mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 13:57:22 +00:00
Merge remote-tracking branch 'refs/remotes/origin/master' into jdshacct
This commit is contained in:
jdeckerMS
commit
d261f407c7
1
.gitignore
vendored
1
.gitignore
vendored
@ -10,7 +10,6 @@ Tools/NuGet/
|
||||
.openpublishing.build.mdproj
|
||||
.openpublishing.buildcore.ps1
|
||||
packages.config
|
||||
windows/keep-secure/index.md
|
||||
|
||||
# User-specific files
|
||||
.vs/
|
||||
@ -8,6 +8,7 @@ Welcome! This repository houses the docs that are written for IT professionals f
|
||||
- [Surface](https://technet.microsoft.com/itpro/surface)
|
||||
- [Surface Hub](https://technet.microsoft.com/itpro/surface-hub)
|
||||
- [Windows 10 for Education](https://technet.microsoft.com/edu/windows)
|
||||
- [HoloLens](https://technet.microsoft.com/itpro/hololens)
|
||||
- [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop)
|
||||
|
||||
## Contributing
|
||||
|
||||
@ -10,7 +10,6 @@ title: Deprecated document modes and Internet Explorer 11 (Internet Explorer 11
|
||||
ms.sitesec: library
|
||||
---
|
||||
|
||||
|
||||
# Deprecated document modes and Internet Explorer 11
|
||||
|
||||
**Applies to:**
|
||||
@ -25,8 +24,8 @@ Windows Internet Explorer 8 introduced document modes as a way to move from the
|
||||
|
||||
This means that while Internet Explorer 11 will continue to support document modes, Microsoft Edge won’t. And because of that, it also means that if you want to use Microsoft Edge, you’re going to have to update your legacy webpages and apps to support modern features, browsers, and devices.
|
||||
|
||||
**Note**<br>
|
||||
For specific details about the technologies and APIs that are no longer supported in Microsoft Edge, see [A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent](https://go.microsoft.com/fwlink/p/?LinkId=615953).
|
||||
>**Note**<br>
|
||||
>For specific details about the technologies and APIs that are no longer supported in Microsoft Edge, see [A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent](https://go.microsoft.com/fwlink/p/?LinkId=615953).
|
||||
|
||||
## What is document mode?
|
||||
Each release after Internet Explorer 8 has helped with the transition by introducing additional document modes that emulated previously supported versions, while also introducing support for features defined by industry standards. During this time, numerous websites and apps were updated to the latest and greatest industry standards, while many other sites and apps continued to simply rely on document modes to work properly.
|
||||
@ -41,7 +40,8 @@ The compatibility improvements made in IE11 lets older websites just work in the
|
||||
## Document mode selection flowchart
|
||||
This flowchart shows how IE11 works when document modes are used.
|
||||
|
||||
|
||||
<br>
|
||||
[Click this link to enlarge image](img-ie11-docmode-lg.md)
|
||||
|
||||
## Known Issues with Internet Explorer 8 document mode in Enterprise Mode
|
||||
The default document mode for Enterprise Mode is Internet Explorer 8. While this mode provides a strong emulation of that browser, it isn’t an exact match. For example, Windows Internet Explorer 9 fundamentally changed how document modes work with iframes and document modes can’t undo architectural changes. It’s also a known issue that Windows 10 supports GDI font rendering while using Enterprise Mode, but uses natural metrics once outside of Enterprise Mode.
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 85 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 10 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 234 KiB |
@ -0,0 +1,11 @@
|
||||
---
|
||||
description: A full-sized view of how document modes are chosen in IE11.
|
||||
title: Full-sized flowchart detailing how document modes are chosen in IE11
|
||||
---
|
||||
|
||||
Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md)<br>
|
||||
|
||||
<p style="overflow: auto;">
|
||||
<img src="images/docmode-decisions-lg.png" alt="Full-sized flowchart detailing how document modes are chosen in IE11" width="1355" height="1625" style="max-width:none;">
|
||||
</p>
|
||||
|
||||
@ -17,7 +17,7 @@ If you’re having problems launching your legacy apps while running Internet Ex
|
||||
|
||||
1. **For x86 systems or for 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**.
|
||||
|
||||
2. **For x64 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\.NETFramework` registry key and change the **EnableIEHosting** value to **1**.
|
||||
2. **For x64 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**.
|
||||
|
||||
For more information, see the [Web Applications](https://go.microsoft.com/fwlink/p/?LinkId=308903) section of the Application Compatibility in the .NET Framework 4.5 page.
|
||||
|
||||
|
||||
@ -41,8 +41,8 @@ In IE, press **ALT+V** to show the **View** menu, press **T** to enter the **Too
|
||||
## Where did the search box go?
|
||||
IE11 uses the **One Box** feature, which lets users type search terms directly into the **Address bar**. Any text entered into the **Address bar** that doesn't appear to be a URL is automatically sent to the currently selected search provider.
|
||||
|
||||
**Note**<br>
|
||||
Depending on how you've set up your intranet search, the text entry might resolve to an intranet site. For more information about this, see [Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md).
|
||||
>[!NOTE]
|
||||
>Depending on how you've set up your intranet search, the text entry might resolve to an intranet site. For more information about this, see [Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md).
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,8 +1,9 @@
|
||||
# [Microsoft HoloLens](index.md)
|
||||
## [HoloLens in the enterprise: requirements](hololens-requirements.md)
|
||||
## [Set up HoloLens](hololens-setup.md)
|
||||
## [Upgrade to Windows Holographic Enterprise](hololens-upgrade-enterprise.md)
|
||||
## [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md)
|
||||
## [Enroll HoloLens in MDM](hololens-enroll-mdm.md)
|
||||
## [Set up HoloLens in kiosk mode](hololens-kiosk.md)
|
||||
## [Configure HoloLens using a provisioning package](hololens-provisioning.md)
|
||||
## [Install apps on HoloLens](hololens-install-apps.md)
|
||||
## [Install apps on HoloLens](hololens-install-apps.md)
|
||||
## [Change history for Microsoft HoloLens documentation](change-history-hololens.md)
|
||||
21
devices/hololens/change-history-hololens.md
Normal file
21
devices/hololens/change-history-hololens.md
Normal file
@ -0,0 +1,21 @@
|
||||
---
|
||||
title: Change history for Microsoft HoloLens documentation
|
||||
description: This topic lists new and updated topics for HoloLens.
|
||||
keywords: change history
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: surfacehub
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Change history for Microsoft HoloLens documentation
|
||||
|
||||
This topic lists new and updated topics in the [Microsoft HoloLens documentation](index.md).
|
||||
|
||||
## January 2017
|
||||
|
||||
| New or changed topic | Description |
|
||||
| --- | --- |
|
||||
| All topics | Changed all references from **Windows Holographic Enterprise** to **Windows Holographic for Business** |
|
||||
@ -6,14 +6,15 @@ ms.mktglfcycl: manage
|
||||
ms.pagetype: hololens, devices
|
||||
ms.sitesec: library
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Enroll HoloLens in MDM
|
||||
|
||||
You can manage multiple HoloLens devices simultaneously using solutions like Microsoft InTune. You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need.
|
||||
You can manage multiple Microsoft HoloLens devices simultaneously using solutions like Microsoft InTune. You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need.
|
||||
|
||||
>[!NOTE]
|
||||
>Mobile device management (MDM) for Development Edition HoloLens does not include VPN, BitLocker, or kiosk mode. Those features are only available when you [upgrade to Windows Holographic Enterprise](hololens-upgrade-enterprise.md).
|
||||
>Mobile device management (MDM) for the Development edition of HoloLens does not include VPN, BitLocker, or kiosk mode. Those features are only available when you [upgrade to Windows Holographic for Business](hololens-upgrade-enterprise.md).
|
||||
|
||||
|
||||
## Requirements
|
||||
|
||||
@ -6,6 +6,7 @@ ms.mktglfcycl: manage
|
||||
ms.pagetype: hololens, devices
|
||||
ms.sitesec: library
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Install apps on HoloLens
|
||||
@ -15,7 +16,7 @@ The recommended way to install Universal Windows Platform (UWP) apps on HoloLens
|
||||
You can also deploy apps using your mobile device management (MDM) provider or use the Windows Device Portal to install apps, if you enable **Developer Mode** on the HoloLens device.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device.** Developer Mode** on a device that has been upgraded to Windows Holographic Enterprise enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
|
||||
>When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device.**Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
|
||||
|
||||
## Use Windows Store for Business to deploy apps to HoloLens
|
||||
|
||||
|
||||
@ -6,6 +6,7 @@ ms.mktglfcycl: manage
|
||||
ms.pagetype: hololens, devices
|
||||
ms.sitesec: library
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Set up HoloLens in kiosk mode
|
||||
@ -17,7 +18,7 @@ Kiosk mode limits the user's ability to launch new apps or change the running ap
|
||||
1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/holographic/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic Enterprise enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
|
||||
>When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
|
||||
|
||||
2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#connecting_over_usb).
|
||||
|
||||
@ -31,7 +32,7 @@ Kiosk mode limits the user's ability to launch new apps or change the running ap
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has an [Enterprise license](hololens-upgrade-enterprise.md).
|
||||
>The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has a [license to upgrade to Windows Holographic for Business](hololens-upgrade-enterprise.md).
|
||||
|
||||
5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**.
|
||||
|
||||
|
||||
@ -6,6 +6,7 @@ ms.mktglfcycl: manage
|
||||
ms.pagetype: hololens, devices
|
||||
ms.sitesec: library
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Configure HoloLens using a provisioning package
|
||||
@ -13,7 +14,7 @@ author: jdeckerMS
|
||||
Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. The Windows Assessment and Deployment Kit (ADK) for Windows 10 includes the Imaging and Configuration Designer (ICD), a tool for configuring images and runtime settings which are then built into provisioning packages.
|
||||
|
||||
Some of the HoloLens configurations that you can apply in a provisioning package:
|
||||
- Upgrade to Windows Holographic Enterprise
|
||||
- Upgrade to Windows Holographic for Business
|
||||
- Set up a local account
|
||||
- Set up a Wi-Fi connection
|
||||
- Apply certificatess to the device
|
||||
@ -31,7 +32,7 @@ When you run ADKsetup.exe for Windows 10, version 1607, select **Configuration D
|
||||
## Create a provisioning package for HoloLens
|
||||
|
||||
>[!NOTE]
|
||||
>Settings in a provisioning package will only be applied if the provisioning package includes an edition upgrade license to Windows Holographic Enterprise or if [the device has already been upgraded to Windows Holographic Enterprise](hololens-upgrade-enterprise.md).
|
||||
>Settings in a provisioning package will only be applied if the provisioning package includes an edition upgrade license to Windows Holographic for Business or if [the device has already been upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md).
|
||||
|
||||
1. On the Windows ICD start page, select **Advanced provisioning**.
|
||||
|
||||
@ -100,7 +101,7 @@ When you run ADKsetup.exe for Windows 10, version 1607, select **Configuration D
|
||||
|
||||
Provisioning packages make use of configuration service providers (CSPs). If you're not familiar with CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers).
|
||||
|
||||
In Windows ICD, when you create a provisioning package for Windows Holographic, the settings in **Available customizations** are based on [CSPs that are supported in Windows Holographic](https://msdn.microsoft.co/library/windows/hardware/dn920025.aspx#HoloLens). The following table describes settings that you might want to configure for HoloLens.
|
||||
In Windows ICD, when you create a provisioning package for Windows Holographic, the settings in **Available customizations** are based on [CSPs that are supported in Windows Holographic](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference#hololens). The following table describes settings that you might want to configure for HoloLens.
|
||||
|
||||
|
||||
|
||||
@ -109,7 +110,7 @@ In Windows ICD, when you create a provisioning package for Windows Holographic,
|
||||
| **Accounts** | Create a local account. HoloLens currently supports a single user only. Creating multiple local accounts in a provisioning package is not supported. <br><br>**IMPORTANT**<br>If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. If the user account is locked out, you must [perform a full device recovery](https://developer.microsoft.com/windows/holographic/reset_or_recover_your_hololens#perform_a_full_device_recovery). |
|
||||
| **Certificates** | Deploy a certificate to HoloLens. |
|
||||
| **ConnectivityProfiles** | Deploy a Wi-Fi profile to HoloLens. |
|
||||
| **EditionUpgrade** | [Upgrade to Windows Holographic Enterprise.](hololens-upgrade-enterprise.md) |
|
||||
| **EditionUpgrade** | [Upgrade to Windows Holographic for Business.](hololens-upgrade-enterprise.md) |
|
||||
| **Policies** | Allow or prevent developer mode on HoloLens. |
|
||||
|
||||
>[!NOTE]
|
||||
|
||||
@ -6,6 +6,7 @@ ms.mktglfcycl: manage
|
||||
ms.pagetype: hololens, devices
|
||||
ms.sitesec: library
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Microsoft HoloLens in the enterprise: requirements
|
||||
@ -35,7 +36,7 @@ When you develop for HoloLens, there are [system requirements and tools](https:/
|
||||
- Wi-Fi network
|
||||
- Intune or a 3rd party mobile device management (MDM) provider that uses Microsoft MDM APIs
|
||||
|
||||
## Upgrade to Windows Holographic Enterprise
|
||||
## Upgrade to Windows Holographic for Business
|
||||
- HoloLens Enterprise license XML file
|
||||
|
||||
|
||||
|
||||
@ -6,6 +6,7 @@ ms.mktglfcycl: manage
|
||||
ms.pagetype: hololens, devices
|
||||
ms.sitesec: library
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Set up HoloLens
|
||||
|
||||
@ -1,21 +1,22 @@
|
||||
---
|
||||
title: Upgrade to Windows Holographic Enterprise (HoloLens)
|
||||
description: HoloLens provides extra features designed for business when you upgrade to Windows Holographic Enterprise.
|
||||
title: Unlock Windows Holographic for Business features (HoloLens)
|
||||
description: HoloLens provides extra features designed for business when you upgrade to Windows Holographic for Business.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.pagetype: hololens, devices
|
||||
ms.sitesec: library
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Upgrade to Windows Holographic Enterprise
|
||||
# Unlock Windows Holographic for Business features
|
||||
|
||||
Microsoft HoloLens is available in the *Development Edition*, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the [Commercial Suite](https://developer.microsoft.com/windows/holographic/release_notes#introducing_microsoft_hololens_commercial_suite), which provides extra features designed for business.
|
||||
|
||||
When you purchase the Commercial Suite, you receive a license that upgrades Windows Holographic to Windows Holographic Enterprise. This license can be applied to the device either through the organization's [mobile device management (MDM) provider](#edition-upgrade-using-mdm) or a [provisioning package](#edition-upgrade-using-a-provisioning-package).
|
||||
When you purchase the Commercial Suite, you receive a license that upgrades Windows Holographic to Windows Holographic for Business. This license can be applied to the device either through the organization's [mobile device management (MDM) provider](#edition-upgrade-using-mdm) or a [provisioning package](#edition-upgrade-using-a-provisioning-package).
|
||||
|
||||
>[!TIP]
|
||||
>You can tell that the HoloLens has been upgraded to the Enterprise edition in **Settings** > **Network & Internet**. The **VPN** option is only available in Windows Holographic Enterprise.
|
||||
>You can tell that the HoloLens has been upgraded to the business edition in **Settings** > **Network & Internet**. The **VPN** option is only available in Windows Holographic for Business.
|
||||
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 47 KiB |
@ -6,13 +6,14 @@ ms.mktglfcycl: manage
|
||||
ms.pagetype: hololens, devices
|
||||
ms.sitesec: library
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Microsoft HoloLens
|
||||
|
||||
|
||||
<table><tbody>
|
||||
<tr><td style="border: 0px;width: 75%;valign= top"><p>Microsoft HoloLens is the first fully self-contained holographic computer running Windows 10.</p><p> Microsoft HoloLens is available in the **Development Edition**, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the **Commercial Suite**, which runs Windows Holographic Enterprise when you apply the Enterprise license file to the device.</p></td><td align="left" style="border: 0px"></td></tr>
|
||||
<tr><td style="border: 0px;width: 75%;valign= top"><p>Microsoft HoloLens is the first fully self-contained holographic computer running Windows 10.</p><p> Microsoft HoloLens is available in the **Development Edition**, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the **Commercial Suite**, which runs Windows Holographic for Business when you apply the Enterprise license file to the device.</p></td><td align="left" style="border: 0px"></td></tr>
|
||||
</tbody></table>
|
||||
|
||||
## In this section
|
||||
@ -21,7 +22,7 @@ author: jdeckerMS
|
||||
| --- | --- |
|
||||
| [HoloLens in the enterprise: requirements](hololens-requirements.md) | Lists requirements for general use, Wi-Fi, and device management |
|
||||
| [Set up HoloLens](hololens-setup.md) | How to set up HoloLens for the first time |
|
||||
| [Upgrade to Windows Holographic Enterprise](hololens-upgrade-enterprise.md) | How to upgrade your Development Edition HoloLens to Windows Holographic Enterprise|
|
||||
| [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) | How to upgrade your Development Edition HoloLens to Windows Holographic for Business|
|
||||
| [Enroll HoloLens in MDM](hololens-enroll-mdm.md) | Manage multiple HoloLens devices simultaneously using solutions like Microsoft InTune |
|
||||
| [Set up HoloLens in kiosk mode](hololens-kiosk.md) | Enable kiosk mode for HoloLens, which limits the user's ability to launch new apps or change the running app |
|
||||
| [Configure HoloLens using a provisioning package](hololens-provisioning.md) | Provisioning packages make it easy for IT administrators to configure HoloLens devices without imaging |
|
||||
|
||||
@ -5,7 +5,8 @@
|
||||
#### [Physically install Microsoft Surface Hub](physically-install-your-surface-hub-device.md)
|
||||
#### [Create and test a device account](create-and-test-a-device-account-surface-hub.md)
|
||||
##### [Online deployment](online-deployment-surface-hub-device-accounts.md)
|
||||
##### [On-premises deployment](on-premises-deployment-surface-hub-device-accounts.md)
|
||||
##### [On-premises deployment (single forest)](on-premises-deployment-surface-hub-device-accounts.md)
|
||||
##### [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md)
|
||||
##### [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md)
|
||||
##### [Create a device account using UI](create-a-device-account-using-office-365.md)
|
||||
##### [Microsoft Exchange properties](exchange-properties-for-surface-hub-device-accounts.md)
|
||||
@ -36,4 +37,5 @@
|
||||
### [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md)
|
||||
### [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)
|
||||
## [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md)
|
||||
## [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md)
|
||||
## [Change history for Surface Hub](change-history-surface-hub.md)
|
||||
@ -30,7 +30,7 @@ The full list of accessibility settings are available to IT admins in the **Sett
|
||||
| Mouse | Defaults selected for **Pointer size**, **Pointer color** and **Mouse keys**. |
|
||||
| Other options | Defaults selected for **Visual options** and **Touch feedback**. |
|
||||
|
||||
Additionally, these accessibility features and apps are returned to default settings when users press [**I'm Done**](i-am-done-finishing-your-surface-hub-meeting.md):
|
||||
Additionally, these accessibility features and apps are returned to default settings when users press [I'm Done](i-am-done-finishing-your-surface-hub-meeting.md):
|
||||
- Narrator
|
||||
- Magnifier
|
||||
- High contrast
|
||||
|
||||
@ -74,7 +74,7 @@ If your organization is using AD or Azure AD, we recommend you either domain joi
|
||||
|---------------------------------------------------|-----------------------------------------|-------|
|
||||
| Create a local admin account | None | The user name and password specified during first run |
|
||||
| Domain join to Active Directory (AD) | Your organization uses AD | Any AD user from a specific security group in your domain |
|
||||
| Azure Active Directory (Azure AD) join the device | Your organization uses Azure AD Basic | Global administators only |
|
||||
| Azure Active Directory (Azure AD) join the device | Your organization uses Azure AD Basic | Global administrators only |
|
||||
| | Your organization uses Azure AD Premium or Enterprise Mobility Suite (EMS) | Global administrators and additional administrators |
|
||||
|
||||
|
||||
|
||||
@ -1620,7 +1620,7 @@ In the following cmdlets, `$strPolicy` is the name of the ActiveSync policy, and
|
||||
|
||||
Note that in order to run the cmdlets, you need to set up a remote PowerShell session and:
|
||||
|
||||
- Your admin account must be remote-PowerShell-enabled. This allows the admin to use the PowerShell cmdlets that are needed by the script. (This permission can be set using set-user `$admin -RemotePowerShellEnabled $true`)
|
||||
- Your admin account must be remote-PowerShell-enabled. This allows the admin to use the PowerShell cmdlets that are needed by the script. (This permission can be set using `set-user $admin -RemotePowerShellEnabled $true`)
|
||||
- Your admin account must have the "Reset Password" role if you plan to run the creation scripts. This allows the admin to change the password of the account, which is needed for the script. The Reset Password Role can be enabled using the Exchange Admin Center.
|
||||
|
||||
Create the policy.
|
||||
@ -1667,7 +1667,7 @@ This retrieves device information for every device that the account has been pro
|
||||
For a device account to automatically accept or decline meeting requests based on its availability, the **AutomateProcessing** attribute must be set to **AutoAccept**. This is recommended as to prevent overlapping meetings.
