mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 14:27:22 +00:00
Merge pull request #954 from MicrosoftDocs/FromPrivateRepo
From private repo
This commit is contained in:
huypub
GitHub
commit
cf26f03943
@ -10,18 +10,21 @@ ms.prod: ie11
|
||||
ms.assetid:
|
||||
title: Internet Explorer 11 delivery through automatic updates
|
||||
ms.sitesec: library
|
||||
ms.date: 05/10/2018
|
||||
ms.date: 05/22/2018
|
||||
---
|
||||
|
||||
# Internet Explorer 11 delivery through automatic updates
|
||||
Internet Explorer 11 makes browsing the web faster, easier, safer, and more reliable than ever. To help customers become more secure and up-to-date, Microsoft will distribute Internet Explorer 11 through Automatic Updates and the Windows Update and Microsoft Update sites. Internet Explorer 11 will be available for users of the 32-bit and 64-bit versions of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1. This article provides an overview of the delivery process and options available for IT administrators to control how and when Internet Explorer 11 is deployed to their organization through Automatic Updates.
|
||||
|
||||
- [Automatic updates delivery process](#automatic-updates-delivery-process)
|
||||
- [Internet Explorer 11 automatic upgrades](#internet-explorer-11-automatic-upgrades)
|
||||
- [Options for blocking automatic delivery](#options-for-blocking-automatic-delivery)
|
||||
- [Availability of Internet Explorer 11](#availability-of-internet-explorer 11)
|
||||
- [Prevent automatic installation of Internet Explorer 11 with WSUS](#prevent-automatic-installation-of-internet-explorer-11-with-wsus)
|
||||
- [Automatic updates delivery process](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#automatic-updates-delivery-process)
|
||||
|
||||
- [Internet Explorer 11 automatic upgrades](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#internet-explorer-11-automatic-upgrades)
|
||||
|
||||
- [Options for blocking automatic delivery](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#options-for-blocking-automatic-delivery)
|
||||
|
||||
- [Availability of Internet Explorer 11](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#availability-of-internet-explorer-11)
|
||||
|
||||
- [Prevent automatic installation of Internet Explorer 11 with WSUS](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#prevent-automatic-installation-of-internet-explorer-11-with-wsus)
|
||||
|
||||
## Automatic updates delivery process
|
||||
|
||||
|
||||
@ -40,6 +40,7 @@
|
||||
### [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md)
|
||||
### [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md)
|
||||
### [Using a room control system](use-room-control-system-with-surface-hub.md)
|
||||
### [Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md)
|
||||
## [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md)
|
||||
## [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md)
|
||||
## [Top support solutions for Surface Hub](support-solutions-surface-hub.md)
|
||||
|
||||
@ -9,7 +9,7 @@ ms.pagetype: surfacehub
|
||||
author: jdeckerms
|
||||
ms.author: jdecker
|
||||
ms.topic: article
|
||||
ms.date: 03/06/2018
|
||||
ms.date: 05/22/2018
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
@ -17,6 +17,12 @@ ms.localizationpriority: medium
|
||||
|
||||
This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
|
||||
|
||||
## May 2018
|
||||
|
||||
New or changed topic | Description
|
||||
--- | ---
|
||||
[Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md) | New
|
||||
|
||||
## April 2018
|
||||
|
||||
New or changed topic | Description
|
||||
|
||||
BIN
devices/surface-hub/images/shrt-complete.png
Normal file
BIN
devices/surface-hub/images/shrt-complete.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 76 KiB |
BIN
devices/surface-hub/images/shrt-done.png
Normal file
BIN
devices/surface-hub/images/shrt-done.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 56 KiB |
BIN
devices/surface-hub/images/shrt-download.png
Normal file
BIN
devices/surface-hub/images/shrt-download.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 62 KiB |
BIN
devices/surface-hub/images/shrt-drive-start.png
Normal file
BIN
devices/surface-hub/images/shrt-drive-start.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 58 KiB |
BIN
devices/surface-hub/images/shrt-drive.png
Normal file
BIN
devices/surface-hub/images/shrt-drive.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 71 KiB |
BIN
devices/surface-hub/images/shrt-guidance.png
Normal file
BIN
devices/surface-hub/images/shrt-guidance.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 77 KiB |
BIN
devices/surface-hub/images/shrt-shortcut.png
Normal file
BIN
devices/surface-hub/images/shrt-shortcut.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 12 KiB |
BIN
devices/surface-hub/images/shrt-start.png
Normal file
BIN
devices/surface-hub/images/shrt-start.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 116 KiB |
@ -41,7 +41,8 @@ Learn about managing and updating Surface Hub.
|
||||
| [Connect other devices and display with Surface Hub](https://technet.microsoft.com/itpro/surface-hub/connect-and-display-with-surface-hub) | You can connect other device to your Surface Hub to display content.|
|
||||
| [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) | You can use Miracast on your wireless network or LAN to connect to Surface Hub. |
|
||||
[Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) | 802.1x Wired Authentication MDM policies have been enabled on Surface Hub devices.
