mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 06:17:22 +00:00
Merge branch 'master' into aljupudi-5548201-htmltomd-batch05
This commit is contained in:
Mandi Ohlinger
GitHub
commit
d2dfa284bf
@ -201,68 +201,32 @@ You can use Group Policy to finish setting up Enterprise Site Discovery. If you
|
|||||||
You can use both the WMI and XML settings individually or together:
|
You can use both the WMI and XML settings individually or together:
|
||||||
|
|
||||||
**To turn off Enterprise Site Discovery**
|
**To turn off Enterprise Site Discovery**
|
||||||
<table>
|
|
||||||
<tr>
|
|Setting name |Option |
|
||||||
<th>Setting name</th>
|
|---------|---------|
|
||||||
<th>Option</th>
|
|Turn on Site Discovery WMI output | Off |
|
||||||
</tr>
|
|Turn on Site Discovery XML output | Blank |
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery WMI output</td>
|
|
||||||
<td>Off</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery XML output</td>
|
|
||||||
<td>Blank</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
**Turn on WMI recording only**
|
**Turn on WMI recording only**
|
||||||
<table>
|
|
||||||
<tr>
|
|Setting name |Option |
|
||||||
<th>Setting name</th>
|
|---------|---------|
|
||||||
<th>Option</th>
|
|Turn on Site Discovery WMI output | On |
|
||||||
</tr>
|
|Turn on Site Discovery XML output | Blank |
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery WMI output</td>
|
|
||||||
<td>On</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery XML output</td>
|
|
||||||
<td>Blank</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
**To turn on XML recording only**
|
**To turn on XML recording only**
|
||||||
<table>
|
|
||||||
<tr>
|
|Setting name |Option |
|
||||||
<th>Setting name</th>
|
|---------|---------|
|
||||||
<th>Option</th>
|
|Turn on Site Discovery WMI output | Off |
|
||||||
</tr>
|
|Turn on Site Discovery XML output | XML file path |
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery WMI output</td>
|
|
||||||
<td>Off</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery XML output</td>
|
|
||||||
<td>XML file path</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
**To turn on both WMI and XML recording**
|
**To turn on both WMI and XML recording**
|
||||||
<table>
|
|
||||||
<tr>
|
|Setting name |Option |
|
||||||
<th>Setting name</th>
|
|---------|---------|
|
||||||
<th>Option</th>
|
|Turn on Site Discovery WMI output | On |
|
||||||
</tr>
|
|Turn on Site Discovery XML output | XML file path |
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery WMI output</td>
|
|
||||||
<td>On</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery XML output</td>
|
|
||||||
<td>XML file path</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
## Use Configuration Manager to collect your data
|
## Use Configuration Manager to collect your data
|
||||||
After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options:
|
After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options:
|
||||||
|
|||||||
@ -60,132 +60,21 @@ Make sure that you don't specify a protocol when adding your URLs. Using a URL l
|
|||||||
|
|
||||||
### Schema elements
|
### Schema elements
|
||||||
This table includes the elements used by the Enterprise Mode schema.
|
This table includes the elements used by the Enterprise Mode schema.
|
||||||
|
|Element |Description |Supported browser |
|
||||||
<table>
|
|---------|---------|---------|
|
||||||
<thead>
|
|<rules> | Root node for the schema.<br>**Example** <pre class="syntax"><rules version="205"> <br> <emie> <br> <domain>contoso.com</domain> <br> </emie><br> </rules> |Internet Explorer 11 and Microsoft Edge |
|
||||||
<tr class="header">
|
|<emie> |The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied. <br> **Example** <pre class="syntax"><rules version="205"> <br> <emie> <br> <domain>contoso.com</domain> <br> </emie><br></rules> <br> </pre><p> **or** <br> For IPv6 ranges: <pre class="syntax"><br><rules version="205"> <br> <emie> <br> <domain>[10.122.34.99]:8080</domain> <br> </emie><br></rules> </pre><p> <br> **or**<br> For IPv4 ranges:<pre class="syntax"><rules version="205"> <br> <emie> <br> <domain>[10.122.34.99]:8080</domain> <br> </emie><br></rules> | Internet Explorer 11 and Microsoft Edge |
|
||||||
<th>Element</th>
|
|<docMode> |The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the docMode section that uses the same value as a <domain> element in the emie section, the emie element is applied. <br> **Example** <pre class="syntax"> <br/><rules version="205"> <br> <docmode> <br> <domain docMode="7">contoso.com</domain> <br> </docmode><br></rules> |Internet Explorer 11 |
|
||||||
<th>Description</th>
|
|<domain> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element. <br> **Example** <pre class="syntax"> <br/><emie> <br> <domain>contoso.com:8080</domain><br></emie> |Internet Explorer 11 and Microsoft Edge |
|
||||||
<th>Supported browser</th>
|
|<path> |A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section.<br> **Example** <pre class="syntax"> <br/><emie> <br> <domain exclude="false">fabrikam.com <br> <path exclude="true">/products</path><br> </domain><br></emie></pre><p> <br> Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does. |Internet Explorer 11 and Microsoft Edge |
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><rules></td>
|
|
||||||
<td>Root node for the schema.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<rules version="205">
|
|
||||||
<emie>
|
|
||||||
<domain>contoso.com</domain>
|
|
||||||
</emie>
|
|
||||||
</rules></pre></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><emie></td>
|
|
||||||
<td>The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<rules version="205">
|
|
||||||
<emie>
|
|
||||||
<domain>contoso.com</domain>
|
|
||||||
</emie>
|
|
||||||
</rules></pre>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv6 ranges:<pre class="syntax"><rules version="205">
|
|
||||||
<emie>
|
|
||||||
<domain>[10.122.34.99]:8080</domain>
|
|
||||||
</emie>
|
|
||||||
</rules></pre>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv4 ranges:<pre class="syntax"><rules version="205">
|
|
||||||
<emie>
|
|
||||||
<domain>10.122.34.99:8080</domain>
|
|
||||||
</emie>
|
|
||||||
</rules></pre></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><docMode></td>
|
|
||||||
<td>The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the <docMode> section that uses the same value as a <domain> element in the <emie> section, the <emie> element is applied.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<rules version="205">
|
|
||||||
<docMode>
|
|
||||||
<domain docMode="7">contoso.com</domain>
|
|
||||||
</docMode>
|
|
||||||
</rules></pre></td>
|
|
||||||
<td>Internet Explorer 11</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><domain></td>
|
|
||||||
<td>A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain>contoso.com:8080</domain>
|
|
||||||
</emie></pre></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><path></td>
|
|
||||||
<td>A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain exclude="false">fabrikam.com
|
|
||||||
<path exclude="true">/products</path>
|
|
||||||
</domain>
|
|
||||||
</emie></pre><p>
|
|
||||||
Where https://fabrikam.com doesn't use IE8 Enterprise Mode, but https://fabrikam.com/products does.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
### Schema attributes
|
### Schema attributes
|
||||||
This table includes the attributes used by the Enterprise Mode schema.
|
This table includes the attributes used by the Enterprise Mode schema.
|
||||||
|
|Attribute|Description|Supported browser|
|
||||||
<table>
|
|--- |--- |--- |
|
||||||
<thead>
|
|<version>|Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.|Internet Explorer 11 and Microsoft Edge|
|
||||||
<tr class="header">
|
|<exclude>|Specifies the domain or path that is excluded from getting the behavior applied. This attribute is supported on the <domain> and <path> elements.<br> **Example** <pre class="syntax"><emie><br> <domain exclude="false">fabrikam.com <br> <path exclude="true">/products</path><br> </domain><br></emie> </pre><p> Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does.|Internet Explorer 11 and Microsoft Edge|
|
||||||
<th>Attribute</th>
|
|<docMode>|Specifies the document mode to apply. This attribute is only supported on <domain> or <path>elements in the <docMode> section.<br> **Example**<pre class="syntax"><docMode> <br> <domain exclude="false">fabrikam.com <br> <path docMode="7">/products</path><br> </domain><br></docMode>|Internet Explorer 11|
|
||||||
<th>Description</th>
|
|
||||||
<th>Supported browser</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><version></td>
|
|
||||||
<td>Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><exclude></td>
|
|
||||||
<td>Specifies the domain or path that is excluded from getting the behavior applied. This attribute is supported on the <domain> and <path> elements.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain exclude="false">fabrikam.com
|
|
||||||
<path exclude="true">/products</path>
|
|
||||||
</domain>
|
|
||||||
</emie></pre><p>
|
|
||||||
Where https://fabrikam.com doesn't use IE8 Enterprise Mode, but https://fabrikam.com/products does.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><docMode></td>
|
|
||||||
<td>Specifies the document mode to apply. This attribute is only supported on <domain> or <path> elements in the <docMode> section.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<docMode>
|
|
||||||
<domain exclude="false">fabrikam.com
|
|
||||||
<path docMode="7">/products</path>
|
|
||||||
</domain>
|
|
||||||
</docMode></pre></td>
|
|
||||||
<td>Internet Explorer 11</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
### Using Enterprise Mode and document mode together
|
### Using Enterprise Mode and document mode together
|
||||||
If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain.
|
If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain.
|
||||||
|
|||||||
@ -92,194 +92,32 @@ Make sure that you don't specify a protocol when adding your URLs. Using a URL l
|
|||||||
### Updated schema elements
|
### Updated schema elements
|
||||||
This table includes the elements used by the v.2 version of the Enterprise Mode schema.
|
This table includes the elements used by the v.2 version of the Enterprise Mode schema.
|
||||||
|
|
||||||
<table>
|
|
||||||
<thead>
|
|Element |Description |Supported browser |
|
||||||
<tr class="header">
|
|---------|---------|---------|
|
||||||
<th>Element</th>
|
|<site-list> |A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>. <br> **Example** <br> <pre class="syntax"><site-list version="205"><br> <site url="contoso.com"><br> <compat-mode>IE8Enterprise</compat-mode><br> <open-in>IE11</open-in><br> </site><br></site-list></pre> | Internet Explorer 11 and Microsoft Edge |
|
||||||
<th>Description</th>
|
|<site> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element. <br> **Example** <pre class="syntax"><site url="contoso.com"><br> <compat-mode>default</compat-mode><br> <open-in>none</open-in><br></site></pre> <br> **or** For IPv4 ranges: <br> <pre class="syntax"><site url="10.122.34.99:8080"><br> <compat-mode>IE8Enterprise</compat-mode><br><site></pre><p> <br> **or** For IPv6 ranges:<pre class="syntax"><site url="[10.122.34.99]:8080"><br> <compat-mode>IE8Enterprise</compat-mode><br><site></pre><p> <br> You can also use the self-closing version, <url="contoso.com" />, which also sets:<ul><li><compat-mode>default</compat-mode></li><li><open-in>none</open-in></li>| Internet Explorer 11 and Microsoft Edge |
|
||||||
<th>Supported browser</th>
|
|<compat-mode> |A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11. <br> **Example** <pre class="syntax"><br><site url="contoso.com"><br> <compat-mode>IE8Enterprise</compat-mode><br></site></pre> **or** <br> For IPv4 ranges:<pre class="syntax"><site url="10.122.34.99:8080"><br> <compat-mode>IE8Enterprise</compat-mode><br><site></pre><p> **or** For IPv6 ranges:<pre class="syntax"><site url="[10.122.34.99]:8080"><br> <compat-mode>IE8Enterprise</compat-mode><br><site></pre><p> Where<ul><li>**IE8Enterprise.** Loads the site in IE8 Enterprise Mode.<br>This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE8 Enterprise Mode.</li><p><li>**IE7Enterprise.** Loads the site in IE7 Enterprise Mode.<br>This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE7 Enterprise Mode<p>**Important**<br>This tag replaces the combination of the `"forceCompatView"="true"` attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.<li>**IE<i>[x]</i>**. Where <i>[x]</i> is the document mode number into which the site loads.<li>**Default or not specified.** Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.</li> |Internet Explorer 11 |
|
||||||
</tr>
|
|<open-in> |A child element that controls what browser is used for sites. This element supports the **Open in IE11** or **Open in Microsoft Edge** experiences, for devices running Windows 10.<br> **Examples**<pre class="syntax"><site url="contoso.com"><br> <open-in>none</open-in> <br></site></pre><p> <br> Where<ul><li><b>IE11.</b> Opens the site in IE11, regardless of which browser is opened by the employee.<li><b>MSEdge.</b> Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.<li><b>None or not specified.</b> Opens in whatever browser the employee chooses.</li> | Internet Explorer 11 and Microsoft Edge |
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><site-list></td>
|
|
||||||
<td>A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site-list version="205">
|
|
||||||
<site url="contoso.com">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<open-in>IE11</open-in>
|
|
||||||
</site>
|
|
||||||
</site-list></pre></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><site></td>
|
|
||||||
<td>A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com">
|
|
||||||
<compat-mode>default</compat-mode>
|
|
||||||
<open-in>none</open-in>
|
|
||||||
</site></pre>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv4 ranges:<pre class="syntax"><site url="10.122.34.99:8080">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<site></pre><p>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv6 ranges:<pre class="syntax"><site url="[10.122.34.99]:8080">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<site></pre><p>
|
|
||||||
You can also use the self-closing version, <url="contoso.com" />, which also sets:
|
|
||||||
<ul>
|
|
||||||
<li><compat-mode>default</compat-mode></li>
|
|
||||||
<li><open-in>none</open-in></li>
|
|
||||||
</ul></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><compat-mode></td>
|
|
||||||
<td>A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
</site></pre>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv4 ranges:<pre class="syntax"><site url="10.122.34.99:8080">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<site></pre><p>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv6 ranges:<pre class="syntax"><site url="[10.122.34.99]:8080">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<site></pre><p>
|
|
||||||
Where:
|
|
||||||
<ul>
|
|
||||||
<li><b>IE8Enterprise.</b> Loads the site in IE8 Enterprise Mode.<br>This element is required for sites included in the <b>EmIE</b> section of the v.1 schema and is needed to load in IE8 Enterprise Mode.</li><p>
|
|
||||||
<li><b>IE7Enterprise.</b> Loads the site in IE7 Enterprise Mode.<br>This element is required for sites included in the <b>EmIE</b> section of the v.1 schema and is needed to load in IE7 Enterprise Mode.<p><b>Important</b><br>This tag replaces the combination of the `"forceCompatView"="true"` attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.</li><p>
|
|
||||||
<li><b>IE<i>[x]</i>.</b> Where <i>[x]</i> is the document mode number into which the site loads.</li><p>
|
|
||||||
<li><b>Default or not specified.</b> Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.</li>
|
|
||||||
</ul></td>
|
|
||||||
<td>Internet Explorer 11</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><open-in></td>
|
|
||||||
<td>A child element that controls what browser is used for sites. This element supports the <b>Open in IE11</b> or <b>Open in Microsoft Edge</b> experiences, for devices running Windows 10.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com">
|
|
||||||
<open-in>none</open-in>
|
|
||||||
</site></pre><p>
|
|
||||||
Where:
|
|
||||||
<ul>
|
|
||||||
<li><b>IE11.</b> Opens the site in IE11, regardless of which browser is opened by the employee.</li><p>
|
|
||||||
<li><b>MSEdge.</b> Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.</li><p>
|
|
||||||
<li><b>None or not specified.</b> Opens in whatever browser the employee chooses.</li>
|
|
||||||
</ul></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
### Updated schema attributes
|
### Updated schema attributes
|
||||||
The <url> attribute, as part of the <site> element in the v.2 version of the schema, replaces the <domain> element from the v.1 version of the schema.
|
The <url> attribute, as part of the <site> element in the v.2 version of the schema, replaces the <domain> element from the v.1 version of the schema.
|
||||||
|
|
||||||
<table>
|
|Attribute|Description|Supported browser|
|
||||||
<thead>
|
|---------|---------|---------|
|
||||||
<tr class="header">
|
|allow-redirect|A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).<br>**Example**<pre class="syntax"><site url="contoso.com/travel"><br> <open-in allow-redirect="true">IE11 </open-in><br></site> </pre> In this example, if [https://contoso.com/travel](https://contoso.com/travel) is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.</li>| Internet Explorer 11 and Microsoft Edge|
|
||||||
<th>Attribute</th>
|
|version |Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element. | Internet Explorer 11 and Microsoft Edge|
|
||||||
<th>Description</th>
|
|url|Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.<br> **Note**<br> Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both [https://contoso.com](https://contoso.com) and [https://contoso.com](https://contoso.com). <br> **Example**<pre class="syntax"><site url="contoso.com:8080"><br> <compat-mode>IE8Enterprise</compat-mode> <br> <open-in>IE11</open-in><br></site></pre>In this example, going to [https://contoso.com:8080](https://contoso.com:8080) using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode. | Internet Explorer 11 and Microsoft Edge|
|
||||||
<th>Supported browser</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td>allow-redirect</td>
|
|
||||||
<td>A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com/travel">
|
|
||||||
<open-in allow-redirect="true">IE11</open-in>
|
|
||||||
</site></pre>
|
|
||||||
In this example, if https://contoso.com/travel is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>version</td>
|
|
||||||
<td>Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>url</td>
|
|
||||||
<td>Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.
|
|
||||||
<br><b>Note</b><br>
|
|
||||||
Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both https://contoso.com and https://contoso.com.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com:8080">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<open-in>IE11</open-in>
|
|
||||||
</site></pre>
|
|
||||||
In this example, going to https://contoso.com:8080 using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
### Deprecated attributes
|
### Deprecated attributes
|
||||||
These v.1 version schema attributes have been deprecated in the v.2 version of the schema:
|
These v.1 version schema attributes have been deprecated in the v.2 version of the schema:
|
||||||
|
|
||||||
<table>
|
|Deprecated attribute|New attribute|Replacement example|
|
||||||
<thead>
|
|--- |--- |--- |
|
||||||
<tr class="header">
|
|<forceCompatView>|<compat-mode>|Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode>|
|
||||||
<th>Deprecated attribute</th>
|
|<docMode>|<compat-mode>|Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode>|
|
||||||
<th>New attribute</th>
|
|<doNotTransition>|<open-in>|Replace:<br> <doNotTransition="true"> with <open-in>none</open-in>|
|
||||||
<th>Replacement example</th>
|
|<domain> and <path>|<site>|Replace:<pre class="syntax"><emie><br> <domain exclude="false">contoso.com</domain><br></emie></pre>With:<pre class="syntax"><site url="contoso.com"/> <br> <compat-mode>IE8Enterprise</compat-mode><br></site></pre>**-AND-** <br>Replace:<pre class="syntax"><emie> <br> <domain exclude="true">contoso.com <br> <path exclude="false" forceCompatView="true">/about</path><br> </domain><br></emie></pre><br> With:<pre class="syntax"><site url="contoso.com/about"><br> <compat-mode>IE7Enterprise</compat-mode><br></site>|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><forceCompatView></td>
|
|
||||||
<td><compat-mode></td>
|
|
||||||
<td>Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><docMode></td>
|
|
||||||
<td><compat-mode></td>
|
|
||||||
<td>Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><doNotTransition></td>
|
|
||||||
<td><open-in></td>
|
|
||||||
<td>Replace <doNotTransition="true"> with <open-in>none</open-in></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><domain> and <path></td>
|
|
||||||
<td><site></td>
|
|
||||||
<td>Replace:
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain exclude="false">contoso.com</domain>
|
|
||||||
</emie></pre>
|
|
||||||
With:
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com"/>
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
</site></pre>
|
|
||||||
<b>-AND-</b><p>
|
|
||||||
Replace:
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain exclude="true">contoso.com
|
|
||||||
<path exclude="false" forceCompatView="true">/about</path>
|
|
||||||
</domain>
|
|
||||||
</emie></pre>
|
|
||||||
With:
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com/about">
|
|
||||||
<compat-mode>IE7Enterprise</compat-mode>
|
|
||||||
</site></pre></td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features.
|
While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features.
|
||||||
|
|
||||||
|
|||||||
@ -63,17 +63,17 @@ Data is collected on the configuration characteristics of IE and the sites it br
|
|||||||
|
|
||||||
|Data point |IE11 |IE10 |IE9 |IE8 |Description |
|
|Data point |IE11 |IE10 |IE9 |IE8 |Description |
|
||||||
|------------------------|-----|-----|-----|-----|------------------------------------------------------------------------|
|
|------------------------|-----|-----|-----|-----|------------------------------------------------------------------------|
|
||||||
|URL | X | X | X | X |URL of the browsed site, including any parameters included in the URL. |
|
|URL | ✔️ | ✔️ | ✔️ | ✔️ |URL of the browsed site, including any parameters included in the URL. |
|
||||||
|Domain | X | X | X | X |Top-level domain of the browsed site. |
|
|Domain | ✔️ | ✔️ | ✔️ | ✔️ |Top-level domain of the browsed site. |
|
||||||
|ActiveX GUID | X | X | X | X |GUID of the ActiveX controls loaded by the site. |
|
|ActiveX GUID | ✔️ | ✔️ | ✔️ | ✔️ |GUID of the ActiveX controls loaded by the site. |
|
||||||
|Document mode | X | X | X | X |Document mode used by IE for a site, based on page characteristics. |
|
|Document mode | ✔️ | ✔️ | ✔️ | ✔️ |Document mode used by IE for a site, based on page characteristics. |
|
||||||
|Document mode reason | X | X | | |The reason why a document mode was set by IE. |
|
|Document mode reason | ✔️ | ✔️ | | |The reason why a document mode was set by IE. |
|
||||||
|Browser state reason | X | X | | |Additional information about why the browser is in its current state. Also called, browser mode. |
|
|Browser state reason | ✔️ | ✔️ | | |Additional information about why the browser is in its current state. Also called, browser mode. |
|
||||||
|Hang count | X | X | X | X |Number of visits to the URL when the browser hung. |
|
|Hang count | ✔️ | ✔️ | ✔️ | ✔️ |Number of visits to the URL when the browser hung. |
|
||||||
|Crash count | X | X | X | X |Number of visits to the URL when the browser crashed. |
|
|Crash count | ✔️ | ✔️ | ✔️ | ✔️ |Number of visits to the URL when the browser crashed. |
|
||||||
|Most recent navigation failure (and count) | X | X | X | X |Description of the most recent navigation failure (like, a 404 bad request or 500 internal server error) and the number of times it happened. |
|
|Most recent navigation failure (and count) | ✔️ | ✔️ | ✔️ | ✔️ |Description of the most recent navigation failure (like, a 404 bad request or 500 internal server error) and the number of times it happened. |
|
||||||
|Number of visits | X | X | X | X |Number of times a site has been visited. |
|
|Number of visits | ✔️ | ✔️ | ✔️ | ✔️ |Number of times a site has been visited. |
|
||||||
|Zone | X | X | X | X |Zone used by IE to browse sites, based on browser settings. |
|
|Zone | ✔️ | ✔️ | ✔️ | ✔️ |Zone used by IE to browse sites, based on browser settings. |
|
||||||
|
|
||||||
|
|
||||||
>**Important**<br>By default, IE doesn’t collect this data; you have to turn this feature on if you want to use it. After you turn on this feature, data is collected on all sites visited by IE, except during InPrivate sessions. Additionally, the data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements.
|
>**Important**<br>By default, IE doesn’t collect this data; you have to turn this feature on if you want to use it. After you turn on this feature, data is collected on all sites visited by IE, except during InPrivate sessions. Additionally, the data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements.
|
||||||
@ -205,68 +205,32 @@ You can use Group Policy to finish setting up Enterprise Site Discovery. If you
|
|||||||
You can use both the WMI and XML settings individually or together:
|
You can use both the WMI and XML settings individually or together:
|
||||||
|
|
||||||
**To turn off Enterprise Site Discovery**
|
**To turn off Enterprise Site Discovery**
|
||||||
<table>
|
|
||||||
<tr>
|
|Setting name|Option|
|
||||||
<th>Setting name</th>
|
|--- |--- |
|
||||||
<th>Option</th>
|
|Turn on Site Discovery WMI output|Off|
|
||||||
</tr>
|
|Turn on Site Discovery XML output|Blank|
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery WMI output</td>
|
|
||||||
<td>Off</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery XML output</td>
|
|
||||||
<td>Blank</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
**Turn on WMI recording only**
|
**Turn on WMI recording only**
|
||||||
<table>
|
|
||||||
<tr>
|
|Setting name|Option|
|
||||||
<th>Setting name</th>
|
|--- |--- |
|
||||||
<th>Option</th>
|
|Turn on Site Discovery WMI output|On|
|
||||||
</tr>
|
|Turn on Site Discovery XML output|Blank|
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery WMI output</td>
|
|
||||||
<td>On</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery XML output</td>
|
|
||||||
<td>Blank</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
**To turn on XML recording only**
|
**To turn on XML recording only**
|
||||||
<table>
|
|
||||||
<tr>
|
|
||||||
<th>Setting name</th>
|
|
||||||
<th>Option</th>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery WMI output</td>
|
|
||||||
<td>Off</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery XML output</td>
|
|
||||||
<td>XML file path</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<strong>To turn on both WMI and XML recording</strong>
|
|Setting name|Option|
|
||||||
<table>
|
|--- |--- |
|
||||||
<tr>
|
|Turn on Site Discovery WMI output|Off|
|
||||||
<th>Setting name</th>
|
|Turn on Site Discovery XML output|XML file path|
|
||||||
<th>Option</th>
|
|
||||||
</tr>
|
**To turn on both WMI and XML recording**
|
||||||
<tr>
|
|
||||||
<td>Turn on Site Discovery WMI output</td>
|
|Setting name|Option|
|
||||||
<td>On</td>
|
|--- |--- |
|
||||||
</tr>
|
|Turn on Site Discovery WMI output|On|
|
||||||
<tr>
|
|Turn on Site Discovery XML output|XML file path|
|
||||||
<td>Turn on Site Discovery XML output</td>
|
|
||||||
<td>XML file path</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
## Use Configuration Manager to collect your data
|
## Use Configuration Manager to collect your data
|
||||||
After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options:
|
After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options:
|
||||||
|
|||||||
@ -65,162 +65,24 @@ The following is an example of the Enterprise Mode schema v.1. This schema can r
|
|||||||
### Schema elements
|
### Schema elements
|
||||||
This table includes the elements used by the Enterprise Mode schema.