|
||||
|
||||
```PowerShell
|
||||
Set-CalendarProcessing $ strRoomUpn -AutomateProcessing AutoAccept
|
||||
Set-CalendarProcessing $strRoomUpn -AutomateProcessing AutoAccept
|
||||
```
|
||||
|
||||
### <a href="" id="accept-ext-meetings-cmdlet"></a>Accepting external meeting requests
|
||||
|
||||
@ -14,10 +14,20 @@ localizationpriority: medium
|
||||
|
||||
This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
|
||||
|
||||
## January 2017
|
||||
|
||||
| New or changed topic | Description |
|
||||
| --- | --- |
|
||||
| [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) | New |
|
||||
| [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) | New |
|
||||
| [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added graphics cards verified to work with 84" Surface Hubs and added information about the lengths of cables. |
|
||||
| [Online deployment](online-deployment-surface-hub-device-accounts.md) | Updated procedures for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment. |
|
||||
|
||||
## December 2016
|
||||
|
||||
| New or changed topic | Description|
|
||||
| --- | --- |
|
||||
| [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added information about Bluetooth accessories. |
|
||||
| [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) | Updated example procedures to include screenshots. |
|
||||
|
||||
## November 2016
|
||||
|
||||
@ -13,7 +13,7 @@ localizationpriority: medium
|
||||
# Connect other devices and display with Surface Hub
|
||||
|
||||
|
||||
You can connect other devices to your Microsoft Surface Hub to display content. This topic describes the Guest Mode, Replacement PC Mode, and Video Out functionality available through wired connections.
|
||||
You can connect other devices to your Microsoft Surface Hub to display content. This topic describes the Guest Mode, Replacement PC Mode, and Video Out functionality available through wired connections, and also lists accessories that you can connect to Surface Hub using [Bluetooth](#bluetooth-accessories).
|
||||
|
||||
## Which method should I choose?
|
||||
|
||||
@ -251,7 +251,7 @@ In Replacement PC Mode, Surface Hub supports any graphics adapter that can produ
|
||||
|
||||
**55" Surface Hubs** - For best experience, use a graphics card capable of 1080p resolution at 120Hz.
|
||||
|
||||
**84" Surface Hubs** - For best experience, use a graphics card capable of outputting four DisplayPort 1.2 streams to produce 2160p at 120Hz (3840 x 2160 at 120Hz vertical refresh). We've verified that this works with the NVIDIA Quadro K2200, NVIDIA Quadro K4200, and NVIDIA Quadro M6000. These are not the only graphics cards - others are available from other vendors.
|
||||
**84" Surface Hubs** - For best experience, use a graphics card capable of outputting four DisplayPort 1.2 streams to produce 2160p at 120Hz (3840 x 2160 at 120Hz vertical refresh). We've verified that this works with the NVIDIA Quadro K2200, NVIDIA Quadro K4200, NVIDIA Quadro M6000, AMD FirePro W5100, AMD FirePro W7100, and AMD FirePro W9100. These are not the only graphics cards - others are available from other vendors.
|
||||
|
||||
Check directly with graphics card vendors for the latest drivers.
|
||||
|
||||
@ -273,7 +273,7 @@ Check directly with graphics card vendors for the latest drivers.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>AMD</p></td>
|
||||
<td><p>[http://support.amd.com/download](http://support.amd.com/download)</p></td>
|
||||
<td><p>[http://support.amd.com/en-us/download](http://support.amd.com/en-us/download)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Intel</p></td>
|
||||
@ -470,3 +470,19 @@ Video Out port on the 84" Surface Hub
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## Cables
|
||||
|
||||
Both the 55” and 84” Surface Hub devices have been tested to work with Certified DisplayPort and HDMI cables. While vendors do sell longer cables that may work with the Surface Hub, only those cables that have been certified by testing labs are certain to work with the Hub. For example, DisplayPort cables are certified only up to 3 meters, however many vendors sell cables that are 3 times that length. If a long cable is necessary, we strongly suggest using HDMI. HDMI has many cost-effective solutions for long-haul cables, including the use of repeaters. Nearly every DisplayPort source will automatically switch to HDMI signaling if a HDMI sink is detected.
|
||||
|
||||
|
||||
## Bluetooth accessories
|
||||
|
||||
You can connect the following accessories to Surface Hub using Bluetooth:
|
||||
|
||||
- Mice
|
||||
- Keyboards
|
||||
- Headsets
|
||||
- Speakers
|
||||
|
||||
>[!NOTE]
|
||||
>After you connect a Bluetooth headset or speaker, you might need to change the [default microphone and speaker settings](local-management-surface-hub-settings.md).
|
||||
@ -46,7 +46,8 @@ For detailed steps using PowerShell to provision a device account, choose an opt
|
||||
| Organization deployment | Description |
|
||||
|---------------------------------|--------------------------------------|
|
||||
| [Online deployment (Office 365)](online-deployment-surface-hub-device-accounts.md) | Your organization's environment is deployed entirely on Office 365. |
|
||||
| [On-premises deployment](on-premises-deployment-surface-hub-device-accounts.md) | Your organization has servers that it controls and uses to host Active Directory, Exchange, and Skype for Business (or Lync). |
|
||||
| [On-premises deployment (single-forest)](on-premises-deployment-surface-hub-device-accounts.md) | Your organization has servers that it controls and uses to host Active Directory, Exchange, and Skype for Business (or Lync) in a single-forest environment. |
|
||||
| [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) | Your organization has servers that it controls and uses to host Active Directory, Exchange, and Skype for Business (or Lync) in a multi-forest environment. |
|
||||
| [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Your organization has a mix of services, with some hosted on-premises and some hosted online through Office 365. |
|
||||
|
||||
If you prefer to use a graphical user interface, some steps can be done using UI instead of PowerShell.
|
||||
|
||||
@ -53,7 +53,7 @@ Use this procedure if you use Exchange on-prem.
|
||||
```ps1
|
||||
Set-ExecutionPolicy Unrestricted
|
||||
$cred=Get-Credential -Message "Please use your Office 365 admin credentials"
|
||||
$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://outlook.office365.com/ps1-liveid/' -Credential $cred -Authentication Basic -AllowRedirection
|
||||
$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://ps.outlook.com/powershell' -Credential $cred -Authentication Basic -AllowRedirection
|
||||
Import-PSSession $sess
|
||||
```
|
||||
|
||||
|
||||
@ -13,7 +13,9 @@ localizationpriority: medium
|
||||
# Microsoft Surface Hub
|
||||
|
||||
|
||||
Documents related to the Microsoft Surface Hub.
|
||||
Documents related to deploying and managing the Microsoft Surface Hub in your organization.
|
||||
|
||||
>[Looking for the user's guide for Surface Hub?](https://www.microsoft.com/surface/support/surface-hub)
|
||||
|
||||
## In this section
|
||||
|
||||
@ -34,7 +36,8 @@ Documents related to the Microsoft Surface Hub.
|
||||
<td align="left"><p>[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)</p></td>
|
||||
<td align="left"><p>This guide covers the installation and administration of devices running Surface Hub, and is intended for use by anyone responsible for these tasks, including IT administrators and developers.</p></td>
|
||||
</tr>
|
||||
<tr><td>[Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md)</td><td>This topic explains the differences between the operating system on Surface Hub and Windows 10 Enterprise.</td></tr><tr>
|
||||
<td>[Change history for Surface Hub](change-history-surface-hub.md)</td><td>This topic lists new and updated topis in the Surface Hub documentation.</td></tr>
|
||||
<tr><td>[Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md)</td><td>This topic explains the differences between the operating system on Surface Hub and Windows 10 Enterprise.</td></tr>
|
||||
<tr><td>[How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md)</td><td>This topic provides guidance on Wi-Fi Direct security risks, how the Surface Hub has addressed those risks, and how Surface Hub administrators can configure the device for the highest level of security. </td></tr>
|
||||
<tr><td>[Change history for Surface Hub](change-history-surface-hub.md)</td><td>This topic lists new and updated topis in the Surface Hub documentation.</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
@ -94,7 +94,7 @@ Once you've determined deployment rings for your Surface Hubs, configure update
|
||||
|
||||
## Use Windows Server Update Services
|
||||
|
||||
You can connect Surface Hub to your indows Server Update Services (WSUS) server to manage updates. Updates will be controlled through approvals or automatic deployment rules configured in your WSUS server, so new upgrades will not be deployed until you choose to deploy them.
|
||||
You can connect Surface Hub to your Windows Server Update Services (WSUS) server to manage updates. Updates will be controlled through approvals or automatic deployment rules configured in your WSUS server, so new upgrades will not be deployed until you choose to deploy them.
|
||||
|
||||
**To manually connect a Surface Hub to a WSUS server:**
|
||||
1. Open **Settings** on your Surface Hub.
|
||||
|
||||
@ -101,6 +101,9 @@ This table describes the sample queries in the Surface Hub solution:
|
||||
|
||||
For Surface Hub to connect to and register with the OMS service, it must have access to the port number of your domains and the URLs. This table list the ports that OMS needs. For more information, see [Configure proxy and firewall settings in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-proxy-firewall/).
|
||||
|
||||
>[!NOTE]
|
||||
>Surface Hub does not currently support the use of a proxy server to communicate with the OMS service.
|
||||
|
||||
| Agent resource | Ports | Bypass HTTPS inspection? |
|
||||
| --------------------------- | ----- | ------------------------ |
|
||||
| *.ods.opinsights.azure.com | 443 | Yes |
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: On-premises deployment (Surface Hub)
|
||||
title: On-premises deployment single forest (Surface Hub)
|
||||
description: This topic explains how you add a device account for your Microsoft Surface Hub when you have a single-forest, on-premises deployment.
|
||||
ms.assetid: 80E12195-A65B-42D1-8B84-ECC3FCBAAFC6
|
||||
keywords: single forest deployment, on prem deployment, device account, Surface Hub
|
||||
@ -11,12 +11,12 @@ author: TrudyHa
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# On-premises deployment (Surface Hub)
|
||||
# On-premises deployment for Surface Hub in a single-forest environment
|
||||
|
||||
|
||||
This topic explains how you add a device account for your Microsoft Surface Hub when you have a single-forest, on-premises deployment.
|
||||
|
||||
If you have a single-forest on-premises deployment with Microsoft Exchange 2013 or later and Skype for Business 2013 or later, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-on-premise-ps-scripts) to create device accounts. If you’re using a multi-forest deployment, you can use equivalent cmdlets that will produce the same results. Those cmdlets are described in this section.
|
||||
If you have a single-forest on-premises deployment with Microsoft Exchange 2013 or later and Skype for Business 2013 or later, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-on-premise-ps-scripts) to create device accounts. If you’re using a multi-forest deployment, see [On-premises deployment for Surface Hub in a multi-forest environment](on-premises-deployment-surface-hub-multi-forest.md).
|
||||
|
||||
1. Start a remote PowerShell session from a PC and connect to Exchange.
|
||||
|
||||
@ -99,7 +99,7 @@ If you have a single-forest on-premises deployment with Microsoft Exchange 2013
|
||||
8. OPTIONAL: You can also allow your Surface Hub to make and receive public switched telephone network (PSTN) phone calls by enabling Enterprise Voice for your account. Enterprise Voice isn't a requirement for Surface Hub, but if you want PSTN dialing functionality for the Surface Hub client, here's how to enable it:
|
||||
|
||||
```PowerShell
|
||||
CsMeetingRoom HUB01 -DomainController DC-ND-001.contoso.com
|
||||
Set-CsMeetingRoom HUB01 -DomainController DC-ND-001.contoso.com
|
||||
-LineURItel: +14255550555;ext=50555" Set-CsMeetingRoom -DomainController DC-ND-001.contoso.com
|
||||
-Identity HUB01 -EnterpriseVoiceEnabled $true
|
||||
```
|
||||
|
||||
@ -0,0 +1,105 @@
|
||||
---
|
||||
title: On-premises deployment multi-forest (Surface Hub)
|
||||
description: This topic explains how you add a device account for your Microsoft Surface Hub when you have a multi-forest, on-premises deployment.
|
||||
ms.assetid: 80E12195-A65B-42D1-8B84-ECC3FCBAAFC6
|
||||
keywords: multi forest deployment, on prem deployment, device account, Surface Hub
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: surfacehub
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# On-premises deployment for Surface Hub in a multi-forest environment
|
||||
|
||||
|
||||
This topic explains how you add a device account for your Microsoft Surface Hub when you have a multi-forest, on-premises deployment.
|
||||
|
||||
If you have a multi-forest on-premises deployment with Microsoft Exchange 2013 or later and Skype for Business 2013 or later, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-on-premise-ps-scripts) to create device accounts. If you’re using a single-forest deployment, see [On-premises deployment for Surface Hub in a single-forest environment](on-premises-deployment-surface-hub-device-accounts.md).
|
||||
|
||||
1. Start a remote PowerShell session from a PC and connect to Exchange.
|
||||
|
||||
Be sure you have the right permissions set to run the associated cmdlets.
|
||||
|
||||
Note here that `$strExchangeServer` is the fully qualified domain name (FQDN) of your Exchange server, and `$strLyncFQDN` is the FQDN of your Skype for Business server.
|
||||
|
||||
```PowerShell
|
||||
Set-ExecutionPolicy Unrestricted
|
||||
$org='contoso.microsoft.com'
|
||||
$cred=Get-Credential $admin@$org
|
||||
$sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $cred -AllowRedirection -Authentication Kerberos -ConnectionUri "http://$strExchangeServer/powershell" -WarningAction SilentlyContinue
|
||||
$sessLync = New-PSSession -Credential $cred -ConnectionURI "https://$strLyncFQDN/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue
|
||||
Import-PSSession $sessExchange
|
||||
Import-PSSession $sessLync
|
||||
```
|
||||
|
||||
2. After establishing a session, create a new mailbox in the Resource Forest. This will allow the account to authenticate into the Surface Hub.
|
||||
|
||||
If you're changing an existing resource mailbox:
|
||||
|
||||
```PowerShell
|
||||
New-Mailbox -UserPrincipalName HUB01@contoso.com -Alias HUB01 -Name "Hub-01"
|
||||
```
|
||||
|
||||
3. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
|
||||
|
||||
Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to **False**. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
|
||||
|
||||
If you haven’t created a compatible policy yet, use the following cmdlet-—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
|
||||
|
||||
```PowerShell
|
||||
$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
|
||||
```
|
||||
|
||||
Once you have a compatible policy, then you will need to apply the policy to the device account.
|
||||
|
||||
```PowerShell
|
||||
Set-CASMailbox $acctUpn -ActiveSyncMailboxPolicy $easPolicy -ActiveSyncEnabled $true
|
||||
Set-Mailbox $acctUpn -Type Room
|
||||
```
|
||||
|
||||
4. Various Exchange properties can be set on the device account to improve the meeting experience for people. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
|
||||
|
||||
```PowerShell
|
||||
Set-CalendarProcessing -Identity $acctUpn -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
|
||||
Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
|
||||
```
|
||||
|
||||
5. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. This should be set in the User Forest.
|
||||
|
||||
```PowerShell
|
||||
Set-AdUser $acctUpn -PasswordNeverExpires $true
|
||||
```
|
||||
|
||||
6. Enable the account in Active Directory so it will authenticate to the Surface Hub. This should be set in the User Forest.
|
||||
|
||||
```PowerShell
|
||||
Set-AdUser $acctUpn -Enabled $true
|
||||
```
|
||||
|
||||
6. You now need to change the room mailbox to a linked mailbox:
|
||||
|
||||
```PowerShell
|
||||
$cred=Get-Credential AuthForest\LinkedRoomTest1
|
||||
Set-mailbox -Alias LinkedRoomTest1 -LinkedMasterAccount AuthForest\LinkedRoomTest1 -LinkedDomainController AuthForest-4939.AuthForest.extest.contoso.com -Name LinkedRoomTest1 -LinkedCredential $cred -Identity LinkedRoomTest1
|
||||
```
|
||||
|
||||
7. Enable the device account with Skype for Business by enabling your Surface Hub AD account on a Skype for Business Server pool:
|
||||
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -SipAddress "sip:HUB01@contoso.com"
|
||||
-DomainController DC-ND-001.contoso.com -RegistrarPool LYNCPool15.contoso.com
|
||||
-Identity HUB01
|
||||
```
|
||||
|
||||
You'll need to use the Session Initiation Protocol (SIP) address and domain controller for the Surface Hub, along with your own Skype for Business Server pool identifier and user identity.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -54,13 +54,10 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
$easPolicy = New-MobileDeviceMailboxPolicy -Name "SurfaceHubs" -PasswordEnabled $false -AllowNonProvisionableDevices $True
|
||||
```
|
||||
|
||||
Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too.
|
||||
Once you have a compatible policy, then you will need to apply the policy to the device account.
|
||||
|
||||
```PowerShell
|
||||
Set-Mailbox 'HUB01@contoso.com' -Type Regular
|
||||
Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.Id
|
||||
Set-Mailbox 'HUB01@contoso.com' -Type Room
|
||||
Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword (ConvertTo-SecureString -String <password> -AsPlainText -Force) -EnableRoomMailboxAccount $true
|
||||
```
|
||||
|
||||
4. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
|
||||
@ -84,7 +81,10 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
Set-MsolUser -UserPrincipalName 'HUB01@contoso.com' -PasswordNeverExpires $true
|
||||
```
|
||||
|
||||
7. The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
|
||||
7. Surface Hub requires a license for Skype for Business functionality.
|
||||
- Your Surface Hub account requires a Lync Online (Plan 2) or Lync Online (Plan 3) license, but it does not require an Exchange Online license.
|
||||
- You'll need to have Lync Online (Plan 2) or higher in your O365 plan. The plan needs to support conferencing capability.
|
||||
- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Lync Online (Plan 3).
|
||||
|
||||
Next, you can use `Get-MsolAccountSku` to retrieve a list of available SKUs for your O365 tenant.
|
||||
|
||||
@ -98,15 +98,6 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
|
||||
8. Enable the device account with Skype for Business.
|
||||
|
||||
In order to enable Skype for Business, your environment will need to meet the following prerequisites:
|
||||
|
||||
- You'll need to have Lync Online (Plan 2) or higher in your O365 plan. The plan needs to support conferencing capability.
|
||||
- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Lync Online (Plan 3).
|
||||
- Your tenant users must have Exchange mailboxes.
|
||||
- Your Surface Hub account does require a Lync Online (Plan 2) or Lync Online (Plan 3) license, but it does not require an Exchange Online license.
|
||||
|
||||
<!-- -->
|
||||
|
||||
- Start by creating a remote PowerShell session from a PC.
|
||||
|
||||
```PowerShell
|
||||
@ -115,33 +106,30 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
Import-PSSession $cssess -AllowClobber
|
||||
```
|
||||
|
||||
- To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
|
||||
- Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, *alice@contoso.com*):
|
||||
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool
|
||||
"sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
|
||||
Get-CsOnlineUser -Identity ‘alice@contoso.com’| fl *registrarpool*
|
||||
```
|
||||
|
||||
If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
|
||||
|
||||
OR by setting a variable
|
||||
|
||||
```PowerShell
|
||||
Get-CsOnlineUser -Identity 'alice@contoso.com'| fl *registrarpool*
|
||||
$strRegistrarPool = (Get-CsOnlineUser -Identity ‘alice@contoso.com’).RegistrarPool
|
||||
```
|
||||
|
||||
- Enable the Surface Hub account with the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool yourRegistrarPool -SipAddressType EmailAddress
|
||||
```
|
||||
|
||||
OR using the $strRegistarPool variable from above
|
||||
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool $strRegistrarPool -SipAddressType EmailAddress
|
||||
```
|
||||
|
||||
9. Assign Skype for Business license to your Surface Hub account.
|
||||
|
||||
Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) to the device.
|
||||
|
||||
- Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app.
|
||||
- Click on **Users and Groups** and then **Add users, reset passwords, and more**.
|
||||
- Select the Surface Hub account, and then click or tap the pen icon, which means edit.
|
||||
- Click on the **Licenses** option.
|
||||
- In the **Assign licenses** section, you need to select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and what you've decided in terms of needing Enterprise Voice. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub.
|
||||
- Click **Save** and you're done.
|
||||
|
||||
>**Note**: It's also possible to use the Windows Azure Active Directory Module for Windows PowerShell to run the cmdlets needed to assign one of these licenses, but that's not covered here.
|
||||
|
||||
For validation, you should be able to use any Skype for Business client (PC, Android, etc) to log in to this account.
|
||||
For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ There are several ways to manage your BitLocker key on the Surface Hub.
|
||||
|
||||
2. If you’ve joined the Surface Hub to Azure Active Directory (Azure AD), the BitLocker key will be stored under the account that was used to join the device.
|
||||
|
||||
3. If you’re using a local admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive.
|
||||
3. If you’re using an admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
121
devices/surface-hub/surface-hub-wifi-direct.md
Normal file
121
devices/surface-hub/surface-hub-wifi-direct.md
Normal file
@ -0,0 +1,121 @@
|
||||
---
|
||||
title: How Surface Hub addresses Wi-Fi Direct security issues
|
||||
description: This topic provides guidance on Wi-Fi Direct security risks.
|
||||
keywords: change history
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: surfacehub
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# How Surface Hub addresses Wi-Fi Direct security issues
|
||||
|
||||
Microsoft Surface Hub is an all-in-one productivity device that enables teams to better brainstorm, collaborate, and share ideas. Surface Hub relies on Miracast for wireless projection by using Wi-Fi Direct.
|
||||
|
||||
This topic provides guidance on Wi-Fi Direct security vulnerabilities, how Surface Hub has addressed those risks, and how Surface Hub administrators can configure the device for the highest level of security. This hardening information will help customers with high security requirements understand how best to protect their Surface Hub connected networks and data in transit.
|
||||
|
||||
The intended audiences for this topic include IT and network administrators interested in deploying Microsoft Surface Hub in their corporate environment with optimal security settings.
