mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 22:07:22 +00:00
minor changes
This commit is contained in:
Greg Lindsay
commit
d1113ee6f1
@ -1,4 +1,6 @@
|
||||
# win-cpub-itpro-docs
|
||||
This repo hosts the WDG ITPro content that is published to TechNet.
|
||||
|
||||
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
|
||||
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
|
||||
|
||||
English Handoff Folder Structure Demo!
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
#[Microsoft Edge - Deployment Guide for IT Pros](index.md)
|
||||
##[Change History for Microsoft Edge](change-history-for-microsoft-edge.md)
|
||||
##[Change history for Microsoft Edge](change-history-for-microsoft-edge.md)
|
||||
##[Microsoft Edge requirements and language support](hardware-and-software-requirements.md)
|
||||
##[Available policies for Microsoft Edge](available-policies.md)
|
||||
##[Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md)
|
||||
|
||||
@ -9,6 +9,8 @@ ms.sitesec: library
|
||||
# Change history for Microsoft Edge
|
||||
This topic lists new and updated topics in the Microsoft Edge documentation for both Windows 10 and Windows 10 Mobile.
|
||||
|
||||
For a detailed feature list of what's in the current Microsoft Edge releases, the Windows Insider Preview builds, and what was introduced in previous releases, see the [Microsoft Edge changelog](https://developer.microsoft.com/en-us/microsoft-edge/platform/changelog/).
|
||||
|
||||
## June 2016
|
||||
|New or changed topic | Description |
|
||||
|----------------------|-------------|
|
||||
|
||||
@ -14,8 +14,6 @@ title: Use Enterprise Mode to improve compatibility (Microsoft Edge for IT Pros)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
|
||||
If you have specific web sites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the web sites will automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work properly with Microsoft Edge, you can set all intranet sites to automatically open using IE11.
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ If you prefer to use a graphical user interface, you can create a device account
|
||||
1. Sign in to Office 365 by visiting http://portal.office.com/admin/
|
||||
2. Provide the admin credentials for your Office 365 tenant. This will take you to your Office 365 Admin Center.
|
||||
|
||||
|
||||
|
||||
|
||||
3. Once you are at the Office 365 Admin Center, navigate to **Users** in the left panel, and then click **Active Users**.
|
||||
|
||||
@ -37,13 +37,13 @@ If you prefer to use a graphical user interface, you can create a device account
|
||||
|
||||
4. On the controls above the list of users, click **+** to create a new user. You'll need to enter a **Display name**, **User name**, **Password** and an email address for the recipient of the password. Optionally you can change the password manually, but we recommend that you use the auto-generated option. You also need to assign this account a license that gives the account access to Exchange and Skype for Business services.
|
||||
|
||||
|
||||
|
||||
|
||||
Click **Create**.
|
||||
|
||||
5. Once the account has been successfully created, click **Close** on the resulting dialog box, and you will see the admin center Active Users list again.
|
||||
|
||||
|
||||
|
||||
|
||||
6. Select the user you just created from the **Active Users** list. You need to disable the Skype for Business license, because you can’t create a Skype Meeting Room with this option.
|
||||
|
||||
@ -51,7 +51,7 @@ If you prefer to use a graphical user interface, you can create a device account
|
||||
|
||||
In the right panel you can see the account properties and several optional actions. The process so far has created a regular Skype account for this user, which you need to disable. Click **Edit** for the **Assigned license** section, then click the dropdown arrow next to the license to expand the details.
|
||||
|
||||
|
||||
|
||||
|
||||
From the list, uncheck **Skype for Business Online (plan 2)** (this license may vary depending on your organization), and click **SAVE**.
|
||||
|
||||
@ -59,39 +59,39 @@ If you prefer to use a graphical user interface, you can create a device account
|
||||
|
||||
1. In the Office 365 Admin Center’s left panel, click **ADMIN**, and then click **Exchange**.
|
||||
|
||||
|
||||
|
||||
|
||||
2. This will open another tab on your browser to take you to the Exchange Admin Center, where you can create and set the Mailbox Setting for Surface Hub.
|
||||
|
||||
|
||||
|
||||
|
||||
3. To create a Mobile Device Mailbox Policy, click **Mobile** from the left panel and then click **Mobile device mailbox policies**. Surface Hubs require an account with a mobile device mailbox policy that does not require a password, so if you already have an existing policy that matches this requirement, you can apply that policy to the account. Otherwise use the following steps to create a new one to be used only for Surface Hub device accounts.
|
||||
|
||||
|
||||
|
||||
|
||||
4. To create a New Surface Hub mobile device mailbox policy, click the **+** button from the controls above the list of policies to add a new policy. For the name, provide a name that will help you distinguish this policy from other device accounts (for example, *SurfaceHubDeviceMobilePolicy*). Make sure the policy does not require a password for the devices assigned to, so make sure **Require a Password** remains unchecked, then click **Save**.
|
||||
|
||||
|
||||
|
||||
|
||||
5. After you have created the new mobile device mailbox policy, go back to the **Exchange Admin Center** and you will see the new policy listed.
|
||||
|
||||
|
||||
|
||||
|
||||
6. Now, to apply the ActiveSync policy without using PowerShell, you can do the following: In the EAC, click **Recipients** > **Mailboxes** and then select a mailbox.
|
||||
|
||||
|
||||
|
||||
|
||||
7. In the Details pane, scroll to **Phone and Voice Features** and click **View details** to display the **Mobile Device Details** screen.
|
||||
|
||||
|
||||
|
||||
|
||||
8. The mobile device mailbox policy that’s currently assigned is displayed. To change the mobile device mailbox policy, click **Browse**.
|
||||
|
||||
|
||||
|
||||
|
||||
9. Choose the appropriate mobile device mailbox policy from the list, click **OK** and then click **Save**.
|
||||
|
||||
|
||||
|
||||
|
||||
### <a href="" id="create-device-acct-o365-complete-acct"></a>Use PowerShell to complete device account creation
|
||||
|
||||
@ -107,11 +107,11 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
|
||||
|
||||
1. Run Windows PowerShell as Administrator.
|
||||
|
||||
|
||||
|
||||
|
||||
2. Create a Credentials object, then create a new session that connects to Skype for Business Online, and provide the global tenant administrator account, then click **OK**.
|
||||
|
||||
|
||||
|
||||
|
||||
3. To connect to Microsoft Online Services, run:
|
||||
|
||||
@ -119,7 +119,7 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
|
||||
Connect-MsolService -Credential $Cred
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
4. Now to connect to Skype for Business Online Services, run:
|
||||
|
||||
@ -127,7 +127,7 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
|
||||
$sfbsession = New-CsOnlineSession -Credential $cred
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
5. Finally, to connect to Exchange Online Services, run:
|
||||
|
||||
@ -136,7 +136,7 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
|
||||
"https://outlook.office365.com/powershell-liveid/" -Credential $cred -Authentication "Basic" –AllowRedirection
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
6. Now you have to import the Skype for Business Online Session and the Exchange Online session you have just created, which will import the Exchange and Skype Commands so you can use them locally.
|
||||
|
||||
@ -147,7 +147,7 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
|
||||
|
||||
Note that this could take a while to complete.
|
||||
|
||||
|
||||
|
||||
|
||||
7. Once you’re connected to the online services you need to run a few more cmdlets to configure this account as a Surface Hub device account.
|
||||
|
||||
@ -180,11 +180,11 @@ Now that you're connected to the online services, you can finish setting up the
|
||||
|
||||
You will see the correct email address.
|
||||
|
||||
|
||||
|
||||
|
||||
2. You need to convert the account into to a room mailbox, so run:
|
||||
|
||||
|
||||
|
||||
|
||||
``` syntax
|
||||
Set-Mailbox $strEmail -Type Room
|
||||
@ -196,7 +196,7 @@ Now that you're connected to the online services, you can finish setting up the
|
||||
Set-Mailbox $strEmail -RoomMailboxPassword (ConvertTo-SecureString -String "<your password>" -AsPlainText -Force) -EnableRoomMailboxAccount $true
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
4. Various Exchange properties can be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
|
||||
|
||||
@ -205,7 +205,7 @@ Now that you're connected to the online services, you can finish setting up the
|
||||
Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a <tla rid="surface_hub"/> room!"
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
5. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information.
|
||||
|
||||
@ -260,11 +260,11 @@ You can use the Exchange Admin Center to create a device account:
|
||||
1. Sign in to your Exchange Admin Center using Exchange admin credentials.
|
||||
2. Once you are at the Exchange Admin Center (EAC), navigate to **Recipients** in the left panel.
|
||||
|
||||
|
||||
|
||||
|
||||
3. On the controls above the list of mailboxess, choose **+** to create a new one, and provide a **Display name**, **Name**, and **User logon name**, and then click **Save**.
|
||||
|
||||
|
||||
|
||||
|
||||
### <a href="" id="create-device-acct-exch-mbx-policy"></a>Create a mobile device mailbox policy from the Exchange Admin Center
|
||||
|
||||
@ -274,37 +274,37 @@ You can use the Exchange Admin Center to create a device account:
|
||||
|
||||
1. Go to the Exchange Admin Center.
|
||||
|
||||
|
||||
|
||||
|
||||
2. To create a mobile device mailbox policy, click **Mobile** from the left panel, then **Mobile device mailbox policies**. Surface Hubs require an account with a mobile device mailbox policy that does not require a password, so if you already have an existing policy that matches this requirement, you can apply that policy to the account. Otherwise use the following steps to create a new one to be used only for Surface Hub device accounts.
|
||||
|
||||
|
||||
|
||||
|
||||
3. To create a new mobile device account mailbox policy, click the **+** button from the controls above the list of policies to add a new policy. For the name provide a name that will help you distinguish this policy from other device accounts (for example, *SurfaceHubDeviceMobilePolicy*). The policy must not be password-protected, so make sure **Require a Password** remains unchecked, then click **Save**.
|
||||
|
||||
|
||||
|
||||
|
||||
4. After you have created the new mobile device mailbox policy, go back to the Exchange Admin Center and you will see the new policy listed.
|
||||
|
||||
|
||||
|
||||
|
||||
5. To apply the ActiveSync policy without using PowerShell, you can do the following:
|
||||
|
||||
- In the EAC, click **Recipients** > **Mailboxes** and select a mailbox.
|
||||
|
||||
|
||||
|
||||
|
||||
- In the **Details** pane, scroll to **Phone and Voice Features** and click **View details** to display the **Mobile Device Details** screen.
|
||||
|
||||
|
||||
|
||||
|
||||
- The mobile device mailbox policy that’s currently assigned is displayed. To change the mobile device mailbox policy, click **Browse**.
|
||||
|
||||
|
||||
|
||||
|
||||
- Choose the appropriate mobile device mailbox policy from the list, click **OK** and then click **Save**.
|
||||
|
||||
|
||||
|
||||
|
||||
### <a href="" id="create-device-acct-exch-powershell-conf"></a>Use PowerShell to configure the account
|
||||
|
||||
|
||||
@ -116,7 +116,7 @@ You can check online for updated versions at [Surface Hub device account scripts
|
||||
|
||||
Your infrastructure will likely fall into one of three configurations. Which configuration you have will affect how you prepare for device setup.
|
||||
|
||||
|
||||
|
||||
|
||||
- [Online deployment (Office 365)](online-deployment-surface-hub-device-accounts.md): Your organization’s environment is deployed entirely on Office 365.
|
||||
- [On-premises deployment](on-premises-deployment-surface-hub-device-accounts.md): Your organization has servers that it controls, where Active Directory, Exchange, and Skype for Business (or Lync) are hosted.
|
||||
|
||||
@ -29,10 +29,23 @@ Initiating a reset will return the device to the last cumulative Windows update,
|
||||
- Local admins on the device
|
||||
- Configurations from MDM or the Settings app
|
||||
|
||||
**To reset a Surface Hub**
|
||||
1. On your Surface Hub, open **Settings**.
|
||||
|
||||
|
||||
|
||||
2. Click **Update & Security**.
|
||||
|
||||
|
||||
|
||||
3. Click **Recovery**, and then click **Get started**.
|
||||
|
||||
|
||||
|
||||
**Important Note**</br>
|
||||
Performing a device reset may take up to 6 hours. Do not interrupt the reset process. Interrupting the process will render the device inoperable, requiring warranty service to return to normal functionality.
|
||||
|
||||
After the reset, you'll be taken through the [first run program](first-run-program-surface-hub.md) again.
|
||||
After the reset, Surface Hub restarts the [first run program](first-run-program-surface-hub.md) again.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -46,7 +46,7 @@ This is the first screen you'll see when you power up the Surface Hub for the fi
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -72,7 +72,7 @@ If no wired connection can be found, then the device will attempt to set up a wi
|
||||
|
||||
If your device does not detect a wired connection that it can use to connect to a network or the Internet, you will see this page. Here you can either connect to a wireless network, or skip making the network connection.
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -97,7 +97,7 @@ If you want to connect to a secured wireless network from this page, click on th
|
||||
|
||||
This page will be shown when you've selected a secured wireless network.
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -121,11 +121,11 @@ This page will be shown when the device detects a wired connection with limited
|
||||
|
||||
- You can select **Enter proxy settings** which will allow you to specify how to use the network proxy. You'll be taken to the next screen.
|
||||
|
||||
|
||||
|
||||
|
||||
This is the screen you'll see if you clicked **Enter proxy settings** on the previous screen.
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -149,7 +149,7 @@ You can skip connecting to a network by selecting **Skip this step**. You'll be
|
||||
|
||||
This screen is purely informational, and shows which recommended settings have been enabled by default.
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -170,7 +170,7 @@ On this page, the Surface Hub will ask for credentials for the device account th
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -192,7 +192,7 @@ If you skip setting it up now, you can add a device account later by using the S
|
||||
|
||||
If you click **Skip setting up a device account**, the device will display a dialog box showing what will happen if the device doesn't have a device account. If you choose **Yes, skip this**, you will be sent to the [Name this device page](#name-this-device).
|
||||
|
||||
|
||||
|
||||
|
||||
### What happens?
|
||||
|
||||
@ -211,7 +211,7 @@ The device will use the UPN or DOMAIN\\User name and password for the device acc
|
||||
|
||||
This page will only be shown if there's a problem. Typically, it means that the device account that you provided was found in Active Directory (AD) or Azure Active Directory (Azure AD), but the Exchange server for the account was not discovered.
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -230,7 +230,7 @@ You can enable Exchange services for a device account later by using the Setting
|
||||
|
||||
If you click **Skip setting up Exchange services**, the device will display a dialog showing what will happen. If you choose **Yes, skip this**, then Exchange services will not be set up.
|
||||
|
||||
|
||||
|
||||
|
||||
### What happens?
|
||||
|
||||
@ -249,7 +249,7 @@ This page will be shown when:
|
||||
- Exchange supported protocols are not supported by the Surface Hub.
|
||||
- Exchange returns incorrect XML.