|
This table includes the elements used by the Enterprise Mode schema.
|
||||||
|
|
||||||
<table>
|
|Element |Description |Supported browser |
|
||||||
<thead>
|
|---------|---------|---------|
|
||||||
<tr class="header">
|
|<rules> | Root node for the schema.<br>**Example** <pre class="syntax"><rules version="205"> <br> <emie> <br> <domain>contoso.com</domain> <br> </emie><br> </rules> |Internet Explorer 11 and Microsoft Edge |
|
||||||
<th>Element</th>
|
|<emie> |The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied. <br> **Example** <pre class="syntax"><rules version="205"> <br> <emie> <br> <domain>contoso.com</domain> <br> </emie><br></rules> <br> </pre><p> **or** <br> For IPv6 ranges: <pre class="syntax"><br><rules version="205"> <br> <emie> <br> <domain>[10.122.34.99]:8080</domain> <br> </emie><br></rules> </pre><p> <br> **or**<br> For IPv4 ranges:<pre class="syntax"><rules version="205"> <br> <emie> <br> <domain>[10.122.34.99]:8080</domain> <br> </emie><br></rules> | Internet Explorer 11 and Microsoft Edge |
|
||||||
<th>Description</th>
|
|<docMode> |The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the docMode section that uses the same value as a <domain> element in the emie section, the emie element is applied. <br> **Example** <pre class="syntax"> <br/><rules version="205"> <br> <docmode> <br> <domain docMode="7">contoso.com</domain> <br> </docmode><br></rules> |Internet Explorer 11 |
|
||||||
<th>Supported browser</th>
|
|<domain> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element. <br> **Example** <pre class="syntax"> <br/><emie> <br> <domain>contoso.com:8080</domain><br></emie> |Internet Explorer 11 and Microsoft Edge |
|
||||||
</tr>
|
|<path> |A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section.<br> **Example** <pre class="syntax"> <br/><emie> <br> <domain exclude="true">fabrikam.com <br> <path exclude="false">/products</path><br> </domain><br></emie></pre><p> <br> Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does. |Internet Explorer 11 and Microsoft Edge |
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><rules></td>
|
|
||||||
<td>Root node for the schema.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<rules version="205">
|
|
||||||
<emie>
|
|
||||||
<domain>contoso.com</domain>
|
|
||||||
</emie>
|
|
||||||
</rules></pre></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><emie></td>
|
|
||||||
<td>The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<rules version="205">
|
|
||||||
<emie>
|
|
||||||
<domain>contoso.com</domain>
|
|
||||||
</emie>
|
|
||||||
</rules></pre>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv6 ranges:<pre class="syntax"><rules version="205">
|
|
||||||
<emie>
|
|
||||||
<domain>[10.122.34.99]:8080</domain>
|
|
||||||
</emie>
|
|
||||||
</rules></pre>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv4 ranges:<pre class="syntax"><rules version="205">
|
|
||||||
<emie>
|
|
||||||
<domain>10.122.34.99:8080</domain>
|
|
||||||
</emie>
|
|
||||||
</rules></pre></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><docMode></td>
|
|
||||||
<td>The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the <docMode> section that uses the same value as a <domain> element in the <emie> section, the <emie> element is applied.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<rules version="205">
|
|
||||||
<docMode>
|
|
||||||
<domain docMode="7">contoso.com</domain>
|
|
||||||
</docMode>
|
|
||||||
</rules></pre></td>
|
|
||||||
<td>Internet Explorer 11</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><domain></td>
|
|
||||||
<td>A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain>contoso.com:8080</domain>
|
|
||||||
</emie></pre></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><path></td>
|
|
||||||
<td>A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain exclude="true">fabrikam.com
|
|
||||||
<path exclude="false">/products</path>
|
|
||||||
</domain>
|
|
||||||
</emie></pre><p>
|
|
||||||
Where <a href="https://fabrikam.com" data-raw-source="https://fabrikam.com">https://fabrikam.com</a> doesn't use IE8 Enterprise Mode, but <a href="https://fabrikam.com/products" data-raw-source="https://fabrikam.com/products">https://fabrikam.com/products</a> does.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
### Schema attributes
|
### Schema attributes
|
||||||
This table includes the attributes used by the Enterprise Mode schema.
|
This table includes the attributes used by the Enterprise Mode schema.
|
||||||
|
|
||||||
<table>
|
|Attribute|Description|Supported browser|
|
||||||
<thead>
|
|--- |--- |--- |
|
||||||
<tr class="header">
|
|version|Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.|Internet Explorer 11 and Microsoft Edge|
|
||||||
<th>Attribute</th>
|
|exclude|Specifies the domain or path that is excluded from getting the behavior applied. This attribute is supported on the <domain> and <path> elements.<br> **Example** <pre class="syntax"><emie><br> <domain exclude="false">fabrikam.com <br> <path exclude="true">/products</path><br> </domain><br></emie> </pre><p> Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does.|Internet Explorer 11 and Microsoft Edge|
|
||||||
<th>Description</th>
|
|docMode|Specifies the document mode to apply. This attribute is only supported on <domain> or <path>elements in the <docMode> section.<br> **Example**<pre class="syntax"><docMode> <br> <domain exclude="false">fabrikam.com <br> <path docMode="9">/products</path><br> </domain><br></docMode>|Internet Explorer 11|
|
||||||
<th>Supported browser</th>
|
|doNotTransition| Specifies that the page should load in the current browser, otherwise it will open in IE11. This attribute is supported on all <domain> or <path> elements. If this attribute is absent, it defaults to false.<br> **Example**<pre class="syntax"><emie><br> <domain doNotTransition="false">fabrikam.com <br> <path doNotTransition="true">/products</path><br> </domain><br></emie></pre><p>Where [https://fabrikam.com](https://fabrikam.com) opens in the IE11 browser, but [https://fabrikam.com/products](https://fabrikam.com/products) loads in the current browser (eg. Microsoft Edge)|Internet Explorer 11 and Microsoft Edge|
|
||||||
</tr>
|
|forceCompatView|Specifies that the page should load in IE7 document mode (Compat View). This attribute is only supported on <domain> or <path> elements in the <emie> section. If the page is also configured to load in Enterprise Mode, it will load in IE7 Enterprise Mode. Otherwise (exclude="true"), it will load in IE11's IE7 document mode. If this attribute is absent, it defaults to false. <br> **Example**<pre class="syntax"><emie><br> <domain exclude="true">fabrikam.com <br> <path forcecompatview="true">/products</path><br> </domain><br></emie></pre><p>Where [https://fabrikam.com](https://fabrikam.com) does not use Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) uses IE7 Enterprise Mode.|Internet Explorer 11|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td>version</td>
|
|
||||||
<td>Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>exclude</td>
|
|
||||||
<td>Specifies the domain or path excluded from applying Enterprise Mode. This attribute is only supported on the <domain> and <path> elements in the <emie> section. If this attribute is absent, it defaults to false.
|
|
||||||
<br />
|
|
||||||
<p><b>Example:</b></p>
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain exclude="false">fabrikam.com
|
|
||||||
<path exclude="true">/products</path>
|
|
||||||
</domain>
|
|
||||||
</emie></pre><p>
|
|
||||||
Where <a href="https://fabrikam.com" data-raw-source="https://fabrikam.com">https://fabrikam.com</a> uses IE8 Enterprise Mode, but <a href="https://fabrikam.com/products" data-raw-source="https://fabrikam.com/products">https://fabrikam.com/products</a> does not.</p></td>
|
|
||||||
<td>Internet Explorer 11</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>docMode</td>
|
|
||||||
<td>Specifies the document mode to apply. This attribute is only supported on <domain> or <path> elements in the <docMode> section.
|
|
||||||
<br />
|
|
||||||
<p><b>Example:</b></p>
|
|
||||||
<pre class="syntax">
|
|
||||||
<docMode>
|
|
||||||
<domain>fabrikam.com
|
|
||||||
<path docMode="9">/products</path>
|
|
||||||
</domain>
|
|
||||||
</docMode></pre><p>
|
|
||||||
Where <a href="https://fabrikam.com" data-raw-source="https://fabrikam.com">https://fabrikam.com</a> loads in IE11 document mode, but <a href="https://fabrikam.com/products" data-raw-source="https://fabrikam.com/products">https://fabrikam.com/products</a> uses IE9 document mode.</p></td>
|
|
||||||
<td>Internet Explorer 11</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>doNotTransition</td>
|
|
||||||
<td>Specifies that the page should load in the current browser, otherwise it will open in IE11. This attribute is supported on all <domain> or <path> elements. If this attribute is absent, it defaults to false.
|
|
||||||
<br />
|
|
||||||
<p><b>Example:</b></p>
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain doNotTransition="false">fabrikam.com
|
|
||||||
<path doNotTransition="true">/products</path>
|
|
||||||
</domain>
|
|
||||||
</emie></pre><p>
|
|
||||||
Where <a href="https://fabrikam.com" data-raw-source="https://fabrikam.com">https://fabrikam.com</a> opens in the IE11 browser, but <a href="https://fabrikam.com/products" data-raw-source="https://fabrikam.com/products">https://fabrikam.com/products</a> loads in the current browser (eg. Microsoft Edge).</p></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>forceCompatView</td>
|
|
||||||
<td>Specifies that the page should load in IE7 document mode (Compat View). This attribute is only supported on <domain> or <path> elements in the <emie> section. If the page is also configured to load in Enterprise Mode, it will load in IE7 Enterprise Mode. Otherwise (exclude="true"), it will load in IE11's IE7 document mode. If this attribute is absent, it defaults to false.
|
|
||||||
<br />
|
|
||||||
<p><b>Example:</b></p>
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain exclude="true">fabrikam.com
|
|
||||||
<path forceCompatView="true">/products</path>
|
|
||||||
</domain>
|
|
||||||
</emie></pre><p>
|
|
||||||
Where <a href="https://fabrikam.com" data-raw-source="https://fabrikam.com">https://fabrikam.com</a> does not use Enterprise Mode, but <a href="https://fabrikam.com/products" data-raw-source="https://fabrikam.com/products">https://fabrikam.com/products</a> uses IE7 Enterprise Mode.</p></td>
|
|
||||||
<td>Internet Explorer 11</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
### Using Enterprise Mode and document mode together
|
### Using Enterprise Mode and document mode together
|
||||||
If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain.
|
If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain.
|
||||||
|
|||||||
@ -97,197 +97,31 @@ The following is an example of the v.2 version of the Enterprise Mode schema.
|
|||||||
### Updated schema elements
|
### Updated schema elements
|
||||||
This table includes the elements used by the v.2 version of the Enterprise Mode schema.
|
This table includes the elements used by the v.2 version of the Enterprise Mode schema.
|
||||||
|
|
||||||
<table>
|
|Element |Description |Supported browser |
|
||||||
<thead>
|
|---------|---------|---------|
|
||||||
<tr class="header">
|
|<site-list> |A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>. <br> **Example** <br> <pre class="syntax"><site-list version="205"><br> <site url="contoso.com"><br> <compat-mode>IE8Enterprise</compat-mode><br> <open-in>IE11</open-in><br> </site><br></site-list></pre> | Internet Explorer 11 and Microsoft Edge |
|
||||||
<th>Element</th>
|
|<site> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element. <br> **Example** <pre class="syntax"><site url="contoso.com"><br> <compat-mode>default</compat-mode><br> <open-in>none</open-in><br></site></pre> <br> **or** For IPv4 ranges: <br> <pre class="syntax"><site url="10.122.34.99:8080"><br> <compat-mode>IE8Enterprise</compat-mode><br><site></pre><p> <br> **or** For IPv6 ranges:<pre class="syntax"><site url="[10.122.34.99]:8080"><br> <compat-mode>IE8Enterprise</compat-mode><br><site></pre><p> <br> You can also use the self-closing version, <url="contoso.com" />, which also sets:<ul><li><compat-mode>default</compat-mode></li><li><open-in>none</open-in></li>| Internet Explorer 11 and Microsoft Edge |
|
||||||
<th>Description</th>
|
|<compat-mode> |A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11. <br> **Example** <pre class="syntax"><br><site url="contoso.com"><br> <compat-mode>IE8Enterprise</compat-mode><br></site></pre> **or** <br> For IPv4 ranges:<pre class="syntax"><site url="10.122.34.99:8080"><br> <compat-mode>IE8Enterprise</compat-mode><br><site></pre><p> **or** For IPv6 ranges:<pre class="syntax"><site url="[10.122.34.99]:8080"><br> <compat-mode>IE8Enterprise</compat-mode><br><site></pre><p> Where<ul><li>**IE8Enterprise.** Loads the site in IE8 Enterprise Mode.<br>This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE8 Enterprise Mode.</li><p><li>**IE7Enterprise.** Loads the site in IE7 Enterprise Mode.<br>This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE7 Enterprise Mode<p>**Important**<br>This tag replaces the combination of the `"forceCompatView"="true"` attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.<li>**IE<i>[x]</i>**. Where <i>[x]</i> is the document mode number into which the site loads.<li>**Default or not specified.** Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.</li> |Internet Explorer 11 |
|
||||||
<th>Supported browser</th>
|
|<open-in> |A child element that controls what browser is used for sites. This element supports the **Open in IE11** or **Open in Microsoft Edge** experiences, for devices running Windows 10.<br> **Examples**<pre class="syntax"><site url="contoso.com"><br> <open-in>none</open-in> <br></site></pre><p> <br> Where<ul><li><b>IE11.</b> Opens the site in IE11, regardless of which browser is opened by the employee.<li><b>MSEdge.</b> Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.<li><b>None or not specified.</b> Opens in whatever browser the employee chooses.</li> | Internet Explorer 11 and Microsoft Edge |
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><site-list></td>
|
|
||||||
<td>A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site-list version="205">
|
|
||||||
<site url="contoso.com">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<open-in>IE11</open-in>
|
|
||||||
</site>
|
|
||||||
</site-list></pre></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><site></td>
|
|
||||||
<td>A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com">
|
|
||||||
<compat-mode>default</compat-mode>
|
|
||||||
<open-in>none</open-in>
|
|
||||||
</site></pre>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv4 ranges:<pre class="syntax"><site url="10.122.34.99:8080">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<site></pre><p>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv6 ranges:<pre class="syntax"><site url="[10.122.34.99]:8080">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<site></pre><p>
|
|
||||||
You can also use the self-closing version, <url="contoso.com" />, which also sets:
|
|
||||||
<ul>
|
|
||||||
<li><compat-mode>default</compat-mode></li>
|
|
||||||
<li><open-in>none</open-in></li>
|
|
||||||
</ul></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><compat-mode></td>
|
|
||||||
<td>A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
</site></pre>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv4 ranges:<pre class="syntax"><site url="10.122.34.99:8080">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<site></pre><p>
|
|
||||||
<strong>-or-</strong>
|
|
||||||
<p>For IPv6 ranges:<pre class="syntax"><site url="[10.122.34.99]:8080">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<site></pre><p>
|
|
||||||
Where:
|
|
||||||
<ul>
|
|
||||||
<li><b>IE8Enterprise.</b> Loads the site in IE8 Enterprise Mode.<br>This element is required for sites included in the <b>EmIE</b> section of the v.1 schema and is needed to load in IE8 Enterprise Mode.</li><p>
|
|
||||||
<li><b>IE7Enterprise.</b> Loads the site in IE7 Enterprise Mode.<br>This element is required for sites included in the <b>EmIE</b> section of the v.1 schema and is needed to load in IE7 Enterprise Mode.<p><b>Important</b><br>This tag replaces the combination of the <code>"forceCompatView"="true"</code> attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.</li><p>
|
|
||||||
<li><b>IE<i>[x]</i>.</b> Where <i>[x]</i> is the document mode number into which the site loads.</li><p>
|
|
||||||
<li><b>Default or not specified.</b> Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.</li>
|
|
||||||
</ul></td>
|
|
||||||
<td>Internet Explorer 11</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><open-in></td>
|
|
||||||
<td>A child element that controls what browser is used for sites. This element supports the <b>Open in IE11</b> or <b>Open in Microsoft Edge</b> experiences, for devices running Windows 10.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com">
|
|
||||||
<open-in>none</open-in>
|
|
||||||
</site></pre><p>
|
|
||||||
Where:
|
|
||||||
<ul>
|
|
||||||
<li><b>IE11.</b> Opens the site in IE11, regardless of which browser is opened by the employee.</li><p>
|
|
||||||
<li><b>MSEdge.</b> Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.</li><p>
|
|
||||||
<li><b>None or not specified.</b> Opens in whatever browser the employee chooses.</li>
|
|
||||||
</ul></td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
### Updated schema attributes
|
### Updated schema attributes
|
||||||
The <url> attribute, as part of the <site> element in the v.2 version of the schema, replaces the <domain> element from the v.1 version of the schema.
|
The <url> attribute, as part of the <site> element in the v.2 version of the schema, replaces the <domain> element from the v.1 version of the schema.
|
||||||
|
|
||||||
<table>
|
|Attribute|Description|Supported browser|
|
||||||
<thead>
|
|---------|---------|---------|
|
||||||
<tr class="header">
|
|allow-redirect|A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).<br>**Example**<pre class="syntax"><site url="contoso.com/travel"><br> <open-in allow-redirect="true">IE11 </open-in><br></site></pre> In this example, if [https://contoso.com/travel](https://contoso.com/travel) is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer. <li>| Internet Explorer 11 and Microsoft Edge|
|
||||||
<th>Attribute</th>
|
|version |Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element. | Internet Explorer 11 and Microsoft Edge|
|
||||||
<th>Description</th>
|
|url|Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.<br> **Note**<br> Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both [https://contoso.com](https://contoso.com) and [https://contoso.com](https://contoso.com). <br> **Example**<pre class="syntax"><site url="contoso.com:8080"><br> <compat-mode>IE8Enterprise</compat-mode> <br> <open-in>IE11</open-in><br></site></pre>In this example, going to [https://contoso.com:8080](https://contoso.com:8080) using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode. | Internet Explorer 11 and Microsoft Edge|
|
||||||
<th>Supported browser</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td>allow-redirect</td>
|
|
||||||
<td>A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com/travel">
|
|
||||||
<open-in allow-redirect="true">IE11</open-in>
|
|
||||||
</site></pre>
|
|
||||||
In this example, if <a href="https://contoso.com/travel" data-raw-source="https://contoso.com/travel">https://contoso.com/travel</a> is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>version</td>
|
|
||||||
<td>Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>url</td>
|
|
||||||
<td>Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.
|
|
||||||
<br><b>Note</b><br>
|
|
||||||
Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both <a href="http://contoso.com" data-raw-source="http://contoso.com">http://contoso.com</a> and <a href="https://contoso.com" data-raw-source="https://contoso.com">https://contoso.com</a>.
|
|
||||||
<p><b>Example</b>
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com:8080">
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<open-in>IE11</open-in>
|
|
||||||
</site></pre>
|
|
||||||
In this example, going to <a href="https://contoso.com:8080" data-raw-source="https://contoso.com:8080">https://contoso.com:8080</a> using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode.</td>
|
|
||||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
### Deprecated attributes
|
### Deprecated attributes
|
||||||
These v.1 version schema attributes have been deprecated in the v.2 version of the schema:
|
These v.1 version schema attributes have been deprecated in the v.2 version of the schema:
|
||||||
|
|
||||||
<table>
|
|Deprecated attribute|New attribute|Replacement example|
|
||||||
<thead>
|
|--- |--- |--- |
|
||||||
<tr class="header">
|
|forceCompatView|<compat-mode>|Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode>|
|
||||||
<th>Deprecated element/attribute</th>
|
|docMode|<compat-mode>|Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode>|
|
||||||
<th>New element</th>
|
|doNotTransition|<open-in>|Replace:<br> <doNotTransition="true"> with <open-in>none</open-in>|
|
||||||
<th>Replacement example</th>
|
|<domain> and <path>|<site>|Replace:<pre class="syntax"><emie><br> <domain>contoso.com</domain><br></emie></pre>With:<pre class="syntax"><site url="contoso.com"/> <br> <compat-mode>IE8Enterprise</compat-mode><br> <open-in>IE11</open-in><br></site></pre>**-AND-** <br>Replace:<pre class="syntax"><emie> <br> <domain exclude="true" donotTransition="true">contoso.com <br> <path forceCompatView="true">/about</path><br> </domain><br></emie></pre><br> With:<pre class="syntax"><site url="contoso.com/about"><br> <compat-mode>IE7Enterprise</compat-mode><br> <open-in>IE11</open-in><br></site>|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td>forceCompatView</td>
|
|
||||||
<td><compat-mode></td>
|
|
||||||
<td>Replace forceCompatView="true" with <compat-mode>IE7Enterprise</compat-mode></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>docMode</td>
|
|
||||||
<td><compat-mode></td>
|
|
||||||
<td>Replace docMode="IE5" with <compat-mode>IE5</compat-mode></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>doNotTransition</td>
|
|
||||||
<td><open-in></td>
|
|
||||||
<td>Replace doNotTransition="true" with <open-in>none</open-in></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><domain> and <path></td>
|
|
||||||
<td><site></td>
|
|
||||||
<td>Replace:
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain>contoso.com</domain>
|
|
||||||
</emie></pre>
|
|
||||||
With:
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com"/>
|
|
||||||
<compat-mode>IE8Enterprise</compat-mode>
|
|
||||||
<open-in>IE11</open-in>
|
|
||||||
</site></pre>
|
|
||||||
<b>-AND-</b><p>
|
|
||||||
Replace:
|
|
||||||
<pre class="syntax">
|
|
||||||
<emie>
|
|
||||||
<domain exclude="true" doNotTransition="true">
|
|
||||||
contoso.com
|
|
||||||
<path forceCompatView="true">/about</path>
|
|
||||||
</domain>
|
|
||||||
</emie></pre>
|
|
||||||
With:
|
|
||||||
<pre class="syntax">
|
|
||||||
<site url="contoso.com/about">
|
|
||||||
<compat-mode>IE7Enterprise</compat-mode>
|
|
||||||
<open-in>IE11</open-in>
|
|
||||||
</site></pre></td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features.
|
While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features.