|
||||
| [Using a room control system]( https://technet.microsoft.com/itpro/surface-hub/use-room-control-system-with-surface-hub) | Room control systems can be used with your Microsoft Surface Hub.|
|
||||
| [Using a room control system](https://technet.microsoft.com/itpro/surface-hub/use-room-control-system-with-surface-hub) | Room control systems can be used with your Microsoft Surface Hub.|
|
||||
[Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md) | Use the Surface Hub Recovery Tool to re-image the Surface Hub SSD.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
98
devices/surface-hub/surface-hub-recovery-tool.md
Normal file
98
devices/surface-hub/surface-hub-recovery-tool.md
Normal file
@ -0,0 +1,98 @@
|
||||
---
|
||||
title: Using the Surface Hub Recovery Tool
|
||||
description: How to use the Surface Hub Recovery Tool to re-image the SSD.
|
||||
ms.assetid: FDB6182C-1211-4A92-A930-6C106BCD5DC1
|
||||
keywords: manage Surface Hub
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: surfacehub
|
||||
author: jdeckerms
|
||||
ms.author: jdecker
|
||||
ms.topic: article
|
||||
ms.date: 05/22/2018
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
# Using the Surface Hub Recovery Tool
|
||||
|
||||
The [Microsoft Surface Hub Recovery Tool](https://www.microsoft.com/download/details.aspx?id=52210) helps you re-image your Surface Hub Solid State Drive (SSD) using a Windows 10 desktop device, without calling support or replacing the SSD. With this tool, you can reimage an SSD that has an unknown Administrator password, boot errors, was unable to complete a cloud recovery, or for a device that has an older version of the operating system. The tool will not fix physically damaged SSDs.
|
||||
|
||||
To re-image the Surface Hub SSD using the Recovery Tool, you'll need to remove the SSD from the Surface Hub, connect the drive to the USB-to-SATA cable, and then connect the cable to the desktop PC on which the Recovery Tool is installed. For more information on how to remove the existing drive from your Surface Hub, please refer to the [Surface Hub SSD Replacement Guide (PDF)](http://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf).
|
||||
|
||||
If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub Support](https://support.microsoft.com/help/4037644/surface-contact-surface-warranty-and-software-support).
|
||||
|
||||
## Prerequisites
|
||||
|
||||
### Mandatory
|
||||
|
||||
- Host PC running 64-bit version of Windows 10, version 1607 or higher.
|
||||
- Internet access
|
||||
- Open USB 2.0 or greater port
|
||||
- USB-to-SATA cable
|
||||
- 10 GB of free disk space on the host computer
|
||||
- SSDs shipped with Surface Hub or a SSD provided by Support as a replacement. SSDs not supplied by Microsoft are not supported.
|
||||
|
||||
### Recommended
|
||||
|
||||
- High-speed Internet connection
|
||||
- Open USB 3.0 port
|
||||
- USB 3.0 or higher USB-to-SATA cable
|
||||
- The imaging tool was tested with the following make and model of cables:
|
||||
- Startech USB312SAT3CB
|
||||
- Rosewill RCUC16001
|
||||
- Ugreen 20231
|
||||
|
||||
## Download Surface Hub Recovery Tool
|
||||
|
||||
Surface Hub Recovery Tool is available for download from [Surface Hub Tools for IT](https://www.microsoft.com/download/details.aspx?id=52210) under the file name **SurfaceHub_Recovery_v1.4.137.0.msi**.
|
||||
|
||||
To start the download, click **Download**, choose **SurfaceHub_Recovery_v1.4.137.0.msi** from the list, and click **Next**. From the pop-up, choose one of the following:
|
||||
|
||||
- Click **Run** to start the installation immediately.
|
||||
- Click **Save** to copy the download to your computer for later installation.
|
||||
|
||||
Install Surface Hub Recovery Tool on the host PC.
|
||||
|
||||
## Run Surface Hub Recovery Tool
|
||||
|
||||
1. On the host PC, select the **Start** button, scroll through the alphabetical list on the left, and select the recovery tool shortcut.
|
||||
|
||||
|
||||
|
||||
2. Click **Start**.
|
||||
|
||||
|
||||
|
||||
3. In the **Guidance** window, click **Next**.
|
||||
|
||||
|
||||
|
||||
4. click **Yes** to download the image. Time to download the recovery image is dependent on internet connection speeds. On an average corporate connection, it can take up to an hour to download the 8GB image file.
|
||||
|
||||
|
||||
|
||||
5. When the download is complete, the tool instructs you to connect an SSD drive. If the tool is unable to locate the attached drive, there is a good chance that the cable being used is not reporting the name of the SSD to Windows. The imaging tool must find the name of the drive as "LITEON L CH-128V2S USB Device" before it can continue. For more information on how to remove the existing drive from your Surface Hub, please refer to the [Surface Hub SSD Replacement Guide (PDF)](http://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf).
|
||||
|
||||
|
||||
|
||||
6. When the drive is recognized, click **Start** to begin the re-imaging process. On the warning that all data on the drive will be erased, click **OK**.