|
||||
|
||||
## Overview
|
||||
|
||||
Microsoft Surface Hub's security depends extensively on Wi-Fi Direct / Miracast and the associated 802.11, Wi-Fi Protected Access (WPA2), and Wireless Protected Setup (WPS) standards. Since the device only supports WPS (as opposed to WPA2 Pre-Shared Key (PSK) or WPA2 Enterprise), issues traditionally associated with 802.11 encryption are simplified by design.
|
||||
|
||||
It is important to note Surface Hub operates on par with the field of Miracast receivers, meaning that it is protected from, and vulnerable to, a similar set of exploits as all WPS-based wireless network devices. But Surface Hub’s implementation of WPS has extra precautions built in, and its internal architecture helps prevent an attacker – even after compromising the Wi-Fi Direct / Miracast layer – to move past the network interface onto other attack surfaces and connected enterprise networks see [Wi-Fi Direct vulnerabilities and how Surface Hub addresses them](#vulnerabilities).
|
||||
|
||||
## Wi-Fi Direct background
|
||||
|
||||
Miracast is part of the Wi-Fi Display standard, which itself is supported by the Wi-Fi Direct protocol. These standards are supported in modern mobile devices for screen sharing and collaboration.
|
||||
|
||||
Wi-Fi Direct or Wi-Fi "Peer to Peer" (P2P) is a standard released by the Wi-Fi Alliance for "Ad-Hoc" networks. This allows supported devices to communicate directly and create groups of networks without requiring a traditional Wi-Fi Access Point or an Internet connection.
|
||||
|
||||
Security for Wi-Fi Direct is provided by WPA2 using the WPS standard. Authentication mechanism for devices can be a numerical pin (WPS-PIN), a physical or virtual Push Button (WPS-PBC), or an out-of-band message such as Near Field Communication (WPS-OOO). The Microsoft Surface Hub supports both Push Button (which is the default) and PIN methods.
|
||||
|
||||
In Wi-Fi Direct, groups are created as either "persistent," allowing for automatic reconnection using stored key material, or "temporary," where devices cannot re-authenticate without user intervention or action. Wi-Fi Direct groups will typically determine a Group Owner (GO) through a negotiation protocol, which mimics the "station" or "Access Point" functionality for the established Wi-Fi Direct Group. This Wi-Fi Direct GO provides authentication (via an “Internal Registrar”), and facilitate upstream network connections. For Surface Hub, this GO negotiation does not take place, as the network only operates in "autonomous" mode, where Surface Hub is always the Group Owner. Finally, Surface Hub does not and will not join other Wi-Fi Direct networks itself as a client.
|
||||
|
||||
<span id="vulnerabilities" />
|
||||
## Wi-Fi Direct vulnerabilities and how Surface Hub addresses them
|
||||
|
||||
**Vulnerabilities and attacks in the Wi-Fi Direct invitation, broadcast, and discovery process**: Wi-Fi Direct / Miracast attacks may target weaknesses in the group establishment, peer discovery, device broadcast, or invitation processes.
|
||||
|
||||
|Wi-Fi Direct Vulnerability | Surface Hub Mitigation |
|
||||
| --- | --- |
|
||||
| The discovery process may remain active for an extended period of time, which could allow Invitations and connections to be established without the intent of the device owner. | Surface Hub only operates as the Group Owner (GO), which does not perform the client Discovery or GO negotiation process. Broadcast can be turned off by fully disabling wireless projection. |
|
||||
| Invitation and discovery using PBC allows an unauthenticated attacker to perform repeated connection attempts or unauthenticated connections are automatically accepted. | By requiring WPS PIN security, Administrators can reduce the potential for such unauthorized connections or "Invitation bombs" (where invitations are repeatedly sent until a user mistakenly accepts one). |
|
||||
|
||||
**Wi-Fi Protected Setup (WPS) Push Button Connect (PBC) vs PIN Entry**: Public weaknesses have been demonstrated in WPS-PIN method design and implementation, other vulnerabilities exist within WPS-PBC involving active attacks against a protocol designed for one time use.
|
||||
|
||||
| Wi-Fi Direct Vulnerability | Surface Hub Mitigation |
|
||||
| --- | --- |
|
||||
| WPS-PBC is vulnerable to active attackers. As stated within the WPS specification: "The PBC method has zero bits of entropy and only protects against passive eavesdropping attacks. PBC protects against eavesdropping attacks and takes measures to prevent a device from joining a network that was not selected by the device owner. The absence of authentication, however, means that PBC does not protect against active attack". Attackers can use selective wireless jamming or other potential denial-of-service vulnerabilities in order to trigger an unintended Wi-Fi Direct GO or connection. Additionally, an active attacker, with only physical proximity, can repeatedly teardown any Wi-Fi Direct group and attempt the described attack until it is successful. |Enable WPS-PIN security within Surface Hub’s configuration. As discussed within the Wi-Fi WPS specification: "The PBC method should only be used if no PIN-capable Registrar is available and the WLAN user is willing to accept the risks associated with PBC". |
|
||||
| WPS-PIN implementations can be brute-forced using a Vulnerability within the WPS standard. Due to the design of split PIN verification, a number of implementation vulnerabilities occurred in the past several years across a wide range of Wi-Fi hardware manufacturers. In 2011 two researchers (Stefan Viehböck and Craig Heffner) released information on this vulnerability and tools such as "Reaver" as a proof of concept. | The Microsoft implementation of WPS within Surface Hub changes the pin every 30 seconds. In order to crack the pin, an attacker must work through the entire exploit in less than 30 seconds. Given the current state of tools and research in this area, a brute-force pin-cracking attack through WPS is unlikely. |
|
||||
| WPS-PIN can be cracked using an offline attack due to weak initial key (E-S1,E S2) entropy. In 2014, Dominique Bongard discussed a "Pixie Dust" attack where poor initial randomness for the pseudo random number generator (PRNG) within the wireless device lead to the ability to perform an offline brute-force attack. | The Microsoft implementation of WPS within Surface Hub is not susceptible to this offline PIN brute-force attack. The WPS-PIN is randomized for each connection. |
|
||||
|
||||
**Unintended exposure of network services**: Network daemons intended for Ethernet or WLAN services may be accidentally exposed due to misconfiguration (such as binding to “all”/0.0.0.0 interfaces), a poorly configured device firewall, or missing firewall rules altogether.
|
||||
|
||||
| Wi-Fi Direct Vulnerability | Surface Hub Mitigation |
|
||||
| --- | --- |
|
||||
| Misconfiguration binds a vulnerable or unauthenticated network service to "all" interfaces, which includes the Wi-Fi Direct interface. This potentially exposes services not intended to be accessible to Wi-Fi Direct clients, which may be weakly or automatically authenticated. | Within Surface Hub, the default firewall rules only permit the required TCP and UDP network ports and by default deny all inbound connections. Strong authentication can be configured by enabling the WPS-PIN mode. |
|
||||
|
||||
**Bridging Wi-Fi Direct and other wired or wireless networks**: While network bridging between WLAN or Ethernet networks is a violation of the Wi-Fi Direct specification, such a bridge or misconfiguration may effectively lower or remove wireless access controls for the internal corporate network.
|
||||
|
||||
| Wi-Fi Direct Vulnerability | Surface Hub Mitigation |
|
||||
| --- | --- |
|
||||
| Wi-Fi Direct devices could allow unauthenticated or poorly authenticated access to bridged network connections. This may allow Wi-Fi Direct networks to route traffic to internal Ethernet LAN or other infrastructure or enterprise WLAN networks in violation of existing IT security protocols. | Surface Hub cannot be configured to bridge Wireless interfaces or allow routing between disparate networks. The default firewall rules add defense in depth to any such routing or bridge connections. |
|
||||
|
||||
**The use of Wi-Fi Direct “legacy” mode**: Exposure to unintended networks or devices when operating in “legacy” mode may present a risk. Device spoofing or unintended connections could occur if WPS-PIN is not enabled.
|
||||
|
||||
|
||||
| Wi-Fi Direct Vulnerability | Surface Hub Mitigation |
|
||||
| --- | --- |
|
||||
| By supporting both Wi-Fi Direct and 802.11 infrastructure clients, the system is operating in a "legacy" support mode. This may expose the connection setup phase indefinitely, allowing for groups to be joined or devices invited to connect well after their intended setup phase terminates. | Surface Hub does not support Wi-Fi Direct legacy clients. Only Wi-Fi Direct connections can be made to Surface Hub even when WPS-PIN mode is enabled. |
|
||||
|
||||
**Wi-Fi Direct GO negotiation during connection setup**: The Group Owner within Wi-Fi Direct is analogous to the “Access Point” in a traditional 802.11 wireless network. The negotiation can be gamed by a malicious device.
|
||||
|
||||
|Wi-Fi Direct Vulnerability | Surface Hub Mitigation |
|
||||
| --- | --- |
|
||||
| If groups are dynamically established or if the Wi-Fi Direct device can be made to join new groups, the Group Owner (GO) negotiation can be won by a malicious device that always specifies the max Group Owner "intent" value of 15. (Unless such device is configured to always be a Group Owner, in which case the connection fails.) | Surface Hub takes advantage of Wi-Fi Direct "Autonomous mode", which skips the GO negotiation phase of the connection setup. Surface Hub is always the Group Owner. |
|
||||
|
||||
**Unintended or malicious Wi-Fi deauthentication**: Wi-Fi deauthentication is an age-old attack that can be used by a physically local attacker to expedite information leaks against the connection setup process, trigger new four-way handshakes, target Wi-Fi Direct WPS-PBC for active attack, or create denial-of-service attacks.
|
||||
|
||||
| Wi-Fi Direct Vulnerability | Surface Hub Mitigation |
|
||||
| --- | --- |
|
||||
| Deauthentication packets can be sent by an unauthenticated attacker to cause the station to re-authenticate and sniff the resulting handshake. Cryptographic or brute-force attacks can be attempted on the resulting handshake. Mitigations for these attack include: enforcing length and complexity policies for pre-shared keys; configuring the Access Point (if applicable) to detect malicious levels of deauthentication packets; and using WPS to automatically generate strong keys. In PBC mode the user is interacting with a physical or virtual button to allow arbitrary device association. This process should happen only at setup within a small window, once the button is automatically "pushed", the device will accept any station associating via a canonical PIN value (all zeros). Deauthentication can force a repeated setup process. | The current Surface Hub design uses WPS in PIN or PBC mode. No PSK configuration is permitted, helping enforce the generation of strong keys. It is recommended to enable WPS-PIN. |
|
||||
| Beyond denial-of-service attacks, deauthentication packets can also be used to trigger a reconnect which re-opens the window of opportunity for active attacks against WPS-PBC. | Enable WPS-PIN security within Surface Hub’s configuration. |
|
||||
|
||||
**Basic wireless information disclosure**: Wireless networks, 802.11 or otherwise, are inherently sources of information disclosure. Although the information is largely connection or device metadata, it remains an accepted risk for any 802.11 administrator. Wi-Fi Direct with device authentication via WPS-PIN effectively reveals the same information as a PSK or Enterprise 802.11 network.
|
||||
|
||||
| Wi-Fi Direct Vulnerability | Surface Hub Mitigation |
|
||||
| --- | --- |
|
||||
| During broadcast, connection setup, or even with already encrypted connections, basic information about the devices and packet sizes is wirelessly transmitted. At a basic level, a local attacker within wireless range can determine the names of wireless devices, the MAC addresses of communicating equipment, and possibly other details such as the version of the wireless stack, packet sizes, or the configured Access Point or Group Owner options by examining the relevant 802.11 Information Elements. | The Wi-Fi Direct network employed by Surface Hub cannot be further protected from metadata leaks, in the same way 802.11 Enterprise or PSK wireless networks also leak such metadata. Physical security and removing potential threats from the wireless proximity can be used to reduce any potential information leaks. |
|
||||
|
||||
**Wireless evil twin or spoofing attacks**: Spoofing the wireless name is a trivial and known exploit for a physically local attacker in order to lure unsuspecting or mistaken users to connect.
|
||||
|
||||
| Wi-Fi Direct Vulnerability | Surface Hub Mitigation |
|
||||
| --- | --- |
|
||||
| By spoofing or cloning the wireless name or "SSID" of the target network, an attacker may trick the user into connecting to fake malicious network. By supporting unauthenticated, auto-join Miracast an attacker could capture the intended display materials or attempt to perform network attacks on the connecting device. | While no specific protections against joining a spoofed Surface Hub are in place, this attack is partially mitigated in two ways. First, any potential attack must be physically within Wi-Fi range. Second, this attack is only possible during the very first connection. Subsequent connections use a persistent Wi-Fi Direct group and Windows will remember and prioritize this prior connection during future Hub use. (Note: Spoofing the MAC address, Wi-Fi channel and SSID simultaneously was not considered for this report and may result in inconsistent Wi-Fi behavior.) Overall this weakness is a fundamental problem for any 802.11 wireless network not using Enterprise WPA2 protocols such as EAP-TLS or EAP-PWD, which are not supported in Wi-Fi Direct. |
|
||||
|
||||
## Surface Hub hardening guidelines
|
||||
|
||||
Surface Hub is designed to facilitate collaboration and allow users to start or join meetings quickly and efficiently. As such, the default Wi-Fi Direct settings for Surface Hub are optimized for this scenario.
|
||||
|
||||
For users who require additional security around the wireless interface, we recommend Surface Hub users enable the WPS-PIN security setting. This disables WPS-PBC mode and offers client authentication, and provides the strongest level of protection by preventing any unauthorized connections to Surface Hub.
|
||||
|
||||
If concerns remain around authentication and authorization of a Surface Hub, we recommend users connect the device to a separate network, either Wi-Fi (such as a "guest" Wi-Fi network) or using separate Ethernet network (preferably an entirely different physical network, but a VLAN can also provide some added security). Of course, this approach may preclude connections to internal network resources or services, and may require additional network configurations to regain access.
|
||||
|
||||
Also recommended:
|
||||
- [Install regular system updates.](manage-windows-updates-for-surface-hub.md)
|
||||
- Update the Miracast settings to disable auto-present mode.
|
||||
|
||||
## Learn more
|
||||
|
||||
- [Wi-Fi Direct specifications](http://www.wi-fi.org/discover-wi-fi/wi-fi-direct)
|
||||
- [Wireless Protected Setup (WPS) specification](http://www.wi-fi.org/discover-wi-fi/wi-fi-protected-setup)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -184,7 +184,7 @@ In Replacement PC mode, the power states are only Ready and Off and only change
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>5</p></td>
|
||||
<td align="left"><p>50</p></td>
|
||||
<td align="left"><p>S0</p></td>
|
||||
<td align="left"><p>Ready</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
|
||||
@ -13,6 +13,7 @@
|
||||
### [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)
|
||||
### [Manage Surface Dock firmware updates](manage-surface-dock-firmware-updates.md)
|
||||
### [Surface Dock Updater](surface-dock-updater.md)
|
||||
### [Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md)
|
||||
## [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md)
|
||||
## [Deploy Surface app with Windows Store for Business](deploy-surface-app-with-windows-store-for-business.md)
|
||||
## [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md)
|
||||
|
||||
@ -11,6 +11,18 @@ author: jdeckerMS
|
||||
|
||||
This topic lists new and updated topics in the Surface documentation library.
|
||||
|
||||
## January 2017
|
||||
|
||||
|New or changed topic | Description |
|
||||
| --- | --- |
|
||||
|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | New |
|
||||
|
||||
## December 2016
|
||||
|
||||
|New or changed topic | Description |
|
||||
| --- | --- |
|
||||
|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added driver info for Surface Studio; updated info for Surface Book and Surface Pro 4 (Windows 10 .zip cumulative update), Surface Pro 3 (Windows8.1-KB2969817-x64.msu), and Surface 3 (UEFI Asset Tag management tool)|
|
||||
|
||||
## November 2016
|
||||
|
||||
|New or changed topic | Description |
|
||||
|
||||
@ -65,7 +65,7 @@ However, issues may arise when organizations intend to use versions of Windows t
|
||||
|
||||
## Apply an asset tag during deployment
|
||||
|
||||
Surface Book, Surface Pro 4, Surface Pro 3, and Surface 3 devices all support the application of an asset tag in UEFI. This asset tag can be used to identify the device from UEFI even if the operating system fails, and it can also be queried from within the operating system. To read more about the Surface Asset Tag function, see the [Asset Tag Tool for Surface Pro 3](https://blogs.technet.microsoft.com/askcore/2014/10/20/asset-tag-tool-for-surface-pro-3/) blog post.
|
||||
Surface Studio, Surface Book, Surface Pro 4, Surface Pro 3, and Surface 3 devices all support the application of an asset tag in UEFI. This asset tag can be used to identify the device from UEFI even if the operating system fails, and it can also be queried from within the operating system. To read more about the Surface Asset Tag function, see the [Asset Tag Tool for Surface Pro 3](https://blogs.technet.microsoft.com/askcore/2014/10/20/asset-tag-tool-for-surface-pro-3/) blog post.
|
||||
|
||||
To apply an asset tag using the [Surface Asset Tag CLI Utility](https://www.microsoft.com/download/details.aspx?id=44076) during a Configuration Manager deployment task sequence, use the script and instructions found in the [Set Surface Asset Tag During a Configuration Manager Task Sequence](https://blogs.technet.microsoft.com/jchalfant/set-surface-pro-3-asset-tag-during-a-configuration-manager-task-sequence/) blog post.
|
||||
|
||||
|
||||
@ -18,16 +18,17 @@ This article walks you through the process of customizing the Surface out-of-box
|
||||
|
||||
It is common practice in a Windows deployment to customize the user experience for the first startup of deployed computers — the out-of-box experience, or OOBE.
|
||||
|
||||
>**Note:** OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](http://msdn.microsoft.com/library/windows/hardware/dn898581.aspx).
|
||||
>[!NOTE]
|
||||
>OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](http://msdn.microsoft.com/library/windows/hardware/dn898581.aspx).
|
||||
|
||||
In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome.
|
||||
|
||||
This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](https://technet.microsoft.com/itpro/windows/deploy/create-a-windows-10-reference-image).
|
||||
|
||||
>**Note:** Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:<br/>
|
||||
- [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit)
|
||||
<br/>
|
||||
- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager)
|
||||
>[!NOTE]
|
||||
>Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:<br/>
|
||||
>- [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit)
|
||||
>- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager)
|
||||
|
||||
|
||||
|
||||
@ -41,7 +42,7 @@ To ensure that an automated deployment is not stopped by this page, the page mus
|
||||
## Scenario 2: Surface Pen pairing in OOBE
|
||||
|
||||
|
||||
When you first take a Surface Pro 3, Surface Pro 4, or Surface Book out of the package and start it up, the first-run experience of the factory image includes a prompt that asks you to pair the included Surface Pen to the device. This prompt is only provided by the factory image that ships with the device and is not included in other images used for deployment, such as the Windows Enterprise installation media downloaded from the Volume Licensing Service Center. Because pairing the Bluetooth Surface Pen outside of this experience requires that you enter the Control Panel or PC Settings and manually pair a Bluetooth device, you may want to have users or a technician use this prompt to perform the pairing operation.
|
||||
When you first take a Surface Pro 3, Surface Pro 4, Surface Book, or Surface Studio out of the package and start it up, the first-run experience of the factory image includes a prompt that asks you to pair the included Surface Pen to the device. This prompt is only provided by the factory image that ships with the device and is not included in other images used for deployment, such as the Windows Enterprise installation media downloaded from the Volume Licensing Service Center. Because pairing the Bluetooth Surface Pen outside of this experience requires that you enter the Control Panel or PC Settings and manually pair a Bluetooth device, you may want to have users or a technician use this prompt to perform the pairing operation.
|
||||
|
||||
To provide the factory Surface Pen pairing experience in OOBE, you must copy four files from the factory Surface image into the reference image. You can copy these files into the reference environment before you capture the reference image, or you can add them later by using Deployment Image Servicing and Management (DISM) to mount the image. The four required files are:
|
||||
|
||||
@ -50,7 +51,8 @@ To provide the factory Surface Pen pairing experience in OOBE, you must copy fou
|
||||
- %windir%\\system32\\oobe\\info\\default\\1033\\PenError\_en-US.png
|
||||
- %windir%\\system32\\oobe\\info\\default\\1033\\PenSuccess\_en-US.png
|
||||
|
||||
>**Note:** You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4.
|
||||
>[!NOTE]
|
||||
>You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -11,6 +11,14 @@ author: miladCA
|
||||
|
||||
#Deploy Surface app with Windows Store for Business
|
||||
|
||||
**Applies to**
|
||||
* Surface Pro 4
|
||||
* Surface Book
|
||||
* Surface 3
|
||||
|
||||
>[!NOTE]
|
||||
>The Surface app ships in Surface Studio.
|
||||
|
||||
The Surface app is a lightweight Windows Store app that provides control of many Surface-specific settings and options, including:
|
||||
|
||||
* Enable or disable the Windows button on the Surface device
|
||||
@ -25,7 +33,7 @@ The Surface app is a lightweight Windows Store app that provides control of many
|
||||
|
||||
If your organization is preparing images that will be deployed to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Windows Store or your Windows Store for Business.
|
||||
|
||||
####Surface app overview
|
||||
##Surface app overview
|
||||
|
||||
The Surface app is available as a free download from the [Windows Store](https://www.microsoft.com/store/apps/Surface/9WZDNCRFJB8P). Users can download and install it from the Windows Store, but if your organization uses Windows Store for Business instead, you will need to add it to your store’s inventory and possibly include the app as part of your Windows deployment process. These processes are discussed throughout this article. For more information about Windows Store for Business, see [Windows Store for Business](https://technet.microsoft.com/windows/store-for-business) in the Windows TechCenter.