|
||||||
|
|
||||||
|
|||||||
@ -126,96 +126,23 @@ Table 2 lists the settings in the Device Management node in the Google Admin Con
|
|||||||
|
|
||||||
Table 2. Settings in the Device Management node in the Google Admin Console
|
Table 2. Settings in the Device Management node in the Google Admin Console
|
||||||
|
|
||||||
<table>
|
|Section |Settings |
|
||||||
<colgroup>
|
|---------|---------|
|
||||||
<col width="50%" />
|
|Network | <p>These settings configure the network connections for Chromebook devices and include the following settings categories:<ul></p><li> **Wi-Fi.** Configures the Wi-Fi connections that are available. The Windows devices will need these configuration settings to connect to the same Wi-Fi networks.</p></li> <li>**Ethernet.** Configures authentication for secured, wired Ethernet connections (802.1x). The Windows devices will need these configuration settings to connect to the network.</p><li>**VPN.** Specifies the VPN network connections used by devices when not directly connected to your intranet. The Windows devices will need the same VPN network connections for users to remotely connect to your intranet.</p><li>**Certificates.** Contains the certificates used for network authentication. The Windows devices will need these certificates to connect to the network.</p> |
|
||||||
<col width="50%" />
|
|Mobile |These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:<ul> <li>**Device management settings.** Configures settings for mobile (companion) devices, such as device synchronization, password settings, auditing, enable remote wipe, and other settings. Record these settings so that you can ensure the same settings are applied when the devices are being managed by Microsoft Intune or another mobile device management (MDM) provider.<li>**Device activation.** Contains a list of mobile (companion) devices that need to be approved for management by using the Google Admin Console. Approve or block any devices in this list so that the list of managed devices accurately reflects active managed devices.<li>**Managed devices.** Performs management tasks on mobile (companion) devices that are managed by the Google Admin Console. Record the list of companion devices on this page so that you can ensure the same devices are managed by Intune or another MDM provider.<li> **Set Up Apple Push Certificate.** Configures the certificate that is essentially the digital signature that lets the Google Admin Console manage iOS devices. You will need this certificate if you plan to manage iOS devices by using Intune or another MDM provider. <li>**Set Up Android for Work.** Authorizes the Google Admin Console to be the MDM provider for Android devices by providing an Enterprise Mobility Management (EMM) token. You will need this token if you plan to manage Android devices by using another MDM provider. |
|
||||||
</colgroup>
|
|Chrome management |These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:<ul> <li>**User settings.** Configures user-based settings for the Chrome browser and Chromebook devices. Most of these Chromebook user-based settings can be mapped to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.<li>**Public session settings.** Configures Public Sessions for Chrome devices that are used as kiosks, loaner devices, shared computers, or for any other work or school-related purpose for which users don't need to sign in with their credentials. You can configure Windows devices similarly by using Assigned Access. Record the settings and apps that are available in Public Sessions so that you can provide similar configuration in Assigned Access.<li> **Device settings.** Configures device-based settings for the Chrome browser and Chromebook devices. You can map most of these Chromebook device-based settings to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.<li>**Devices.** Manages Chrome device management licenses. The number of licenses recorded here should correspond to the number of licenses you will need for your new management system, such as Intune. Record the number of licenses and use those to determine how many licenses you will need to manage your Windows devices <li>**App Management.** Provides configuration settings for Chrome apps. Record the settings for any apps that you have identified that will run on Windows devices. |
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Section</th>
|
|
||||||
<th align="left">Settings</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Network</td>
|
|
||||||
<td align="left"><p>These settings configure the network connections for Chromebook devices and include the following settings categories:</p>
|
|
||||||
<ul>
|
|
||||||
<li><p><strong>Wi-Fi.</strong> Configures the Wi-Fi connections that are available. The Windows devices will need these configuration settings to connect to the same Wi-Fi networks.</p></li>
|
|
||||||
<li><p><strong>Ethernet.</strong> Configures authentication for secured, wired Ethernet connections (802.1x). The Windows devices will need these configuration settings to connect to the network.</p></li>
|
|
||||||
<li><p><strong>VPN.</strong> Specifies the VPN network connections used by devices when not directly connected to your intranet. The Windows devices will need the same VPN network connections for users to remotely connect to your intranet.</p></li>
|
|
||||||
<li><p><strong>Certificates.</strong> Contains the certificates used for network authentication. The Windows devices will need these certificates to connect to the network.</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Mobile</td>
|
|
||||||
<td align="left"><p>These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:</p>
|
|
||||||
<ul>
|
|
||||||
<li><p><strong>Device management settings.</strong> Configures settings for mobile (companion) devices, such as device synchronization, password settings, auditing, enable remote wipe, and other settings. Record these settings so that you can ensure the same settings are applied when the devices are being managed by Microsoft Intune or another mobile device management (MDM) provider.</p></li>
|
|
||||||
<li><p><strong>Device activation.</strong> Contains a list of mobile (companion) devices that need to be approved for management by using the Google Admin Console. Approve or block any devices in this list so that the list of managed devices accurately reflects active managed devices.</p></li>
|
|
||||||
<li><p><strong>Managed devices.</strong> Performs management tasks on mobile (companion) devices that are managed by the Google Admin Console. Record the list of companion devices on this page so that you can ensure the same devices are managed by Intune or another MDM provider.</p></li>
|
|
||||||
<li><p><strong>Set Up Apple Push Certificate.</strong> Configures the certificate that is essentially the digital signature that lets the Google Admin Console manage iOS devices. You will need this certificate if you plan to manage iOS devices by using Intune or another MDM provider.</p></li>
|
|
||||||
<li><p><strong>Set Up Android for Work.</strong> Authorizes the Google Admin Console to be the MDM provider for Android devices by providing an Enterprise Mobility Management (EMM) token. You will need this token if you plan to manage Android devices by using another MDM provider.</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Chrome management</td>
|
|
||||||
<td align="left"><p>These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:</p>
|
|
||||||
<ul>
|
|
||||||
<li><p><strong>User settings.</strong> Configures user-based settings for the Chrome browser and Chromebook devices. Most of these Chromebook user-based settings can be mapped to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.</p></li>
|
|
||||||
<li><p><strong>Public session settings.</strong> Configures Public Sessions for Chrome devices that are used as kiosks, loaner devices, shared computers, or for any other work or school-related purpose for which users don't need to sign in with their credentials. You can configure Windows devices similarly by using Assigned Access. Record the settings and apps that are available in Public Sessions so that you can provide similar configuration in Assigned Access.</p></li>
|
|
||||||
<li><p><strong>Device settings.</strong> Configures device-based settings for the Chrome browser and Chromebook devices. You can map most of these Chromebook device-based settings to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.</p></li>
|
|
||||||
<li><p><strong>Devices.</strong> Manages Chrome device management licenses. The number of licenses recorded here should correspond to the number of licenses you will need for your new management system, such as Intune. Record the number of licenses and use those to determine how many licenses you will need to manage your Windows devices.</p></li>
|
|
||||||
<li><p><strong>App Management.</strong> Provides configuration settings for Chrome apps. Record the settings for any apps that you have identified that will run on Windows devices.</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Table 3 lists the settings in the Security node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows.
|
Table 3 lists the settings in the Security node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows.
|
||||||
|
|
||||||
Table 3. Settings in the Security node in the Google Admin Console
|
Table 3. Settings in the Security node in the Google Admin Console
|
||||||
|
|
||||||
<table>
|
|Section|Settings|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|Basic settings|These settings configure password management and whether or not two-factor authentication (2FA) is configured. You can set the minimum password length, the maximum password length, if non-admin users can recover their own passwords, and enable 2FA.<br> Record these settings and use them to help configure your on-premises Active Directory or Azure Active Directory (Azure AD) to mirror the current behavior of your Chromebook environment.|
|
||||||
<col width="50%" />
|
|Password monitoring|This section is used to monitor the strength of user passwords. You don’t need to migrate any settings in this section.|
|
||||||
</colgroup>
|
|API reference|This section is used to enable access to various Google Apps Administrative APIs. You don’t need to migrate any settings in this section.|
|
||||||
<thead>
|
|Set up single sign-on (SSO)|This section is used to configure SSO for Google web-based apps (such as Google Apps Gmail or Google Apps Calendar). While you don’t need to migrate any settings in this section, you probably will want to configure Azure Active Directory synchronization to replace Google-based SSO.|
|
||||||
<tr class="header">
|
|Advanced settings|This section is used to configure administrative access to user data and to configure the Google Secure Data Connector (which allows Google Apps to access data on your local network). You don’t need to migrate any settings in this section.|
|
||||||
<th align="left">Section</th>
|
|
||||||
<th align="left">Settings</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>Basic settings</p></td>
|
|
||||||
<td align="left"><p>These settings configure password management and whether or not two-factor authentication (2FA) is configured. You can set the minimum password length, the maximum password length, if non-admin users can recover their own passwords, and enable 2FA.</p>
|
|
||||||
<p>Record these settings and use them to help configure your on-premises Active Directory or Azure Active Directory (Azure AD) to mirror the current behavior of your Chromebook environment.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p>Password monitoring</p></td>
|
|
||||||
<td align="left"><p>This section is used to monitor the strength of user passwords. You don’t need to migrate any settings in this section.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>API reference</p></td>
|
|
||||||
<td align="left"><p>This section is used to enable access to various Google Apps Administrative APIs. You don’t need to migrate any settings in this section.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p>Set up single sign-on (SSO)</p></td>
|
|
||||||
<td align="left"><p>This section is used to configure SSO for Google web-based apps (such as Google Apps Gmail or Google Apps Calendar). While you don’t need to migrate any settings in this section, you probably will want to configure Azure Active Directory synchronization to replace Google-based SSO.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>Advanced settings</p></td>
|
|
||||||
<td align="left"><p>This section is used to configure administrative access to user data and to configure the Google Secure Data Connector (which allows Google Apps to access data on your local network). You don’t need to migrate any settings in this section.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
**Identify locally-configured settings to migrate**
|
**Identify locally-configured settings to migrate**
|
||||||
|
|
||||||
@ -428,62 +355,14 @@ Table 5 is a decision matrix that helps you decide if you can use only on-premis
|
|||||||
|
|
||||||
Table 5. Select on-premises AD DS, Azure AD, or hybrid
|
Table 5. Select on-premises AD DS, Azure AD, or hybrid
|
||||||
|
|
||||||
<table>
|
|If you plan to...|On-premises AD DS|Azure AD|Hybrid|
|
||||||
<colgroup>
|
|--- |--- |--- |--- |
|
||||||
<col width="25%" />
|
|Use Office 365||✔️|✔️|
|
||||||
<col width="25%" />
|
|Use Intune for management||✔️|✔️|
|
||||||
<col width="25%" />
|
|Use Microsoft Endpoint Manager for management|✔️||✔️|
|
||||||
<col width="25%" />
|
|Use Group Policy for management|✔️||✔️|
|
||||||
</colgroup>
|
|Have devices that are domain-joined|✔️||✔️|
|
||||||
<thead>
|
|Allow faculty and students to Bring Your Own Device (BYOD) which are not domain-joined||✔️|✔️|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">If you plan to...</th>
|
|
||||||
<th align="left">On-premises AD DS</th>
|
|
||||||
<th align="left">Azure AD</th>
|
|
||||||
<th align="left">Hybrid</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Use Office 365</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Use Intune for management</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Use Microsoft Endpoint Manager for management</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Use Group Policy for management</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Have devices that are domain-joined</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Allow faculty and students to Bring Your Own Device (BYOD) which are not domain-joined</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### <a href="" id="plan-userdevapp-manage"></a>
|
### <a href="" id="plan-userdevapp-manage"></a>
|
||||||
|
|
||||||
@ -497,113 +376,17 @@ Table 6 is a decision matrix that lists the device, user, and app management pro
|
|||||||
|
|
||||||
Table 6. Device, user, and app management products and technologies
|
Table 6. Device, user, and app management products and technologies
|
||||||
|
|
||||||
<table>
|
|Desired feature|Windows provisioning packages|Group Policy|Configuration Manager|Intune|MDT|Windows Software Update Services|
|
||||||
<colgroup>
|
|--- |--- |--- |--- |--- |--- |--- |
|
||||||
<col width="14%" />
|
|Deploy operating system images|✔️||✔️||✔️||
|
||||||
<col width="14%" />
|
|Deploy apps during operating system deployment|✔️||✔️||✔️||
|
||||||
<col width="14%" />
|
|Deploy apps after operating system deployment|✔️|✔️|✔️||||
|
||||||
<col width="14%" />
|
|Deploy software updates during operating system deployment|||✔️||✔️||
|
||||||
<col width="14%" />
|
|Deploy software updates after operating system deployment|✔️|✔️|✔️|✔️||✔️|
|
||||||
<col width="14%" />
|
|Support devices that are domain-joined|✔️|✔️|✔️|✔️|✔️||
|
||||||
<col width="14%" />
|
|Support devices that are not domain-joined|✔️|||✔️|✔️||
|
||||||
</colgroup>
|
|Use on-premises resources|✔️|✔️|✔️||✔️||
|
||||||
<thead>
|
|Use cloud-based services||||✔️|||
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Desired feature</th>
|
|
||||||
<th align="left">Windows provisioning packages</th>
|
|
||||||
<th align="left">Group Policy</th>
|
|
||||||
<th align="left">Configuration Manager</th>
|
|
||||||
<th align="left">Intune</th>
|
|
||||||
<th align="left">MDT</th>
|
|
||||||
<th align="left">Windows Software Update Services</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Deploy operating system images</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Deploy apps during operating system deployment</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Deploy apps after operating system deployment</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left"></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Deploy software updates during operating system deployment</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Deploy software updates after operating system deployment</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Support devices that are domain-joined</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Support devices that are not domain-joined</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Use on-premises resources</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Use cloud-based services</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left">X</td>
|
|
||||||
<td align="left"></td>
|
|
||||||
<td align="left"></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
You can use Configuration Manager and Intune in conjunction with each other to provide features from both products and technologies. In some instances you may need only one of these products or technologies. In other instances, you may need two or more to meet the device, user, and app management needs for your institution.
|
You can use Configuration Manager and Intune in conjunction with each other to provide features from both products and technologies. In some instances you may need only one of these products or technologies. In other instances, you may need two or more to meet the device, user, and app management needs for your institution.
|
||||||
|
|
||||||
@ -665,35 +448,10 @@ It is important that you perform any network infrastructure remediation first be
|
|||||||
|
|
||||||
Table 7. Network infrastructure products and technologies and deployment resources
|
Table 7. Network infrastructure products and technologies and deployment resources
|
||||||
|
|
||||||
<table>
|
|Product or technology|Resources|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|DHCP|<li> [Core Network Guide](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh911995(v=ws.11)) <li> [DHCP Deployment Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd283051(v=ws.10))|
|
||||||
<col width="50%" />
|
|DNS|<li>[Core Network Guide](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh911995(v=ws.11)) <li>[Deploying Domain Name System (DNS)](/previous-versions/windows/it-pro/windows-server-2003/cc780661(v=ws.10))|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Product or technology</th>
|
|
||||||
<th align="left">Resources</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">DHCP</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh911995(v=ws.11)" data-raw-source="[Core Network Guide](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh911995(v=ws.11))">Core Network Guide</a></p></li>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd283051(v=ws.10)" data-raw-source="[DHCP Deployment Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd283051(v=ws.10))">DHCP Deployment Guide</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">DNS</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh911995(v=ws.11)" data-raw-source="[Core Network Guide](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh911995(v=ws.11))">Core Network Guide</a></p></li>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2003/cc780661(v=ws.10)" data-raw-source="[Deploying Domain Name System (DNS)](/previous-versions/windows/it-pro/windows-server-2003/cc780661(v=ws.10))">Deploying Domain Name System (DNS)</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
If you use network infrastructure products and technologies from other vendors, refer to the vendor documentation on how to perform the necessary remediation. If you determined that no remediation is necessary, you can skip this section.
|
If you use network infrastructure products and technologies from other vendors, refer to the vendor documentation on how to perform the necessary remediation. If you determined that no remediation is necessary, you can skip this section.
|
||||||
@ -707,37 +465,10 @@ In the [Plan for Active Directory services](#plan-adservices) section, you deter
|
|||||||
|
|
||||||
Table 8. AD DS, Azure AD and deployment resources
|
Table 8. AD DS, Azure AD and deployment resources
|
||||||
|
|
||||||
<table>
|
|Product or technology|Resources|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|AD DS| <li> [Core Network Guide](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh911995(v=ws.11)) <li>[Active Directory Domain Services Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831484(v=ws.11))|
|
||||||
<col width="50%" />
|
|Azure AD| <li> [Azure Active Directory documentation](/azure/active-directory/) <li>[Manage and support Azure Active Directory Premium](https://go.microsoft.com/fwlink/p/?LinkId=690259) <li>[Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines](/windows-server/identity/ad-ds/introduction-to-active-directory-domain-services-ad-ds-virtualization-level-100)|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Product or technology</th>
|
|
||||||
<th align="left">Resources</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">AD DS</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh911995(v=ws.11)" data-raw-source="[Core Network Guide](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh911995(v=ws.11))">Core Network Guide</a></p></li>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831484(v=ws.11)" data-raw-source="[Active Directory Domain Services Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831484(v=ws.11))">Active Directory Domain Services Overview</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Azure AD</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="/azure/active-directory/" data-raw-source="[Azure Active Directory documentation](/azure/active-directory/)">Azure Active Directory documentation</a></p></li>
|
|
||||||
<li><p><a href="https://go.microsoft.com/fwlink/p/?LinkId=690259" data-raw-source="[Manage and support Azure Active Directory Premium](https://go.microsoft.com/fwlink/p/?LinkId=690259)">Manage and support Azure Active Directory Premium</a></p></li>
|
|
||||||
<li><p><a href="/windows-server/identity/ad-ds/introduction-to-active-directory-domain-services-ad-ds-virtualization-level-100" data-raw-source="[Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines](/windows-server/identity/ad-ds/introduction-to-active-directory-domain-services-ad-ds-virtualization-level-100)">Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
If you decided not to migrate to AD DS or Azure AD as a part of the migration, or if you determined that no remediation is necessary, you can skip this section. If you use identity products and technologies from another vendor, refer to the vendor documentation on how to perform the necessary steps.
|
If you decided not to migrate to AD DS or Azure AD as a part of the migration, or if you determined that no remediation is necessary, you can skip this section. If you use identity products and technologies from another vendor, refer to the vendor documentation on how to perform the necessary steps.
|
||||||
|
|
||||||
@ -750,59 +481,13 @@ Table 9 lists the Microsoft management systems and the deployment resources for
|
|||||||
|
|
||||||
Table 9. Management systems and deployment resources
|
Table 9. Management systems and deployment resources
|
||||||
|
|
||||||
<table>
|
|Management system|Resources|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|Windows provisioning packages| <li> [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package) <li>[Windows Imaging and Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd) <li> [Step-By-Step: Building Windows 10 Provisioning Packages](/archive/blogs/canitpro/step-by-step-building-windows-10-provisioning-packages)|
|
||||||
<col width="50%" />
|
|Group Policy|<li> [Core Network Companion Guide: Group Policy Deployment](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj899807(v=ws.11)) <li> [Deploying Group Policy](/previous-versions/windows/it-pro/windows-server-2003/cc737330(v=ws.10))"|
|
||||||
</colgroup>
|
|Configuration Manager| <li> [Site Administration for System Center 2012 Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg681983(v=technet.10)) <li> [Deploying Clients for System Center 2012 Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg699391(v=technet.10))|
|
||||||
<thead>
|
|Intune| <li> [Set up and manage devices with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=690262) <li> [Smoother Management Of Office 365 Deployments with Windows Intune](https://go.microsoft.com/fwlink/p/?LinkId=690263) <li> [System Center 2012 R2 Configuration Manager &amp; Windows Intune](/learn/?l=fCzIjVKy_6404984382)|
|
||||||
<tr class="header">
|
|MDT| <li>[MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=690324) <li> [Step-By-Step: Installing Windows 8.1 From A USB Key](/archive/blogs/canitpro/step-by-step-installing-windows-8-1-from-a-usb-key)|
|
||||||
<th align="left">Management system</th>
|
|
||||||
<th align="left">Resources</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Windows provisioning packages</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="/windows/configuration/provisioning-packages/provisioning-create-package" data-raw-source="[Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package)">Build and apply a provisioning package</a></p></li>
|
|
||||||
<li><p><a href="/windows/configuration/provisioning-packages/provisioning-install-icd" data-raw-source="[Windows Imaging and Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd)">Windows Imaging and Configuration Designer</a></p></li>
|
|
||||||
<li><p><a href="/archive/blogs/canitpro/step-by-step-building-windows-10-provisioning-packages" data-raw-source="[Step-By-Step: Building Windows 10 Provisioning Packages](/archive/blogs/canitpro/step-by-step-building-windows-10-provisioning-packages)">Step-By-Step: Building Windows 10 Provisioning Packages</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Group Policy</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj899807(v=ws.11)" data-raw-source="[Core Network Companion Guide: Group Policy Deployment](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj899807(v=ws.11))">Core Network Companion Guide: Group Policy Deployment</a></p></li>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2003/cc737330(v=ws.10)" data-raw-source="[Deploying Group Policy](/previous-versions/windows/it-pro/windows-server-2003/cc737330(v=ws.10))">Deploying Group Policy</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Configuration Manager</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="/previous-versions/system-center/system-center-2012-R2/gg681983(v=technet.10)" data-raw-source="[Site Administration for System Center 2012 Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg681983(v=technet.10))">Site Administration for System Center 2012 Configuration Manager</a></p></li>
|
|
||||||
<li><p><a href="/previous-versions/system-center/system-center-2012-R2/gg699391(v=technet.10)" data-raw-source="[Deploying Clients for System Center 2012 Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg699391(v=technet.10))">Deploying Clients for System Center 2012 Configuration Manager</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Intune</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="https://go.microsoft.com/fwlink/p/?LinkId=690262" data-raw-source="[Set up and manage devices with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=690262)">Set up and manage devices with Microsoft Intune</a></p></li>
|
|
||||||
<li><p><a href="https://go.microsoft.com/fwlink/p/?LinkId=690263" data-raw-source="[Smoother Management Of Office 365 Deployments with Windows Intune](https://go.microsoft.com/fwlink/p/?LinkId=690263)">Smoother Management Of Office 365 Deployments with Windows Intune</a></p></li>
|
|
||||||
<li><p><a href="/learn/?l=fCzIjVKy_6404984382" data-raw-source="[System Center 2012 R2 Configuration Manager &amp; Windows Intune](/learn/?l=fCzIjVKy_6404984382)">System Center 2012 R2 Configuration Manager & Windows Intune</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">MDT</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="https://go.microsoft.com/fwlink/p/?LinkId=690324" data-raw-source="[MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=690324)">MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013</a></p></li>
|
|
||||||
<li><p><a href="/archive/blogs/canitpro/step-by-step-installing-windows-8-1-from-a-usb-key" data-raw-source="[Step-By-Step: Installing Windows 8.1 From A USB Key](/archive/blogs/canitpro/step-by-step-installing-windows-8-1-from-a-usb-key)">Step-By-Step: Installing Windows 8.1 From A USB Key</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
If you determined that no new management system or no remediation of existing systems is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps.
|
If you determined that no new management system or no remediation of existing systems is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps.
|
||||||
|
|
||||||
@ -815,44 +500,11 @@ In this step, you need to configure your management system to deploy the apps to
|
|||||||
|
|
||||||
Table 10. Management systems and app deployment resources
|
Table 10. Management systems and app deployment resources
|
||||||
|
|
||||||
<table>
|
|Management system|Resources|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|Group Policy| <li> [Editing an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791894(v=ws.10)) <li> [Group Policy Software Deployment Background](/previous-versions/windows/it-pro/windows-server-2003/cc739305(v=ws.10)) <li> [Assigning and Publishing Software](/previous-versions/windows/it-pro/windows-server-2003/cc783635(v=ws.10))|
|
||||||
<col width="50%" />
|
|Configuration Manager| <li> [How to Deploy Applications in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682082(v=technet.10)) <li> [Application Management in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg699373(v=technet.10))|
|
||||||
</colgroup>
|
|Intune| <li> [Deploy apps to mobile devices in Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=733913) <li> [Manage apps with Microsoft Intune](/mem/intune/)|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Management system</th>
|
|
||||||
<th align="left">Resources</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Group Policy</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791894(v=ws.10)" data-raw-source="[Editing an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791894(v=ws.10))">Editing an AppLocker Policy</a></p></li>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2003/cc739305(v=ws.10)" data-raw-source="[Group Policy Software Deployment Background](/previous-versions/windows/it-pro/windows-server-2003/cc739305(v=ws.10))">Group Policy Software Deployment Background</a></p></li>
|
|
||||||
<li><p><a href="/previous-versions/windows/it-pro/windows-server-2003/cc783635(v=ws.10)" data-raw-source="[Assigning and Publishing Software](/previous-versions/windows/it-pro/windows-server-2003/cc783635(v=ws.10))">Assigning and Publishing Software</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Configuration Manager</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="/previous-versions/system-center/system-center-2012-R2/gg682082(v=technet.10)" data-raw-source="[How to Deploy Applications in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682082(v=technet.10))">How to Deploy Applications in Configuration Manager</a></p></li>
|
|
||||||
<li><p><a href="/previous-versions/system-center/system-center-2012-R2/gg699373(v=technet.10)" data-raw-source="[Application Management in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg699373(v=technet.10))">Application Management in Configuration Manager</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Intune</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p><a href="https://go.microsoft.com/fwlink/p/?LinkId=733913" data-raw-source="[Deploy apps to mobile devices in Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=733913)">Deploy apps to mobile devices in Microsoft Intune</a></p></li>
|
|
||||||
<li><p><a href="/mem/intune/" data-raw-source="[Manage apps with Microsoft Intune](/mem/intune/)">Manage apps with Microsoft Intune</a></p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
If you determined that no deployment of apps is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps.
|
If you determined that no deployment of apps is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps.
|
||||||
|
|
||||||
|
|||||||
@ -83,7 +83,7 @@ This district configuration has the following characteristics:
|
|||||||
|
|
||||||
* If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](/azure/active-directory/hybrid/whatis-hybrid-identity).
|
* If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](/azure/active-directory/hybrid/whatis-hybrid-identity).
|
||||||
|
|
||||||
* Use [Intune](/intune/), [Mobile Device Management for Office 365](https://support.office.com/en-us/article/Set-up-Mobile-Device-Management-MDM-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy in AD DS](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc725828(v=ws.10)) to manage devices.
|
* Use [Intune](/intune/), [Mobile Device Management for Office 365](/microsoft-365/admin/basic-mobility-security/set-up), or [Group Policy in AD DS](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc725828(v=ws.10)) to manage devices.
|
||||||
|
|
||||||
* Each device supports a one-student-per-device or multiple-students-per-device scenario.
|
* Each device supports a one-student-per-device or multiple-students-per-device scenario.
|
||||||
|
|
||||||
@ -128,7 +128,7 @@ Office 365 Education allows:
|
|||||||
|
|
||||||
* Students and faculty to access classroom resources from anywhere on any device (including iOS and Android devices).