|
||||
|
||||
|
||||
|
||||
Prior to applying the system image to the drive, the SSD is repartitioned and formatted. Copying the system binaries will take approximately 30 minutes, but can take longer depending on the speed of your USB bus, the cable being used, or antivirus software installed on your system.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Troubleshooting and common problems
|
||||
|
||||
Issue | Notes
|
||||
--- | ---
|
||||
The tool fails to image the SSD | Make sure you are using a factory-supplied SSD and one of the tested cables.
|
||||
The reimaging process appears halted/frozen | It is safe to close and restart the Surface Hub Recovery Tool with no ill effect to the SSD.
|
||||
The drive isn’t recognized by the tool | Verify that the Surface Hub SSD is enumerated as a Lite-On drive, "LITEON L CH-128V2S USB Device". If the drive is recognized as another named device, your current cable isn’t compatible. Try another cable or one of the tested cable listed above.
|
||||
Error: -2147024809 | Open Disk Manager and remove the partitions on the Surface Hub drive. Disconnect and reconnect the drive to the host machine. Restart the imaging tool again.
|
||||
|
||||
If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub Support](https://support.microsoft.com/help/4037644/surface-contact-surface-warranty-and-software-support).
|
||||
@ -2601,6 +2601,7 @@ The following list shows the configuration service providers supported in Window
|
||||
| [NodeCache CSP](nodecache-csp.md) |  |  |
|
||||
[PassportForWork CSP](passportforwork-csp.md) |  |  |
|
||||
| [Policy CSP](policy-configuration-service-provider.md) |  |  |
|
||||
| [RemoteWipe CSP](remotewipe-csp.md) |  | 4 |
|
||||
| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) |  |  |
|
||||
| [Update CSP](update-csp.md) |  |  |
|
||||
| [VPN2 CSP](vpnv2-csp.md) |  |  |
|
||||
|
||||
@ -201,14 +201,14 @@ ADMX Info:
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1709. Boolean policy to disable the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device.
|
||||
|
||||
The Windows 10 Automatic ReDeployment feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students.
|
||||
The Autopilot Reset feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the Autopilot Reset is triggered the devices are for ready for use by information workers or students.
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 - Enable the visibility of the credentials for Windows 10 Automatic ReDeployment
|
||||
- 1 - Disable visibility of the credentials for Windows 10 Automatic ReDeployment
|
||||
- 0 - Enable the visibility of the credentials for Autopilot Reset
|
||||
- 1 - Disable visibility of the credentials for Autopilot Reset
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
@ -15,8 +15,10 @@ author: greg-lindsay
|
||||
|
||||
This topic describes how to deploy Windows 10 Enterprise E3 or E5 licenses with [Windows 10 Enterprise Subscription Activation](windows-10-enterprise-subscription-activation.md) or [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) and Azure Active Directory (Azure AD).
|
||||
|
||||
>Note: Windows 10 Enterprise Subscription Activation (EA or MPSA) requires Windows 10 Pro, version 1703 or later.<BR>
|
||||
>[!NOTE]
|
||||
>Windows 10 Enterprise Subscription Activation (EA or MPSA) requires Windows 10 Pro, version 1703 or later.<BR>
|
||||
>Windows 10 Enterprise E3 in CSP requires Windows 10 Pro, version 1607 or later.<BR>
|
||||
>Automatic, non-KMS activation requires Windows 10, version 1803 or later on a device with a firmware-embedded activation key.<BR>
|
||||
|
||||
## Enabling Subscription Activation with an existing EA
|
||||
|
||||
@ -82,7 +84,7 @@ The following methods are available to assign licenses:
|
||||
|
||||
## Explore the upgrade experience
|
||||
|
||||
Now that your subscription has been established and Windows 10 Enterprise E3 or E5 licenses have been assigned to users, the users are ready to upgrade their devices running Windows 10 Pro, version 1703 edition to Windows 10 Enterprise edition. So what will the users experience? How will they upgrade their devices?
|
||||
Now that your subscription has been established and Windows 10 Enterprise E3 or E5 licenses have been assigned to users, the users are ready to upgrade their devices running Windows 10 Pro, (version 1703 or later) to Windows 10 Enterprise. What will the users experience? How will they upgrade their devices?
|
||||
|
||||
### Step 1: Join Windows 10 Pro devices to Azure AD
|
||||
|
||||
@ -135,15 +137,17 @@ Now the device is Azure AD joined to the company’s subscription.
|
||||
|
||||
Now the device is Azure AD joined to the company’s subscription.
|
||||
|
||||
### Step 2: Verify that Pro edition is activated
|
||||
### Step 2: Pro edition activation
|
||||
|
||||
Windows 10 Pro must be successfully activated in **Settings > Update & Security > Activation**, as illustrated in **Figure 7a**.
|
||||
>[!IMPORTANT]
|
||||
>If the device is running Windows 10, version 1803 or later, this step is no longer necessary when there is a firmware-embedded activation key on the device. Starting with Windows 10, version 1803 the device will automatically activate Windows 10 Enterprise using the firmware-embedded activation key.<br>
|
||||
>If the device is running Windows 10, version 1703 or 1709, then Windows 10 Pro must be successfully activated in **Settings > Update & Security > Activation**, as illustrated in **Figure 7a**.
