FGf$)Szd^=+`@SV2?14y!n8}$w!*gFZA&=YqPVDr@G+$k+;GzJI z;k?2jbD`5M6*r?Ew4BUfR&7KP;v?&XJo1TZDh@n;D0bQQoMF3O8orvq@i_527=X!cT>9<(IoGM!%poYesLk)~BI876U%|*i33U zmeCTI!AC1@p~Xf2qhpAa2@bzF;x`gzl{wcRuX$v^?O&iYy}GtpDa{ z%Zd;oN5&c}+xNPqg6|DAkB$<1Y8)gQOO~H&F;ZF8ZmeOXG44vIAN2P4+)jtO?@s-P z2%mIn+pCcH-fC%5Zm6wzs97PYWZit+S+Y2J3rTj}Sz&lMm;2de`_#hv^Ro6I+hM!idqz)ozVKVOevg zcVlki`q93LA-pu`N}SzOYjp!%kPb&*3Cc_%E>yhCWdoO1?C?V15Owj3tZu!nYJ0<<602g=N9HTfK?Yp=dW#4PdR zZ+^$8o*+JMWVfs?d39+kzwP5h-s0;M)zg)zq?^lKqbsVnekX^>y&iab_0H(EJ?_Xj zUHy|6KX0N>UiT@;Cyw~W>v^w_R&-MFUOn=+Q;%wIcP$RPU6MIJAH6)(=RP&$=IW}F z1s8TRG>TQ!8CgNvb&IQ7XS`?pngJ9kdRbRjS*>qjL@94~wMilxV0JWsTR!^YrNx?S zzO<3Ut%WQxm^pV+CiP*U=z`k-K0BnyWAO@7HFiIQCK0*${?Ycd-=yM8emrBHWQjd} zz!BCOIc~Y2l@zBh?RnLZtG6{uhRPkE-bwh=u|*!(Mh@p8f6O{Ly*SoT2%;^o3oTa{ z2`y|N|9#LyGJBnGQ_#ky%wB0Q=}!yrMI4=Z$n&eR!5@6gtQ6cy;b$)Slgnlgr}TPY z@<>He)OTXfRnp!H_F#p6YwDV8ftw^ToTiQ-fV9HRG`dVq&cykpGM}%??axub65KW? zvS()TeeOAOlIv=fu2|5u>9U3frFbJR_UUy{&HB=qFTMwyL+{X_)`-OU;1p2|&SB1A z;1T$2o^}K~tRf!XCwXL$M7`{L*2;6%iY{%V@ZAnr_nfS@+y8q@DuIAFKDqr6ucQAW zPb10fXy`m?romw(ergoUm>GqlIhP78A{sWMIc1suRybYp(EO&K=iGW>X^sPQfqw0@ zH(6x(E%V8TT%^dm&b{$YtXbffdR*h|;$NB@vxl3yX{YNk(Tj&kPU2kD7*mX{aj z`#nu(J^KV@ahM7aZ{|f%)~;l~uifUk+~raDZ8<}zAg^#3ekp#K`FxN$AJcS!Z31c# ztbdXHzK0b8+M4^0CM5SlNLL@Loot6vr&*@Qcb0KSYFA?pwG4{p~ZrRV|)um{Z(I=AzJIBDX1^Pq- zjPTvsL(@24cfEe-iukOW0%=>nZR2q)7*9=rw-6cXJoL%srn9a%+udA;-Wa4bhaM_# ztcX3yik;ond5p=fbGTBH9cWQ!3ieJG)KPpa!`K^|%F3*|ulthE*sEbh5|?k+W-oY& zPruY1@1*j@!7fiJf15Hj{cD9>k;XOU^%l^}Ua8AHsbSn%A8sI%`TXN>-+HOo( zl+)P`3J~fagjx5Et;onjwlcs%zb=5=O(x*`f)&vAtaVy)lf7shZVe)Q~yCGk49mHb<&NL52aQ z>;*y*=Y7VlSCB0JYqyx#?CzxiLuq>?ez`I-eDF& zYxLU|?=GF=U{Z!IgEH$vsK$oFs?u!znccW`$@J(N?D5j2`p}u2v`r0F95>L}- z(+kt>ubMv$xy~0!%Q{y3={w&odS(fa@4)?E6#2DL{9~J;b%eAPE>D{-^(VIM-4XPk z$G890>Y9xkZb*T&!g)o-Yi2J^jskYvCZd#ay_&UUnvCdgh}(4maB^hB{-|t@^BP9* zQIo^6Shrf86?H_ko1TI}s=~YqYkHUTYyp14*1?~b^k|GbM6(U;FcjB5^una;_Xo}9 zl#$WG1E_7Eb)05Ic6Uh*$={X>jj0YWZ+}z zq=OKgo77)oikCN@6GCEEdrOHN@c!&XBmIQxe34B`4fjfP>Pw9?`8@F zNiE&bT4w#Q{j$HVaGBLV8me5IZR5Sji-Xd_D&C34)fDGG_R5jdUq|tC9@M>d_Rh(I ztA=e@k!Ysvi&4i8YVEAj8i!eXI|v86)cKlfZ0yE_O=&MQXJu*6X-J-py7TWI3gZ_+ zJoozCdm3w$O?p4FbkZq|oO#y42dlq+%;?zuK*5tA;v$>*L+?7+`79}t%W`B_3%-j{ zWip}!tEOZ}IM#vI2jt0h@GI}Ap$1z{@rVx^(8#Jg`h&>*Y@TdPo=RRbCK<5oo-_xE zkpfCk0J^k|JhQ#}M_;=U&MvGa2bS7y&O5i4;*iUGfs&uNuef9y!BX0w+`ln{g zcv@|07yaz9?16FG`G#eob4I=xjGSx$cCi9e$xU%mSat^a&l3C(c^GJf=)gH)5R|J= zrKY~?01RupY^aq`)*fs$_o z`^jS6?%uWoNji#6V(w0$V^1Gn`ef5dVbe1ri#K}1gVCN8!Ff@!$$B5JO&S~CNR1x^ z$>-~755G>+)lo;6C8xZucnv{1u>O_Ojs+rkWSt~l3K^419F|2YgD3shb$Kyw{&MEQ zpI~m#H0TTt_|pPdZByrhBfL#aO3-?3bnQwlo#az1F-=9bA6Wv6Ulp~(u@r6YXkDvr zGTjDNP?(OqNlQp9vkGO=0-eq)G3YUGB5FQg)u%vAMXz~D91X2WI~B0)ojW%(v7I24 z?MNP6QQi_VE(hFw;EF+T;*o- zims&$B=E?s24Of6Pk9$kG<_4qN;sP9(kS&UXtXZquKxZp!){gU=^Pn=T7p|2w&mIH zZDDFUHqqQgX<+4Cgdc18OTzPE1q`6D9bdH3WTX9SMpl$Hx`QFiMfp*!anhiH-an&f zK1(>N{}*6|`s4I$j``v#@qoCxl>FOK1*sH| z+edsBSMju%tiaJtrd<4^-^@M zTRSg)*0e+4^y`aIqb%rl>Cc{wazNtUC?K?S$mi(M>p&wYDgkBLqGCDcMX(B`=<$w) znASgE6Ti@VX?aAaA2P==cCDRw(JP!2ZT%}b5>We(vqGLQJJT%V$9C$>-z1Uv-USpC z{oO{EA!q=-%7d)}%r>CbgB@d9A&~H~*k0iD&Gd`?+(P8Z#98w#;LpBSfOkb^j>S<8 zh>UPyR8r&v@O5%JNOmhB+i1 zF+%e75(&ye@4Jh0i)qF|(Jto_sx95pf*6v3=1#xB%F8|2MWk1+G=j!Skkdne^N-L$ zm1UC;&7Vi0kc)p|l1a2}xsju;wf}wk=h)q~FO(`jA(4{8)b={Bheq#$?kTYZn$R-s z*;ljwv0@3F;}e1^rR{`Sz9d#|1KqK^WBe;r;A0{mX9JVl%8>NaSw0IBr=;!rV-JZ< zE7hKt$>jP4I?d-*;L|Gq9%aUjA71rk*f++BmBSUMW=rA8t)jS*3Z7m{qG~q_Oy{Coc3iR9`KAgr zJ-MJvKYn*ok6!IrmfKVwSl4l>Gg z(_h3TR7YKG2TN&k=a9qP$4nuIkkAJJexf27i>Jwb3UdT4XVOO}SLsVZcVy4CP%X_( zEN6sVVs}nVe4550v2m-rRF&el2ssnvQ6nzfKXC2YGTAL!8yyduhehZ(D*6ebKn!@a zQ_~1}GE$mT+Dp|8CD(y3h#v|!`62^~sGl9~VEi-gkil%r1_T|ST9YyBy9F#j`rIe0 z6r+QVl}ITFSxk=YY+ZP9ZT72M`VYn!`=Rj3RNykc{W@~B_TIha zRQk$Ffrgn) z?i=MD80`yaqWq(=>Cm}_;<<$=?VQA0lB;iSyiUKZu-M3CPla;IayWIveuVga6gz_V zGG1~gh(v4BViN;-z?-$28AV@3Ny;Z8M5%d6j!T3Q?;IuX_Eom~Ke4=Ndh{ZQB!t68 zj!~>Rd8bR%tkwPR9{hFI^!u^!JSF1!zc!mQo$emGt4q}z!1gUJ&W1fxlU4PsZX&QSxan&><=JaEMp(^wl4f9E^UALHKzkC&Yg)m(IXv@H@AY*{m5rg% z$YQ{-_FUzoREu~B*yZOBukVmMREeIq+g^WgeXyT%KSozxfywopDuPXGw1KBY{>6yu z9lw0j&UCm|V4!|PnK9GOS2-P=KSCY!#3>05_GJRS_W+N#Hru~`O!MVc#OG;kC?^Ga ze*Rf6J#=f#EXp)uASjl|0(oeHEbKPL)E!*FO;8|iKL3xtqtlydDh$;ygBcqt;qi<+* z_~M+wH`N$!`B^o;K|wcgiF-K*E)E?o-8$tin?GOA zc3yk(u~XA``SU4Z8^*!ymp>6KVUbf)uuy~@;LTxaA*t9R)336nspK}Pc^T1YEVDm3 zdr{qu?pR3;v{I>W<~FgIQfD+r4L2}}`nWLKMF^qJK0>K&@7|iMQ18J=-TG6p6i}?h zx_p!v+UX=tOG865gqe629bBABq?F8W69O_-4-DcIsbXgn!Sh%LY1yT z;A2{yF5|!ulV5#dQha<6Gc*;Fb;GH(l@Gu&u@pX7A}aR$(cYRWtbTv1>fRTNTG?K~ zIls%Ah9$1-$x_5t{eBf!XAb#2r_luBIZyP$1_GA@h^EUO6ybDne!Ljpu*hQ739^=+jON0f6Yo}-sHBUuz9-!!@<4w`j?t}_ApR)z#{>nK>4y8O?F$*h^ z!mg?j_tAe^l{kU6{yV|r&t;zsEx5~ls#};RSb*b0h1@N=Nrb+Ya;}JoSw+;@`L7Bw zKud5`&c);^pKVA_&XRB$B6mItUtfLYA;C=Fg6nOKwipnYZCu)r#p^sAmXVv4To$7d z6HUYkJBNR5C~wWTulm{H&p_6!yi?}E3*FEeTqIZOhb{|@JXSt#)Kx0wENOPj)z5`n zjF~ItW(%3jfpT@0_xq7ri@h&yq$G(l^Y(-I+3I~dGSIO zyd}eGdt(NiRS|><*>Jvcs1+5;_1v?EG?#v5zfWuG;;^Ql>cvvb(pjSrADQXy5jV3) zJIWv1kU)AT_xb4d(Th@|9U(LgBhfNR;um1vrCz&V5w!tkeeq;TT|9fUg`I}$1&@WR zlfg7{f|cw3VK^madc-E*Y1bG)y)Kl+-ZB3)0Zsn)At^%w|As<`LPxOFnaKgt?tWts z7jueR%yi+Sd&Vn>4ui=6oKeN!-~NKPpcOLBZ2Aun*=2=~5xDI~DRBlWJ8JQ7c3fT+i7e`I$ z)l27sfwFe7rlQJ%x1=hJyE}Nt4}wdtmq1!c@3%<c)(^*1|7W&Kyb~Dg-w2A;?3^Zf`;0^U$%sd&GvH>h{i>xQbJY;2=+`S%2%Ipl5 z3GJsXO>B}%(F*IIBP_k^1i1sK&C+rss!>TzmJRnnqImC)SrRw=!WcV1 z;Z$U5oAvHf?<9Q`*?~2&$#eT`=FSW95{0Lg3V~XWb#~oT`zdq3FXQfDZ02xmfGsGu zr;1O?xPOPEbkU=-s>q{Z8pWHhXKTfp_qi|@C|ZGvfT zC6mRUHP`q!#^XfA))x}h^yXy`kui7Uq^o&&0b?Ry07nYGK>2>-9Wp|f11P{viGuwj{@Q1NW()(7~y;9$ci~7mI^;sIDOixTgkz> z8eH%106j92q74x=d78u}%c&#$8C&x)P-QmUQpbdU+JARj*i9F*BuiFqk;5O({p2Hu z8k9DDI_Q{N5*Lju>?MsTG48V)yZe=z7icsEnjOKcUJFnbKbs+;d!UZtK2%$-OO6WV<~v_PAA{K`|ijKV@ae>ihY%Dlos>Z(l*CYpL6R(=^)R=B>Ab zA1(t;-VlG2B8xV&HaP(@$VD#tBLd?=QZZv>Z-o)HTJm8-PaB!%X~d87{Wewtqm>|5=%J~$-fi< z(f@bi!odjvX?4jN{c;CjkOE9NNYi7+2LlpeA8-^9dc5OlGRD!Y zU~}B?lMX((m; z#w1%BBWzOm2#~$8zFLq{5%>l$2?gqwd1DYWv7I$39`oPUz2J<_d)_(+hC7m@k3st$ zm&mgv9)Jx+Tgdg&Kx!8aH6cPK?2=CVF&$0klTFz;PkRA#K16?+OjI$)L|_!G@kp9dpzj?@_E`!LCNCs(>h0dlA6+t6TahPrUyAL>}B_m7#g^xGIc zHAi}azMJYli531@h=TKeZK|etfs(Gl;Wy4@J7F%a^QErcOwfa0Nf)t5yFcvJ`z~Vi zsYr=XAD829D1*a4c;D|pmDBIlv?A@r$Y#YobF-NCyzk>3XB`EEqh|VwU-Hkg`NT@7 z3L=UeQf!4B;>!S9=Q6!+h~;(5Z)H9+Bd#yr1Na_xU-5y>RPUE~ZD?^0AGCC>RN+((+`OfJ440rp73VV|ED6 zB@08U+0C<8mb3G=_qEQmg591*`$yvc=E)~g6USdE$o%MjnQEzz^Ky4{F;J0e@7O(D zcxZW<6nAY%E0wzRQLL_>+=rO^S4Hq+MLQheIZ~)&brGMQg4$KQ21ksbLo*^?aF$!X z##hfwXRJ@LxNe3~*zpuI*Rs>v^QSmifcN+S>kv(|a!3`oL5FW0t<6KVJ!H?hjnmVY zM_f@>#W7u^kQyHDt-R_kc~S{O5gExfvQNc10ar;TXqaNSBM-wT#J&iBrz;$~p}WJK z_KU)rnmTo*4r!=cSbu#;`GdDZ+4HJ%^Grv>$&mHM2@=JS-wg`a)}n==jH^LPJBL9L*MW>Lp)$&Xrc=8|PJ=Z6a6I#(|k+yB1V z+kXpK?m$~&tbFoDO+MkEV?pBszuT-+jbOeU;b8Nt=g>E`)s(zBzWuRm3a)Yyvp;g= zS1R<6L>8g^j!V{y$6{i3%NUoHobPKSi6w)B@CCW$92x(YVL#G){Jlg123A|C!#8Fk}E#NkBJpl&) zvvW!qH{Ycnx3eis?(Y2EyK^!}KtXSwFFRaV6k_pM@THg}0RYG%EUD)9Coss-{Qe&B zg_Bpm_sm-d&mR5Nv%P*cf>$S(gX&j7V^03DE?X#teD0g*ifCu-RK9a&R_VdQI|*0g256qDH69D$Ee!ya4FQXbmzJ59NLI zvSp>u9Vt+(MMF!wwwf6U>QBNE7$O4Q;PW*NkG32tLoq30KmVig_6Y#5?ww9rFtkj) zzFTy&a(FZ)!)e?+KHujo8+^i2ziH>7h)rb_cN-u;9gQWbAh?L#MApg3PBxFvHy{BB z9RwKdkXn;P?lt0kA}_WnF257$4A+XaCK#qzKUOI{fyzEqvEIWQALi*DeP}Oc>n5!m z)bgR6t+rdPvI_m2*MFLVV%h4jG}M}unQNz;Tw0X>-8IoY5W8yb+%-1lHE zZ6v!Rs}P?QHYxj!ovu@_!rTI1*sbER+%d#h$v_woI(w0levc@gs9 z?bMxrWS@1K_|)9JeP^j7=e3KnrA;54ce)efWTSVDH41|sE!G!+Y}c97idAngz|MC5 zamhN2mLS2g*liKt1(BiZlc}=o#V~=s513AE5;=mz4&djRoWsvy*l z(zj{YAw?c7%;QpJX0XpjEf?5*_VVIr4K2{GiGB6yFOkoFCbQPc5+OFErgtLTIVD-4 zy%j^gZFfcTZ06rkczqBHo&nGF+5Fv!6kE?zg6&Cw35!IRxj@>2D&W7PmUcXfVtA2! zpK#u@$y)>zJs$|YK3DAEQ+VP#wZL@ro54G%lmsYC;Fp_}#ND?zH%g7tk#Ug{yYH)J zC3q08cHPtFFb&~N*ng1hhsp~A4QXI;HwVFW?%R~6MN zPI+TG);V7vJPozuVsYi;b3G?ZN71t_RH^Z*GxHJUP>`{4Zo{7#ps2MCeto%5Go=eZ zNp8Z^pOjvn@UTGP@WWPG7_^g=K)D%O4YfJXrsEEtf`f8+pMM+@V(WA;qCK2Ev(IYo zXc`zk2WjEfCa~z@f4qHrTM7Du$v?n7J_vCn_mtmwxs?KNXps^GgFTR`&kObOfkc@H)t0B(VV*5EaPbGrQX z#lj5%G0`W(6uqpVe+ZEHr&AaaYB?v+$reJi0KTcnK%bz6Fky$8q8LWttg2_X#_Dbl zkG9XTgfnw>LYaS7B%>4o=#&DjLl8mgqJMk&$8c zHWFceYebRG3~Io45|_&0cu-Mg8N2heO**NnAYUE6K|8$I5|X@WRD|Ui(LzefY;%!T zzWcj-7{avo$Q7tVY}paj{{XNqaqGx3TQ#x+^_{Srm31p#^evhyQ|~_|43$knwwnvi zs3u|t`lHHR$-5z>38a0`%qedASy>PX*brN1cepbopP_G5hYz<~ZgC4%avxUpaiMEe z^`~4NKe8LUo$cpJX}Q-O818W#+l!M~L)~KyWsmK7$>_-eFVBt%Y7E8f_wXk@(p%uO z4shP)hIMNz1pvV5QBL&R-yJyPN1{eEO4z+YDm(Xre;ArN4>H#CsW=xyO3 zT+E6IfHblf{;AuBe{S}M5i{ZK@8!H!J&z8@P(YC6p4;8Xj#f^xAn2`h5@V352N<7F z_Vf2OeM)!wEfjX1@5GNp&lf(>ySMFWOcEXlqES-T(Xr_G9yogD+D1xDhKB93!7`{A zfFiIXcUW%q4&Q=J5Q%9}B=+A7GVo8eVjer^1DVqSOF`|*q}%LmHqw4?>m7^k3H4wh zZ{kVJ(n9-5$j&a0BQFzlhu3n`OZtfQC3UP8u`#h4KsMW@IiVfor14xztdY-!2UkO6 z1DG6)DazWe>UQ1^h&81zO4%!0@>#}yiR1&=ouN;gS8*D2oW~WrXdj)Y#w1@*=r&Yb z>^;z;$21guoY+s>M2MU@%vmb$TvI&seAhjmS~CK?a6S(~qatECL8N$wPnY^r^EB%% zrTAmGbSsS>u%zhG&Pq{O`AA5#BYY@(4r9w`E)xi&CrThyM@eHZO}ibGF}F(5>K5rF zZ_?@N>icewQrl56O?nk}V!bc_OvSO=R`faicmjW5Jl7>e!a;Bz^8wD1Oj^DVwz83_ zaQ>{2uBfjs*g{qeWO1=WF`5YVvS-Gv(rjeVl@#ZQhaTO8k_0{hy&p>rHdGy(mI3f^ zYVJ(iF`?pffd~24KAfTzyr@06qBawftk)f;d%T2LEqV_p>UXc8D{huJs_Rz{^mJP= zVF`_WGV9XCAk{9N*?YH`%q0$f#nh}A_gqKt?*NnFe$ZU;>8^Sj&?8+sgxKK7VJF!ID#-M6#a!)$si7`M7I=5 zmBCF-hc-<)X*lQf(>zN%^PV^ zCzP>B14vK2ObTCsHN2+yYa4;wdUF;>?34AL4ekVi$$kcHgIwRy|C$OZlry&^Z;YdIHNQ?Z*neX~ls%U<#9FQnUjOLyEvQ7+N181fu# z6G5G~5FySztO8IVPk$~84t8zj11myv)2Ryxi29)wtaxg&#Acc`GO9j~=z{=b`QJ+ir8FJ&$osD%yRda&#vXec;m*NqsZHBBdor z3Q@vMM+P5;V{XbWCB9)5xq&((f)BK|;D`D8c|2T%Kw?DZ>(r1IR033n?x92Kx` zPL^2t#?b#TO2Ct8+bMH;4~3lX|u zxpWdSn&vUapxCb*fnSRSZL^JuV<8{LLW~0ft&q=qrC&sr26)#|AUd`$#vT%X?7krn z9xD#T4OImCQBzm%e|)0?pxG!ajl5MFTMRs#q0-ZRGweP#UX|M~6yMUy4lvm8cOKQX z%3b7Bv{=hfb$MsO*b~X>af$b+Xw505xEpEC!L2uFqOC?5F=&FmsCMoc zl|Prf_LCw;X*Bvwl)Ze==l2`hgPT33D$rB+ZNOyY_N3Nfku|K@MR?)W?}L)rrt!|> z?WS*xd`;x9_*fJK;vI)53dj;z84`Nk;p4$65E9Yv@z+PkM*;)i-AgiWskle;db}yk zXZ}^+XOjDes+PY3&xc;=B#}tW^f~Xk(X3vqmtJrP+(QJFU283o5F?tosc)_GdI?c6 zp}b*qR3D!d9jLWA1PKW6raP>&{H2T-IBq>{rVG`%z37^dZ!#_uOyUG08owJv{kZxe zJR>L6!uoUg_2W7zZR(ZR+q%ufeYSIdn;n62(7W4pU_HI^o9OtKxQA{_a|^A~5(wfl zzfvxF+c$Hz4k>1zO~^unPRnGzM3RxA!m1-a$-WFKz5$iMA3IHvGAkl2#xgpc_mXs5 zxDfVGlcy=MoNnIp7zQcxRs||>X}?FOfTrK2E5vUpTOYZ*!$}T9>8_a-(xI};NW%Lm0GS&nzjcR1OM(|XJ(5A)c5srf zrFTL1#}DrNA-iPr+tc%4T-|6f*E6dx8ui82O#+FYW;a&iOyQx2TFKV6%RkWXqN{>C zz26-AbZ>zTg-cl{Q+>`WAF5Y(q9eL(<)Dk};5;f`_qrRqF26X8wS4nIUt#?( zVk?Ctl;r8X)}>oy2(b&lVir!nZ8sV;zJ-s|lk8e)aNwKj_n(5EFj9UG4*0HHYY7Oc zHiE-DwqA3RC$2&E;NCQrY^E(C#UdqqV!}Fa7F^-aGAdwvPmMXT;=WWTUVtYrS+ zd$~UPHz`7NR(lyrF^n+*Zhhf*-Z_cMc-VNajkj2qC;CX?$G5b$?*zyiV^Z#;G$*Rr z-(YunS9{PoZ69`eSaA7_B=nk{`&Ks`p8lr`g*TO{53 z`Y!XwHx%t3N}|!5gvD58B2Dv1Y@40`vMc3%%hQymwf)ns;$|qoIKJHt>oKr?RC<9tG#JhEw32IQ~Ys~ zn<>$b!Dd+C@Ld;=g5$YvJ?H*4k}G=B{RC@_h2M%3q#@Gkk@AZhD5 zTaDW%fpB@$Sd5olB^k7nZ$YtW+G&mX*zjd9t%Wl6tHB(3w}ON#^w;*InL#MU zOs-S;m&{itzZ3;_4}K@r;>YC3WUF5OXa6Cpe?~L(d|XSx%(U2e`X$E)!X?>+zh=E= zB~@~|QQ0C`p0O7n>X!T;iO1pNPfim;C*%7)*oU^?R!X9C(w3{_A1_a>ym*;jqhI;z z=heGU6xC&)7Xxt|QuV@xA29|N`xHeuk_Xzq84e%B&sRm%|2>Lw>!rwok$>yy7}-D0 zLIxujEVy6m{%$rt?58E}j)?ZYvicKEKkMZs(Va>VeyFm;7ISk9ap#kS`~4eh*dfO* zslyjwbeVip`9<5ovtNgdnfy3D-rr+a$T^XP40HKvy_)6;=-Ki#3~sgj-@oC=)%u5x z*c8Klfg<-WSWMJF(=pDi*~{53bDm#MHCCRD)47awM`qrdoJv;lOWsv+_TT1~=Llj8 zSN%P^ayBNnR??nTg@iayskSBjs5i2My#1oA@#$yi7$dcaX)@^X`4__;YJ6*WV#@Hd zixkwIcdSMo;vOMkTfD!ol0!?5pKwHr+Qui3_;}4_iJ--kp8t%{aj=*Blz9~*MA#oy zgzI0_<&?aGMcyeXsFS}uGC6y(tDIe|)nUnR`R(adIs<(5S(#BIQ868TK2;;{y6>6Z zDn~m*E8^P3EAo`+fp8xtgZLfn6w)ByR$uS6tX?TbP+MdKE&r1DDw27XP5JtaR#Zgp zFXp1n>PsERxtlIbd=~6uKXaQ(ot-EK3)^)bOL+oe0!$PW+_DzU&DQJj&luii70^x~QSGi5#rhAiK&Yww! zeL7Q5aE$9}Re}{`jNUWqRGMn@CT0~--j==cd+0pRk~if7g`6O5YC6+q`iJ}@4eNXk zetpo49Cw%si6AahUioVmS1Eu=4;T8ueSL8>=G<>+i=lxfO0ZLYVZ(Wdb><$)RrvfA zH%sCcJ#uW>oE0K}GTEoj+mR6PQ9UR_si@{4j=D`H*@V`81JP<;bRs-W<>69w{~H>6 z(-H6t)2S(;P(sCXSNHLFRrXTjE0O=oAc^M$r|CAmTaHCzZq-zWC~wgIXRqNE+TATKMDlUcH@jv`910pH5oG1n zM?YB5+OL#+sH`$JtsC3SiyB7cEQ9=Jt|Ea~xv~ifZ%A`cjn4@QcDQUFtyOq(Wc0ol zQv5d~OKI}4mLaSoYNfDJvXY9Z8Cr4L%x~y)V04YhPe@grLRIR^ju@rwls{B>ylQ=( z`S>OKW9`pVA_8ypM}1Oc?2kB{bu1^8fx|6(Vx2(b*E{v3MD*Wzpg1wF5piTT6Yltr zd1ZrGj_%%?gV9@6=z%3!I&2@HJ;>a+R`^H6;j*1&-J`aIz;9T0tw{1O)_6u6^k%6o zW3A9OnKj+}!+nQ=#-FY;kP`V_2On=$x%}PcnBKdGl2hoZ+Mg1ECY~%3_g{WL*n{DJ zcPOY8%FM?+sC7n12S(?rGNVaYd?} z;%1tZEN4#=KAxk70%;AI*=;Z~&OGmI>V*iGtZ0b!A*4Kg z^2{#dNMu-qyY2^*W9jgp6oPMFg-lmCf<0pTB)K~pn1FQ*`8--~jlvdG<&DiN_`d@b zd5_&prz&yOdgzk+ga0zi-sfbu{qz~Dl}|WTlL|+~R?MDUWpT}+$M4-aI|Po2FfNU) z!gqhg25X;9imZjsA|keE*q_6g*lE&F`>GVwJiD5FQ-S#K!nKr1hQbLrypJX^_;LqU zXnAqQa(NyhG`(MW=YLt^qgYuP<*E%apG$=8k%&EF zCvT97^c~M#O?q!NcVWwC8u$(6(}VJT#{-)b`7?2kCvw$<=M4AfV3RQ&Su`-)?gsTZ zo4rJlSuq4D(0To4_R*{hou1pzT;+ouTDd|AO97Av;QlMeDutQK!S?&cSPdJs2loPE z4&;S+1@5{Gy{1(tWdum_;|B$vi-ipI>><|i-=J&A?wKLsD(dQ)gsJ&4JC`0x z_W|}F)w^Hk04|K7tlpB?d0L~Dez_M6dyn%T=gGs5Terr=UN#QK$RCgF7O|d*jefh%E3@X;w!GnlVShQD_N>!z^{KmfpzoS0u!NJCvzDhc zsC&0%d(TlE@-&tD?p=Ku*@f?i3|~(Z(w$-9Ybs0KtPrNO;mRcVv;8=!dRUf$VFu?j zTzJe~yE{V(-93DAw(1IxDqM#bRcE%&0g0{^rx*oOHFj)i8Dl#A5d)|@*{JDNJpM5e zyybiJBpP3^tKPW-z)ueF{}}9EL<>gKE=?D6id0hWmT?UK)|`Czx%(*J{k-5#XO|iG z{XJUv@IlfKuwb8w)BB}1v$Ngc0a2?_#hA_Z1I31k~1ZroMD5r;TK4Z8XWZQUlh-q?m@KP{4 zIG#T$;j&#ByC1|w&wM<;T*YDrg43ChC`dw00Vg%Mnj?jM2C(U${<0q*WV4 zE{c*0t$K>8$}dy*PDT~#c?FQ5qdK>YnI6w`QeAWQ!B@39T_Y5`MA6~2ouylSXIZM2 zS#r~ra0le|oyH=O{}FZ70a0#GTM;CsI|X)WkZzDzx@+m~?hfg0Sh~BVJEXfCM5G%< zN=m=IaPRLs{L8-QymMyeojEh-c^<#{T5uz%);?hAKk=A)@|*>qUDZ=>s%fH;{=GDx z3-bHhZ^cJ1VDIzCx7wNiF{gC4EB8tG{=|GE>fE;!Yi@eF=Q83d@Ka|zQ->MZ#^2K< zy5-R^%weCOoi@E54^gCw7S0xy5Yk6@vV327^~2fQ9-M6N{kpN@iQT4I!knA6>3O1$ z9trnqk2}NJ)k`%8-%(77@$FCS`2=6RQVgMkCy)M#fVqhAI>xT?mfD)L=}Tim)8b{1 z-|+*44Ib14_ueV#DI z5@k5ffqx{5>=V=LS6>)BCo}(KbDr@>3>f5@w7tg%#rX#cKN5Q{!%EXeY{JtK)mYJo zTG}`thfq=tc3$E_A{aDD661%}Ueh)rXABPhzFDn}ZLo!;S>}P`Wzfv+@rL`#&gLe~ zFo&m~;|~9Bsgtsagwm9_x%gD!QlMxvShd~FmM(T)bZm=9S$T{Jv)U!uWvp=?T>Yq_ z6+r8Ut2Inf#`MY`lRNxL3QZtspQJ|JX*?Xxm0mx+7e45`#^CdDrBHA?G7TPrT6BQ5C&M) z#cI>@Z3xcmSJshpnLDmdnp1t`^IwfdYtJK63CYiRm5&5&LY>T@D67TSz2BBf2$GSf zC@3xPhPi@9=2Ljy)zb+J4c*4Ar4Nn?RuX-DnyCM9SI?Trklr;nUC#Ysa9B~g!7A?V zSpu&b2BUcrEM<|@JhzL^o-QEXAs3&;M+=Kd>YZBY`?tB-TIyydV9kt|4>quuh-qFf z{hma07AR8>HzQWrODA1epOo3K@9PQ&WIV^2wWQFybc?0J`Jd~WZWXXNO_n~lTm9O% z-t?mN%&J&E2>LFgGg9P+z)&PR)g7_Xzuj!eU9LBl8`j=1L5MTRU!4EEG7We9nkOkq zDZzegO@ALc`l*lul>})|P3%2c^}F`Ef;lw~*KEA@N&Fhytme^Qw)IONYVoO6@c5HI zOr+@-*23lPHV=!g>|-pY4x0U&dzpn)0`{HX_}X;_GmNEL%cAJ?5ZA&TP9v4QfKwV& z&xpH)6l@D6p%}b~$A4dzTwE;K1J_c&gT<9qCPrIbM`-pjx@uf%bH9qFMmll=kW%B0 zGd``()=HYkE|6`?T3GG*ipnp+SPMuCKt$|%j_&i2Vdcg|xSQ|<4N+YO|7MiZp6?C$ z_>Hvh0nfr}&Sm8`a)Mdcf>T!4;mSMgKGaBjT)t&97Pm5%pz3mRRRGC(r?MEs(R2~V zxT@*O@(PNp6{aQ`3nGq0PDjTpA@hJaPM(D?^cSDydeC<0Kv_OHJ3^;I8$wR#4a=bf zw%TcP{$VQjal=nsvxh3manxgxKrQm%Z7|v(H!oHHMLdXx7Nxz;?)fRNW>V5isdK_! zU7u@cYoU|f3FCi^6GN{itqn|(v%3gL~^j_@hWOUlVB4!}7h4g}v<*mBwK2$?>5Op5N9C|Ob*mP*Do=df3& z&zU`rIj)8=Tj=Qzsj42!*VqzQD&&`4xF-?IPOpm&{F^oUGv`n&N;9LL07-!sgq}_F3qB>$;8f?*lnbFk&PU!J&K>(9rVvbq#zIrj7XQn_gc!b?E6^ zixq#1HsM1rd0o~2rnuqUjo${CqI=6yy(gV%5;ksIsTDZ!DV{&X3H^z$L?{-rCQz_z zq-bh7bnNNsNWa0nCawO1^ckk*)!|!f6mbgbePdP|7DC4iLo0uqT3$0wX5 zOj_EG!MdxbO0?PQ2MXwc-wS|;|FwLjiKa?H577K1 zI!S)Nq*RtaaQRdLZ5imhx!e5O6!GH7A(={!+kzL1=v_wA#KY{v=SKYH$*5u2E>Z*1 zzi`4ykpTrN%qDo94k2L5K~qmdq74T3nOi$<(DE6wg=b?K%yAIUFS+N$T_e>anCA+} z+2XioHP^zR(H)zA;_qrZw$XjuIsWLj#2J^I#GO`xBmt?P6Hm7!axPrnFAyEDRxJds zwJS2|Q7GezahE7v`MI`+prX3Zi7i*n?Rme^(jT+Aiv)Z9aQFdM*QXzo zv6?AfBf;^NKt~9ip^2tu%k{_S8o;Ey7u^Vw!}|mDeZ=HpUy;~rgvhJ##8q|33fu1qZtEaU3Uw~)TdK) zMn?Mx23q0<)<_p@jN4?G63Ksd)E||la_-=ya6n;op^q04!lXeS9n*dzt!FnKy-p{{ ztIgWqrXH971};iEDJ}B&`^EjB`gQJZrrihe)H7{eAL)|MKUkf%fa#s6s0U4de8Oc9 zeU7gOfBgRIkbnx8c_>~7>Hc&^%3E6>K`{wr&5KsMkZ8_#AeJFNdO2V`4B;-~RuX4` z(NNpKxz-!HzL=P%;<(LNWO7tft#{SFe@BGBPkjaKS=rWTSRA=`Iyq*m{boHeuqs2f z+6^;zuAk4FBjdzYZNrn%eK{}SvU5zOg$iH9itDW8rN#w}#z}7Fd)D1FR$a+(+kw^s z`c#z`8yXQbr_PoF<>lr>E3xV!`X$o~K8PBJ-lL@-%)N3N%&48-K8SVd*I@3vKe(Ap zEcIKh^zsiVg;PQSg{YJ$4>*Inlu^FPUW8fTpQnG3wMb}dM%JlZSTBRtp2FO(TsC0t zIbUD=mOG$1Iq)%T$ct@^GOCq(Hx6+46OSfeZ0LE>e#i@LAKPo2!0JqFJ z@Z<^87`+p#B`kDDM0#%06(al6(9J_2HmLTcrn1#e@ObT7Zo{i{X+}y`$}<;=>D!v# zxoP;AZ1QKDeZUE1 z(3ZymT<7YkeH3x23a>qndf-1_XPu`mKMN&?pMiJLK(TCerPggSPe&C;LOOVlN>L10 zlQwJ=kPk`KX{@6a(=^O0dDa-0sLuu8Nx2v&N`E(9Sj1I%CNoxUoZkJ(rlYG-`_9Ip z!4Mbmb90)o^Zo$WOuMJ;TVFSNQ(VmG^(c)+LLy82&LPH-W_PHzB^i{B?WTIpqci?q zs2-C|vJZ+N;zPV645@$f`NKa``P&`QtM-BsI;E8^Abi(PHu_>>(~FSaJSgP8*JXMp zAJXzrnl143N~}^?XsgeRx0b(P52rbkf#$YmWsttDEM!7=z>s*8BERxw<>FMV-JR*- zZ!{6Q8O6LDpJ3(#k@-W9J&AR9DOvIsL&Vm6J+OV-^K`nCxA6f;(oW4yDa7%Toju#O ziZ9sCU#ez9D_=xqizXpxP(<@qk4WSNbvvb^7F|rF~3X4uxK% zG!7GdJu>=Vqdb_cFzirbakBJb5vjsO)3rK*ytA+&7X#N23w}j838|kxLgMA*81N+s zfsrrg&HGVPMyi~NFoxBDkCY-f9+>g?VeHY#gF)Wz^B8=%7Q?aroc5@egTc0jSn9~^AH|~i(_Mp>mavF)Bd1Y*=W1;e;e!b*G z6Q7nc>%kiTt;<{q<s*m+&f&>>dfiJeXB^q!BMxEw$C2A)Q4*ofzyCrK@ng5B+4A z&rh3xFOH0qp<~CZKUYRQGq>cpNL%BYbj-ZCYDY3-!%(EbwfK@7Mr_ZTSLa1A2d>LK zcRjIfwBDR_8SE9q+@YixG)WL?!#rZI9FW(`#}~)NNl!LPU?(j6L;cV5g{XJG-l%9! ztH@R*(U)$yCX;P0Ln%aTtD-7O7r!5g`l>s5W&noR%->tR0`SS0%o5h zcA>h)MW628eZkI+G45&thK?-s-k}TYf{B>vTgxrlVl^H%(%Y&|rCO zBHKRpFl^9^6}GI{sYWe4Rayt+hB>$W`054*x@qlh*dUL0_ANF0a0oX$`@ZtcHq9d& zf9*M~-m>J93ACUxhRZkNm)rRB@O@ryxY%NQo|qmG#60zis*saz0Tiv)zAgOTg2jt0 z`gVT9&YOXRZ$*@E0F!ZSj zL303lQwYU%(6X%{13kTO_^y11UroDOx8XehB-PuYgdyv3QHo5vm&XqDw?^6X-kMm7)zlRmb<4FJ@Y(Mn#wLHZ+hHKS>8lxF|^&h#&iP(5-Hs_ z)R2=Muq1;byU$;qYV?bz!xfG^CfPK^V*c2${n|0}aG?-ji+Vf1RCXqE^}W+@i~{S$ zKn`IT6DKA2PgR!AxZZk;K~XK-@eSafJ<_;f%M z{OnY@E#dZY+t_@@USTclLW|5IAraB%^&Q5rw#m1K$*qWzSm3bDPGTQ55f%s z5{B0)yGT-Gk^ZBWd1yw6lN4xPyx(qp3qNUv!ZrxXE@lbqwnp>Jcp07jK3ild&o>fO zwwIWCgsA4|BZdytU1maUh(zJ5)cSy+7J@jtqGil5?7t9>WJn1#KN%`a`=QJfXoJ>H zz2?{-=@hKzbOzyCfJDhD#X=M%UhXHstMYCRcx~hI zenf2C9D!Zx9G>&Qo(sFivax4-eO)L!QWcj`N58b;l6OhGGGuKjb3&CQ!SCs{YVK}g zq>m_;cU*$ z&DV}<7LV^hK+KpW+?=TkN^n%psS#DL5_s8pWA>`WFI& z6^&%|3ish;#}gbJDZw25OSuS}kJACt@<35|^OqGK5(r1l&d7GZT21xQcS3ro z{36C$<#fn3Gw*!Iyq);7{&=kC&{acGfKKs_yG;pJGpa=Z_yqy-DujlH9L(bvo8_A^ z(9C|8OI<5x;H@i>`QA$%u6QzbXzi=G%Ol(8Kb>BqT0TWp(W!?wrNnam4iV2w5>hyv zs6utBwk9gI9CWd!bb|~oTPYo_^P8|%|BmOBUg#XIRaM@b!m%Y%k?i$Im;crVX=Z$} zNexk1nF|YPqHH5cY^p*F#_^9=MfA3xbN?i|-0P{qI>z=fd-Pn5(#!o#iGr&?BH8C2 zg%3sE9he-KbtdLQvzQ2@##cfoEi!hud;Utjn&BuBYH>6Q98XTB8~rA`Pb_;}9PIe? z?