|
||||
|
||||
@ -73,7 +81,8 @@ After you add an app to the Windows Store for Business account in Offline mode,
|
||||
6. Click either the **Encoded license** or **Unencoded license** option. Use the Encoded license option with management tools like System Center Configuration Manager or when you use Windows Imaging and Configuration Designer (Windows ICD). Select the Unencoded license option when you use Deployment Image Servicing and Management (DISM) or deployment solutions based on imaging, including the Microsoft Deployment Toolkit (MDT).
|
||||
7. Click **Generate** to generate and download the license for the app. Make sure you note the path of the license file because you’ll need that later in this article.
|
||||
|
||||
>**Note:** When you download an app for offline use, such as the Surface app, you may notice a section at the bottom of the page labeled **Required frameworks**. Your target computers must have the frameworks installed for the app to run, so you may need to repeat the download process for each of the required frameworks for your architecture (either x86 or x64) and also include them as part of your Windows deployment discussed later in this article.
|
||||
>[!NOTE]
|
||||
>When you download an app for offline use, such as the Surface app, you may notice a section at the bottom of the page labeled **Required frameworks**. Your target computers must have the frameworks installed for the app to run, so you may need to repeat the download process for each of the required frameworks for your architecture (either x86 or x64) and also include them as part of your Windows deployment discussed later in this article.
|
||||
|
||||
Figure 5 shows the required frameworks for the Surface app.
|
||||
|
||||
@ -81,13 +90,15 @@ Figure 5 shows the required frameworks for the Surface app.
|
||||
|
||||
*Figure 5. Required frameworks for the Surface app*
|
||||
|
||||
>**Note:** The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Windows Store for Business. Always use the Surface app and recommended framework versions as provided by Windows Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes.
|
||||
>[!NOTE]
|
||||
>The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Windows Store for Business. Always use the Surface app and recommended framework versions as provided by Windows Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes.
|
||||
|
||||
To download the required frameworks for the Surface app, follow these steps:
|
||||
1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder.
|
||||
2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder.
|
||||
|
||||
>**Note:** Only the 64-bit (x64) version of each framework is required for Surface devices. Surface devices are native 64-bit UEFI devices and are not compatible with 32-bit (x86) versions of Windows that would require 32-bit frameworks.
|
||||
>[!NOTE]
|
||||
>Only the 64-bit (x64) version of each framework is required for Surface devices. Surface devices are native 64-bit UEFI devices and are not compatible with 32-bit (x86) versions of Windows that would require 32-bit frameworks.
|
||||
|
||||
##Install Surface app on your computer with PowerShell
|
||||
The following procedure provisions the Surface app onto your computer and makes it available for any user accounts created on the computer afterwards.
|
||||
|
||||
@ -28,21 +28,34 @@ Driver and firmware updates for Surface devices are released in one of two ways:
|
||||
|
||||
Installation files for administrative tools, drivers for accessories, and updates for Windows are also available for some devices and are detailed here in this article.
|
||||
|
||||
>**Note:** To simplify the process of locating drivers for your device, downloads for Surface devices have been reorganized to separate pages for each model. Bookmark the Microsoft Download Center page for your device from the links provided on this page. Many of the filenames contain a placeholder denoted with *xxxxxx*, which identifies the current version number or date of the file.
|
||||
>[!NOTE]
|
||||
>To simplify the process of locating drivers for your device, downloads for Surface devices have been reorganized to separate pages for each model. Bookmark the Microsoft Download Center page for your device from the links provided on this page. Many of the filenames contain a placeholder denoted with *xxxxxx*, which identifies the current version number or date of the file.
|
||||
|
||||
|
||||
Recent additions to the downloads for Surface devices provide you with options to install Windows 10 on your Surface devices and update LTE devices with the latest Windows 10 drivers and firmware.
|
||||
|
||||
>**Note:** A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](https://support.microsoft.com/en-us/kb/2909710) for more information.
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](https://go.microsoft.com/fwlink/p/?LinkId=618106) for more information.
|
||||
|
||||
|
||||
|
||||
## Surface Studio
|
||||
|
||||
Download the following updates for [Surface Studio from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=54311).
|
||||
|
||||
* SurfaceStudio_Win10_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
|
||||
|
||||
|
||||
## Surface Book
|
||||
|
||||
|
||||
Download the following updates [for Surface Book from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49497).
|
||||
|
||||
- SurfaceBook\_Win10\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
|
||||
- SurfaceBook_Win10_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
|
||||
|
||||
- SurfaceBook_Win10_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
|
||||
|
||||
- Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
|
||||
|
||||
@ -51,7 +64,9 @@ Download the following updates [for Surface Book from the Microsoft Download Cen
|
||||
|
||||
Download the following updates for [Surface Pro 4 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49498).
|
||||
|
||||
- SurfacePro4\_Win10\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
|
||||
- SurfacePro4_Win10_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
|
||||
|
||||
- SurfacePro4_Win10_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
|
||||
|
||||
- Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
|
||||
|
||||
@ -60,26 +75,22 @@ Download the following updates for [Surface Pro 4 from the Microsoft Download Ce
|
||||
|
||||
Download the following updates [for Surface Pro 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=38826).
|
||||
|
||||
- SurfacePro3\_Win10\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
|
||||
- SurfacePro3_Win10_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
|
||||
|
||||
- SurfacePro3\_Win10\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
|
||||
- SurfacePro3_Win10_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
|
||||
|
||||
- SurfacePro3\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 8.1 Pro
|
||||
- SurfacePro3_Win8x_xxxxxx.msi – Cumulative firmware and driver update package for Windows 8.1 Pro
|
||||
|
||||
- SurfacePro3\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
|
||||
- SurfacePro3_Win8x_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
|
||||
|
||||
- Surface Firmware Tool.msi – Firmware tools for UEFI management
|
||||
|
||||
- Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
|
||||
|
||||
- Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
|
||||
|
||||
- Surface Pro 3 AssetTag.zip – UEFI Asset Tag management tool
|
||||
|
||||
- Surface Pro 3 Driver Set.ppkg – Deployment Asset Provisioning Package for Windows 10
|
||||
|
||||
- Surface Pro 3 KB2978002.zip – Update for Quick Note-Taking Experience feature in Windows 8.1
|
||||
|
||||
- Windows8.1-KB2969817-x64.msu – Fixes an issue that causes Surface devices to reboot twice after firmware updates are installed on all supported x64-based versions of Windows 8.1
|
||||
|
||||
- Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
|
||||
|
||||
## Surface 3
|
||||
@ -87,15 +98,15 @@ Download the following updates [for Surface Pro 3 from the Microsoft Download Ce
|
||||
|
||||
Download the following updates [for Surface 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49040).
|
||||
|
||||
- Surface3\_Win10\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
|
||||
- Surface3_WiFi_Win10_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
|
||||
|
||||
- Surface3\_Win8x\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 8.1 Pro
|
||||
- Surface3_WiFi_Win10_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
|
||||
|
||||
- Surface3\_Win8x\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
|
||||
- Surface3_WiFi_Win8x_xxxxxx.msi – Cumulative firmware and driver update package for Windows 8.1 Pro
|
||||
|
||||
- Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
|
||||
- Surface3_WiFi_Win8x_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
|
||||
|
||||
- Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
|
||||
- Surface 3 AssetTag.zip – UEFI Asset Tag management tool
|
||||
|
||||
- Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
|
||||
|
||||
@ -104,49 +115,43 @@ Download the following updates [for Surface 3 from the Microsoft Download Center
|
||||
|
||||
Download the following updates [for AT&T 4G LTE versions of Surface 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49039).
|
||||
|
||||
- Surface3\_US1\_Win10\_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10
|
||||
- Surface3_4GLTE-ATT_Win10_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10
|
||||
|
||||
- Surface3\_US1\_Win10\_xxxxxx.zip – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10
|
||||
- Surface3_4GLTE-ATT_Win10_xxxxxx.zip – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10
|
||||
|
||||
- Surface3\_US1\_Win8x\_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 8.1 Pro
|
||||
- Surface3_4GLTE-ATT_Win8x_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 8.1 Pro
|
||||
|
||||
- Surface3\_US1\_Win8x\_xxxxxx.zip – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 8.1 Pro
|
||||
- Surface3_4GLTE-ATT_Win8x_xxxxxx.zip – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 8.1 Pro
|
||||
|
||||
- Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
|
||||
|
||||
- Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
|
||||
- Surface 3 AssetTag.zip – UEFI Asset Tag management tool
|
||||
|
||||
- Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
|
||||
|
||||
Download the following updates [for non-AT&T 4G LTE versions of Surface 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49037).
|
||||
|
||||
- Surface3\_NAG\_Win10\_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10
|
||||
- Surface3_4GLTE-NorthAmericaUnlocked_Win10_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10
|
||||
|
||||
- Surface3\_NAG\_Win10\_xxxxxx.zip – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10
|
||||
- Surface3_4GLTE-NorthAmericaUnlocked_Win10_xxxxxx.zip – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10
|
||||
|
||||
- Surface3\_NAG\_Win8x\_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 8.1 Pro
|
||||
- Surface3_4GLTE-NorthAmericaUnlocked_Win8x_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 8.1 Pro
|
||||
|
||||
- Surface3\_NAG\_Win8x\_xxxxxx.zip – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 8.1 Pro
|
||||
- Surface3_4GLTE-NorthAmericaUnlocked_Win8x_xxxxxx.zip – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 8.1 Pro
|
||||
|
||||
- Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
|
||||
|
||||
- Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
|
||||
- Surface 3 AssetTag.zip – UEFI Asset Tag management tool
|
||||
|
||||
- Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
|
||||
|
||||
Download the following updates [for 4G LTE Surface 3 versions for regions outside North America from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49041).
|
||||
|
||||
- Surface3\_ROW\_Win10\_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10
|
||||
- Surface3_4GLTE-RestOfTheWorld_Win10_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10
|
||||
|
||||
- Surface3\_ROW\_Win10\_xxxxxx.zip – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10
|
||||
- Surface3_4GLTE-RestOfTheWorld_Win10_xxxxxx.zip – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10
|
||||
|
||||
- Surface3\_ROW\_Win8x\_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 8.1 Pro
|
||||
- Surface3_4GLTE-RestOfTheWorld_Win8x_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 8.1 Pro
|
||||
|
||||
- Surface3\_ROW\_Win8x\_xxxxxx.zip – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 8.1 Pro
|
||||
- Surface3_4GLTE-RestOfTheWorld_Win8x_xxxxxx.zip – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 8.1 Pro
|
||||
|
||||
- Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
|
||||
|
||||
- Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
|
||||
- Surface 3 AssetTag.zip – UEFI Asset Tag management tool
|
||||
|
||||
- Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
|
||||
|
||||
|
||||
@ -11,7 +11,8 @@ author: Scottmca
|
||||
|
||||
# Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit
|
||||
|
||||
#### Applies to
|
||||
**Applies to**
|
||||
- Surface Studio
|
||||
* Surface Pro 4
|
||||
* Surface Book
|
||||
* Surface 3
|
||||
@ -47,13 +48,19 @@ You can download and find out more about the Windows ADK at [Download the Window
|
||||
|
||||
Before you can perform a deployment with MDT, you must first supply a set of operating system installation files and an operating system image. These files and image can be found on the physical installation media (DVD) for Windows 10. You can also find these files in the disk image (ISO file) for Windows 10, which you can download from the [Volume Licensing Service Center (VLSC)](https://www.microsoft.com/Licensing/servicecenter/default.aspx).
|
||||
|
||||
>**Note:** The installation media generated from the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT.
|
||||
|
||||
>[!NOTE]
|
||||
>The installation media generated from the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT.
|
||||
|
||||
|
||||
#### Windows Server
|
||||
|
||||
Although MDT can be installed on a Windows client, to take full advantage of Windows Deployment Services’ ability to network boot, a full Windows Server environment is recommended. To provide network boot for UEFI devices like Surface with WDS, you will need Windows Server 2008 R2 or later.
|
||||
|
||||
>**Note:** To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter).
|
||||
|
||||
>[!NOTE]
|
||||
>To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter).
|
||||
|
||||
|
||||
#### Windows Deployment Services
|
||||
|
||||
@ -63,11 +70,15 @@ Windows Deployment Services (WDS) is leveraged to facilitate network boot capabi
|
||||
|
||||
The process of creating a reference image should always be performed in a virtual environment. When you use a virtual machine as the platform to build your reference image, you eliminate the need for installation of additional drivers. The drivers for a Hyper-V virtual machine are included by default in the factory Windows 10 image. When you avoid the installation of additional drivers – especially complex drivers that include application components like control panel applications – you ensure that the image created by your reference image process will be as universally compatible as possible.
|
||||
|
||||
>**Note:** A Generation 1 virtual machine is recommended for the preparation of a reference image in a Hyper-V virtual environment.
|
||||
>[!NOTE]
|
||||
>A Generation 1 virtual machine is recommended for the preparation of a reference image in a Hyper-V virtual environment.
|
||||
|
||||
Because customizations are performed by MDT at the time of deployment, the goal of reference image creation is not to perform customization but to increase performance during deployment by reducing the number of actions that need to occur on each deployed device. The biggest action that can slow down an MDT deployment is the installation of Windows updates. When MDT performs this step during the deployment process, it downloads the updates on each deployed device and installs them. By installing Windows updates in your reference image, the updates are already installed when the image is deployed to the device and the MDT update process only needs to install updates that are new since the image was created or are applicable to products other than Windows (for example, Microsoft Office updates).
|
||||
|
||||
>**Note:** Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center.
|
||||
|
||||
>[!NOTE]
|
||||
>Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center.
|
||||
|
||||
|
||||
#### Surface firmware and drivers
|
||||
|
||||
@ -78,13 +89,15 @@ When you browse to the specific Microsoft Download Center page for your device,
|
||||
|
||||
In addition to the driver files that help Windows communicate with the hardware components of the Surface device, the .zip file you download will also contain firmware updates. These firmware updates will update the instructions used by the device hardware to communicate between components and Windows. The firmware of Surface device components is updated by installation of specific driver files and thus is installed along with the other drivers during deployment. The firmware of an out-of-date Surface device is thus updated when the device reboots during and after the Windows deployment process.
|
||||
|
||||
>**Note:** Beginning in Windows 10, the drivers for Surface devices are included in the Windows Preinstallation Environment (WinPE). In earlier versions of Windows, specific drivers (like network drivers) had to be imported and configured in MDT for use in WinPE to successfully deploy to Surface devices.
|
||||
>[!NOTE]
|
||||
>Beginning in Windows 10, the drivers for Surface devices are included in the Windows Preinstallation Environment (WinPE). In earlier versions of Windows, specific drivers (like network drivers) had to be imported and configured in MDT for use in WinPE to successfully deploy to Surface devices.
|
||||
|
||||
#### Application installation files
|
||||
|
||||
In addition to the drivers that are used by Windows to communicate with the Surface device’s hardware and components, you will also need to provide the installation files for any applications that you want to install on your deployed Surface devices. To automate the deployment of an application, you will also need to determine the command-line instructions for that application to perform a silent installation. In this article, the Surface app and Microsoft Office 365 will be installed as examples of application installation. The application installation process can be used with any application with installation files that can be launched from command line.
|
||||
|
||||
>**Note:** If the application files for your application are stored on your organization’s network and will be accessible from your Surface devices during the deployment process, you can deploy that application directly from that network location. To use installation files from a network location, use the **Install Application Without Source Files or Elsewhere on the Network** option in the MDT New Application Wizard, which is described in the [Import applications](#import-applications) section later in this article.
|
||||
>[!NOTE]
|
||||
>If the application files for your application are stored on your organization’s network and will be accessible from your Surface devices during the deployment process, you can deploy that application directly from that network location. To use installation files from a network location, use the **Install Application Without Source Files or Elsewhere on the Network** option in the MDT New Application Wizard, which is described in the [Import applications](#import-applications) section later in this article.
|
||||
|
||||
#### Microsoft Surface Deployment Accelerator
|
||||
|
||||
@ -96,7 +109,8 @@ Before you can configure the deployment environment with Windows images, drivers
|
||||
|
||||
To boot from the network with either your reference virtual machines or your Surface devices, your deployment environment must include a Windows Server environment. The Windows Server environment is required to install WDS and the WDS PXE server. Without PXE support, you will be required to create physical boot media, such as a USB stick to perform your deployment – MDT and Windows ADK will still be required, but Windows Server is not required. Both MDT and Windows ADK can be installed on a Windows client and perform a Windows deployment.
|
||||
|
||||
>**Note:** To download deployment tools directly to Windows Server, you must disable [Internet Explorer Enhanced Security Configuration](https://technet.microsoft.com/library/dd883248). On Windows Server 2012 R2, this can be performed directly through the **Server Manager** option on the **Local Server** tab. In the **Properties** section, **IE Enhanced Security Configuration** can be found on the right side. You may also need to enable the **File Download** option for the **Internet** zone through the **Security** tab of **Internet Options**.
|
||||
>[!NOTE]
|
||||
>To download deployment tools directly to Windows Server, you must disable [Internet Explorer Enhanced Security Configuration](https://technet.microsoft.com/library/dd883248). On Windows Server 2012 R2, this can be performed directly through the **Server Manager** option on the **Local Server** tab. In the **Properties** section, **IE Enhanced Security Configuration** can be found on the right side. You may also need to enable the **File Download** option for the **Internet** zone through the **Security** tab of **Internet Options**.
|
||||
|
||||
#### Install Windows Deployment Services
|
||||
|
||||
@ -112,17 +126,20 @@ After the WDS role is installed, you need to configure WDS. You can begin the co
|
||||
|
||||
*Figure 2. Configure PXE response for Windows Deployment Services*
|
||||
|
||||
>**Note:** Before you configure WDS make sure you have a local NTFS volume that is not your system drive (C:) available for use with WDS. This volume is used to store WDS boot images, deployment images, and configuration.
|
||||
>[!NOTE]
|
||||
>Before you configure WDS make sure you have a local NTFS volume that is not your system drive (C:) available for use with WDS. This volume is used to store WDS boot images, deployment images, and configuration.
|
||||
|
||||
Using the Windows Deployment Services Configuration Wizard, configure WDS to fit the needs of your organization. You can find detailed instructions for the installation and configuration of WDS at [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426). On the **PXE Server Initial Settings** page, be sure to configure WDS so that it will respond to your Surface devices when they attempt to boot from the network. If you have already installed WDS or need to change your PXE server response settings, you can do so on the **PXE Response** tab of the **Properties** of your server in the Windows Deployment Services Management Console.
|
||||
|
||||
>**Note:** You will add boot images to WDS when you update your boot images in MDT. You do not need to add boot images or Windows images to WDS when you configure the role.
|
||||
>[!NOTE]
|
||||
>You will add boot images to WDS when you update your boot images in MDT. You do not need to add boot images or Windows images to WDS when you configure the role.
|
||||
|
||||
#### Install Windows Assessment and Deployment Kit
|
||||
|
||||
To install Windows ADK, run the Adksetup.exe file that you downloaded from [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#adkwin10). Windows ADK must be installed before MDT. You should always download and use the most recent version of Windows ADK. A new version is usually released corresponding with each new version of Windows.
|
||||
|
||||
>**Note:** You can also use the Adksetup.exe file to download the Windows ADK installation files locally for use on other devices.
|
||||
>[!NOTE]
|
||||
>You can also use the Adksetup.exe file to download the Windows ADK installation files locally for use on other devices.
|
||||
|
||||
When you get to the **Select the features you want to install** page, you only need to select the **Deployment Tools** and **Windows Preinstallation Environment (Windows PE)** check boxes to deploy Windows 10 using MDT, as shown in Figure 3.
|
||||
|
||||
@ -170,13 +187,16 @@ To create the deployment share, follow these steps:
|
||||
|
||||
* **Path** – Specify a local folder where the deployment share will reside, and then click **Next**.
|
||||
|
||||
>**Note:** Like the WDS remote installation folder, it is recommended that you put this folder on an NTFS volume that is not your system volume.
|
||||
>[!NOTE]
|
||||
>Like the WDS remote installation folder, it is recommended that you put this folder on an NTFS volume that is not your system volume.
|
||||
|
||||
* **Share** – Specify a name for the network share under which the local folder specified on the **Path** page will be shared, and then click **Next**.
|
||||
|
||||
>**Note:** The share name cannot contain spaces.
|
||||
>[!NOTE]
|
||||
>The share name cannot contain spaces.
|
||||
|
||||
>**Note:** You can use a Dollar Sign (**$**) to hide your network share so that it will not be displayed when users browse the available network shares on the server in File Explorer.
|
||||
>[!NOTE]
|
||||
>You can use a Dollar Sign (**$**) to hide your network share so that it will not be displayed when users browse the available network shares on the server in File Explorer.
|
||||
|
||||
* **Descriptive Name** – Enter a descriptive name for the network share (this descriptive name can contain spaces), and then click **Next**. The descriptive name will be the name of the folder as it appears in the Deployment Workbench.
|
||||
* **Options** – You can accept the default options on this page. Click **Next**.
|
||||
@ -189,7 +209,8 @@ To create the deployment share, follow these steps:
|
||||
|
||||
To secure the deployment share and prevent unauthorized access to the deployment resources, you can create a local user on the deployment share host and configure permissions for that user to have read-only access to the deployment share only. It is especially important to secure access to the deployment share if you intend to automate the logon to the deployment share during the deployment boot process. By automating the logon to the deployment share during the boot of deployment media, the credentials for that logon are stored in plaintext in the bootstrap.ini file on the boot media.