|
||||
|
||||
<span id="win-10-pro-activated"/>
|
||||
<img src="images/sa-pro-activation.png" alt="Windows 10 Pro activated" width="710" height="440" />
|
||||
<BR>**Figure 7a - Windows 10 Pro activation in Settings** <BR>
|
||||
|
||||
Windows 10 Pro activation is required before Enterprise E3 or E5 can be enabled.
|
||||
Windows 10 Pro activation is required before Enterprise E3 or E5 can be enabled (Windows 10, versions 1703 and 1709 only).
|
||||
|
||||
|
||||
### Step 3: Sign in using Azure AD account
|
||||
@ -176,7 +180,7 @@ Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscr
|
||||
|
||||
In some instances, users may experience problems with the Windows 10 Enterprise E3 or E5 subscription. The most common problems that users may experience are as follows:
|
||||
|
||||
- The existing Windows 10 Pro, version 1703 operating system is not activated.
|
||||
- The existing Windows 10 Pro, version 1703 or 1709 operating system is not activated. This problem does not apply to Windows 10, version 1803 or later.
|
||||
|
||||
- The Windows 10 Enterprise E3 or E5 subscription has lapsed or has been removed.
|
||||
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
|
||||
localizationpriority: high
|
||||
ms.sitesec: library
|
||||
ms.pagetype: mdt
|
||||
ms.date: 12/05/2017
|
||||
ms.date: 05/17/2018
|
||||
author: greg-lindsay
|
||||
---
|
||||
|
||||
@ -23,15 +23,27 @@ Deployment instructions are provided for the following scenarios:
|
||||
## Requirements
|
||||
|
||||
- VMs must be running Windows 10 Pro, version 1703 (also known as the Creator's Update) or later.
|
||||
- VMs must be Active Directory-joined or Azure Active Directory-joined.
|
||||
- VMs must be Active Directory-joined or Azure Active Directory (AAD)-joined.
|
||||
- VMs must be generation 1.
|
||||
- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH).
|
||||
|
||||
## Activation
|
||||
|
||||
The underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise.
|
||||
### Scenario 1
|
||||
- The VM is running Windows 10, version 1803 or later.
|
||||
- The VM is hosted in Azure or another [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH).
|
||||
|
||||
When a user with VDA rights signs in to the VM using their AAD credentials, the VM is automatically stepped-up to Enterprise and activated. There is no need to perform Windows 10 Pro activation. This eliminates the need to maintain KMS or MAK in the qualifying cloud infrastructure.
|
||||
|
||||
Procedures in this topic provide a Windows 10 Pro Generic Volume License Key (GVLK). Activation with this key is accomplished using a Volume License KMS activation server provided by the QMTH. Alternatively, a KMS activation server on your corporate network can be used if you have configured a private connection, such as [ExpressRoute](https://azure.microsoft.com/services/expressroute/) or [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/).
|
||||
### Scenario 2
|
||||
- The Hyper-V host and the VM are both running Windows 10, version 1803 or later.
|
||||
|
||||
[Inherited Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation#inherited-activation) is enabled. All VMs created by a user with a Windows 10 E3 or E5 license are automatically activated independent of whether a user signs in iwth a local account or using an Azure Active Directory account.
|
||||
|
||||
### Scenario 3
|
||||
- The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) partner.
|
||||
|
||||
In this scenario, the underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise. Activation is accomplished using a Windows 10 Pro Generic Volume License Key (GVLK) and a Volume License KMS activation server provided by the hoster. Alternatively, a KMS activation server on your corporate network can be used if you have configured a private connection, such as [ExpressRoute](https://azure.microsoft.com/services/expressroute/) or [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/).
|
||||
|
||||
For examples of activation issues, see [Troubleshoot the user experience](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#troubleshoot-the-user-experience).
|
||||
|
||||
@ -50,23 +62,26 @@ For examples of activation issues, see [Troubleshoot the user experience](https:
|
||||
6. Follow the instructions to use sysprep at [Steps to generalize a VHD](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image#steps-to-generalize-a-vhd) and then start the VM again.
|
||||
7. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd).
|
||||
8. Open Windows Configuration Designer and click **Provison desktop services**.
|
||||
9. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name.
|
||||
- Note: You can use a different project name, but this name is also used with dism.exe in a subsequent step.
|
||||
10. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**.
|
||||
11. On the Set up network page, choose **Off**.
|
||||
12. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details.
|
||||
9. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 10.
|
||||
|
||||
1. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name.
|
||||
- Note: You can use a different project name, but this name is also used with dism.exe in a subsequent step.
|
||||
2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**.
|
||||
10. On the Set up network page, choose **Off**.
|
||||
11. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details.
|
||||
- Note: This step is different for [Azure AD-joined VMs](#azure-active-directory-joined-vms).