#Ns$%^ny+Q@x$G^xhKJcqi&?fSsicZVnS~H{W&?q@;8rMYo{9S${mlaU?NY64dB? zLiOU#NhqCH%a97P8gJ@Glj^}+M-muTT4XaBUCrAV9o~b(mXasICBirJIrEQSJAeOn zB|C|Zkt(=K++z$nOw>@N`;XagiO)0LnUwAOFC<7oVmsOFRiI7DU?U{C1ZlV`mS-7^ zvBlhuu3@N2^(@ueX6F7^MX_FGdF4ilDZPi9b+ebS_mf&+`F+bX6`m9zm|&B^7G=0h zvJPE;!3p&Iqr5k~@$i`=ZkIH3T#%S9-JX59{3EuvW~7XiMwp2D8?p80deZaFjY&pA z`QZXEgQ2pU&qQd zKR7-US4P{{y`y^nyiDdW7Y2HHBdy(qT}6GFi5ae-)kk`&)qz)+i52aSt#VA5i?L;V z@C;FzX-3H#n0Nrug(P#riz+de^i1B}~m< zy!qc$CZ;DV@?~|vPW?@}mb0|RlZ#508GBZGw5Ot*N8f1N@2JJ`f=i#*;1XtIeSfGl zrHc$DkLMssR^%_M{t(ed)zee#UCFUf(am~33C5N>c^Y~46tZ|Eq48q|B^barXMcwsO~9a+Tb)A|&Y0^qH9m-xv;uxdywp^^W+zO1U>2nodU5uRV+!Ul*OAf^6;jyBiEss{GnOaJ zLg8__8!3+zA#GMDOFY$MeP4eZ%^x5yvd@*~H#6c(g!D9x(2mPm&C4h9^l z48_^FcC?VvOcfC6o|!woT*Z%ms+lwuADUl0qISynest>2E{o7DU;l>ZneILbJxL5% zbD!=U?yPFMdzK_8Qe7-LUxbn+W&csPwHT_))P2+JQU4n2c$CS~nVdZ2baMEawuYq$mM+m;@ez-VW_MZIM?uz`6{Jddkc0wrliCaTeS1@3Zy8I@#&6 zCEd}_L@LrpMUKbb4YeUuR-G#MhiGjPkYo-=)Fw{!?kuD*4D}pmON12nIR#XaDzVi6Y6s_c*JYZhBd% zwrt{2-ZyUeOS8SMiM+*nw^f#wI-|+?^Zsk7n?S)Foio0zSS-)6S!g+Zn)eLVMS*t0 zsi0l=^Pg%LdY19-za0HkeRSyqHdNh;U-})%DW#XbUy4J66w4UI{${B@-)7Q>EV zQS^P5M|&?7;}C}`0FHvj=bK4q$?qkx3)@Yc{(88^{7H=vR=R6lE0qdYsVxvrbLFQP zlx0UGBZ%45W!7;N&t>sdYJ7OmF zkIWM5qhi)Bg^M(i4vr5W%-!G5P>X9Zf#aN)HsGie3q&q@$bk@5lgH;U^p#6c@&+wE zRlDRZAO%PS>e1^oS&}1xXp+;BRu5e_Vsg|GUx@J|703v^ZA2%OexCK!Ax6)sj+`BM zS{py~&S7x9fK`F73j>1!Plv*2UGfgDN+y>IEnSLCI0z60!tX+b`xh6W+mcfLV54)1 ztxH1{^zBCVm;adYuoyuj9aXcRNGW#?e~~Onw*@n)#NSw26!BmOuYUyRZ&xd&Hdm&M zc6?B3oh7sIKLwNfl zqoaH*)Zu{Jjj_g){A95okz-yG3!Mrdr)gDg)c*U(_yPGru-9HS!5mXl31&ZBiqwd@1t+p*Sf25yDb#O}M9V4ZEUSy%Vx zx#QmuN-SaXpf~dS7d$J|4A6J9@S?S$F5}SGif*|5CewH6gZ88JjT~i$9`>afm9=&d zyQEP-QGCKRAYA@;{M-Dz_g-XgD{Un5AqJ8iq3eg{^gmOdwM_%r#B?c(x!Snb_F^li zzz$;bwMEHbrS+SX#F>x#=P9ji=P&KCpJ=V^wLGt^)k7qCb>zmfWu&b;kv?G($kIfs zCI(n>6*!=Gq4A{o3BiYnt}$}WyW8{1IuS&^WS)2?+wzG-7lHJ1rCfU_XK<#D<8w5O zH6KT(8Eqpf6Wf`XShj2GE84oLd@JrJn?5T*3clkwd^4ExbS1jv_#Mry;YX~g+=`CQ zIB$h60Fo?(gd9F`w)=ptc61+(+D)Y-Vh+YLUTmj=R)ub@-TZEDn7=7i6uHU1HPDOGm&qPiB1ap9h#QB&XU*#^>1S!_1sc(v8Dy7Zqj~E)OVuHt|Qd4fXj7(S%p+%gp z(&|ibF0<$TF4w(ky!;vfLIgr+21jevhM(R3`gwi+HQ{?ZSujQzsZUuCv`sTbb@xqh zU#M|$o2V+x^a@hAio^z&pR7nN>cMJAG$_!sD-4&_UogI0%F1>cF@l6li3mX32<$Wi z=I~@l{99I#>9fVXV&>AofvjptJWi-ro6%uBJ`Hg-1dsOp)-83NnkEhgK@YA)SYngo z4ud4`6w@O^RHq+8CFX%)aK6^de(je0(QEH4xlt@s7P!Nc)5?h8tlpR3Kl?!cKj`O5 zKc|dM_C{9bjKHP2#*8K9RTr7kLE?9FmRUHQWr?LLc>euw>1 zNaDLXC-OTh6bfK)WpS|8Ja>J@Y1}toYj>fK-#&%ANvx}{dSN<^4lA0%7-NmW#F4lX zoMW5^rfzqhL3FW{X1#nL(B>AN zn?r8Ps9u%JfChXwggh%M9yvyHZ&QVxnE7`7u%iQYM&X8Gw!3W0g1ac>y_W;OG))24 zG#;z|cD}M|pkx5XoE*zbhjN41aL)v#?#5#do0zHb#_X+<@*Eb^B}Bq_9HEjpNODy} z3xDRF5u2~^GSbuT7b;$SO`kr)qF@vgmwHMd@VIB>sZRqhbxR{=l*wR6?cYQtK4GPC zgt`Ie$kyDvj&vxtF&XpXN;_IzJhFb5WmVQD!o_WvWT) zvkWOlSxu*}FS04H-h=Vo+wXT-4IpO>)27jQPl)1ik{0R&3X-Hupa2jAN7PdoFMpPl z($ow+dFE#l+AM>?WgJjSh)7_vJA0E06K~2w-R+E0Nq9duV9v-Vv_NHnC%RpKUJ@y` zs*%L9asOM{E08CaCK`voxk!f*?}(m@q#&1=aK>@U%Xzqql~11bnNRh07OT?OWq#TQuUj=Wd@PX2lPEnmz=*y^9|Jdu8~oW;8~iBXb> z6Ix}1VqsbvQj!Dr-1fhreZ||dG>%pSvi!#?T(P9IP}fIDg_p_^}X9oybyZS z%3MHXuUAq{|KdBA@aZI!spgmO7e*(T1PWx0#pj1*npjWWg;pW@$95G`0&e?q$Q%mOM`S3N3fEVp8(LYI#t&6 z;*GDw$4~Ero1PxGAo7|YWggyk^yqQk6j^3)+L2S*8t2i4hq6nv@8#pqXvA8&w&K&$ z@*QS!k(N}V!8J03v1_19^BAJ>GHv6R11|=NhTurV5<@k_Qy|6tiFV&e=Kj1PuZ}Hb zc}eqK0xO7ftL=>ns^2H=7tEAM33RX2C)&@72(`GnGT44rrfEs*$Sd1Llk_9mkFC^s zLy+5wdqK03yk606g8b1NuPk5Bh#amrDmW-z{^> zb|z(IFs1dV!TX)#7>X(C-a1+e*_tI)DMU(ONOEGm^$)r;f%le{9L!GgFE-z70-#U# zWgGoz+LLbEH7d7wFWf|&HBLw$*q2qjvlI)SFEum}XfX5fy&qXxoc>+!VzbE;tV}k< zj-;`NkQ@RMPe~3!e$#HbC3%0W=6yI;EDS9t=f!Wdss8LN3Mso5Nh{OPsnZ)WzIY^u zpZ+Yp*7C8w=#*^sm`3qhl{*1{?4^;zU(fS^F3djo!2GO2QcrxRg^5>=CA z5I&lu>Fu@_b)f;)2K!fW{jLjU-S$q%jhJnqL0P@`yTYxo1Xebae(7I|n&g0GX+(%2 z^drLXfEL>5t}hv;IZ7Z!7}Ioz0e*>)W(4l$h?yF}s-WJ#HIoJl^m3^2RgHC;M(PaC zoDoV9EzTxmB1I0-mcp?VKx3f?Joh>G+vvmXClLIunc9fs`)#aI4z*CaJ%?>9nj}Y& z>%gIeM5n{}A_1kpqG8ZOZj{35p#jfcZc~&e2iCGh@moQmcI6-b?x&|DmdW8aS~93zHWg%OS4Q zfSz0)!fKi1DZTC{!zX5{rM#0R22B3prXn}t8eMN&a7r!{7{#!-pNWNMzT29(C?_#r zEEDCj)%0Kyw}MMc@cLb7ATD=@x)2>s9bF17_o3c^ybJ%w(qBlF#U_Bm@4b?}Jnt=C zUGu8w4Nbh19BCcyo;}4O{8la$)UBk-atp_OLvcxmZEIf6eP%IZF3hyd7MJy$G+eD9 zgwf^cnCkxiU6{qP15x$cH>Ls@!bJlP3CTi>jzx6_>UDrmZYHJ}Hmru$(v6OHijweX z(Uzu~GYPo`=+9=B}B~4m`B>~OxtLmzWfC5b9k-6p7NzTNS>b<)ifv2YOwPdEs^+*8tS{_|SkGK4bL{*`&N3grva@ zo)@2XFlPS*C882XR?+Tw_$aTt{4y=~9YA=NuPh!l&!T9`Ss&IYWUYy)puU!`1HyWh zQ6{{;=0<^-Frwb2$>!opKJY;5lrRMKMW!Y{!Wqa5Lkf>NI#Lc3A^xbS%>%u^wlqkV zUw3>eZ%s~nUsv=K-v*44<>n#la>zUzAgQFONh0nQSLB$5EW1YuCg^>hS_m!K1OoX3 zhPW->TMfxawQ*(USM(H1=QUUp(U}8eRW2tch%{NZxo=idSXHIPi}+FAHe%9JrGB<6 zB>UPb@-P%NyGjTelPt;t+2V1(V;Q7Y9G-}mKF7HxJ5e0~RgNbl)_+PzCDV%$OmTeG z1-1tMgX0e!dFBJja5bLpw9dMlq3WtG9&h=Ci}MMG3f<=nZXAn(qg4g4m)?sT1)w^1 zCFe5EUpw(t!)B_z;`jD-RFbGMtC&ZxbRGI*bg?WnR7blbNzdb>F_$lzk5qE-$FeK= zeVs`iIJ5Oz@5Re(GA0*IS)F$DzM~uroozJq(0X+fm8`amHJkoMcSMH7JV#p%PlsT! z?F={m-0Qk@rVh`D8m$BuW(|WgfIJ_uCD6FH_fl9{N)R!}d;_qc*&R%1)hO*^L0ex@ zg`)b(x1i?`u7nTYoEg`8;rgXMnAYgJ_iK=YiccZClixW?T6gh=2~yx$eOJIh$O?`T zVaWs5Np=KPUu~SA&E^XinV?7xCZa?btB4@Ik!K{P@ddbUZSU$z3vWp*P|umAqz*N@ zq(QMfiB^PoQi0@uM`O{SH!;omcz3T!R&A~_->z1V<+i#JJQjVcKO#hnRwWxvVY>a( zfXMeD!`DUNEYFlh6=_hUXoLYkg#ignOKj{U9AeT> z#wVE6l`~QWWx2gDmQIl0!R#|t!Qc6nx%*U~%dWd3C*aK)9|@2)|24*}#l#q>qZm78 zSpj*ghu5rh$$E2xV_enNKRffC7@-H z+CET~VslTiu7j;0LwY&8x(cRMZ%%FtmRMp)aTZNM^G><6-LYP6h)66(obwr)`*T>- z?zLB_f4uaek}t`2lCA+PadLn)EUz0tjFoE0k8V?9uix>}>zj0?u+D)=Jm@AaXhja% zRr9_GB!#%`MavqIuTbyH$mk5`RiK1l78pkd`iSnRWps7{FZz-%#UYf2yC-T~ zFmfEd{QgA8AcltZQjNf31fydj02NbeYV1%u+%Ko5WZjqDr^+kNb5>V3pnqN7#rKVgwTWkfcWU{y~{)FPsZG>kN(o0CAt>}vjQe+Bse9lWu!1vY;XHgGWvd0g~D9x2{@ z#dFKbxOAuYZ1aqhI5`nuc)-VQp=_L)e3c79+u9{&|)lJwdGv4gf^(Wyg zw1)>Lk4zcu$EtfGK?t2y#aV5JJ~S8AUIQo+l|K(A=4k9yMKih9jZQE(D0%!hpm;eT z&tGCjF5-IbhBT8~G`1L!kb&ApUMW7jIjf$<@F{&fiIRm8JD6xVkm_4{Oj$B=Y3hMv8B0m^yLYDXvVKckY z&Sgz`PTn({3Xep_8D*uYmt!D=;zo9XxnL{}^$jQhK%df;R#k+>N5MrT=(gH=)Z72>C^SwhPn+&=C9I5j}R(fz9W70^N;MAwT{+?i*RE8~Ww&Y=cQqQC}Hk4mPEL!i4 z0f{jDIOg|0y*n9pHq%+sKXGg-eTSCxzd;}F3H*wRY#Ehsjkhh=lx4vuZdz(Lu(9yJ;k z`kM-y@8fA+tsbNeu*O`bvCJArIZfoSEj0%6se7Z*m`5nth|wDUK=1H(6(xy75a|OX zC4W1Yesw~&!AaA^@e~Py&EvPcihz`;vMhu76zBd7dV6Q>)Uu4*tgh_?3W)}61{2{* z*mjMf1V_6@@{4zwg;83z2ogT3(iw>ZoIgRu>D|8-@|>CUdD*?89T=E}bE%>oCw zNKFx>Gj{O*+auC!A>Mbv(x2$LVzSk+=_~nBe@UNm9w=!FjFc}d1_I7Bw_^30Sm?%m zyBD#X3r!M-%B|i}-E^^>1GSrbT>rS^5+$|n4QRbWcDAR{KrD!|EsJJP<9?OCP%$ofi7Cq;OGxH~ zk~V9irV=1tuw}AJ29VYrV9PBkZGiix*oj{NulNUIj#CI5Nt-7dVSANt2Yy{w;!H8WG0gj8Dx-G(9JzQ5A(ZoVH?*)w3qXwxoH}Hhv=c&w^7(s&}{+WJ~Hh)g57y@1g`sL&muV&CrKiw3LHKM4VryGXID={Q* zS1!gb#)?1Ue_9^V+c|H}@4efU(tFiVd}E7tss7C=5!M`Ek;Er->b^jgFe4{hps9EL&a#LhPWDNbfC%-Mw|X!NfVRuK+eEetNtn3^?=oR5Fi4^ z^o|J_(+z0qo^XM`{MTB4YOt_JBwC5LZ!T#7+wz%nAA2+;N@6Dp=Y(w5%4$0eHb*rQ zudck#;afZkOjOJ#Rm{X~%=qHUKa74?lT<`tAEN_-dW_SHX6qTVsf9y3TO)`k-M;Js zIUk@Ol@;4)bK^P|I&y8R(^G~q)7SI+%nfM@s;BAy+ihvlCau~1uRdn&ogpj%W(2O? zI|sQdKHZleM5CcBk2@LyEP%ad#aGgMMTb{8hp%G~vjd4yVgV=4U}EKb)`K}YJ9?9v zv+|$M-qCymq0&^Y)Y`YBPxJHp%k7?YHdvZ<7^(SgVzzDE@vBT4Xk}J{GtLWA^**Am zs)({I@jJUj@{Z_X9@6zjh6srfT zJ5AOIE<8L(LJ^xaqiWmM$SCf*-GMg$)k|1TIY$FOGbY3O4Q=p$s+>YH{{Dd1 zJ|o1Su0}s9VV+MgZfv^>l{!wkdmaoaPR2u5;;|LQbLk3%f$#2+Qc5%<6UmHRX$x*c zq{x@cigeP%$+{lE#4@d-e{}i1uAx=N10P$Yq0VBjbn&mgd4Rv0AT*>w%J}DvLA<`7 zqG+dOz558-tPbBSm_6 z(ox;#WAQ~477_`YiPe#rn%BGU6*ECm(hJf~^@WYhI#Nv=Qj_h?N~X>K{`#MN$d|3c zsF{sAH|lKPjF~>o-Q-j&cgf{@je>w=;R2gHc-TMcM|}5DMepV3JXMpcg51!)_^>ER*{~WjWo~o=T63r&$*207 zRLl_4ePh-C_JbFWI<+$0nkXIqtfT@g*IY$@e(5+P5d*uKaEMiSj9S8tY z1^}sUzSRqPn<7T#p8xmR+gS|;2OD!tR&GZ~Lz#>|>q#=?*T`8NoZsW;d>YcKuaKp{ zwvHH^@VVj3R)Iqop}?B&x1HZ6+&AlrvnV8|)7qC!@b}Wj?eM?g5jh|Y-E*-0e_wN^ zQSC?vSB0L^0P{5qkp0DGuaQq-qOV5cmn%6fcHWL9_O@eIcQ;<<7>DXMA%$8q7I&Y| z$s><}PEWip#BI5Jf)jN}Js&a49pf&)>)ly&5brR!>ozqkOad9C6dXq8hd&%k(jWSc z$N|bLn5UTL{TrWzWbk5V*l~!!Jdb3+ME6fGnxFsZsFaS|s_Eg;k!9N^mI8mk8+g?3 z+fg5e+FegfNc7jgf6uGZZZMM@uRrg+l$Vv0E8goo6#J0q-3mo2+`TPM)r(XvPqy3a z`SkJlx?Sh5@9hTlZQu9J$1UepYXW@yFCln(;Waf(|L7+J_T_jq{Z8KJuUS6y;dfJQ z6%2GT5ek-J#1nENxN&A&Rd+K6W-2x~OFq$#?=by%JL`6 zX=X*yDcxDBO|)x_pPQw>onPpR3YQ6I*ip}@!Po5k$D2x!Hfg;hyBm>U=Hv`*nBtYW zPjVIK>RXiuuE>imwnFJq30T#F@Y%*m*YzBLIq(+uBO z3ZU8Eh?HM|G_}d<|3knL`{4v@X3!6dKUYiSboi}~DJ~A9Wu)Bu6yws2x2iEBdBAu* zip$sOimZw;!_seA6#g-i42NZ1_pO2`ramaroX%Yrlnn6B4PfZwLkvaFLv6O(pgXw) zzlCo$`Re_nizap4Xv<)(A2$-p9m%$FFiM>}(DCh>NwfQ`d3`sH49Y6x0p-d3P;>yr zXLDi_{97WI8LYz`v2E>fnYqcZgs%5#cO-$pR8B#mbh&@o5sJS#{%d9i{T~WY&F-h0 z^?B>NbN3$l;Lve*hucYypS|#VI?HfB@~AEzbu%&K<3!gz)e=GDEzP~Z&XXqV zU@||iyd8%hI!;9ADql8=P-DUR*dFn|sfgC?ozSZ1bIS6|Ahm)&-@)JnP8+zgck~Zs zVu&RF)r_deZi2)>Oyp=}KegZmBF27t*;lWVYQ|}mYViEtpFe(e;j*%_2p3z%X$UNy ztq}7vPn=!N(r$oIE}reEa|!!oY2rp5)qO$Ys=SevcyB_6ZFQ zEp9Jx?Cz#=b^q0@Ty6;_ZXhI6VetJ2zG+CL$R5QtLc2`-dQ&mtRYd$vM&r zs|a>LIMTFz9~cuFSXIPrH>Ktxarog^fCC~u=ENCu%XYD3?t8M&M@N|0+7pHmqbgfCoNM(hBouB`!kQs5>NNr`B^E>D3@6gDlPH}>F z)MI|QZKg;(1pL5G*7J(z2{dvwX;KUsEMs1OO${T%^Veuca?R8QdGvlUb~=AGfZadR zJRA*Zkwb01tAU9nq(7YUN3Zi|7G`&gd7}6QX?+1RPkyf|4muo&e>csn4_bw#L(A-e zS+I7+R>LstwK3^S>cXeXHXekAXOw8D%H}Xo%`rJ*R8d-Vl_YhCF%;W?e;>LW-+=aYTcO8k$~#1`nTI!Tp| zjOj66&>drKdK4*5==zHdGBC(`=%3!K-dMY-BeRgLT6Ebl6(m(F%-F4-ef=;^nhRT0 zJugOqny(?nEe?!b_031ds3u~(-T7g^8dMlUB8k+Mcvnek1v1QzMKsCqiqNe~;-|6^ z%->OyJt+WA2;K%lSAn_?o!@U5@#;0~Xk(qz6_x7w`N2hC>{0ToAkCLjWBHo|0MyXW*Q%c0#! z>zKlN)H9QviLWV|nXt5)qpU2Ff3)DM8$>ETM)>AAsd-4qL$_|#r{Z$%*shUTWpiPhOnW$K6RYJz zR6fDow_u{St?ki`Bgo264x0Qo>)Fwa#G$}A8(EQogqe@8HK|t7MUCk|cE4t7`8loQ zMarum7UYp^d>>A@ouoVokId^A+E!~$8FJjYlo$3q#gF90K$e~Oqi^#mVwJV;5)L$X z4m6;zyFR9ps}t4;peq2+m#I=1cPI^Ak8A&bEDX!x>=;_ME)A;-Fz0SlojQHHz{>jm@>YKiQHc%-iH|dP z0=fnUyQYjdf@?4_VktBwxF-N20dLM-Nd$Va?b_X_+y9TKw~T75i`umd#ihmFU4py2 zdvJG`65LzdU4y$5+=~`>cWKc=km4;A`sF#_dEb*C`IWJ<$KGp?Iqx~=y06-o1^o4r zgVHXa$qbetawZgPrN(I^?TrD}RDcCTSK*UN^{><)N~m-HQwjWKAXKl{9l&R@9>&JP zcw4H06jr{)JKHYf5P^3NPopb8f;&~l03K|+Dmg~Ud#(h1ix(*A<&N27lA?}ts8ZyP z;evy)JMu7=RNvLOO7>ad&}u!|b*#iBHR?G1zZYFt7OB-kzek;KGLEPJG|QWi`-e4w ze3PHty|OALHzAs!5|zMLgh&bfdu5yg^#WF{j>X%DX$)ptBX*o`bW34c`JJw8l^pvK z96`PkUe|W2QE)iqrHV&%<>9z*gQ{pX+QX$6*-G(%EJ9sbojU^jkID8lm6eq+9%&F9 zE-vovOBg!)AZ@Z}*m~cUw?U^{LH!F1G7;|4oiNQY5Hxl}`MeOlu)fat>d?DLyCb(eCJ=LJ!-zdjm$wb0`lmNer=JAEq)yT{3&chxk z#JO(fKM?VMf+qRxXYyQkk%$IG;M3J8j7{KJvu)H6wX7jQ&hh!rGi?k7vU3GTtb8y%t{78dU$-VP<$r;$I94gSX=Kll%g)=Yw>{n-!N z&^h&hkJj+g1Z^CkfI$Led%tu45%=H8DJ&#NYt=OIn56G|+;X=412ZT^>wmrcbXZ#l z8HU+kGw*mUt4ZJg7Nvw)$~QYM!^TOr9RJU@a2N@rU&gfrEAjx3@!x8-!Gm5`g}I}C z7UDc}K&VV-J93^3JZL-3!hghuZxKh-93y_=1|<4Vh?G+p`v4*)Ll;^vV+vqCaTA2| zpb>&vHBT|Qp13IK=q9iV&-R?y18;u$RfaY&?Pwe;p&i12CFB1k*yvis6chx`Xz7Fm z<%WZWvsNwE;~(nH2h5U`(h$u59uO|>?{f?oZiqwcTSrKShM!7gqJKTF511)pQGUzH zr~LaJ+3E*4KYwIm0ws)U5T;uHOIzN5l=#a@5%f#y{{DWV2S&G-nQG8s@q5|cPkOl? zpiCBjuFk)nNTuz1KCiRgpUo3EEDXF#ZDH@d;BGcK0{#AF`Nyo)E-~mo*4&ggg{YtA zd1PZ`$xm+(hPeF^Hix-#D;4;a!m3q^>|2>41s8ypVxRHS_FpwwJ`hBi z`Oc+$fdU0vp|B%D5#zrJuM2|uaUv{QDk1|?Sp(e2WzIvM!85 zsF!ri+-XL7|O*1+FXCiXKNv>G+@+;}t&_8nz)3X_lr@D(QbvCf5 zYma9zXqR1W$H@#r2xnu>HVde!_uYEy9t;ykzfe_l>-vF&{RT_{Uw=TkVR6b(X(0SNB zP+Ng|Uu<`3AOv5D_?z-<2;Yw2YM}hFGT_nqWAM=){a+?)9Qi1g41dc|O1 zxOjW46zEf$D?(1EWrxC`)ap;4bj>f$M~@gkcEI28{8wvoK#r$o#=NWh3BJQ2p-G?o z!kYfWw*$;hYI~)74Ydx7N-?{$n$!u*O3rM>n~n5o3`_qwE`=`zlnzx=I%YBpJob_8 zy#DrzoV@h2i(<7rrWA5l&K%=~VkC{Xaz^CykrivR431k-wd`JY^xGkE^wpIc_KG2q zTL&+vkmXP=8_Gr2$_IlDai5Ev6ygrArpT}%0%F4VhilDPb8Bcmg9t@imgVFGltd^tVAroXcj5T#{|PCJ&_RAP#ArgTdj7%njUF1dTyO zOlS5LQ?<#NX~uWB+-g4q`FA}8g(yVb`kmKQjo^%)9{A;oCQ*p7Y{PVYA=n_srdzmN zGu-aLqg0wnudh*~%5KsnxxD_bjKio?=woBlsR1mqk(cG6D0F)u2#9`WW#1tvtKv^+ zndu*Htyr-Q!S7gLa;5C$p0nIC(r#mf^*!bVn>1(PPRP)Q^x%974!(OJq5pP~vw+(k z_5Dv7(`1|u>7g_51YIadJZph$4_-HMJjTg=6~Fkgsz_7(hlv@P0`R&2-3z?VyaW9b z?TzA+vLs~pLF~QmfB6pxI42loI`I41f8fs`#4PAD8P$BzdjBKL{nHZtEVL$ud z{t(1Am|ZgeU77c9`x=n(j`w0fwy2|H=UdJypRtb4N%M-2Q0pgG?4puw@&45gMDPiL zJK&QiK%Yj9_a8(Cu~M2Y#!PO*f69(bf;-|cUG$Uk7eyN54EOYudR7=Vsq~xyH|GQ; zizsjS(C?IW9+vNq^Ppc4j7oDm-w6rke{Qu6H!a@a9%5IYqmON%aG|zfje2iPoP+X9 zz}U=06!CK_Vrc9;V}p&Y;iJ%LugwuZuxZx@&M>TWz=FItZm9n||H9~4{LkgiHHcUh zX=7@5eRv;+e7YM^9yzrM8?|jB&H4rd-yG*P5Cj#d4(6B~cisehY+e}&T}3r68meuq zCRjVdoZb)he~adi#t$@py;a_fzAk932JQY5#}KFdoP*GRo7t#(ojyrjlpc%rnaBU& zuJ;*s^ZZV}&t3m}H+uCZUlC|wGiN9Fb(27`a$QGg->OKDXGI|9n5|P_DwF3(b@h4U z7!A`9Wo01bZV?f?1}spuz1_HbYeY5SPv8A&o8^6MXK7BN1@3mWQ=M`dhuKUgyyof) z;v8Jz&I&cf=Fr9N3P>rA(3OtHkcz#+>Lx~VkLm0>;ch_(#(_5@7O1$eBg8s}wPtcy z^lf5NiAg$2lJ9x2v$~QzRgw=`Ki>-f|20FhpL4Rqwmn7=PfnAB>DZAM7`cZxCxqGJ zc7)wC={xL4qMpCr{=IT}HEuH?MBvM)YKEm`fAcaOyfwCnLH`#;&(b2wp@n)O-~qi& zvn|W0$+Ma95=;0Bo+@nZ3Si^)slaV!pU>shxYS?U3B4P4e=hTBx~QjCZU zp2r=LqRC35TT+~e_6#LXteJ*?1UP+wWftT}y%x>3 z*4^_%MXT@Z)eKoo*0}$ZL%7FbtK9Xw>VWPPREF&LuE@(pime)q3vUlaej0sxN@@1n zjq>%P3(cxm6M9v`*o3BZ(!h^e3Ftrbgu?{-{Yb+^J|2b!kC%M&wxc93DF&}NC|P5W zxB2V+w>sDzqQm$iw1qgYatJFsEb`|zP&fF1oe$Bh+b3R!f&ew`pSEW1EvF-+qAN+} zx4 zQj?+psbPq9iXVPO8$Ij)NuvJyA`dm9C^7fWnXS%G*{x|20qx%@SF))|%re(zVZ(Wd z``=E^ky^Y_75xeSa>Bq;@PWn&(otdeiiU$L`w2jMpYYSSIv$6P5*eFDS6T{@Nu6R8 z8dGob)fy(v%Rrrf-R%UhvMxDR$a+Nm3Tm^IDiRIp&vs?)a zR0GA5s`*kZ9=6ubtK|??5CeTudVfmkqgs2{c*;HYy zfB0D*;+1-OrvE9C$$=;vt5}|$_`|lzsn50uoVH$v%Un&lhb|FqY#mb+Jyn#Fs|n>d z^!fcSK;}V#D@wY!B@I$5gwW4&|Ff(xB5gL`n|k(Q0EKwFGP4S!?YfWF&kU?<_Cg7U zkN1CHrk~Juu7e^<(gm?Uf{?%wvt*TiNg1U%vpBMfVF=zII;!?<#Uf7&_2j{i-4Bpg zCagEXuroGBpwe_NKd(p7XPxXgL%1k=(wux0E$zN#=@ zHSi?HN~9Jr)61sdMbsg*HDD33s$l7YPJANQ2V7Wt4lVzCv;WVhp27=gWfm9YPh<1M z&k&>9l&%qh4I#cm5ZA*V_>&7eAB9 zclethz=A#=G*WE3-V`LqZ@+A$Xn0p}3XbR|F$;;O=1lpWsTqBN93{E_zt{F-(ea4q z;JjQcxzd)JMTMRjBU=hE`@wD?Tjc#PkC2aiF+dKRhG=lcQG-s7%l2mI{(qm>_^_y> zY|bZ72?EpXZS5*UakGm*OCDQzLLwxpMU1!wUuaqVo#TuLa-hP7P5JB2_6E(TB|SP( z)edfG^B1x%|FaMyQaskBFmZaH&XMhH=FHnFSLu=}gK((2q4r6w=Bd?*cpV(N>pRb$ zz;?8jc{azPTt{7Of$Y)A)`p|+$M=FxdKY&`SFF_WzM}FK1@Ug< z+)I;R{@7y@SjM5Jr2ts?YL6n4o_PMB_(y6>FR1hXcPt()lSXHNx-l5>*WS{>8-ev? z*S^D*MrU4|>khG}^F@*XwlP}K+~UXz&E*$1!$TEN48?~Egr@iURvYd~@L5ww=eN6epl0U! zEC>M|L!kFLg>P{8E(RY>ucR}fu@tg72*6HQP(h6VVLp_|#IWG%C}JyVa%+fUEcCgt z#k~*CfsAT`sK)r#GU#G76Y63VK9unDAF;oigHc*g*5TZdgt~=692h%Bt!9QQ1>5G} z*M#j7kXXjrFm8&+mC)PVr;j>%KE*a4s60bF>zRRIBG%1)GwT$dR*}1&*I)C4Yv#on z-eD_efmGX$!HSt$EUc;tt6XAA-pW<%OV?J+vYHD__@R@{XqEDHUaD}G29o-|;6f?# z^ut3hA$sAc$BF>?Au@>t(~*(p@Ei)#cH-YV!8tFh?0mf@PSmptj8D^uUBW&OHrcw6 ze91@55njrLbPSn9hzFcZbP`p~txcnjTP!3I!VDld>y>UieOGg{o$9sE@&R;{L{ z+#R|S=ujwPt}u97=JB%-KXciby`-wx-DO{UC8W0PvsIc`7ytJi_2n0g~7t9DJ<>@6B@M>|6Qe#vm%7Irlbb#~!L{OUS>g=@2|CXv@GFtfvOE%Plz>PpZC zx_n*Pvh&9zzsjlJ_%3NHTec9@;yc|1q}GyYQN_B$Di|Dk)Au_vjEJMwu1v?AaAPeeX^JmUU%N=)07`;cna+24Y& z{Wy`A0Ms9H{?U8!Uf_naR;E{}M1Ouv#*Oke1gS%VB}Y7|KQmbWx7Z|yb7!M7I%Ib0 z75u<*`TqA+oQDEpz~^|&i1QU}o#gB6$65yyk4uTkPVF2I_<(V~T?0v1iSnoP@dd%s z=1>;K;@hc}Xw#=$s71i}W+g4Jac&jAy8~IX-IQUX)zr+=X}alYE|xq0kAN}0a@%$$ zS`ie_vek`xyWNIn)9pRUZt-tP0xW^^B=N1+x%`)&YcC@~>tFxo%;PKvMaCbq@R$tP zRU%vgmW^WYZ94pQ^l%u@zoLhdlG-dR8g?Go)%)7W8N#X23ZMuQ7ly!)7AyyXPG9v4 z6vqMNMVB});oLnP7sCU)w+QmhxU>&FGycgWeL*W+V=R?@4pdZdUt*J#RfVLDHgpup zT?PqdVZqOehnW6f0~eSXF0bR0d^T)q%>yDOaz3d{$?M4DPG_2a%*l2VPh~A|nZJ!gz zTARcX#RL-7_(U13A{u%#anh-tH;7 zt0J~TM|c)3Nbu?<%P-%N^M;gDI21`%Auw=ckcQS+pdw#V zp!&1N3gbQ-0w87?&&z8x&x4Tzx6I6peYFBxc*J#s-qrVP}9uvti{ zo(thEjhor-@~K<=^eVSa&&Ssf1)5h8YIo{g8xoml#b7GvL>M(!2>?0N6^cT- zS0RXRl~c_o^rrI6Iz*V51iHSjSyGgsydcNqWE9b7PD$rinAno>YA*G>W?eiu5;t|;r~VxN5#?0)Gn#;M zi1P!>gI^Ol;4abrfVT6ZBqRV=zEY*~a{`TEa61N2ShZ2IUk-BY9gEU5gDrh7s9PSn z;H5>~?vzj#=x9MTZDsFuKgMpndhF{pQW4pkN9U z2aGr>%36?yufTt4K3XoF9_5EIib=mT(EK=?f=MukujH_!vGg-eTBGQPkmv;VF zyYRy#+QFG)hU2@2+wb;J`j|v2Lx68Di7aH?wYlDo{q%Du47XKrH)x@Q@dJf_1&>l&;dCI4vu=EaAaBq0y^E#@NqKC@JIr^VORL~s6Sj>sV;*D1 zf%n{B`ghYWy&_Ylijr8NjZWN5j6Ql!YBMWmKd%X@z&-o^B&kiT$`8GFQ(f*$NGNAl^@Bv>^9pE5QlU~^=I#Om8};~`v?W>2qsv?5 z?Vbo*uV`tpLl&F=!W_%-RwF%&lIBDQEiKs`uo4if*nSndd|=yDa4-2fXInS&atSNd<+U%Sy?&9mUDVsCi!xgSoxoQ z1sRXIX>^VP^mPkmPrc5xrk{MBj;)=eDlg^u)by6imh5xwo$%h(M;u-%;MaZg zL05XLVtsnZw(Ok%m7%)75jq$!{-92v8ORu7S~*<5%4QW-ig#P#p~BToSk>@cKFhc^ z2&ryOm3tLG@zc;-C5i{J)pMdclCqXSf{)t;UlX)#NsZ^_a@@}I^7;%<(njwA@Slb0 z=J-E2@l~1N1F}YVF9bZdRhKI4*i>dcAX)3K_``ol)f<=}#o#?`DoPSAI+b63bT?kx zgpD0=@#O4zKcbI#pxzWvp)iIW0SKFwOp^c!-TD<-*iS&Bx{@g*!UEI|yTR475N<37 z+G;)tvW?iLvWFuZ+B#`iY zS)21QQdQk+zQQ~Al-~@{UznB4T=3=-G%8j)0<)5|9(Uh5nY9s%)nv!xoMm8K+c0Fs zHkKHMi1Ykvm170O8RulkY>y*FH@l60`0s=Zwwjd`g_i1j5TWz20Xh?ZgUL8ECIjQ& z(@8m*#OnHjDUC!`qShDE8V0ti5;l?BB}qw-+@m%O+8Ed%sSq$NHS2GC&-R2;cc_1< z@NTEYk$r7Cq!6Bg@uwQql6_1ZH;IsNW!~25h(ls6H+Faaq-t~gmXhmC7g|d_dt_7& z!)@uy1dEbQg>slKd>zJjdwS`5fAI0HTC6sN+>teLTHlN{bqnv(ulmwQn{bCt*-H(= zZqt-hAh(G6TG_uj8_(BN@fLzNaf_oN%xXomUUT+}MJRQ}VL(di$m$nGR2b9bKda{= z*pO5r_HpUWd&#f$n1^?rC@0Vhf@L%TvWOABroFaucqVxvzV&s z8Mkx10oYH12#&u!VL^=Hu>g07D63p>$;vdIB=SI25jaaHJ^^6c?9B-Lh!1Q@V+7EA zMNBNnpJqDC!nKh$llMzWOXGD;A+ORY2C8+{XJ3E0XN@JBj$$>_wb`pwj0^l z=+M*YkRL}<;W?f*wx2Q@MlKWIQ5dht#%iU@%!`$CZ)~XIa4v7i8HeU9$3-AZk!*!m zlS5+|hV&GStabcFkY?(^W8mA>M2R57mf27WUUN={iihiRyQ5ZNlbnJ>TYHYnZU^f6 z{x6bqs59`1I+1We$p4+>ok8Z48(0P6*kM;~I5mCAwG6+6q?+fXq3JFC`K?ELccEchlWL|>8yOg<0AI4-b*7J&AW^z*>2}8Oa0J27 z7dRmSo=`WoHyn)TX}!;vaJmxuhLii3)H<5sg?S=~mF5%}JzE~eSGe1*_4Utj)sOgn zp%_XExMKprK6Y&s0t1-psj>cj;K8ESM5Er*QkSqp%xFyjU>t~7vd5=9!qqf|em z%}HLcTNK&HR2s^8kUplal;#bfu`zd{|KLsi){ z^%?VckA3kd-eQD=mH2nHyi!@^1dS{MUYcuM(6~HP#UU$g*+!RZufq?kr54Y8^p8c@ zA3bcesC{6$8&H?!vzX($(^iU)bnMiQd`m0uuD*=g44nW^Y~<9V+B%{m`OmgLcDB_) zhTYCOj>b)m>47~yoC3MZG21|zEZpL%ftXlOk`~Y^)?&yI0Jz^>-dB;WaH_{`;~3ZX zez>=A3feJ=L-`@QI=MA`W$leq_#)s!UFtDof{uRZg6au@D9;l`XSOymdAdpka2N(x zn}{)g8!ivN)ytDcN=Kvz zMsgRO$w04;&D>;+EiGp&t%`1BqZ6T334{bs@2AB5E(-;W=@aF&(L!g%nb`HC$|nN4 zlQqxx99n7pHRM96Y?yf)1F^pSd5f=5h%61|*F!02uc9MRiAVY5g+Xb|h=aT6ouI$z zYKQ4+91md=X$D2(JW?g%6LZFWnCQa;l(>`l zFjxxn5)fJ+b6!c-=pul1N4kO|>5_zjCoz6Qh4Ud1K?V(CE~Z1NASy~i%lh~1CzC(# z@?w<;THyopUki+sJuYz-w<}Cczt=PU`N-YS>e^swfv0!Y9I9mm;$bt4M_mU=hk3ht zz+0EmRwpC_UvVAlwR-WO{K*OcKc3j~5M=;kGt=0CP41q)+rTpC6bm$pksy5`;Nl@2 z-wKnswADbMKg&b2%05_fBDu?$rP*-#1HCh*hit^8)TF_}NG`C=ds|U8#i%FWxv;^P zMwv_17&DwDpr=kY<;mLbU!S5w0%lCpXgL{5d}uR5?896FGYhX<%rS%lZ$jBP{(MDO zgVYwDwfZNWWvJ=0;*ET7|8c{ouoA&a@|@G0&hwtroQF+M|MeLvxY@+v23M^wW*0}U zQxDOXm#pTH>&Z`O`4~s+)qgf-Xarj~2%gI9dP0uz5knj9sDh(YNvDlW0wguGC=bIUKrzmIchscOkWDDZp=Mw4`<@aHUXl}2bSn~^)RZJUX97Q!<82SIlnL>R zVdlT+;1B^Xgej@{wz_ghWmTgdFBQC<(40G6rMjyUZj=l9z%i^TzX(sSV%ycWMj(Q_ z+`bEAEoFc@EwB#snO&rq)Xr)GPuAL{UWVpqu!puqw_-!i?rtKMQJyFNGXdBf+b$)M z3}8Nm@P*i@RP`tS8t-ZoTkw<81PM9WaFq57olliyM46rdeBqAI#IRFrTa=g$CP~Q< z+f*SJYPeQA%MD6op;;_0i^q2M!Kk}q zjmT1}b-T-J29JZkuik|w6H-!@*x@1yd*^8q9Cj|tLPM-&*K<8(OWT%1Tr`%|Rh_c) z#a1!#BMnVaom9%t{rzra?L!