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -273,7 +273,7 @@ If you choose to skip this check, the Surface Hub will stop looking for the Exch
|
||||
|
||||
This page asks you to provide two names that will be used for identifying the Surface Hub.
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -307,7 +307,7 @@ Because every Surface Hub can be used by any number of authenticated employees,
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -348,7 +348,7 @@ Joining Azure AD has two primary benefits:
|
||||
1. Some employees from your organization will be able to access the device as admins, and will be able to start the Settings app and configure the device. People that have admin permissions will be defined in your Azure AD subscription.
|
||||
2. If your Azure AD is connected to a mobile device management (MDM) solution, the device will enroll with that MDM solution so you can apply policies and configuration.
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -357,11 +357,11 @@ The following input is required:
|
||||
- **User's UPN:** The user principal name (UPN) of an account that can join Azure AD.
|
||||
- **Password:** The password of the account you’re using to join Azure AD.
|
||||
|
||||
|
||||
|
||||
|
||||
If you get to this point and don't have valid credentials for an Azure AD account, the device will allow you to continue by creating a local admin account. Click **Set up Windows with a local account instead**.
|
||||
|
||||
|
||||
|
||||
|
||||
### What happens?
|
||||
|
||||
@ -373,7 +373,7 @@ This page will ask for credentials to join a domain so that the Surface Hub can
|
||||
|
||||
Once the device has been domain joined, you must specify a security group from the domain you joined. This security group will be provisioned as administrators on the Surface Hub, and anyone from the security group can enter their domain credentials to access Settings.
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
@ -385,7 +385,7 @@ The following input is required:
|
||||
|
||||
After the credentials are verified, you will be asked to type a security group name. This input is required.
|
||||
|
||||
|
||||
|
||||
|
||||
### What happens?
|
||||
|
||||
@ -401,7 +401,7 @@ If the join is successful, you'll see the **Enter a security group** page. When
|
||||
|
||||
If you decide not to use Azure Active Directory (Azure AD) or Active Directory (AD) to manage the Surface Hub, you'll need to create a local admin account.
|
||||
|
||||
|
||||
|
||||
|
||||
### Details
|
||||
|
||||
|
||||
@ -21,17 +21,17 @@ Use this procedure if you use Exchange on-prem.
|
||||
- In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
|
||||
- Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.<p>
|
||||
|
||||
|
||||
|
||||
|
||||
- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
|
||||
|
||||
>**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
|
||||
|
||||
|
||||
|
||||
|
||||
- Click **Finish** to create the account.
|
||||
|
||||
|
||||
|
||||
|
||||
2. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Office 365 admin center and verify that the account created in the previous steps has merged to online.
|
||||
|
||||
@ -223,17 +223,17 @@ Use this procedure if you use Exchange online.
|
||||
- In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
|
||||
- Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
|
||||
|
||||
>**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
|
||||
|
||||
|
||||
|
||||
|
||||
- Click **Finish** to create the account.
|
||||
|
||||
|
||||
|
||||
|
||||
6. Directory synchronization.
|
||||
|
||||
|
||||
BIN
devices/surface-hub/images/sh-settings-reset-device.png
Normal file
BIN
devices/surface-hub/images/sh-settings-reset-device.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 16 KiB |
BIN
devices/surface-hub/images/sh-settings-update-security.png
Normal file
BIN
devices/surface-hub/images/sh-settings-update-security.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
BIN
devices/surface-hub/images/sh-settings.png
Normal file
BIN
devices/surface-hub/images/sh-settings.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
@ -30,7 +30,7 @@ If you joined your Surface Hub to an Azure Active Directory (Azure AD) subscript
|
||||
|
||||
Alternatively, the device can be enrolled like any other Windows device by going to **Settings** > **Accounts** > **Work access**.
|
||||
|
||||
|
||||
|
||||
|
||||
### Manage a device through MDM
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ In order to function properly, the Surface Hub must have access to a wired or wi
|
||||
- Can receive an IP address using DHCP
|
||||
- Open ports:
|
||||
- HTTPS: 443
|
||||
- HTTP: 8080
|
||||
- HTTP: 80
|
||||
|
||||
A wired connection is preferred.
|
||||
|
||||
@ -79,7 +79,7 @@ In order to ensure that your environment is ready for the Surface Hub, verify th
|
||||
- It must have these ports open:
|
||||
|
||||
- HTTPS: 443
|
||||
- HTTP: 8080
|
||||
- HTTP: 80
|
||||
|
||||
If your network runs through a proxy, you'll need the proxy address or script information as well.
|
||||
|
||||
|
||||
@ -58,9 +58,7 @@ In order to create and deploy provisioning packages, all of the following are re
|
||||
### <a href="" id="installing-wicd-prov-pkg"></a>Install the Windows Imaging and Configuration Designer
|
||||
|
||||
1. The Windows Imaging and Configuration Designer (ICD) is installed as part of the Windows 10 ADK. The installer for the ADK can be downloaded from the [Microsoft Download Center](http://go.microsoft.com/fwlink/?LinkId=718147).
|
||||
>**Note** The ADK must be installed on a separate PC, not on the Surface Hub.
|
||||
|
||||
|
||||
>**Note** The ADK must be installed on a separate PC, not on the Surface Hub.
|
||||
|
||||
2. Run the installer, and set your preferences for installation. When asked what features you want to install, you will see a checklist like the one in the following figure. Note that **Windows Performance Toolkit** and **Windows Assessment Toolkit** should be unchecked, as they are not needed to run the ICD.
|
||||
|
||||
@ -73,7 +71,7 @@ In order to create and deploy provisioning packages, all of the following are re
|
||||
|
||||
All four of these features are required to run the ICD and create a package for the Surfact Hub.
|
||||
|
||||
|
||||
|
||||
|
||||
3. Continue with the installer until the ADK is installed. This may take a while, because the installer downloads remote content.
|
||||
|
||||
@ -83,29 +81,29 @@ This example will demonstrate how to create a provisioning package to install a
|
||||
|
||||
1. On the PC that had the Windows 10 ADK installed, open ICD and choose the **New provisioning package** tile from the main menu.
|
||||
|
||||
|
||||
|
||||
|
||||
2. When the **New project** dialog box opens, type whatever name you like in the **Name** box. The **Location** and **Description** boxes can also be filled at your discretion, though we recommend using the **Description** box to help you distinguish among multiple packages. Click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
Select the settings that are **Common to all Windows editions**, and click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
When asked to import a provisioning package, just click **Finish.**
|
||||
|
||||
|
||||
|
||||
|
||||
3. ICD's main screen will be displayed. This is where you create the provisioning package. In the **Available customizations** pane, expand **Runtime settings** and then expand **Certificates**. Click **Root certificates**.
|
||||
|
||||
|
||||
|
||||
|
||||
In the center pane, you’ll be asked to specify a **CertificateName** for the Root certificate. You can set this to whatever you want. For the example, we've used the same name as the project. Click **Add**, and an entry will be added in the left pane.
|
||||
|
||||
4. In the **Available customizations** pane on the left, a new category has appeared for **CertificatePath** underneath the **CertificateName** you provided. There’s also a red exclamation icon indicating that there is a required field that needs to be set. Click **CeritficatePath**.
|
||||
|
||||
|
||||
|
||||
|
||||
5. In the center pane, you’ll be asked to specify the path for the certificate. Enter the name of the .cer file that you want to deploy, either by typing or clicking **Browse**. It must be a root certificate. The provisioning package created will copy the .cer file into the package it creates.
|
||||
|
||||
@ -238,15 +236,15 @@ The following two methods for deploying provisioning packages apply to any kind
|
||||
3. Navigate to **System > Work Access**. Under the header **Related settings**, click on **Add or remove a management package**.
|
||||
4. Here, click the button for **Add a package**.
|
||||
|
||||
|
||||
|
||||
|
||||
5. Click **Removable media** from the dropdown list. You will see a list of available provisioning packages on the **Settings** page.
|
||||
|
||||
|
||||
|
||||
|
||||
6. Choose your package and click **Add**.
|
||||
|
||||
|
||||
|
||||
|
||||
7. You may have to re-enter the admin credentials if User Access Control (UAC) asks for them.
|
||||
8. You’ll see a confirmation dialog box. Click **Yes, add it**. The certificate will be installed.
|
||||
|
||||
@ -68,7 +68,7 @@ You can use a standard RJ-11 (6P6C) connector to connect the Surface Hub serial
|
||||
|
||||
This diagram shows the correct pinout used for an RJ-11 (6P6C) to DB9 cable.
|
||||
|
||||
|
||||
|
||||
|
||||
## Command sets
|
||||
|
||||
|
||||
@ -25,33 +25,33 @@ If a wired network connection is not available, the Surface Hub can use a wirele
|
||||
1. On the Surface Hub, open **Settings** and enter your admin credentials.
|
||||
2. Click **System**, and then click **Network & Internet**. Under **Wi-Fi**, choose an access point. If you want Surface Hub to automatically connect to this access point, click **Connect automatically**. Click **Connect**.
|
||||
|
||||
|
||||
|
||||
|
||||
3. If the network is secured, you'll be asked to enter the security key. Click **Next** to connect.
|
||||
|
||||
|
||||
|
||||
|
||||
### Review wireless settings
|
||||
|
||||
1. On the Surface Hub, open **Settings** and enter your admin credentials.
|
||||
2. Click **System**, click **Network & Internet**, then **Wi-Fi**, and then click **Advanced options**.
|
||||
|
||||
|
||||
|
||||
|
||||
3. The system will show you the properties for the wireless network connection.
|
||||
|
||||
|
||||
|
||||
|
||||
### Review wired settings
|
||||
|
||||
1. On the Surface Hub, open **Settings** and enter your admin credentials.
|
||||
2. Click **System**, click **Network & Internet**, then click on the network under Ethernet.
|
||||
|
||||
|
||||
|
||||
|
||||
3. The system will show you the properties for the wired network connection.
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -13,4 +13,7 @@
|
||||
### [Step by step: Surface Deployment Accelerator](step-by-step-surface-deployment-accelerator.md)
|
||||
## [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md)
|
||||
## [Surface Dock Updater](surface-dock-updater.md)
|
||||
## [Surface Enterprise Management Mode](surface-enterprise-management-mode.md)
|
||||
### [Enroll and configure Surface devices with SEMM](enroll-and-configure-surface-devices-with-semm.md)
|
||||
### [Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md)
|
||||
|
||||
|
||||
@ -81,6 +81,8 @@ Figure 5 shows the required frameworks for the Surface app.
|
||||
|
||||
*Figure 5. Required frameworks for the Surface app*
|
||||
|
||||
>**Note:** The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Windows Store for Business. Always use the Surface app and recommended framework versions as provided by Windows Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes.
|
||||
|
||||
To download the required frameworks for the Surface app, follow these steps:
|
||||
1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder.
|
||||
2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder.
|
||||
|
||||
@ -0,0 +1,135 @@
|
||||
---
|
||||
title: Enroll and configure Surface devices with SEMM (Surface)
|
||||
description: Learn how to create a Surface UEFI configuration package to control the settings of Surface UEFI, as well as enroll a Surface device in SEMM.
|
||||
keywords: surface enterprise management
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.pagetype: surface, devices, security
|
||||
ms.sitesec: library
|
||||
author: jobotto
|
||||
---
|
||||
|
||||
# Enroll and configure Surface devices with SEMM
|
||||
|
||||
With Microsoft Surface Enterprise Management Mode (SEMM), you can securely configure the settings of Surface UEFI on a Surface device and manage those settings on Surface devices in your organization. When a Surface device is managed by SEMM, that device is considered to be *enrolled* (sometimes referred to as activated). This article shows you how to create a Surface UEFI configuration package that will not only control the settings of Surface UEFI, but will also enroll a Surface device in SEMM.
|
||||
|
||||
For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode).
|
||||
|
||||
#### Download and install Microsoft Surface UEFI Configurator
|
||||
The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/en-us/download/details.aspx?id=46703) page in the Microsoft Download Center.
|
||||
Run the Microsoft Surface UEFI Configurator Windows Installer (.msi) file to start the installation of the tool. When the installer completes, find Microsoft Surface UEFI Configurator in the All Apps section of your Start menu.
|
||||
|
||||
>**Note**: Microsoft Surface UEFI Configurator is supported only on Windows 10.
|
||||
|
||||
## Create a Surface UEFI configuration package
|
||||
|
||||
The Surface UEFI configuration package performs both the role of applying a new configuration of Surface UEFI settings to a Surface device managed with SEMM and the role of enrolling Surface devices in SEMM. The creation of a configuration package requires you to have a signing certificate to be used with SEMM to secure the configuration of UEFI settings on each Surface device. For more information about the requirements for the SEMM certificate, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode).
|
||||
|
||||
To create a Surface UEFI configuration package, follow these steps:
|
||||
|
||||
1. Open Microsoft Surface UEFI Configurator from the Start menu.
|
||||
2. Click **Start**.
|
||||
3. Click **Configuration Package**, as shown in Figure 1.
|
||||
|
||||
|
||||
|
||||
*Figure 1. Select Configuration Package to create a package for SEMM enrollment and configuration*
|
||||
|
||||
4. Click **Certificate Protection** to add your exported certificate file with private key (.pfx), as shown in Figure 2. Browse to the location of your certificate file, select the file, and then click **OK**.
|
||||
|
||||
|
||||
|
||||
*Figure 2. Add the SEMM certificate and Surface UEFI password to a Surface UEFI configuration package*
|
||||
|
||||
5. When you are prompted to confirm the certificate password, enter and confirm the password for your certificate file, and then click **OK**.
|
||||
6. Click **Password Protection** to add a password to Surface UEFI. This password will be required whenever you boot to UEFI. If this password is not entered, only the **PC information**, **About**, **Enterprise management**, and **Exit** pages will be displayed. This step is optional.
|
||||
7. When you are prompted, enter and confirm your chosen password for Surface UEFI, and then click **OK**. If you want to clear an existing Surface UEFI password, leave the password field blank.
|
||||
8. If you do not want the Surface UEFI package to apply to a particular device, on the **Choose which Surface type you want to target** page, click the slider beneath the corresponding Surface Book or Surface Pro 4 image so that it is in the **Off** position. (As shown in Figure 3.)