|
||||
|
||||
>**Note:** If you intend to capture images (such as the reference image) with this user, the user must also have write permission on the Captures folder in the MDT deployment share.
|
||||
>[!NOTE]
|
||||
>If you intend to capture images (such as the reference image) with this user, the user must also have write permission on the Captures folder in the MDT deployment share.
|
||||
|
||||
You now have an empty deployment share that is ready for you to add the resources that will be required for reference image creation and deployment to Surface devices.
|
||||
|
||||
@ -197,7 +218,8 @@ You now have an empty deployment share that is ready for you to add the resource
|
||||
|
||||
The first resources that are required to perform a deployment of Windows are the installation files from Windows 10 installation media. Even if you have an already prepared reference image, you still need to supply the unaltered installation files from your installation media. The source of these files can be a physical disk, or it can be an ISO file like the download from the Volume Licensing Service Center (VLSC).
|
||||
|
||||
>**Note:** A 64-bit operating system is required for compatibility with Surface Pro 4, Surface Book, Surface Pro 3, and Surface 3.
|
||||
>[!NOTE]
|
||||
>A 64-bit operating system is required for compatibility with Surface Studio, Surface Pro 4, Surface Book, Surface Pro 3, and Surface 3.
|
||||
|
||||
To import Windows 10 installation files, follow these steps:
|
||||
|
||||
@ -234,7 +256,8 @@ Now that you’ve imported the installation files from the installation media, y
|
||||
|
||||
As described in the [Deployment tools](#deployment-tools) section of this article, the goal of creating a reference image is to keep the Windows environment as simple as possible while performing tasks that would be common to all devices being deployed. You should now have a basic MDT deployment share configured with default options and a set of unaltered, factory installation files for Windows 10. This simple configuration is perfect for reference image creation because the deployment share contains no applications or drivers to interfere with the process.
|
||||
|
||||
>**Note:** For some organizations keeping a simple deployment share without applications or drivers is the simplest solution for creation of reference images. You can easily connect to more than one deployment share from a single Deployment Workbench and copy images from a simple, reference-image-only deployment share to a production deployment share complete with drivers and applications.
|
||||
>[!NOTE]
|
||||
>For some organizations keeping a simple deployment share without applications or drivers is the simplest solution for creation of reference images. You can easily connect to more than one deployment share from a single Deployment Workbench and copy images from a simple, reference-image-only deployment share to a production deployment share complete with drivers and applications.
|
||||
|
||||
To create the reference image task sequence, follow these steps:
|
||||
|
||||
@ -246,13 +269,15 @@ To create the reference image task sequence, follow these steps:
|
||||
|
||||
2. The New Task Sequence Wizard presents a series of steps, as follows:
|
||||
* **General Settings** – Enter an identifier for the reference image task sequence in the **Task Sequence ID** field, a name for the reference image task sequence in the **Task Sequence Name** field, and any comments for the reference image task sequence in the **Task Sequence Comments** field, and then click **Next**.
|
||||
>**Note:** The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
|
||||
>[!NOTE]
|
||||
>The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
|
||||
* **Select Template** – Select **Standard Client Task Sequence** from the drop-down menu, and then click **Next**.
|
||||
* **Select OS** – Navigate to and select the Windows 10 image you imported with the Windows 10 installation files, and then click **Next**.
|
||||
* **Specify Product Key** – Click **Do Not Specify a Product Key at This Time**, and then click **Next**.
|
||||
* **OS Settings** – Enter a name, organization, and home page URL in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**.
|
||||
* **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**.
|
||||
>**Note:** During creation of a reference image, any specified Administrator password will be automatically removed when the image is prepared for capture with Sysprep. During reference image creation, a password is not necessary, but is recommended to remain in line with best practices for production deployment environments.
|
||||
>[!NOTE]
|
||||
>During creation of a reference image, any specified Administrator password will be automatically removed when the image is prepared for capture with Sysprep. During reference image creation, a password is not necessary, but is recommended to remain in line with best practices for production deployment environments.
|
||||
* **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence.
|
||||
* **Progress** – While the task sequence is created, a progress bar is displayed on this page.
|
||||
* **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard.
|
||||
@ -282,7 +307,8 @@ To update the MDT boot media, follow these steps:
|
||||
|
||||
2. Use the Update Deployment Share Wizard to create boot images with the following process:
|
||||
* **Options** – Click **Completely Regenerate the Boot Images**, and then click **Next**.
|
||||
>**Note:** Because this is the first time the newly created deployment share has been updated, new boot images will be generated regardless of which option you select on the **Options** page.
|
||||
>[!NOTE]
|
||||
>Because this is the first time the newly created deployment share has been updated, new boot images will be generated regardless of which option you select on the **Options** page.
|
||||
* **Summary** – Review the specified options on this page before you click **Next** to begin generation of boot images.
|
||||
* **Progress** – While the boot images are being generated, a progress bar is displayed on this page.
|
||||
* **Confirmation** – When the boot images have been generated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard.
|
||||
@ -319,17 +345,20 @@ To import the MDT boot media into WDS for PXE boot, follow these steps:
|
||||
* **Summary** – Review your selections to import a boot image into WDS, and then click **Next**.
|
||||
* **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard.
|
||||
|
||||
>**Note:** Only the 32-bit boot image, LiteTouchPE_x86.wim, is required to boot from BIOS devices, including Generation 1 Hyper-V virtual machines like the reference virtual machine.
|
||||
>[!NOTE]
|
||||
>Only the 32-bit boot image, LiteTouchPE_x86.wim, is required to boot from BIOS devices, including Generation 1 Hyper-V virtual machines like the reference virtual machine.
|
||||
|
||||
If your WDS configuration is properly set up to respond to PXE clients, you should now be able to boot from the network with any device with a network adapter properly configured for network boot (PXE).
|
||||
|
||||
>**Note:** If your WDS server resides on the same server as DHCP or in a different subnet than the devices you are attempting to boot, additional configuration may be required. For more information, see [Managing Network Boot Programs](https://technet.microsoft.com/library/cc732351).
|
||||
>[!NOTE]
|
||||
>If your WDS server resides on the same server as DHCP or in a different subnet than the devices you are attempting to boot, additional configuration may be required. For more information, see [Managing Network Boot Programs](https://technet.microsoft.com/library/cc732351).
|
||||
|
||||
### Deploy and capture a reference image
|
||||
|
||||
Your deployment environment is now set up to create a reference image for Windows 10 complete with Windows Updates.
|
||||
|
||||
>**Note:** You cannot install version updates (such as Windows 10, Version 1511) in a reference image. To create a reference image with a new version of Windows, you must use installation files from that version of Windows. When you install a version update in Windows, it effectively performs an upgrade to a new version of Windows, and upgraded installations of Windows cannot be prepared for deployment with Sysprep.<br/><br/>
|
||||
>[!NOTE]
|
||||
>You cannot install version updates (such as Windows 10, Version 1511) in a reference image. To create a reference image with a new version of Windows, you must use installation files from that version of Windows. When you install a version update in Windows, it effectively performs an upgrade to a new version of Windows, and upgraded installations of Windows cannot be prepared for deployment with Sysprep.<br/><br/>
|
||||
By using a fully automated task sequence in an MDT deployment share dedicated to reference image creation, you can greatly reduce the time and effort required to create new reference images and it is the best way to ensure that your organization is ready for feature updates and new versions of Windows 10.
|
||||
|
||||
You can now boot from the network with a virtual machine to run the prepared task sequence and generate a reference image. When you prepare your virtual machine in Hyper-V for reference image creation, consider the following:
|
||||
@ -376,7 +405,8 @@ As the task sequence processes the deployment, it will automatically perform the
|
||||
* Reboot into WinPE
|
||||
* Capture an image of the Windows 10 environment and store it in the Captures folder in the MDT deployment share
|
||||
|
||||
>**Note:** The Windows Update process can take some time to complete as it searches the Internet for updates, downloads those updates, and then installs them. By performing this process now, in the reference environment, you eliminate the need to perform these tasks on each deployed device and significantly reduce the amount of time and bandwidth required to perform your deployment.
|
||||
>[!NOTE]
|
||||
>The Windows Update process can take some time to complete as it searches the Internet for updates, downloads those updates, and then installs them. By performing this process now, in the reference environment, you eliminate the need to perform these tasks on each deployed device and significantly reduce the amount of time and bandwidth required to perform your deployment.
|
||||
|
||||
When the task sequence completes, your virtual machine will be off and a new reference image complete with updates will be ready in your MDT deployment share for you to import it and prepare your deployment environment for deployment to Surface devices.
|
||||
|
||||
@ -401,7 +431,8 @@ To import the reference image for deployment, use the following steps:
|
||||
* **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Operating System Wizard.
|
||||
3. Expand the folder in which you imported the image to verify that the import completed successfully.
|
||||
|
||||
>**Note:** You can import the reference image into the same deployment share that you used to create your reference image, or you could import the reference image into a new deployment share for deployment to your Surface devices. If you chose to create a new deployment share for deployment of your reference image, remember that you still need to import a full set of installation files from installation media.
|
||||
>[!NOTE]
|
||||
>You can import the reference image into the same deployment share that you used to create your reference image, or you could import the reference image into a new deployment share for deployment to your Surface devices. If you chose to create a new deployment share for deployment of your reference image, remember that you still need to import a full set of installation files from installation media.
|
||||
|
||||
Now that your updated reference image is imported, it is time to prepare your deployment environment for deployment to Surface devices complete with drivers, applications, and automation.
|
||||
|
||||
@ -516,7 +547,8 @@ To create the deployment task sequence, follow these steps:
|
||||
1. In the Deployment Workbench, under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard.
|
||||
2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard:
|
||||
* **General Settings** – Enter an identifier for the deployment task sequence in the **Task Sequence ID** field, a name for the deployment task sequence in the **Task Sequence Name** field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, then click **Next**.
|
||||
>**Note:** The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
|
||||
>[!NOTE]
|
||||
>The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
|
||||
* **Select Template** – Click **Standard Client Task Sequence** from the drop-down menu, and then click **Next**.
|
||||
* **Select OS** – Navigate to and select the reference image that you imported, and then click **Next**.
|
||||
* **Specify Product Key** – Select the product key entry that fits your organization's licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**.
|
||||
@ -553,7 +585,7 @@ After the task sequence is created it can be modified for increased automation,
|
||||
|
||||
|
||||
|
||||
Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence
|
||||
*Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence*
|
||||
|
||||
15. Select the **Inject Drivers** step, the next step in the task sequence.
|
||||
16. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options:
|
||||
@ -727,13 +759,15 @@ To import the updated MDT boot media into WDS for PXE boot, follow these steps:
|
||||
* **Summary** – Review your selections to import a boot image into WDS, and then click **Next**.
|
||||
* **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard.
|
||||
|
||||
>**Note:** Although it is a best practice to replace and update the boot images in WDS whenever the MDT deployment share is updated, for deployment to Surface devices the 32-bit boot image, LiteTouchPE_x86.wim, is not required. Only the 64-bit boot image is required for 64-bit UEFI devices.
|
||||
>[!NOTE]
|
||||
>Although it is a best practice to replace and update the boot images in WDS whenever the MDT deployment share is updated, for deployment to Surface devices the 32-bit boot image, LiteTouchPE_x86.wim, is not required. Only the 64-bit boot image is required for 64-bit UEFI devices.
|
||||
|
||||
### Deploy Windows to Surface
|
||||
|
||||
With all of the automation provided by the deployment share rules and task sequence, performing the deployment on each Surface device becomes as easy as a single touch.
|
||||
|
||||
>**Note:** For the deployment to require only a single touch, the Surface devices must be connected to a keyboard, connected to the network with a Microsoft Surface USB Ethernet Adapter or Surface Dock, and configured with PXE boot as the first boot option, as shown in Figure 25.
|
||||
>[!NOTE]
|
||||
>For the deployment to require only a single touch, the Surface devices must be connected to a keyboard, connected to the network with a Microsoft Surface USB Ethernet Adapter or Surface Dock, and configured with PXE boot as the first boot option, as shown in Figure 25.
|
||||
|
||||
|
||||
|
||||
@ -750,7 +784,8 @@ On a properly configured Surface device, simply turn on the device and press Ent
|
||||
* Windows Update will run, installing any new Windows Updates or updates for installed applications, like Microsoft Office
|
||||
* The task sequence will complete silently and log out of the device
|
||||
|
||||
>**Note:** For Surface devices not configured to boot to the network as the first boot option, you can hold Volume Down and press Power to boot the system immediately to a USB or network device.
|
||||
>[!NOTE]
|
||||
>For Surface devices not configured to boot to the network as the first boot option, you can hold Volume Down and press Power to boot the system immediately to a USB or network device.
|
||||
|
||||
The resulting configuration is a Surface device that is logged out and ready for an end user to enter their credentials, log on, and get right to work. The applications and drivers they need are already installed and up to date.
|
||||
|
||||
|
||||
@ -19,7 +19,8 @@ For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Manage
|
||||
The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center.
|
||||
Run the Microsoft Surface UEFI Configurator Windows Installer (.msi) file to start the installation of the tool. When the installer completes, find Microsoft Surface UEFI Configurator in the All Apps section of your Start menu.
|
||||
|
||||
>**Note**: Microsoft Surface UEFI Configurator is supported only on Windows 10.
|
||||
>[!NOTE]
|
||||
>Microsoft Surface UEFI Configurator is supported only on Windows 10.
|
||||
|
||||
## Create a Surface UEFI configuration package
|
||||
|
||||
@ -67,7 +68,8 @@ To create a Surface UEFI configuration package, follow these steps:
|
||||
13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**.
|
||||
14. When the package is created and saved, the **Successful** page is displayed.
|
||||
|
||||
>**Note**: Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator.
|
||||
>[!NOTE]
|
||||
>Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator.
|
||||
|
||||
|
||||
|
||||
@ -75,7 +77,8 @@ To create a Surface UEFI configuration package, follow these steps:
|
||||
|
||||
Now that you have created your Surface UEFI configuration package, you can enroll or configure Surface devices.
|
||||
|
||||
>**Note**: When a Surface UEFI configuration package is created, a log file is created on the desktop with details of the configuration package settings and options.
|
||||
>[!NOTE]
|
||||
>When a Surface UEFI configuration package is created, a log file is created on the desktop with details of the configuration package settings and options.
|
||||
|
||||
## Enroll a Surface device in SEMM
|
||||
When the Surface UEFI configuration package is executed, the SEMM certificate and Surface UEFI configuration files are staged in the firmware storage of the Surface device. When the Surface device reboots, Surface UEFI processes these files and begins the process of applying the Surface UEFI configuration or enrolling the Surface device in SEMM, as shown in Figure 7.
|
||||
|
||||
@ -55,7 +55,8 @@ To boot a Surface device from an alternative boot device, follow these steps:
|
||||
3. Press and release the **Power** button.
|
||||
4. After the system begins to boot from the USB stick or Ethernet adapter, release the **Volume Down** button.
|
||||
|
||||
>**Note:** In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard.
|
||||
>[!NOTE]
|
||||
>In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard.
|
||||
|
||||
|
||||
For Windows 10, version 1511 and later – including the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10, version 1511 – the drivers for Microsoft Surface Ethernet Adapters are present by default. If you are using a deployment solution that uses Windows Preinstallation Environment (WinPE), like the Microsoft Deployment Toolkit, and booting from the network with PXE, ensure that your deployment solution is using the latest version of the Windows ADK.
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 276 KiB After Width: | Height: | Size: 74 KiB |
@ -33,7 +33,9 @@ For more information on planning for, deploying, and managing Surface devices in
|
||||
| [Change history for Surface documentation](change-history-for-surface.md) | This topic lists new and updated topics in the Surface documentation library. |
|
||||
|
||||
|
||||
## Learn more
|
||||
|
||||
[Certifying Surface Pro 4 and Surface Book as standard devices at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/849/Certifying-Surface-Pro-4-and-Surface-Book-as-standard-devices-at-Microsoft)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -20,9 +20,12 @@ The Surface Dock provides external connectivity to Surface devices through a sin
|
||||
|
||||
Like the firmware for Surface devices, firmware for Surface Dock is also contained within a downloaded driver that is visible in Device Manager. This driver stages the firmware update files on the Surface device. When a Surface Dock is connected and the driver is loaded, the newer version of the firmware staged by the driver is detected and firmware files are copied to the Surface Dock. The Surface Dock then begins a two-phase process to apply the firmware internally. Each phase requires the Surface Dock to be disconnected from the Surface device before the firmware is applied. The driver copies the firmware into the dock, but only applies it when the user disconnects the Surface device from the Surface Dock. This ensures that there are no disruptions because the firmware is only applied when the user leaves their desk with the device.
|
||||
|
||||
>**Note:** You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links:<br/>
|
||||
- [How to manage and update Surface drivers and firmware](https://technet.microsoft.com/mt697551) from Microsoft Mechanics
|
||||
- [Windows Update Makes Surface Better](https://blogs.windows.com/devices/2014/04/15/windows-update-makes-surface-better/#0MqzmYgshCDaJpvK.97) on the Microsoft Devices Blog
|
||||
|
||||
>[!NOTE]
|
||||
>You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links:
|
||||
>- [How to manage and update Surface drivers and firmware](https://technet.microsoft.com/mt697551) from Microsoft Mechanics
|
||||
>- [Windows Update Makes Surface Better](https://go.microsoft.com/fwlink/p/?LinkId=785354) on the Microsoft Devices Blog
|
||||
|
||||
|
||||
|
||||
|
||||
@ -70,7 +73,8 @@ There are three methods you can use to update the firmware of the Surface Dock:
|
||||
|
||||
Windows Update is the method that most users will use. The drivers for the Surface Dock are downloaded automatically from Windows Update and the dock update process is initiated without additional user interaction. The two-phase dock update process described earlier occurs in the background as the user connects and disconnects the Surface Dock during normal use.
|
||||
|
||||
>**Note:** The driver version that is displayed in Device Manager may be different from the firmware version that the Surface Dock is using.
|
||||
>[!NOTE]
|
||||
>The driver version that is displayed in Device Manager may be different from the firmware version that the Surface Dock is using.
|
||||
|
||||
|
||||
|
||||
@ -81,8 +85,9 @@ This method is used mostly in environments where Surface device drivers and firm
|
||||
|
||||
For more information about how to deploy MSI packages see [Create and deploy an application with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/get-started/create-and-deploy-an-application).
|
||||
|
||||
>**Note:** When drivers are installed through Windows Update or the MSI package, registry keys are added that indicate the version of firmware installed on the Surface Dock and contained within the Surface Dock driver. These registry keys can be found in:<br/><br/>
|
||||
**HLKM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\SurfaceDockFwUpdate\\Parameters**
|
||||
>[!NOTE]
|
||||
>When drivers are installed through Windows Update or the MSI package, registry keys are added that indicate the version of firmware installed on the Surface Dock and contained within the Surface Dock driver. These registry keys can be found in:
|
||||
> **HLKM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\SurfaceDockFwUpdate\\Parameters**
|
||||
|
||||
Firmware status is displayed for both the main chipset (displayed as **Component10**) and the DisplayPort chipset (displayed as **Component20**). For each chipset there are four keys, where *xx* is **10** or **20** corresponding to each chipset:
|
||||
|
||||
@ -94,7 +99,8 @@ Firmware status is displayed for both the main chipset (displayed as **Component
|
||||
|
||||
- **Component*xx*FirmwareUpdateStatusRejectReason** – This key changes as the firmware update is processed. It should result in 0 after the successful installation of Surface Dock firmware.
|
||||
|
||||
>**Note:** These registry keys are not present unless you have installed updated Surface Dock drivers through Windows Update or MSI deployment.
|
||||
>[!NOTE]
|
||||
>These registry keys are not present unless you have installed updated Surface Dock drivers through Windows Update or MSI deployment.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ author: miladCA
|
||||
|
||||
#Manage Surface UEFI settings
|
||||
|
||||
Current and future generations of Surface devices, including Surface Pro 4 and Surface Book, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings.
|
||||
Current and future generations of Surface devices, including Surface Pro 4, Surface Book, and Surface Studio, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings.
|
||||
|
||||
>[!NOTE]
|
||||
>Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI.
|
||||
|
||||
@ -16,21 +16,23 @@ author: miladCA
|
||||
|
||||
Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices.
|
||||
|
||||
[Microsoft Surface Data Eraser](https://www.microsoft.com/download/details.aspx?id=46703) is a tool that boots from a USB stick and allows you to perform a secure wipe of all data from a compatible Surface device. A Microsoft Surface Data Eraser USB stick requires only the ability to boot from USB. The USB tool is easy to create by using the provided wizard, the Microsoft Surface Data Eraser Wrapper, and is easy to use with a simple graphic interface, no command line needed. To learn more about the data wiping capabilities and practices Microsoft uses during the service process for Surface, see [Protecting your data if you send your Surface in for service](https://www.microsoft.com/surface/support/security-sign-in-and-accounts/data-wiping-policy).
|
||||
[Microsoft Surface Data Eraser](https://www.microsoft.com/download/details.aspx?id=46703) is a tool that boots from a USB stick and allows you to perform a secure wipe of all data from a compatible Surface device. A Microsoft Surface Data Eraser USB stick requires only the ability to boot from USB. The USB stick is easy to create by using the provided wizard, the Microsoft Surface Data Eraser wrapper, and is easy to use with a simple graphic interface, no command line needed. To learn more about the data wiping capabilities and practices Microsoft uses during the service process for Surface, see [Protecting your data if you send your Surface in for service](https://www.microsoft.com/surface/support/security-sign-in-and-accounts/data-wiping-policy).