*?V;-#w+PYW+n|juC|G7}!A+%oIhTQ~f=`gi86nge( zVb}MY-_K%n*BoxGq`tk<(poz94H?Kqx@1lR`)QdwT zY8y>c&%GIUZ0NW&NgA(?mEs+X$2F?$WBGc9h#jXgDOj7Sw8Fr^saBpb;9P#zs9RZ~ z4uw=Kzc4lHa)wooU^UB&G12IgKSva#XSaMxAh-q*my%%kiKqLL z6>W8fbDY<1gFg+eIe)G(CGx<=iv2-yd@3T^V*Xn`p9lwMiz*g&g4kycVmQ6>tE2jTI^W}GiZc&zWzOC7Hf zapRZdUWEtrUF2d*dtB8Y_Y|e*ugUuIIYMsGLFaRqx9qKvJQI`5M)vd57e#^Y{?z7t zkK#t1SyC+?rvxE{^sLM?EOE#~Gq>Cth`S~UuX>5BE%DCY2GC$ziPeDM5DaAw7FL;> zivkZ@R+|>%$_V3Nhd?*kwu8{xh88=_%K4cf1FfU^Mm=b{<9kLL6!T*v>3%I6I=SPV zR$8>$&>LEO5uU^r;$n^z$hQYNssp`_|Si3gH zE5&1*$i+Jydb|AWP90BOMnjY@a~X3ytoy_s1*MiE8Au}vjc$xbX%_Walp2{y^AxBaG&WOY|FcHL!gQ8_e=;uCr)>W{^K z|CmM~Q7W9M7VGowK$ucUJV6b*ZrLKvM(&o{*5^%N_d8_TG^dcFb-mbl&+}0D_^oOn zQ>@5Mc&)uR2s$nPNOC!G6qe%MBQ|j^cN|g{+r-rSQRnbE=+7KIW>mf)njJzgeKV8l z_XDOBVeBW4t+Cae^<}oL89^Y9-|UDy>)wFM-;qqwvJEUGVTjQ>OtNF97QrokK;}oH z3H&Wo@hX?UP%X;d$f--l)0D~c0IPTnB%#E3i=Rvlt1f++PtU3aNpX>1>+dIGyGo&lR- z9+T8dzH>c+V2A55pAS_6lQGK0@3&8G!;IYW70q>RIcO&?qrLu47@z7YyI5psuo!>J zGNly&F&ro>9??=$_e$G*3P^zQ92HcRV;st7zV(o|zy`S5oH~k}@7Re1jz`dZuNrKD zGmrpWk9y)>GzN&QVJR!S(e6r7W0lxc7FF)xZ}`MdtEt~svKU8BRSA2JI{Zft`*}}X zLbkd*Yp4{Y;h%cn5yl_1gbdLqW2GsV=df|f>n2!(jvdAUVAl|RdhJwDM_(+%Z5UPlx93P`n_rQ+z*{=uEA+rsGGUS zn1qr=gt{bOSr-5rHZOe1pTIcG=2^M^7FSod^d~HGL2CfzM61vDgl_lX85N@_zfFu5E|JSoTAylc$Z?BB9aCWtv5C)5VZ$ zZ-O2-9Y^gu;%TE)Y};+;9th##fMkg&OEF6W$ZctYWs(9Y8pI(~z>$3|Qk;qD3UDtL z^Ik!mCNI4~LwdRxf4(&4;#^2(ZXs!sq+4VbEv7#~v?s*PW;Ya(+VDZZ;h<%wk2)$J zrmQy?{rE;^L$=}L94Ti|r!2j$r;}frRgbGh=gQl3#cODu6Z>NZ(^(i7{;uC!giRedgbB2F&P$azl{L_?Q{#3{h9usxG+|Xh0VshE|aQl)*W|h6Zlf03ARU9 zdsw(-bU6x922B>T>{N8Rn!OyUDYmL?xrYYTn3+QAk?9;Ls2U^mX|e3M_#e)%%sSz; z52N0B=!up+=+_|4`;0pZUq{8dW3mbigByxOW0%)5Cr~`cmcmn7GrgDpRMA`K?_>w! z3%=D^uyN{X&#TG$rqe?jKdzoBJzqY*BgJKSm9)YrGx_AgrL^&o-nO)|SDQ`}PWQLS zXEbxe^QlvlR7@Qn=)#s4I@yD~(Lp8jYGEZ%uacpBL1hKtU|5WV6^QaxfBhDTSq|Of zkyQKg#nLDO zw5zn_<5K;(wB>0Tdk<+ytL@xD(}@otfQ`+p`}=Em>PBDSgrC+1pnURhA6iidH$ za^?4K?YHt=es<$H)Bf)VVGb884fHg7tk=T!-|DnK8y-md0O!al{d0Rn5VPB-zgi>0 zI$Z#!HMSXBAMK?24I&zQdLC=lA)C6R4i($1vtR?2tPGL@=&xl7s>7q4E)wq0loj4A zygWR6#4`pV^%kA0%nlLyYg;i_(z*6}13+y2r-Ji#oewvUzF*Z~vC@6d&>yo3T=UoI zc(`1H;#KV0 zDyp4f#z$w{f2a!$Z)$P>7J*H&l&UrcI7C|=Jn=R|b0SMg5twzxRYy-q8Asl0mGw81!pfuTO+g#pleqz;#~cf+wxbR-U*^Cjh+Yd(^E-*V{TE^5QZ zvL#kEC(#Z)XwFi=WL>F2=1{5#LEL`%Ah$<*l?cAe9(=Dco|@FBs!DPE8w2Fdor$f^A(#E&1ba_PZ@s;5D9`)VfK-PeLuXkt~PaOViY z^%!1RJIp##4Z3FC`-xT69)XTttc9#{pZ!K!-sYk>10oY(QrecNHo5olw5$kA=+u5^ z)qI2qJClw%URRD@e%rjNMWt^yr}Ei48LMLfM14k5m$&-)WzBVL zAv9P=FEJt=M#93(6}H~xb-y{6Jgp^Dcb`4yX!btKM*ySYP08wvRjJ7X^n_7{*1?(b z#?TM*Lz0zIBn7RXxA}FF$+;p-w__;gwiv_e2;do7@YYMdQu6r^d<#HLPmk?VF7zQz z&Ai@E@(W^$KSVjWw@Zj*P$~kIUIyYES%d1+Xt{z5zTN?1D$7T@WjB2+E9@t~XZ5Hb zTh$EL-f((`l_y@hd)_1PxAPkpTb*56>~sL6u+qwOYK467)@A7&T7DX23MOtaS>OSw z$6FTt=??LFX|SnlaIuwga&%Z$ z<~0YfH~+NL=}j4IjtEy_!lnOCHi6DZsO{dX=g4B5fX9{wqNAd)V(F&guy0pb#y=G= z(<#Zb`-ERe8<^1slXV)i8RDpne1=vhk(WRzn@`yc>6K#Zsm6dbL)RBQ#73}rTRA0b zO%s4BK^{#oj&XC2?3dPn)x^5>Aq6h~BTztcWrW3zU^>i>4`@<}TQ>2dZLb1C0p!n^ zOq;$7Py;`Wq1`hSrdb13mAxof(aUB1SH0K2uPm!$Ppf2Y!Z7zg!JZYoy`T6{#{Yyc zHHw1O9v%7IHhpm0P%7ugx;JfWHpjjZ+t_?C1a3YlRedwSbyP%*&^!GkS9+h|>~6E0 zir>qP49EHf*K$#C(I7U^ zheL}eaBjLcsoOqXB3Ft_ss36(H9(O90rw1pl#Qi!Rmc+ARmX#%QDhNA*#M9hQ+`>0aIzqqYHV2B*`l!~Ee3)2W8Mm9I2G!fHL-;boxL z1v?4?TkifQ5sa#<25v)3eFT-O{9;G?xctxcxHFz~4CdX2pTIPWpy}sNg7U=9IOxJ< zw6q&@(s+*JD#xXhxn-AM@ns2w!qZVCwkq}4lzh6qu1bce^ZOln;_hP%pd8}9yj0Q0 z6rL0Xw(8-u6D$hyI&TzYAj!iJ%%UBx+Oyv~gQ*bB?&JGya>_QQ{mkuQe2nh>KhE;} zBB8{B^?_KsfuAT>!znV^KneHYo9n$d@q}tF|MA}s2Sg>IZ|tCEP6Wv++dI%|Kmy-; zsN&;U=m`S$6k5XUwVANq7MzOlXxQwEecSiP;2B3ZIlopAaZ>fK?&-eQ95OO4->OSd z*`1Ih(yZSIYlE_~ks0rx{4TIl#bXU;L)ZjQTuO9p1%FpZ8h`oLS82us)|f5@4!E(Y zcOTGiJnc5h=qtXh5bhy#a%t(QzI%rDOPZYvtjdIcZE$&K*J)p3q!9;0Gs&S&wGft&iR` zNDctl=4WwbX`5d}+8$%?DlDpq7if+s&}zbzrTM!=^**mlcJp}=;v1>@H@mM&DZsV% ztij`|Jgp(IL9CfR@`6E8&n7AS`^s!Uk37jsZoSISUNeE|W&@XWGUCatxVCv6&}CtC ztGscji1q&2tF3Qn8((|?Yf~_AX1FIW{=tiZm?Y4<&LrDoDb#X+G+ghmc z@_|?~RIu*LgOQS0dI5@=Hj^~Ro%AM-pff%FXom}!jGuF-Sng~I-Jo%8Cg5TyaVI)X zgvxa>EfpJRBv_0{&BM);Yh6jtyzPsQBYN0G@(tmWe6RD4SW{`6=}YPSFfj*4Zk^eI+OAtCYz*bwFZcE#389*f~>) z^W3zR;xHOEvY`f`URP&QoY@?OvXM8}YYv4Mwvtu8r>d8<+$VS4Q}G}8DPZ4zes%_@ z5lCoIVmycM43awVWyc%Bp}D^e#90y}m?&LSE3f6|b~toR%ZHW|EY;!KpK-5!P`Xij zl^Hg2^|JJ0k>Bb2U@!J>)$c&0sOkwW|H z>B6RXZUtIxV>@W;;(r@Q2rw?$GL(lwBxv|&`UF*lPvw=YVplPMedX-^NKm%9%Y)`5&p`?4{<;>uC*roHo~6hSlcC! zs$Ahe58&X|OW^J6*cE6}##dOw(UPV=^RZT&pFk;Ia$7nspI#$TX;SV(*?@Pb|EncS zM^D@_&)a64>9C{%yt}Hb1jc| z`bp}U-8>Ym*He}7-q+D#s8w<$SsHEYe_Q!ZOC)yBY1OiYKwYH)A?aZl5#v0~lw}_? zZQa>rgM@0QAIck!&oAO=gF_2^OefOg;xpd+JV)8(kP{ld0a53zlFijiS3TJA z*B9&Rt@S0p1(b&=LBf}WN`x;*T0HD0=6Y^65vFXCJ=nR8z&iaGtR^D}9Zybwv-9S@ zDM*Zyl<^Vem9uGmq~YN~k8_t=QDVtp&7M?PGd#dr8%0!!XcXk)30U@}4EFr;`n^!> z=l)lGXMs-12JD{+J0I67VQnJaX1L8&S2tR6Juyy&U6&?Rjv`Aiy;K%qdDpcxD1Un%iQssb|!4IA>%>2<=yHA3)Tlx4NBe0ENVJdO@#*B?b!gQ;-LHNNC_b$ z&W6Tc6n^DkHpDab*{~W9_CN*mW$vkU`NNnuk_hyGhvjQ_YGzfvI4{$3y}|EPiTe4H zV`_UjX;?C3;e)F8OorPL)dtdzjQ%q~EK(JV89jlXgnsFSy(Ow?98?%(Q~L%tb- zhFG=s@y5ZCsB_NLqb}hXOE)t&b0-aFOD^0R=>AOCRw891QN`-K8AaU?*0vU}VtPYq zXM@PfK=PLNJK4GZX1s3Bvg&(N1v}k-$NQb4N|WZr(vKqAME17r(p9o*r%|0dFdyL2 zdfAHQut({jUE#!ZaJ@nBzrQaPr;C`-nRk{Vh%Z*Bd`!Xv5bC^ik2Eb0ppgl9Gp~en2sczDkod?eTgG4o9X5qw zsCY@`tQOz~7{*tiul1GDYVsAY@JU(RNC3H*cC4^ z#AGA?n?ji9(2QmQqfUo~p~hu}wo4B4&c_db)Z(p9o%vm`^udTvNIVo10FNh~4r1Wk zGQnmtdA745;c&E%r6--*Rb(Km5FodSkP@=2i5x8VW+1YqjiQy6Qm1MU+1GSXb-l1M zzRe=A;B?R zPBrpSM;^4(#>I-EtWHzg%Iw7d{yo$-iFEd?cvO4dXz~_b(&*6tHcBVG9$2!l_gVOP z>qW7Fg)GLHpTxp5+)>CbgeXUA$jD0;kM4&{uHtGBxd`aKIl6onAq~REe{D@N=-SHd z$TJ^@Lpa+rV?^0qrci%`ncsAch5qQPW0t918C7vqUsJUC&SLvTc!c7@= zr;y$|8Uj(Koe7Un>UYhDaPSqSKa^ou0x2ri(P*H5KeWD^AiyGDrT1nv|A>p59=B@% zR7K~~Ls_5UL$9y7w~M&p_0!w7@TqQ-Pz-;zjJ194-w+fe>ZDWH8Qs-Ee%vGxP!&?Z zqJgfa;7lXbmVEXNrJou*7b;;6tcrWY*?F+v2l@>4k+K9Ld+(7HIoqRQ4!un5_fFx7 zIqv76MR(V0I|@|&e?{G8R2#wmH}GP`-HR13?ry~$iWc`mDH_}>J%Sq3$At0*pfK4`z(cku!L|#V27HfylL@MDp zw^nKS+tuS@^x&=K^GRR&^$G`?J#y!Wq9T>iUQT&s4mET-3Fo|PK0d;T_LN?QA;;Y? z`s>e@B|$nBnXqBt8lz*zkwlJKPa!V388G!I#dY_Pm9aBcQmbZ{(I;_{7>%9;RWIwh zC8o56_~+cGTHyxIL}pXf(%A&1`33dF(|DyuBHY9P(U#pu$8*H2ULW2Lvx3j3T6F^j zU%8?DObQx&)|t7=GE^%XjNsUR@Z(W&W2~5MnxrHxU67;9h5}=6T}=(q`wC6?!I`Fh zA8VRnQ3Wdhe&%UtQG%Dm#y5p~=&+PLsqcZsOz->>H;5^pA!!-@F^u1$JS>ui9dJ|f ziQ{f(VhvpWr%l&pPU`b?p95AxkfpU7tW~|u=0n{ml@X&~bx_#H`l_;dlvu&aAlMm! zdE_f%%3Fc#tYjcthDXY(XqQ;Z&m$+Zv6L(UTsiga%Sh2;_jGJqCPZszuWp`LTKvTi zbL!^Z?u=}JF7@W}3#}qQZnHH(D+_A5!4!6;L?$XBZ@5TQMZ)@(6GG_=qkS=>tt7PGq!so%O6ttwAQ-r>YH9oAyMtD$L6W_r#JVG-1D}J-K z#D&aMXhN!^!N114#zug{(chk%C#|(v9f!26p zT8E-C@Us=ill1VvfHQV9kxR20wl&5u1g%RopKE?~obZS0Y2RWh;6DdVxv9jbrxc$bDIl-yiQ} zebQ|xFtnh5z-n7{##%Z1t=$USWFB%}NW{}4Or6Yy=T1*j$UHU8XmHidz@VPl$1XFA ztC$>i%-YdYnz<~^1avgH6_{op1Vs7wHj=@M1_9y4FC$@Wsyz=lQ&-JjREfJM74>pc zaCjs^kisC0@oqX|GOw;is+w8qOm|_&69>(NuW9Q2G+D)|I;vFM)K$q}9#g~cLRb)7{@Kc z(|{5R_wpIeO56RuTO=C<$zq_d{qsMFCu9qa*bNs2@-?m&)_M0DPio5T>PCgy3A>(% zce#j{{fqOdT<}J?re9FV7f^qUN>CdbEM3&nMvhCdW;obNvBS)d*Ydj5vuE3AvE^>b z4nfCKl3$%IStHr#XDzbG!Vx$k5tTttzQ{z%bZ;{8r|voMIWz5V@gxW*e88BAoDNrz zktC@fv6`R^_==d|wtQ2xz5aToBFM%2d%IcrV;~h9bi#r$mZS0zS~ySzMbA2VwwMsL zf$$3-7)`mkAH*ieM|A``+}`HZ^n5Qo>F;QcibwZ#SQ?obgOgP9iSt`WDqLzxB`8mD z5#C`&j^ph);$+o+1tgPU?P)U%W7BE=!p&zkr2lO@d$ss9k-RkembmY3x1xSA^wVHB zzQi^-hPd6Z&nZ=3XzvmD?a-^g$Fv*ivYV1p3v3D=>7_`Ro%}n* zYII|b7uBd!#zj}3?3Ihr_0v?nxk@kV@Ftuj9d}jFbkvbwdVZ&Dn`w2uqw%%io3A)i zlnJ=kDApZm-&>Ku?KgbQ+*v{`=7%e5hRF}e(E|B5CV}?^2dpfb8CrT4Tlw@|^nt0Y zbYW0O)rHpnNZYrmlmbKM0%}ltkA|7FojQxcR5Ht|+?~34xbj6djJ3NKHmbWaj>){_ zR@>U^#<2P|(nkIVyX@5#rL}43eZ9LomD<{uh59CN;OrjDMk-=I0i{L9K*FZ4d%qX{ zDdCyT+uS*qbZF?n@7>ny6-~J^qb4@=409{(cy@bLT0}RzmMfJc5+H+NtCzJf#wL;_ z)FeLi89UTEJFf9{cqhtA1A9)&B6v-CFmV%fQdbN8O+p7jdBw^kd2B&U_CkF(8e73~ z_H)>2MZ-R2E3naiie4CB5*~&z5Gar)KL=+~Fbv&80h0Dy8TT^miBn9DzVFfGIoeCL zQP43jv}hH9ipCuAsr!0a?U{S&uh5L(WJXfpFA~9vh9Tb{>?KKl>_n3F3vXGqTGdw}g>sJVd3GF&NP|G|oUyy3d= z-ja5M%A6i5))g_I?vcFm`bVdTg6HrI$5hn05i7Jy(Z*&`hKRZKhhb}gH(iWsRWkOx zO&qCtnoAx*MUN;;sObknYhvkT> z)6nMV*}EG-gZL=p^2bn-&DUZkM*fbKsCIvrLXW$oR2G(MFxsPI?@BMzEo-Wu&jaEu zH;Gwd(sU=HBm`3X16TkrCYg!Io}~Vb-Cq*oCR)g%Wq5x?TAnF^8R;x-d^^2EsE)qI zKP>>==X9pN2%E7{$qZ&%k){bG09?h|G|X&dhBUPa6-|w4HW(b0=^aJ5mPz==kSVp- zF?o+d%7UB{EXhhc`4d=R4&0r)ol8DmCh03r*KyCNmiCWlGBkt?-Hy)xs0Y^Uf8;zd zZP>q?9Q|=oO67_>2dAtTNx6)FwIVd#BOijP5ra&J8k+bslQ!DC0^7w@Bgodn0$j2g zw<|{YeW2X5Vc`p!Zx=N7A0(O>vd<@runKqr z(qgMxmX*kb&kn9Bk;+~cAS%w{^nBEMLpdQbMmAJ&4wd4b;R`!LLF|^(y7`14muA5A zgd)pV&o1~sG2fWx>H>O6igYUHklSw+>@8am%K!YyuoX0`SF3MkU%jjyazQ=K9F87K zz%8Dsh(F0Domam@&HvF>rbEbRp%<|Pc0IdHI{p8<;5R`CIFFBy?=a^78t6||?p5)B zIRH0CTy~zQs4^Wi-i8dL=nZR#Y_S{iF4p{~(ZZ#s+T$@`XJaz!8i8P2``LcgeG2d0 zs?O~1?l!gkkG}N&z5vzVgW@IXVy><{n$T)$Y7S#!oe}b+q_ohlqmV7(srbj{n|cuO ztvsY38Ut4JP-QZO0%)OTo?T@y)PU!Q=C?44~5^ZU<7Gj-+%u97Z{`giIm;ITg} zcbk$MMR6jhPESu?rt4calDNBmiV5<6DoCONdsXZzv_d#AHlF_obE!}?U!ILecOP$# zg!nH05tPoBHcmrWS(&Fxo8fmw(3JZ>-#X5pD@5t26|gOJmU1!)VCCCX#*u_1AV?Lc zV%~kS(|0#F7MydlmfP+u;WtUup6>qKSyAx;-z5daeeDfl`TCzzYl_^gi=#!_yisl% zgBI0}g43F>YTVKf_(u7&L~bl9RzmSJPxq}ZAixs*5!9 z;(thY=>CvkL<5=cDW^_7JUr~H18TkjVjD*8ZPoVq8*-jqU%LZs=qe;9b67rStq7TV z8(-BSz%zHq<;jV^Nux1%0jN6d)g^N&;y)frs2{4cIOBBj&m}Ur*&6SA{K zB)I>i2tV9-=I1u&?ZHF;e8Ik6h@8ST~>M??I00%{O5HqEi)bxCSmw7?&76L!zDXws7bdhYsk&^)uKS%Q^np5Nl zru2K5W=NYp35hRyEYg_uz9``-sB3ANZ2}-t6U1_+Z@UdJer`8B?Hg|^L^kw7a@&Z& zeZEO2;@|>(9Y2X;Vz3@G9Ud~ln4EAN20=&n%k|NG3fxH-NfO6ZILqqcO1azY;z;H} zNH?{+C;3G~8M*hP2w~$sv!F*$!TU^K-H6lF`{V*WcmIJ*v~g1oh=Vqd^J=dg+AqT# zy35Ck7`l_E?Jn#4u#RJ?aauvzUl}79lugd=ED50HN8-Ox%i}usxjBYC7l)@fCM*c@ zv0J=2*BVWILsg_$d5XX{5w`>M6^^g^!irqRC~qC&pLN}45?NU93qO#pyGD>RLw;s9 zo!Ux&WWy;x%Z^P^@cZS5g9(H>q9cxDi6ZOKGXG9W`))o9lUrGW7*-X1Sg+5&x_8hpDu#o;H` zMSjn>>~Xmr>8{tCIDT>iqDdrd6O^GDonXhntheEI-qXAh+=dX|!lUb`#mb9v-s%-7haTf+xG0zAy8>B=7#|z} zu=sh_@CEnXvtve9F&4WmQT9e!htP~WcLM7VN-Ge(zVYq#Y4^_VWzKH1c3P?1gl#{; zeknvVvjiwVa$5`YOC$IM7J~IG1t183#+9~MId2v1q} z9l)E6iV)k;HyEOB!}6@%Q}S*{>Mu0du?Sy;DQ{RAKJl;JwcQy{7bT z$g{NKkjldhuL4#vOy>lmG|0N5``@5jJ@C=q7L<*j`1ZMu-_Q-qHeN4CS4gpC0S19H zq%rY?yUNjljSdpqNoETRb2#x`W-0q+M&G~K#++>B#gK>@8pjXFW-?+2=fjppVkcA#XAeiux=VI&+$T0X%RoPzLpK67IrD2FY9e9H8PNmiJEIJR0!v5lf zf6`wDPdGm6P^kN5a7;MIBNwX-7WvBxMV`?#Z2#Gq)nfF|U;D|&$4!+_MNM0^9tNVv zr726UO*NhJxPk;^RDe&r?%LnH^;}n-?=Mr@BP)Ghj&i?j0*=e=yvu-RXJ`E;9k4%` zFFOgj-cHY6m6Ef49xWMR8`eA+NPV9HEl;awwoj?vPq&-z?56!@5WXCqax}bInKCKZ zWA*AjBwm_fL!-1-UzwF(r*7Drr@`E)&W z{dHOYA3fdiYd`%j>3?gdp%()r*TR#%PTA%5b1^2e_h;?5Z=v?x+vM#gc zSo5E@iPy}=jD5O;=HqYfm-(K-OR;|_A$}XTeQBH zv>?5Ek+=P~fji}w8Ra_fk?(DnxL(JmWV*2wA)Wc5{rdGg&y!>?agm#MD~`(D!q$rq z+aj-~89t8(S_ljAmq>?qYuAN51xKj}Agqvb-uF=@s=$OaH&-n}Zu?ge;;-r4EsN^g z^PfZ|b%C;S@tlp`h?cTcpznFO)XJ*XDDvP9H0z4AENN-!;(%xNwaerN?$oFzBBQA3 z@t2kHu#)sT?h_{mh-O-aVA1|q*8V4JeY+=5Gv;re7=1&ZO5_EIerT1gbdnSCjeJhi zR&u=oLL=iCwlpi=(dReN!k0@J05@UZnMtMCJ>O%%XJ75nl7Ermx$I1qeLn0`KL=c9%b4AJR5ljm=cW!VFYIT>mDw%Cg#sc+x$0NPE*tE8QD3=J{L7dtD4IOyLDy~=Atwkcw%0!;{~=bcjGrB zSKHHn!k2L|p_&n$ON@AW?yEaH`3O}jo7G`|^hfL8Lpv6apJyw5H295~V+8ctXxg$M z6Iwg|@F;bPo>(`J;a4Y;e z)AeTVYvxZEJRGPNIk7JumQIL@e<>2MU1rUNjhGmZFQ$=J@bI>fZvHKhUMGbF7UP8G z+V!?6yaz2%B0X(ya+xLl1R0+551*ZcG9aC^Ouh)ZPo z_a2iz4zP5U=9b@x(#liPd!j32iXH@@$%!Epc>eV%_HyG9zTCFhJU+2@KI$x39&#Ih z75FQ*B$Af<8YP1yRF+$c<(%6Gf_+HPZ%=IH!JYqWl~B0KCo$UxvrsMe1UJLXj?cm4Kt9nE2CK2TH$li*Gi#F|Vz4NPdJ7@}W7$o~wrrD}b;P_Z z#DvWT2R$}*h~5#8cWIJ+#3rscs7hyqr1S6&Y_ICMy*;hR3^RjKM6NhQ0(>8fe7juR zt}>m7DlKxmPJda0HeY{|+x}4atM|*@hq?XMsy(=@vP}np6kNwNdlJFs8i|xHzwI`M zrol*mRn_?r8VL!ap=3UkKd-lm3X}-Ulo-6ji?6IthG}^c%zII)T|Nz@+(>M@4Pp^C zuK7^i%v)Whce#@_ zy3lp(PgkwwZd+sGpQHWu(nAtKfW0(}EjSi8s4TBb*~!pW2(zjvI}VBUA&2ze_H*RR zbb$#7E^Tnyo5vNcAQ(8BkdoWpfSxCzaD*u|Z35-|DKuO{q6zhwWHoH6iA5S;=uoKp zZhK`ks>BZa6Z*`xO7Y{TN19(4cjRkw(2P->kGu*BT)KMZ5XEC{Y!Z4qun#xh_v_m1>23?x9TS90pD^ z3CkW*BpbFnMGT3B$z^D(1m-geZ7LQFDd&BrqL#6y*vb)KV5`S3vTG7tJ*)M@n!}|} z4e$T?hDcQ^mTgJF;0*i@qlKg=2y}A~rIk*wp3)niQ&gZHSZNbf(bgEyRejw+fBo9_ zaHl#rlqKXT5xdu@@Y-_fT-klnupa%+jI*zud%8muUL@m(`+ku%K<*_Z-$J2}lLqCa z5wf#142WaKFbv7Dm`ZH9Ab1pLzY=g9lkDB`+b@4yU4L2CzB9Iie`O3T=B=WLI|@tk zj}g2?U~YeQa90}ZwW0gjoy*Q4MNQ3!2o9dTcp*c{X`DZqmXXU?FNSm#PhM`!?b}vR zT_lwYML*-sIiD3wMnlDKyVHuo9*G|AsOvj8BJq}kjN4F{^uT?&xS`i;i|iL-*#@_Z z-jvuqYV6wwuXpGCr?boHN|;M$Ku_Jg0fV{e-0kz8-75{L=P?@_u0RzLVS01>MU-7= zI|K3%P}0GuMkqj_cVGCfi32D`{IoR(fFJF5_?#nc1Y1T((YyK;_+nKRR68A`v?3)@076kQ(1@PsU`Md##lPV))834nCz2f=8{HQE zg!~Vawgy7$=O2<(Mj1O+r6V9=(oYQtRCmoKM$8!+yHKcp^E$S?hGzp%(a=kR3ULPi zOx4hR1^Hgg;WQc8)LgQOV$QS3>zQk5UZXfv11k(28H-?pVz6Vv+y*NQ+2~XjJZPvS z3zc*B?`J4^RhdKU8h#p%2Gn6H^aUWy@Q&NVkm!^lvCYq;F)}GJIlo}7FN7|sgx-B0 zPx3TdNwW5DJ9(&%0{ncVb82PNo{NvHb<_Sa`@6=T&mo?cx@82K)oy#Yccit4S)XyI zMt(k-N!RSzq+mWoAsA{?II%M|-3WB-s}yN9uXCoE+|6<73P`&jN1MG=LXkjW`&5 z4?kc;kf#5%E`YV{hI90Y`vdSr1t+)t?|CN7O~!dZ;qEOHJR`vv*8wr|(^+nGdcaGNXt3*q6v`S6cH0xq|^yHEk;6v$AzJgGqYPvS1qTTmg2D-TV2yq~kea4IeEndfZl z=tJ~71e1d~8d{(le9x5hs*VJ4{-x0xL)CfU>Kn7v`BBtkENjtNQ8 zUt#UAJ-e9ooJ+-{S*AE-!W}Qz9Y=7W6A&4w`QCu((iE&ht8YZc(yK23ltRyc^Sg%N~r*-Z&#UQ ziVb%wSEvdGFO&yoBJE5a@MxKq{)crjD%w$QgYpIx*)6+)Def)Ce%>IX6c(3slbnp8 zU(5;mtqaYa&?4}Q>t0u*CP^aOkp-h?HR@Hv?ES@6M4yWA_fUQuvvtg2w`tNK9P@P~ zCohH~-IYCWN{~Je2JAZ-S0Uqre=|`@1u=b#PCS2D43CGm+xB+LFhp8HD2!pXVinTW zqYCKLW20Y#;PN1hP*0huKl!OBMxw|jQ;jXL*F6dnTEpxqx;VP>3YxJZU68Dvbft;@ zqo#oU5z-9fvP`9yXn|7hO}Q4#o#7@;Wf3m-3w zN9LAC+fN&OZc866W6zFLGSOG(}gs6JTna0DDne{bn9ZaeY-SAev1)d-lX{RxYd%p`8PYfbw|0Umw}9NJejy&>zu&(q8FcK2sOMib2xjLz>^nYS#AO4tP?x zuUp@^trtFPcN0K%Yexi`**D7=jPEuMHa4pHJPaE~uYz5N+g1hzn24SpUoTnSs&}j{ zShY=T)P%VJKE5&9tN?_Yf2`4HsHW3P7~7P%#AJUu)cS9?WV~=Z<7v;kOUV9m>vvad z@#|p%rCH$3=8LAe3FdLp$g(7^^ZSy&rso)`ifYsm+VHCBCI031iM%yrSvnSMB&jDl z>RD*I$-LYI6+gAbV|+so=w zRa}ljT#46qfXT`rdh~9!yJ-82<;ltkAKO$z8@it439DXKhsOr-z{iMEu`Zhy4U^|Kj3Cd`=_sHm ze4w$3;9Tn^7rzw&k|h#*uNV#90mTFy?aP^WSIiz$2z{4&k2*X-&XNwQ@dnIseq866 zC)%#begXDGvh!MYs6rkkuImq%sWn~qlmqFPbo6q?$hI!~l4<{4VhejfrXH0@ZP{?x zt?CY_5m{Bd4z>I%Qzk6my{o$)IpG5Cue?!W z?mKl~kCjJ$&PlOp8=t6>KDZ^i)O{b9>*4B=_C*kCBP+U2yeNlni=qF;3q;?FJESCl zNLq4Yf|ZSkB2AlKE!WQ^R4c(z6$*utxf1Mm7bSoUhkLpf-gJWz)_9C~~%5KYN&_yVYwDchAFJX@R;lJF@bKr@#zKyt=8yh1V zNhk1Y&6gh>@Y|BLhdv@c3bDiLr?FcOQJYhOKtxWcL0Iu7_^;dN$mcl+=zkgXnyHPo zcF0h-Ym2BB(@~zf^lQD|_S#nh+Mk~T+#Z5-K|k~x^rkmAWxaM!i!KVw#(R8ym#;uL zJJZ;XnXpb%r{K0!db#0{?7r+(57A#j&5mb<)-+E&{l$Xm9kye{DP7r`8?HAij^jzz z@s7PtBOf*EtGI%(Tb(`;ACH&#t`f5-G%g%=*)BNxofS|yn|YS_@JI8smtMp713(Eh3uUfWAtKj!R6t5p3xWjC(Zb3JYOZZ}3T zeg+us%zYYHi(Xw-d0Sye?Xc?){24c4#|Kb`*ZG3{h+TalMiZ*P1lEVIPe4ObLN}Bh zt?2jLNG+s=@Xj!!RE(y?j+T)ltysfI=%{`zCGhwzK+ead-JE(=^>Iw;_u0Pk+qE(X zrLp~M<^s<_PAwJvUeJ8wCVE>q(+hC7`V;opt>jU*pqxa|+QsRr>!gvo6u%CrASh*9 zhJA+NJqvUxcy55kKC*QN_goNrU{i2*0RWg+D!S9wFb` zv8;yXZKqkO|E1YcL%B27wZk=M?)cD~#bu(h>4GnpmPy_$Sh-=hqR?~Xb@c>l?Fh2? zv&%Ho!Xk`K0%fI3eew11wE&WQJo9Jj-{b5BqLMS!{sdJqt)L|>*tL8SVYR_vOWny# zzYQpm+UP%fG>1CkmEJNL(cek=JpYBaEANx^>nR`-#UVk}oQWq2FSz=<&>iRVqOxI- z10d|wE)catUxDZqr$)mR8g^48}=uw_fejY)tn zod~kumuGE#drIYh3?wI>v3I$~vH4ypNmpPaVmAPiwIiCh%5NPvDX2a%U;S_q^;)-h zRx8NRQ)a@#ZFr94WGAeqbu8*6Vv%A8PwVvVvP+x zs&w`}{rR$p?3OzKKiOZNxd{jIq%ro(@q%f&hM$#YEMtW&rIYBp7!q1N-4d<-L5IDZ;&05Y2knP zV_L@W;M;dEBBPV;v-4^OZC3wu7rbJtJtHUfz9fw#@%9+3NgNMi*Zww_>A>ug;hTg( zU7ydIO2v{%V3pV>9QAju(6Es{XU>-rGXp!_=Q`~-OoMl5C z8OL1@r(jDhQ-VC1D!NUe{snMcsKT|X|GWM~D)4*x)LpPH_RC3Pk*uw@E>C6T*9uC_ zo8a&IVOghhryL4}%C%NeA^kNNo^zFkzQNbD;^N}%;sHHxfsjH1cm*Zr`ik?75o|*y zb5*981aw(Fhzf;rb1)eFcoY)E9=_`R#raNtLU3HU1DaM>g%_?aL>inLQOt<{UPhqh z9=mnz%45B7E+D4fq5(N=d4$J?<26lJAuos85RxG&+MMyyP4oA5b|Wg=!w&|MqAqjj zl~YDYiU3*`q_{$mp(+IB%RErG!B+W~6>ZrN%k^KK z`|hqRSK4dHc(o)zHu&=DXSs5DkF(TyGk(y!yKF&Au4KH;&9!%44>%>goKzqM$*In(0B94@MX%F_*q zQaeYsQf1uD0$xWgWm;q9 z1Lp!KK=R)zl>Z#$VXza?<5hNGAZy}8X*Nam77G+p4yLUJzS=mFDe+A=SoAAJ?6?0f zJmEYQ+w7VkXMDOq^?<0? Windows Components > Store** | Turn off the Store application| Select **Enabled**| +| **Administrative Templates > Windows Components > Store** | Turn off the Store application| **Enabled**| [!INCLUDE [intune-settings-catalog-2](../../../includes/configure/intune-settings-catalog-2.md)] -Alternatively, you can configure devices using a [custom policy][INT-3] with the [Policy CSP][CSP-2]. +Alternatively, you can configure devices using a [custom policy][INT-1] with the [Policy CSP][CSP-1]. | Setting | |--| @@ -49,8 +49,7 @@ Alternatively, you can configure devices using a [custom policy][INT-3] with the When you prevent access to the Microsoft Store, users can't access the Store app. Here's a screenshot of the Store app when access is blocked: - -[CSP-2]: /windows/client-management/mdm/policy-csp-admx-credssp -[INT-3]: /mem/intune/configuration/settings-catalog +[CSP-1]: /windows/client-management/mdm/policy-csp-admx-windowsstore +[INT-1]: /mem/intune/configuration/settings-catalog diff --git a/windows/configuration/tips/manage-tips-and-suggestions.md b/windows/configuration/tips/manage-tips-and-suggestions.md deleted file mode 100644 index 41d0fa25af..0000000000 --- a/windows/configuration/tips/manage-tips-and-suggestions.