|
||||
|
||||
|
||||
|
||||
*Figure 3. Choose the devices for package compatibility*
|
||||
|
||||
9. Click **Next**.
|
||||
10. If you want to deactivate a component on managed Surface devices, on the **Choose which components you want to activate or deactivate** page, click the slider next to any device or group of devices you want to deactivate so that the slider is in the **Off** position. (Shown in Figure 4.) The default configuration for each device is **On**. Click the **Reset** button if you want to return all sliders to the default position.
|
||||
|
||||
|
||||
|
||||
*Figure 4. Disable or enable individual Surface components*
|
||||
|
||||
11. Click **Next**.
|
||||
12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package.
|
||||
|
||||
|
||||
|
||||
*Figure 5. Control advanced Surface UEFI settings and Surface UEFI pages with SEMM*
|
||||
|
||||
13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**.
|
||||
14. When the package is created and saved, the **Successful** page is displayed.
|
||||
|
||||
>**Note**: Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator.
|
||||
|
||||
|
||||
|
||||
*Figure 6. The last two characters of the certificate thumbprint are displayed on the Successful page*
|
||||
|
||||
Now that you have created your Surface UEFI configuration package, you can enroll or configure Surface devices.
|
||||
|
||||
>**Note**: When a Surface UEFI configuration package is created, a log file is created on the desktop with details of the configuration package settings and options.
|
||||
|
||||
## Enroll a Surface device in SEMM
|
||||
When the Surface UEFI configuration package is executed, the SEMM certificate and Surface UEFI configuration files are staged in the firmware storage of the Surface device. When the Surface device reboots, Surface UEFI processes these files and begins the process of applying the Surface UEFI configuration or enrolling the Surface device in SEMM, as shown in Figure 7.
|
||||
|
||||
|
||||
|
||||
*Figure 7. The SEMM process for configuration of Surface UEFI or enrollment of a Surface device*
|
||||
|
||||
Before you begin the process to enroll a Surface device in SEMM, ensure that you have the last two characters of the certificate thumbprint on hand. You will need these characters to confirm the device’s enrollment (see Figure 6).
|
||||
|
||||
To enroll a Surface device in SEMM with a Surface UEFI configuration package, follow these steps:
|
||||
|
||||
1. Run the Surface UEFI configuration package .msi file on the Surface device you want to enroll in SEMM. This will provision the Surface UEFI configuration file in the device’s firmware.
|
||||
2. Select the **I accept the terms in the License Agreement** check box to accept the End User License Agreement (EULA), and then click **Install** to begin the installation process.
|
||||
3. Click **Finish** to complete the Surface UEFI configuration package installation and restart the Surface device when you are prompted to do so.
|
||||
4. Surface UEFI will load the configuration file and determine that SEMM is not enabled on the device. Surface UEFI will then begin the SEMM enrollment process, as follows:
|
||||
* Surface UEFI will verify that the SEMM configuration file contains a SEMM certificate.
|
||||
* Surface UEFI will prompt you to enter to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8.
|
||||
|
||||
|
||||
|
||||
*Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint*
|
||||
|
||||
* Surface UEFI will store the SEMM certificate in firmware and apply the configuration settings that are specified in the Surface UEFI configuration file.
|
||||
|
||||
5. The Surface device is now enrolled in SEMM and will boot to Windows.
|
||||
|
||||
You can verify that a Surface device has been successfully enrolled in SEMM by looking for **Microsoft Surface Configuration Package** in **Programs and Features** (as shown in Figure 9), or in the events stored in the **Microsoft Surface UEFI Configurator** log, found under **Applications and Services Logs** in Event Viewer (as shown in Figure 10).
|
||||
|
||||
|
||||
|
||||
*Figure 9. Verify the enrollment of a Surface device in SEMM in Programs and Features*
|
||||
|
||||
|
||||
|
||||
*Figure 10. Verify the enrollment of a Surface device in SEMM in Event Viewer*
|
||||
|
||||
You can also verify that the device is enrolled in SEMM in Surface UEFI – while the device is enrolled, Surface UEFI will contain the **Enterprise management** page (as shown in Figure 11).
|
||||
|
||||
|
||||
|
||||
*Figure 11. The Surface UEFI Enterprise management page*
|
||||
|
||||
|
||||
## Configure Surface UEFI settings with SEMM
|
||||
|
||||
After a device is enrolled in SEMM, you can run Surface UEFI configuration packages signed with the same SEMM certificate to apply new Surface UEFI settings. These settings are applied automatically the next time the device boots, without any interaction from the user. You can use application deployment solutions like System Center Configuration Manager to deploy Surface UEFI configuration packages to Surface devices to change or manage the settings in Surface UEFI.
|
||||
|
||||
For more information about how to deploy Windows Installer (.msi) files with Configuration Manager, see [Deploy and manage applications with System Center Configuration Manager](https://technet.microsoft.com/library/mt627959).
|
||||
|
||||
If you have secured Surface UEFI with a password, users without the password who attempt to boot to Surface UEFI will only have the **PC information**, **About**, **Enterprise management**, and **Exit** pages displayed to them.
|
||||
|
||||
If you have not secured Surface UEFI with a password or a user enters the password correctly, settings that are configured with SEMM will be dimmed (unavailable) and the text Some settings are managed by your organization will be displayed at the top of the page, as shown in Figure 12.
|
||||
|
||||
|
||||
|
||||
*Figure 12. Settings managed by SEMM will be disabled in Surface UEFI*
|
||||
BIN
devices/surface/images/surface-enroll-semm-fig1.png
Normal file
BIN
devices/surface/images/surface-enroll-semm-fig1.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 102 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 87 KiB |
BIN
devices/surface/images/surface-ent-mgmt-fig2-securepackage.png
Normal file
BIN
devices/surface/images/surface-ent-mgmt-fig2-securepackage.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 113 KiB |
BIN
devices/surface/images/surface-ent-mgmt-fig3-enabledisable.png
Normal file
BIN
devices/surface/images/surface-ent-mgmt-fig3-enabledisable.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 113 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 130 KiB |
BIN
devices/surface/images/surface-ent-mgmt-fig5-success.png
Normal file
BIN
devices/surface/images/surface-ent-mgmt-fig5-success.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 94 KiB |
BIN
devices/surface/images/surface-ent-mgmt-fig6-enrollconfirm.png
Normal file
BIN
devices/surface/images/surface-ent-mgmt-fig6-enrollconfirm.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 218 KiB |
BIN
devices/surface/images/surface-ent-mgmt-fig7-semmrecovery.png
Normal file
BIN
devices/surface/images/surface-ent-mgmt-fig7-semmrecovery.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 138 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig1.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig1.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 102 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig10.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig10.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 128 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig11.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig11.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 108 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig12.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig12.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 65 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig3.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig3.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 126 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig4.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig4.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 113 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig5.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig5.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 110 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig6.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig6.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 112 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig7.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig7.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 94 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig8.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig8.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
BIN
devices/surface/images/surface-semm-enroll-fig9.png
Normal file
BIN
devices/surface/images/surface-semm-enroll-fig9.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 66 KiB |
BIN
devices/surface/images/surface-semm-enrollment-fig2.png
Normal file
BIN
devices/surface/images/surface-semm-enrollment-fig2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 112 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig1.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig1.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 74 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig10.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig10.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 87 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig11.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig11.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 45 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig12.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig12.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 170 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig13.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig13.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 122 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig14.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig14.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 60 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig2.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 102 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig3.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig3.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 50 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig4.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig4.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 52 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig5.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig5.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 66 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig6.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig6.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 108 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig7.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig7.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig8.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig8.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 276 KiB |
BIN
devices/surface/images/surface-semm-unenroll-fig9.png
Normal file
BIN
devices/surface/images/surface-semm-unenroll-fig9.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 133 KiB |
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Surface (Surface)
|
||||
description: .
|
||||
description:
|
||||
ms.assetid: 2a6aec85-b8e2-4784-8dc1-194ed5126a04
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
@ -86,6 +86,11 @@ For more information on planning for, deploying, and managing Surface devices in
|
||||
<td><p>[Surface Dock Updater](surface-dock-updater.md)</p></td>
|
||||
<td><p>Get a detailed walkthrough of Microsoft Surface Dock Updater.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>[Surface Enterprise Management Mode](surface-enterprise-management-mode.md)</p></td>
|
||||
<td><p>See how this feature of Surface devices with Surface UEFI allows you to secure and manage firmware settings within your organization.
|
||||
</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
163
devices/surface/surface-enterprise-management-mode.md
Normal file
163
devices/surface/surface-enterprise-management-mode.md
Normal file
@ -0,0 +1,163 @@
|
||||
---
|
||||
title: Surface Enterprise Management Mode (Surface)
|
||||
description: See how this feature of Surface devices with Surface UEFI helps you secure and manage firmware settings within your organization.
|
||||
keywords: uefi, configure, firmware, secure, semm
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.pagetype: surface, devices, security
|
||||
ms.sitesec: library
|
||||
author: jobotto
|
||||
---
|
||||
|
||||
# Microsoft Surface Enterprise Management Mode
|
||||
|
||||
Microsoft Surface Enterprise Management Mode (SEMM) is a feature of Surface devices with Surface UEFI that allows you to secure and manage firmware settings within your organization. With SEMM, IT professionals can prepare configurations of UEFI settings and install them on a Surface device. In addition to the ability to configure UEFI settings, SEMM also uses a certificate to protect the configuration from unauthorized tampering or removal.
|
||||
|
||||
>**Note**: SEMM is only available on devices with Surface UEFI firmware, such as Surface Pro 4 and Surface Book. For more information about Surface UEFI, see [Manage Surface UEFI Settings](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-uefi-settings).
|
||||
|
||||
When Surface devices are configured by SEMM and secured with the SEMM certificate, they are considered *enrolled* in SEMM. When the SEMM certificate is removed and control of UEFI settings is returned to the user of the device, the Surface device is considered *unenrolled* in SEMM.
|
||||
|
||||
## Microsoft Surface UEFI Configurator
|
||||
|
||||
The primary workspace of SEMM is Microsoft Surface UEFI Configurator, as shown in Figure 1. Microsoft Surface UEFI Configurator is a tool that is used to create Windows Installer (.msi) packages that are used to enroll, configure, and unenroll SEMM on a Surface device. These packages contain a configuration file where the settings for UEFI are specified. SEMM packages also contain a certificate that is installed and stored in firmware and used to verify the signature of configuration files before UEFI settings are applied.
|
||||
|
||||
|
||||
|
||||
*Figure 1. Microsoft Surface UEFI Configurator*
|
||||
|
||||
>**Note**: Windows 10 is required to run Microsoft Surface UEFI Configurator
|
||||
|
||||
You can use the Microsoft Surface UEFI Configurator tool in three modes:
|
||||
|
||||
* [Surface UEFI Configuration Package](#configuration-package). Use this mode to create a Surface UEFI configuration package to enroll a Surface device in SEMM and to configure UEFI settings on enrolled devices.
|
||||
* [Surface UEFI Reset Package](#reset-package). Use this mode to unenroll a Surface device from SEMM.
|
||||
* [Surface UEFI Recovery Request](#recovery-request). Use this mode to respond to a recovery request to unenroll a Surface device from SEMM where a Reset Package operation is not successful.
|
||||
|
||||
|
||||
#### Download Microsoft Surface UEFI Configurator
|
||||
|
||||
You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/en-us/download/details.aspx?id=46703) page in the Microsoft Download Center.
|
||||
|
||||
### Configuration package
|
||||
|
||||
Surface UEFI configuration packages are the primary mechanism to implement and manage SEMM on Surface devices. These packages contain a configuration file of UEFI settings specified during creation of the package in Microsoft Surface UEFI Configurator and a certificate file, as shown in Figure 2. When a configuration package is run for the first time on a Surface device that is not already enrolled in SEMM, it provisions the certificate file in the device’s firmware and enrolls the device in SEMM. When enrolling a device in SEMM, you will be prompted to confirm the operation by providing the last two digits of the SEMM certificate thumbprint before the certificate file is stored and the enrollment can complete. This confirmation requires that a user be present at the device at the time of enrollment to perform the confirmation.
|
||||
|
||||
|
||||
|
||||
*Figure 2. Secure a SEMM configuration package with a certificate*
|
||||
|
||||
See the [Surface Enterprise Management Mode certificate requirements](#surface-enterprise-management-mode-certificate-requirements) section of this article for more information about the requirements for the SEMM certificate.
|
||||
|
||||
>**Note**: You can also specify a UEFI password with SEMM that is required to view the **Security**, **Devices**, **Boot Configuration**, or **Enterprise Management** pages of Surface UEFI.
|
||||
|
||||
After a device is enrolled in SEMM, the configuration file is read and the settings specified in the file are applied to UEFI. When you run a configuration package on a device that is already enrolled in SEMM, the signature of the configuration file is checked against the certificate that is stored in the device firmware. If the signature does not match, no changes are applied to the device.
|
||||
|
||||
You can use Surface UEFI settings to enable or disable the operation of individual components, such as cameras, wireless communication, or docking USB port (as shown in Figure 3), and configure advanced settings (as shown in Figure 4).
|
||||
|
||||
|
||||
|
||||
*Figure 3. Enable or disable devices in Surface UEFI with SEMM*
|
||||
|
||||
|
||||
|
||||
*Figure 4. Configure advanced settings with SEMM*
|
||||
|
||||
You can enable or disable the following devices with SEMM:
|
||||
|
||||
* Docking USB Port
|
||||
* On-board Audio
|
||||
* Type Cover
|
||||
* Micro SD or SD Card Slots
|
||||
* Front Camera
|
||||
* Rear Camera
|
||||
* Infrared Camera, for Windows Hello
|
||||
* Bluetooth Only
|
||||
* Wi-Fi and Bluetooth
|
||||
* Trusted Platform Module (TPM)
|
||||
|
||||
You can configure the following advanced settings with SEMM:
|
||||
|
||||
* IPv6 support for PXE boot
|
||||
* Alternate boot order, where the Volume Down button and Power button can be pressed together during boot, to boot directly to a USB or Ethernet device
|
||||
* Lock the boot order to prevent changes
|
||||
* Support for booting to USB devices
|
||||
* Display of the Surface UEFI **Security** page
|
||||
* Display of the Surface UEFI **Devices** page
|
||||
* Display of the Surface UEFI **Boot** page
|
||||
|
||||
>**Note**: When you create a SEMM configuration package, two characters are shown on the **Successful** page, as shown in Figure 5.
|
||||
|
||||
|
||||
|
||||
*Figure 5. Display of the last two characters of the certificate thumbprint on the Successful page*
|
||||
|
||||
These characters are the last two characters of the certificate thumbprint and should be written down or recorded. The characters are required to confirm enrollment in SEMM on a Surface device, as shown in Figure 6.