|
* Students and faculty to access classroom resources from anywhere on any device (including iOS and Android devices).
|
||||||
|
|
||||||
For more information about Office 365 Education features and an FAQ, go to [Office 365 Education plans and pricing](https://products.office.com/en-us/academic).
|
For more information about Office 365 Education features and an FAQ, go to [Office 365 Education plans and pricing](https://www.microsoft.com/microsoft-365/academic/compare-office-365-education-plans).
|
||||||
|
|
||||||
### How to configure a district
|
### How to configure a district
|
||||||
|
|
||||||
@ -225,80 +225,10 @@ Use the cloud-centric scenario and on-premises and cloud scenario as a guide for
|
|||||||
|
|
||||||
To deploy Windows 10 and your apps, you can use MDT by itself or Microsoft Endpoint Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution.
|
To deploy Windows 10 and your apps, you can use MDT by itself or Microsoft Endpoint Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution.
|
||||||
|
|
||||||
<table>
|
|Method|Description|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="25%" />
|
|MDT|MDT is an on-premises solution that supports initial operating system deployment and upgrade. You can use MDT to deploy and upgrade Windows 10. In addition, you can initially deploy Windows desktop and Microsoft Store apps and software updates.<br> Select this method when you: <li> Want to deploy Windows 10 to institution-owned and personal devices. (Devices need not be domain joined.) <li> Don’t have an existing AD DS infrastructure. <li> Need to manage devices regardless of where they are (on or off premises). <br>The advantages of this method are that: <br> <li> You can deploy Windows 10 operating systems <li> You can manage device drivers during initial deployment. <li>You can deploy Windows desktop apps (during initial deployment)<li> It doesn’t require an AD DS infrastructure.<li>It doesn’t have additional infrastructure requirements.<li>MDT doesn’t incur additional cost: it’s a free tool.<li>You can deploy Windows 10 operating systems to institution-owned and personal devices. <br> The disadvantages of this method are that it:<br> <li>Can’t manage applications throughout entire application life cycle (by itself).<li>Can’t manage software updates for Windows 10 and apps (by itself).<li>Doesn’t provide antivirus and malware protection (by itself).<li>Has limited scaling to large numbers of users and devices.|
|
||||||
<col width="75%" />
|
|Microsoft Endpoint Configuration Manager|<li> Configuration Manager is an on-premises solution that supports operating system management throughout the entire operating system life cycle <li>You can use Configuration Manager to deploy and upgrade Windows 10. In addition, you can manage Windows desktop and Microsoft Store apps and software updates as well as provide antivirus and antimalware protection. <br> Select this method when you: <li> Want to deploy Windows 10 to institution-owned devices that are domain joined (personal devices are typically not domain joined). <li>Have an existing AD DS infrastructure (or plan to deploy an AD DS infrastructure). <li>Typically deploy Windows 10 to on-premises devices. <br> The advantages of this method are that: <li>You can deploy Windows 10 operating systems.<li>You can manage (deploy) Windows desktop and Microsoft Store apps throughout entire application life cycle.<li>You can manage software updates for Windows 10 and apps.<li>You can manage antivirus and malware protection.<li>It scales to large number of users and devices. <br>The disadvantages of this method are that it:<li>Carries an additional cost for Microsoft Endpoint Manager server licenses (if the institution does not have Configuration Manager already).<li>Can deploy Windows 10 only to domain-joined (institution-owned devices).<li>Requires an AD DS infrastructure (if the institution does not have AD DS already).|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Method</th>
|
|
||||||
<th align="left">Description</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">MDT</td>
|
|
||||||
<td><p>MDT is an on-premises solution that supports initial operating system deployment and upgrade. You can use MDT to deploy and upgrade Windows 10. In addition, you can initially deploy Windows desktop and Microsoft Store apps and software updates.<br/><br/>
|
|
||||||
Select this method when you:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Want to deploy Windows 10 to institution-owned and personal devices. (Devices need not be domain joined.)</li>
|
|
||||||
<li>Don’t have an existing AD DS infrastructure.</li>
|
|
||||||
<li>Need to manage devices regardless of where they are (on or off premises).</li>
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<p>The advantages of this method are that:</p>
|
|
||||||
<ul>
|
|
||||||
<li>You can deploy Windows 10 operating systems.</li>
|
|
||||||
<li>You can manage device drivers during initial deployment.</li>
|
|
||||||
<li>You can deploy Windows desktop apps (during initial deployment)</li>
|
|
||||||
<li>It doesn’t require an AD DS infrastructure.</li>
|
|
||||||
<li>It doesn’t have additional infrastructure requirements.</li>
|
|
||||||
<li>MDT doesn’t incur additional cost: it’s a free tool.</li>
|
|
||||||
<li>You can deploy Windows 10 operating systems to institution-owned and personal devices.</li>
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<p>The disadvantages of this method are that it:</p>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>Can’t manage applications throughout entire application life cycle (by itself).</li>
|
|
||||||
<li>Can’t manage software updates for Windows 10 and apps (by itself).</li>
|
|
||||||
<li>Doesn’t provide antivirus and malware protection (by itself).</li>
|
|
||||||
<li>Has limited scaling to large numbers of users and devices.</li>
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Microsoft Endpoint Configuration Manager</td>
|
|
||||||
<td><p>Configuration Manager is an on-premises solution that supports operating system management throughout the entire operating system life cycle. You can use Configuration Manager to deploy and upgrade Windows 10. In addition, you can manage Windows desktop and Microsoft Store apps and software updates as well as provide antivirus and antimalware protection.<br/><br/>
|
|
||||||
Select this method when you:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Want to deploy Windows 10 to institution-owned devices that are domain joined (personal devices are typically not domain joined).</li>
|
|
||||||
<li>Have an existing AD DS infrastructure (or plan to deploy an AD DS infrastructure).</li>
|
|
||||||
<li>Typically deploy Windows 10 to on-premises devices.</li>
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<p>The advantages of this method are that:</p>
|
|
||||||
<ul>
|
|
||||||
<li>You can deploy Windows 10 operating systems.</li>
|
|
||||||
<li>You can manage (deploy) Windows desktop and Microsoft Store apps throughout entire application life cycle.</li>
|
|
||||||
<li>You can manage software updates for Windows 10 and apps.</li>
|
|
||||||
<li>You can manage antivirus and malware protection.</li>
|
|
||||||
<li>It scales to large number of users and devices.</li>
|
|
||||||
</ul>
|
|
||||||
<p>The disadvantages of this method are that it:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Carries an additional cost for Microsoft Endpoint Manager server licenses (if the institution does not have Configuration Manager already).</li>
|
|
||||||
<li>Can deploy Windows 10 only to domain-joined (institution-owned devices).</li>
|
|
||||||
<li>Requires an AD DS infrastructure (if the institution does not have AD DS already).</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
*Table 2. Deployment methods*
|
*Table 2. Deployment methods*
|
||||||
|
|
||||||
@ -317,81 +247,10 @@ If you have only one device to configure, manually configuring that one device i
|
|||||||
|
|
||||||
For a district, there are many ways to manage the configuration setting for users and devices. Table 4 lists the methods that this guide describes and recommends. Use this information to determine which combination of configuration setting management methods is right for your institution.
|
For a district, there are many ways to manage the configuration setting for users and devices. Table 4 lists the methods that this guide describes and recommends. Use this information to determine which combination of configuration setting management methods is right for your institution.
|
||||||
|
|
||||||
<table>
|
|Method|Description|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="25%" />
|
|Group Policy|Group Policy is an integral part of AD DS and allows you to specify configuration settings for Windows 10 and previous versions of Windows. <br> Select this method when you <li>Want to manage institution-owned devices that are domain joined (personal devices are typically not domain joined).<li> Want more granular control of device and user settings. <li>Have an existing AD DS infrastructure.<li>Typically manage on-premises devices.<li>Can manage a required setting only by using Group Policy. <br>The advantages of this method include: <li>No cost beyond the AD DS infrastructure. <li>A larger number of settings (compared to Intune).<br>The disadvantages of this method are that it:<li>Can only manage domain-joined (institution-owned devices).<li>Requires an AD DS infrastructure (if the institution does not have AD DS already).<li>Typically manages on-premises devices (unless devices use a virtual private network [VPN] or Microsoft DirectAccess to connect).<li> Has rudimentary app management capabilities.<li> Cannot deploy Windows 10 operating systems.|
|
||||||
<col width="75%" />
|
|Intune|Intune is a cloud-based management system that allows you to specify configuration settings for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD.<br>Intune is the cloud-based management system described in this guide, but you can use other MDM providers. If you use an MDM provider other than Intune, integration with Configuration Manager is unavailable.<br>Select this method when you:<li> Want to manage institution-owned and personal devices (does not require that the device be domain joined).<li>Don’t need granular control over device and user settings (compared to Group Policy).<li>Don’t have an existing AD DS infrastructure.<li>Need to manage devices regardless of where they are (on or off premises).<li>Want to provide application management for the entire application life cycle.<li>Can manage a required setting only by using Intune.<br>The advantages of this method are that:<li>You can manage institution-owned and personal devices.<li>It doesn’t require that devices be domain joined.<li>It doesn’t require any on-premises infrastructure.<li>It can manage devices regardless of their location (on or off premises).<br>The disadvantages of this method are that it:<li>Carries an additional cost for Intune subscription licenses.<li>Doesn’t offer granular control over device and user settings (compared to Group Policy).<li>Cannot deploy Windows 10 operating systems.|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Method</th>
|
|
||||||
<th align="left">Description</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Group Policy</td>
|
|
||||||
<td><p>Group Policy is an integral part of AD DS and allows you to specify configuration settings for Windows 10 and previous versions of Windows.<br/><br/>
|
|
||||||
Select this method when you:</p>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>Want to manage institution-owned devices that are domain joined (personal devices are typically not domain joined).</li>
|
|
||||||
<li>Want more granular control of device and user settings.</li>
|
|
||||||
<li>Have an existing AD DS infrastructure.</li>
|
|
||||||
<li>Typically manage on-premises devices.</li>
|
|
||||||
<li>Can manage a required setting only by using Group Policy.</li>
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<p>The advantages of this method include:</p>
|
|
||||||
<ul>
|
|
||||||
<li>No cost beyond the AD DS infrastructure.</li>
|
|
||||||
<li>A larger number of settings (compared to Intune).</li>
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<p>The disadvantages of this method are that it:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Can only manage domain-joined (institution-owned devices).</li>
|
|
||||||
<li>Requires an AD DS infrastructure (if the institution does not have AD DS already).</li>
|
|
||||||
<li>Typically manages on-premises devices (unless devices use a virtual private network [VPN] or Microsoft DirectAccess to connect).</li>
|
|
||||||
<li>Has rudimentary app management capabilities.</li>
|
|
||||||
<li>Cannot deploy Windows 10 operating systems.</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Intune</td>
|
|
||||||
<td><p>Intune is a cloud-based management system that allows you to specify configuration settings for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD.<br/><br/>
|
|
||||||
Intune is the cloud-based management system described in this guide, but you can use other MDM providers. If you use an MDM provider other than Intune, integration with Configuration Manager is unavailable.<br/><br/>
|
|
||||||
Select this method when you:</p>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>Want to manage institution-owned and personal devices (does not require that the device be domain joined).</li>
|
|
||||||
<li>Don’t need granular control over device and user settings (compared to Group Policy).</li>
|
|
||||||
<li>Don’t have an existing AD DS infrastructure.</li>
|
|
||||||
<li>Need to manage devices regardless of where they are (on or off premises).</li>
|
|
||||||
<li>Want to provide application management for the entire application life cycle.</li>
|
|
||||||
<li>Can manage a required setting only by using Intune.</li>
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<p>The advantages of this method are that:</p>
|
|
||||||
<ul>
|
|
||||||
<li>You can manage institution-owned and personal devices.</li>
|
|
||||||
<li>It doesn’t require that devices be domain joined.</li>
|
|
||||||
<li>It doesn’t require any on-premises infrastructure.</li>
|
|
||||||
<li>It can manage devices regardless of their location (on or off premises).</li>
|
|
||||||
</ul>
|
|
||||||
<p>The disadvantages of this method are that it:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Carries an additional cost for Intune subscription licenses.</li>
|
|
||||||
<li>Doesn’t offer granular control over device and user settings (compared to Group Policy).</li>
|
|
||||||
<li>Cannot deploy Windows 10 operating systems.</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
*Table 4. Configuration setting management methods*
|
*Table 4. Configuration setting management methods*
|
||||||
|
|
||||||
@ -410,114 +269,11 @@ For a district, there are many ways to manage apps and software updates. Table 6
|
|||||||
|
|
||||||
Use the information in Table 6 to determine which combination of app and update management products is right for your district.
|
Use the information in Table 6 to determine which combination of app and update management products is right for your district.
|
||||||
|
|
||||||
<table>
|
|Selection|Management method|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="25%" />
|
|Microsoft Endpoint Configuration Manager|Configuration Manager is an on-premises solution that allows you to specify configuration settings for Windows 10; previous versions of Windows; and other operating systems, such as iOS or Android, through integration with Intune.Configuration Manager supports application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager. You can also manage Windows desktop and Microsoft Store applications. Select this method when you:<li>Selected Configuration Manager to deploy Windows 10.<li>Want to manage institution-owned devices that are domain joined (personally owned devices are typically not domain joined).<li>Want to manage AD DS domain-joined devices.<li>Have an existing AD DS infrastructure.<li>Typically manage on-premises devices.<li>Want to deploy operating systems.<li>Want to provide application management for the entire application life cycle.<br>The advantages of this method are that:<li>You can deploy Windows 10 operating systems.<li>You can manage applications throughout the entire application life cycle.<li>You can manage software updates for Windows 10 and apps.<li>You can manage antivirus and malware protection.<li>It scales to large numbers of users and devices.<br>The disadvantages of this method are that it:<li>Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).<li>Carries an additional cost for Windows Server licenses and the corresponding server hardware.<li>Can only manage domain-joined (institution-owned devices).<li>Requires an AD DS infrastructure (if the institution does not have AD DS already).<li>Typically manages on-premises devices (unless devices through VPN or DirectAccess).|
|
||||||
<col width="75%" />
|
|Intune|Intune is a cloud-based solution that allows you to manage apps and software updates for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD.<br>Select this method when you:<li>Selected MDT only to deploy Windows 10.<li>Want to manage institution-owned and personal devices that are not domain joined.<li>Want to manage Azure AD domain-joined devices.<li>Need to manage devices regardless of where they are (on or off premises).<li>Want to provide application management for the entire application life cycle.<br>The advantages of this method are that:<li>You can manage institution-owned and personal devices.<li>It doesn’t require that devices be domain joined.<li>It doesn’t require on-premises infrastructure.vIt can manage devices regardless of their location (on or off premises).<li>You can deploy keys to perform in-place Windows 10 upgrades (such as upgrading from Windows 10 Pro to Windows 10 Education edition).<br>The disadvantages of this method are that it:<li>Carries an additional cost for Intune subscription licenses.<li>Cannot deploy Windows 10 operating systems.|
|
||||||
</colgroup>
|
|Microsoft Endpoint Manager and Intune (hybrid)|Configuration Manager and Intune together extend Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both Configuration Manager and Intune.<br>Configuration Manager and Intune in the hybrid configuration allow you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices. <br>Select this method when you:<li>Selected Microsoft Endpoint Manager to deploy Windows 10.<li>Want to manage institution-owned and personal devices (does not require that the device be domain joined).<li>Want to manage domain-joined devices.<li>Want to manage Azure AD domain-joined devices.<li>Have an existing AD DS infrastructure.<li>Want to manage devices regardless of their connectivity.vWant to deploy operating systems.<li>Want to provide application management for the entire application life cycle.<br>The advantages of this method are that:<li>You can deploy operating systems.<li>You can manage applications throughout the entire application life cycle.<li>You can scale to large numbers of users and devices.<li>You can support institution-owned and personal devices.<li>It doesn’t require that devices be domain joined.<li>It can manage devices regardless of their location (on or off premises).<br>The disadvantages of this method are that it:<li>Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).<li>Carries an additional cost for Windows Server licenses and the corresponding server hardware.<li>Carries an additional cost for Intune subscription licenses.<li>Requires an AD DS infrastructure (if the institution does not have AD DS already).|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Selection</th>
|
|
||||||
<th align="left">Management method</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Microsoft Endpoint Configuration Manager</td>
|
|
||||||
<td><p>Configuration Manager is an on-premises solution that allows you to specify configuration settings for Windows 10; previous versions of Windows; and other operating systems, such as iOS or Android, through integration with Intune.<br/><br/>Configuration Manager supports application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager. You can also manage Windows desktop and Microsoft Store applications.<br/><br/>Select this method when you:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Selected Configuration Manager to deploy Windows 10.</li>
|
|
||||||
<li>Want to manage institution-owned devices that are domain joined (personally owned devices are typically not domain joined).</li>
|
|
||||||
<li>Want to manage AD DS domain-joined devices.</li>
|
|
||||||
<li>Have an existing AD DS infrastructure.</li>
|
|
||||||
<li>Typically manage on-premises devices.</li>
|
|
||||||
<li>Want to deploy operating systems.</li>
|
|
||||||
<li>Want to provide application management for the entire application life cycle.</li>
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<p>The advantages of this method are that:</p>
|
|
||||||
<ul>
|
|
||||||
<li>You can deploy Windows 10 operating systems.</li>
|
|
||||||
<li>You can manage applications throughout the entire application life cycle.</li>
|
|
||||||
<li>You can manage software updates for Windows 10 and apps.</li>
|
|
||||||
<li>You can manage antivirus and malware protection.</li>
|
|
||||||
<li>It scales to large numbers of users and devices.</li>
|
|
||||||
</ul>
|
|
||||||
<p>The disadvantages of this method are that it:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).</li>
|
|
||||||
<li>Carries an additional cost for Windows Server licenses and the corresponding server hardware.</li>
|
|
||||||
<li>Can only manage domain-joined (institution-owned devices).</li>
|
|
||||||
<li>Requires an AD DS infrastructure (if the institution does not have AD DS already).</li>
|
|
||||||
<li>Typically manages on-premises devices (unless devices through VPN or DirectAccess).</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Intune</td>
|
|
||||||
<td><p>Intune is a cloud-based solution that allows you to manage apps and software updates for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD.<br/><br/>
|
|
||||||
Select this method when you:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Selected MDT only to deploy Windows 10.</li>
|
|
||||||
<li>Want to manage institution-owned and personal devices that are not domain joined.</li>
|
|
||||||
<li>Want to manage Azure AD domain-joined devices.</li>
|
|
||||||
<li>Need to manage devices regardless of where they are (on or off premises).</li>
|
|
||||||
<li>Want to provide application management for the entire application life cycle.</li>
|
|
||||||
</ul>
|
|
||||||
<p>The advantages of this method are that:</p>
|
|
||||||
<ul>
|
|
||||||
<li>You can manage institution-owned and personal devices.</li>
|
|
||||||
<li>It doesn’t require that devices be domain joined.</li>
|
|
||||||
<li>It doesn’t require on-premises infrastructure.</li>
|
|
||||||
<li>It can manage devices regardless of their location (on or off premises).</li>
|
|
||||||
<li>You can deploy keys to perform in-place Windows 10 upgrades (such as upgrading from Windows 10 Pro to Windows 10 Education edition).</li>
|
|
||||||
</ul>
|
|
||||||
<p>The disadvantages of this method are that it:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Carries an additional cost for Intune subscription licenses.</li>
|
|
||||||
<li>Cannot deploy Windows 10 operating systems.</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Microsoft Endpoint Manager and Intune (hybrid)</td>
|
|
||||||
<td><p>Configuration Manager and Intune together extend Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both Configuration Manager and Intune.<br/><br/>
|
|
||||||
Configuration Manager and Intune in the hybrid configuration allow you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices.<br/><br/>
|
|
||||||
Select this method when you:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Selected Microsoft Endpoint Manager to deploy Windows 10.</li>
|
|
||||||
<li>Want to manage institution-owned and personal devices (does not require that the device be domain joined).</li>
|
|
||||||
<li>Want to manage domain-joined devices.</li>
|
|
||||||
<li>Want to manage Azure AD domain-joined devices.</li>
|
|
||||||
<li>Have an existing AD DS infrastructure.</li>
|
|
||||||
<li>Want to manage devices regardless of their connectivity.</li>
|
|
||||||
<li>Want to deploy operating systems.</li>
|
|
||||||
<li>Want to provide application management for the entire application life cycle.</li>
|
|
||||||
</ul>
|
|
||||||
<p>The advantages of this method are that:</p>
|
|
||||||
<ul>
|
|
||||||
<li>You can deploy operating systems.</li>
|
|
||||||
<li>You can manage applications throughout the entire application life cycle.</li>
|
|
||||||
<li>You can scale to large numbers of users and devices.</li>
|
|
||||||
<li>You can support institution-owned and personal devices.</li>
|
|
||||||
<li>It doesn’t require that devices be domain joined.</li>
|
|
||||||
<li>It can manage devices regardless of their location (on or off premises).</li>
|
|
||||||
</ul>
|
|
||||||
<p>The disadvantages of this method are that it:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).</li>
|
|
||||||
<li>Carries an additional cost for Windows Server licenses and the corresponding server hardware.</li>
|
|
||||||
<li>Carries an additional cost for Intune subscription licenses.</li>
|
|
||||||
<li>Requires an AD DS infrastructure (if the institution does not have AD DS already).</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
*Table 6. App and update management products*
|
*Table 6. App and update management products*
|
||||||
|
|
||||||
@ -683,7 +439,7 @@ Now that you have created your new Office 365 Education subscription, add the do
|
|||||||
To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant.
|
To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush).
|
> By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up FAQ](/microsoft-365/education/deploy/office-365-education-self-sign-up).
|
||||||
|
|
||||||
Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks:
|
Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks:
|
||||||
|
|
||||||
@ -695,7 +451,7 @@ You will always want faculty and students to join the Office 365 tenant that you
|
|||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours.
|
> You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours.
|
||||||
|
|
||||||
By default, all new Office 365 Education subscriptions have automatic tenant join enabled, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 10. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins).
|
By default, all new Office 365 Education subscriptions have automatic tenant join enabled, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 10. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](/microsoft-365/education/deploy/office-365-education-self-sign-up).
|
||||||
|
|
||||||
|Action |Windows PowerShell command|
|
|Action |Windows PowerShell command|
|
||||||
|-------|--------------------------|
|
|-------|--------------------------|
|
||||||
@ -714,7 +470,7 @@ To reduce your administrative effort, automatically assign Office 365 Education
|
|||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section.
|
> By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section.
|
||||||
|
|
||||||
Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 11. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins).
|
Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 11. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](/microsoft-365/education/deploy/office-365-education-self-sign-up).
|
||||||
|
|
||||||
|Action |Windows PowerShell command|
|
|Action |Windows PowerShell command|
|
||||||
|-------|--------------------------|
|
|-------|--------------------------|
|
||||||
@ -935,7 +691,7 @@ You can use the Microsoft 365 admin center to add individual Office 365 accounts
|
|||||||
|
|
||||||
The bulk-add process assigns the same Office 365 Education license plan to all users on the list. Therefore, you must create a separate list for each license plan you recorded in Table 9. Depending on the number of faculty members who need to use the classroom, you may want to add the faculty Office 365 accounts manually; however, use the bulk-add process to add student accounts.
|
The bulk-add process assigns the same Office 365 Education license plan to all users on the list. Therefore, you must create a separate list for each license plan you recorded in Table 9. Depending on the number of faculty members who need to use the classroom, you may want to add the faculty Office 365 accounts manually; however, use the bulk-add process to add student accounts.
|
||||||
|
|
||||||
For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Office 365 - Admin help](https://support.office.com/en-us/article/Add-several-users-at-the-same-time-to-Office-365-Admin-Help-1f5767ed-e717-4f24-969c-6ea9d412ca88?ui=en-US&rs=en-US&ad=US).
|
For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Microsoft 365](/microsoft-365/enterprise/add-several-users-at-the-same-time).