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Manage Windows 10 and Microsoft Store tips, fun facts, and suggestions -description: Windows 10 provides organizations with various options to manage user experiences to provide a consistent and predictable experience for employees. -ms.topic: how-to -ms.date: 09/20/2017 ---- - -# Manage Windows 10 and Microsoft Store tips, fun fact and suggestions - -Windows includes user experience features that provide useful tips, "fun facts", and suggestions as you use Windows, and app suggestions from the Microsoft Store. These features are designed to help people get the most out of their Windows experience by, for example, sharing new features, providing more details on the features they use, or sharing content available in the Microsoft Store. Examples of such user experiences include: - -* **Windows Spotlight on the lock screen**: Daily updated images on the lock screen that can include more facts and tips in "hotspots" that are revealed on hover. -* **Start menu app suggestions**: App suggestions in Start that recommend productivity tool or utilities from the Microsoft Store. -* **Additional apps on Start**: More apps preinstalled on the Start screen, which can enhance the user's experience. -* **Windows tips**: Contextual tips that appear based on specific user actions to reveal related Windows features or help users complete a scenario. -* **Microsoft account notifications**: For users who have a connected Microsoft account, toast notifications about their account like parental control notifications or subscription expiration. - ->[!TIP] -> On all Windows desktop editions, users can directly enable and disable Windows tips, "fun facts", and suggestions and Microsoft Store suggestions. For example, users are able to select personal photos for the lock screen as opposed to the images provided by Microsoft, or turn off tips, "fun facts", or suggestions as they use Windows. - -Windows 10 provides organizations the ability to centrally manage the type of content provided by these features through Group Policy or mobile device management (MDM). The following table describes how administrators can manage suggestions and tips in Windows 10 commercial and education editions. - -## Options available to manage Windows 10 tips and "fun facts" and Microsoft Store suggestions - -| Windows 10 edition | Disable | Show Microsoft apps only | Show Microsoft and popular third-party apps | -|--|--|--|--| -| Windows 10 Pro | No | Yes | Yes (default) | -| Windows 10 Enterprise | Yes | Yes | Yes (default) | -| Windows 10 Pro Education | Yes (default) | Yes | No (setting can't be changed) | -| Windows 10 Education | Yes (default) | Yes | No (setting can't be changed) | - -[Learn more about policy settings for Windows Spotlight.](../lock-screen/windows-spotlight.md) diff --git a/windows/configuration/toc.yml b/windows/configuration/toc.yml index c95d3d3c20..e1ddf72a85 100644 --- a/windows/configuration/toc.yml +++ b/windows/configuration/toc.yml @@ -17,8 +17,6 @@ items: href: store/index.md - name: Find the AUMID of an installed app href: store/find-aumid.md - - name: Manage Microsoft Store tips, "fun facts", and suggestions - href: tips/manage-tips-and-suggestions.md - name: Cellular settings href: cellular/provisioning-apn.md - name: Kiosks and restricted user experiences From 310d3559d6024457b5d8d72fa62cf3aefcb44c66 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 12 Mar 2024 16:32:20 -0400 Subject: [PATCH 10/34] Update redirection URLs in windows-configuration.json --- .openpublishing.redirection.windows-configuration.json | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/.openpublishing.redirection.windows-configuration.json b/.openpublishing.redirection.windows-configuration.json index d3f2f32f68..88e7d94d90 100644 --- a/.openpublishing.redirection.windows-configuration.json +++ b/.openpublishing.redirection.windows-configuration.json @@ -432,7 +432,7 @@ }, { "source_path": "windows/configuration/stop-employees-from-using-microsoft-store.md", - "redirect_url": "/windows/configuration/store/stop-employees-from-using-microsoft-store", + "redirect_url": "/windows/configuration/store", "redirect_document_id": false }, { @@ -841,14 +841,9 @@ "redirect_document_id": false }, { - "source_path": "/windows/configuration/tips/manage-tips-and-suggestions.md", + "source_path": "windows/configuration/tips/manage-tips-and-suggestions.md", "redirect_url": "/windows/configuration", "redirect_document_id": false - }, - { - "source_path": "windows/configuration/stop-employees-from-using-microsoft-store.md", - "redirect_url": "/windows/configuration/store", - "redirect_document_id": false } ] } \ No newline at end of file From f321b1888fadd52f477077c3fe5a004ebc837465 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 12 Mar 2024 16:39:40 -0400 Subject: [PATCH 11/34] Update Microsoft Store configuration --- windows/configuration/store/index.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/configuration/store/index.md b/windows/configuration/store/index.md index 0b4e2ced83..0e34c6c7ab 100644 --- a/windows/configuration/store/index.md +++ b/windows/configuration/store/index.md @@ -1,19 +1,19 @@ --- -title: Configure access to the Microsoft Store -description: Learn how to configure access to the Microsoft Store. +title: Configure access to Microsoft Store +description: Learn how to configure access to the Microsoft Store app. ms.topic: how-to ms.date: 03/12/2024 --- -# Configure access to the Microsoft Store +# Configure access to Microsoft Store -Microsoft Store is a digital distribution platform that provides a way for the users to install applications on Windows devices. Organizations that manage Windows devices can configure access to Microsoft Store for devices in their organization. For some organizations, business policies require blocking access to Microsoft Store. +Microsoft Store is a digital distribution platform that provides a way for users to install applications on Windows devices. For some organizations, business policies require blocking access to Microsoft Store. This article describes how to configure access to the Microsoft Store app in your organization. -## Prevent access to the Microsoft Store +## Prevent access to the Microsoft Store app -You can use configuration service provider (CSP) or group policy (GPO) settings to configure access to Microsoft Store. The CSP configuration is available to Windows Enterprise and Education editions only. +You can use configuration service provider (CSP) or group policy (GPO) settings to configure access to the Microsoft Store app. The CSP configuration is available to Windows Enterprise and Education editions only. [!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] From 7e5141abfaf47b8f3c0d22269ba1d6a4ea735e2f Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 12 Mar 2024 16:42:26 -0400 Subject: [PATCH 12/34] Update Microsoft Store configuration and fix typo in TOC --- windows/configuration/store/index.md | 2 ++ windows/configuration/toc.yml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/configuration/store/index.md b/windows/configuration/store/index.md index 0e34c6c7ab..4b39cca8b3 100644 --- a/windows/configuration/store/index.md +++ b/windows/configuration/store/index.md @@ -49,6 +49,8 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the When you prevent access to the Microsoft Store, users can't access the Store app. Here's a screenshot of the Store app when access is blocked: +:::image type="content" source="images/store-blocked.png" alt-text="Screenshot of the Microsoft Store app blocked access."::: + [CSP-1]: /windows/client-management/mdm/policy-csp-admx-windowsstore diff --git a/windows/configuration/toc.yml b/windows/configuration/toc.yml index e1ddf72a85..25256515be 100644 --- a/windows/configuration/toc.yml +++ b/windows/configuration/toc.yml @@ -13,7 +13,7 @@ items: href: lock-screen/windows-spotlight.md - name: Microsoft Store items: - - name: Configure access to the Microsoft Store + - name: Configure access to Microsoft Store href: store/index.md - name: Find the AUMID of an installed app href: store/find-aumid.md From bef22534385dfb8a4f030d45ffbbde95e6464c95 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 13 Mar 2024 08:10:20 -0400 Subject: [PATCH 13/34] Update Microsoft Store configuration --- windows/configuration/store/index.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/windows/configuration/store/index.md b/windows/configuration/store/index.md index 4b39cca8b3..b615d7fb80 100644 --- a/windows/configuration/store/index.md +++ b/windows/configuration/store/index.md @@ -1,16 +1,24 @@ --- -title: Configure access to Microsoft Store +title: Configure access to the Microsoft Store app description: Learn how to configure access to the Microsoft Store app. ms.topic: how-to -ms.date: 03/12/2024 +ms.date: 03/13/2024 --- -# Configure access to Microsoft Store +# Configure access to the Microsoft Store app Microsoft Store is a digital distribution platform that provides a way for users to install applications on Windows devices. For some organizations, business policies require blocking access to Microsoft Store. This article describes how to configure access to the Microsoft Store app in your organization. +## Considerations + +Here are some considerations when if you prevent access to the Microsoft Store app: + +- Store applications keep updating automatically, by default +- Users might still be able to install applications using Windows Package Manager (winget), or other methods, if they don't need to acquire the package from Microsoft Store +- Devices managed by Microsoft Intune can still install applications sourced from Microsoft Store, even if you block access to the Microsoft Store app. To learn more, see [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps-microsoft) + ## Prevent access to the Microsoft Store app You can use configuration service provider (CSP) or group policy (GPO) settings to configure access to the Microsoft Store app. The CSP configuration is available to Windows Enterprise and Education editions only. @@ -47,7 +55,7 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the ## User experience -When you prevent access to the Microsoft Store, users can't access the Store app. Here's a screenshot of the Store app when access is blocked: +When you turn off the Microsoft Store application, users get the following message when they open it: :::image type="content" source="images/store-blocked.png" alt-text="Screenshot of the Microsoft Store app blocked access."::: From a86fd5c7ca03e5db2ab685d8871b08800e4f8f58 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 13 Mar 2024 08:17:22 -0400 Subject: [PATCH 14/34] Update Microsoft Store configuration documentation --- windows/configuration/store/index.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/windows/configuration/store/index.md b/windows/configuration/store/index.md index b615d7fb80..5a68b21262 100644 --- a/windows/configuration/store/index.md +++ b/windows/configuration/store/index.md @@ -11,14 +11,6 @@ Microsoft Store is a digital distribution platform that provides a way for users This article describes how to configure access to the Microsoft Store app in your organization. -## Considerations - -Here are some considerations when if you prevent access to the Microsoft Store app: - -- Store applications keep updating automatically, by default -- Users might still be able to install applications using Windows Package Manager (winget), or other methods, if they don't need to acquire the package from Microsoft Store -- Devices managed by Microsoft Intune can still install applications sourced from Microsoft Store, even if you block access to the Microsoft Store app. To learn more, see [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps-microsoft) - ## Prevent access to the Microsoft Store app You can use configuration service provider (CSP) or group policy (GPO) settings to configure access to the Microsoft Store app. The CSP configuration is available to Windows Enterprise and Education editions only. @@ -59,7 +51,16 @@ When you turn off the Microsoft Store application, users get the following messa :::image type="content" source="images/store-blocked.png" alt-text="Screenshot of the Microsoft Store app blocked access."::: +## Considerations + +Here are some considerations when you prevent access to the Microsoft Store app: + +- Microsoft Store applications keep updating automatically, by default +- Users might still be able to install applications using Windows Package Manager (winget), or other methods, if they don't need to acquire the package from Microsoft Store +- Devices managed by Microsoft Intune can still install applications sourced from Microsoft Store, even if you block access to the Microsoft Store app. To learn more, see [Add Microsoft Store apps to Microsoft Intune][INT-2] + [CSP-1]: /windows/client-management/mdm/policy-csp-admx-windowsstore [INT-1]: /mem/intune/configuration/settings-catalog +[INT-2]: /mem/intune/apps/store-apps-microsoft From 3ab221507b890a36c48646fdc2aad61e228072c3 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 13 Mar 2024 08:28:31 -0400 Subject: [PATCH 15/34] Add redirection for stopping employees from using Microsoft Store --- .openpublishing.redirection.windows-configuration.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.openpublishing.redirection.windows-configuration.json b/.openpublishing.redirection.windows-configuration.json index 88e7d94d90..d68a51ee9f 100644 --- a/.openpublishing.redirection.windows-configuration.json +++ b/.openpublishing.redirection.windows-configuration.json @@ -435,6 +435,11 @@ "redirect_url": "/windows/configuration/store", "redirect_document_id": false }, + { + "source_path": "windows/configuration/store/stop-employees-from-using-microsoft-store.md", + "redirect_url": "/windows/configuration/store", + "redirect_document_id": false + }, { "source_path": "windows/configuration/supported-csp-start-menu-layout-windows.md", "redirect_url": "/windows/configuration/start/supported-csp-start-menu-layout-windows", From 26caa2ce8f3a9d758535158e7582e56d163f927c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 13 Mar 2024 14:25:21 -0400 Subject: [PATCH 16/34] Update Microsoft Store app blocked access screenshot --- windows/configuration/store/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/store/index.md b/windows/configuration/store/index.md index 5a68b21262..09c92aea0f 100644 --- a/windows/configuration/store/index.md +++ b/windows/configuration/store/index.md @@ -49,7 +49,7 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the When you turn off the Microsoft Store application, users get the following message when they open it: -:::image type="content" source="images/store-blocked.png" alt-text="Screenshot of the Microsoft Store app blocked access."::: +:::image type="content" source="images/store-blocked.png" alt-text="Screenshot of the Microsoft Store app blocked access." border="false"::: ## Considerations From 6217e6650e17bbd945a63cf190aaae8f5014214b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 13 Mar 2024 15:02:56 -0400 Subject: [PATCH 17/34] Remove unused event log filter code --- .../assigned-access/includes/quickstart-kiosk-ps.md | 5 ----- .../includes/quickstart-restricted-experience-ps.md | 10 ---------- 2 files changed, 15 deletions(-) diff --git a/windows/configuration/assigned-access/includes/quickstart-kiosk-ps.md b/windows/configuration/assigned-access/includes/quickstart-kiosk-ps.md index 961d33806c..4f5ce43c2e 100644 --- a/windows/configuration/assigned-access/includes/quickstart-kiosk-ps.md +++ b/windows/configuration/assigned-access/includes/quickstart-kiosk-ps.md @@ -24,11 +24,6 @@ $assignedAccessConfiguration = @" "@ -$eventLogFilterHashTable = @{ - ProviderName = "Microsoft-Windows-AssignedAccess"; - StartTime = Get-Date -Millisecond 0 -} - $namespaceName="root\cimv2\mdm\dmmap" $className="MDM_AssignedAccess" $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className diff --git a/windows/configuration/assigned-access/includes/quickstart-restricted-experience-ps.md b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-ps.md index 48b5655a82..35a15c446f 100644 --- a/windows/configuration/assigned-access/includes/quickstart-restricted-experience-ps.md +++ b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-ps.md @@ -62,11 +62,6 @@ $assignedAccessConfiguration = @" "@ -$eventLogFilterHashTable = @{ - ProviderName = "Microsoft-Windows-AssignedAccess"; - StartTime = Get-Date -Millisecond 0 -} - $namespaceName="root\cimv2\mdm\dmmap" $className="MDM_AssignedAccess" $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className @@ -124,11 +119,6 @@ $assignedAccessConfiguration = @" "@ -$eventLogFilterHashTable = @{ - ProviderName = "Microsoft-Windows-AssignedAccess"; - StartTime = Get-Date -Millisecond 0 -} - $namespaceName="root\cimv2\mdm\dmmap" $className="MDM_AssignedAccess" $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className From 78ea6aa00821ee7b53c750b61ca6e1c7dc91c027 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Wed, 13 Mar 2024 13:00:11 -0700 Subject: [PATCH 18/34] Updated policy limit information to reflect current state. Fixed acrolinx issues --- .../design/deploy-multiple-wdac-policies.md | 28 ++++++++----------- .../operations/known-issues.md | 23 +++++++-------- 2 files changed, 22 insertions(+), 29 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md b/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md index 1d76e0e5a9..b9655217a3 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md @@ -2,7 +2,7 @@ title: Use multiple Windows Defender Application Control Policies description: Windows Defender Application Control supports multiple code integrity policies for one device. ms.localizationpriority: medium -ms.date: 07/19/2021 +ms.date: 03/13/2024 ms.topic: article --- @@ -11,17 +11,19 @@ ms.topic: article >[!NOTE] >Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). -Prior to Windows 10 1903, Windows Defender Application Control only supported a single active policy on a system at any given time. This limited customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports up to 32 active policies on a device at once in order to enable the following scenarios: +Beginning with Windows 10 version 1903 and Windows Server 2022, you can deploy multiple Windows Defender Application Control (WDAC) policies side-by-side on a device. To allow more than 32 active policies, install the Windows security update released on, or after, March 12, 2024 and then restart the device. With these updates, there's no limit for the number of policies you can deploy at once to a given device. Until you install the Windows security update released on or after March 12, 2024, your device is limited to 32 active policies and you must not exceed that number. + +Here are some common scenarios where multiple side-by-side policies are useful: 1. Enforce and Audit Side-by-Side - To validate policy changes before deploying in enforcement mode, users can now deploy an audit-mode base policy side by side with an existing enforcement-mode base policy 2. Multiple Base Policies - Users can enforce two or more base policies simultaneously in order to allow simpler policy targeting for policies with different scope/intent - - If two base policies exist on a device, an application has to be allowed by both to run + - If two base policies exist on a device, an application must pass both policies for it to run 3. Supplemental Policies - Users can deploy one or more supplemental policies to expand a base policy - A supplemental policy expands a single base policy, and multiple supplemental policies can expand the same base policy - - For supplemental policies, applications that are allowed by either the base policy or its supplemental policy/policies are allowed to run + - For supplemental policies, applications allowed by either the base policy or its supplemental policy/policies run > [!NOTE] > Pre-1903 systems do not support the use of Multiple Policy Format WDAC policies. @@ -31,11 +33,11 @@ Prior to Windows 10 1903, Windows Defender Application Control only supported a - Multiple base policies: intersection - Only applications allowed by both policies run without generating block events - Base + supplemental policy: union - - Files that are allowed by either the base policy or the supplemental policy aren't blocked + - Files allowed by either the base policy or the supplemental policy run ## Creating WDAC policies in Multiple Policy Format -In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below example describes the process of creating a new policy in the multiple policy format. +In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique values generated for the policy ID and 2) the policy type set as a Base policy. The below example describes the process of creating a new policy in the multiple policy format. ```powershell New-CIPolicy -MultiplePolicyFormat -ScanPath "" -UserPEs -FilePath ".