|
||||
|
||||
|
||||
|
||||
*Figure 6. Enrollment confirmation in SEMM with the SEMM certificate thumbprint*
|
||||
|
||||
To enroll a Surface device in SEMM or to apply the UEFI configuration from a configuration package, all you need to do is run the .msi file on the intended Surface device. You can use application deployment or operating system deployment technologies such as [System Center Configuration Manager](https://technet.microsoft.com/library/mt346023) or the [Microsoft Deployment Toolkit](https://technet.microsoft.com/en-us/windows/dn475741). When you enroll a device in SEMM you must be present to confirm the enrollment on the device. User interaction is not required when you apply a configuration to devices that are already enrolled in SEMM.
|
||||
|
||||
### Reset package
|
||||
|
||||
A Surface UEFI reset package is used to perform only one task — to unenroll a Surface device from SEMM. The reset package contains signed instructions to remove the SEMM certificate from the device’s firmware and to reset UEFI settings to factory default. Like a Surface UEFI configuration package, a reset package must be signed with the same SEMM certificate that is provisioned on the Surface device. When you create a SEMM reset package, you are required to supply the serial number of the Surface device you intend to reset. SEMM reset packages are not universal and are specific to one device.
|
||||
|
||||
### Recovery request
|
||||
|
||||
In some scenarios, it may be impossible to use a Surface UEFI reset package. (For example, if Windows becomes unusable on the Surface device.) In these scenarios you can unenroll the Surface device from SEMM through the **Enterprise Management** page of Surface UEFI (shown in Figure 7) with a Recovery Request operation.
|
||||
|
||||
|
||||
|
||||
*Figure 7. Initiate a SEMM recovery request on the Enterprise Management page*
|
||||
|
||||
When you use the process on the **Enterprise Management** page to reset SEMM on a Surface device, you are provided with a Reset Request. This Reset Request can be saved as a file to a USB drive, copied as text, or read as a QR Code with a mobile device to be easily emailed or messaged. Use the Microsoft Surface UEFI Configurator Reset Request option to load a Reset Request file or enter the Reset Request text or QR Code. Microsoft Surface UEFI Configurator will generate a verification code that can be entered on the Surface device. If you enter the code on the Surface device and click **Restart**, the device will be unenrolled from SEMM.
|
||||
|
||||
>**Note**: A Reset Request expires two hours after it is created.
|
||||
|
||||
## Surface Enterprise Management Mode certificate requirements
|
||||
|
||||
>**Note**: The SEMM certificate is required to perform any modification to SEMM or Surface UEFI settings on enrolled Surface devices. If the SEMM certificate is corrupted or lost, SEMM cannot be removed or reset. Manage your SEMM certificate accordingly with an appropriate solution for backup and recovery.
|
||||
|
||||
Packages created with the Microsoft Surface UEFI Configurator tool are signed with a certificate. This certificate ensures that after a device is enrolled in SEMM, only packages created with the approved certificate can be used to modify the settings of UEFI. The following settings are recommended for the SEMM certificate:
|
||||
|
||||
* **Key Algorithm** – RSA
|
||||
* **Key Length** – 2048
|
||||
* **Hash Algorithm** – SHA-256
|
||||
* **Type** – SSL Server Authentication
|
||||
* **Key Usage** – Key Encipherment
|
||||
* **Provider** – Microsoft Enhanced RSA and AES Cryptographic Provider
|
||||
* **Expiration Date** – 15 Months from certificate creation
|
||||
* **Key Export Policy** – Exportable
|
||||
|
||||
It is also recommended that the SEMM certificate be authenticated in a two-tier public key infrastructure (PKI) architecture where the intermediate certification authority (CA) is dedicated to SEMM, enabling certificate revocation. For more information about a two-tier PKI configuration, see [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](https://technet.microsoft.com/library/hh831348).
|
||||
|
||||
>**Note**: You can use the following PowerShell script to create a self-signed certificate for use in proof-of-concept scenarios.
|
||||
To use this script, copy the following text into Notepad and save the file as a PowerShell script (.ps1). This script creates a certificate with a password of `12345678`.<br/><br/>The certificate generated by this script is not recommended for production environments.
|
||||
|
||||
```
|
||||
if (-not (Test-Path "Demo Certificate")) { New-Item -ItemType Directory -Force -Path "Demo Certificate" }
|
||||
if (Test-Path "Demo Certificate\TempOwner.pfx") { Remove-Item "Demo Certificate\TempOwner.pfx" }
|
||||
|
||||
# Generate the Ownership private signing key with password 12345678
|
||||
$pw = ConvertTo-SecureString "12345678" -AsPlainText -Force
|
||||
|
||||
$TestUefiV2 = New-SelfSignedCertificate `
|
||||
-Subject "CN=Surface Demo Kit, O=Contoso Corporation, C=US" `
|
||||
-Type SSLServerAuthentication `
|
||||
-HashAlgorithm sha256 `
|
||||
-KeyAlgorithm RSA `
|
||||
-KeyLength 2048 `
|
||||
-KeyUsage KeyEncipherment `
|
||||
-KeyUsageProperty All `
|
||||
-Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" `
|
||||
-NotAfter (Get-Date).AddYears(25) `
|
||||
-TextExtension @("2.5.29.37={text}1.2.840.113549.1.1.1") `
|
||||
-KeyExportPolicy Exportable
|
||||
|
||||
$TestUefiV2 | Export-PfxCertificate -Password $pw -FilePath "Demo Certificate\TempOwner.pfx"
|
||||
```
|
||||
|
||||
For use with SEMM and Microsoft Surface UEFI Configurator, the certificate must be exported with the private key and with password protection. Microsoft Surface UEFI Configurator will prompt you to select the SEMM certificate file (.pfx) and certificate password when it is required.
|
||||
|
||||
>**Note**: For organizations that use an offline root in their PKI infrastructure, Microsoft Surface UEFI Configurator must be run in an environment connected to the root CA to authenticate the SEMM certificate. The packages generated by Microsoft Surface UEFI Configurator can be transferred as files and therefore can be transferred outside the offline network environment with removable storage, such as a USB stick.
|
||||
148
devices/surface/unenroll-surface-devices-from-semm.md
Normal file
148
devices/surface/unenroll-surface-devices-from-semm.md
Normal file
@ -0,0 +1,148 @@
|
||||
---
|
||||
title: Unenroll Surface devices from SEMM (Surface)
|
||||
description: Learn how to unenroll a device from SEMM by using a Surface UEFI reset package or the Recovery Request option.
|
||||
keywords: surface enterprise management
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.pagetype: surface, devices, security
|
||||
ms.sitesec: library
|
||||
author: jobotto
|
||||
---
|
||||
|
||||
# Unenroll Surface devices from SEMM
|
||||
|
||||
When a Surface device is enrolled in Surface Enterprise Management Mode (SEMM), a certificate is stored in the firmware of that device. The presence of that certificate and the enrollment in SEMM prevent any unauthorized changes to Surface UEFI settings or options while the device is enrolled in SEMM. To restore control of Surface UEFI settings to the user, the Surface device must be unenrolled from SEMM, a process sometimes described as reset or recovery. There are two methods you can use to unenroll a device from SEMM—a Surface UEFI reset package and a Recovery Request.
|
||||
|
||||
>**Warning:** To unenroll a device from SEMM and restore user control of Surface UEFI settings, you must have the SEMM certificate that was used to enroll the device in SEMM. If this certificate becomes lost or corrupted, it is not possible to unenroll from SEMM. Back up and protect your SEMM certificate accordingly.
|
||||
|
||||
For more information about SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode).
|
||||
|
||||
## Unenroll a Surface device from SEMM with a Surface UEFI reset package
|
||||
|
||||
The Surface UEFI reset package is the primary method you use to unenroll a Surface device from SEMM. Like a Surface UEFI configuration package, the reset package is a Windows Installer (.msi) file that configures SEMM on the device. Unlike the configuration package, the reset package will reset the Surface UEFI configuration on a Surface device to its default settings, remove the SEMM certificate, and unenroll the device from SEMM.
|
||||
|
||||
Reset packages are created specifically for an individual Surface device. To begin the process of creating a reset package, you will need the serial number of the device you want to unenroll, as well as the SEMM certificate used to enroll the device. You can find the serial number of your Surface device on the **PC information** page of Surface UEFI, as shown in Figure 1. This page is displayed even if Surface UEFI is password protected and the incorrect password is entered.
|
||||
|
||||
|
||||
|
||||
*Figure 1. The serial number of the Surface device is displayed on the Surface UEFI PC information page*
|
||||
|
||||
>**Note:** To boot to Surface UEFI, press **Volume Up** and **Power** simultaneously while the device is off. Hold **Volume Up** until the Surface logo is displayed and the device begins to boot.
|
||||
|
||||
To create a Surface UEFI reset package, follow these steps:
|
||||
|
||||
1. Open Microsoft Surface UEFI Configurator from the Start menu.
|
||||
2. Click **Start**.
|
||||
3. Click **Reset Package**, as shown in Figure 2.
|
||||
|
||||
|
||||
|
||||
*Figure 2. Click Reset Package to create a package to unenroll a Surface device from SEMM*
|
||||
|
||||
4. Click **Certificate Protection** to add your SEMM certificate file with private key (.pfx), as shown in Figure 3. Browse to the location of your certificate file, select the file, and then click **OK**.
|
||||
|
||||
|
||||
|
||||
*Figure 3. Add the SEMM certificate to a Surface UEFI reset package*
|
||||
|
||||
5. Click **Next**.
|
||||
6. Type the serial number of the device you want to unenroll from SEMM (as shown in Figure 4), and then click **Build** to generate the Surface UEFI reset package.
|
||||
|
||||
|
||||
|
||||
*Figure 4. Use the serial number of your Surface device to create a Surface UEFI reset package*
|
||||
|
||||
7. In the **Save As** dialog box, specify a name for the Surface UEFI reset package, browse to the location where you would like to save the file, and then click **Save**.
|
||||
8. When the package generation has completed, the **Successful** page is displayed. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator.
|
||||
|
||||
Run the Surface UEFI reset package Windows Installer (.msi) file on the Surface device to unenroll the device from SEMM. The reset package will require a reboot to perform the unenroll operation. After the device has been unenrolled, you can verify the successful removal by ensuring that the **Microsoft Surface Configuration Package** item in **Programs and Features** (shown in Figure 5) is no longer present.
|
||||
|
||||
|
||||
|
||||
*Figure 5. The presence of the Microsoft Surface Configuration Package item in Programs and Features indicates that the device is enrolled in SEMM*
|
||||
|
||||
## Unenroll a Surface device from SEMM with a Recovery Request
|
||||
|
||||
In some scenarios, a Surface UEFI reset package may not be a viable option to unenroll a Surface device from SEMM (for example, where Windows has become unusable). In these scenarios you can unenroll the device by using a Recovery Request generated from within Surface UEFI. The Recovery Request process can be initiated even on devices where you do not have the Surface UEFI password.
|
||||
|
||||
The Recovery Request process is initiated from Surface UEFI on the Surface device, approved with Microsoft Surface UEFI Configurator on another computer, and then completed in Surface UEFI. Like the reset package, approving a Recovery Request with Microsoft Surface UEFI Configurator requires access to the SEMM certificate that was used to enroll the Surface device.
|
||||
|
||||
To initiate a Recovery Request, follow these steps:
|
||||
|
||||
1. Boot the Surface device that is to be unenrolled from SEMM to Surface UEFI.
|
||||
2. Type the Surface UEFI password if you are prompted to do so.
|
||||
3. Click the **Enterprise management** page, as shown in Figure 6.
|
||||
|
||||
|
||||
|
||||
*Figure 6. The Enterprise management page is displayed in Surface UEFI on devices enrolled in SEMM*
|
||||
|
||||
4. Click or press **Get Started**.
|
||||
5. Click or press **Next** to begin the Recovery Request process.
|
||||
>**Note:** A Recovery Request expires two hours after it is created. If a Recovery Request is not completed in this time, you will have to restart the Recovery Request process.
|
||||
6. Select **SEMM Certificate** from the list of certificates displayed on the **Choose a SEMM reset key** page (shown in Figure 7), and then click or press **Next**.
|
||||
|
||||
|
||||
|
||||
*Figure 7. Choose SEMM Certificate for your Recovery Request (Reset Request)*
|
||||
|
||||
7. On the **Enter SEMM reset verification code** page you can click the **QR Code** or **Text** buttons to display your Recovery Request (Reset Request) as shown in Figure 8, or the **USB** button to save your Recovery Request (Reset Request) as a file to a USB drive, as shown in Figure 9.
|
||||
|
||||
|
||||
|
||||
*Figure 8. A Recovery Request (Reset Request) displayed as a QR Code*
|
||||
|
||||
|
||||
|
||||
*Figure 9. Save a Recovery Request (Reset Request) to a USB drive*
|
||||
|
||||
* To use a QR Code Recovery Request (Reset Request), use a QR reader app on a mobile device to read the code. The QR reader app will translate the QR code into an alphanumeric string. You can then email or message that string to the administrator that will produce the reset verification code with Microsoft Surface UEFI Configurator.
|
||||
* To use a Recovery Request (Reset Request) saved to a USB drive as a file, use the USB drive to transfer the file to the computer where Microsoft Surface UEFI Configurator will be used to produce the Reset Verification Code. The file can also be copied from the USB drive on another device to be emailed or transferred over the network.
|
||||
* To use the Recovery Request (Reset Request) as text, simply type the text directly into Microsoft Surface UEFI Configurator.
|
||||
|
||||
8. Open Microsoft Surface UEFI Configurator from the Start menu on another computer.
|
||||
>**Note:** Microsoft Surface UEFI Configurator must run in an environment that is able to authenticate the certificate chain for the SEMM certificate.
|
||||
9. Click **Start**.
|
||||
10. Click **Recovery Request**, as shown in Figure 10.
|
||||
|
||||
|
||||
|
||||
*Figure 10. Click Recovery Request to begin the process to approve a Recovery Request*
|
||||
|
||||
11. Click **Certificate Protection** to authenticate the Recovery Request with the SEMM certificate.
|
||||
12. Browse to and select your SEMM certificate file, and then click **OK**.
|
||||
13. When you are prompted to enter the certificate password as shown in Figure 11, type and confirm the password for the certificate file, and then click **OK**.
|
||||
|
||||
|
||||
|
||||
*Figure 11. Type the password for the SEMM certificate*
|
||||
|
||||
14. Click **Next**.
|
||||
15. Enter the Recovery Request (Reset Request), and then click **Generate** to create a reset verification code (as shown in Figure 12).