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process.
|
> If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process.
|
||||||
@ -949,7 +705,7 @@ Assign SharePoint Online resource permissions to Office 365 security groups, not
|
|||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant.
|
> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant.
|
||||||
|
|
||||||
For information about creating security groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US).
|
For information about creating security groups, see [Create an Office 365 Group in the admin center](/microsoft-365/admin/create-groups/create-groups).
|
||||||
|
|
||||||
You can add and remove users from security groups at any time.
|
You can add and remove users from security groups at any time.
|
||||||
|
|
||||||
@ -966,7 +722,7 @@ You can create email distribution groups based on job role (such as teacher, adm
|
|||||||
> Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps.
|
> Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps.
|
||||||
|
|
||||||
|
|
||||||
For information about creating email distribution groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US).
|
For information about creating email distribution groups, see [Create a Microsoft 365 group in the admin center](/microsoft-365/admin/create-groups/create-groups).
|
||||||
|
|
||||||
#### Summary
|
#### Summary
|
||||||
|
|
||||||
@ -1083,63 +839,11 @@ This guide discusses thick image deployment. For information about thin image de
|
|||||||
### Select a method to initiate deployment
|
### Select a method to initiate deployment
|
||||||
The LTI deployment process is highly automated: it requires minimal information to deploy or upgrade Windows 10. The ZTI deployment process is fully automated, but you must manually initiate it. To do so, use the method listed in Table 15 that best meets the needs of your institution.
|
The LTI deployment process is highly automated: it requires minimal information to deploy or upgrade Windows 10. The ZTI deployment process is fully automated, but you must manually initiate it. To do so, use the method listed in Table 15 that best meets the needs of your institution.
|
||||||
|
|
||||||
<table>
|
|Method|Description and reason to select this method|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="25%" />
|
|Windows Deployment Services|This method:<li>Uses diskless booting to initiate LTI and ZTI deployments.<li>Works only with devices that support PXE boot.<li>Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.<li>Deploys images more slowly than when you use local media.<li>Requires that you deploy a Windows Deployment Services server.<br><br>Select this method when you want to deploy Windows over-the-network and perform diskless booting. The advantage of this method is that the diskless media are generic and typically don’t require updates after you create them (LTI and ZTI access the centrally located deployment content over the network). The disadvantage of this method is that over-the-network deployments are slower than deployments from local media, and you must deploy a Windows Deployment Services server.|
|
||||||
<col width="75%" />
|
|Bootable media|This method:<li>Initiates LTI or ZTI deployment by booting from local media, including from USB drives, DVD, or CD.<li>Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.<li>Deploys images more slowly than when using local media.<li>Requires no additional infrastructure.<br> <br>Select this method when you want to deploy Windows over the network and are willing to boot the target device from local media. The advantage of this method is that the media are generic and typically don’t require updates after you create them (LTI and ZTI access the centrally located deployment content over the network). The disadvantage of this method is that over-the-network deployments are slower than deployment from local media.|
|
||||||
|
|Deployment media|This method:<li>Initiates LTI or ZTI deployment by booting from a local USB hard disk.<li>Deploys Windows 10 from local media, which consumes less network bandwidth than over-the-network methods.<li>Deploys images more quickly than network-based methods do.<li>Requires a USB hard disk because of the deployment share’s storage requirements (up to 100 GB).<br> <br>Select this method when you want to perform local deployments and are willing to boot the target device from a local USB hard disk. The advantage of this method is that local deployments are faster than over-the-network deployments. The disadvantage of this method is that each time you change the deployment share or distribution point content, you must regenerate the deployment media and update the USB hard disk.
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Method</th>
|
|
||||||
<th align="left">Description and reason to select this method</th>
|
|
||||||
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Windows Deployment Services</td>
|
|
||||||
<td><p>This method:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Uses diskless booting to initiate LTI and ZTI deployments.</li>
|
|
||||||
<li>Works only with devices that support PXE boot.</li>
|
|
||||||
<li>Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.</li>
|
|
||||||
<li>Deploys images more slowly than when you use local media.</li>
|
|
||||||
<li>Requires that you deploy a Windows Deployment Services server.</li>
|
|
||||||
</ul>
|
|
||||||
<br/>Select this method when you want to deploy Windows over-the-network and perform diskless booting. The advantage of this method is that the diskless media are generic and typically don’t require updates after you create them (LTI and ZTI access the centrally located deployment content over the network). The disadvantage of this method is that over-the-network deployments are slower than deployments from local media, and you must deploy a Windows Deployment Services server.
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Bootable media</td>
|
|
||||||
<td><p>This method:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Initiates LTI or ZTI deployment by booting from local media, including from USB drives, DVD, or CD.</li>
|
|
||||||
<li>Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.</li>
|
|
||||||
<li>Deploys images more slowly than when using local media.</li>
|
|
||||||
<li>Requires no additional infrastructure.</li>
|
|
||||||
</ul>
|
|
||||||
<br/>Select this method when you want to deploy Windows over the network and are willing to boot the target device from local media. The advantage of this method is that the media are generic and typically don’t require updates after you create them (LTI and ZTI access the centrally located deployment content over the network). The disadvantage of this method is that over-the-network deployments are slower than deployment from local media.
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Deployment media</td>
|
|
||||||
<td><p>This method:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Initiates LTI or ZTI deployment by booting from a local USB hard disk.</li>
|
|
||||||
<li>Deploys Windows 10 from local media, which consumes less network bandwidth than over-the-network methods.</li>
|
|
||||||
<li>Deploys images more quickly than network-based methods do.</li>
|
|
||||||
<li>Requires a USB hard disk because of the deployment share’s storage requirements (up to 100 GB).</li>
|
|
||||||
</ul>
|
|
||||||
<br/>Select this method when you want to perform local deployments and are willing to boot the target device from a local USB hard disk. The advantage of this method is that local deployments are faster than over-the-network deployments. The disadvantage of this method is that each time you change the deployment share or distribution point content, you must regenerate the deployment media and update the USB hard disk.
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
*Table 15. Methods to initiate LTI and ZTI deployments*
|
*Table 15. Methods to initiate LTI and ZTI deployments*
|
||||||
|
|
||||||
@ -1154,91 +858,14 @@ Before you can deploy Windows 10 and your apps to devices, you need to prepare y
|
|||||||
|
|
||||||
The first step in preparing for Windows 10 deployment is to configure—that is, *populate*—the MDT deployment share. Table 16 lists the MDT deployment share configuration tasks that you must perform. Perform the tasks in the order represented in Table 16.
|
The first step in preparing for Windows 10 deployment is to configure—that is, *populate*—the MDT deployment share. Table 16 lists the MDT deployment share configuration tasks that you must perform. Perform the tasks in the order represented in Table 16.
|
||||||
|
|
||||||
<table>
|
|Task|Description|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="25%" />
|
|1. Import operating systems|Import the operating systems that you selected in the [Select the operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench)|
|
||||||
<col width="75%" />
|
|2. Import device drivers|Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.<br>Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench)|
|
||||||
|
|3. Create MDT applications for Microsoft Store apps|Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the **Add-AppxPackage** Windows PowerShell cmdlet to deploy the .appx files associated with the app (called provisioned apps). Use this method to deploy up to 24 apps to Windows 10.<br>Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you will need to obtain the .appx files by performing one of the following tasks:<li>For offline-licensed apps, download the .appx files from the Microsoft Store for Business.<li>For apps that are not offline licensed, obtain the .appx files from the app software vendor directly.<br> <br> If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.<br>If you have Intune or Microsoft Endpoint Configuration Manager, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune) and [Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager). This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.<br>In addition, you must prepare your environment for sideloading Microsoft Store apps. For more information about how to:<li>Prepare your environment for sideloading, see [Try it out: sideload Microsoft Store apps](/previous-versions/windows/).<li>Create an MDT application, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench).|
|
||||||
</colgroup>
|
|4. Create MDT applications for Windows desktop apps|You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.<br>To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in[Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source).<br> If you have Intune, you can [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune), as described in the Deploy and manage apps by using Intune section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps.<br>This is the preferred method for deploying and managing Windows desktop apps.<br>**Note:** You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune) <br>For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt).|
|
||||||
<thead>
|
|5. Create task sequences|You must create separate task sequences for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education, (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education, or (3) if you want to run deployments and upgrades for both 32-bit and 64-bit versions of Windows 10. To do so, you must create task sequences that will:<li>Deploy 64-bit Windows 10 Education to devices.<li>Deploy 32-bit Windows 10 Education to devices.<li>Upgrade existing devices to 64-bit Windows 10 Education.<li>Upgrade existing devices to 32-bit Windows 10 Education.<br> <br>Again, you will create the task sequences based on the operating systems that you imported in step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench).|
|
||||||
<tr class="header">
|
|6. Update the deployment share|Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32-bit and 64-bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.<br>For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#UpdateaDeploymentShareintheDeploymentWorkbench).|
|
||||||
<th align="left">Task</th>
|
|
||||||
<th align="left">Description</th>
|
|
||||||
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">1. Import operating systems</td>
|
|
||||||
<td>Import the operating systems that you selected in the <a href="#select-the-operating-systems" data-raw-source="[Select the operating systems](#select-the-operating-systems)">Select the operating systems</a> section into the deployment share. For more information about how to import operating systems, see <a href="/mem/configmgr/mdt/use-the-mdt#ImportanOperatingSystemintotheDeploymentWorkbench" data-raw-source="[Import an Operating System into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportanOperatingSystemintotheDeploymentWorkbench)">Import an Operating System into the Deployment Workbench</a>.</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">2. Import device drivers</td>
|
|
||||||
<td>Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.<br/><br/>
|
|
||||||
Import device drivers for each device in your institution. For more information about how to import device drivers, see <a href="/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench" data-raw-source="[Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench)">Import Device Drivers into the Deployment Workbench</a>.
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">3. Create MDT applications for Microsoft Store apps</td>
|
|
||||||
<td>Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using <i>sideloading</i>, which allows you to use the <strong>Add-AppxPackage</strong> Windows PowerShell cmdlet to deploy the .appx files associated with the app (called <em>provisioned apps</em>). Use this method to deploy up to 24 apps to Windows 10.<br/><br/>
|
|
||||||
<p>Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you will need to obtain the .appx files by performing one of the following tasks:</p>
|
|
||||||
<ul>
|
|
||||||
<li>For offline-licensed apps, download the .appx files from the Microsoft Store for Business.</li>
|
|
||||||
<li>For apps that are not offline licensed, obtain the .appx files from the app software vendor directly.</li>
|
|
||||||
</ul>
|
|
||||||
<br/>If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.<br/><br/>
|
|
||||||
If you have Intune or Microsoft Endpoint Configuration Manager, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the <a href="#deploy-and-manage-apps-by-using-intune" data-raw-source="[Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)">Deploy and manage apps by using Intune</a> and <a href="#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager" data-raw-source="[Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager)">Deploy and manage apps by using Microsoft Endpoint Configuration Manager</a> sections. This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.<br/><br/>
|
|
||||||
In addition, you must prepare your environment for sideloading Microsoft Store apps. For more information about how to:<br/><br/>
|
|
||||||
<ul>
|
|
||||||
<li>Prepare your environment for sideloading, see <a href="/previous-versions/windows/" data-raw-source="[Try it out: sideload Microsoft Store apps](/previous-versions/windows/)">Try it out: sideload Microsoft Store apps</a>.</li>
|
|
||||||
<li>Create an MDT application, see <a href="/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench" data-raw-source="[Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench)">Create a New Application in the Deployment Workbench</a>.</li>
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">4. Create MDT applications for Windows desktop apps</td>
|
|
||||||
<td>You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.<br/><br/>
|
|
||||||
To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in <a href="/deployoffice/deploy-microsoft-365-apps-local-source" data-raw-source="[Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source)">Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool</a>.<br/><br/>
|
|
||||||
If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the <a href="#deploy-and-manage-apps-by-using-intune" data-raw-source="[Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)">Deploy and manage apps by using Intune</a> section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.
|
|
||||||
<br/><br/>
|
|
||||||
<strong>Note</strong> You can also deploy Windows desktop apps after you deploy Windows 10, as described in the <a href="#deploy-and-manage-apps-by-using-intune" data-raw-source="[Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)">Deploy and manage apps by using Intune</a> section.
|
|
||||||
|
|
||||||
For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt).
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">5. Create task sequences</td>
|
|
||||||
<td><p>You must create separate task sequences for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education, (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education, or (3) if you want to run deployments and upgrades for both 32-bit and 64-bit versions of Windows 10. To do so, you must create task sequences that will:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Deploy 64-bit Windows 10 Education to devices.</li>
|
|
||||||
<li>Deploy 32-bit Windows 10 Education to devices.</li>
|
|
||||||
<li>Upgrade existing devices to 64-bit Windows 10 Education.</li>
|
|
||||||
<li>Upgrade existing devices to 32-bit Windows 10 Education.</li>
|
|
||||||
</ul>
|
|
||||||
<br/>Again, you will create the task sequences based on the operating systems that you imported in step 1. For more information about how to create a task sequence, see <a href="/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench" data-raw-source="[Create a New Task Sequence in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench)">Create a New Task Sequence in the Deployment Workbench</a>.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">6. Update the deployment share</td>
|
|
||||||
<td>Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32-bit and 64-bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.<br/><br/>
|
|
||||||
For more information about how to update a deployment share, see <a href="/mem/configmgr/mdt/use-the-mdt#UpdateaDeploymentShareintheDeploymentWorkbench" data-raw-source="[Update a Deployment Share in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#UpdateaDeploymentShareintheDeploymentWorkbench)">Update a Deployment Share in the Deployment Workbench</a>.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
*Table 16. Tasks to configure the MDT deployment share*
|
*Table 16. Tasks to configure the MDT deployment share*
|
||||||
|
|
||||||
@ -1430,116 +1057,20 @@ Microsoft has several recommended settings for educational institutions. Table 1
|
|||||||
|
|
||||||
Use the information in Table 17 to help you determine whether you need to configure the setting and which method you will use to do so. At the end, you will have a list of settings that you want to apply to the Windows 10 devices and know which management method you will use to configure the settings.
|
Use the information in Table 17 to help you determine whether you need to configure the setting and which method you will use to do so. At the end, you will have a list of settings that you want to apply to the Windows 10 devices and know which management method you will use to configure the settings.
|
||||||
|
|
||||||
<table>
|
|Recommendation|Description|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="75%" />
|
|Use of Microsoft accounts|You want faculty and students to use only Azure AD accounts for institution-owned devices. For these devices, do not use Microsoft accounts or associate a Microsoft account with the Azure AD accounts.<br>**Note** Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices. <br>**Group Policy.** Configure the [Accounts: Block Microsoft accounts](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj966262(v=ws.11)) Group Policy setting to use the **Users can’t add Microsoft accounts** setting option.<br>****Intune**.** To enable or disable the use of Microsoft accounts, use the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy.|
|
||||||
<col width="25%" />
|
|Restrict the local administrator accounts on the devices|Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.<br>**Group Policy**. Create a Local Group Group Policy preference to limit the local administrators group membership. Select the Delete all member users and Delete all member groups check boxes to remove any existing members. For more information about how to configure Local Group preferences, see Configure a Local Group Item. <br>**Intune**. Not available.|
|
||||||
|
|Manage the built-in administrator account created during device deployment|When you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and (optionally) disable it.<br> **Group Policy**. To rename the built-in Administrator account, use the Accounts: Rename administrator account Group policy setting. For more information about how to rename the built-in Administrator account, see [To rename the Administrator account using the Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-essentials-sbs/cc747484(v=ws.10)). You specify the new name for the Administrator account. To disable the built-in Administrator account, use the Accounts: Administrator account status Group policy setting. For more information about how to disable the built-in Administrator account, see [Accounts: Administrator account status](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj852165(v=ws.11)).<br> **Intune**. Not available.|
|
||||||
</colgroup>
|
|Control Microsoft Store access|You can control access to Microsoft Store and whether existing Microsoft Store apps receive updates. You can only disable the Microsoft Store app in Windows 10 Education and Windows 10 Enterprise.<br>**Group policy**. To disable the Microsoft Store app, use the Turn off the Store Application group policy setting. To prevent Microsoft Store apps from receiving updates, use the Turn off Automatic Download and Install of updates Group Policy setting. For more information about configuring these settings, see Can I use Group Policy to control the Microsoft Store in my enterprise environment?<br>**Intune**. To enable or disable Microsoft Store access, use the Allow application store policy setting in the Apps section of a Windows 10 General Configuration policy.|
|
||||||
<thead>
|
|Use of Remote Desktop connections to devices|Remote Desktop connections could allow unauthorized access to the device. Depending on your institution’s policies, you may want to disable Remote Desktop connections on your devices.<br>**Group policy**. To enable or disable Remote Desktop connections to devices, use the Allow Users to connect remotely using Remote Desktop setting in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.<br>**Intune**. Not available.|
|
||||||
<tr class="header">
|
|Use of camera|A device’s camera can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the camera on your devices.<br>**Group policy**. Not available.<br>**Intune**. To enable or disable the camera, use the Allow camera policy setting in the Hardware section of a Windows 10 General Configuration policy.|
|
||||||
<th align="left">Recommendation</th>
|
|Use of audio recording|Audio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices.<br>**Group policy**. To disable the Sound Recorder app, use the Do not allow Sound Recorder to run Group Policy setting. You can disable other audio recording apps by using AppLocker policies. To create AppLocker policies, use the information in [Editing an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791894(v=ws.10)) and [Create Your AppLocker Policies](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791899(v=ws.11)).<br>**Intune**. To enable or disable audio recording, use the Allow voice recording policy setting in the Features section of a Windows 10 General Configuration policy.|
|
||||||
<th align="left">Description</th>
|
|Use of screen capture|Screen captures can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the ability to perform screen captures on your devices.<br>**Group policy**. Not available.<br>**Intune**. To enable or disable screen capture, use the Allow screen capture policy setting in the System section of a Windows 10 General Configuration policy.|
|
||||||
|
|Use of location services|Providing a device’s location can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the location service on your devices.<br>**Group policy**. To enable or disable location services, use the Turn off location group policy setting in User Configuration\Windows Components\Location and Sensors.<br>**Intune**. To enable or disable location services, use the Allow geolocation policy setting in the Hardware section of a Windows 10 General Configuration policy.|
|
||||||
</tr>
|
|Changing wallpaper|Custom wallpapers can be a source of disclosure or privacy issues in an education environment (if the wallpaper displays information about the user or device). Depending on your institution’s policies, you may want to prevent users from changing the wallpaper on institution-owned devices.<br>**Group policy**. To configure the wallpaper, use the Desktop WallPaper setting in User Configuration\Administrative Templates\Desktop\Desktop.<br>**Intune**. Not available.|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Use of Microsoft accounts</td>
|
|
||||||
<td>You want faculty and students to use only Azure AD accounts for institution-owned devices. For these devices, do not use Microsoft accounts or associate a Microsoft account with the Azure AD accounts.<br/><br/>
|
|
||||||
|
|
||||||
**Note** Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.<br/><br/>
|
|
||||||
**Group Policy.** Configure the [Accounts: Block Microsoft accounts](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj966262(v=ws.11)) Group Policy setting to use the **Users can’t add Microsoft accounts** setting option.<br/><br/>
|
|
||||||
**Intune.** To enable or disable the use of Microsoft accounts, use the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Restrict the local administrator accounts on the devices</td>
|
|
||||||
<td>Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.<br/><br/>
|
|
||||||
<strong>Group Policy.</strong> Create a <strong>Local Group</strong> Group Policy preference to limit the local administrators group membership. Select the Delete all member users and Delete all member groups check boxes to remove any existing members. For more information about how to configure Local Group preferences, see Configure a Local Group Item.<br/><br/>
|
|
||||||
<strong>Intune.</strong> Not available.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Manage the built-in administrator account created during device deployment</td>
|
|
||||||
<td>When you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and (optionally) disable it.<br/><br/>
|
|
||||||
<strong>Group Policy.</strong> To rename the built-in Administrator account, use the <strong>Accounts: Rename administrator account</strong> Group Policy setting. For more information about how to rename the built-in Administrator account, see <a href="/previous-versions/windows/it-pro/windows-server-essentials-sbs/cc747484(v=ws.10)" data-raw-source="[To rename the Administrator account using the Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-essentials-sbs/cc747484(v=ws.10))">To rename the Administrator account using the Group Policy Management Console</a>. You specify the new name for the Administrator account. To disable the built-in Administrator account, use the <strong>Accounts: Administrator account status</strong> Group Policy setting. For more information about how to disable the built-in Administrator account, see <a href="/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj852165(v=ws.11)" data-raw-source="[Accounts: Administrator account status](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj852165(v=ws.11))">Accounts: Administrator account status</a>.<br/><br/>
|
|
||||||
<strong>Intune.</strong> Not available.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Control Microsoft Store access</td>
|
|
||||||
<td>You can control access to Microsoft Store and whether existing Microsoft Store apps receive updates. You can only disable the Microsoft Store app in Windows 10 Education and Windows 10 Enterprise.<br/><br/>
|
|
||||||
<strong>Group Policy.</strong> To disable the Microsoft Store app, use the <strong>Turn off the Store Application</strong> group policy setting. To prevent Microsoft Store apps from receiving updates, use the <strong>Turn off Automatic Download and Install of updates</strong> Group Policy setting. For more information about configuring these settings, see <a href="/previous-versions/windows/it-pro/windows-8.1-and-8/hh832040(v=ws.11)#BKMK_UseGP" data-raw-source="[Can I use Group Policy to control the Microsoft Store in my enterprise environment?](/previous-versions/windows/it-pro/windows-8.1-and-8/hh832040(v=ws.11)#BKMK_UseGP)">Can I use Group Policy to control the Microsoft Store in my enterprise environment?</a>.<br/><br/>
|
|
||||||
<strong>Intune.</strong> To enable or disable Microsoft Store access, use the <strong>Allow application store</strong> policy setting in the <strong>Apps</strong> section of a <strong>Windows 10 General Configuration policy</strong>.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Use of Remote Desktop connections to devices</td>
|
|
||||||
<td>Remote Desktop connections could allow unauthorized access to the device. Depending on your institution’s policies, you may want to disable Remote Desktop connections on your devices.<br/><br/>
|
|
||||||
<strong>Group Policy.</strong> To enable or disable Remote Desktop connections to devices, use the <strong>Allow Users to connect remotely using Remote Desktop</strong> setting in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.<br/><br/>
|
|
||||||
<strong>Intune.</strong> Not available.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Use of camera</td>
|
|
||||||
<td>A device’s camera can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the camera on your devices.<br/><br/>
|
|
||||||
<strong>Group Policy.</strong> Not available.<br/><br/>
|
|
||||||
<strong>Intune.</strong> To enable or disable the camera, use the <strong>Allow camera</strong> policy setting in the <strong>Hardware</strong> section of a <strong>Windows 10 General Configuration</strong> policy.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Use of audio recording</td>
|
|
||||||
<td>Audio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices.<br/><br/>
|
|
||||||
<strong>Group Policy.</strong> To disable the Sound Recorder app, use the <strong>Do not allow Sound Recorder to run</strong> Group Policy setting. You can disable other audio recording apps by using AppLocker policies. To create AppLocker policies, use the information in <a href="/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791894(v=ws.10)" data-raw-source="[Editing an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791894(v=ws.10))">Editing an AppLocker Policy</a> and <a href="/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791899(v=ws.11)" data-raw-source="[Create Your AppLocker Policies](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791899(v=ws.11))">Create Your AppLocker Policies</a>.<br/><br/>
|
|
||||||
<strong>Intune.</strong> To enable or disable audio recording, use the <strong>Allow voice recording</strong> policy setting in the <strong>Features</strong> section of a <strong>Windows 10 General Configuration</strong> policy.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Use of screen capture</td>
|
|
||||||
<td>Screen captures can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the ability to perform screen captures on your devices.<br/><br/>
|
|
||||||
<strong>Group Policy.</strong> Not available.<br/><br/>
|
|
||||||
<strong>Intune.</strong> To enable or disable screen capture, use the <strong>Allow screen capture</strong> policy setting in the <strong>System</strong> section of a <strong>Windows 10 General Configuration</strong> policy.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Use of location services</td>
|
|
||||||
<td>Providing a device’s location can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the location service on your devices.<br/><br/>
|
|
||||||
<strong>Group Policy.</strong> To enable or disable location services, use the <strong>Turn off location</strong> group policy setting in User Configuration\Windows Components\Location and Sensors.<br/><br/>
|
|
||||||
<strong>Intune.</strong> To enable or disable location services, use the <strong>Allow geolocation</strong> policy setting in the <strong>Hardware</strong> section of a <strong>Windows 10 General Configuration</strong> policy.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td valign="top">Changing wallpaper</td>
|
|
||||||
<td>Custom wallpapers can be a source of disclosure or privacy issues in an education environment (if the wallpaper displays information about the user or device). Depending on your institution’s policies, you may want to prevent users from changing the wallpaper on institution-owned devices.<br/><br/>
|
|
||||||
<strong>Group Policy.</strong> To configure the wallpaper, use the <strong>Desktop WallPaper</strong> setting in User Configuration\Administrative Templates\Desktop\Desktop.<br/><br/>
|
|
||||||
<strong>Intune.</strong> Not available.