|
||||
13. On the Add applications page, add applications if desired. This step is optional.
|
||||
14. On the Add certificates page, add certificates if desired. This step is optional.
|
||||
15. On the Finish page, click **Create**.
|
||||
16. In file explorer, double-click the VHD to mount the disk image. Determine the drive letter of the mounted image.
|
||||
17. Type the following at an elevated commnand prompt. Replace the letter **G** with the drive letter of the mounted image, and enter the project name you used if it is different than the one suggested:
|
||||
12. On the Add applications page, add applications if desired. This step is optional.
|
||||
13. On the Add certificates page, add certificates if desired. This step is optional.
|
||||
14. On the Finish page, click **Create**.
|
||||
15. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 16.
|
||||
1. In file explorer, double-click the VHD to mount the disk image. Determine the drive letter of the mounted image.
|
||||
2. Type the following at an elevated commnand prompt. Replace the letter **G** with the drive letter of the mounted image, and enter the project name you used if it is different than the one suggested:
|
||||
|
||||
```
|
||||
Dism.exe /Image=G:\ /Add-ProvisioningPackage /PackagePath: "Desktop AD Enrollment Pro GVLK.ppkg"
|
||||
```
|
||||
18. Right-click the mounted image in file explorer and click **Eject**.
|
||||
19. See instructions at [Upload and create VM from generalized VHD](https://docs.microsoft.com/azure/virtual-machines/windows/upload-generalized-managed#log-in-to-azure) to log in to Azure, get your storage account details, upload the VHD, and create a managed image.
|
||||
3. Right-click the mounted image in file explorer and click **Eject**.
|
||||
1. See instructions at [Upload and create VM from generalized VHD](https://docs.microsoft.com/azure/virtual-machines/windows/upload-generalized-managed#log-in-to-azure) to log in to Azure, get your storage account details, upload the VHD, and create a managed image.
|
||||
|
||||
## Azure Active Directory-joined VMs
|
||||
|
||||
@ -75,8 +90,8 @@ For examples of activation issues, see [Troubleshoot the user experience](https:
|
||||
|
||||
For Azure AD-joined VMs, follow the same instructions (above) as for [Active Directory-joined VMs](#active-directory-joined-vms) with the following exceptions:
|
||||
- In step 9, during setup with Windows Configuration Designer, under **Name**, type a name for the project that indicates it is not for Active Directory joined VMs, such as **Desktop Bulk Enrollment Token Pro GVLK**.
|
||||
- In step 12, during setup with Windows Configuration Designer, on the Account Management page, instead of enrolling in Active Directory, choose **Enroll in Azure AD**, click **Get Bulk Token**, sign in and add the bulk token using your organization's credentials.
|
||||
- In step 17, when entering the PackagePath, use the project name you entered in step 9 (ex: **Desktop Bulk Enrollment Token Pro GVLK.ppkg**)
|
||||
- In step 11, during setup with Windows Configuration Designer, on the Account Management page, instead of enrolling in Active Directory, choose **Enroll in Azure AD**, click **Get Bulk Token**, sign in and add the bulk token using your organization's credentials.
|
||||
- In step 15, sub-step 2, when entering the PackagePath, use the project name you entered in step 9 (ex: **Desktop Bulk Enrollment Token Pro GVLK.ppkg**)
|
||||
- When attempting to access the VM using remote desktop, you will need to create a custom RDP settings file as described below in [Create custom RDP settings for Azure](#create-custom-rpd-settings-for-azure).
|
||||
|
||||
## Azure Gallery VMs
|
||||
@ -92,9 +107,10 @@ For Azure AD-joined VMs, follow the same instructions (above) as for [Active Dir
|
||||
4. Click **Add**, type **Authenticated users**, and then click **OK** three times.
|
||||
5. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd).
|
||||
6. Open Windows Configuration Designer and click **Provison desktop services**.
|
||||
7. Under **Name**, type **Desktop Bulk Enrollment Token Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name.
|
||||
- Note: You can use a different project name, but this name is also used with dism.exe in a subsequent step.
|
||||
8. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**.
|
||||
7. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 8.
|
||||
1. Under **Name**, type **Desktop Bulk Enrollment Token Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name.
|
||||
2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**.
|
||||
8. Under **Name**, type **Desktop Bulk Enrollment**, click **Finish**, and then on the **Set up device** page enter a device name.
|
||||
9. On the Set up network page, choose **Off**.
|
||||
10. On the Account Management page, choose **Enroll in Azure AD**, click **Get Bulk Token**, sign in, and add the bulk token using your organizations credentials.
|
||||
11. On the Add applications page, add applications if desired. This step is optional.
|
||||
|
||||
@ -54,6 +54,7 @@ The following figure illustrates how deploying Windows 10 has evolved with each
|
||||
- **Windows 10 1607** made a big leap forward. Now you can just change the product key and the SKU instantly changes from Windows 10 Pro to Windows 10 Enterprise. In addition to provisioning packages and MDM, you can just inject a key using SLMGR.VBS (which injects the key into WMI), so it became trivial to do this using a command line.<br>
|
||||
- **Windows 10 1703** made this “step-up” from Windows 10 Pro to Windows 10 Enterprise automatic for those that subscribed to Windows 10 Enterprise E3 or E5 via the CSP program.<br>
|
||||
- **Windows 10 1709** adds support for Windows 10 Subscription Activation, very similar to the CSP support but for large enterprises, enabling the use of Azure AD for assigning licenses to users. When those users sign in on an AD or Azure AD-joined machine, it automatically steps up from Windows 10 Pro to Windows 10 Enterprise.