|
||||
|
||||
Compatible Surface devices include:
|
||||
|
||||
- Surface Book
|
||||
- Surface Studio
|
||||
|
||||
- Surface Pro 4
|
||||
- Surface Book
|
||||
|
||||
- Surface Pro3
|
||||
- Surface Pro 4
|
||||
|
||||
- Surface 3
|
||||
- Surface Pro3
|
||||
|
||||
- Surface 3 LTE
|
||||
- Surface 3
|
||||
|
||||
- Surface Pro 2
|
||||
- Surface 3 LTE
|
||||
|
||||
- Surface Pro 2
|
||||
|
||||
Some scenarios where Microsoft Surface Data Eraser can be helpful include:
|
||||
|
||||
@ -42,9 +44,11 @@ Some scenarios where Microsoft Surface Data Eraser can be helpful include:
|
||||
|
||||
- Standard practice when performing reimaging for devices used with sensitive data
|
||||
|
||||
>**Note:** Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser.
|
||||
>[!NOTE]
|
||||
>Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser.
|
||||
|
||||
>**Note:** Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function.
|
||||
>[!NOTE]
|
||||
>Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function.
|
||||
|
||||
|
||||
## How to create a Microsoft Surface Data Eraser USB stick
|
||||
@ -71,7 +75,9 @@ After the creation tool is installed, follow these steps to create a Microsoft S
|
||||
*Figure 1. Start the Microsoft Surface Data Eraser tool*
|
||||
|
||||
4. Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost.
|
||||
>**Note:** If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB.
|
||||
|
||||
>[!NOTE]
|
||||
>If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB.
|
||||
|
||||
|
||||
|
||||
@ -94,43 +100,41 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo
|
||||
|
||||
1. Insert the bootable Microsoft Surface Data Eraser USB stick into the supported Surface device.
|
||||
|
||||
2. Ensure your system firmware is set to boot to USB. To enter the firmware settings:
|
||||
2. Boot your Surface device from the Microsoft Surface Data Eraser USB stick. To boot your device from the USB stick follow these steps:
|
||||
|
||||
1. Turn off your Surface device.
|
||||
a. Turn off your Surface device.
|
||||
|
||||
2. Press and hold the **Volume Up** button.
|
||||
b. Press and hold the **Volume Down** button.
|
||||
|
||||
3. Press and release the **Power** button.
|
||||
c. Press and release the **Power** button.
|
||||
|
||||
4. Release the **Volume Up** button.
|
||||
d. Release the **Volume Down** button.
|
||||
|
||||
>[!NOTE]
|
||||
>If your device does not boot to USB using these steps, you may need to turn on the **Enable Alternate Boot Sequence** option in Surface UEFI. You can read more about Surface UEFI boot configuration in [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).
|
||||
|
||||
3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed.
|
||||
3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed, as shown in Figure 4.
|
||||
|
||||
|
||||
|
||||
*Figure 4. Booting the Microsoft Surface Data Eraser USB stick*
|
||||
|
||||
4. Read the software license terms, and then close the notepad file.
|
||||
4. Read the software license terms, and then close the Notepad file.
|
||||
|
||||
5. Accept or Decline the Software License Terms by typing **Accept** or **Decline**.
|
||||
5. Accept or decline the software license terms by typing **Accept** or **Decline**. You must accept the license terms to continue.
|
||||
|
||||
6. Select one of the following three options:
|
||||
6. The Microsoft Surface Data Eraser script detects the storage devices that are present in your Surface device and displays the details of the native storage device. To continue, press **Y** (this action runs Microsoft Surface Data Eraser and removes all data from the storage device) or press **N** (this action shuts down the device without removing data).
|
||||
|
||||
- **Enter S to start Data Erase** – Select this option to begin the data erase process. You will have a chance to confirm in the next step.
|
||||
>[!NOTE]
|
||||
>The Microsoft Surface Data Eraser tool will delete all data, including Windows operating system files required to boot the device, in a secure and unrecoverable way. To boot a Surface device that has been wiped with Microsoft Surface Data Eraser, you will first need to reinstall the Windows operating system. To remove data from a Surface device without removing the Windows operating system, you can use the **Reset your PC** function. However, this does not prevent your data from being recovered with forensic or data recovery capabilities. See [Recovery options in Windows 10](https://support.microsoft.com/help/12415/windows-10-recovery-options) for more information.
|
||||
|
||||
- **Enter D to perform Diskpart** – Select this option to use diskpart.exe to manage partitions on your disk.
|
||||
|
||||
|
||||
*Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser*
|
||||
|
||||
- **Enter X to shut device down** – Select this option to perform no action and shut down the device.
|
||||
7. If you pressed **Y** in step 6, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice.
|
||||
|
||||
7. If you typed **S** to begin the data erase process, the partition that will be erased is displayed, as shown in Figure 5. If this is correct, press **Y** to continue, or **N** to shut down the device.
|
||||
|
||||
|
||||
|
||||
*Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser*
|
||||
|
||||
8. If you pressed **Y** in step 7, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice.
|
||||
|
||||
9. Click the **Yes** button to continue erasing data on the Surface device.
|
||||
8. Click the **Yes** button to continue erasing data on the Surface device.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -62,7 +62,8 @@ When the SDA completes, you can use the deployment share to deploy over the netw
|
||||
|
||||
You can modify the task sequence in the MDT Deployment Workbench to [include your own apps](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt#sec04), or to [pause the automated installation routine](https://blogs.technet.microsoft.com/mniehaus/2009/06/26/mdt-2010-new-feature-3-suspend-and-resume-a-lite-touch-task-sequence/). While the installation is paused, you can make changes to customize your reference image. After the image is captured, you can configure a deployment task sequence and distribute this custom configuration by using the same network boot capabilities as before.
|
||||
|
||||
>**Note:** With SDA v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment.
|
||||
>[!NOTE]
|
||||
>With SDA v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment.
|
||||
|
||||
|
||||
|
||||
@ -77,15 +78,18 @@ For environments where the SDA server will not be able to connect to the Interne
|
||||
|
||||
You can find a full list of available driver downloads at [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)
|
||||
|
||||
>**Note:** Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder.
|
||||
>[!NOTE]
|
||||
>Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder.
|
||||
|
||||
>**Note:** Using files from a local directory is not supported when including Office 365 in your deployment share. To include Office 365 in your deployment share, select the **Download from the Internet** check box.
|
||||
>[!NOTE]
|
||||
>Using files from a local directory is not supported when including Office 365 in your deployment share. To include Office 365 in your deployment share, select the **Download from the Internet** check box.
|
||||
|
||||
## Changes and updates
|
||||
|
||||
SDA is periodically updated by Microsoft. For instructions on how these features are used, see [Step-by-Step: Microsoft Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator).
|
||||
|
||||
>**Note:** To install a newer version of SDA on a server with a previous version of SDA installed, you only need to run the installation file for the new version of SDA. The installer will handle the upgrade process automatically. If you used SDA to create a deployment share prior to the upgrade and want to use new features of the new version of SDA, you will need to create a new deployment share. SDA does not support upgrades of an existing deployment share.
|
||||
>[!NOTE]
|
||||
>To install a newer version of SDA on a server with a previous version of SDA installed, you only need to run the installation file for the new version of SDA. The installer will handle the upgrade process automatically. If you used SDA to create a deployment share prior to the upgrade and want to use new features of the new version of SDA, you will need to create a new deployment share. SDA does not support upgrades of an existing deployment share.
|
||||
|
||||
### Version 1.96.0405
|
||||
This version of SDA adds support for the following:
|
||||
|
||||
@ -39,7 +39,8 @@ The tool installs in the SDA program group, as shown in Figure 2.
|
||||
|
||||
*Figure 2. The SDA program group and icon*
|
||||
|
||||
>**Note:** At this point the tool has not yet prepared any deployment environment or downloaded any materials from the Internet.
|
||||
>[!NOTE]
|
||||
>At this point, the tool has not yet prepared any deployment environment or downloaded any materials from the Internet.
|
||||
|
||||
|
||||
|
||||
@ -48,7 +49,8 @@ The tool installs in the SDA program group, as shown in Figure 2.
|
||||
|
||||
The following steps show you how to create a deployment share for Windows 10 that supports Surface 3, Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, the Surface Asset Tag Tool, and Office 365. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps.
|
||||
|
||||
>**Note:** SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice.
|
||||
>[!NOTE]
|
||||
>SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice.
|
||||
|
||||
|
||||
|
||||
@ -58,12 +60,14 @@ The following steps show you how to create a deployment share for Windows 10 th
|
||||
|
||||
3. On the **Verify System** page, the SDA wizard verifies the prerequisites required for an SDA deployment share. This process also checks for the presence of the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10 and the Microsoft Deployment Toolkit (MDT) 2013 Update 2. If these tools are not detected, they are downloaded and installed automatically. Click **Next** to continue.
|
||||
|
||||
>**Note:** As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows:
|
||||
* Deployment tools
|
||||
* User State Migration Tool (USMT)
|
||||
* Windows Preinstallation Environment (WinPE)</br></br>
|
||||
>[!NOTE]
|
||||
>As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows:
|
||||
> * Deployment tools
|
||||
> * User State Migration Tool (USMT)
|
||||
> * Windows Preinstallation Environment (WinPE)</br></br>
|
||||
|
||||
>**Note:** As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1.
|
||||
>[!NOTE]
|
||||
>As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1.
|
||||
|
||||
4. On the **Windows 8.1** page, to create a Windows 10 deployment share, do not select the **Would you like to support Windows 8.1** check box. Click **Next** to continue.
|
||||
|
||||
@ -93,7 +97,8 @@ The following steps show you how to create a deployment share for Windows 10 th
|
||||
|
||||
*Figure 4. Selecting Surface Firmware Tool requires Surface Pro 3 drivers*
|
||||
|
||||
>**Note:** You cannot select both Surface 3 and Surface 3 LTE models at the same time.
|
||||
>[!NOTE]
|
||||
>You cannot select both Surface 3 and Surface 3 LTE models at the same time.
|
||||
|
||||
7. On the **Summary** page confirm your selections and click **Finish** to begin the creation of your deployment share. The process can take several minutes as files are downloaded, the tools are installed, and the deployment share is created. While the SDA scripts are creating your deployment share, an **Installation Progress** window will be displayed, as shown in Figure 5. A typical SDA process includes:
|
||||
|
||||
@ -125,17 +130,21 @@ The following steps show you how to create a deployment share for Windows 10 th
|
||||
|
||||
If you are unable to connect to the Internet with your deployment server, or if you want to download the Surface drivers and apps separately, you can specify a local source for the driver an app files at the time of deployment share creation. On the **Configure** page of the SDA wizard, select the **Copy from a Local Directory** check box, as shown in Figure 6. The **Download from the Internet** check box will be automatically deselected. Enter the folder location where you have placed the driver and app files in the **Local Path** field, as shown in Figure 6.
|
||||
|
||||
>**Note:** All of the downloaded driver and applications files must be located in the same folder. If a required driver or application file is missing from the selected folder when you click **Next**, a warning is displayed and the wizard will not proceed to the next step.
|
||||
>[!NOTE]
|
||||
>All of the downloaded driver and applications files must be located in the same folder. If a required driver or application file is missing from the selected folder when you click **Next**, a warning is displayed and the wizard will not proceed to the next step.
|
||||
|
||||
>**Note:** The driver and app files do not need to be extracted from the downloaded .zip files.
|
||||
>[!NOTE]
|
||||
>The driver and app files do not need to be extracted from the downloaded .zip files.
|
||||
|
||||
>**Note:** Including Office 365 in your deployment share requires an Internet connection and cannot be performed if you use local files.
|
||||
>[!NOTE]
|
||||
>Including Office 365 in your deployment share requires an Internet connection and cannot be performed if you use local files.
|
||||
|
||||
|
||||
|
||||
*Figure 6. Specify the Surface driver and app files from a local path*
|
||||
|
||||
>**Note:** The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later.
|
||||
>[!NOTE]
|
||||
>The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later.
|
||||
|
||||
|
||||
|
||||
@ -143,7 +152,8 @@ If you are unable to connect to the Internet with your deployment server, or if
|
||||
|
||||
You can use USB media to perform an SDA deployment if your Surface device is unable to boot from the network. For example, if you do not have a Microsoft Surface Ethernet Adapter or Microsoft Surface dock to facilitate network boot (PXE boot). The USB drive produced by following these steps includes a complete copy of the SDA deployment share and can be run on a Surface device without a network connection.
|
||||
|
||||
>**Note:** The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended.
|
||||
>[!NOTE]
|
||||
>The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended.
|
||||
|
||||
|
||||
|
||||
@ -157,9 +167,8 @@ Before you can create bootable media files within the MDT Deployment Workbench o
|
||||
|
||||
4. **clean** – Removes all configuration from your USB drive.
|
||||
|
||||
>**Warning:** This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command.
|
||||
|
||||
|
||||
>[!WARNING]
|
||||
>This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command.
|
||||
|
||||
5. **create part pri** – Creates a primary partition on the USB drive.
|
||||
|
||||
@ -175,7 +184,8 @@ Before you can create bootable media files within the MDT Deployment Workbench o
|
||||
|
||||
*Figure 7. Use DiskPart to prepare a USB drive for boot*
|
||||
|
||||
>**Note:** You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly.
|
||||
>[!NOTE]
|
||||
>You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly.
|
||||
|
||||
|
||||
|
||||
@ -284,9 +294,8 @@ When you run the task sequence, you will be prompted to provide the following in
|
||||
|
||||
- A product key, if one is required
|
||||
|
||||
>**Note:** If you are deploying the same version of Windows as the version that came on your device, no product key is required.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>If you are deploying the same version of Windows as the version that came on your device, no product key is required.
|
||||
|
||||
- A time zone
|
||||
|
||||
@ -300,9 +309,9 @@ The **2 – Create Windows Reference Image** task sequence is used to perform a
|
||||
|
||||
Like the **1 – Deploy Microsoft Surface** task sequence, the **2 – Create Windows Reference Image** task sequence performs a deployment of the unaltered Windows image directly from the installation media. Creation of a reference image should always be performed on a virtual machine. Using a virtual machine as your reference system helps to ensure that the resulting image is compatible with different hardware configurations.
|
||||
|
||||
>**Note:** Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](http://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).
|
||||
>[!NOTE]
|
||||
>Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](http://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).
|
||||
|
||||
|
||||
|
||||
In addition to the information required by the **1 – Deploy Microsoft Surface** task sequence, you will also be prompted to capture an image when you run this task sequence on your reference virtual machine. The **Location** and **File name** fields are automatically populated with the proper information for your deployment share. All that you need to do is select the **Capture an image of this reference computer** option when you are prompted on the **Capture Image** page of the Windows Deployment Wizard.
|
||||
|
||||
|
||||
@ -18,23 +18,19 @@ Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the ha
|
||||
|
||||
The [Microsoft Surface Diagnostic Toolkit](https://www.microsoft.com/download/details.aspx?id=46703) is a small, portable diagnostic tool that runs through a suite of tests to diagnose the hardware of Surface devices. The Microsoft Surface Diagnostic Toolkit executable file is less than 3 MB, which allows it to be distributed through email. It does not require installation, so it can be run directly from a USB stick or over the network. The Microsoft Surface Diagnostic Toolkit walks you through several tests of individual components including the touchscreen, cameras, and sensors.
|
||||
|
||||
>**Note:** A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices:
|
||||
>[!NOTE]
|
||||
>A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices:
|
||||
>- Surface Studio
|
||||
>- Surface Book
|
||||
>- Surface Pro 4
|
||||
>- Surface 3 LTE
|
||||
>- Surface 3
|
||||
>- Surface Pro 3
|
||||
>- Surface Pro 2
|
||||
>- Surface Pro
|
||||
|
||||
- Surface Book
|
||||
|
||||
- Surface Pro 4
|
||||
|
||||
- Surface 3 LTE
|
||||
|
||||
- Surface 3
|
||||
|
||||
- Surface Pro 3
|
||||
|
||||
- Surface Pro 2
|
||||
|
||||
- Surface Pro
|
||||
|
||||
>**Note:** Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the archive file (.zip) as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.)
|
||||
>[!NOTE]
|
||||
>Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the archive file (.zip) as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.)
|
||||
|
||||
Running the Microsoft Surface Diagnostic Toolkit is a hands-on activity. The test sequence includes several tests that require you to perform actions or observe the outcome of the test, and then click the applicable **Pass** or **Fail** button. Some tests require connectivity to external devices, like an external display. Other tests use the built in Windows troubleshooters. At the end of testing, a visual report of the test results is displayed and you are given the option to save a log file or copy the results to the clipboard.
|
||||
|
||||
@ -54,7 +50,8 @@ To run a full set of tests with the Microsoft Surface Diagnostic Toolkit, you sh
|
||||
|
||||
- A power adapter for your Surface device
|
||||
|
||||
>**Note:** The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not resolve issues with the operating system or software.
|
||||
>[!NOTE]
|
||||
>The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not resolve issues with the operating system or software.
|
||||
|
||||
## Configure test options
|
||||
|
||||
@ -64,7 +61,8 @@ Before you select the tests you want to run, you can click the Tools ![images\su
|
||||
|
||||
*Figure 1. The Tools button highlighted in upper right corner of window*
|
||||
|
||||
>**Note:** Any options you want to select must be specified before you run the tests. You cannot change the test options after the testing sequence has started.
|
||||
>[!NOTE]
|
||||
>Any options you want to select must be specified before you run the tests. You cannot change the test options after the testing sequence has started.
|
||||
|
||||
####Test depth
|
||||
You can quickly select among three modes for testing and diagnostics by using the **Test Depth** page. The **Test Depth** page displays a slider with three possible positions, as shown in Figure 2. These positions determine which tests are run and what information is recorded without requiring you to select specific tests with the **Run Specific Tests** button. The three modes allow you to focus the tests of the Microsoft Surface Diagnostic Toolkit on hardware, software, or both hardware and software.
|
||||
@ -173,34 +171,40 @@ These files and logs are stored in a .zip file saved by the Microsoft Surface Di
|
||||
|
||||
#### Type Cover test
|
||||
|
||||
>**Note:** A Surface Type Cover is required for this test.
|
||||
>[!NOTE]
|
||||
>A Surface Type Cover is required for this test.
|
||||
|
||||
|
||||
If a Surface Type Cover is not detected, the test prompts you to connect the Type Cover. When a Type Cover is detected the test prompts you to use the keyboard and touchpad. The cursor should move while you swipe the touchpad, and the keyboard Windows key should bring up the Start menu or Start screen to successfully pass this test. You can skip this test if a Type Cover is not used with the Surface device.
|
||||
|
||||
#### Integrated keyboard test
|
||||
|
||||
>**Note:** This test is only applicable to Surface Book and requires that the Surface Book be docked to the keyboard.
|
||||
>[!NOTE]
|
||||
>This test is only applicable to Surface Book and requires that the Surface Book be docked to the keyboard.
|
||||
|
||||
This test is essentially the same as the Type Cover test, except the integrated keyboard in the Surface Book base is tested rather than the Type Cover. During the first stage of this test a diagram of the keyboard is displayed. When you press a key, the corresponding key will be marked on the diagram. The test will proceed when every key in the diagram is marked. In the second stage of this test, you are prompted to make several gestures on the keypad. As you perform each gesture (for example, a three finger tap), the gesture will be marked on the screen. When you have performed all gestures, the test will automatically complete.
|
||||
|
||||
>**Note:** The F-keys on the diagram require that you press the Function (FN) key simultaneously to activate them. By default, these keys perform other actions. For the Home and End keys, you must press the same keys as F8 and F9, but without the Function (FN) key pressed.
|
||||
>[!NOTE]
|
||||
>The F-keys on the diagram require that you press the Function (FN) key simultaneously to activate them. By default, these keys perform other actions. For the Home and End keys, you must press the same keys as F8 and F9, but without the Function (FN) key pressed.
|
||||
|
||||
#### Canvas mode battery test
|
||||
|
||||
>**Note:** This test is only applicable to Surface Book.
|
||||
>[!NOTE]
|
||||
>This test is only applicable to Surface Book.
|
||||
|
||||
Depending on which mode Surface Book is in, different batteries are used to power the device. When Surface Book is in clipboard mode (detached form the keyboard) it uses an internal battery, and when it is connected in either laptop mode or canvas mode it uses different connections to the battery in the keyboard. In canvas mode, the screen is connected to the keyboard so that when the device is closed, the screen remains face-up and visible. Connect the Surface Book to the keyboard in this manner for the test to automatically proceed.
|
||||
|
||||
#### Clipboard mode battery test
|
||||
|
||||
>**Note:** This test is only applicable to Surface Book.
|
||||
>[!NOTE]
|
||||
>This test is only applicable to Surface Book.
|
||||
|
||||
Disconnect the Surface Book from the keyboard to work in clipboard mode. In clipboard mode the Surface Book operates from an internal battery that is tested when the Surface Book is disconnected from the keyboard. Disconnecting the Surface Book from the keyboard will also disconnect the Surface Book from power and will automatically begin this test.
|
||||
|
||||
#### Laptop mode battery test
|
||||
|
||||
>**Note:** This test is only applicable to Surface Book.
|
||||
>[!NOTE]
|
||||
>This test is only applicable to Surface Book.
|
||||
|
||||
Connect the Surface Book to the keyboard in the opposite fashion to canvas mode in laptop mode. In laptop mode the screen will face you when the device is open and the device can be used in the same way as any other laptop. Disconnect AC Power from the laptop base when prompted for this test to check the battery status.