\policy.xml" -Level FilePublisher -Fallback SignedVersion,Publisher,Hash @@ -55,7 +57,7 @@ Add-SignerRule -FilePath ".\policy.xml" -CertificatePath [-K ### Supplemental policy creation -In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format as shown above. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy. +In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format as shown earlier. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy. - "SupplementsBasePolicyID": GUID of base policy that the supplemental policy applies to - "BasePolicyToSupplementPath": path to base policy file that the supplemental policy applies to @@ -66,11 +68,11 @@ Set-CIPolicyIdInfo -FilePath ".\supplemental_policy.xml" [-SupplementsBasePolicy ### Merging policies -When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy will be a base policy with ID \. +When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy is a base policy with ID \. ## Deploying multiple policies -In order to deploy multiple Windows Defender Application Control policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP, which is supported by Microsoft Intune's custom OMA-URI feature. +In order to deploy multiple Windows Defender Application Control policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP. ### Deploying multiple policies locally @@ -86,15 +88,9 @@ To deploy policies locally using the new multiple policy format, follow these st Multiple Windows Defender Application Control policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment.
-However, when policies are unenrolled from an MDM server, the CSP will attempt to remove every policy from devices, not just the policies added by the CSP. The reason for this is that the ApplicationControl CSP doesn't track enrollment sources for individual policies, even though it will query all policies on a device, regardless if they were deployed by the CSP. +However, when policies are unenrolled from an MDM server, the CSP attempts to remove every policy not actively deployed, not just the policies added by the CSP. This behavior happens because the system doesn't know what deployment methods were used to apply individual policies. For more information on deploying multiple policies, optionally using Microsoft Intune's custom OMA-URI capability, see [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp). > [!NOTE] > WMI and GP do not currently support multiple policies. Instead, customers who cannot directly access the MDM stack should use the [ApplicationControl CSP via the MDM Bridge WMI Provider](/windows/client-management/mdm/applicationcontrol-csp#powershell-and-wmi-bridge-usage-guidance) to manage Multiple Policy Format Windows Defender Application Control policies. - -### Known Issues in Multiple Policy Format - -* If the maximum number of policies is exceeded, the device may bluescreen referencing ci.dll with a bug check value of 0x0000003b. -* If policies are loaded without requiring a reboot such as `PS_UpdateAndCompareCIPolicy`, they will still count towards this limit. -* This may pose an especially large challenge if the value of `{PolicyGUID}.cip` changes between releases. It may result in a long window between a change and the resultant reboot. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md index 91af264958..fbccba4c71 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md @@ -2,7 +2,7 @@ title: WDAC Admin Tips & Known Issues description: WDAC Known Issues ms.manager: jsuther -ms.date: 11/22/2023 +ms.date: 03/13/2024 ms.topic: article ms.localizationpriority: medium --- @@ -43,32 +43,28 @@ When the WDAC engine evaluates files against the active set of policies on the d 4. Lastly, WDAC makes a cloud call to the ISG to get reputation about the file, if the policy enables the ISG option. -5. If no explicit rule exists for the file and it's not allowed based on ISG or MI, then the file is blocked implicitly. +5. Any file not allowed by an explicit rule or based on ISG or MI is blocked implicitly. ## Known issues ### Boot stop failure (blue screen) occurs if more than 32 policies are active -If the maximum number of policies is exceeded, the device will bluescreen referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. +Until you apply the Windows security update released on or after March 12, 2024, your device is limited to 32 active policies. If the maximum number of policies is exceeded, the device bluescreens referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. To remove the maximum policy limit, install the Windows security update released on, or after, March 12, 2024 and then restart the device. Otherwise, reduce the number of policies on the device to remain below 32 policies. ### Audit mode policies can change the behavior for some apps or cause app crashes -Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that includes the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode: +Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that turns on user mode code integrity (UMCI) with the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode: - Some script hosts might block code or run code with fewer privileges even in audit mode. See [Script enforcement with WDAC](/windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement) for information about individual script host behaviors. - Option **19 Enabled:Dynamic Code Security** is always enforced if any UMCI policy includes that option. See [WDAC and .NET](/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet#wdac-and-net-hardening). -### Managed Installer and ISG may cause excessive events - -When Managed Installer and ISG are enabled, 3091 and 3092 events are logged when a file didn't have Managed Installer or ISG authorization, regardless of whether the file was allowed. These events were moved to the verbose channel beginning with the September 2022 Update Preview since the events don't indicate an issue with the policy. - ### .NET native images may generate false positive block events In some cases, the code integrity logs where Windows Defender Application Control errors and warnings are written include error events for native images generated for .NET assemblies. Typically, native image blocks are functionally benign as a blocked native image falls back to its corresponding assembly and .NET regenerates the native image at its next scheduled maintenance window. ### Signatures using elliptical curve cryptography (ECC) aren't supported -WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If you try to allow files by signature based on ECC signatures, you'll see VerificationError = 23 on the corresponding 3089 signature information events. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA. +WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If WDAC blocks a file based on ECC signatures, the corresponding 3089 signature information events show VerificationError = 23. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA. ### MSI installers are treated as user writeable on Windows 10 when allowed by FilePath rule @@ -88,18 +84,19 @@ As a workaround, download the MSI file and run it locally: ```console msiexec -i c:\temp\Windows10_Version_1511_ADMX.msi ``` + ### Slow boot and performance with custom policies -WDAC evaluates all processes that run, including inbox Windows processes. If policies don't build off the WDAC templates or don't trust the Windows signers, you'll see slower boot times, degraded performance and possibly boot issues. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies. +WDAC evaluates all processes that run, including inbox Windows processes. You can cause slower boot times, degraded performance, and possibly boot issues if your policies don't build upon the WDAC templates or don't trust the Windows signers. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies. #### AppId Tagging policy considerations -If the AppId Tagging Policy wasn't built off the WDAC base templates or doesn't allow the Windows in-box signers, you'll notice a significant increase in boot times (~2 minutes). +AppId Tagging policies that aren't built upon the WDAC base templates or don't allow the Windows in-box signers might cause a significant increase in boot times (~2 minutes). -If you can't allowlist the Windows signers, or build off the WDAC base templates, it's recommended to add the following rule to your policies to improve the performance: +If you can't allowlist the Windows signers or build off the WDAC base templates, add the following rule to your policies to improve the performance: :::image type="content" source="../images/known-issue-appid-dll-rule.png" alt-text="Allow all dlls in the policy."::: :::image type="content" source="../images/known-issue-appid-dll-rule-xml.png" alt-text="Allow all dll files in the xml policy."::: -Since AppId Tagging policies evaluate but can't tag dll files, this rule will short circuit dll evaluation and improve evaluation performance. +Since AppId Tagging policies evaluate but can't tag dll files, this rule short circuits dll evaluation and improve evaluation performance. From 0ac830ce2c22b52211ba83f1cb99e83588ac4a66 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 13 Mar 2024 14:42:05 -0700 Subject: [PATCH 19/34] fresh-w11reqs-8823084 --- windows/whats-new/windows-11-requirements.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/windows/whats-new/windows-11-requirements.md b/windows/whats-new/windows-11-requirements.md index d2de462f2e..62733bd8d1 100644 --- a/windows/whats-new/windows-11-requirements.md +++ b/windows/whats-new/windows-11-requirements.md @@ -11,7 +11,7 @@ ms.collection: - highpri - tier1 ms.subservice: itpro-fundamentals -ms.date: 02/13/2023 +ms.date: 03/13/2024 appliesto: - ✅ Windows 11 @@ -120,10 +120,8 @@ The following configuration requirements apply to VMs running Windows 11. ## Next steps +- [What's new in Windows 11](/windows/whats-new/windows-11-overview) - [Plan for Windows 11](windows-11-plan.md) - [Prepare for Windows 11](windows-11-prepare.md) - -## See also - - [Windows minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview) -- [What's new in Windows 11 overview](/windows/whats-new/windows-11-overview) + From a5c80d75cca3e43e1251f35ae71ee0187263509e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 14 Mar 2024 06:56:40 -0400 Subject: [PATCH 20/34] Update redirection for assigned access configuration file --- .openpublishing.redirection.windows-configuration.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.openpublishing.redirection.windows-configuration.json b/.openpublishing.redirection.windows-configuration.json index d68a51ee9f..17fa02cbec 100644 --- a/.openpublishing.redirection.windows-configuration.json +++ b/.openpublishing.redirection.windows-configuration.json @@ -756,8 +756,8 @@ "redirect_document_id": false }, { - "source_path": "windows/configuration/kiosk/lock-down-windows-11-to-specific-apps.md", - "redirect_url": "/windows/configuration/assigned-access/create-xml", + "source_path": "windows/configuration/assigned-access/create-xml.md", + "redirect_url": "/windows/configuration/assigned-access/configuration-file", "redirect_document_id": false }, { From 7c9836161f08f7e43c6c6b24297046779bc06d36 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 14 Mar 2024 07:04:55 -0400 Subject: [PATCH 21/34] Add redirection for lock-down-windows-11-to-specific-apps.md --- .openpublishing.redirection.windows-configuration.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.openpublishing.redirection.windows-configuration.json b/.openpublishing.redirection.windows-configuration.json index 17fa02cbec..b4526996f1 100644 --- a/.openpublishing.redirection.windows-configuration.json +++ b/.openpublishing.redirection.windows-configuration.json @@ -760,6 +760,11 @@ "redirect_url": "/windows/configuration/assigned-access/configuration-file", "redirect_document_id": false }, + { + "source_path": "windows/configuration/kiosk/lock-down-windows-11-to-specific-apps.md", + "redirect_url": "/windows/configuration/assigned-access/configuration-file", + "redirect_document_id": false + }, { "source_path": "windows/configuration/kiosk/kiosk-additional-reference.md", "redirect_url": "/windows/configuration/assigned-access", From 19377758673e71db9440cff844f82beb428f84d8 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Thu, 14 Mar 2024 09:34:25 -0700 Subject: [PATCH 22/34] =?UTF-8?q?Revert=20"Updated=20policy=20limit=20info?= =?UTF-8?q?rmation=20to=20reflect=20current=20state.=20Fixed=20acro?= =?UTF-8?q?=E2=80=A6"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../design/deploy-multiple-wdac-policies.md | 28 +++++++++++-------- .../operations/known-issues.md | 23 ++++++++------- 2 files changed, 29 insertions(+), 22 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md b/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md index b9655217a3..1d76e0e5a9 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md @@ -2,7 +2,7 @@ title: Use multiple Windows Defender Application Control Policies description: Windows Defender Application Control supports multiple code integrity policies for one device. ms.localizationpriority: medium -ms.date: 03/13/2024 +ms.date: 07/19/2021 ms.topic: article --- @@ -11,19 +11,17 @@ ms.topic: article >[!NOTE] >Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). -Beginning with Windows 10 version 1903 and Windows Server 2022, you can deploy multiple Windows Defender Application Control (WDAC) policies side-by-side on a device. To allow more than 32 active policies, install the Windows security update released on, or after, March 12, 2024 and then restart the device. With these updates, there's no limit for the number of policies you can deploy at once to a given device. Until you install the Windows security update released on or after March 12, 2024, your device is limited to 32 active policies and you must not exceed that number. - -Here are some common scenarios where multiple side-by-side policies are useful: +Prior to Windows 10 1903, Windows Defender Application Control only supported a single active policy on a system at any given time. This limited customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports up to 32 active policies on a device at once in order to enable the following scenarios: 1. Enforce and Audit Side-by-Side - To validate policy changes before deploying in enforcement mode, users can now deploy an audit-mode base policy side by side with an existing enforcement-mode base policy 2. Multiple Base Policies - Users can enforce two or more base policies simultaneously in order to allow simpler policy targeting for policies with different scope/intent - - If two base policies exist on a device, an application must pass both policies for it to run + - If two base policies exist on a device, an application has to be allowed by both to run 3. Supplemental Policies - Users can deploy one or more supplemental policies to expand a base policy - A supplemental policy expands a single base policy, and multiple supplemental policies can expand the same base policy - - For supplemental policies, applications allowed by either the base policy or its supplemental policy/policies run + - For supplemental policies, applications that are allowed by either the base policy or its supplemental policy/policies are allowed to run > [!NOTE] > Pre-1903 systems do not support the use of Multiple Policy Format WDAC policies. @@ -33,11 +31,11 @@ Here are some common scenarios where multiple side-by-side policies are useful: - Multiple base policies: intersection - Only applications allowed by both policies run without generating block events - Base + supplemental policy: union - - Files allowed by either the base policy or the supplemental policy run + - Files that are allowed by either the base policy or the supplemental policy aren't blocked ## Creating WDAC policies in Multiple Policy Format -In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique values generated for the policy ID and 2) the policy type set as a Base policy. The below example describes the process of creating a new policy in the multiple policy format. +In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below example describes the process of creating a new policy in the multiple policy format. ```powershell New-CIPolicy -MultiplePolicyFormat -ScanPath "" -UserPEs -FilePath ".\policy.xml" -Level FilePublisher -Fallback SignedVersion,Publisher,Hash @@ -57,7 +55,7 @@ Add-SignerRule -FilePath ".\policy.xml" -CertificatePath [-K ### Supplemental policy creation -In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format as shown earlier. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy. +In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format as shown above. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy. - "SupplementsBasePolicyID": GUID of base policy that the supplemental policy applies to - "BasePolicyToSupplementPath": path to base policy file that the supplemental policy applies to @@ -68,11 +66,11 @@ Set-CIPolicyIdInfo -FilePath ".\supplemental_policy.xml" [-SupplementsBasePolicy ### Merging policies -When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy is a base policy with ID \. +When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy will be a base policy with ID \. ## Deploying multiple policies -In order to deploy multiple Windows Defender Application Control policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP. +In order to deploy multiple Windows Defender Application Control policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP, which is supported by Microsoft Intune's custom OMA-URI feature. ### Deploying multiple policies locally @@ -88,9 +86,15 @@ To deploy policies locally using the new multiple policy format, follow these st Multiple Windows Defender Application Control policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment.