|
||||
- **Windows 10 1803** updates Windows 10 Subscription Activation to enable pulling activation keys directly from firmware for devices that support firmware-embedded keys. It is no longer necessary to run a script to perform the activation step on Windows 10 Pro prior to activating Enterprise. For virtual machines and hosts running Windows 10, version 1803 [Inherited Activation](#inherited-activation) is also enabled.
|
||||
|
||||
## Requirements
|
||||
|
||||
@ -85,21 +86,24 @@ You can benefit by moving to Windows as an online service in the following ways:
|
||||
|
||||
When a licensed user signs in to a device that meets requirements using the Azure AD credentials associated with a Windows 10 Enterprise E3 or E5 license, the operating system turns from Windows 10 Pro to Windows 10 Enterprise and all the appropriate Windows 10 Enterprise features are unlocked. When a user’s subscription expires or is transferred to another user, the Windows 10 Enterprise device reverts seamlessly to Windows 10 Pro edition, after a grace period of up to 90 days.
|
||||
|
||||
Devices currently running Windows 10 Pro, version 1703 can get Windows 10 Enterprise Semi-Annual Channel on up to five devices for each user covered by the license. This benefit does not include Long Term Servicing Channel.
|
||||
Devices currently running Windows 10 Pro, version 1703 or later can get Windows 10 Enterprise Semi-Annual Channel on up to five devices for each user covered by the license. This benefit does not include Long Term Servicing Channel.
|
||||
|
||||
### Scenarios
|
||||
|
||||
**Scenario #1**: Using KMS for activation, just purchased Windows 10 Enterprise E3 or E5 subscriptions (or for some reason have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise), and you are using Windows 10 1607 or above.
|
||||
**Scenario #1**: You are using Windows 10 1803 or above, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise).
|
||||
|
||||
All you need to do to change all of your Windows 10 Pro devices to Windows 10 Enterprise is to run this command on each computer:
|
||||
All of your Windows 10 Pro devices will step-up to Windows 10 Enterprise, and devices that are already running Windows 10 Enterprise will become activated when a Subscription Activation-enabled user signs in to the device.
|
||||
|
||||
**Scenario #2**: You are using Windows 10, version 1607, 1703, or 1709 with KMS for activation, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise).
|
||||
|
||||
To change all of your Windows 10 Pro devices to Windows 10 Enterprise, run the following command on each computer:
|
||||
|
||||
<pre style="overflow-y: visible">
|
||||
cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
|
||||
</pre>
|
||||
cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43</pre>
|
||||
|
||||
This key comes from [Appendix A: KMS Client Setup Keys](https://technet.microsoft.com/library/jj612867.aspx) in the Volume Activation guide. The command causes the OS to change to Windows 10 Enterprise and then seek out the KMS server to reactivate. It is also possible to inject the Windows 10 Pro key from this article if you wish to step back down from Enterprise to Pro.
|
||||
The command causes the OS to change to Windows 10 Enterprise and then seek out the KMS server to reactivate. This key comes from [Appendix A: KMS Client Setup Keys](https://technet.microsoft.com/library/jj612867.aspx) in the Volume Activation guide. It is also possible to inject the Windows 10 Pro key from this article if you wish to step back down from Enterprise to Pro.
|
||||
|
||||
**Scenario #2**: Using Azure AD-joined devices or Active Directory-joined devices running Windows 10 1709 or later, and with Azure AD synchronization configured, just follow the steps in [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) to acquire a $0 SKU and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. Then, assign that license to all of your Azure AD users. These can be AD-synced accounts. The device will automatically change from Windows 10 Pro to Windows 10 Enterprise when that user signs in.
|
||||
**Scenario #3**: Using Azure AD-joined devices or Active Directory-joined devices running Windows 10 1709 or later, and with Azure AD synchronization configured, just follow the steps in [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) to acquire a $0 SKU and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. Then, assign that license to all of your Azure AD users. These can be AD-synced accounts. The device will automatically change from Windows 10 Pro to Windows 10 Enterprise when that user signs in.
|
||||
|
||||
In summary, if you have a Windows 10 Enterprise E3 or E5 subscription, but are still running Windows 10 Pro, it’s really simple (and quick) to move to Windows 10 Enterprise using one of the scenarios above.
|
||||
|
||||
@ -122,7 +126,9 @@ When you have the required Azure AD subscription, group-based licensing is the p
|
||||
|
||||
### Existing Enterprise deployments
|
||||
|
||||
If you have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you are able to seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key.
|
||||
If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate Windows 10 Enterprise.
|
||||
|
||||
If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key.