|
||||
|
||||
|
||||
|
||||
*Figure 12. Enter the Recovery Request (Reset Request)*
|
||||
|
||||
* If you displayed the Recovery Request (Reset Request) as text on the Surface device being reset, use the keyboard to type the Recovery Request (Reset Request) in the provided field.
|
||||
* If you displayed the Recovery Request (Reset Request) as a QR Code and then used a messaging or email application to send the code to the computer with Microsoft Surface UEFI Configurator, copy and paste the code into the provided field.
|
||||
* If you saved the Recovery Request (Reset Request) as a file to a USB drive, click the **Import** button, browse to and select the Recovery Request (Reset Request) file, and then click **OK**.
|
||||
|
||||
16. The reset verification code is displayed in Microsoft Surface UEFI Configurator, as shown in Figure 13.
|
||||
|
||||
|
||||
|
||||
*Figure 13. The reset verification code displayed in Microsoft Surface UEFI Configurator*
|
||||
|
||||
* Click the **Share** button to send the reset verification code by email.
|
||||
|
||||
17. Enter the reset verification code in the provided field on the Surface device (shown in Figure 8), and then click or press **Verify** to reset the device and unenroll the device from SEMM.
|
||||
18. Click or press **Restart now** on the **SEMM reset successful** page to complete the unenrollment from SEMM, as shown in Figure 14.
|
||||
|
||||
|
||||
|
||||
*Figure 14. Successful unenrollment from SEMM*
|
||||
|
||||
19. Click **End** in Microsoft Surface UEFI Configurator to complete the Recovery Request (Reset Request) process and close Microsoft Surface UEFI Configurator.
|
||||
|
||||
|
||||
@ -20,10 +20,10 @@ author: jdeckerMS
|
||||
Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test:
|
||||
|
||||
- A Microsoft Edge browser window opens, showing just the test and nothing else.
|
||||
- The clipboard is cleared.
|
||||
- Students aren’t able to go to other websites.
|
||||
- Students can’t open or access other apps.
|
||||
- Students can't share, print, or record their screens.
|
||||
- Students can’t copy or paste.
|
||||
- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features.
|
||||
- Cortana is turned off.
|
||||
|
||||
|
||||
@ -20,10 +20,10 @@ author: jdeckerMS
|
||||
The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test:
|
||||
|
||||
- A Microsoft Edge browser window opens, showing just the test and nothing else.
|
||||
- The clipboard is cleared.
|
||||
- Students aren’t able to go to other websites.
|
||||
- Students can’t open or access other apps.
|
||||
- Students can't share, print, or record their screens.
|
||||
- Students can’t copy or paste.
|
||||
- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features.
|
||||
- Cortana is turned off.
|
||||
|
||||
|
||||
@ -20,10 +20,10 @@ author: jdeckerMS
|
||||
Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test:
|
||||
|
||||
- **Take a Test** shows just the test and nothing else.
|
||||
- **Take a Test** clears the clipboard.
|
||||
- Students aren’t able to go to other websites.
|
||||
- Students can’t open or access other apps.
|
||||
- Students can't share, print, or record their screens.
|
||||
- Students can’t copy or paste.
|
||||
- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features.
|
||||
- Cortana is turned off.
|
||||
|
||||
|
||||
@ -1,5 +1,4 @@
|
||||
# [Deploy Windows 10](index.md)
|
||||
## [Deploy Windows 10 in a test lab](windows-10-poc.md)
|
||||
## [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md)
|
||||
## [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md)
|
||||
### [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
|
||||
|
||||
@ -16,7 +16,6 @@ Learn about deploying Windows 10 for IT professionals.
|
||||
|Topic |Description |
|
||||
|------|------------|
|
||||
|[Change history for Deploy Windows 10](change-history-for-deploy-windows-10.md) |This topic lists new and updated topics in the Deploy Windows 10 documentation for [Windows 10 and Windows 10 Mobile](../index.md). |
|
||||
|[Deploy Windows 10 in a test lab](windows-10-poc.md) |This guide provides instructions for setting up a proof of concept (PoC) lab using Hyper-V and a minimum amount of resources. |
|
||||
|[Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) |To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the key capabilities and limitations of each, is a key task. |
|
||||
|[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. |
|
||||
|[Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) |If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or, more specifically, MDT 2013 Update 2. |
|
||||
|
||||
@ -264,7 +264,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="7" nowrap="nowrap">Windows 10</td>
|
||||
@ -326,7 +326,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td>D</td>
|
||||
<td>✔</td>
|
||||
</tr>
|
||||
</table>
|
||||
@ -392,7 +392,7 @@ The following table summarizes the free upgrade paths to Windows 10. For a list
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td>Windows 8/8.1 Pro Professional</td>
|
||||
<td>Windows 8/8.1 Pro</td>
|
||||
<td rowspan="2">Windows 10 Pro</td>
|
||||
</tr>
|
||||
<tr>
|
||||
|
||||
@ -701,6 +701,7 @@
|
||||
### [Windows Defender in Windows 10](windows-defender-in-windows-10.md)
|
||||
#### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md)
|
||||
#### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md)
|
||||
#### [Use PowerShell cmdlets for Windows Defender](use-powershell-cmdlets-windows-defender-for-windows-10.md)
|
||||
#### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md)
|
||||
### [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md)
|
||||
#### [Isolating Windows Store Apps on Your Network](isolating-apps-on-your-network.md)
|
||||
|
||||
@ -68,7 +68,7 @@ In Active Directory, default local accounts are used by administrators to manage
|
||||
|
||||
Each default local account is automatically assigned to a security group that is preconfigured with the appropriate rights and permissions to perform specific tasks. Active Directory security groups collect user accounts, computer accounts, and other groups into manageable units. For more information, see [Active Directory Security Groups](active-directory-security-groups.md).
|
||||
|
||||
On an Active Directory domain controller, each default local account is referred to as a security principal. A security principal is a directory object that is used to secure and manage Active Directory services that provide access to domain controller resources. A security principal includes objects such as user accounts, computer accounts, security groups, or the threads or processes that run in the security context of a user or computer account. For more information, see [Security Principals Technical Overview](security-principals.md).
|
||||
On an Active Directory domain controller, each default local account is referred to as a security principal. A security principal is a directory object that is used to secure and manage Active Directory services that provide access to domain controller resources. A security principal includes objects such as user accounts, computer accounts, security groups, or the threads or processes that run in the security context of a user or computer account. For more information, see [Security Principals](security-principals.md).
|
||||
|
||||
A security principal is represented by a unique security identifier (SID).The SIDs that are related to each of the default local accounts in Active Directory are described in the sections below.
|
||||
|
||||
@ -350,7 +350,7 @@ Because it is impossible to predict the specific errors that will occur for any
|
||||
**Important**
|
||||
Rebooting a computer is the only reliable way to recover functionality as this will cause both the computer account and user accounts to log back in again. Logging in again will request new TGTs that are valid with the new KRBTGT, correcting any KRBTGT related operational issues on that computer.
|
||||
|
||||
<!-- For information how to resolve issues and potential issues from a compromised KRBTGT account, see "Reset the KRBTGT account password." -->
|
||||
For information about how to help mitigate the risks associated with a potentially compromised KRBTGT account, see [KRBTGT Account Password Reset Scripts now available for customers](http://blogs.microsoft.com/cybertrust/2015/02/11/krbtgt-account-password-reset-scripts-now-available-for-customers/).
|
||||
|
||||
### Read-only domain controllers and the KRBTGT account
|
||||
|
||||
@ -474,7 +474,7 @@ Each default local account in Active Directory has a number of account settings
|
||||
<td><p>Provides support for the Data Encryption Standard (DES). DES supports multiple levels of encryption, including Microsoft Point-to-Point Encryption (MPPE) Standard (40-bit and 56-bit), MPPE standard (56-bit), MPPE Strong (128-bit), Internet Protocol security (IPSec) DES (40-bit), IPSec 56-bit DES, and IPSec Triple DES (3DES).</p>
|
||||
<div class="alert">
|
||||
<strong>Note</strong>
|
||||
<p>DES is not enabled by default in Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows 7, Windows 8, and Windows 8.1. For these operating systems, you must configure your computers to use the DES-CBC-MD5 or DES-CBC-CRC cipher suites. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see [Hunting down DES in order to securely deploy Kerberos](http://blogs.technet.com/b/askds/archive/2010/10/19/hunting-down-des-in-order-to-securely-deploy-kerberos.aspx).</p>
|
||||
<p>DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see [Hunting down DES in order to securely deploy Kerberos](http://blogs.technet.com/b/askds/archive/2010/10/19/hunting-down-des-in-order-to-securely-deploy-kerberos.aspx).</p>
|
||||
</div>
|
||||
<div>
|
||||
|
||||
@ -571,7 +571,7 @@ If the administrators in your environment can sign in locally to managed servers
|
||||
|
||||
- **Better**. Do not grant administrators membership in the local Administrator group on the computer in order to restrict the administrator from bypassing these protections.
|
||||
|
||||
- **Ideal**. Restrict workstations from having any network connectivity, except for the domain controllers and servers that the administrator accounts are used to manage. Alternately, use AppLocker application control policies to restrict all applications from running, except for the operating system and approved administrative tools and applications. For more information about AppLocker, see [AppLocker Overview](http://technet.microsoft.com/library/hh831440.aspx).
|
||||
- **Ideal**. Restrict workstations from having any network connectivity, except for the domain controllers and servers that the administrator accounts are used to manage. Alternately, use AppLocker application control policies to restrict all applications from running, except for the operating system and approved administrative tools and applications. For more information about AppLocker, see [AppLocker](applocker-overview.md).
|
||||
|
||||
The following procedure describes how to block Internet access by creating a Group Policy Object (GPO) that configures an invalid proxy address on administrative workstations. These instructions apply only to computers running Internet Explorer and other Windows components that use these proxy settings.
|
||||
|
||||
@ -584,7 +584,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s
|
||||
|
||||
2. Create computer accounts for the new workstations.
|
||||
|
||||
> **Note** You might have to delegate permissions to join the domain by using [KB 932455](http://support.microsoft.com/kb/932455) if the account that joins the workstations to the domain does not already have permissions to join computers to the domain.
|
||||
> **Note** You might have to delegate permissions to join computers to the domain if the account that joins the workstations to the domain does not already have them. For more information, see [Delegation of Administration in Active Directory](http://social.technet.microsoft.com/wiki/contents/articles/20292.delegation-of-administration-in-active-directory.aspx).
|
||||
|
||||
|
||||
|
||||
@ -846,14 +846,6 @@ In addition, installed applications and management agents on domain controllers
|
||||
|
||||
## See also
|
||||
|
||||
- [Security Principals](security-principals.md)
|
||||
|
||||
[Security Principals Technical Overview](security-principals.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- [Access Control Overview](access-control.md)
|
||||
|
||||
@ -986,7 +986,7 @@ This security group has not changed since Windows Server 2008.
|
||||
|
||||
Members of the Cloneable Domain Controllers group that are domain controllers may be cloned. In Windows Server 2012 R2 and Windows Server 2012, you can deploy domain controllers by copying an existing virtual domain controller. In a virtual environment, you no longer have to repeatedly deploy a server image that is prepared by using sysprep.exe, promote the server to a domain controller, and then complete additional configuration requirements for deploying each domain controller (including adding the virtual domain controller to this security group).
|
||||
|
||||
For more information, see [Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100)](https://technet.microsoft.com/en-us/library/hh831734.aspx).
|
||||
For more information, see [Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100)](https://technet.microsoft.com/library/hh831734.aspx).
|
||||
|
||||
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
|
||||
|
||||
@ -1302,7 +1302,7 @@ This security group has not changed since Windows Server 2008.
|
||||
|
||||
Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions.
|
||||
|
||||
For information about other means to secure the DNS server service, see [Securing the DNS Server Service](http://technet.microsoft.com/library/cc731367.aspx).
|
||||
For more information about security and DNS, see [DNSSEC in Windows Server 2012](https://technet.microsoft.com/library/dn593694(v=ws.11).aspx).
|
||||
|
||||
This security group has not changed since Windows Server 2008.
|
||||
|
||||
@ -1742,7 +1742,7 @@ Members of this group are Read-Only Domain Controllers in the enterprise. Except
|
||||
|
||||
Read-only domain controllers address some of the issues that are commonly found in branch offices. These locations might not have a domain controller. Or, they might have a writable domain controller, but not the physical security, network bandwidth, or local expertise to support it.
|
||||
|
||||
For more information, see [AD DS: Read-Only Domain Controllers](http://technet.microsoft.com/library/cc732801.aspx).
|
||||
For more information, see [What Is an RODC?](https://technet.microsoft.com/library/cc771030.aspx).
|
||||
|
||||
The Enterprise Read-Only Domain Controllers group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable).
|
||||
|
||||
@ -1866,7 +1866,7 @@ This security group has not changed since Windows Server 2008.
|
||||
|
||||
This group is authorized to create, edit, or delete Group Policy Objects in the domain. By default, the only member of the group is Administrator.
|
||||
|
||||
For information about other features you can use with this security group, see [Group Policy Planning and Deployment Guide](http://technet.microsoft.com/library/cc754948.aspx).
|
||||
For information about other features you can use with this security group, see [Group Policy Overview](https://technet.microsoft.com/library/hh831791.aspx).
|
||||
|
||||
The Group Policy Creators Owners group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable).
|
||||
|
||||
@ -2525,7 +2525,7 @@ This group has no default members. Because members of this group can load and un
|
||||
|
||||
The Print Operators group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable).
|
||||
|
||||
This security group has not changed since Windows Server 2008. However, in Windows Server 2008 R2, functionality was added to manage print administration. For more information, see [Assigning Delegated Print Administrator and Printer Permission Settings in Windows Server 2008 R2](http://technet.microsoft.com/library/ee524015(WS.10).aspx).
|
||||
This security group has not changed since Windows Server 2008. However, in Windows Server 2008 R2, functionality was added to manage print administration. For more information, see [Assign Delegated Print Administrator and Printer Permission Settings in Windows Server 2012](https://technet.microsoft.com/library/jj190062(v=ws.11).aspx).