-However, when policies are unenrolled from an MDM server, the CSP attempts to remove every policy not actively deployed, not just the policies added by the CSP. This behavior happens because the system doesn't know what deployment methods were used to apply individual policies. +However, when policies are unenrolled from an MDM server, the CSP will attempt to remove every policy from devices, not just the policies added by the CSP. The reason for this is that the ApplicationControl CSP doesn't track enrollment sources for individual policies, even though it will query all policies on a device, regardless if they were deployed by the CSP. For more information on deploying multiple policies, optionally using Microsoft Intune's custom OMA-URI capability, see [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp). > [!NOTE] > WMI and GP do not currently support multiple policies. Instead, customers who cannot directly access the MDM stack should use the [ApplicationControl CSP via the MDM Bridge WMI Provider](/windows/client-management/mdm/applicationcontrol-csp#powershell-and-wmi-bridge-usage-guidance) to manage Multiple Policy Format Windows Defender Application Control policies. + +### Known Issues in Multiple Policy Format + +* If the maximum number of policies is exceeded, the device may bluescreen referencing ci.dll with a bug check value of 0x0000003b. +* If policies are loaded without requiring a reboot such as `PS_UpdateAndCompareCIPolicy`, they will still count towards this limit. +* This may pose an especially large challenge if the value of `{PolicyGUID}.cip` changes between releases. It may result in a long window between a change and the resultant reboot. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md index fbccba4c71..91af264958 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md @@ -2,7 +2,7 @@ title: WDAC Admin Tips & Known Issues description: WDAC Known Issues ms.manager: jsuther -ms.date: 03/13/2024 +ms.date: 11/22/2023 ms.topic: article ms.localizationpriority: medium --- @@ -43,28 +43,32 @@ When the WDAC engine evaluates files against the active set of policies on the d 4. Lastly, WDAC makes a cloud call to the ISG to get reputation about the file, if the policy enables the ISG option. -5. Any file not allowed by an explicit rule or based on ISG or MI is blocked implicitly. +5. If no explicit rule exists for the file and it's not allowed based on ISG or MI, then the file is blocked implicitly. ## Known issues ### Boot stop failure (blue screen) occurs if more than 32 policies are active -Until you apply the Windows security update released on or after March 12, 2024, your device is limited to 32 active policies. If the maximum number of policies is exceeded, the device bluescreens referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. To remove the maximum policy limit, install the Windows security update released on, or after, March 12, 2024 and then restart the device. Otherwise, reduce the number of policies on the device to remain below 32 policies. +If the maximum number of policies is exceeded, the device will bluescreen referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. ### Audit mode policies can change the behavior for some apps or cause app crashes -Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that turns on user mode code integrity (UMCI) with the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode: +Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that includes the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode: - Some script hosts might block code or run code with fewer privileges even in audit mode. See [Script enforcement with WDAC](/windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement) for information about individual script host behaviors. - Option **19 Enabled:Dynamic Code Security** is always enforced if any UMCI policy includes that option. See [WDAC and .NET](/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet#wdac-and-net-hardening). +### Managed Installer and ISG may cause excessive events + +When Managed Installer and ISG are enabled, 3091 and 3092 events are logged when a file didn't have Managed Installer or ISG authorization, regardless of whether the file was allowed. These events were moved to the verbose channel beginning with the September 2022 Update Preview since the events don't indicate an issue with the policy. + ### .NET native images may generate false positive block events In some cases, the code integrity logs where Windows Defender Application Control errors and warnings are written include error events for native images generated for .NET assemblies. Typically, native image blocks are functionally benign as a blocked native image falls back to its corresponding assembly and .NET regenerates the native image at its next scheduled maintenance window. ### Signatures using elliptical curve cryptography (ECC) aren't supported -WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If WDAC blocks a file based on ECC signatures, the corresponding 3089 signature information events show VerificationError = 23. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA. +WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If you try to allow files by signature based on ECC signatures, you'll see VerificationError = 23 on the corresponding 3089 signature information events. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA. ### MSI installers are treated as user writeable on Windows 10 when allowed by FilePath rule @@ -84,19 +88,18 @@ As a workaround, download the MSI file and run it locally: ```console msiexec -i c:\temp\Windows10_Version_1511_ADMX.msi ``` - ### Slow boot and performance with custom policies -WDAC evaluates all processes that run, including inbox Windows processes. You can cause slower boot times, degraded performance, and possibly boot issues if your policies don't build upon the WDAC templates or don't trust the Windows signers. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies. +WDAC evaluates all processes that run, including inbox Windows processes. If policies don't build off the WDAC templates or don't trust the Windows signers, you'll see slower boot times, degraded performance and possibly boot issues. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies. #### AppId Tagging policy considerations -AppId Tagging policies that aren't built upon the WDAC base templates or don't allow the Windows in-box signers might cause a significant increase in boot times (~2 minutes). +If the AppId Tagging Policy wasn't built off the WDAC base templates or doesn't allow the Windows in-box signers, you'll notice a significant increase in boot times (~2 minutes). -If you can't allowlist the Windows signers or build off the WDAC base templates, add the following rule to your policies to improve the performance: +If you can't allowlist the Windows signers, or build off the WDAC base templates, it's recommended to add the following rule to your policies to improve the performance: :::image type="content" source="../images/known-issue-appid-dll-rule.png" alt-text="Allow all dlls in the policy."::: :::image type="content" source="../images/known-issue-appid-dll-rule-xml.png" alt-text="Allow all dll files in the xml policy."::: -Since AppId Tagging policies evaluate but can't tag dll files, this rule short circuits dll evaluation and improve evaluation performance. +Since AppId Tagging policies evaluate but can't tag dll files, this rule will short circuit dll evaluation and improve evaluation performance. From 33e99cfac54e75f7bd58eef00525e31ef3b80656 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 14 Mar 2024 09:51:30 -0700 Subject: [PATCH 23/34] Update windows/whats-new/deprecated-features.md update date --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index b7a5a042d1..4b4df97331 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 03/11/2024 +ms.date: 03/14/2024 ms.service: windows-client ms.subservice: itpro-fundamentals ms.localizationpriority: medium From 2da1acf437bfe7dd780fd4f5ae7d725834df52d9 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 14 Mar 2024 15:26:31 -0700 Subject: [PATCH 24/34] other-prods-edit --- windows/deployment/update/update-other-microsoft-products.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/deployment/update/update-other-microsoft-products.md b/windows/deployment/update/update-other-microsoft-products.md index 1479c86008..0d05bd2cd3 100644 --- a/windows/deployment/update/update-other-microsoft-products.md +++ b/windows/deployment/update/update-other-microsoft-products.md @@ -11,7 +11,7 @@ manager: aaroncz appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 03/11/2024 +ms.date: 03/14/2024 --- # Update other Microsoft products @@ -70,7 +70,6 @@ The following is a list of other Microsoft products that might be updated: - Windows Azure Pack - Windows Azure Service Bus - Windows Embedded Developer Update -- Windows Intune - Windows Live Sign-in Assistant - Windows Small Business Server - Zune From 4f941d1f87d4bb476c3080b71179da2763fa519d Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Fri, 15 Mar 2024 11:31:29 -0600 Subject: [PATCH 25/34] Update note in BitLocker CSP --- windows/client-management/mdm/bitlocker-csp.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index d9cf189c9a..3daf3023c2 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -16,13 +16,19 @@ ms.date: 01/18/2024 The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it's also supported in Windows 10 Pro. > [!NOTE] +> To manage BitLocker through CSP except to enable and disable it using the `RequireDeviceEncryption` policy, regardless of your management platform, one of the following licenses must be assigned to your users: > -> - Settings are enforced only at the time encryption is started. Encryption isn't restarted with settings changes. -> - You must send all the settings together in a single SyncML to be effective. +> - Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, and E5). +> - Windows 10/11 Enterprise A3 or A5 (included in Microsoft 365 A3 and A5). A `Get` operation on any of the settings, except for `RequireDeviceEncryption` and `RequireStorageCardEncryption`, returns the setting configured by the admin. For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation returns the actual status of enforcement to the admin, such as if Trusted Platform Module (TPM) protection is required and if encryption is required. And if the device has BitLocker enabled but with password protector, the status reported is 0. A Get operation on RequireDeviceEncryption doesn't verify that a minimum PIN length is enforced (SystemDrivesMinimumPINLength). + +> [!NOTE] +> +> - Settings are enforced only at the time encryption is started. Encryption isn't restarted with settings changes. +> - You must send all the settings together in a single SyncML to be effective. From 0ce7c4200022a37b5077db1d2a0b1e3ec24c5c09 Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Fri, 15 Mar 2024 11:37:51 -0600 Subject: [PATCH 26/34] Minor change --- windows/client-management/mdm/bitlocker-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 3daf3023c2..77ce431acb 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -16,7 +16,7 @@ ms.date: 01/18/2024 The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it's also supported in Windows 10 Pro. > [!NOTE] -> To manage BitLocker through CSP except to enable and disable it using the `RequireDeviceEncryption` policy, regardless of your management platform, one of the following licenses must be assigned to your users: +> To manage BitLocker through CSP except to enable and disable it using the `RequireDeviceEncryption` policy, one of the following licenses must be assigned to your users regardless of your management platform: > > - Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, and E5). > - Windows 10/11 Enterprise A3 or A5 (included in Microsoft 365 A3 and A5). From d8601e471790ed3af9885ebb9b1ae5892a4c43a2 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 15 Mar 2024 14:12:49 -0400 Subject: [PATCH 27/34] Delete license and activation SVG icons --- .../hello-for-business/images/fingerprint.svg | 4 +- .../hello-for-business/images/hello.svg | 4 +- .../hello-for-business/images/iris.svg | 4 +- .../hello-for-business/images/pin.svg | 4 +- .../hello-for-business/images/smartcard.svg | 4 +- .../passkeys/images/laptop.svg | 6 +- .../passkeys/images/phone.svg | 6 +- .../passkeys/images/qr-code.svg | 6 +- .../passkeys/images/usb.svg | 6 +- .../security/images/icons/accessibility.svg | 6 +- windows/security/images/icons/activation.svg | 3 - windows/security/images/icons/certificate.svg | 4 +- windows/security/images/icons/cmd.svg | 9 + .../security/images/icons/control-panel.svg | 9 + windows/security/images/icons/drive.svg | 75 ++++ windows/security/images/icons/face.svg | 3 + windows/security/images/icons/feedback.svg | 4 +- windows/security/images/icons/fingerprint.svg | 3 + windows/security/images/icons/folder.svg | 3 + windows/security/images/icons/gear.svg | 10 - .../security/images/icons/group-policy.svg | 13 +- windows/security/images/icons/information.svg | 6 +- windows/security/images/icons/insider.svg | 3 + windows/security/images/icons/intune.svg | 47 ++- windows/security/images/icons/iris.svg | 3 + windows/security/images/icons/key.svg | 6 +- windows/security/images/icons/kiosk.svg | 3 + windows/security/images/icons/laptop.svg | 3 + windows/security/images/icons/license.svg | 3 - windows/security/images/icons/lock.svg | 3 + .../security/images/icons/locked-drive.svg | 351 ++++++++++++++++++ windows/security/images/icons/os-drive.svg | 129 +++++++ windows/security/images/icons/phone.svg | 3 + windows/security/images/icons/pin-code.svg | 3 + windows/security/images/icons/pin.svg | 3 + windows/security/images/icons/power.svg | 3 + windows/security/images/icons/powershell.svg | 8 +- .../images/icons/provisioning-package.svg | 6 +- windows/security/images/icons/qr-code.svg | 3 + windows/security/images/icons/registry.svg | 6 +- windows/security/images/icons/rocket.svg | 155 ++++++++ windows/security/images/icons/sc.svg | 3 + .../security/images/icons/settings-app.svg | 24 ++ windows/security/images/icons/settings.svg | 18 +- windows/security/images/icons/start.svg | 3 + .../security/images/icons/subscription.svg | 4 +- .../security/images/icons/unlocked-drive.svg | 120 ++++++ windows/security/images/icons/usb.svg | 3 + windows/security/images/icons/user.svg | 3 + windows/security/images/icons/vsc.svg | 3 + .../data-protection/bitlocker/images/cmd.svg | 16 +- .../bitlocker/images/controlpanel.svg | 8 +- .../bitlocker/images/drive.svg | 40 +- .../bitlocker/images/locked-drive.svg | 176 ++++----- .../bitlocker/images/os-drive.svg | 78 ++-- .../bitlocker/images/powershell.svg | 8 +- .../bitlocker/images/unlocked-drive.svg | 81 ++-- 57 files changed, 1207 insertions(+), 314 deletions(-) delete mode 100644 windows/security/images/icons/activation.svg create mode 100644 windows/security/images/icons/cmd.svg create mode 100644 windows/security/images/icons/control-panel.svg create mode 100644 windows/security/images/icons/drive.svg create mode 100644 windows/security/images/icons/face.svg create mode 100644 windows/security/images/icons/fingerprint.svg create mode 100644 windows/security/images/icons/folder.svg delete mode 100644 windows/security/images/icons/gear.svg create mode 100644 windows/security/images/icons/insider.svg create mode 100644 windows/security/images/icons/iris.svg create mode 100644 windows/security/images/icons/kiosk.svg create mode 100644 windows/security/images/icons/laptop.svg delete mode 100644 windows/security/images/icons/license.svg create mode 100644 windows/security/images/icons/lock.svg create mode 100644 