|
||||
|
||||
If the computer has never been activated with a Pro key, run the following script. Copy the text below into a .cmd file and run the file from an elevated command prompt:
|
||||
|
||||
|
||||
@ -4,13 +4,13 @@
|
||||
## [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md)
|
||||
## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
|
||||
## [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md)
|
||||
## Basic level diagnostics events and fields
|
||||
## Basic level Windows diagnostic data events and fields
|
||||
### [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)
|
||||
### [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
|
||||
### [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
|
||||
## Enhanced level diagnostics events and fields
|
||||
## Enhanced level Windows diagnostic data events and fields
|
||||
### [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
|
||||
## Full level diagnostics events and fields
|
||||
## Full level categories
|
||||
### [Windows 10, version 1709 and newer diagnostic data for the Full level](windows-diagnostic-data.md)
|
||||
### [Windows 10, version 1703 diagnostic data for the Full level](windows-diagnostic-data-1703.md)
|
||||
## [Manage Windows 10 connection endpoints](manage-windows-endpoints.md)
|
||||
|
||||
@ -21,7 +21,9 @@ ms.date: 01/17/2018
|
||||
## Introduction
|
||||
The Diagnostic Data Viewer is a Windows app that lets you review the diagnostic data your device is sending to Microsoft, grouping the info into simple categories based on how it's used by Microsoft.
|
||||
|
||||
## Install and Use the Diagnostic Data ViewerYou must turn on data viewing and download the app before you can use the Diagnostic Data Viewer to review your device's diagnostic data.
|
||||
## Install and Use the Diagnostic Data Viewer
|
||||
|
||||
You must turn on data viewing and download the app before you can use the Diagnostic Data Viewer to review your device's diagnostic data.
|
||||
|
||||
### Turn on data viewing
|
||||
Before you can use this tool, you must turn on data viewing in the **Settings** panel. Turning on data viewing lets Windows store your device's diagnostic data until you turn it off. Turning off data viewing stops Windows from collecting your diagnostic data and clears the existing diagnostic data from your device.
|
||||
|
||||
@ -46,7 +46,7 @@ The following fields are available:
|
||||
- **LicenseType:** Reserved for future use
|
||||
- **ProcessDurationMS_Sum:** Total duration of wall clock process instances
|
||||
- **ReadCountAtExit_Sum:** Total IO reads for a process when it exited
|
||||
- **ReadSizeInKBAtExit_Sum:**Total IO read size for a process when it exited
|
||||
- **ReadSizeInKBAtExit_Sum:** Total IO read size for a process when it exited
|
||||
- **ResumeCount:** Number of times a process instance has resumed
|
||||
- **RunningDurationMS_Sum:** Total uptime
|
||||
- **SuspendCount:** Number of times a process instance was suspended
|
||||
|
||||
@ -32,7 +32,7 @@ sections:
|
||||
|
||||
- type: markdown
|
||||
|
||||
text: Get ready for General Data Protection Regulation (GDPR) by viewing and configuring diagnostics data in your organization.
|
||||
text: Get ready for General Data Protection Regulation (GDPR) by viewing and configuring Windows diagnostic data in your organization.
|
||||
|
||||
- items:
|
||||
|
||||
@ -68,21 +68,21 @@ sections:
|
||||
|
||||
- href: \windows\privacy\diagnostic-data-viewer-overview
|
||||
|
||||
html: <p>Review the diagnostic data sent to Microsoft by device in your organization</p>
|
||||
html: <p>Review the Windows diagnostic data sent to Microsoft by device in your organization</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_investigate.svg
|
||||
|
||||
title: View diagnostic data
|
||||
title: View Windows diagnostic data
|
||||
|
||||
- title: Understand Diagnostic Data in Windows 10
|
||||
- title: Understand Windows diagnostic data in Windows 10
|
||||
|
||||
items:
|
||||
|
||||
- type: paragraph
|
||||
|
||||
text: 'For the latest Windows 10 version, Learn more about what Windows Diagnostic Data is gathered at various diagnostics levels.'
|
||||
text: 'For the latest Windows 10 version, learn more about what Windows diagnostic data is collected at various diagnostics levels.'