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
@ -2602,7 +2602,7 @@ Depending on the account’s domain functional level, members of the Protected U
|
||||
|
||||
The Protected Users group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable).
|
||||
|
||||
This group was introduced in Windows Server 2012 R2. For more information about how this group works, see [Protected Users Security Group](https://technet.microsoft.com/en-us/library/dn466518.aspx).
|
||||
This group was introduced in Windows Server 2012 R2. For more information about how this group works, see [Protected Users Security Group](https://technet.microsoft.com/library/dn466518.aspx).
|
||||
|
||||
The following table specifies the properties of the Protected Users group.
|
||||
|
||||
@ -2724,7 +2724,7 @@ This security group has not changed since Windows Server 2008.
|
||||
|
||||
Servers that are members in the RDS Endpoint Servers group can run virtual machines and host sessions where user RemoteApp programs and personal virtual desktops run. This group needs to be populated on servers running RD Connection Broker. Session Host servers and RD Virtualization Host servers used in the deployment need to be in this group.
|
||||
|
||||
For information about Remote Desktop Services, see [Remote Desktop Services Design Guide](http://technet.microsoft.com/library/gg750997.aspx).
|
||||
For information about Remote Desktop Services, see [Host desktops and apps in Remote Desktop Services](https://technet.microsoft.com/library/mt718499.aspx).
|
||||
|
||||
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
|
||||
|
||||
@ -2844,7 +2844,7 @@ This security group was introduced in Windows Server 2012, and it has not chang
|
||||
|
||||
Servers in the RDS Remote Access Servers group provide users with access to RemoteApp programs and personal virtual desktops. In Internet facing deployments, these servers are typically deployed in an edge network. This group needs to be populated on servers running RD Connection Broker. RD Gateway servers and RD Web Access servers that are used in the deployment need to be in this group.
|
||||
|
||||
For information about RemoteApp programs, see [Overview of RemoteApp](http://technet.microsoft.com/library/cc755055.aspx)
|
||||
For more information, see [Host desktops and apps in Remote Desktop Services](https://technet.microsoft.com/library/mt718499.aspx).
|
||||
|
||||
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
|
||||
|
||||
@ -2978,7 +2978,7 @@ Because administration of a Read-only domain controller can be delegated to a do
|
||||
|
||||
- Read-only Domain Name System (DNS)
|
||||
|
||||
For information about deploying a Read-only domain controller, see [Read-Only Domain Controllers Step-by-Step Guide](http://technet.microsoft.com/library/cc772234.aspx).
|
||||
For information about deploying a Read-only domain controller, see [Understanding Planning and Deployment for Read-Only Domain Controllers](https://technet.microsoft.com/library/cc754719(v=ws.10).aspx).
|
||||
|
||||
This security group was introduced in Windows Server 2008, and it has not changed in subsequent versions.
|
||||
|
||||
@ -3041,7 +3041,7 @@ Members of the Remote Management Users group can access WMI resources over manag
|
||||
|
||||
The Remote Management Users group is generally used to allow users to manage servers through the Server Manager console, whereas the [WinRMRemoteWMIUsers\_](#bkmk-winrmremotewmiusers-) group is allows remotely running Windows PowerShell commands.
|
||||
|
||||
For more information, see [WS-Management Protocol (Windows)](http://msdn.microsoft.com/library/aa384470.aspx) and [About WMI (Windows)](http://msdn.microsoft.com/library/aa384642.aspx).
|
||||
For more information, see [What's New in MI?](https://msdn.microsoft.com/library/jj819828(v=vs.85).aspx) and [About WMI](http://msdn.microsoft.com/library/aa384642.aspx).
|
||||
|
||||
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
|
||||
|
||||
@ -3105,9 +3105,10 @@ Computers that are members of the Replicator group support file replication in a
|
||||
**Important**
|
||||
In Windows Server 2008 R2, FRS cannot be used for replicating DFS folders or custom (non-SYSVOL) data. A Windows Server 2008 R2 domain controller can still use FRS to replicate the contents of a SYSVOL shared resource in a domain that uses FRS for replicating the SYSVOL shared resource between domain controllers.
|
||||
|
||||
However, Windows Server 2008 R2 servers cannot use FRS to replicate the contents of any replica set apart from the SYSVOL shared resource. The DFS Replication service is a replacement for FRS, and it can be used to replicate the contents of a SYSVOL shared resource, DFS folders, and other custom (non-SYSVOL) data. You should migrate all non-SYSVOL FRS replica sets to DFS Replication. For more information, see [File Replication Service (FRS) Is Deprecated in Windows Server 2008 R2 (Windows).](http://msdn.microsoft.com/library/windows/desktop/ff384840.aspx)
|
||||
However, Windows Server 2008 R2 servers cannot use FRS to replicate the contents of any replica set apart from the SYSVOL shared resource. The DFS Replication service is a replacement for FRS, and it can be used to replicate the contents of a SYSVOL shared resource, DFS folders, and other custom (non-SYSVOL) data. You should migrate all non-SYSVOL FRS replica sets to DFS Replication. For more information, see:
|
||||
|
||||
|
||||
- [File Replication Service (FRS) Is Deprecated in Windows Server 2008 R2 (Windows)](http://msdn.microsoft.com/library/windows/desktop/ff384840.aspx)
|
||||
- [DFS Namespaces and DFS Replication Overview](https://technet.microsoft.com/library/jj127250(v=ws.11).aspx)
|
||||
|
||||
This security group has not changed since Windows Server 2008.
|
||||
|
||||
@ -3581,21 +3582,10 @@ This security group was introduced in Windows Server 2012, and it has not chang
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## See also
|
||||
|
||||
- [Security Principals](security-principals.md)
|
||||
|
||||
[Security Principals Technical Overview](security-principals.md)
|
||||
|
||||
|
||||
[Special Identities](special-identities.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- [Special Identities](special-identities.md)
|
||||
|
||||
- [Access Control Overview](access-control.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Add multiple apps to your enterprise data protection (EDP) Protected Apps list (Windows 10)
|
||||
description: Add multiple apps to your enterprise data protection (EDP) Protected Apps list at the same time, by using the Microsoft Intune Custom URI functionality and the AppLocker.
|
||||
title: Add apps to your enterprise data protection (EDP) policy by using the Microsoft Intune custom URI functionality (Windows 10)
|
||||
description: Add multiple apps to your enterprise data protection (EDP) allowed app list at the same time, by using the Microsoft Intune Custom URI functionality and AppLocker.
|
||||
ms.assetid: b50db35d-a2a9-4b78-a95d-a1b066e66880
|
||||
keywords: EDP, Enterprise Data Protection, protected apps, protected app list
|
||||
ms.prod: w10
|
||||
@ -10,7 +10,7 @@ ms.sitesec: library
|
||||
author: eross-msft
|
||||
---
|
||||
|
||||
# Add multiple apps to your enterprise data protection (EDP) Protected Apps list
|
||||
# Add apps to your enterprise data protection (EDP) policy by using the Microsoft Intune custom URI functionality
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10 Insider Preview
|
||||
@ -18,7 +18,7 @@ author: eross-msft
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
|
||||
Add multiple apps to your enterprise data protection (EDP) **Protected Apps** list at the same time, by using the Microsoft Intune Custom URI functionality and AppLocker. For more info about how to create a custom URI using Intune, see [Windows 10 custom policy settings in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=691330).
|
||||
Add multiple apps to your enterprise data protection (EDP) allowed app list at the same time, by using the Microsoft Intune Custom URI functionality and AppLocker. For more info about how to create a custom URI using Intune, see [Windows 10 custom policy settings in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=691330).
|
||||
|
||||
**Important**
|
||||
Results can be unpredictable if you configure your policy using both the UI and the Custom URI method together. We recommend using a single method for each policy.
|
||||
|
||||
@ -12,6 +12,13 @@ author: brianlic-msft
|
||||
# Change history for Keep Windows 10 secure
|
||||
This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
|
||||
|
||||
## July 2016
|
||||
|
||||
|New or changed topic | Description |
|
||||
|----------------------|-------------|
|
||||
|[Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |New |
|
||||
|
||||
|
||||
## June 2016
|
||||
|
||||
|New or changed topic | Description |
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager (Windows 10)
|
||||
description: Configuration Manager (version 1511 or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network.
|
||||
description: Configuration Manager (version 1606 or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network.
|
||||
ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529
|
||||
keywords: EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager
|
||||
ms.prod: w10
|
||||
@ -15,28 +15,14 @@ author: eross-msft
|
||||
|
||||
- Windows 10 Insider Preview
|
||||
- Windows 10 Mobile Preview
|
||||
- System Center Configuration Manager (version 1511 or later)
|
||||
- System Center Configuration Manager (version 1605 Tech Preview or later)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
|
||||
Configuration Manager (version 1511 or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network.
|
||||
System Center Configuration Manager (version 1605 Tech Preview or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection mode, and how to find enterprise data on the network.
|
||||
|
||||
## In this topic:
|
||||
- [Add an EDP policy](#add-an-edp-policy)
|
||||
|
||||
- [Choose which apps can access your enterprise data](#choose-which-apps-can-access-your-enterprise-data)
|
||||
|
||||
- [Manage the EDP protection level for your enterprise data](#manage-the-edp-protection-level-for-your-enterprise-data)
|
||||
|
||||
- [Define your enterprise-managed identity domains](#define-your-enterprise-managed-identity-domains)
|
||||
|
||||
- [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data)
|
||||
|
||||
- [Choose your optional EDP-related settings](#choose-your-optional-EDP-related-settings)
|
||||
|
||||
- [Review your configuration choices in the Summary screen](#review-your-configuration-choices-in-the-summary-screen)
|
||||
|
||||
- [Deploy the EDP policy](#deploy-the-edp-policy)
|
||||
>**Important**<br>
|
||||
If you previously created an EDP policy using System Center Configuration Manager version 1511 or 1602, you’ll need to recreate it using version 1605 Tech Preview or later. Editing an EDP policy created in version 1511 or 1602 is not supported in version 1605 Tech Preview. There is no migration path between EDP policies across these versions.
|
||||
|
||||
## Add an EDP policy
|
||||
After you’ve installed and set up System Center Configuration Manager for your organization, you must create a configuration item for EDP, which in turn becomes your EDP policy.
|
||||
@ -66,60 +52,124 @@ The **Create Configuration Item Wizard** starts.
|
||||
|
||||
|
||||
|
||||
6. On the **Device Settings** screen, click **Enterprise Data Protection**, and then click **Next**.
|
||||
6. On the **Device Settings** screen, click **Enterprise data protection**, and then click **Next**.
|
||||
|
||||
|
||||
|
||||
The **Configure Enterprise Data Protection settings** page appears, where you'll configure your policy for your organization.
|
||||
The **Configure enterprise data protection settings** page appears, where you'll configure your policy for your organization.
|
||||
|
||||
## Choose which apps can access your enterprise data
|
||||
During the policy-creation process in Configuration Manager, you can choose the apps you want to give access to your enterprise data through EDP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps or unprotected network locations.
|
||||
### Add app rules to your policy
|
||||
During the policy-creation process in System Center Configuration Manager, you can choose the apps you want to give access to your enterprise data through EDP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
|
||||
|
||||
The steps to add your apps are based on the type of app it is; either a Universal Windows Platform (UWP) app, or a signed Classic Windows application.
|
||||
The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed desktop app (also known as a Classic Windows app), or an AppLocker policy file.
|
||||
|
||||
**Important**<br>EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary and will encrypt all files they create or modify, meaning that they could encrypt personal data and cause data leaks during the revocation process. Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your **Protected App** list.
|
||||
>**Important**<br>
|
||||
EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary, and EDP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process. <p>Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
|
||||
|
||||
**To add a UWP app**
|
||||
#### Add a store app rule to your policy
|
||||
For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list.
|
||||
|
||||
1. From the **Configure the following apps to be protected by EDP** table in the **Protected Apps** area, click **Add.**
|
||||
**To add a store app**
|
||||
|
||||
2. Click **Universal App**, type the **Publisher Name** and the **Product Name** into the associated boxes, and then click **OK**. If you don't have the publisher or product name, you can find them by following these steps.
|
||||
1. From the **App rules** area, click **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
**To find the Publisher and Product name values for Microsoft Store apps without installing them**
|
||||
|
||||
|
||||
1. Go to the [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, Microsoft OneNote.
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*.
|
||||
|
||||
2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`.
|
||||
3. Click **Allow** from the **Enterprise data protection mode** drop-down list.
|
||||
|
||||
3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/*9wzdncrfhvjl*/applockerdata, where *9wzdncrfhvjl* is replaced with your ID value.
|
||||
Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp) section.
|
||||
|
||||
The API runs and opens a text editor with the app details.
|
||||
4. Pick **Store App** from the **Rule template** drop-down list.
|
||||
|
||||
``` json
|
||||
The box changes to show the store app rule options.
|
||||
|
||||
5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`.
|
||||
|
||||
If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps.
|
||||
|
||||
**To find the Publisher and Product Name values for Store apps without installing them**
|
||||
|
||||
1. Go to the [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, Microsoft OneNote.
|
||||
|
||||
>**Note**<br>
|
||||
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section.
|
||||
|
||||
2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`.
|
||||
|
||||
3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value.
|
||||
|
||||
The API runs and opens a text editor with the app details.
|
||||
|
||||
``` json
|
||||
{
|
||||
"packageIdentityName": "Microsoft.Office.OneNote",
|
||||
"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
|
||||
"packageIdentityName": "Microsoft.Office.OneNote",
|
||||
"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
|
||||
}
|
||||
```
|
||||
|
||||
4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
|
||||
>**Important**<br>
|
||||
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.<p>For example:
|
||||
```json
|
||||
{
|
||||
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
}
|
||||
```
|
||||
|
||||
4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of the **Add app** box, and then click **OK**.
|
||||
<p>**Important**<br>If you don’t see the **Product Name** box, it could mean that your tenant is not on the latest build and that you need to wait until it's upgraded. Same applies if you see the **AppId** box. The **AppId** box has been removed in the latest build and should disappear (along with any entries) when your tenant is upgraded.
|
||||
<p>**Important**<br>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.<p>For example:<br>
|
||||
**To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones**
|
||||
1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature.
|
||||
|
||||
```
|
||||
>**Note**<br>
|
||||
Your PC and phone must be on the same wireless network.
|
||||
|
||||
2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**.
|
||||
|
||||
3. On the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**.
|
||||
|
||||
4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate.
|
||||
|
||||
5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step.
|
||||
|
||||
6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names.
|
||||
|
||||
7. Start the app for which you're looking for the publisher and product name values.
|
||||
|
||||
8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
|
||||
>**Important**<br>
|
||||
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.<p>For example:
|
||||
```json
|
||||
{
|
||||
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
#### Add a desktop app rule to your policy
|
||||
For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list.
|
||||
|
||||
**To add a Classic Windows application**
|
||||
**To add a desktop app to your policy**
|
||||
1. From the **App rules** area, click **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
1. From the **Configure the following apps to be protected by EDP** table in the **Protected Apps** area, click **Add.**
|
||||
<p>A dialog box appears, letting you pick whether the app is a **Universal App** or a **Desktop App**.