windows/security/images/icons/locked-drive.svg create mode 100644 windows/security/images/icons/os-drive.svg create mode 100644 windows/security/images/icons/phone.svg create mode 100644 windows/security/images/icons/pin-code.svg create mode 100644 windows/security/images/icons/pin.svg create mode 100644 windows/security/images/icons/power.svg create mode 100644 windows/security/images/icons/qr-code.svg create mode 100644 windows/security/images/icons/rocket.svg create mode 100644 windows/security/images/icons/sc.svg create mode 100644 windows/security/images/icons/settings-app.svg create mode 100644 windows/security/images/icons/start.svg create mode 100644 windows/security/images/icons/unlocked-drive.svg create mode 100644 windows/security/images/icons/usb.svg create mode 100644 windows/security/images/icons/user.svg create mode 100644 windows/security/images/icons/vsc.svg diff --git a/windows/security/identity-protection/hello-for-business/images/fingerprint.svg b/windows/security/identity-protection/hello-for-business/images/fingerprint.svg index e2b816716a..2494d65659 100644 --- a/windows/security/identity-protection/hello-for-business/images/fingerprint.svg +++ b/windows/security/identity-protection/hello-for-business/images/fingerprint.svg @@ -1,3 +1,3 @@ - - + + diff --git a/windows/security/identity-protection/hello-for-business/images/hello.svg b/windows/security/identity-protection/hello-for-business/images/hello.svg index 5601c82127..a4fa1ca0df 100644 --- a/windows/security/identity-protection/hello-for-business/images/hello.svg +++ b/windows/security/identity-protection/hello-for-business/images/hello.svg @@ -1,3 +1,3 @@ - - + + diff --git a/windows/security/identity-protection/hello-for-business/images/iris.svg b/windows/security/identity-protection/hello-for-business/images/iris.svg index 871cac50d5..465902e0b3 100644 --- a/windows/security/identity-protection/hello-for-business/images/iris.svg +++ b/windows/security/identity-protection/hello-for-business/images/iris.svg @@ -1,3 +1,3 @@ - - + + diff --git a/windows/security/identity-protection/hello-for-business/images/pin.svg b/windows/security/identity-protection/hello-for-business/images/pin.svg index a34b2fa5db..a5bfdc4148 100644 --- a/windows/security/identity-protection/hello-for-business/images/pin.svg +++ b/windows/security/identity-protection/hello-for-business/images/pin.svg @@ -1,3 +1,3 @@ - - + + diff --git a/windows/security/identity-protection/hello-for-business/images/smartcard.svg b/windows/security/identity-protection/hello-for-business/images/smartcard.svg index c9d40368b5..d1924ffebb 100644 --- a/windows/security/identity-protection/hello-for-business/images/smartcard.svg +++ b/windows/security/identity-protection/hello-for-business/images/smartcard.svg @@ -1,3 +1,3 @@ - - + + diff --git a/windows/security/identity-protection/passkeys/images/laptop.svg b/windows/security/identity-protection/passkeys/images/laptop.svg index 2440c97fd5..5b8d16655e 100644 --- a/windows/security/identity-protection/passkeys/images/laptop.svg +++ b/windows/security/identity-protection/passkeys/images/laptop.svg @@ -1,3 +1,3 @@ - - - \ No newline at end of file + + + diff --git a/windows/security/identity-protection/passkeys/images/phone.svg b/windows/security/identity-protection/passkeys/images/phone.svg index acb1dce81f..d701cabb0d 100644 --- a/windows/security/identity-protection/passkeys/images/phone.svg +++ b/windows/security/identity-protection/passkeys/images/phone.svg @@ -1,3 +1,3 @@ - - - \ No newline at end of file + + + diff --git a/windows/security/identity-protection/passkeys/images/qr-code.svg b/windows/security/identity-protection/passkeys/images/qr-code.svg index d84c521351..b52c264ab3 100644 --- a/windows/security/identity-protection/passkeys/images/qr-code.svg +++ b/windows/security/identity-protection/passkeys/images/qr-code.svg @@ -1,3 +1,3 @@ - - - \ No newline at end of file + + + diff --git a/windows/security/identity-protection/passkeys/images/usb.svg b/windows/security/identity-protection/passkeys/images/usb.svg index 18027400c1..ab1ccbc8d9 100644 --- a/windows/security/identity-protection/passkeys/images/usb.svg +++ b/windows/security/identity-protection/passkeys/images/usb.svg @@ -1,3 +1,3 @@ - - - \ No newline at end of file + + + diff --git a/windows/security/images/icons/accessibility.svg b/windows/security/images/icons/accessibility.svg index 21a6b4f235..5cd9234699 100644 --- a/windows/security/images/icons/accessibility.svg +++ b/windows/security/images/icons/accessibility.svg @@ -1,3 +1,3 @@ - - - \ No newline at end of file + + + diff --git a/windows/security/images/icons/activation.svg b/windows/security/images/icons/activation.svg deleted file mode 100644 index 0060e89a0b..0000000000 --- a/windows/security/images/icons/activation.svg +++ /dev/null @@ -1,3 +0,0 @@ - - - diff --git a/windows/security/images/icons/certificate.svg b/windows/security/images/icons/certificate.svg index 0060e89a0b..956bfc1e42 100644 --- a/windows/security/images/icons/certificate.svg +++ b/windows/security/images/icons/certificate.svg @@ -1,3 +1,3 @@ - - + + diff --git a/windows/security/images/icons/cmd.svg b/windows/security/images/icons/cmd.svg new file mode 100644 index 0000000000..e712a4fff5 --- /dev/null +++ b/windows/security/images/icons/cmd.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/windows/security/images/icons/control-panel.svg b/windows/security/images/icons/control-panel.svg new file mode 100644 index 0000000000..6eebbe9be8 --- /dev/null +++ b/windows/security/images/icons/control-panel.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/windows/security/images/icons/drive.svg b/windows/security/images/icons/drive.svg new file mode 100644 index 0000000000..0293932c8e --- /dev/null +++ b/windows/security/images/icons/drive.svg @@ -0,0 +1,75 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/security/images/icons/face.svg b/windows/security/images/icons/face.svg new file mode 100644 index 0000000000..a4fa1ca0df --- /dev/null +++ b/windows/security/images/icons/face.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/feedback.svg b/windows/security/images/icons/feedback.svg index 2ecd143695..cd887f3a0f 100644 --- a/windows/security/images/icons/feedback.svg +++ b/windows/security/images/icons/feedback.svg @@ -1,3 +1,3 @@ - - + + diff --git a/windows/security/images/icons/fingerprint.svg b/windows/security/images/icons/fingerprint.svg new file mode 100644 index 0000000000..2494d65659 --- /dev/null +++ b/windows/security/images/icons/fingerprint.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/folder.svg b/windows/security/images/icons/folder.svg new file mode 100644 index 0000000000..468edaf961 --- /dev/null +++ b/windows/security/images/icons/folder.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/gear.svg b/windows/security/images/icons/gear.svg deleted file mode 100644 index caca268bea..0000000000 --- a/windows/security/images/icons/gear.svg +++ /dev/null @@ -1,10 +0,0 @@ - - - - - - - - - - diff --git a/windows/security/images/icons/group-policy.svg b/windows/security/images/icons/group-policy.svg index c9cb511415..e6ec2d2c2e 100644 --- a/windows/security/images/icons/group-policy.svg +++ b/windows/security/images/icons/group-policy.svg @@ -1,9 +1,14 @@ - - + + + + - + - + + + + diff --git a/windows/security/images/icons/information.svg b/windows/security/images/icons/information.svg index bc692eabb9..4a33944103 100644 --- a/windows/security/images/icons/information.svg +++ b/windows/security/images/icons/information.svg @@ -1,3 +1,3 @@ - - - \ No newline at end of file + + + diff --git a/windows/security/images/icons/insider.svg b/windows/security/images/icons/insider.svg new file mode 100644 index 0000000000..fa002fa2a1 --- /dev/null +++ b/windows/security/images/icons/insider.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/intune.svg b/windows/security/images/icons/intune.svg index 6e0d938aed..22148b48fb 100644 --- a/windows/security/images/icons/intune.svg +++ b/windows/security/images/icons/intune.svg @@ -1,24 +1,23 @@ - - - - - - - - - - - - - - - - Icon-intune-329 - - - - - - - - \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/security/images/icons/iris.svg b/windows/security/images/icons/iris.svg new file mode 100644 index 0000000000..465902e0b3 --- /dev/null +++ b/windows/security/images/icons/iris.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/key.svg b/windows/security/images/icons/key.svg index c9df33c18f..62e4755d33 100644 --- a/windows/security/images/icons/key.svg +++ b/windows/security/images/icons/key.svg @@ -1,3 +1,3 @@ - - - \ No newline at end of file + + + diff --git a/windows/security/images/icons/kiosk.svg b/windows/security/images/icons/kiosk.svg new file mode 100644 index 0000000000..f975677d19 --- /dev/null +++ b/windows/security/images/icons/kiosk.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/laptop.svg b/windows/security/images/icons/laptop.svg new file mode 100644 index 0000000000..5b8d16655e --- /dev/null +++ b/windows/security/images/icons/laptop.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/license.svg b/windows/security/images/icons/license.svg deleted file mode 100644 index 4be1c3b5f7..0000000000 --- a/windows/security/images/icons/license.svg +++ /dev/null @@ -1,3 +0,0 @@ - - - diff --git a/windows/security/images/icons/lock.svg b/windows/security/images/icons/lock.svg new file mode 100644 index 0000000000..ccd1850fbb --- /dev/null +++ b/windows/security/images/icons/lock.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/locked-drive.svg b/windows/security/images/icons/locked-drive.svg new file mode 100644 index 0000000000..59a6edbe09 --- /dev/null +++ b/windows/security/images/icons/locked-drive.svg @@ -0,0 +1,351 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/security/images/icons/os-drive.svg b/windows/security/images/icons/os-drive.svg new file mode 100644 index 0000000000..504abbd5a9 --- /dev/null +++ b/windows/security/images/icons/os-drive.svg @@ -0,0 +1,129 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/security/images/icons/phone.svg b/windows/security/images/icons/phone.svg new file mode 100644 index 0000000000..d701cabb0d --- /dev/null +++ b/windows/security/images/icons/phone.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/pin-code.svg b/windows/security/images/icons/pin-code.svg new file mode 100644 index 0000000000..a5bfdc4148 --- /dev/null +++ b/windows/security/images/icons/pin-code.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/pin.svg b/windows/security/images/icons/pin.svg new file mode 100644 index 0000000000..64426df32c --- /dev/null +++ b/windows/security/images/icons/pin.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/power.svg b/windows/security/images/icons/power.svg new file mode 100644 index 0000000000..e74606b72c --- /dev/null +++ b/windows/security/images/icons/power.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/powershell.svg b/windows/security/images/icons/powershell.svg index b23a99c61d..3d90e2ff6f 100644 --- a/windows/security/images/icons/powershell.svg +++ b/windows/security/images/icons/powershell.svg @@ -1,9 +1,9 @@ - - + + - + - + diff --git a/windows/security/images/icons/provisioning-package.svg b/windows/security/images/icons/provisioning-package.svg index dbbad7d780..99c1148922 100644 --- a/windows/security/images/icons/provisioning-package.svg +++ b/windows/security/images/icons/provisioning-package.svg @@ -1,3 +1,3 @@ - - - \ No newline at end of file + + + diff --git a/windows/security/images/icons/qr-code.svg b/windows/security/images/icons/qr-code.svg new file mode 100644 index 0000000000..b52c264ab3 --- /dev/null +++ b/windows/security/images/icons/qr-code.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/registry.svg b/windows/security/images/icons/registry.svg index bc4aa2f534..667bce7438 100644 --- a/windows/security/images/icons/registry.svg +++ b/windows/security/images/icons/registry.svg @@ -1,9 +1,9 @@ - + - + - + diff --git a/windows/security/images/icons/rocket.svg b/windows/security/images/icons/rocket.svg new file mode 100644 index 0000000000..ee39fb57aa --- /dev/null +++ b/windows/security/images/icons/rocket.svg @@ -0,0 +1,155 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/security/images/icons/sc.svg b/windows/security/images/icons/sc.svg new file mode 100644 index 0000000000..d1924ffebb --- /dev/null +++ b/windows/security/images/icons/sc.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/settings-app.svg b/windows/security/images/icons/settings-app.svg new file mode 100644 index 0000000000..d62d13fb54 --- /dev/null +++ b/windows/security/images/icons/settings-app.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/security/images/icons/settings.svg b/windows/security/images/icons/settings.svg index 9ec19d16aa..36da6757f2 100644 --- a/windows/security/images/icons/settings.svg +++ b/windows/security/images/icons/settings.svg @@ -1,19 +1,3 @@ - - - - - - - - - - - - - - - - - + diff --git a/windows/security/images/icons/start.svg b/windows/security/images/icons/start.svg new file mode 100644 index 0000000000..a3e6c3d8e8 --- /dev/null +++ b/windows/security/images/icons/start.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/subscription.svg b/windows/security/images/icons/subscription.svg index 4be1c3b5f7..ffa73c424e 100644 --- a/windows/security/images/icons/subscription.svg +++ b/windows/security/images/icons/subscription.svg @@ -1,3 +1,3 @@ - - + + diff --git a/windows/security/images/icons/unlocked-drive.svg b/windows/security/images/icons/unlocked-drive.svg new file mode 100644 index 0000000000..a8464ec134 --- /dev/null +++ b/windows/security/images/icons/unlocked-drive.svg @@ -0,0 +1,120 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/security/images/icons/usb.svg b/windows/security/images/icons/usb.svg new file mode 100644 index 0000000000..ab1ccbc8d9 --- /dev/null +++ b/windows/security/images/icons/usb.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/user.svg b/windows/security/images/icons/user.svg new file mode 100644 index 0000000000..76c0b2ce5d --- /dev/null +++ b/windows/security/images/icons/user.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/vsc.svg b/windows/security/images/icons/vsc.svg new file mode 100644 index 0000000000..cbf23de89e --- /dev/null +++ b/windows/security/images/icons/vsc.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/cmd.svg b/windows/security/operating-system-security/data-protection/bitlocker/images/cmd.svg index 0cddf31701..e712a4fff5 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/images/cmd.svg +++ b/windows/security/operating-system-security/data-protection/bitlocker/images/cmd.svg @@ -1,9 +1,9 @@ - - - - - - - - + + + + + + + + diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/controlpanel.svg b/windows/security/operating-system-security/data-protection/bitlocker/images/controlpanel.svg index 3f526ed38d..6eebbe9be8 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/images/controlpanel.svg +++ b/windows/security/operating-system-security/data-protection/bitlocker/images/controlpanel.svg @@ -1,9 +1,9 @@ - - + + - + - + diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/drive.svg b/windows/security/operating-system-security/data-protection/bitlocker/images/drive.svg index fdd0ac46fd..0293932c8e 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/images/drive.svg +++ b/windows/security/operating-system-security/data-protection/bitlocker/images/drive.svg @@ -1,35 +1,35 @@ - - + + - - - - - - - + + + + + + + - + - + - + - + @@ -37,38 +37,38 @@ - + - + - + - + - + - + - + diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/locked-drive.svg b/windows/security/operating-system-security/data-protection/bitlocker/images/locked-drive.svg index 9c1d764581..59a6edbe09 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/images/locked-drive.svg +++ b/windows/security/operating-system-security/data-protection/bitlocker/images/locked-drive.svg @@ -1,83 +1,83 @@ - - + + - - - - - - - + + + + + + + - + - + - + - + - + - + - + - + - + - - - - + + + + - - + + - - + + - + - - - - + + + + - - + + - - + + - + - - - + + + @@ -95,16 +95,16 @@ - + - + - - - + + + @@ -122,13 +122,13 @@ - + - - + + @@ -148,19 +148,19 @@ - + - + - + @@ -168,74 +168,74 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -243,42 +243,42 @@ - + - + - + - + - + - + - + - + - + @@ -286,51 +286,51 @@ - + - + - + - + - + - + - + - + - + - + - + - + @@ -341,10 +341,10 @@ - + - + diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/os-drive.svg b/windows/security/operating-system-security/data-protection/bitlocker/images/os-drive.svg index 4b4f7f766f..504abbd5a9 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/images/os-drive.svg +++ b/windows/security/operating-system-security/data-protection/bitlocker/images/os-drive.svg @@ -1,57 +1,57 @@ - - + + - - - - - - - + + + + + + + - + - - + + - - + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -59,19 +59,19 @@ - + - + - + @@ -79,50 +79,50 @@ - + - + - + - + - + - + - + - + - + - + diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/powershell.svg b/windows/security/operating-system-security/data-protection/bitlocker/images/powershell.svg index b23a99c61d..3d90e2ff6f 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/images/powershell.svg +++ b/windows/security/operating-system-security/data-protection/bitlocker/images/powershell.svg @@ -1,9 +1,9 @@ - - + + - + - + diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/unlocked-drive.svg b/windows/security/operating-system-security/data-protection/bitlocker/images/unlocked-drive.svg index 94f06bf78b..a8464ec134 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/images/unlocked-drive.svg +++ b/windows/security/operating-system-security/data-protection/bitlocker/images/unlocked-drive.svg @@ -1,73 +1,71 @@ - - - + + - - - - - - - + + + + + + + - + - - + + - - + + - + - + - + - + - + - + - + - + - + - + - + - - + - + - + - + @@ -75,50 +73,47 @@ - + - + - + - + - + - + - + - + - - - - + From c7937717627cff6d0b48bf8ac2f9cbc6dfe6da65 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 15 Mar 2024 14:28:49 -0400 Subject: [PATCH 28/34] Update edition requirements icon in licensing and edition requirements file --- windows/security/images/icons/gear.svg | 3 +++ windows/security/licensing-and-edition-requirements.md | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 windows/security/images/icons/gear.svg diff --git a/windows/security/images/icons/gear.svg b/windows/security/images/icons/gear.svg new file mode 100644 index 0000000000..36da6757f2 --- /dev/null +++ b/windows/security/images/icons/gear.