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
<br/>
|
<br/>
|
||||||
<em>Table 17. Recommended settings for educational institutions</em>
|
<em>Table 17. Recommended settings for educational institutions</em>
|
||||||
|
|
||||||
@ -1719,205 +1250,23 @@ After the initial deployment, you need to perform certain tasks to maintain the
|
|||||||
|
|
||||||
Table 19 lists the school and individual classroom maintenance tasks, the resources for performing the tasks, and the schedule (or frequency) on which you should perform the tasks.
|
Table 19 lists the school and individual classroom maintenance tasks, the resources for performing the tasks, and the schedule (or frequency) on which you should perform the tasks.
|
||||||
|
|
||||||
<table>
|
|Task and resources|Monthly|New semester or academic year|As required|
|
||||||
<colgroup>
|
|--- |--- |--- |--- |
|
||||||
<col width="10%" />
|
|Verify that Windows Update is active and current with operating system and software updates.<br>For more information about completing this task when you have:<li>Intune, see [Keep Windows PCs up to date with software updates in Microsoft Intune](/intune/deploy-use/keep-windows-pcs-up-to-date-with-software-updates-in-microsoft-intune)<li>Group Policy, see [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).<li>WSUS, see [Windows Server Update Services](/windows/deployment/deploy-whats-new).<br>Neither Intune, Group Policy, nor WSUS, see “Install, upgrade, & activate” in Windows 10 help.|✔️|✔️|✔️|
|
||||||
<col width="10%" />
|
|Verify that Windows Defender is active and current with malware Security intelligence.<br>For more information about completing this task, see [Turn Windows Defender on or off](https://support.microsoft.com/instantanswers/742778f2-6aad-4a8d-8f5d-db59cebc4f24/how-to-protect-your-windows-10-pc#v1h=tab02)and [Updating Windows Defender](https://support.microsoft.com/instantanswers/742778f2-6aad-4a8d-8f5d-db59cebc4f24/how-to-protect-your-windows-10-pc#v1h=tab03).|✔️|✔️|✔️|
|
||||||
<col width="10%" />
|
|Verify that Windows Defender has run a scan in the past week and that no viruses or malware were found.<br>For more information about completing this task, see the “How do I find and remove a virus?” topic in [Protect my PC from viruses](https://support.microsoft.com/help/17228/windows-protect-my-pc-from-viruses).|✔️|✔️|✔️|
|
||||||
<col width="70%" />
|
|Download and approve updates for Windows 10, apps, device driver, and other software.<br>For more information, see:<li>[Manage updates by using Intune](#manage-updates-by-using-intune)<li>[Manage updates by using Microsoft Endpoint Configuration Manager](#manage-updates-by-using-microsoft-endpoint-configuration-manager)|✔️|✔️|✔️|
|
||||||
</colgroup>
|
|Verify that you’re using the appropriate Windows 10 servicing options for updates and upgrades (such as selecting whether you want to use Current Branch or Current Branch for Business).<br>For more information about Windows 10 servicing options for updates and upgrades, see [Windows 10 servicing options](/windows/deployment/update/).||✔️|✔️|
|
||||||
<thead>
|
|Refresh the operating system and apps on devices.<br>For more information about completing this task, see the following resources:<li>[Prepare for deployment](#prepare-for-deployment)<li>[Capture the reference image](#capture-the-reference-image)<li>[Deploy Windows 10 to devices](#deploy-windows-10-to-devices)||✔️|✔️|
|
||||||
<tr class="header">
|
|Install any new Windows desktop apps, or update any Windows desktop apps used in the curriculum.<br>For more information, see:<li>[Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)<li>[Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager)||✔️|✔️|
|
||||||
<th align="left">Task and resources</th>
|
|Install new or update existing Microsoft Store apps used in the curriculum.<br>Microsoft Store apps are automatically updated from Microsoft Store. The menu bar in the Microsoft Store app shows whether any Microsoft Store app updates are available for download.<br>You can also deploy Microsoft Store apps directly to devices by using Intune, Microsoft Endpoint Configuration Manager, or both in a hybrid configuration. <br>For more information, see:<li>[Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)<li>[Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager)||✔️|✔️|
|
||||||
<th align="left">Monthly</th>
|
|Remove unnecessary user accounts (and corresponding licenses) from AD DS and Office 365 (if you have an on-premises AD DS infrastructure).<br>For more information about how to:<li>Remove unnecessary user accounts, see [Active Directory Administrative Center](/windows-server/identity/ad-ds/get-started/adac/active-directory-administrative-center) <li>Remove licenses, see [Add users and assign licenses](/microsoft-365/admin/add-users/add-users)||✔️|✔️|
|
||||||
<th align="left">New semester or academic year</th>
|
|Add new accounts (and corresponding licenses) to AD DS (if you have an on-premises AD DS infrastructure).<br>For more information about how to:<li>Add user accounts, see [Bulk-import user and group accounts into AD DS](#bulk-import-user-and-group-accounts-into-ad-ds)<li>Assign licenses, see [Add users and assign licenses](/microsoft-365/admin/add-users/add-users)||✔️|✔️|
|
||||||
<th align="left">As required</th>
|
|Remove unnecessary user accounts (and corresponding licenses) from Office 365 (if you do not have an on-premises AD DS infrastructure).<br>For more information about how to:<li>Remove unnecessary user accounts, see [Delete or restore users](/microsoft-365/admin/add-users/delete-a-user)<li> Remove licenses, [Assign or remove licenses for Microsoft 365](/microsoft-365/admin/add-users/add-users).||✔️|✔️|
|
||||||
</tr>
|
|Add new accounts (and corresponding licenses) to Office 365 (if you don’t have an on-premises AD DS infrastructure).<br>For more information about how to:<li>Add user accounts, see [Add users to Microsoft 365](/microsoft-365/admin/add-users/add-users) and [Add users individually or in bulk to Office 365](https://www.youtube.com/watch?v=zDs3VltTJps).<li>Assign licenses, see [Add users to Microsoft 365](/microsoft-365/admin/add-users/add-users).||✔️|✔️|
|
||||||
</thead>
|
|Create or modify security groups, and manage group membership in Office 365.<br>For more information about how to:<li>Create or modify security groups, see [Create a Microsoft 365 group](/microsoft-365/admin/create-groups/create-groups)<li>Manage group membership, see [Manage Group membership](/microsoft-365/admin/create-groups/add-or-remove-members-from-groups).||✔️|✔️|
|
||||||
<tbody>
|
|Create or modify Exchange Online or Microsoft Exchange Server distribution lists in Office 365.<br>For more information about how to create or modify Exchange Online or Exchange Server distribution lists in Office 365, see [Create and manage distribution groups](/exchange/recipients-in-exchange-online/manage-distribution-groups/manage-distribution-groups) and [Create, edit, or delete a security group](/microsoft-365/admin/email/create-edit-or-delete-a-security-group).||✔️|✔️|
|
||||||
<tr>
|
|Install new student devices.<br> Follow the same steps you followed in the[Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section.|||✔️|
|
||||||
<td>Verify that Windows Update is active and current with operating system and software updates.<br/><br/>
|
|
||||||
For more information about completing this task when you have:
|
|
||||||
<ul>
|
|
||||||
<li>Intune, see <a href="/intune/deploy-use/keep-windows-pcs-up-to-date-with-software-updates-in-microsoft-intune" data-raw-source="[Keep Windows PCs up to date with software updates in Microsoft Intune](/intune/deploy-use/keep-windows-pcs-up-to-date-with-software-updates-in-microsoft-intune)">Keep Windows PCs up to date with software updates in Microsoft Intune</a>.</li>
|
|
||||||
<li>Group Policy, see <a href="/windows/deployment/update/waas-manage-updates-wufb" data-raw-source="[Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb)">Windows Update for Business</a>.</li>
|
|
||||||
<li>WSUS, see <a href="/windows/deployment/deploy-whats-new" data-raw-source="[Windows Server Update Services](/windows/deployment/deploy-whats-new)">Windows Server Update Services</a>.</li>
|
|
||||||
<li>Neither Intune, Group Policy, nor WSUS, see “Install, upgrade, & activate” in <a href="https://support.microsoft.com/products/windows?os=windows-10" data-raw-source="[Windows 10 help](https://support.microsoft.com/products/windows?os=windows-10)">Windows 10 help</a>.</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Verify that Windows Defender is active and current with malware Security intelligence.<br/><br/>
|
|
||||||
For more information about completing this task, see <a href="https://support.microsoft.com/instantanswers/742778f2-6aad-4a8d-8f5d-db59cebc4f24/how-to-protect-your-windows-10-pc#v1h=tab02" data-raw-source="[Turn Windows Defender on or off](https://support.microsoft.com/instantanswers/742778f2-6aad-4a8d-8f5d-db59cebc4f24/how-to-protect-your-windows-10-pc#v1h=tab02)">Turn Windows Defender on or off</a> and <a href="https://support.microsoft.com/instantanswers/742778f2-6aad-4a8d-8f5d-db59cebc4f24/how-to-protect-your-windows-10-pc#v1h=tab03" data-raw-source="[Updating Windows Defender](https://support.microsoft.com/instantanswers/742778f2-6aad-4a8d-8f5d-db59cebc4f24/how-to-protect-your-windows-10-pc#v1h=tab03)">Updating Windows Defender</a>.
|
|
||||||
</td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Verify that Windows Defender has run a scan in the past week and that no viruses or malware were found.<br/><br/>
|
|
||||||
For more information about completing this task, see the “How do I find and remove a virus?” topic in <a href="https://support.microsoft.com/help/17228/windows-protect-my-pc-from-viruses" data-raw-source="[Protect my PC from viruses](https://support.microsoft.com/help/17228/windows-protect-my-pc-from-viruses)">Protect my PC from viruses</a>.
|
|
||||||
</td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Download and approve updates for Windows 10, apps, device driver, and other software.<br/><br/>
|
|
||||||
For more information, see:
|
|
||||||
<ul>
|
|
||||||
<li><a href="#manage-updates-by-using-intune" data-raw-source="[Manage updates by using Intune](#manage-updates-by-using-intune)">Manage updates by using Intune</a></li>
|
|
||||||
<li><a href="#manage-updates-by-using-microsoft-endpoint-configuration-manager" data-raw-source="[Manage updates by using Microsoft Endpoint Configuration Manager](#manage-updates-by-using-microsoft-endpoint-configuration-manager)">Manage updates by using Microsoft Endpoint Configuration Manager</a></li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Verify that you’re using the appropriate Windows 10 servicing options for updates and upgrades (such as selecting whether you want to use Current Branch or Current Branch for Business).<br/><br/>
|
|
||||||
For more information about Windows 10 servicing options for updates and upgrades, see <a href="/windows/deployment/update/" data-raw-source="[Windows 10 servicing options](/windows/deployment/update/)">Windows 10 servicing options</a>.
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Refresh the operating system and apps on devices.<br/><br/>
|
|
||||||
For more information about completing this task, see the following resources:
|
|
||||||
<ul>
|
|
||||||
<li><a href="#prepare-for-deployment" data-raw-source="[Prepare for deployment](#prepare-for-deployment)">Prepare for deployment</a></li>
|
|
||||||
<li><a href="#capture-the-reference-image" data-raw-source="[Capture the reference image](#capture-the-reference-image)">Capture the reference image</a></li>
|
|
||||||
<li><a href="#deploy-windows-10-to-devices" data-raw-source="[Deploy Windows 10 to devices](#deploy-windows-10-to-devices)">Deploy Windows 10 to devices</a></li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Install any new Windows desktop apps, or update any Windows desktop apps used in the curriculum.<br/><br/>
|
|
||||||
For more information, see:
|
|
||||||
<ul>
|
|
||||||
<li><a href="#deploy-and-manage-apps-by-using-intune" data-raw-source="[Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)">Deploy and manage apps by using Intune</a></li>
|
|
||||||
<li><a href="#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager" data-raw-source="[Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager)">Deploy and manage apps by using Microsoft Endpoint Configuration Manager</a></li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Install new or update existing Microsoft Store apps used in the curriculum.<br/><br/>
|
|
||||||
Microsoft Store apps are automatically updated from Microsoft Store. The menu bar in the Microsoft Store app shows whether any Microsoft Store app updates are available for download.<br/><br/>
|
|
||||||
You can also deploy Microsoft Store apps directly to devices by using Intune, Microsoft Endpoint Configuration Manager, or both in a hybrid configuration. For more information, see:
|
|
||||||
<ul>
|
|
||||||
<li><a href="#deploy-and-manage-apps-by-using-intune" data-raw-source="[Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)">Deploy and manage apps by using Intune</a></li>
|
|
||||||
<li><a href="#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager" data-raw-source="[Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager)">Deploy and manage apps by using Microsoft Endpoint Configuration Manager</a></li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Remove unnecessary user accounts (and corresponding licenses) from AD DS and Office 365 (if you have an on-premises AD DS infrastructure).<br/><br/>
|
|
||||||
For more information about how to:
|
|
||||||
<ul>
|
|
||||||
<li>Remove unnecessary user accounts, see <a href="/windows-server/identity/ad-ds/get-started/adac/active-directory-administrative-center" data-raw-source="[Active Directory Administrative Center](/windows-server/identity/ad-ds/get-started/adac/active-directory-administrative-center)">Active Directory Administrative Center</a>.</li>
|
|
||||||
<li>Remove licenses, see <a href="https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US" data-raw-source="[Assign or remove licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US)">Assign or remove licenses for Office 365 for business</a>.</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Add new accounts (and corresponding licenses) to AD DS (if you have an on-premises AD DS infrastructure).<br/><br/>
|
|
||||||
For more information about how to:
|
|
||||||
<ul>
|
|
||||||
<li>Add user accounts, see <a href="#bulk-import-user-and-group-accounts-into-ad-ds" data-raw-source="[Bulk-import user and group accounts into AD DS](#bulk-import-user-and-group-accounts-into-ad-ds)">Bulk-import user and group accounts into AD DS</a>.</li>
|
|
||||||
<li>Assign licenses, see <a href="https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US" data-raw-source="[Assign or remove licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US)">Assign or remove licenses for Office 365 for business</a>.</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Remove unnecessary user accounts (and corresponding licenses) from Office 365 (if you do not have an on-premises AD DS infrastructure).<br/><br/>
|
|
||||||
For more information about how to:
|
|
||||||
<ul>
|
|
||||||
<li>Remove unnecessary user accounts, see <a href="https://support.office.com/en-us/article/Delete-or-restore-users-d5155593-3bac-4d8d-9d8b-f4513a81479e" data-raw-source="[Delete or restore users](https://support.office.com/en-us/article/Delete-or-restore-users-d5155593-3bac-4d8d-9d8b-f4513a81479e)">Delete or restore users</a>.</li>
|
|
||||||
<li>Remove licenses, see <a href="https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US" data-raw-source="[Assign or remove licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US)">Assign or remove licenses for Office 365 for business</a>.</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Add new accounts (and corresponding licenses) to Office 365 (if you don’t have an on-premises AD DS infrastructure).<br/><br/>
|
|
||||||
For more information about how to:
|
|
||||||
<ul>
|
|
||||||
<li>Add user accounts, see <a href="https://support.office.com/en-us/article/Add-users-to-Office-365-for-business-435ccec3-09dd-4587-9ebd-2f3cad6bc2bc" data-raw-source="[Add users to Office 365 for business](https://support.office.com/en-us/article/Add-users-to-Office-365-for-business-435ccec3-09dd-4587-9ebd-2f3cad6bc2bc)">Add users to Office 365 for business</a> and <a href="https://www.youtube.com/watch?v=zDs3VltTJps" data-raw-source="[Add users individually or in bulk to Office 365](https://www.youtube.com/watch?v=zDs3VltTJps)">Add users individually or in bulk to Office 365</a>.</li>
|
|
||||||
<li>Assign licenses, see <a href="https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US" data-raw-source="[Assign or remove licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US)">Assign or remove licenses for Office 365 for business</a>.</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Create or modify security groups, and manage group membership in Office 365.<br/><br/>
|
|
||||||
For more information about how to:
|
|
||||||
<ul>
|
|
||||||
<li>Create or modify security groups, see <a href="https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US" data-raw-source="[Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US)">Create an Office 365 Group in the admin center</a>.</li>
|
|
||||||
<li>Manage group membership, see <a href="https://support.office.com/en-us/article/Manage-Group-membership-in-the-Office-365-admin-center-e186d224-a324-4afa-8300-0e4fc0c3000a" data-raw-source="[Manage Group membership in the admin center](https://support.office.com/en-us/article/Manage-Group-membership-in-the-Office-365-admin-center-e186d224-a324-4afa-8300-0e4fc0c3000a)">Manage Group membership in the admin center</a>.</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Create or modify Exchange Online or Microsoft Exchange Server distribution lists in Office 365.<br/><br/>
|
|
||||||
For more information about how to create or modify Exchange Online or Exchange Server distribution lists in Office 365, see <a href="/exchange/recipients-in-exchange-online/manage-distribution-groups/manage-distribution-groups" data-raw-source="[Create and manage distribution groups](/exchange/recipients-in-exchange-online/manage-distribution-groups/manage-distribution-groups)">Create and manage distribution groups</a> and <a href="https://support.office.com/en-us/article/Create-edit-or-delete-a-security-group-55C96B32-E086-4C9E-948B-A018B44510CB" data-raw-source="[Create, edit, or delete a security group](https://support.office.com/en-us/article/Create-edit-or-delete-a-security-group-55C96B32-E086-4C9E-948B-A018B44510CB)">Create, edit, or delete a security group</a>.
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
<tr>
|
|
||||||
<td>Install new student devices.<br/><br/>
|
|
||||||
Follow the same steps you followed in the <a href="#deploy-windows-10-to-devices" data-raw-source="[Deploy Windows 10 to devices](#deploy-windows-10-to-devices)">Deploy Windows 10 to devices</a> section.
|
|
||||||
</td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td>x</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
<br/>
|
|
||||||
|
|
||||||
*Table 19. School and individual classroom maintenance tasks, with resources and the schedule for performing them*
|
*Table 19. School and individual classroom maintenance tasks, with resources and the schedule for performing them*
|
||||||
|
|
||||||
|
|||||||
@ -164,184 +164,164 @@ For more information, see [Manage settings in the Store for Business](manage-set
|
|||||||
Store for Business and Education is currently available in these markets.
|
Store for Business and Education is currently available in these markets.
|
||||||
|
|
||||||
### Support for free and paid products
|
### Support for free and paid products
|
||||||
<table>
|
|
||||||
<tr>
|
- Afghanistan
|
||||||
<th align="center" colspan="4">Supports all free and paid products</th>
|
- Algeria
|
||||||
</tr>
|
- Andorra
|
||||||
<tr align="left">
|
- Angola
|
||||||
<td>
|
- Anguilla
|
||||||
<ul>
|
- Antigua and Barbuda
|
||||||
<li>Afghanistan</li>
|
- Argentina
|
||||||
<li>Algeria</li>
|
- Australia
|
||||||
<li>Andorra</li>
|
- Austria
|
||||||
<li>Angola</li>
|
- Bahamas
|
||||||
<li>Anguilla</li>
|
- Bahrain
|
||||||
<li>Antigua and Barbuda</li>
|
- Bangladesh
|
||||||
<li>Argentina</li>
|
- Barbados
|
||||||
<li>Australia</li>
|
- Belgium
|
||||||
<li>Austria</li>
|
- Belize
|
||||||
<li>Bahamas</li>
|
- Bermuda
|
||||||
<li>Bahrain</li>
|
- Benin
|
||||||
<li>Bangladesh</li>
|
- Bhutan
|
||||||
<li>Barbados</li>
|
- Bolivia
|
||||||
<li>Belgium</li>
|
- Bonaire
|
||||||
<li>Belize</li>
|
- Botswana
|
||||||
<li>Bermuda</li>
|
- Brunei Darussalam
|
||||||
<li>Benin</li>
|
- Bulgaria
|
||||||
<li>Bhutan</li>
|
- Burundi
|
||||||
<li>Bolivia</li>
|
- Cambodia
|
||||||
<li>Bonaire</li>
|
- Cameroon
|
||||||
<li>Botswana</li>
|
- Canada
|
||||||
<li>Brunei Darussalam</li>
|
- Cayman Islands
|
||||||
<li>Bulgaria</li>
|
- Chile
|
||||||
<li>Burundi</li>
|
- Colombia
|
||||||
<li>Cambodia</li>
|
- Comoros
|
||||||
<li>Cameroon</li>
|
- Costa Rica
|
||||||
<li>Canada</li>
|
- Côte D'ivoire
|
||||||
<li>Cayman Islands</li>
|
- Croatia
|
||||||
<li>Chile</li>
|
- Curçao
|
||||||
<li>Colombia</li>
|
- Cyprus
|
||||||
<li>Comoros</li>
|
- Czech Republic
|
||||||
<li>Costa Rica</li>
|
- Denmark
|
||||||
<li>Côte D'ivoire</li>
|
- Dominican Republic
|
||||||
<li>Croatia</li>
|
- Ecuador
|
||||||
<li>Curçao</li>
|
- Egypt
|
||||||
<li>Cyprus</li>
|
- El Salvador
|
||||||
<li>Czech Republic</li>
|
- Estonia
|
||||||
<li>Denmark</li>
|
- Ethiopia
|
||||||
<li>Dominican Republic</li>
|
- Faroe Islands
|
||||||
<li>Ecuador</li>
|
- Fiji
|
||||||
</ul>
|
- Finland
|
||||||
</td>
|
- France
|
||||||
<td>
|
- French Guiana
|
||||||
<ul>
|
- French Polynesia
|
||||||
<li>Egypt</li>
|
- Germany
|
||||||
<li>El Salvador</li>
|
- Ghana
|
||||||
<li>Estonia</li>
|
- Greece
|
||||||
<li>Ethiopia</li>
|
- Greenland
|
||||||
<li>Faroe Islands</li>
|
- Guadeloupe
|
||||||
<li>Fiji</li>
|
- Guatemala
|
||||||
<li>Finland</li>
|
- Honduras
|
||||||
<li>France</li>
|
- Hong Kong SAR
|
||||||
<li>French Guiana</li>
|
- Hungary
|
||||||
<li>French Polynesia</li>
|
- Iceland
|
||||||
<li>Germany</li>
|
- Indonesia
|
||||||
<li>Ghana</li>
|
- Iraq
|
||||||
<li>Greece</li>
|
- Ireland
|
||||||
<li>Greenland</li>
|
- Israel
|
||||||
<li>Guadeloupe</li>
|
- Italy
|
||||||
<li>Guatemala</li>
|
- Jamaica
|
||||||
<li>Honduras</li>
|
- Japan
|
||||||
<li>Hong Kong SAR</li>
|
- Jersey
|
||||||
<li>Hungary</li>
|
- Jordan
|
||||||
<li>Iceland</li>
|
- Kenya
|
||||||
<li>Indonesia</li>
|
- Kuwait
|
||||||
<li>Iraq</li>
|
- Laos
|
||||||
<li>Ireland</li>
|
- Latvia
|
||||||
<li>Israel</li>
|
- Lebanon
|
||||||
<li>Italy</li>
|
- Libya
|
||||||
<li>Jamaica</li>
|
- Liechtenstein
|
||||||
<li>Japan</li>
|
- Lithuania
|
||||||
<li>Jersey</li>
|
- Luxembourg
|
||||||
<li>Jordan</li>
|
- Macedonia
|
||||||
<li>Kenya</li>
|
- Madagascar
|
||||||
<li>Kuwait</li>
|
- Malawi
|
||||||
<li>Laos</li>
|
- Malaysia
|
||||||
<li>Latvia</li>
|
- Maldives
|
||||||
<li>Lebanon</li>
|
- Mali
|
||||||
<li>Libya</li>
|
- Malta
|
||||||
<li>Liechtenstein</li>
|
- Marshall Islands
|
||||||
<li>Lithuania</li>
|
- Martinique
|
||||||
<li>Luxembourg</li>
|
- Mauritius
|
||||||
<li>Macedonia</li>
|
- Mayotte
|
||||||
<li>Madagascar</li>
|
- Mexico
|
||||||
</ul>
|
- Mongolia
|
||||||
</td>
|
- Montenegro
|
||||||
<td>
|
- Morocco
|
||||||
<ul>
|
- Mozambique
|
||||||
<li>Malawi</li>
|
- Myanamar
|
||||||
<li>Malaysia</li>
|
- Namibia
|
||||||
<li>Maldives</li>
|
- Nepal
|
||||||
<li>Mali</li>
|
- Netherlands
|
||||||
<li>Malta</li>
|
- New Caledonia
|
||||||
<li>Marshall Islands</li>
|
- New Zealand
|
||||||
<li>Martinique</li>
|
- Nicaragua
|
||||||
<li>Mauritius</li>
|
- Nigeria
|
||||||
<li>Mayotte</li>
|
- Norway
|
||||||
<li>Mexico</li>
|
- Oman
|
||||||
<li>Mongolia</li>
|
- Pakistan
|
||||||
<li>Montenegro</li>
|
- Palestinian Authority
|
||||||
<li>Morocco</li>
|
- Panama
|
||||||
<li>Mozambique</li>
|
- Papua New Guinea
|
||||||
<li>Myanamar</li>
|
- Paraguay
|
||||||
<li>Namibia</li>
|
- Peru
|
||||||
<li>Nepal</li>
|
- Philippines
|
||||||
<li>Netherlands</li>
|
- Poland
|
||||||
<li>New Caledonia</li>
|
- Portugal
|
||||||
<li>New Zealand</li>
|
- Qatar
|
||||||
<li>Nicaragua</li>
|
- Republic of Cabo Verde
|
||||||
<li>Nigeria</li>
|
- Reunion
|
||||||
<li>Norway</li>
|
- Romania
|
||||||
<li>Oman</li>
|
- Rwanda
|
||||||
<li>Pakistan</li>
|
- Saint Kitts and Nevis
|
||||||
<li>Palestinian Authority</li>
|
- Saint Lucia
|
||||||
<li>Panama</li>
|
- Saint Martin
|
||||||
<li>Papua New Guinea</li>
|
- Saint Vincent and the Grenadines
|
||||||
<li>Paraguay</li>
|
- San marino
|
||||||
<li>Peru</li>
|
- Saudi Arabia
|
||||||
<li>Philippines</li>
|
- Senegal
|
||||||
<li>Poland</li>
|
- Serbia
|
||||||
<li>Portugal</li>
|
- Seychelles
|
||||||
<li>Qatar</li>
|
- Singapore
|
||||||
<li>Republic of Cabo Verde</li>
|
- Sint Maarten
|
||||||
<li>Reunion</li>
|
- Slovakia
|
||||||
<li>Romania</li>
|
- Slovenia
|
||||||
<li>Rwanda</li>
|
- South Africa
|
||||||
<li>Saint Kitts and Nevis</li>
|
- Spain
|
||||||
</ul>
|
- Sri Lanka
|
||||||
</td>
|
- Suriname
|
||||||
<td>
|
- Sweden
|
||||||
<ul>
|
- Switzerland
|
||||||
<li>Saint Lucia</li>
|
- Tanzania
|
||||||
<li>Saint Martin</li>
|
- Thailand
|
||||||
<li>Saint Vincent and the Grenadines</li>
|
- Timor-Leste
|
||||||
<li>San marino</li>
|
- Togo
|
||||||
<li>Saudi Arabia</li>
|
- Tonga
|
||||||
<li>Senegal</li>
|
- Trinidad and Tobago
|
||||||
<li>Serbia</li>
|
- Tunisia
|
||||||
<li>Seychelles</li>
|
- Turkey
|
||||||
<li>Singapore</li>
|
- Turks and Caicos Islands
|
||||||
<li>Sint Maarten</li>
|
- Uganda
|
||||||
<li>Slovakia</li>
|
- United Arab Emirates
|
||||||
<li>Slovenia</li>
|
- United Kingdom
|
||||||
<li>South Africa</li>
|
- United States
|
||||||
<li>Spain</li>
|
- Uruguay
|
||||||
<li>Sri Lanka</li>
|
- Vatican City
|
||||||
<li>Suriname</li>
|
- Viet Nam
|
||||||
<li>Sweden</li>
|
- Virgin Islands, U.S.