|
||||
|
||||
@ -210,25 +214,29 @@ In this test the battery is discharged for a few seconds and tested for health a
|
||||
|
||||
#### Discrete graphics (dGPU) test
|
||||
|
||||
>**Note:** This test is only applicable to Surface Book models with a discrete graphics processor.
|
||||
>[!NOTE]
|
||||
>This test is only applicable to Surface Book models with a discrete graphics processor.
|
||||
|
||||
This test will query the device information of current hardware to check for the presence of both the Intel integrated graphics processor in the Surface Book and the NVIDIA discrete graphics processor in the Surface Book keyboard. The keyboard must be attached for this test to function.
|
||||
|
||||
#### Discrete graphics (dGPU) fan test
|
||||
|
||||
>**Note:** This test is only applicable to Surface Book models with a discrete graphics processor.
|
||||
>[!NOTE]
|
||||
>This test is only applicable to Surface Book models with a discrete graphics processor.
|
||||
|
||||
The discrete graphics processor in the Surface Book includes a separate cooling fan. The fan is turned on automatically by the test for 5 seconds. Listen for the sound of the fan in the keyboard and report if the fan is working correctly when prompted.
|
||||
|
||||
#### Muscle wire test
|
||||
|
||||
>**Note:** This test is only applicable to Surface Book.
|
||||
>[!NOTE]
|
||||
>This test is only applicable to Surface Book.
|
||||
|
||||
To disconnect the Surface Book from the keyboard, software must instruct the muscle wire latch mechanism to open. This is typically accomplished by pressing and holding the undock key on the keyboard. This test sends the same signal to the latch, which unlocks the Surface Book from the Surface Book keyboard. Remove the Surface Book from the keyboard when you are prompted to do so.
|
||||
|
||||
#### Dead pixel and display artifacts tests
|
||||
|
||||
>**Note:** Before you run this test, be sure to clean the screen of dust or smudges.
|
||||
>[!NOTE]
|
||||
>Before you run this test, be sure to clean the screen of dust or smudges.
|
||||
|
||||
This test prompts you to view the display in search of malfunctioning pixels. The test displays full-screen, single-color images including black, white, red, green, and blue. Pixels that remain bright or dark when the screen displays an image of a different color indicate a failed test. You should also look for distortion or variance in the color of the screen.
|
||||
|
||||
@ -246,7 +254,8 @@ The Surface touchscreen should detect input across the entire screen of the devi
|
||||
|
||||
#### Digitizer pen test
|
||||
|
||||
>**Note:** A Microsoft Surface Pen is required for this test.
|
||||
>[!NOTE]
|
||||
>A Microsoft Surface Pen is required for this test.
|
||||
|
||||
This test displays the same lines as those that are displayed during the Digitizer Touch test, but your input is performed with a Surface Pen instead of your finger. The lines should remain unbroken for as long as the Pen is pressed to the screen. Trace all of the lines in the image to look for unresponsive areas across the entire screen of the Surface device.
|
||||
|
||||
@ -264,7 +273,8 @@ This test prompts you to use the volume rocker to turn the volume all the way up
|
||||
|
||||
#### Micro SD or SD slot test
|
||||
|
||||
>**Note:** This test requires a micro SD or SD card that is compatible with the slot in your Surface device.
|
||||
>[!NOTE]
|
||||
>This test requires a micro SD or SD card that is compatible with the slot in your Surface device.
|
||||
|
||||
Insert a micro SD or SD card when you are prompted. When the SD card is detected, the test prompts you to remove the SD card to ensure that the card is not left in the device. During this test a small file is written to the SD card and then verified. Detection and verification of the SD card automatically passes this test without additional input.
|
||||
|
||||
@ -274,13 +284,15 @@ This test displays a meter that shows the microphone sound level and records aud
|
||||
|
||||
#### Video out test
|
||||
|
||||
>**Note:** This test requires an external display with the applicable connection for your Surface device.
|
||||
>[!NOTE]
|
||||
>This test requires an external display with the applicable connection for your Surface device.
|
||||
|
||||
Surface devices provide a Mini DisplayPort connection for connecting to an external display. Connect your display through the Mini DisplayPort on the device when prompted. The display should be detected automatically and an image should appear on the external display.
|
||||
|
||||
#### Bluetooth test
|
||||
|
||||
>**Note:** This test requires a Bluetooth device. The device must be set to pairing mode or made discoverable to perform this test.
|
||||
>[!NOTE]
|
||||
>This test requires a Bluetooth device. The device must be set to pairing mode or made discoverable to perform this test.
|
||||
|
||||
After you receive a prompt to put the device in pairing mode, the test opens the **Add a device** window and begins to search for discoverable Bluetooth devices. Watch the **Add a device** window to verify that your Bluetooth device is detected. Select your Bluetooth device from the list and connect to the device to complete the test.
|
||||
|
||||
@ -288,17 +300,20 @@ After you receive a prompt to put the device in pairing mode, the test opens the
|
||||
|
||||
Use this test to verify that the cameras on your Surface device are operating properly. Images will be displayed from both the front and rear cameras, and the infrared camera on a Surface Pro 4. Continuous autofocus can be enabled on the rear camera. Move the device closer and farther away from an object to verify the operation of continuous autofocus.
|
||||
|
||||
>**Note:** You can also use the **Snapshot to Logs** option to save a snapshot of the video output to the log files.
|
||||
>[!NOTE]
|
||||
>You can also use the **Snapshot to Logs** option to save a snapshot of the video output to the log files.
|
||||
|
||||
#### Speaker test
|
||||
|
||||
>**Note:** Headphones or external speakers are required to test the headphone jack in this test.
|
||||
>[!NOTE]
|
||||
>Headphones or external speakers are required to test the headphone jack in this test.
|
||||
|
||||
This test plays audio over left and right channels respectively, both for the internal speakers and for speakers or headphones connected through the headphone jack. Plug in your headphones or speakers to the 3.5mm stereo jack when prompted. The test will automatically detect that a sound playback device has been connected. Mark each channel as a pass or fail as you hear the audio play through the speakers or headphones.
|
||||
|
||||
#### Network test
|
||||
|
||||
>**Note:** Connect the Surface device to a Wi-Fi network before you run this test. Connections that are made during the test are removed when the test is completed.
|
||||
>[!NOTE]
|
||||
>Connect the Surface device to a Wi-Fi network before you run this test. Connections that are made during the test are removed when the test is completed.
|
||||
|
||||
This test uses the Windows Network Diagnostics built in troubleshooter to diagnose potential issues with network connectivity, including proxy configuration, DNS problems, and IP address conflicts. An event log is saved by this test in Windows logs and is visible in the Windows Event Viewer. The Event ID is 6100.
|
||||
|
||||
@ -326,11 +341,13 @@ The compass detects which direction the Surface device is facing relative to nor
|
||||
|
||||
The ambient light sensor is used to automatically adjust screen brightness relative to the ambient lighting in the environment. Turn the device toward or away from a light source to cause the screen to dim or brighten in response increased or decreased light. The test automatically passes when the screen brightness automatically changes.
|
||||
|
||||
>**Note:** You can also block the ambient light from the sensor by holding your hand slightly in front of the light sensor, which is located directly next to the camera. Use the provided meter to determine if you are blocking light from the sensor.
|
||||
>[!NOTE]
|
||||
>You can also block the ambient light from the sensor by holding your hand slightly in front of the light sensor, which is located directly next to the camera. Use the provided meter to determine if you are blocking light from the sensor.
|
||||
|
||||
#### Device orientation test
|
||||
|
||||
>**Note:** Before you run this test, disable rotation lock from the Action Center if enabled.
|
||||
>[!NOTE]
|
||||
>Before you run this test, disable rotation lock from the Action Center if enabled.
|
||||
|
||||
The device orientation sensor determines what the angle of the Surface device is, relative to the ground. Rotate the display 90 degrees or 180 degrees to cause the screen orientation to switch between portrait and landscape mode. If you have a Surface Type Cover or the Surface Book keyboard connected, you will be prompted to disconnect the Surface from the keyboard to allow screen rotation. The test automatically passes when the screen orientation switches.
|
||||
|
||||
@ -344,7 +361,8 @@ The Microsoft Surface Diagnostic Toolkit uses this test only if a Surface Dock i
|
||||
|
||||
#### System assessment
|
||||
|
||||
>**Note:** The Surface device must be connected to AC power before you can run this test.
|
||||
>[!NOTE]
|
||||
>The Surface device must be connected to AC power before you can run this test.
|
||||
|
||||
The Windows System Assessment Tool (WinSAT) runs a series of benchmarks against the processor, memory, video adapter, and storage devices. The results include the processing speed of various algorithms, read and write performance of memory and storage, and performance in several Direct3D graphical tests.
|
||||
|
||||
@ -358,13 +376,15 @@ If your Surface device has encountered an error that caused the device to fail o
|
||||
|
||||
#### Connected standby text
|
||||
|
||||
>**Note:** This test is only available on Surface devices running Windows 8 or Windows 8.1.
|
||||
>[!NOTE]
|
||||
>This test is only available on Surface devices running Windows 8 or Windows 8.1.
|
||||
|
||||
If connected standby is enabled on the Surface device, this test passes automatically. If connected standby is not enabled, a failure is recorded for this test. Find out more about Connected Standby and Modern Standby at [Modern Standby](https://msdn.microsoft.com/library/windows/hardware/mt282515) on MSDN.
|
||||
|
||||
#### Modern standby test
|
||||
|
||||
>**Note:** This test is only available on Surface devices running Windows 10.
|
||||
>[!NOTE]
|
||||
>This test is only available on Surface devices running Windows 10.
|
||||
|
||||
This test records log files of the power configuration for the Surface device using the **powercfg.exe /a** command. The test completes automatically and a failure is only recorded if the command does not run.
|
||||
|
||||
@ -373,7 +393,8 @@ This test records log files of the power configuration for the Surface device us
|
||||
|
||||
You can run the Microsoft Surface Diagnostic Toolkit from the command line or as part of a script. The tool supports the following arguments:
|
||||
|
||||
>**Note:** Many of the tests performed by the Microsoft Surface Diagnostic Toolkit require technician interaction. The Microsoft Surface Diagnostic Toolkit cannot run unattended.
|
||||
>[!NOTE]
|
||||
>Many of the tests performed by the Microsoft Surface Diagnostic Toolkit require technician interaction. The Microsoft Surface Diagnostic Toolkit cannot run unattended.
|
||||
|
||||
#### exclude
|
||||
|
||||
@ -526,7 +547,8 @@ If a localization file with the same name and in the same folder as the executab
|
||||
|
||||
A custom localization file selected through this process does not need a specific name. After you select the custom localization file, the Microsoft Surface Diagnostic Toolkit will import the contents and write them to a .locale file with the same name as the .exe file, just like if you click the **Generate** button to create a new .locale file.
|
||||
|
||||
>**Note:** If you import a localization file by clicking the **Browse** button, an existing localization file will be overwritten without prompting if that file has the same name as the Microsoft Surface Diagnostic Toolkit executable file.
|
||||
>[!NOTE]
|
||||
>If you import a localization file by clicking the **Browse** button, an existing localization file will be overwritten without prompting if that file has the same name as the Microsoft Surface Diagnostic Toolkit executable file.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -20,7 +20,8 @@ The [Microsoft Surface Dock Updater](https://www.microsoft.com/download/details.
|
||||
|
||||
When you run the Microsoft Surface Dock Updater installer you will be prompted to accept an End User License Agreement (EULA).
|
||||
|
||||
>**Note:** Updating Surface Dock firmware requires connectivity to the Surface Dock, available only on Surface Pro 3, Surface Pro 4, and Surface Book devices. A Surface Pro 3, Surface Pro 4, or Surface Book is required to successfully install Microsoft Surface Dock Updater.
|
||||
>[!NOTE]
|
||||
>Updating Surface Dock firmware requires connectivity to the Surface Dock, available only on Surface Pro 3, Surface Pro 4, and Surface Book devices. A Surface Pro 3, Surface Pro 4, or Surface Book is required to successfully install Microsoft Surface Dock Updater.
|
||||
|
||||
## Update a Surface Dock with Microsoft Surface Dock Updater
|
||||
|
||||
@ -75,7 +76,8 @@ To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps
|
||||
|
||||
9. If you want to update multiple Surface Docks in one sitting, you can click the **Update another Surface Dock** button to begin the process on the next Surface Dock.
|
||||
|
||||
>**Note:** The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power.
|
||||
>[!NOTE]
|
||||
>The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ author: jobotto
|
||||
Microsoft Surface Enterprise Management Mode (SEMM) is a feature of Surface devices with Surface UEFI that allows you to secure and manage firmware settings within your organization. With SEMM, IT professionals can prepare configurations of UEFI settings and install them on a Surface device. In addition to the ability to configure UEFI settings, SEMM also uses a certificate to protect the configuration from unauthorized tampering or removal.
|
||||
|
||||
>[!NOTE]
|
||||
>SEMM is only available on devices with Surface UEFI firmware, such as Surface Pro 4 and Surface Book. For more information about Surface UEFI, see [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).
|
||||
>SEMM is only available on devices with Surface UEFI firmware, such as Surface Pro 4, Surface Book, and Surface Studio. For more information about Surface UEFI, see [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).
|
||||
|
||||
When Surface devices are configured by SEMM and secured with the SEMM certificate, they are considered *enrolled* in SEMM. When the SEMM certificate is removed and control of UEFI settings is returned to the user of the device, the Surface device is considered *unenrolled* in SEMM.
|
||||
|
||||
|
||||
@ -13,7 +13,8 @@ author: jobotto
|
||||
|
||||
When a Surface device is enrolled in Surface Enterprise Management Mode (SEMM), a certificate is stored in the firmware of that device. The presence of that certificate and the enrollment in SEMM prevent any unauthorized changes to Surface UEFI settings or options while the device is enrolled in SEMM. To restore control of Surface UEFI settings to the user, the Surface device must be unenrolled from SEMM, a process sometimes described as reset or recovery. There are two methods you can use to unenroll a device from SEMM—a Surface UEFI reset package and a Recovery Request.
|
||||
|
||||
>**Warning:** To unenroll a device from SEMM and restore user control of Surface UEFI settings, you must have the SEMM certificate that was used to enroll the device in SEMM. If this certificate becomes lost or corrupted, it is not possible to unenroll from SEMM. Back up and protect your SEMM certificate accordingly.
|
||||
>[!WARNING]
|
||||
>To unenroll a device from SEMM and restore user control of Surface UEFI settings, you must have the SEMM certificate that was used to enroll the device in SEMM. If this certificate becomes lost or corrupted, it is not possible to unenroll from SEMM. Back up and protect your SEMM certificate accordingly.
|
||||
|
||||
For more information about SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode).
|
||||
|
||||
@ -27,7 +28,8 @@ Reset packages are created specifically for an individual Surface device. To beg
|
||||
|
||||
*Figure 1. The serial number of the Surface device is displayed on the Surface UEFI PC information page*
|
||||
|
||||
>**Note:** To boot to Surface UEFI, press **Volume Up** and **Power** simultaneously while the device is off. Hold **Volume Up** until the Surface logo is displayed and the device begins to boot.
|
||||
>[!NOTE]
|
||||
>To boot to Surface UEFI, press **Volume Up** and **Power** simultaneously while the device is off. Hold **Volume Up** until the Surface logo is displayed and the device begins to boot.
|
||||
|
||||
To create a Surface UEFI reset package, follow these steps:
|
||||
|
||||
@ -79,7 +81,8 @@ To initiate a Recovery Request, follow these steps:
|
||||
|
||||
4. Click or press **Get Started**.
|
||||
5. Click or press **Next** to begin the Recovery Request process.
|
||||
>**Note:** A Recovery Request expires two hours after it is created. If a Recovery Request is not completed in this time, you will have to restart the Recovery Request process.
|
||||
>[!NOTE]
|
||||
>A Recovery Request expires two hours after it is created. If a Recovery Request is not completed in this time, you will have to restart the Recovery Request process.
|
||||
6. Select **SEMM Certificate** from the list of certificates displayed on the **Choose a SEMM reset key** page (shown in Figure 7), and then click or press **Next**.
|
||||
|
||||
|
||||
@ -101,7 +104,8 @@ To initiate a Recovery Request, follow these steps:
|
||||
* To use the Recovery Request (Reset Request) as text, simply type the text directly into Microsoft Surface UEFI Configurator.
|
||||
|
||||
8. Open Microsoft Surface UEFI Configurator from the Start menu on another computer.
|
||||
>**Note:** Microsoft Surface UEFI Configurator must run in an environment that is able to authenticate the certificate chain for the SEMM certificate.
|
||||
>[!NOTE]
|
||||
>Microsoft Surface UEFI Configurator must run in an environment that is able to authenticate the certificate chain for the SEMM certificate.
|
||||
9. Click **Start**.
|
||||
10. Click **Recovery Request**, as shown in Figure 10.
|
||||
|
||||
|
||||
@ -16,6 +16,7 @@ Find out how to download and manage the latest firmware and driver updates for y
|
||||
|
||||
| Topic | Description |
|
||||
| --- | --- |
|
||||
|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | See how you can use Wake On LAN to remotely wake up devices to perform management or maintenance tasks, or to enable management solutions automatically. |
|
||||
| [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)| Get a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.|
|
||||
| [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)| Explore the available options to manage firmware and driver updates for Surface devices.|
|
||||
| [Manage Surface Dock firmware updates](manage-surface-dock-firmware-updates.md)| Read about the different methods you can use to manage the process of Surface Dock firmware updates.|
|
||||
|
||||
@ -45,8 +45,11 @@ Performing an upgrade deployment of Windows 10 requires the same tools and resou
|
||||
You will also need to have available the following resources:
|
||||
|
||||
* Windows 10 installation files, such as the installation media downloaded from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx)
|
||||
>**Note:** Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT.
|
||||
* [Surface firmware and drivers](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10
|
||||
|
||||
>[!NOTE]
|
||||
>Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT.
|
||||
* [Surface firmware and drivers](https://technet.microsoft.com/en-us/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10
|
||||
|
||||
* Application installation files for any applications you want to install, such as the Surface app
|
||||
|
||||
## Prepare the upgrade deployment
|
||||
@ -102,7 +105,8 @@ Create the upgrade task sequence with the following process:
|
||||
1. In the Deployment Workbench under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard.
|
||||
2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard:
|
||||
- **General Settings** – Enter an identifier for the deployment task sequence in the Task Sequence ID field, a name for the deployment task sequence in the Task Sequence Name field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, and then click **Next**.
|
||||
>**Note:** The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
|
||||
>[!NOTE]
|
||||
>The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
|
||||
- **Select Template** – Select **Standard Client Upgrade Task Sequence** from the drop-down menu, and then click **Next**.
|
||||
- **Select OS** – Navigate to and select the Windows image that you imported, and then click **Next**.
|
||||
- **Specify Product Key** – Select the product key entry that fits your organization’s licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**.
|
||||
|
||||
56
devices/surface/wake-on-lan-for-surface-devices.md
Normal file
56
devices/surface/wake-on-lan-for-surface-devices.md
Normal file
@ -0,0 +1,56 @@
|
||||
---
|
||||
title: Wake On LAN for Surface devices (Surface)
|
||||
description: See how you can use Wake On LAN to remotely wake up devices to perform management or maintenance tasks, or to enable management solutions automatically – even if the devices are powered down.
|
||||
keywords: update, deploy, driver, wol, wake-on-lan
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.pagetype: surface, devices
|
||||
ms.sitesec: library
|
||||
author: jobotto
|
||||
---
|
||||
|
||||
# Wake On LAN for Surface devices
|
||||
|
||||
Surface devices that run Windows 10, version 1607 (also known as Windows 10 Anniversary Update) or later and use a Surface Ethernet adapter to connect to a wired network, are capable of Wake On LAN (WOL) from Connected Standby. With WOL, you can remotely wake up devices to perform management or maintenance tasks or enable management solutions (such as System Center Configuration Manager) automatically – even if the devices are powered down. For example, you can deploy applications to Surface devices left docked with a Surface Dock or Surface Pro 3 Docking Station by using System Center Configuration Manager during a window in the middle of the night, when the office is empty.
|
||||
|
||||
>[!NOTE]
|
||||
>Surface devices must be connected to AC power to support WOL.
|
||||
|
||||
## Supported devices
|
||||
|
||||
The following devices are supported for WOL:
|
||||
|
||||
* Surface Book
|
||||
* Surface Pro 4
|
||||
* Surface Pro 3
|
||||
* Surface 3
|
||||
* Surface Ethernet adapter
|
||||
* Surface Dock
|
||||
* Surface Docking Station for Surface Pro 3
|
||||
|
||||
## WOL driver
|
||||
|
||||
To enable WOL support on Surface devices, a specific driver for the Surface Ethernet adapter is required. This driver is not included in the standard driver and firmware pack for Surface devices – you must download and install it separately. You can download the Surface WOL driver (SurfaceWOL.msi) from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center.
|
||||
|
||||
You can run this Microsoft Windows Installer (.msi) file on a Surface device to install the Surface WOL driver, or you can distribute it to Surface devices with an application deployment solution, such as System Center Configuration Manager. To include the Surface WOL driver during deployment, you can install the .msi file as an application during the deployment process. You can also extract the Surface WOL driver files to include them in the deployment process. For example, you can include them in your Microsoft Deployment Toolkit (MDT) deployment share. You can read more about Surface deployment with MDT in [Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/deploy-windows-10-to-surface-devices-with-mdt).