|
||||
|
||||
- type: list
|
||||
|
||||
@ -96,7 +96,7 @@ sections:
|
||||
|
||||
- href: \windows\privacy\basic-level-windows-diagnostic-events-and-fields
|
||||
|
||||
html: <p>Learn more about basic diagnostics events and fields collected</p>
|
||||
html: <p>Learn more about basic Windows diagnostic data events and fields collected</p>
|
||||
|
||||
image:
|
||||
|
||||
@ -106,7 +106,7 @@ sections:
|
||||
|
||||
- href: \windows\privacy\enhanced-diagnostic-data-windows-analytics-events-and-fields
|
||||
|
||||
html: <p>Learn more about diagnostics events and fields used by Windows Analytics</p>
|
||||
html: <p>Learn more about Windows diagnostic data events and fields used by Windows Analytics</p>
|
||||
|
||||
image:
|
||||
|
||||
@ -116,13 +116,13 @@ sections:
|
||||
|
||||
- href: \windows\privacy\windows-diagnostic-data
|
||||
|
||||
html: <p>Learn more about all diagnostics data collected</p>
|
||||
html: <p>Learn more about all Windows diagnostic data collected</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_get-started.svg
|
||||
|
||||
title: Full level events and fields
|
||||
title: Full level data categories
|
||||
|
||||
- items:
|
||||
|
||||
@ -144,7 +144,7 @@ sections:
|
||||
|
||||
html: <p><a class="barLink" href="https://www.microsoft.com/en-us/trustcenter/cloudservices/windows10">Windows 10 on Trust Center</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://docs.microsoft.com/en-us/microsoft-365/compliance/gdpr">GDPR on Microsoft365 Compliance solutions</a></p>
|
||||
<p><a class="barLink" href="https://docs.microsoft.com/en-us/microsoft-365/compliance/gdpr">GDPR on Microsoft 365 Compliance solutions</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted">Support for GDPR Accountability on Service Trust Portal</a></p>
|
||||
|
||||
@ -256,6 +256,7 @@ This table provides the ISO/IEC 19944:2017-specific definitions for use and de-i
|
||||
|<a name="#promote">Promote</a>|9.3.6 Market/advertise/promote|Use of the specified data categories to promote a product or service in or on a first-party Microsoft product or service.|
|
||||
|
||||
<br><br>
|
||||
|
||||
|Data identification qualifiers |ISO/IEC 19944:2017 Reference |Microsoft usage notes |
|
||||
|-|-|-|
|
||||
|<a name="#pseudo">Pseudonymized Data</a> |8.3.3 Pseudonymized data|As defined|
|
||||
|
||||
@ -38,68 +38,26 @@ For more information on enabling MDM with Microsoft Intune, see [Setup Windows D
|
||||
|
||||
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
|
||||
### Using the Azure Intune Portal to deploy Windows Defender Advanced Threat Protection policies on Windows 10 1607 and higher
|
||||
### Use the Azure Intune Portal to deploy Windows Defender Advanced Threat Protection policies on Windows 10 1607 and higher
|
||||
|
||||
1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
1. Login to the [Microsoft Azure portal](https://portal.azure.com).
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
2. Select **Device Configuration > Profiles > Create profile**.
|
||||
|
||||
b. Select Windows 10 as the operating system.
|
||||
3. Enter a **Name** and **Description**.
|
||||
|
||||
c. In the **Deployment method** field, select **Mobile Device Management / Microsoft Intune**.
|
||||
|
||||
d. Click **Download package**, and save the .zip file.
|
||||
4. For **Platform**, select **Windows 10 and later**.
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*.
|
||||
5. For **Profile type**, select **Windows Defender ATP (Windows 10 Desktop)**.
|
||||
|
||||
3. Login to the [Microsoft Azure portal](https://portal.azure.com).
|
||||
6. Configure the settings:
|
||||
- **Onboard Configuration Package**: Browse and select the **WindowsDefenderATP.onboarding** file you downloaded. This file enables a setting so devices can report to the Windows Defender ATP service.
|
||||
- **Sample sharing for all files**: Allows samples to be collected, and shared with Windows Defender ATP. For example, if you see a suspicious file, you can submit it to Windows Defender ATP for deep analysis.
|
||||
- **Expedite telemetry reporting frequency**: For devices that are at high risk, enable this setting so it reports telemetry to the Windows Defender ATP service more frequently.
|
||||
- **Offboard Configuration Package**: If you want to remove Windows Defender ATP monitoring, you can download an offboarding package from the Windows Defender ATP portal, and add it. Otherwise, skip this property.
|
||||
|
||||
7. Select **OK**, and **Create** to save your changes, which creates the profile.
|
||||
|
||||
4. From the Intune blade, choose **Device configuration**.
|
||||
|
||||
|
||||
|
||||
5. Under **Manage**, choose **Profiles** and click **Create Profile**.
|
||||
|
||||
|
||||
|
||||
6. Type a name, description and choose **Windows 10 and later** as the Platform and **Custom** as the Profile type.
|
||||
|
||||
|
||||
|
||||
7. Click **Settings** > **Configure**.
|
||||
|
||||
|
||||
|
||||
8. Under Custom OMA-URI Settings, click **Add**.
|
||||
|
||||
|
||||
|
||||
9. Enter the following values, then click **OK**.
|
||||
|
||||
|
||||
|
||||
- **Name**: Type a name for the setting.
|
||||
- **Description**: Type a description for the setting.
|
||||
- **OMA-URI**: _./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding_
|
||||
- **Value**: Copy and paste the contents of the WindowsDefenderATP.onboarding file you downloaded.
|
||||
|
||||
10. Save the settings by clicking **OK**.
|
||||
|
||||
11. Click **Create**.
|
||||
|
||||
|
||||
|
||||
12. To deploy the Profile, click **Assignments**.
|
||||
|
||||
|
||||
|
||||
13. Search for and select the Group you want to apply the Configuration Profile to, then click **Select**.
|
||||
|
||||
|
||||
|
||||
14. Click **Save** to finish deploying the Configuration Profile.
|
||||
|
||||
|
||||
|
||||
|
||||
### Onboard and monitor machines using the classic Intune console
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user