|
||||||
<li>Switzerland</li>
|
- Zambia
|
||||||
<li>Tanzania</li>
|
- Zimbabwe
|
||||||
<li>Thailand</li>
|
|
||||||
<li>Timor-Leste</li>
|
|
||||||
<li>Togo</li>
|
|
||||||
<li>Tonga</li>
|
|
||||||
<li>Trinidad and Tobago</li>
|
|
||||||
<li>Tunisia</li>
|
|
||||||
<li>Turkey</li>
|
|
||||||
<li>Turks and Caicos Islands</li>
|
|
||||||
<li>Uganda</li>
|
|
||||||
<li>United Arab Emirates</li>
|
|
||||||
<li>United Kingdom</li>
|
|
||||||
<li>United States</li>
|
|
||||||
<li>Uruguay</li>
|
|
||||||
<li>Vatican City</li>
|
|
||||||
<li>Viet Nam</li>
|
|
||||||
<li>Virgin Islands, U.S.</li>
|
|
||||||
<li>Zambia</li>
|
|
||||||
<li>Zimbabwe<br> </li><br/> </ul>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
### Support for free apps
|
### Support for free apps
|
||||||
Customers in these markets can use Microsoft Store for Business and Education to acquire free apps:
|
Customers in these markets can use Microsoft Store for Business and Education to acquire free apps:
|
||||||
|
|||||||
@ -24,56 +24,15 @@ Use the following procedure to configure the App-V for reporting.
|
|||||||
|
|
||||||
2. After you have enabled the App-V client, use the **Set-AppvClientConfiguration** cmdlet to configure appropriate Reporting Configuration settings:
|
2. After you have enabled the App-V client, use the **Set-AppvClientConfiguration** cmdlet to configure appropriate Reporting Configuration settings:
|
||||||
|
|
||||||
<table>
|
|Setting|Description|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="30%" />
|
|ReportingEnabled|Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.|
|
||||||
<col width="70%" />
|
|ReportingServerURL|Specifies the location on the reporting server where client information is saved. For example, https://<reportingservername>:<reportingportnumber>.<br> **Note:** <br>This is the port number that was assigned during the Reporting Server setup|
|
||||||
</colgroup>
|
|Reporting Start Time|This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.|
|
||||||
<thead>
|
|ReportingRandomDelay|Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.|
|
||||||
<tr class="header">
|
|ReportingInterval|Specifies the retry interval that the client will use to resend data to the reporting server.|
|
||||||
<th align="left">Setting</th>
|
|ReportingDataCacheLimit|Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.|
|
||||||
<th align="left">Description</th>
|
|ReportingDataBlockSize|Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>ReportingEnabled</p></td>
|
|
||||||
<td align="left"><p>Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p>ReportingServerURL</p></td>
|
|
||||||
<td align="left"><p>Specifies the location on the reporting server where client information is saved. For example, https://<reportingservername>:<reportingportnumber>.</p>
|
|
||||||
<div class="alert">
|
|
||||||
<strong>Note</strong><br/><p>This is the port number that was assigned during the Reporting Server setup</p>
|
|
||||||
</div>
|
|
||||||
<div>
|
|
||||||
|
|
||||||
</div></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>Reporting Start Time</p></td>
|
|
||||||
<td align="left"><p>This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p>ReportingRandomDelay</p></td>
|
|
||||||
<td align="left"><p>Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>ReportingInterval</p></td>
|
|
||||||
<td align="left"><p>Specifies the retry interval that the client will use to resend data to the reporting server.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p>ReportingDataCacheLimit</p></td>
|
|
||||||
<td align="left"><p>Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>ReportingDataBlockSize</p></td>
|
|
||||||
<td align="left"><p>Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
3. After the appropriate settings have been configured, the computer running the App-V client will automatically collect data and will send the data back to the reporting server.
|
3. After the appropriate settings have been configured, the computer running the App-V client will automatically collect data and will send the data back to the reporting server.
|
||||||
|
|
||||||
|
|||||||
@ -69,28 +69,10 @@ This topic explains the following procedures:
|
|||||||
|
|
||||||
2. Use the following cmdlets, and add the optional **–UserSID** parameter, where **-UserSID** represents the end user’s security identifier (SID):
|
2. Use the following cmdlets, and add the optional **–UserSID** parameter, where **-UserSID** represents the end user’s security identifier (SID):
|
||||||
|
|
||||||
<table>
|
|Cmdlet|Examples|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|Enable-AppVClientConnectionGroup|Enable-AppVClientConnectionGroup "ConnectionGroupA" -UserSID S-1-2-34-56789012-3456789012-345678901-2345|
|
||||||
<col width="50%" />
|
|Disable-AppVClientConnectionGroup|Disable-AppVClientConnectionGroup "ConnectionGroupA" -UserSID S-1-2-34-56789012-3456789012-345678901-2345|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Cmdlet</th>
|
|
||||||
<th align="left">Examples</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>Enable-AppVClientConnectionGroup</p></td>
|
|
||||||
<td align="left"><p>Enable-AppVClientConnectionGroup "ConnectionGroupA" -UserSID S-1-2-34-56789012-3456789012-345678901-2345</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p>Disable-AppVClientConnectionGroup</p></td>
|
|
||||||
<td align="left"><p>Disable-AppVClientConnectionGroup "ConnectionGroupA" -UserSID S-1-2-34-56789012-3456789012-345678901-2345</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
## To allow only administrators to enable connection groups
|
## To allow only administrators to enable connection groups
|
||||||
|
|
||||||
@ -102,33 +84,9 @@ This topic explains the following procedures:
|
|||||||
|
|
||||||
2. Run the following cmdlet and parameter:
|
2. Run the following cmdlet and parameter:
|
||||||
|
|
||||||
<table>
|
|Cmdlet|Parameter and values|Example|
|
||||||
<colgroup>
|
|--- |--- |--- |
|
||||||
<col width="33%" />
|
|Set-AppvClientConfiguration|-RequirePublishAsAdmin<li>0 - False<li>1 - True|Set-AppvClientConfiguration -RequirePublishAsAdmin<br>1|
|
||||||
<col width="33%" />
|
|
||||||
<col width="33%" />
|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Cmdlet</th>
|
|
||||||
<th align="left">Parameter and values</th>
|
|
||||||
<th align="left">Example</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>Set-AppvClientConfiguration</p></td>
|
|
||||||
<td align="left"><p>-RequirePublishAsAdmin</p>
|
|
||||||
<ul>
|
|
||||||
<li><p>0 - False</p></li>
|
|
||||||
<li><p>1 - True</p></li>
|
|
||||||
</ul></td>
|
|
||||||
<td align="left"><p>Set-AppvClientConfiguration -RequirePublishAsAdmin 1</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<br>For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
<br>For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
||||||
|
|
||||||
|
|||||||
@ -24,50 +24,16 @@ In some previous versions of App-V, connection groups were referred to as Dynami
|
|||||||
|
|
||||||
**In this section:**
|
**In this section:**
|
||||||
|
|
||||||
<table>
|
|Links|Description|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|[About the Connection Group Virtual Environment](appv-connection-group-virtual-environment.md)|Describes the connection group virtual environment.|
|
||||||
<col width="50%" />
|
|[About the Connection Group File](appv-connection-group-file.md)|Describes the connection group file.|
|
||||||
</colgroup>
|
|[How to Create a Connection Group](appv-create-a-connection-group.md)|Explains how to create a new connection group.|
|
||||||
<tbody>
|
|[How to Create a Connection Group with User-Published and Globally Published Packages](appv-create-a-connection-group-with-user-published-and-globally-published-packages.md)|Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.|
|
||||||
<tr class="odd">
|
|[How to Delete a Connection Group](appv-delete-a-connection-group.md)|Explains how to delete a connection group.|
|
||||||
<td align="left"><p><a href="appv-connection-group-virtual-environment.md" data-raw-source="[About the Connection Group Virtual Environment](appv-connection-group-virtual-environment.md)">About the Connection Group Virtual Environment</a></p></td>
|
|[How to Publish a Connection Group](appv-publish-a-connection-group.md)|Explains how to publish a connection group.|
|
||||||
<td align="left"><p>Describes the connection group virtual environment.</p></td>
|
|[How to Make a Connection Group Ignore the Package Version](appv-configure-connection-groups-to-ignore-the-package-version.md)|Explains how to configure a connection group to accept any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create.|
|
||||||
</tr>
|
[How to Allow Only Administrators to Enable Connection Groups](appv-allow-administrators-to-enable-connection-groups.md)|Explains how to configure the App-V client so that only administrators (not end users) can enable or disable connection groups.|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p><a href="appv-connection-group-file.md" data-raw-source="[About the Connection Group File](appv-connection-group-file.md)">About the Connection Group File</a></p></td>
|
|
||||||
<td align="left"><p>Describes the connection group file.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p><a href="appv-create-a-connection-group.md" data-raw-source="[How to Create a Connection Group](appv-create-a-connection-group.md)">How to Create a Connection Group</a></p></td>
|
|
||||||
<td align="left"><p>Explains how to create a new connection group.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p><a href="appv-create-a-connection-group-with-user-published-and-globally-published-packages.md" data-raw-source="[How to Create a Connection Group with User-Published and Globally Published Packages](appv-create-a-connection-group-with-user-published-and-globally-published-packages.md)">How to Create a Connection Group with User-Published and Globally Published Packages</a></p></td>
|
|
||||||
<td align="left"><p>Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p><a href="appv-delete-a-connection-group.md" data-raw-source="[How to Delete a Connection Group](appv-delete-a-connection-group.md)">How to Delete a Connection Group</a></p></td>
|
|
||||||
<td align="left"><p>Explains how to delete a connection group.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p><a href="appv-publish-a-connection-group.md" data-raw-source="[How to Publish a Connection Group](appv-publish-a-connection-group.md)">How to Publish a Connection Group</a></p></td>
|
|
||||||
<td align="left"><p>Explains how to publish a connection group.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p><a href="appv-configure-connection-groups-to-ignore-the-package-version.md" data-raw-source="[How to Make a Connection Group Ignore the Package Version](appv-configure-connection-groups-to-ignore-the-package-version.md)">How to Make a Connection Group Ignore the Package Version</a></p></td>
|
|
||||||
<td align="left"><p>Explains how to configure a connection group to accept any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p><a href="appv-allow-administrators-to-enable-connection-groups.md" data-raw-source="[How to Allow Only Administrators to Enable Connection Groups](appv-allow-administrators-to-enable-connection-groups.md)">How to Allow Only Administrators to Enable Connection Groups</a></p></td>
|
|
||||||
<td align="left"><p>Explains how to configure the App-V client so that only administrators (not end users) can enable or disable connection groups.</p></td>
|
|
||||||
</tr></tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<br>For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
<br>For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
||||||
|
|
||||||
|
|||||||
@ -26,35 +26,9 @@ You can now use the package converter to convert App-V 4.6 packages that contain
|
|||||||
|
|
||||||
You can also use the `–OSDsToIncludeInPackage` parameter with the `ConvertFrom-AppvLegacyPackage` cmdlet to specify which .osd files’ information is converted and placed within the new package.
|
You can also use the `–OSDsToIncludeInPackage` parameter with the `ConvertFrom-AppvLegacyPackage` cmdlet to specify which .osd files’ information is converted and placed within the new package.
|
||||||
|
|
||||||
<table>
|
|New in App-V for Windows client|Prior to App-V for Windows 10|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|New .xml files are created corresponding to the .osd files associated with a package; these files include the following information:<li>environment variables<li>shortcuts<li>file type associations<li>registry information<li>scripts<br> <br>You can now choose to add information from a subset of the .osd files in the source directory to the package using the -OSDsToIncludeInPackage parameter.|Registry information and scripts included in .osd files associated with a package were not included in package converter output.<br> <br>The package converter would populate the new package with information from all of the .osd files in the source directory.|
|
||||||
<col width="50%" />
|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">New in App-V for Windows client</th>
|
|
||||||
<th align="left">Prior to App-V for Windows 10</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>New .xml files are created corresponding to the .osd files associated with a package; these files include the following information:</p>
|
|
||||||
<ul>
|
|
||||||
<li><p>environment variables</p></li>
|
|
||||||
<li><p>shortcuts</p></li>
|
|
||||||
<li><p>file type associations</p></li>
|
|
||||||
<li><p>registry information</p></li>
|
|
||||||
<li><p>scripts</p></li>
|
|
||||||
</ul>
|
|
||||||
<p>You can now choose to add information from a subset of the .osd files in the source directory to the package using the <code>-OSDsToIncludeInPackage</code> parameter.</p></td>
|
|
||||||
<td align="left"><p>Registry information and scripts included in .osd files associated with a package were not included in package converter output.</p>
|
|
||||||
<p>The package converter would populate the new package with information from all of the .osd files in the source directory.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Example conversion statement
|
### Example conversion statement
|
||||||
|
|
||||||
@ -102,65 +76,10 @@ ConvertFrom-AppvLegacyPackage –SourcePath \\OldPkgStore\ContosoApp\
|
|||||||
|
|
||||||
**In the above example:**
|
**In the above example:**
|
||||||
|
|
||||||
<table>
|
|These Source directory files…|…are converted to these Destination directory files…|…and will contain these items|Description|
|
||||||
<colgroup>
|
|--- |--- |--- |--- |
|
||||||
<col width="25%" />
|
|<li>X.osd<li>Y.osd<li>Z.osd|<li>X_Config.xml<li>Y_Config.xml<li>Z_Config.xml|<li>Environment variables:<li>Shortcuts<li>File type associations<li>Registry information<li>Scripts|Each .osd file is converted to a separate, corresponding .xml file that contains the items listed here in App-V deployment configuration format. These items can then be copied from these .xml files and placed in the deployment configuration or user configuration files as desired.<br>In this example, there are three .xml files, corresponding with the three .osd files in the source directory. Each .xml file contains the environment variables, shortcuts, file type associations, registry information, and scripts in its corresponding .osd file.|
|
||||||
<col width="25%" />
|
|<li>X.osd<li>Y.osd|<li>ContosoApp.appv <li>ContosoApp_DeploymentConfig.xml <li>ContosoApp_UserConfig.xml|<li>Environment variables<li>Shortcuts<li>File type associations|The information from the .osd files specified in the -OSDsToIncludeInPackage parameter are converted and placed inside the package. The converter then populates the deployment configuration file and the user configuration file with the contents of the package, just as App-V Sequencer does when sequencing a new package.<br>In this example, environment variables, shortcuts, and file type associations included in X.osd and Y.osd were converted and placed in the App-V package, and some of this information was also included in the deployment configuration and user configuration files. X.osd and Y.osd were used because they were included as arguments to the -OSDsToIncludeInPackage parameter. No information from Z.osd was included in the package, because it was not included as one of these arguments.|
|
||||||
<col width="25%" />
|
|
||||||
<col width="25%" />
|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">These Source directory files…</th>
|
|
||||||
<th align="left">…are converted to these Destination directory files…</th>
|
|
||||||
<th align="left">…and will contain these items</th>
|
|
||||||
<th align="left">Description</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p>X.osd</p></li>
|
|
||||||
<li><p>Y.osd</p></li>
|
|
||||||
<li><p>Z.osd</p></li>
|
|
||||||
</ul></td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p>X_Config.xml</p></li>
|
|
||||||
<li><p>Y_Config.xml</p></li>
|
|
||||||
<li><p>Z_Config.xml</p></li>
|
|
||||||
</ul></td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p>Environment variables</p></li>
|
|
||||||
<li><p>Shortcuts</p></li>
|
|
||||||
<li><p>File type associations</p></li>
|
|
||||||
<li><p>Registry information</p></li>
|
|
||||||
<li><p>Scripts</p></li>
|
|
||||||
</ul></td>
|
|
||||||
<td align="left"><p>Each .osd file is converted to a separate, corresponding .xml file that contains the items listed here in App-V deployment configuration format. These items can then be copied from these .xml files and placed in the deployment configuration or user configuration files as desired.</p>
|
|
||||||
<p>In this example, there are three .xml files, corresponding with the three .osd files in the source directory. Each .xml file contains the environment variables, shortcuts, file type associations, registry information, and scripts in its corresponding .osd file.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p>X.osd</p></li>
|
|
||||||
<li><p>Y.osd</p></li>
|
|
||||||
</ul></td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p>ContosoApp.appv</p></li>
|
|
||||||
<li><p>ContosoApp_DeploymentConfig.xml</p></li>
|
|
||||||
<li><p>ContosoApp_UserConfig.xml</p></li>
|
|
||||||
</ul></td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p>Environment variables</p></li>
|
|
||||||
<li><p>Shortcuts</p></li>
|
|
||||||
<li><p>File type associations</p></li>
|
|
||||||
</ul></td>
|
|
||||||
<td align="left"><p>The information from the .osd files specified in the <code>-OSDsToIncludeInPackage</code> parameter are converted and placed inside the package. The converter then populates the deployment configuration file and the user configuration file with the contents of the package, just as App-V Sequencer does when sequencing a new package.</p>
|
|
||||||
<p>In this example, environment variables, shortcuts, and file type associations included in X.osd and Y.osd were converted and placed in the App-V package, and some of this information was also included in the deployment configuration and user configuration files. X.osd and Y.osd were used because they were included as arguments to the <code>-OSDsToIncludeInPackage</code> parameter. No information from Z.osd was included in the package, because it was not included as one of these arguments.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Converting packages created using a prior version of App-V
|
## Converting packages created using a prior version of App-V
|
||||||
|
|
||||||
@ -175,34 +94,11 @@ After you convert an existing package you should test the package prior to deplo
|
|||||||
|
|
||||||
**What to know before you convert existing packages**
|
**What to know before you convert existing packages**
|
||||||
|
|
||||||
<table>
|
|Issue|Workaround|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|Virtual packages using DSC are not linked after conversion.|Link the packages using connection groups. See [Managing Connection Groups](appv-managing-connection-groups.md).|
|
||||||
<col width="50%" />
|
|Environment variable conflicts are detected during conversion.|Resolve any conflicts in the associated **.osd** file.|
|
||||||
</colgroup>
|
|Hard-coded paths are detected during conversion.|Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it is recommended to re-sequence the package.|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Issue</th>
|
|
||||||
<th align="left">Workaround</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>Virtual packages using DSC are not linked after conversion.</p></td>
|
|
||||||
<td align="left"><p>Link the packages using connection groups. See <a href="appv-managing-connection-groups.md" data-raw-source="[Managing Connection Groups](appv-managing-connection-groups.md)">Managing Connection Groups</a>.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p>Environment variable conflicts are detected during conversion.</p></td>
|
|
||||||
<td align="left"><p>Resolve any conflicts in the associated <strong>.osd</strong> file.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>Hard-coded paths are detected during conversion.</p></td>
|
|
||||||
<td align="left"><p>Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it is recommended to re-sequence the package.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
When converting a package check for failing files or shortcuts, locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path.
|
When converting a package check for failing files or shortcuts, locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path.
|
||||||
|
|
||||||
@ -218,39 +114,12 @@ If a converted package does not open after you convert it, it is also recommende
|
|||||||
|
|
||||||
There is no direct method to upgrade to a full App-V infrastructure. Use the information in the following section for information about upgrading the App-V server.
|
There is no direct method to upgrade to a full App-V infrastructure. Use the information in the following section for information about upgrading the App-V server.
|
||||||
|
|
||||||
<table>
|
|Task|More Information|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|Review prerequisites.|[App-V Server prerequisite software](appv-prerequisites.md#app-v-server-prerequisite-software)|
|
||||||
<col width="50%" />
|
|Enable the App-V client.|[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)|
|
||||||
</colgroup>
|
|Install App-V Server.|[How to Deploy the App-V Server](appv-deploy-the-appv-server.md)|
|
||||||
<thead>
|
|Migrate existing packages.|See [Converting packages created using a prior version of App-V](#converting-packages-created-using-a-prior-version-of-app-v) earlier in this topic.|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Task</th>
|
|
||||||
<th align="left">More Information</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>Review prerequisites.</p></td>
|
|
||||||
<td align="left"><p><a href="appv-prerequisites.md#app-v-server-prerequisite-software" data-raw-source="[App-V Server prerequisite software](appv-prerequisites.md#app-v-server-prerequisite-software)">App-V Server prerequisite software</a>.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p>Enable the App-V client.</p></td>
|
|
||||||
<td align="left"><p><a href="appv-enable-the-app-v-desktop-client.md" data-raw-source="[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)">Enable the App-V desktop client</a>.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left"><p>Install App-V Server.</p></td>
|
|
||||||
<td align="left"><p><a href="appv-deploy-the-appv-server.md" data-raw-source="[How to Deploy the App-V Server](appv-deploy-the-appv-server.md)">How to Deploy the App-V Server</a>.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left"><p>Migrate existing packages.</p></td>
|
|
||||||
<td align="left"><p>See <a href="#converting-packages-created-using-a-prior-version-of-app-v" data-raw-source="[Converting packages created using a prior version of App-V](#converting-packages-created-using-a-prior-version-of-app-v)">Converting packages created using a prior version of App-V</a> earlier in this topic.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<br>For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
<br>For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
||||||
|
|
||||||
|
|||||||
@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
title: Get seats
|
title: Get seats
|
||||||
description: The Get seats operation retrieves the information about active seats in the Micorsoft Store for Business.
|
description: The Get seats operation retrieves the information about active seats in the Microsoft Store for Business.
|
||||||
ms.assetid: 32945788-47AC-4259-B616-F359D48F4F2F
|
ms.assetid: 32945788-47AC-4259-B616-F359D48F4F2F
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
manager: dansimp
|
manager: dansimp
|
||||||
@ -18,118 +18,34 @@ The **Get seats** operation retrieves the information about active seats in the
|
|||||||
|
|
||||||
## Request
|
## Request
|
||||||
|
|
||||||
<table>
|
**GET:**
|
||||||
<colgroup>
|
|
||||||
<col width="50%" />
|
```http
|
||||||
<col width="50%" />
|
https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats?continuationToken={ContinuationToken}&maxResults={MaxResults}
|
||||||
</colgroup>
|
```
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th>Method</th>
|
|
||||||
<th>Request URI</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>GET</p></td>
|
|
||||||
<td><p>https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats?continuationToken={ContinuationToken}&maxResults={MaxResults}</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
### URI parameters
|
### URI parameters
|
||||||
|
|
||||||
The following parameters may be specified in the request URI.
|
The following parameters may be specified in the request URI.