|
||||
|
||||
>[!NOTE]
|
||||
>During the installation of SurfaceWOL.msi, the following registry key is set to a value of 1, which allows easy identification of systems where the WOL driver has been installed. If you chose to extract and install these drivers separately during deployment, this registry key will not be configured and must be configured manually or with a script.
|
||||
|
||||
>**HKLM\SYSTEM\CurrentControlSet\Control\Power AllowSystemRequiredPowerRequests**
|
||||
|
||||
To extract the contents of SurfaceWOL.msi, use the MSIExec administrative installation option (**/a**), as shown in the following example, to extract the contents to the C:\WOL\ folder:
|
||||
|
||||
`msiexec /a surfacewol.msi targetdir=C:\WOL /qn`
|
||||
|
||||
## Using Surface WOL
|
||||
|
||||
The Surface WOL driver conforms to the WOL standard, whereby the device is woken by a special network communication known as a magic packet. The magic packet consists of 6 bytes of 255 (or FF in hexadecimal) followed by 16 repetitions of the target computer’s MAC address. You can read more about the magic packet and the WOL standard on [Wikipedia](https://wikipedia.org/wiki/Wake-on-LAN#Magic_packet).
|
||||
|
||||
>[!NOTE]
|
||||
>To send a magic packet and wake up a device by using WOL, you must know the MAC address of the target device and Ethernet adapter. Because the magic packet does not use the IP network protocol, it is not possible to use the IP address or DNS name of the device.
|
||||
|
||||
Many management solutions, such as System Center Configuration Manager, provide built-in support for WOL. There are also many solutions, including Windows Store apps, PowerShell modules, third-party applications, and third-party management solutions that allow you to send a magic packet to wake up a device. For example, you can use the [Wake On LAN PowerShell module](https://gallery.technet.microsoft.com/scriptcenter/Wake-On-Lan-815424c4) from the TechNet Script Center.
|
||||
|
||||
>[!NOTE]
|
||||
>After a device has been woken up with a magic packet, the device will return to sleep if an application is not actively preventing sleep on the system or if the AllowSystemRequiredPowerRequests registry key is not configured to 1, which allows applications to prevent sleep. See the [WOL driver](#wol-driver) section of this article for more information about this registry key.
|
||||
@ -17,5 +17,6 @@
|
||||
## [Deployment recommendations for school IT administrators](edu-deployment-recommendations.md)
|
||||
## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
|
||||
## [Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
|
||||
## [Upgrade Windows 10 Pro to Pro Education from Windows Store for Business](windows-10-pro-to-pro-edu-upgrade.md)
|
||||
## [Chromebook migration guide](chromebook-migration-guide.md)
|
||||
## [Change history for Windows 10 for Education](change-history-edu.md)
|
||||
|
||||
@ -12,6 +12,16 @@ author: jdeckerMS
|
||||
|
||||
This topic lists new and updated topics in the [Windows 10 for Education](index.md) documentation.
|
||||
|
||||
## January 2017
|
||||
| New or changed topic | Description |
|
||||
| --- | --- |
|
||||
| [For IT administrators - get Minecraft: Education Edition](school-get-minecraft.md) | Updates. Learn how schools can use invoices to pay for Minecraft: Education Edition. |
|
||||
|
||||
## December 2016
|
||||
| New or changed topic | Description |
|
||||
| --- | --- |
|
||||
| [Upgrade Windows 10 Pro to Pro Education from Windows Store for Business](windows-10-pro-to-pro-edu-upgrade.md) | New. Learn how to opt-in to a free upgrade to Windows 10 Pro Education. |
|
||||
|
||||
## November 2016
|
||||
|
||||
| New or changed topic | Description|
|
||||
|
||||
@ -597,7 +597,7 @@ To create a new Office 365 Education subscription for use in the classroom, use
|
||||
|
||||
2. On the **Get started** page, in **Enter your school email address**, type your school email address, and then click **Sign up**.
|
||||
|
||||
You will receive an email in your school email account.
|
||||
You will receive an email in your school email account.
|
||||
3. Click the hyperlink in the email in your school email account.
|
||||
|
||||
4. On the **One last thing** page, complete your user information, and then click **Start**.
|
||||
@ -627,7 +627,7 @@ Now that you have created your new Office 365 Education subscription, add the do
|
||||
|
||||
To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant.
|
||||
|
||||
>**Note** By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries require opt-in steps to add new users to existing Office 365 tenants. Check your country requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush).
|
||||
>**Note** By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush).
|
||||
|
||||
Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks:
|
||||
|
||||
@ -841,7 +841,7 @@ After you have selected your user and group account bulk import method, you’re
|
||||
|
||||
With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method.
|
||||
|
||||
>**Note** Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts.
|
||||
>**Note** Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts.
|
||||
|
||||
For more information about how to import user accounts into AD DS by using:
|
||||
|
||||
@ -891,7 +891,7 @@ Microsoft Exchange Online uses an email distribution group as a single email rec
|
||||
|
||||
You can create email distribution groups based on job role (such as teacher, administration, or student) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group.
|
||||
|
||||
>**Note** Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps.
|
||||
>**Note** Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps.
|
||||
|
||||
|
||||
For information about creating email distribution groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US).
|
||||
@ -935,7 +935,7 @@ To create and configure your Windows Store for Business portal, simply use the a
|
||||
|
||||
5. In the **Welcome to the Windows Store for Business** dialog box, click **OK**.
|
||||
|
||||
After you create the Windows Store for Business portal, configure it by using the commands in the **Settings** menu listed in Table 14. Depending on your institution, you may (or may not) need to change these settings to further customize your portal.
|
||||
After you create the Windows Store for Business portal, configure it by using the commands in the **Settings** menu listed in Table 14. Depending on your institution, you may (or may not) need to change these settings to further customize your portal.
|
||||
|
||||
|Menu selection|What can you do in this menu|
|
||||
|--------------|----------------------------|
|
||||
@ -1171,7 +1171,7 @@ For more information about how to update a deployment share, see [Update a Deplo
|
||||
|
||||
>**Note** If you have already configured your System Center Configuration Manager infrastructure to support the operating system deployment feature or if you selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next section.
|
||||
|
||||
Before you can use System Center Configuration Manager to deploy Windows 10 and manage your apps and devices, you must configure System Center Configuration Manager to support the operating system deployment feature. If you don’t have an existing System Center Configuration Manager infrastructure, you will need to deploy a new infrastructure.
|
||||
Before you can use System Center Configuration Manager to deploy Windows 10 and manage your apps and devices, you must configure System Center Configuration Manager to support the operating system deployment feature. If you don’t have an existing System Center Configuration Manager infrastructure, you will need to deploy a new infrastructure.
|
||||
|
||||
Deploying a new System Center Configuration Manager infrastructure is beyond the scope of this guide, but the following resources can help you deploy a new System Center Configuration Manager infrastructure:
|
||||
|
||||
@ -1217,9 +1217,9 @@ You can use Windows Deployment Services in conjunction with MDT to automatically
|
||||
* [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/en-us/library/jj648426.aspx)
|
||||
|
||||
2. Add LTI boot images (Windows PE images) to Windows Deployment Services.
|
||||
|
||||
|
||||
The LTI boot images (.wim files) that you will add to Windows Deployment Services are in the MDT deployment share. Locate the .wim files in the deployment share’s Boot subfolder.
|
||||
|
||||
|
||||
For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](https://technet.microsoft.com/en-us/library/dn759415.aspx#AddLTIBootImagestoWindowsDeploymentServices).
|
||||
|
||||
### Configure Window Deployment Services for System Center Configuration Manager
|
||||
@ -1231,9 +1231,9 @@ You can use Windows Deployment Services in conjunction with System Center Config
|
||||
#### To configure Windows Deployment Services for System Center Configuration Manager
|
||||
|
||||
1. Set up and configure Windows Deployment Services.
|
||||
|
||||
|
||||
Windows Deployment Services is a server role available in all Windows Server editions. You can enable the Windows Deployment Services server role on a new server or on any server running Windows Server in your institution.
|
||||
|
||||
|
||||
For more information about how to perform this step, see the following resources:
|
||||
* [Windows Deployment Services Overview](https://technet.microsoft.com/library/hh831764.aspx)
|
||||
* The Windows Deployment Services Help file, included in Windows Deployment Services
|
||||
@ -1244,9 +1244,9 @@ You can use Windows Deployment Services in conjunction with System Center Config
|
||||
To support PXE boot requests, you install the PXE service point site system role. Then, you must configure one or more distribution points to respond to PXE boot request.
|
||||
For more information about how to perform this step, see [Install site system roles for System Center Configuration Manager](https://technet.microsoft.com/en-us/library/mt704036.aspx), [Use PXE to deploy Windows over the network with System Center Configuration Manager](https://technet.microsoft.com/en-us/library/mt627940.aspx), and [Configuring distribution points to accept PXE requests](https://technet.microsoft.com/en-us/library/mt627944.aspx#BKMK_PXEDistributionPoint).
|
||||
3. Configure the appropriate boot images (Windows PE images) to deploy from the PXE-enabled distribution point.
|
||||
|
||||
|
||||
Before a device can start a boot image from a PXE-enabled distribution point, you must change the properties of the boot image to enable PXE booting. Typically, you create this boot image when you created your MDT task sequence in the Configuration Manager console.
|
||||
|
||||
|
||||
For more information about how to perform this step, see [Configure a boot image to deploy from a PXE-enabled distribution point](https://technet.microsoft.com/en-us/library/mt627946.aspx#BKMK_BootImagePXE) and [Manage boot images with System Center Configuration Manager](https://technet.microsoft.com/en-us/library/mt627946.aspx).
|
||||
|
||||
#### Summary
|
||||
@ -1271,8 +1271,8 @@ You initially configured the MDT deployment share in the [Configure the MDT depl
|
||||
|
||||
1. Create a task sequence to deploy the appropriate Windows 10 edition.
|
||||
|
||||
A task sequence can deploy only one Windows 10 edition or version, which means that you must create a task sequence for each Windows 10 edition and version you selected in the [Select the operating systems](#select-the-operating-systems) section earlier in this guide. To create task sequences, use the New Task Sequence Wizard.
|
||||
|
||||
A task sequence can deploy only one Windows 10 edition or version, which means that you must create a task sequence for each Windows 10 edition and version you selected in the [Select the operating systems](#select-the-operating-systems) section earlier in this guide. To create task sequences, use the New Task Sequence Wizard.
|
||||
|
||||
For more information, see [Create a New Task Sequence in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewTaskSequenceintheDeploymentWorkbench).
|
||||
2. Create an MDT application for each desktop app you want to include in your reference image.
|
||||
|
||||
@ -1280,12 +1280,12 @@ You initially configured the MDT deployment share in the [Configure the MDT depl
|
||||
3. Customize the task sequence to install the MDT applications that you created in step 2.
|
||||
|
||||
You can add an **Install Application** task sequence step to your task sequence. Then, you can customize the **Install Application** task sequence step to install a specific app, which automatically installs the app with no user interaction required when your run the task sequence.
|
||||
|
||||
|
||||
You need to add an **Install Application** task sequence step for each app you want to include in your reference image. For more information, see [Customize Application Installation in Task Sequences](http://technet.microsoft.com/en-us/library/dn759415.aspx#CustomizeApplicationInstallationinTaskSequences).
|
||||
4. Create a selection profile that contains the drivers for the device.
|
||||
|
||||
A *selection profile* lets you select specific device drivers. For example, if you want to deploy the device drivers for a Surface Pro 4 device, you can create a selection profile that contains only the Surface Pro 4 device drivers.
|
||||
|
||||
|
||||
First, in the Out-of-Box Drivers node in the Deployment Workbench, create a folder that will contain your device drivers. Next, import the device drivers into the folder you just created. Finally, create the selection profile and specify the folder that contains the device drivers. For more information, see the following resources:
|
||||
|
||||
* [Create Folders to Organize Device Drivers for LTI Deployments](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateFolderstoOrganizeDeviceDriversforLTIDeployments)
|
||||
@ -1334,7 +1334,7 @@ For more information about how to create a task sequence in the:
|
||||
* Configuration Manager console, see [Create a task sequence to install an operating system in System Center Configuration Manager](https://technet.microsoft.com/en-us/library/mt627927.aspx).
|
||||
|
||||
####Summary
|
||||
In this section, you customized the MDT deployment share to deploy Windows 10 and desktop apps to one or more reference devices by creating and customizing MDT applications, device drivers, and applications. Next, you ran the task sequence, which deploys Windows 10, deploys your apps, deploys the appropriate device drivers, and captures an image of the reference device. Then, you imported the captured reference image into a deployment share or System Center Configuration Manager. Finally, you created a task sequence to deploy your captured reference image to faculty and student devices. At this point in the process, you’re ready to deploy Windows 10 and your apps to your devices.
|
||||
In this section, you customized the MDT deployment share to deploy Windows 10 and desktop apps to one or more reference devices by creating and customizing MDT applications, device drivers, and applications. Next, you ran the task sequence, which deploys Windows 10, deploys your apps, deploys the appropriate device drivers, and captures an image of the reference device. Then, you imported the captured reference image into a deployment share or System Center Configuration Manager. Finally, you created a task sequence to deploy your captured reference image to faculty and student devices. At this point in the process, you’re ready to deploy Windows 10 and your apps to your devices.
|
||||
|
||||
## Prepare for device management
|
||||
|
||||
@ -1548,7 +1548,7 @@ In this section, you prepared your institution for device management. You identi
|
||||
|
||||
## Deploy Windows 10 to devices
|
||||
|
||||
You’re ready to deploy Windows 10 to faculty and student devices. You must complete the steps in this section for each student device in the classrooms as well as for any new student devices you add in the future. You can also perform these actions for any device that’s eligible for a Windows 10 upgrade. This section discusses deploying Windows 10 to new devices, refreshing Windows 10 on existing devices, and upgrading existing devices that are running eligible versions of Windows 8.1 or Windows 7 to Windows 10.
|
||||
You’re ready to deploy Windows 10 to faculty and student devices. You must complete the steps in this section for each student device in the classrooms as well as for any new student devices you add in the future. You can also perform these actions for any device that’s eligible for a Windows 10 upgrade. This section discusses deploying Windows 10 to new devices, refreshing Windows 10 on existing devices, and upgrading existing devices that are running eligible versions of Windows 8.1 or Windows 7 to Windows 10.
|
||||
|
||||
### Prepare for deployment
|
||||
|
||||
@ -1838,7 +1838,7 @@ Follow the same steps you followed in the [Deploy Windows 10 to devices](#deploy
|
||||
|
||||
#### Summary
|
||||
|
||||
You have now identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your district and individual school configuration should match the typical school configuration you saw in the [Plan a typical district configuration](#plan-a-typical-district-configuration) section. By performing these maintenance tasks, you help ensure that your district as a whole stays secure and is configured as you specified.
|
||||
You have now identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your district and individual school configuration should match the typical school configuration you saw in the [Plan a typical district configuration](#plan-a-typical-district-configuration) section. By performing these maintenance tasks, you help ensure that your district as a whole stays secure and is configured as you specified.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -91,9 +91,9 @@ Find apps for your school using Windows Store for Business. Admins in an educati
|
||||
**To acquire apps**
|
||||
- For info on how to acquire apps, see [Acquire apps in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/acquire-apps-windows-store-for-business#acquire-apps)
|
||||
|
||||
**To add a payment method**
|
||||
**To add a payment method - debit or credit card**
|
||||
|
||||
If you the app you purchase has a price, you’ll need to provide a payment method.
|
||||
If the app you purchase has a price, you’ll need to provide a payment method.
|
||||
- Click **Get started! Add a way to pay.** Provide the info needed for your debit or credit card.
|
||||
|
||||
For more information on payment options, see [payment options](https://technet.microsoft.com/itpro/windows/manage/acquire-apps-windows-store-for-business#payment-options).
|
||||
|
||||
BIN
education/windows/images/mcee-add-payment-method.png
Normal file
BIN
education/windows/images/mcee-add-payment-method.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
BIN
education/windows/images/mcee-invoice-bills.PNG
Normal file
BIN
education/windows/images/mcee-invoice-bills.PNG
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 5.8 KiB |
BIN
education/windows/images/mcee-invoice-info.png
Normal file
BIN
education/windows/images/mcee-invoice-info.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
BIN
education/windows/images/mcee-view-bills.png
Normal file
BIN
education/windows/images/mcee-view-bills.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 81 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 25 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 54 KiB |
BIN
education/windows/images/win10-connect-to-work-or-school.png
Normal file
BIN
education/windows/images/win10-connect-to-work-or-school.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 42 KiB |
BIN
education/windows/images/win10-lets-get-2.png
Normal file
BIN
education/windows/images/win10-lets-get-2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 39 KiB |
BIN
education/windows/images/win10-set-up-work-or-school.png
Normal file
BIN
education/windows/images/win10-set-up-work-or-school.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 52 KiB |
BIN
education/windows/images/windows-ad-connect.png
Normal file
BIN
education/windows/images/windows-ad-connect.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 45 KiB |
BIN
education/windows/images/windows-choose-how.png
Normal file
BIN
education/windows/images/windows-choose-how.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 19 KiB |
BIN
education/windows/images/windows-connect-to-work-or-school.png
Normal file
BIN
education/windows/images/windows-connect-to-work-or-school.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
BIN
education/windows/images/windows-lets-get-2.png
Normal file
BIN
education/windows/images/windows-lets-get-2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 25 KiB |
BIN
education/windows/images/windows-lets-get.png
Normal file
BIN
education/windows/images/windows-lets-get.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
BIN
education/windows/images/windows-set-up-work-or-school.png
Normal file
BIN
education/windows/images/windows-set-up-work-or-school.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 27 KiB |
BIN
education/windows/images/windows-sign-in.png
Normal file
BIN
education/windows/images/windows-sign-in.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 818 KiB |
BIN
education/windows/images/windows-who-owns.png
Normal file
BIN
education/windows/images/windows-who-owns.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 11 KiB |
BIN
education/windows/images/windows.png
Normal file
BIN
education/windows/images/windows.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 608 B |
Binary file not shown.
|
After Width: | Height: | Size: 164 KiB |
BIN
education/windows/images/wsfb_win10_pro_education_launch.png
Normal file
BIN
education/windows/images/wsfb_win10_pro_education_launch.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 150 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 80 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 40 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 40 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 43 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 38 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
@ -42,6 +42,13 @@ author: CelesteDG
|
||||
<b>[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)</b><br />Get step-by-step guidance on how to deploy Windows 10 to PCs and devices across a school district.</p></div>
|
||||
</div></div>
|
||||
|
||||
##  Upgrade
|
||||
|
||||
<div class="side-by-side"> <div class="side-by-side-content">
|
||||
<div class="side-by-side-content-left"><p><b>[Upgrade Windows 10 Pro to Pro Education from Windows Store for Business](windows-10-pro-to-pro-edu-upgrade.md)</b><br />If you have an education tenant and use Windows 10 Pro in your schools now, find out how you can opt-in to a free upgrade to Windows 10 Pro Education.</p></div>
|
||||
</div>
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Try it out: virtual labs and how-to videos for Windows 10 Education](https://technet.microsoft.com/en-us/windows/dn610356)
|
||||
|
||||
@ -58,6 +58,51 @@ Qualified education institutions can purchase Minecraft: Education Edition licen
|
||||
- You’ll receive an email with a link to Windows Store for Business.
|
||||
- Sign in to [Windows Store for Business](https://www.microsoft.com/business-store) to distribute and manage the Minecraft: Education Edition licenses. For more information on distribution options, see [Distribute Minecraft](#distribute-minecraft)
|
||||
|
||||
## Minecraft: Education Edition payment options
|
||||
You can pay for Minecraft: Education Edition with a debit or credit card, or with an invoice.
|
||||
|
||||
|
||||
### Debit or credit cards
|
||||
|
||||
During the purchase, click **Get started! Add a way to pay.** Provide the info needed for your debit or credit card.
|
||||
|
||||
### Invoices
|
||||
|
||||
Invoices are now a supported payment method for Minecraft: Education Edition. There are a few requirements:
|
||||
- Admins only (not supported for Teachers)
|
||||
- $500 invoice minimum for your initial purchase
|
||||
- $15,000 invoice maximum (for all invoices within your organization)
|
||||
|
||||
**To pay with an invoice**
|
||||
|
||||
1. During the purchase, click **Get started! Add a way to pay.**
|
||||
|
||||
|
||||
|
||||
2. Select the Invoice option, and provide the info needed for an invoice. The **PO number** item allows you to add a tracking number or info that is meaningful to your organization.
|
||||
|
||||
|
||||
|
||||
### Find your invoice
|
||||
|
||||
After you've finished the purchase, you can find your invoice by checking **Minecraft: Education Edition** in your **Inventory**.
|
||||
|
||||
> **Note**: After you complete a purchase, it can take up to twenty-four hours for the app to appear in **Inventory**.
|
||||
|
||||
**To view your invoice**
|
||||
1. In Windows Store for Business, click **Manage** and then click **Inventory**.
|
||||
2. Click **Minecraft: Education Edition** in the list of apps.
|
||||
3. On **Minecraft: Education Edition**, click **View Bills**.
|
||||
|
||||
|
||||
|
||||
4. On **Invoice Bills**, click the invoice number to view and download your invoice. It downloads as a .pdf.
|
||||
|
||||
|
||||
|
||||
The **Payment Instructions** section on the first page of the invoice has information on invoice amount, due date, and how to pay with electronic funds transfer, or with a check.
|
||||
|
||||
|
||||
## <a href="" id="distribute-minecraft"></a>Distribute Minecraft
|
||||
|
||||
After Minecraft: Education Edition is added to your Windows Store for Business inventory, you have three options:
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user