|
||||
|
||||
|
||||
2. Click **Desktop App**, pick the options you want (see table), and then click **OK**.
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*.
|
||||
|
||||
3. Click **Allow** from the **Enterprise data protection mode** drop-down list.
|
||||
|
||||
Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp) section.
|
||||
|
||||
4. Pick **Desktop App** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to show the desktop app rule options.
|
||||
|
||||
5. Pick the options you want to include for the app rule (see table), and then click **OK**.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
@ -139,21 +189,21 @@ The steps to add your apps are based on the type of app it is; either a Universa
|
||||
<td>All files for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, and <strong>File Name</strong> selected</td>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, and <strong>Binary name</strong> selected</td>
|
||||
<td>Any version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>File Name</strong>, and <strong>File Version, Exactly</strong>, selected</td>
|
||||
<td>Specified version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>File Name</strong>, and <strong>File Version, And above</strong> selected</td>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>Binary name</strong>, and <strong>File Version, and above</strong>, selected</td>
|
||||
<td>Specified version or newer releases of the named file or package for the specified product, signed by the named publisher.<p>This option is recommended for enlightened apps that weren't previously enlightened.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>File Name</strong>, and <strong>File Version, And below</strong> selected</td>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>Binary name</strong>, and <strong>File Version, And below</strong> selected</td>
|
||||
<td>Specified version or older releases of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>Binary name</strong>, and <strong>File Version, Exactly</strong> selected</td>
|
||||
<td>Specified version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
If you’re unsure about what to include for the publisher, you can run this PowerShell command:
|
||||
@ -172,43 +222,166 @@ Path Publisher
|
||||
```
|
||||
Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box.
|
||||
|
||||
|
||||
#### Add an AppLocker policy file
|
||||
For this example, we’re going to add an AppLocker XML file to the **App Rules** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/applocker-overview) content.
|
||||
|
||||
## Manage the EDP-protection level for your enterprise data
|
||||
After you've added the apps you want to protect with EDP, you'll need to apply an app management mode.
|
||||
**To create an app rule and xml file using the AppLocker tool**
|
||||
1. Open the Local Security Policy snap-in (SecPol.msc).
|
||||
|
||||
2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**.
|
||||
|
||||
We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your **Protected Apps** list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**.
|
||||
|
||||
|
||||
3. Right-click in the right-hand pane, and then click **Create New Rule**.
|
||||
|
||||
The **Create Packaged app Rules** wizard appears.
|
||||
|
||||
4. On the **Before You Begin** page, click **Next**.
|
||||
|
||||
|
||||
|
||||
5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**.
|
||||
|
||||
|
||||
|
||||
6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area.
|
||||
|
||||
|
||||
|
||||
7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Photos.
|
||||
|
||||
|
||||
|
||||
8. On the updated **Publisher** page, click **Create**.
|
||||
|
||||
|
||||
|
||||
9. Review the Local Security Policy snap-in to make sure your rule is correct.
|
||||
|
||||
|
||||
|
||||
10. In the left pane, right-click on **AppLocker**, and then click **Export policy**.
|
||||
|
||||
The **Export policy** box opens, letting you export and save your new policy as XML.
|
||||
|
||||
|
||||
|
||||
11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**.
|
||||
|
||||
The policy is saved and you’ll see a message that says 1 rule was exported from the policy.
|
||||
|
||||
**Example XML file**<br>
|
||||
This is the XML file that AppLocker creates for Microsoft Photos.
|
||||
|
||||
```xml
|
||||
<AppLockerPolicy Version="1">
|
||||
<RuleCollection Type="Exe" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Msi" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Script" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Dll" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Appx" EnforcementMode="NotConfigured">
|
||||
<FilePublisherRule Id="5e0c752b-5921-4f72-8146-80ad5f582110" Name="Microsoft.Windows.Photos, version 16.526.0.0 and above, from Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
|
||||
<Conditions>
|
||||
<FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.Photos" BinaryName="*">
|
||||
<BinaryVersionRange LowSection="16.526.0.0" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
</RuleCollection>
|
||||
</AppLockerPolicy>
|
||||
```
|
||||
12. After you’ve created your XML file, you need to import it by using System Center Configuration Manager.
|
||||
|
||||
**To import your Applocker policy file app rule using 1System Center Configuration Manager**
|
||||
1. From the **App rules** area, click **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*.
|
||||
|
||||
3. Click **Allow** from the **Enterprise data protection mode** drop-down list.
|
||||
|
||||
Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp) section.
|
||||
|
||||
4. Pick the **AppLocker policy file** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to let you import your AppLocker XML policy file.
|
||||
|
||||
5. Click the ellipsis (...) to browse for your AppLocker XML file, click **Open**, and then click **OK** to close the **Add app rule** box.
|
||||
|
||||
The file is imported and the apps are added to your **App Rules** list.
|
||||
|
||||
#### Exempt apps from EDP restrictions
|
||||
If you're running into compatibility issues where your app is incompatible with EDP, but still needs to be used with enterprise data, you can exempt the app from the EDP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak.
|
||||
|
||||
**To exempt a store app, a desktop app, or an AppLocker policy file app rule**
|
||||
|
||||
1. From the **App rules** area, click **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*.
|
||||
|
||||
3. Click **Exempt** from the **Enterprise data protection mode** drop-down list.
|
||||
|
||||
Be aware that when you exempt apps, they’re allowed to bypass the EDP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic.
|
||||
|
||||
4. Fill out the rest of the app rule info, based on the type of rule you’re adding:
|
||||
|
||||
- **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic.
|
||||
|
||||
- **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic.
|
||||
|
||||
- **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps.
|
||||
|
||||
5. Click **OK**.
|
||||
|
||||
### Manage the EDP-protection level for your enterprise data
|
||||
After you've added the apps you want to protect with EDP, you'll need to apply a management and protection mode.
|
||||
|
||||
We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**.
|
||||
|
||||
|Mode |Description |
|
||||
|-----|------------|
|
||||
|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise. |
|
||||
|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.|
|
||||
|Override |EDP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459). |
|
||||
|Silent |EDP runs silently, logging inappropriate data sharing, without blocking anything. |
|
||||
|Off (not recommended) |EDP is turned off and doesn't help to protect or audit your data.
|
||||
<p>After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives. |
|
||||
|Silent |EDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.|
|
||||
|Off (not recommended) |EDP is turned off and doesn't help to protect or audit your data.<p>After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives.|
|
||||
|
||||
|
||||
|
||||
## Define your enterprise-managed identity domains
|
||||
Specify your company’s enterprise identity, expressed as your primary internet domain. For example, if your company is Contoso, its enterprise identity might be contoso.com. The first listed domain (in this example, contoso.com) is the primary enterprise identity string used to tag files protected by any app on the **Protected App** list.
|
||||
### Define your enterprise-managed identity domains
|
||||
Corporate identity, usually expressed as your primary internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by EDP. For example, emails using contoso.com are identified as being corporate and are restricted by your enterprise data protection policies.
|
||||
|
||||
You can also specify all the domains owned by your enterprise that are used for user accounts, separating them with the "|" character. For example, if Contoso also has some employees with email addresses or user accounts on the fabrikam.com domain, you would use contoso.com|fabrikam.com.
|
||||
You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (contoso.com|newcontoso.com). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list.
|
||||
|
||||
This list of managed identity domains, along with the primary domain, make up the identity of your managing enterprise. User identities (user@domain) that end in any of the domains on this list, are considered managed.
|
||||
**To add your corporate identity**
|
||||
|
||||
|
||||
- Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`.
|
||||
|
||||
**To add your primary domain**
|
||||
|
||||
|
||||
- Type the name of your primary domain into the **Primary domain** field. For example, *contoso.com*.<p>
|
||||
If you have multiple domains, you must separate them with the "|" character. For example, contoso.com|fabrikam.com.
|
||||
### Choose where apps can access enterprise data
|
||||
After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.
|
||||
|
||||
## Choose where apps can access enterprise data
|
||||
After you've added a management level to your protected apps, you'll need to decide where those apps can access enterprise data on your network. There are 6 options, including your network domain, cloud domain, proxy server, internal proxy server, IPv4 range, and IPv6 range.
|
||||
There are no default locations included with EDP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT).
|
||||
|
||||
**To specify where your protected apps can find and send enterprise data on the network**
|
||||
>**Important**<br>
|
||||
- Every EDP policy should include policy that defines your enterprise network locations.
|
||||
- Classless Inter-Domain Routing (CIDR) notation isn’t supported for EDP configurations.
|
||||
|
||||
**To define where your protected apps can find and send enterprise data on you network**
|
||||
|
||||
1. Add additional network locations your apps can access by clicking **Add**.
|
||||
|
||||
The **Add or edit corporate network definition** box appears.
|
||||
|
||||
2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table.
|
||||
|
||||
|
||||
|
||||
1. Add additional network locations your apps can access by clicking **Add**, and then choosing your location type, including:
|
||||
<table>
|
||||
<tr>
|
||||
<th>Network location type</th>
|
||||
@ -216,65 +389,145 @@ After you've added a management level to your protected apps, you'll need to dec
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Cloud Domain</td>
|
||||
<td>contoso.sharepoint.com,proxy1.contoso.com|<br>office.com|proxy2.contoso.com</td>
|
||||
<td>Specify the cloud resources traffic to restrict to your protected apps.<p>For each cloud resource, you may also specify an internal proxy server that routes your traffic from your **Enterprise Internal Proxy Server** policy. If you have multiple resources, you must use the | delimiter. Include the "|" delimiter just before the "|" if you don’t use proxies. For example: [URL,Proxy]|[URL,Proxy].</td>
|
||||
<td>Enterprise Cloud Resources</td>
|
||||
<td>**With proxy:** contoso.sharepoint.com,proxy.contoso.com|<br>contoso.visualstudio.com,proxy.contoso.com<p>**Without proxy:** contoso.sharepoint.com|contoso.visualstudio.com</td>
|
||||
<td>Specify the cloud resources to be treated as corporate and protected by EDP.<p>For each cloud resource, you may also optionally specify an internal proxy server that routes your traffic through your Enterprise Internal Proxy Server.<p>If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: `URL <,proxy>|URL <,proxy>`.<p>If Windows is unable to determine whether an app should be allowed to connect to a network resource, it will automatically block the connection. If instead you want Windows to allow the connections to happen, you can add the `/*AppCompat*/` string to this setting. For example: `URL <,proxy>|URL <,proxy>|/*AppCompat*/`</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Network Domain</td>
|
||||
<td>domain1.contoso.com,domain2.contoso.com</td>
|
||||
<td>Specify the DNS suffix used in your environment. All traffic to the fully-qualified domains using this DNS suffix will be protected. If you have multiple resources, you must use the "," delimiter.<p>This setting works with the IP Ranges settings to detect whether a network endpoint is enterprise or personal on private networks.</td>
|
||||
<td>Enterprise Network Domain Names (Required)</td>
|
||||
<td>corp.contoso.com,region.contoso.com</td>
|
||||
<td>Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.<p>This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.<p>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Proxy Server</td>
|
||||
<td>domain1.contoso.com:80;domain2.contoso.com:137</td>
|
||||
<td>Specify the proxy server and the port traffic is routed through. If you have multiple resources, you must use the ";" delimiter.<p>This setting is required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when using certain Wi-Fi hotspots at hotels and restaurants.</td>
|
||||
<td>Enterprise Proxy Servers</td>
|
||||
<td>proxy.contoso.com:80;proxy2.contoso.com:137</td>
|
||||
<td>Specify your externally-facing proxy server addresses, along with the port through which traffic is allowed and protected with EDP.<p>This list shouldn’t include any servers listed in the Enterprise Internal Proxy Servers list, which are used for EDP-protected traffic.<p>This setting is also required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when you’re visiting another company and not on that company’s guest network.<p>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Internal Proxy Server</td>
|
||||
<td>proxy1.contoso.com;proxy2.contoso.com</td>
|
||||
<td>Specify the proxy servers your cloud resources will go through. If you have multiple resources, you must use the ";" delimiter.</td>
|
||||
<td>Enterprise Internal Proxy Servers</td>
|
||||
<td>contoso.internalproxy1.com;contoso.internalproxy2.com</td>
|
||||
<td>Specify the proxy servers your devices will go through to reach your cloud resources.<p>Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.<p>This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.<p>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise IPv4 Range</td>
|
||||
<td>**Starting IPv4 Address:** 3.4.0.1<br>**Ending IPv4 Address:** 3.4.255.254<br>**Custom URI:** 3.4.0.1-3.4.255.254,10.0.0.1-10.255.255.254</td>
|
||||
<td>Specify the addresses for a valid IPv4 value range within your intranet.<p>If you are adding a single range, you can enter the starting and ending addresses into your management system’s UI. If you want to add multiple addresses, we suggest creating a Custom URI, using the "-" delimiter between start and end of a range, and the "," delimiter to separate ranges.</td>
|
||||
<td>Enterprise IPv4 Range (Required)</td>
|
||||
<td>**Starting IPv4 Address:** 3.4.0.1<br>**Ending IPv4 Address:** 3.4.255.254<br>**Custom URI:** 3.4.0.1-3.4.255.254,<br>10.0.0.1-10.255.255.254</td>
|
||||
<td>Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.<p>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise IPv6 Range</td>
|
||||
<td>**Starting IPv6 Address:** 2a01:110::<br>**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff<br>**Custom URI:** 2a01:110::-2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</td>
|
||||
<td>Specify the addresses for a valid IPv6 value range within your intranet.<p>If you are adding a single range, you can enter the starting and ending addresses into your management system’s UI. If you want to add multiple addresses, we suggest creating a Custom URI, using the "-" delimiter between start and end of a range, and the "," delimiter to separate ranges.</td>
|
||||
</tr>
|
||||
<td>**Starting IPv6 Address:** 2a01:110::<br>**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff<br>**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,<br>fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</td>
|
||||
<td>Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.<p>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Neutral Resources</td>
|
||||
<td>sts.contoso.com,sts.contoso2.com</td>
|
||||
<td>Specify your authentication redirection endpoints for your company.<p>These locations are considered enterprise or personal, based on the context of the connection before the redirection.<p>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
3. Add as many locations as you need, and then click **OK**.
|
||||
|
||||
2. Add as many locations as you need, and then click **OK**.<p>
|
||||
The **Add or Edit Enterprise Network Locations box** closes.
|
||||
The **Add or edit corporate network definition** box closes.
|
||||
|
||||
3. In the **Use a data recovery certificate in case of data loss** box, click **Browse** to add a data recovery certificate for your policy.<p>
|
||||
Adding a data recovery certificate helps you to access locally-protected files on the device. For example, if an employee leaves the company and the IT department has to access EDP-protected data from a Windows 10 company computer. This can also help recover data in case an employee's device is accidentally revoked. For more info about how to find and export your data recovery certificate, see the[Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic.