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/licensing-and-edition-requirements.md b/windows/security/licensing-and-edition-requirements.md index e2ef744996..5514543d97 100644 --- a/windows/security/licensing-and-edition-requirements.md +++ b/windows/security/licensing-and-edition-requirements.md @@ -19,7 +19,7 @@ Select one of the two tabs to learn about licensing requirements to use the secu [!INCLUDE [licensing-requirements](../../includes/licensing/_licensing-requirements.md)] -#### [:::image type="icon" source="images/icons/activation.svg" border="false"::: **Edition requirements**](#tab/edition) +#### [:::image type="icon" source="images/icons/subscription.svg" border="false"::: **Edition requirements**](#tab/edition) [!INCLUDE [_edition-requirements](../../includes/licensing/_edition-requirements.md)] From 4bae06ab07e82acae5a214a2d124cadced6a24fa Mon Sep 17 00:00:00 2001 From: Stacyrch140 <102548089+Stacyrch140@users.noreply.github.com> Date: Mon, 18 Mar 2024 13:41:21 -0400 Subject: [PATCH 29/34] pencil edit --- windows/client-management/mdm/bitlocker-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 77ce431acb..647b90ac50 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -660,7 +660,7 @@ Sample value for this node to enable this policy is: `` **Example**: -To disable this policy, use hte following SyncML: +To disable this policy, use the following SyncML: ```xml From bf58a7c5564ae3fcce12af9ff57480f110e4a25f Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 18 Mar 2024 13:42:40 -0400 Subject: [PATCH 30/34] Update taskbar configuration files --- ...ing.redirection.windows-configuration.json | 20 ++++++++++++++----- .../taskbar/{configure.md => index.md} | 0 ...-taskbar-windows.md => policy-settings.md} | 0 windows/configuration/taskbar/toc.yml | 4 ++-- 4 files changed, 17 insertions(+), 7 deletions(-) rename windows/configuration/taskbar/{configure.md => index.md} (100%) rename windows/configuration/taskbar/{supported-csp-taskbar-windows.md => policy-settings.md} (100%) diff --git a/.openpublishing.redirection.windows-configuration.json b/.openpublishing.redirection.windows-configuration.json index b4526996f1..971d493152 100644 --- a/.openpublishing.redirection.windows-configuration.json +++ b/.openpublishing.redirection.windows-configuration.json @@ -282,7 +282,7 @@ }, { "source_path": "windows/configuration/configure-windows-10-taskbar.md", - "redirect_url": "/windows/configuration/taskbar/configure-windows-10-taskbar", + "redirect_url": "/windows/configuration/taskbar/", "redirect_document_id": false }, { @@ -297,7 +297,7 @@ }, { "source_path": "windows/configuration/customize-taskbar-windows-11.md", - "redirect_url": "/windows/configuration/taskbar/customize-taskbar-windows-11", + "redirect_url": "/windows/configuration/taskbar", "redirect_document_id": false }, { @@ -447,7 +447,7 @@ }, { "source_path": "windows/configuration/supported-csp-taskbar-windows.md", - "redirect_url": "/windows/configuration/taskbar/supported-csp-taskbar-windows", + "redirect_url": "/windows/configuration/taskbar/policy-settings", "redirect_document_id": false }, { @@ -842,18 +842,28 @@ }, { "source_path": "windows/configuration/taskbar/configure-windows-10-taskbar.md", - "redirect_url": "/windows/configuration/taskbar", + "redirect_url": "/windows/configuration/taskbar/", "redirect_document_id": false }, { "source_path": "windows/configuration/taskbar/customize-taskbar-windows-11.md", - "redirect_url": "/windows/configuration/taskbar", + "redirect_url": "/windows/configuration/taskbar/", "redirect_document_id": false }, { "source_path": "windows/configuration/tips/manage-tips-and-suggestions.md", "redirect_url": "/windows/configuration", "redirect_document_id": false + }, + { + "source_path": "windows/configuration/taskbar/configure.md", + "redirect_url": "/windows/configuration/taskbar/", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/taskbar/supported-csp-taskbar-windows.md", + "redirect_url": "/windows/configuration/taskbar/policy-settings", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/configuration/taskbar/configure.md b/windows/configuration/taskbar/index.md similarity index 100% rename from windows/configuration/taskbar/configure.md rename to windows/configuration/taskbar/index.md diff --git a/windows/configuration/taskbar/supported-csp-taskbar-windows.md b/windows/configuration/taskbar/policy-settings.md similarity index 100% rename from windows/configuration/taskbar/supported-csp-taskbar-windows.md rename to windows/configuration/taskbar/policy-settings.md diff --git a/windows/configuration/taskbar/toc.yml b/windows/configuration/taskbar/toc.yml index 906f16ce7c..c3601e77ec 100644 --- a/windows/configuration/taskbar/toc.yml +++ b/windows/configuration/taskbar/toc.yml @@ -1,5 +1,5 @@ items: - name: Customize the Taskbar - href: configure.md + href: index.md - name: Supported Taskbar CSPs - href: supported-csp-taskbar-windows.md \ No newline at end of file + href: policy-settings.md \ No newline at end of file From de39bdb71abc5232c9be01e3d86bdc8918260950 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 18 Mar 2024 13:44:42 -0400 Subject: [PATCH 31/34] Update taskbar configuration URL --- windows/configuration/index.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml index b6023eda4e..c71df35e46 100644 --- a/windows/configuration/index.yml +++ b/windows/configuration/index.yml @@ -24,7 +24,7 @@ landingContent: - text: Customize the Windows Start menu layout url: start/customize-and-export-start-layout.md - text: Customize the Windows taskbar - url: taskbar/configure.md + url: taskbar/index.md - text: Configure Windows Spotlight on the lock screen url: lock-screen/windows-spotlight.md - text: Accessibility information for IT pros From eef3c38746752de73c40cef8777d2386de013526 Mon Sep 17 00:00:00 2001 From: zacharylayne Date: Wed, 20 Mar 2024 09:54:07 -0700 Subject: [PATCH 32/34] Update policies-in-policy-csp-supported-by-hololens2.md Added policies to: https://learn.microsoft.com/en-us/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2 that were in the 23H2 release here: https://learn.microsoft.com/en-us/hololens/hololens-release-notes See issue https://dev.azure.com/microsoft/OS/_workitems/edit/48800141 As a bonus, fixed links for the following: LetAppsAccessLocation_ForceAllowTheseApps LetAppsAccessLocation_ForceDenyTheseApps LetAppsAccessLocation_UserInControlOfTheseApps ConfigureTelemetryOptInSettingsUx DisableDeviceDelete --- ...es-in-policy-csp-supported-by-hololens2.md | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md index 8a1244f15d..04fb46bf39 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -39,6 +39,10 @@ ms.date: 02/03/2023 - [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitforegrounddownloadbandwidth) 10 - [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitbackgrounddownloadbandwidth) 10 - [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitbackgrounddownloadbandwidth) 10 +- [Device/{TenantId}/Policies/EnableWindowsHelloProvisioningForSecurityKeys](passportforwork-csp.md#devicetenantidpoliciesenablewindowshelloprovisioningforsecuritykeys) 12 +- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md#allowinstallationofmatchingdeviceids) 12 +- [DeviceInstallation/DeviceInstall_Removable_Deny](policy-csp-deviceinstallation.md#deviceinstall_removable_deny) 12 +- [DeviceInstallation/EnableInstallationPolicyLayering](policy-csp-deviceinstallation.md#enableinstallationpolicylayering) 12 - [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#allowidlereturnwithoutpassword) - [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#allowsimpledevicepassword) - [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#alphanumericdevicepasswordrequired) @@ -59,12 +63,18 @@ ms.date: 02/03/2023 - [MixedReality/ConfigureMovingPlatform](policy-csp-mixedreality.md#configuremovingplatform) *[Feb. 2022 Servicing release](/hololens/hololens-release-notes#windows-holographic-version-21h2---february-2022-update) - [MixedReality/ConfigureNtpClient](./policy-csp-mixedreality.md#configurentpclient) 12 - [MixedReality/DisallowNetworkConnectivityPassivePolling](./policy-csp-mixedreality.md#disallownetworkconnectivitypassivepolling) 12 +- [MixedReality/EnableStartMenuWristTap](./policy-csp-mixedreality.md#enablestartmenuwristtap)12 +- [MixedReality/EnableStartMenuSingleHandGesture](./policy-csp-mixedreality.md#enablestartmenusinglehandgesture) 12 +- [MixedReality/EnableStartMenuVoiceCommand](./policy-csp-mixedreality.md#enablestartmenuvoicecommand) 12 - [MixedReality/FallbackDiagnostics](./policy-csp-mixedreality.md#fallbackdiagnostics) 9 - [MixedReality/ManualDownDirectionDisabled](policy-csp-mixedreality.md#manualdowndirectiondisabled) *[Feb. 2022 Servicing release](/hololens/hololens-release-notes#windows-holographic-version-21h2---february-2022-update) - [MixedReality/MicrophoneDisabled](./policy-csp-mixedreality.md#microphonedisabled) 9 - [MixedReality/NtpClientEnabled](./policy-csp-mixedreality.md#ntpclientenabled) 12 +- [MixedReality/PreferLogonAsOtherUser](./policy-csp-mixedreality.md#preferlogonasotheruser) 12 - [MixedReality/SkipCalibrationDuringSetup](./policy-csp-mixedreality.md#skipcalibrationduringsetup) 12 - [MixedReality/SkipTrainingDuringSetup](./policy-csp-mixedreality.md#skiptrainingduringsetup) 12 +- [MixedReality/RequireStartIconHold](./policy-csp-mixedreality.md#requirestarticonhold) 12 +- [MixedReality/RequireStartIconVisible](./policy-csp-mixedreality.md#requirestarticonvisible) 12 - [MixedReality/VisitorAutoLogon](policy-csp-mixedreality.md#visitorautologon) 10 - [MixedReality/VolumeButtonDisabled](./policy-csp-mixedreality.md#volumebuttondisabled) 9 - [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#displayofftimeoutonbattery) 9, 14 @@ -91,9 +101,9 @@ ms.date: 02/03/2023 - [Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessgazeinput_forcedenytheseapps) 8 - [Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessgazeinput_userincontroloftheseapps) 8 - [Privacy/LetAppsAccessLocation](policy-csp-privacy.md#letappsaccesslocation) -- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](/windows/client-management/mdm/policy-csp-privacy) 12 -- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](/windows/client-management/mdm/policy-csp-privacy) 12 -- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](/windows/client-management/mdm/policy-csp-privacy) 12 +- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](/windows/client-management/mdm/policy-csp-privacy.md#letappsaccesslocation_forceallowtheseapps) 12 +- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](/windows/client-management/mdm/policy-csp-privacy.md#letappsaccesslocation_forcedenytheseapps) 12 +- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](/windows/client-management/mdm/policy-csp-privacy.md#letappsaccesslocation_userincontroloftheseapps) 12 - [Privacy/LetAppsAccessMicrophone](policy-csp-privacy.md#letappsaccessmicrophone) - [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forceallowtheseapps) 8 - [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forcedenytheseapps) 8 @@ -113,8 +123,8 @@ ms.date: 02/03/2023 - [System/AllowLocation](policy-csp-system.md#allowlocation) - [System/AllowStorageCard](policy-csp-system.md#allowstoragecard) - [System/AllowTelemetry](policy-csp-system.md#allowtelemetry) -- [System/ConfigureTelemetryOptInSettingsUx](/windows/client-management/mdm/policy-csp-system) 12 -- [System/DisableDeviceDelete](/windows/client-management/mdm/policy-csp-system) 12 +- [System/ConfigureTelemetryOptInSettingsUx](/windows/client-management/mdm/policy-csp-system.md#configuretelemetryoptinsettingsux) 12 +- [System/DisableDeviceDelete](/windows/client-management/mdm/policy-csp-system.md#disabledevicedelete) 12 - [TimeLanguageSettings/ConfigureTimeZone](./policy-csp-timelanguagesettings.md#configuretimezone) 9 - [Update/ActiveHoursEnd](./policy-csp-update.md#activehoursend) 9 - [Update/ActiveHoursMaxRange](./policy-csp-update.md#activehoursmaxrange) 9 @@ -165,6 +175,3 @@ Footnotes: [Policy CSP](policy-configuration-service-provider.md) [Full HoloLens CSP Details](/windows/client-management/mdm/configuration-service-provider-support) - - - From f843410cc0d688e7fb1d2fd1181761335ab18d9d Mon Sep 17 00:00:00 2001 From: zacharylayne Date: Wed, 20 Mar 2024 10:23:54 -0700 Subject: [PATCH 33/34] Update policies-in-policy-csp-supported-by-hololens2.md Fixed some links that were broken. I'm pretty awesome. --- .../policies-in-policy-csp-supported-by-hololens2.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md index 04fb46bf39..db7aa3399c 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -41,7 +41,7 @@ ms.date: 02/03/2023 - [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitbackgrounddownloadbandwidth) 10 - [Device/{TenantId}/Policies/EnableWindowsHelloProvisioningForSecurityKeys](passportforwork-csp.md#devicetenantidpoliciesenablewindowshelloprovisioningforsecuritykeys) 12 - [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md#allowinstallationofmatchingdeviceids) 12 -- [DeviceInstallation/DeviceInstall_Removable_Deny](policy-csp-deviceinstallation.md#deviceinstall_removable_deny) 12 +- [DeviceInstallation/DeviceInstall_Removable_Deny](policy-csp-admx-deviceinstallation.md#deviceinstall_removable_deny) 12 - [DeviceInstallation/EnableInstallationPolicyLayering](policy-csp-deviceinstallation.md#enableinstallationpolicylayering) 12 - [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#allowidlereturnwithoutpassword) - [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#allowsimpledevicepassword) @@ -101,9 +101,9 @@ ms.date: 02/03/2023 - [Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessgazeinput_forcedenytheseapps) 8 - [Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessgazeinput_userincontroloftheseapps) 8 - [Privacy/LetAppsAccessLocation](policy-csp-privacy.md#letappsaccesslocation) -- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](/windows/client-management/mdm/policy-csp-privacy.md#letappsaccesslocation_forceallowtheseapps) 12 -- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](/windows/client-management/mdm/policy-csp-privacy.md#letappsaccesslocation_forcedenytheseapps) 12 -- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](/windows/client-management/mdm/policy-csp-privacy.md#letappsaccesslocation_userincontroloftheseapps) 12 +- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesslocation_forceallowtheseapps) 12 +- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesslocation_forcedenytheseapps) 12 +- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesslocation_userincontroloftheseapps) 12 - [Privacy/LetAppsAccessMicrophone](policy-csp-privacy.md#letappsaccessmicrophone) - [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forceallowtheseapps) 8 - [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forcedenytheseapps) 8 @@ -123,8 +123,8 @@ ms.date: 02/03/2023 - [System/AllowLocation](policy-csp-system.md#allowlocation) - [System/AllowStorageCard](policy-csp-system.md#allowstoragecard) - [System/AllowTelemetry](policy-csp-system.md#allowtelemetry) -- [System/ConfigureTelemetryOptInSettingsUx](/windows/client-management/mdm/policy-csp-system.md#configuretelemetryoptinsettingsux) 12 -- [System/DisableDeviceDelete](/windows/client-management/mdm/policy-csp-system.md#disabledevicedelete) 12 +- [System/ConfigureTelemetryOptInSettingsUx](client-management/mdm/policy-csp-system.md#configuretelemetryoptinsettingsux) 12 +- [System/DisableDeviceDelete](policy-csp-system.md#disabledevicedelete) 12 - [TimeLanguageSettings/ConfigureTimeZone](./policy-csp-timelanguagesettings.md#configuretimezone) 9 - [Update/ActiveHoursEnd](./policy-csp-update.md#activehoursend) 9 - [Update/ActiveHoursMaxRange](./policy-csp-update.md#activehoursmaxrange) 9 From a00cec391f7419636b4a44bbce3e5f62c0956c71 Mon Sep 17 00:00:00 2001 From: zacharylayne Date: Wed, 20 Mar 2024 10:32:30 -0700 Subject: [PATCH 34/34] Update policies-in-policy-csp-supported-by-hololens2.md Fixed another broken link. --- .../mdm/policies-in-policy-csp-supported-by-hololens2.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md index db7aa3399c..c0c0fd2588 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -123,7 +123,7 @@ ms.date: 02/03/2023 - [System/AllowLocation](policy-csp-system.md#allowlocation) - [System/AllowStorageCard](policy-csp-system.md#allowstoragecard) - [System/AllowTelemetry](policy-csp-system.md#allowtelemetry) -- [System/ConfigureTelemetryOptInSettingsUx](client-management/mdm/policy-csp-system.md#configuretelemetryoptinsettingsux) 12 +- [System/ConfigureTelemetryOptInSettingsUx](policy-csp-system.md#configuretelemetryoptinsettingsux) 12 - [System/DisableDeviceDelete](policy-csp-system.md#disabledevicedelete) 12 - [TimeLanguageSettings/ConfigureTimeZone](./policy-csp-timelanguagesettings.md#configuretimezone) 9 - [Update/ActiveHoursEnd](./policy-csp-update.md#activehoursend) 9