|
||||
4. Decide if you want to Windows to look for additional network settings.
|
||||
|
||||
## Choose your optional EDP-related settings
|
||||
|
||||
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network.
|
||||
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network.
|
||||
|
||||
- **Show the enterprise data protection icon overlay on your allowed apps that are EDP-unaware in the Windows Start menu and on corporate file icons in the File Explorer.** Click this box if you want the enterprise data protection icon overlay to appear on corporate files or in the Start menu, on top the tiles for your unenlightened protected apps.
|
||||
|
||||
5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy.
|
||||
|
||||
After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data.
|
||||
|
||||
For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic.
|
||||
|
||||
|
||||
|
||||
#### Create and verify an Encrypting File System (EFS) DRA certificate for EDP
|
||||
If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use EDP in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you.
|
||||
|
||||
>**Important**<br>If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy.
|
||||
|
||||
**To manually create an EFS DRA certificate**
|
||||
1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate.
|
||||
2. Run this command:
|
||||
|
||||
`cipher /r:<EFSDRA>`<br>Where `<EFSDRA>` is the name of the .cer and .pfx files that you want to create.
|
||||
|
||||
3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file.
|
||||
|
||||
The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1.
|
||||
|
||||
**Important**<br>Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location.
|
||||
|
||||
4. Add your EFS DRA certificate to your EDP policy by using Step 3 of the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic.
|
||||
|
||||
**To verify your data recovery certificate is correctly set up on an EDP client computer**
|
||||
1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by EDP.
|
||||
|
||||
2. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command:
|
||||
|
||||
`cipher /c <filename>`<br>Where `<filename>` is the name of the file you created in Step 1.
|
||||
|
||||
3. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list.
|
||||
|
||||
**To recover your data using the EFS DRA certificate in a test environment**
|
||||
1. Copy your EDP-encrypted file to a location where you have admin access.
|
||||
|
||||
2. Install the EFSDRA.pfx file, using your password.
|
||||
|
||||
3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command:
|
||||
|
||||
`cipher /d <encryptedfile.extension>`<br>Where `<encryptedfile.extension>` is the name of your encrypted file. For example, corporatedata.docx.
|
||||
|
||||
### Choose your optional EDP-related settings
|
||||
After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional EDP settings.
|
||||
|
||||
**To add your optional settings**
|
||||
- Choose to set any or all of the optional EDP-related settings:
|
||||
|
||||
|
||||
- **Block the user from decrypting data that was created or edited by the apps configured above.** Clicking **No**, or leaving the setting blank, lets your employees right-click to decrypt their protected app data, along with the option to decrypt data in the **Save As** box and the **Save As** file picker . Clicking **Yes** removes the **Decrypt** option and saves all data for protected apps as enterprise-encrypted.
|
||||
**To set your optional settings**
|
||||
1. Choose to set any or all of the optional settings:
|
||||
|
||||
- **Protect app content when the device is in a locked state for the apps configured above.** Clicking **Yes** lets EDP help to secure protected app content when a mobile device is locked. We recommend turning this option on to help prevent data leaks from things such as email text that appears on the **Lock** screen of a Windows 10 Mobile phone.
|
||||
- **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are:
|
||||
|
||||
- **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box.
|
||||
|
||||
- **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult.
|
||||
|
||||
|
||||
- **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether apps can show corporate data on a Windows 10 Mobile device **Lock** screen. The options are:
|
||||
|
||||
- **Yes (recommended).** Stop apps from reading corporate data on Windows 10 Mobile device when the screen is locked.
|
||||
|
||||
- **No, or not configured.** Allows apps to read corporate data on Windows 10 Mobile device when the screen is locked.
|
||||
|
||||
## Review your configuration choices in the Summary screen
|
||||
- **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are:
|
||||
|
||||
- **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps.
|
||||
|
||||
- **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps.
|
||||
|
||||
- **Revoke local encryption keys during the unerollment process.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from enterprise data protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are:
|
||||
|
||||
- **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment.
|
||||
|
||||
- **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions.
|
||||
|
||||
2. After you pick all of the settings you want to include, click **Summary**.
|
||||
|
||||
### Review your configuration choices in the Summary screen
|
||||
After you've finished configuring your policy, you can review all of your info on the **Summary** screen.
|
||||
|
||||
**To view the Summary screen**
|
||||
- Click the **Summary** button to review your policy choices, and then click **Next** to finish and to save your policy.<p>
|
||||
A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page.
|
||||
- Click the **Summary** button to review your policy choices, and then click **Next** to finish and to save your policy.
|
||||
|
||||
|
||||
|
||||
A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page.
|
||||
|
||||
|
||||
|
||||
## Deploy the EDP policy
|
||||
After you’ve created your EDP policy, you'll need to deploy it to your organization's devices. For info about your deployment options, see these topics:
|
||||
@ -283,15 +536,6 @@ After you’ve created your EDP policy, you'll need to deploy it to your organiz
|
||||
- [How to Deploy Configuration Baselines in Configuration Manager]( http://go.microsoft.com/fwlink/p/?LinkId=708226)
|
||||
|
||||
## Related topics
|
||||
- [System Center Configuration Manager and Endpoint Protection (Version 1511)](http://go.microsoft.com/fwlink/p/?LinkId=717372)
|
||||
- [System Center Configuration Manager and Endpoint Protection (Version 1606)](http://go.microsoft.com/fwlink/p/?LinkId=717372)
|
||||
- [TechNet documentation for Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=691623)
|
||||
- [Manage mobile devices with Configuration Manager and Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=691624)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- [Manage mobile devices with Configuration Manager and Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=691624)
|
||||
@ -57,7 +57,7 @@ AppLocker and Device Guard should run side-by-side in your organization, which o
|
||||
|
||||
**Device Guard with Credential Guard**
|
||||
|
||||
Although Credential Guard is not a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against credential theft. Similar to virtualization-based protection of kernel mode code integrity, Credential Guard leverages hypervisor technology to protect domain credentials. This mitigation is targeted at resisting the use of pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Credential Guard, organizations can gain additional protection against such threats. For information about how to deploy Credential Guard to your Windows 10 Enterprise clients, see the [Enable Credential Guard](#enable-cg) section. In addition to the client-side enablement of Credential Guard, organizations can deploy mitigations at both the CA and domain controller level to help prevent credential theft. Microsoft will be releasing details about these additional mitigations in the future.
|
||||
Although Credential Guard is not a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against credential theft. Similar to virtualization-based protection of kernel mode code integrity, Credential Guard leverages hypervisor technology to protect domain credentials. This mitigation is targeted at resisting the use of pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Credential Guard, organizations can gain additional protection against such threats. For information about how to deploy Credential Guard to your Windows 10 Enterprise clients, see the [Enable Credential Guard](#enable-cg) section. In addition to the client-side enablement of Credential Guard, organizations can deploy mitigations at both the CA and domain controller level to help prevent credential theft. Refer to the [Credential Guard](credential-guard.md) documentation for guidance on these additional mitigations.
|
||||
|
||||
**Unified manageability**
|
||||
|
||||
|
||||
@ -132,16 +132,8 @@ If clients do not recognize Dynamic Access Control, there must be a two-way trus
|
||||
|
||||
If claims are transformed when they leave a forest, all domain controllers in the user’s forest root must be set at the Windows Server 2012 or higher functional level.
|
||||
|
||||
A file server running Windows Server 2012 or Windows Server 2012 R2 must have a Group Policy setting that specifies whether it needs to get user claims for user tokens that do not carry claims. This setting is set by default to **Automatic**, which results in this Group Policy setting to be turned **On** if there is a central policy that contains user or device claims for that file server. If the file server contains discretionary ACLs that include user claims, you need to set this Group Policy to **On** so that the server knows to request claims on behalf of users that do not provide claims when they access the server.
|
||||
|
||||
## Additional resource
|
||||
|
||||
[Access control overview](access-control.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
A file server running a server operating system that supports Dyamic Access Control must have a Group Policy setting that specifies whether it needs to get user claims for user tokens that do not carry claims. This setting is set by default to **Automatic**, which results in this Group Policy setting to be turned **On** if there is a central policy that contains user or device claims for that file server. If the file server contains discretionary ACLs that include user claims, you need to set this Group Policy to **On** so that the server knows to request claims on behalf of users that do not provide claims when they access the server.
|
||||
|
||||
## See also
|
||||
|
||||
- [Access control overview](access-control.md)
|
||||
|
||||
@ -70,7 +70,7 @@ This event generates every time Windows Security audit log was cleared.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that cleared the system security audit log. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that cleared the system security audit log.
|
||||
|
||||
|
||||
@ -75,7 +75,7 @@ You typically see these events during operating system startup or user logon and
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that registered the trusted logon process. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that registered the trusted logon process.
|
||||
|
||||
|
||||
@ -82,7 +82,7 @@ You will typically see these events with “**Subject\\Security ID**” = “**L
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “change system time” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “change system time” operation.
|
||||
|
||||
|
||||
@ -115,7 +115,7 @@ This event generates when a logon session is created (on destination machine). I
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about successful logon.
|
||||
|
||||
@ -175,7 +175,7 @@ This event generates when a logon session is created (on destination machine). I
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account for which logon was performed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account for which logon was performed.
|
||||
|
||||
|
||||
@ -89,7 +89,7 @@ This event generates on domain controllers, member servers, and workstations.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that reported information about logon failure. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about logon failure.
|
||||
|
||||
@ -125,7 +125,7 @@ This event generates on domain controllers, member servers, and workstations.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of the account that was specified in the logon attempt. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that was specified in the logon attempt.
|
||||
|
||||
|
||||
@ -85,7 +85,7 @@ This event generates on the computer to which the logon was performed (target co
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that reported information about claims. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about claims.
|
||||
|
||||
@ -121,7 +121,7 @@ This event generates on the computer to which the logon was performed (target co
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account for which logon was performed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account for which logon was performed.
|
||||
|
||||
|
||||
@ -80,7 +80,7 @@ Multiple events are generated if the group membership information cannot fit in
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about successful logon or invokes it.
|
||||
|
||||
@ -116,7 +116,7 @@ Multiple events are generated if the group membership information cannot fit in
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account for which logon was performed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account for which logon was performed.
|
||||
|
||||
|
||||
@ -75,7 +75,7 @@ It may be positively correlated with a “[4624](event-4624.md): An account was
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that was logged off. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that was logged off.
|
||||
|
||||
|
||||
@ -74,7 +74,7 @@ It may be positively correlated with a “[4624](event-4624.md): An account was
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “logoff” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “logoff” operation.
|
||||
|
||||
|
||||
@ -82,7 +82,7 @@ It is also a routine event which periodically occurs during normal operating sys
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the new logon session with explicit credentials. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the new logon session with explicit credentials.
|
||||
|
||||
|
||||
@ -93,7 +93,7 @@ This event shows that access was requested, and the results of the request, but
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested a handle to an object. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested a handle to an object.
|
||||
|
||||
|
||||
@ -80,7 +80,7 @@ This event generates only if “Set Value" auditing is set in registry key’s [
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “modify registry value” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “modify registry value” operation.
|
||||
|
||||
|
||||
@ -76,7 +76,7 @@ Typically this event is needed if you need to know how long the handle to the ob
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “close object’s handle” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “close object’s handle” operation.
|
||||
|
||||
|
||||
@ -79,7 +79,7 @@ The advantage of this event is that it’s generated only during real delete ope
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “delete object” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “delete object” operation.
|
||||
|
||||
|
||||
@ -84,7 +84,7 @@ This event generates only if Success auditing is enabled for the [Audit Handle M
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested a handle to an object. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested a handle to an object.
|
||||
|
||||
|
||||
@ -84,7 +84,7 @@ You will get one 4662 for each operation type which was performed.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the operation.
|
||||
|
||||
|
||||
@ -87,7 +87,7 @@ The main difference with “[4656](event-4656.md): A handle to an object was req
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that made an attempt to access an object. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that made an attempt to access an object.
|
||||
|
||||
|
||||
@ -71,7 +71,7 @@ This event generates when an NTFS hard link was successfully created.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that made an attempt to create the hard link. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that made an attempt to create the hard link.
|
||||
|
||||
|
||||
@ -80,7 +80,7 @@ Before this event can generate, certain ACEs might need to be set in the object
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “change object’s permissions” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “change object’s permissions” operation.
|
||||
|
||||
|
||||
@ -97,7 +97,7 @@ You typically will see many of these events in the event log, because every logo
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account to which special privileges were assigned. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account to which special privileges were assigned.
|
||||
|
||||
|
||||
@ -77,7 +77,7 @@ Failure event generates when service call attempt fails.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested privileged operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested privileged operation.
|
||||
|
||||
|
||||
@ -80,7 +80,7 @@ Failure event generates when operation attempt fails.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested privileged operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested privileged operation.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ This event generates when SIDs were filtered for specific Active Directory trust
|
||||
|
||||
See more information about SID filtering here: <https://technet.microsoft.com/en-us/library/cc772633(v=ws.10).aspx>.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
There is no example of this event in this document.
|
||||
|
||||
|
||||
@ -95,7 +95,7 @@ This event generates every time a new process starts.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “create process” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “create process” operation.
|
||||
|
||||
@ -119,7 +119,7 @@ This event generates every time a new process starts.
|
||||
|
||||
- **Security ID** \[Type = SID\] \[Version 2\]**:** SID of target account. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\] \[Version 2\]**:** the name of the target account.
|
||||
|
||||
|
||||
@ -71,7 +71,7 @@ This event generates every time a process has exited.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “terminate process” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “terminate process” operation.
|
||||
|
||||
|
||||
@ -72,7 +72,7 @@ This event generates if an attempt was made to duplicate a handle to an object.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that made an attempt to duplicate a handle to an object. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that made an attempt to duplicate a handle to an object.
|
||||
|
||||
|
||||
@ -75,7 +75,7 @@ These events are generated for [ALPC Ports](https://msdn.microsoft.com/en-us/lib
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested an access to the object. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested an access to the object.
|
||||
|
||||
|
||||
@ -82,7 +82,7 @@ Failure event generates when a Master Key backup operation fails for some reason
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested backup operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested backup operation.
|
||||
|
||||
|
||||
@ -79,7 +79,7 @@ Failure event generates when a Master Key restore operation fails for some reaso
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “recover” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security Identifiers](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379571(v=vs.85).aspx).
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](security-identifiers.md).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “recover” operation.
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user