|
||||||
|
|
||||||
<table>
|
|Parameter|Type|Description|
|
||||||
<colgroup>
|
|--- |--- |--- |
|
||||||
<col width="33%" />
|
|productId|string|Required. Product identifier for an application that is used by the Store for Business.|
|
||||||
<col width="33%" />
|
|skuId|string|Required. Product identifier that specifies a specific SKU of an application.|
|
||||||
<col width="33%" />
|
|continuationToken|string|Optional.|
|
||||||
</colgroup>
|
|maxResults|int32|Optional. Default = 25, Maximum = 100|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th>Parameter</th>
|
|
||||||
<th>Type</th>
|
|
||||||
<th>Description</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>productId</p></td>
|
|
||||||
<td><p>string</p></td>
|
|
||||||
<td><p>Required. Product identifier for an application that is used by the Store for Business.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>skuId</p></td>
|
|
||||||
<td><p>string</p></td>
|
|
||||||
<td><p>Required. Product identifier that specifies a specific SKU of an application.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>continuationToken</p></td>
|
|
||||||
<td><p>string</p></td>
|
|
||||||
<td><p>Optional.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>maxResults</p></td>
|
|
||||||
<td><p>int32</p></td>
|
|
||||||
<td><p>Optional. Default = 25, Maximum = 100</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
## Response
|
## Response
|
||||||
|
|
||||||
### Response body
|
### Response body
|
||||||
|
|
||||||
The response body contains [SeatDetailsResultSet](data-structures-windows-store-for-business.md#seatdetailsresultset).
|
The response body contains [SeatDetailsResultSet](data-structures-windows-store-for-business.md#seatdetailsresultset).
|
||||||
|
|
||||||
<table>
|
|Error code|Description|Retry|Data field|
|
||||||
<colgroup>
|
|--- |--- |--- |--- |
|
||||||
<col width="25%" />
|
|400|Invalid parameters|No|Parameter name <br> Reason: Missing parameter or invalid parameter <br> Details: String|
|
||||||
<col width="25%" />
|
|404|Not found|||
|
||||||
<col width="25%" />
|
|409|Conflict||Reason: Not online|
|
||||||
<col width="25%" />
|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th>Error code</th>
|
|
||||||
<th>Description</th>
|
|
||||||
<th>Retry</th>
|
|
||||||
<th>Data field</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>400</p></td>
|
|
||||||
<td><p>Invalid parameters</p></td>
|
|
||||||
<td><p>No</p></td>
|
|
||||||
<td><p>Parameter name</p>
|
|
||||||
<p>Reason: Missing parameter or invalid parameter</p>
|
|
||||||
<p>Details: String</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>404</p></td>
|
|
||||||
<td><p>Not found</p></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>409</p></td>
|
|
||||||
<td><p>Conflict</p></td>
|
|
||||||
<td></td>
|
|
||||||
<td><p>Reason: Not online</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
@ -17,13 +17,10 @@ ms.date: 06/26/2017
|
|||||||
|
|
||||||
The HotSpot configuration service provider is used to configure and enable Internet sharing on the device, in which the device can be configured to share its cellular connection over Wi-Fi with up to eight client devices or computers.
|
The HotSpot configuration service provider is used to configure and enable Internet sharing on the device, in which the device can be configured to share its cellular connection over Wi-Fi with up to eight client devices or computers.
|
||||||
|
|
||||||
> **Note** HotSpot CSP is only supported in Windows 10 Mobile.
|
> [!Note]
|
||||||
|
> HotSpot CSP is only supported in Windows 10 Mobile.
|
||||||
>
|
>
|
||||||
>
|
> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION capability to be accessed from a network configuration application.
|
||||||
>
|
|
||||||
> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION capability to be accessed from a network configuration application.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The following shows the HotSpot configuration service provider management object in tree format as used by OMA Client Provisioning. The OMA DM protocol is not supported by this configuration service provider.
|
The following shows the HotSpot configuration service provider management object in tree format as used by OMA Client Provisioning. The OMA DM protocol is not supported by this configuration service provider.
|
||||||
|
|
||||||
@ -62,8 +59,8 @@ By default, any available connection will be used as a public connection. Howeve
|
|||||||
|
|
||||||
Specified connections will be mapped, by policy, to the Internet sharing service. All attempts to enumerate Connection Manager connections for the Internet sharing service will return only the mapped connections.
|
Specified connections will be mapped, by policy, to the Internet sharing service. All attempts to enumerate Connection Manager connections for the Internet sharing service will return only the mapped connections.
|
||||||
|
|
||||||
> **Note** The mapping policy will also include the connection specified in the **TetheringNAIConnection** value as well.
|
> [!Note]
|
||||||
|
> The mapping policy will also include the connection specified in the **TetheringNAIConnection** value as well.
|
||||||
|
|
||||||
|
|
||||||
If the specified connections do not exist, Internet sharing will not start because it will not have any cellular connections available to share
|
If the specified connections do not exist, Internet sharing will not start because it will not have any cellular connections available to share
|
||||||
@ -77,9 +74,8 @@ If a CDMA mobile operator requires using a Tethering NAI during Internet sharing
|
|||||||
|
|
||||||
Specified connections will be mapped, by policy, to the Internet sharing service. All attempts to enumerate Connection Manager connections for the Internet sharing service will return only the mapped connections.
|
Specified connections will be mapped, by policy, to the Internet sharing service. All attempts to enumerate Connection Manager connections for the Internet sharing service will return only the mapped connections.
|
||||||
|
|
||||||
> **Note** The mapping policy will also include the connections specified in the **DedicatedConnections** as well.
|
> [!Note]
|
||||||
|
> The mapping policy will also include the connections specified in the **DedicatedConnections** as well.
|
||||||
|
|
||||||
|
|
||||||
If the specified connections do not exist, Internet sharing will not start because it will not have any cellular connections available to share
|
If the specified connections do not exist, Internet sharing will not start because it will not have any cellular connections available to share
|
||||||
|
|
||||||
@ -109,8 +105,8 @@ Optional. Reference to a localized string, provided by the mobile operator, that
|
|||||||
|
|
||||||
Where `<path_to_res_dll>` is the path to the resource dll that contains the string and `<str_id>` is the string identifier. For more information on language-neutral string resource registry values, see [Using Registry String Redirection](/windows/win32/intl/using-registry-string-redirection) on MSDN.
|
Where `<path_to_res_dll>` is the path to the resource dll that contains the string and `<str_id>` is the string identifier. For more information on language-neutral string resource registry values, see [Using Registry String Redirection](/windows/win32/intl/using-registry-string-redirection) on MSDN.
|
||||||
|
|
||||||
> **Note** MOAppLink is required to use the MOHelpMessage setting.
|
> [!Note]
|
||||||
|
> MOAppLink is required to use the MOHelpMessage setting.
|
||||||
|
|
||||||
|
|
||||||
<a href="" id="entitlementrequired"></a>**EntitlementRequired**
|
<a href="" id="entitlementrequired"></a>**EntitlementRequired**
|
||||||
@ -137,14 +133,14 @@ Optional. The time-out value, in minutes, after which Internet sharing is automa
|
|||||||
Changes to this node require a reboot.
|
Changes to this node require a reboot.
|
||||||
|
|
||||||
<a href="" id="minwifikeylength"></a>**MinWifiKeyLength**
|
<a href="" id="minwifikeylength"></a>**MinWifiKeyLength**
|
||||||
> **Important** This parm is no longer supported for Windows Phone 8.1. The enforced minimum allowed length of the Wi-Fi key is 8.
|
|
||||||
|
|
||||||
|
|
||||||
|
> [!Important]
|
||||||
|
> This parm is no longer supported for Windows Phone 8.1. The enforced minimum allowed length of the Wi-Fi key is 8.
|
||||||
|
|
||||||
<a href="" id="minwifissidlength"></a>**MinWifiSSIDLength**
|
<a href="" id="minwifissidlength"></a>**MinWifiSSIDLength**
|
||||||
> **Important** This parm is no longer supported for Windows Phone 8.1. The enforced minimum allowed length of the Wi-Fi SSID is 1.
|
|
||||||
|
|
||||||
|
|
||||||
|
> [!Important]
|
||||||
|
> This parm is no longer supported for Windows Phone 8.1. The enforced minimum allowed length of the Wi-Fi SSID is 1.
|
||||||
|
|
||||||
## Additional requirements for CDMA networks
|
## Additional requirements for CDMA networks
|
||||||
|
|
||||||
@ -169,7 +165,8 @@ For CDMA networks that use a separate Network Access Identity (NAI) for Internet
|
|||||||
</wap-provisioningdoc>
|
</wap-provisioningdoc>
|
||||||
```
|
```
|
||||||
|
|
||||||
> **Note** CDMA devices are limited to one active data connection at a time. This means any application or service (such as email or MMS) that is bound to another connection may not work while Internet sharing is turned on.
|
> [!Note]
|
||||||
|
> CDMA devices are limited to one active data connection at a time. This means any application or service (such as email or MMS) that is bound to another connection may not work while Internet sharing is turned on.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -186,34 +183,11 @@ The DLL must be code signed in a specific way, see [Sign binaries and packages](
|
|||||||
|
|
||||||
During an entitlement check the Internet Sharing service loads the specified DLL and then call the `IsEntitled` function. The function must connect to the server to perform any required validation, then return one of the following **ICS\_ENTITLEMENT\_RESULT** enumeration values.
|
During an entitlement check the Internet Sharing service loads the specified DLL and then call the `IsEntitled` function. The function must connect to the server to perform any required validation, then return one of the following **ICS\_ENTITLEMENT\_RESULT** enumeration values.
|
||||||
|
|
||||||
<table>
|
|Value|Description|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|**ENTITLEMENT_SUCCESS**|The device is allowed to connect to the server.|
|
||||||
<col width="50%" />
|
|**ENTITLEMENT_FAILED**|The device is not allowed to connect to the server|
|
||||||
</colgroup>
|
|**ENTITLEMENT_UNAVAILABLE**|The entitlement check failed because the device could not contact the server or acquire a connection to verify entitlement.|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th>Value</th>
|
|
||||||
<th>Description</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p><strong>ENTITLEMENT_SUCCESS</strong></p></td>
|
|
||||||
<td><p>The device is allowed to connect to the server.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p><strong>ENTITLEMENT_FAILED</strong></p></td>
|
|
||||||
<td><p>The device is not allowed to connect to the server</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p><strong>ENTITLEMENT_UNAVAILABLE</strong></p></td>
|
|
||||||
<td><p>The entitlement check failed because the device could not contact the server or acquire a connection to verify entitlement.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The definition for the **ICS\_ENTITLEMENT\_RESULT** is in the header file `IcsEntitlementh`, which ships with the Windows Adaptation Kit.
|
The definition for the **ICS\_ENTITLEMENT\_RESULT** is in the header file `IcsEntitlementh`, which ships with the Windows Adaptation Kit.
|
||||||
|
|
||||||
|
|||||||
@ -18,11 +18,11 @@ The Windows version of mobile application management (MAM) is a lightweight solu
|
|||||||
|
|
||||||
## Integration with Azure AD
|
## Integration with Azure AD
|
||||||
|
|
||||||
MAM on Windows is integrated with Azure Active Directory (Azure AD) identity service. The MAM service supports Azure AD integrated authentication for the user and the device during enrollment and the downloading of MAM policies. MAM integration with Azure AD is similar to mobile device management (MDM) integration. See [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md).
|
MAM on Windows is integrated with Azure Active Directory (Azure AD) identity service. The MAM service supports Azure AD-integrated authentication for the user and the device during enrollment and the downloading of MAM policies. MAM integration with Azure AD is similar to mobile device management (MDM) integration. See [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md).
|
||||||
|
|
||||||
MAM enrollment is integrated with adding a work account flow to a personal device. If both MAM and Azure AD integrated MDM services are provided in an organization, a users’ personal devices will be enrolled to MAM or MDM, depending on the user’s actions. If a user adds their work or school Azure AD account as a secondary account to the machine, their device will be enrolled to MAM. If a user joins their device to Azure AD, it will be enrolled to MDM. In general, a device that has a personal account as its primary account is considered a personal device and should be enrolled to MAM. An Azure AD join, and enrollment to MDM, should be used to manage corporate devices.
|
MAM enrollment is integrated with adding a work account flow to a personal device. If both MAM and Azure AD-integrated MDM services are provided in an organization, a users’ personal devices will be enrolled to MAM or MDM, depending on the user’s actions. If a user adds their work or school Azure AD account as a secondary account to the machine, their device will be enrolled to MAM. If a user joins their device to Azure AD, it will be enrolled to MDM. In general, a device that has a personal account as its primary account is considered a personal device and should be enrolled to MAM. An Azure AD join, and enrollment to MDM, should be used to manage corporate devices.
|
||||||
|
|
||||||
On personal devices, users can add an Azure AD account as a secondary account to the device while keeping their personal account as primary. Users can add an Azure AD account to the device from a supported Azure AD integrated application, such as the next update of Microsoft Office 365 or Microsoft Office Mobile. Alternatively, users can add an Azure AD account from **Settings > Accounts > Access work or school**.
|
On personal devices, users can add an Azure AD account as a secondary account to the device while keeping their personal account as primary. Users can add an Azure AD account to the device from a supported Azure AD-integrated application, such as the next update of Microsoft Office 365 or Microsoft Office Mobile. Alternatively, users can add an Azure AD account from **Settings > Accounts > Access work or school**.
|
||||||
|
|
||||||
Regular non-admin users can enroll to MAM.
|
Regular non-admin users can enroll to MAM.
|
||||||
|
|
||||||
@ -44,7 +44,7 @@ To make applications WIP-aware, app developers need to include the following dat
|
|||||||
|
|
||||||
MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. Starting with Azure AD in Windows 10, version 1703, the same cloud-based Management MDM app will support both MDM and MAM enrollments. If you have already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration.
|
MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. Starting with Azure AD in Windows 10, version 1703, the same cloud-based Management MDM app will support both MDM and MAM enrollments. If you have already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration.
|
||||||
|
|
||||||
|
:::image type="content" alt-text="Mobile application management app." source="images/implement-server-side-mobile-application-management.png":::
|
||||||
|
|
||||||
MAM and MDM services in an organization could be provided by different vendors. Depending on the company configuration, IT admin typically needs to add one or two Azure AD Management apps to configure MAM and MDM policies. For example, if both MAM and MDM are provided by the same vendor, then an IT Admin needs to add one Management app from this vendor that will contain both MAM and MDM policies for the organization. Alternatively, if the MAM and MDM services in an organization are provided by two different vendors, then two Management apps from the two vendors need to be configured for the company in Azure AD: one for MAM and one for MDM. Please note: if the MDM service in an organization is not integrated with Azure AD and uses auto-discovery, only one Management app for MAM needs to be configured.
|
MAM and MDM services in an organization could be provided by different vendors. Depending on the company configuration, IT admin typically needs to add one or two Azure AD Management apps to configure MAM and MDM policies. For example, if both MAM and MDM are provided by the same vendor, then an IT Admin needs to add one Management app from this vendor that will contain both MAM and MDM policies for the organization. Alternatively, if the MAM and MDM services in an organization are provided by two different vendors, then two Management apps from the two vendors need to be configured for the company in Azure AD: one for MAM and one for MDM. Please note: if the MDM service in an organization is not integrated with Azure AD and uses auto-discovery, only one Management app for MAM needs to be configured.
|
||||||
|
|
||||||
@ -129,40 +129,8 @@ If the MAM device is properly configured for MDM enrollment, then the Enroll onl
|
|||||||
|
|
||||||
We have updated Skype for Business to work with MAM. The following table explains Office release channels and release dates for Skype for Business compliance with the MAM feature.
|
We have updated Skype for Business to work with MAM. The following table explains Office release channels and release dates for Skype for Business compliance with the MAM feature.
|
||||||
|
|
||||||
<table>
|
|Update channel|Primary purpose|LOB Tattoo availability|Default update channel for the products|
|
||||||
<colgroup>
|
|--- |--- |--- |--- |
|
||||||
<col width="15%" />
|
|[Current channel](/deployoffice/overview-update-channels#BKMK_CB)|Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel.|March 9 2017|Visio Pro for Office 365<br>Project Desktop Client<br>Microsoft 365 Apps for business (the version of Office that comes with some Microsoft 365 plans, such as Business Premium.)|
|
||||||
<col width="35%" />
|
|[Deferred channel](/deployoffice/overview-update-channels#BKMK_CBB)|Provide users with new features of Office only a few times a year.|October 10 2017|Microsoft 365 Apps for enterprise|
|
||||||
<col width="15%" />
|
|[First release for deferred channel](/deployoffice/overview-update-channels#BKMK_FRCBB)|Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel.|June 13 2017||
|
||||||
<col width="35%" />
|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th>Update channel</th>
|
|
||||||
<th>Primary purpose</th>
|
|
||||||
<th>LOB Tattoo availability</th>
|
|
||||||
<th>Default update channel for the products</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><a href="/deployoffice/overview-update-channels#BKMK_CB" data-raw-source="[Current channel](/deployoffice/overview-update-channels#BKMK_CB)">Current channel</a></td>
|
|
||||||
<td>Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel. </td>
|
|
||||||
<td>March 9 2017</td>
|
|
||||||
<td><p>Visio Pro for Office 365</p>
|
|
||||||
<p>Project Desktop Client</p>
|
|
||||||
<p>Microsoft 365 Apps for business (the version of Office that comes with some Microsoft 365 plans, such as Business Premium.)</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td><a href="/deployoffice/overview-update-channels#BKMK_CBB" data-raw-source="[Deferred channel](/deployoffice/overview-update-channels#BKMK_CBB)">Deferred channel</a></td>
|
|
||||||
<td>Provide users with new features of Office only a few times a year.</td>
|
|
||||||
<td>October 10 2017</td>
|
|
||||||
<td>Microsoft 365 Apps for enterprise</td>
|
|
||||||
</tr><tr>
|
|
||||||
<td><a href="/deployoffice/overview-update-channels#BKMK_FRCBB" data-raw-source="[First release for deferred channel](/deployoffice/overview-update-channels#BKMK_FRCBB)">First release for Deferred channel</a></td>
|
|
||||||
<td>Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel. </td>
|
|
||||||
<td>June 13 2017</td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|||||||
@ -34,26 +34,12 @@ For additional information about Store for Business, see the TechNet topics in [
|
|||||||
|
|
||||||
The Store for Business provides services that enable a management tool to synchronize new and updated applications on behalf of an organization. Once synchronized, you can distribute new and updated applications using the Windows Management framework. The services provides several capabilities including providing application data, the ability to assign and reclaim applications, and the ability to download offline-licensed application packages.
|
The Store for Business provides services that enable a management tool to synchronize new and updated applications on behalf of an organization. Once synchronized, you can distribute new and updated applications using the Windows Management framework. The services provides several capabilities including providing application data, the ability to assign and reclaim applications, and the ability to download offline-licensed application packages.
|
||||||
|
|
||||||
<table>
|
- **Application data**: The Store for Business service provides metadata for the applications that have been acquired via the Store for Business. This includes the application identifier that is used to deploy online license applications, artwork for an application that is used to create a company portal, and localized descriptions for applications.
|
||||||
<colgroup>
|
|
||||||
<col width="50%" />
|
|
||||||
<col width="50%" />
|
|
||||||
</colgroup>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>Application data</p></td>
|
|
||||||
<td><p>The Store for Business service provides metadata for the applications that have been acquired via the Store for Business. This includes the application identifier that is used to deploy online license applications, artwork for an application that is used to create a company portal, and localized descriptions for applications.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>Licensing models</p></td>
|
|
||||||
<td><p><strong>Offline vs. Online</strong></p>
|
|
||||||
<p>Online-licensed applications require connectivity to the Microsoft Store. Users require an Azure Active Directory identity and rely on the store services on the device to be able to acquire an application from the store. It is similar to how applications are acquired from the Microsoft Store using a Microsoft account. Assigning or reclaiming seats for an application require a call to the Store for Business services.</p>
|
|
||||||
<p>Offline-licensed applications enable an organization to use the application for imaging and for devices that may not have connectivity to the store or may not have Azure Active Directory. Offline-licensed application do not require connectivity to the store, however it can be updated directly from the store if the device has connectivity and the app update policies allow updates to be distributed via the store.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
- **Licensing models**:
|
||||||
|
|
||||||
|
- **Online-licensed** applications require connectivity to the Microsoft Store. Users require an Azure Active Directory identity and rely on the store services on the device to be able to acquire an application from the store. It is similar to how applications are acquired from the Microsoft Store using a Microsoft account. Assigning or reclaiming seats for an application require a call to the Store for Business services.
|
||||||
|
- **Offline-licensed** applications enable an organization to use the application for imaging and for devices that may not have connectivity to the store or may not have Azure Active Directory. Offline-licensed application do not require connectivity to the store, however it can be updated directly from the store if the device has connectivity and the app update policies allow updates to be distributed via the store.
|
||||||
|
|
||||||
### Offline-licensed application distribution
|
### Offline-licensed application distribution
|
||||||
|
|
||||||
@ -89,13 +75,11 @@ MTS requires calls to be authenticated using an Azure AD OAuth bearer token. The
|
|||||||
|
|
||||||
Here are the details for requesting an authorization token:
|
Here are the details for requesting an authorization token:
|
||||||
|
|
||||||
- Login Authority = https:<span></span>//login.windows.net/\<TargetTenantId\>
|
- Login Authority = `https://login.windows.net/<TargetTenantId>`
|
||||||
- Resource/audience\* = https:<span></span>//onestore.microsoft.com
|
- Resource/audience = `https://onestore.microsoft.com`: The token audience URI is meant as an identifier of the application for which the token is being generated, and it is not a URL for a service endpoint or a web-page.
|
||||||
- ClientId = your AAD application client id
|
- ClientId = your AAD application client id
|
||||||
- ClientSecret = your AAD application client secret/key
|
- ClientSecret = your AAD application client secret/key
|
||||||
|
|
||||||
\* The token audience URI is meant as an identifier of the application for which the token is being generated, and it is not a URL for a service endpoint or a web-page.
|
|
||||||
|
|
||||||
## Using the management tool
|
## Using the management tool
|
||||||
|
|
||||||
After registering your management tool with Azure AD, the management tool can call into the management services. There are a couple of call patterns:
|
After registering your management tool with Azure AD, the management tool can call into the management services. There are a couple of call patterns:
|
||||||
|
|||||||
@ -110,75 +110,49 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma
|
|||||||
</s:envelope>
|
</s:envelope>
|
||||||
```
|
```
|
||||||
|
|
||||||
<table>
|
**Sample error messages**
|
||||||
<colgroup>
|
|
||||||
<col width="20%" />
|
- **Namespace**: `s:`
|
||||||
<col width="20%" />
|
- **Subcode**: MessageFormat
|
||||||
<col width="20%" />
|
- **Error**: MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR
|
||||||
<col width="20%" />
|
- **Description**: Invalid message from the Mobile Device Management (MDM) server.
|
||||||
<col width="20%" />
|
- **HRESULT**: 80180001
|
||||||
</colgroup>
|
|
||||||
<thead>
|
- **Namespace**: `s:`
|
||||||
<tr class="header">
|
- **Subcode**: Authentication
|
||||||
<th>Namespace</th>
|
- **Error**: MENROLL_E_DEVICE_AUTHENTICATION_ERROR
|
||||||
<th>Subcode</th>
|
- **Description**: The Mobile Device Management (MDM) server failed to authenticate the user. Try again or contact your system administrator.
|
||||||
<th>Error</th>
|
- **HRESULT**: 80180002
|
||||||
<th>Description</th>
|
|
||||||
<th>HRESULT</th>
|
- **Namespace**: `s:`
|
||||||
</tr>
|
- **Subcode**: Authorization
|
||||||
</thead>
|
- **Error**: MENROLL_E_DEVICE_AUTHORIZATION_ERROR
|
||||||
<tbody>
|
- **Description**: The user is not authorized to enroll to Mobile Device Management (MDM). Try again or contact your system administrator.
|
||||||
<tr class="odd">
|
- **HRESULT**: 80180003
|
||||||
<td><p>s:</p></td>
|
|
||||||
<td><p>MessageFormat</p></td>
|
- **Namespace**: `s:`
|
||||||
<td><p>MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR</p></td>
|
- **Subcode**: CertificateRequest
|
||||||
<td><p>Invalid message from the Mobile Device Management (MDM) server.</p></td>
|
- **Error**: MENROLL_E_DEVICE_CERTIFICATEREQUEST_ERROR
|
||||||
<td><p>80180001</p></td>
|
- **Description**: The user has no permission for the certificate template or the certificate authority is unreachable. Try again or contact your system administrator.
|
||||||
</tr>
|
- **HRESULT**: 80180004
|
||||||
<tr class="even">
|
|
||||||
<td><p>s:</p></td>
|
- **Namespace**: `s:`
|
||||||
<td><p>Authentication</p></td>
|
- **Subcode**: EnrollmentServer
|
||||||
<td><p>MENROLL_E_DEVICE_AUTHENTICATION_ERROR</p></td>
|
- **Error**: MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR
|
||||||
<td><p>The Mobile Device Management (MDM) server failed to authenticate the user. Try again or contact your system administrator.</p></td>
|
- **Description**: The Mobile Device Management (MDM) server encountered an error. Try again or contact your system administrator.
|
||||||
<td><p>80180002</p></td>
|
- **HRESULT**: 80180005
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
- **Namespace**: `a:`
|
||||||
<td><p>s:</p></td>
|
- **Subcode**: InternalServiceFault
|
||||||
<td><p>Authorization</p></td>
|
- **Error**: MENROLL_E_DEVICE_INTERNALSERVICE_ERROR
|
||||||
<td><p>MENROLL_E_DEVICE_AUTHORIZATION_ERROR</p></td>
|
- **Description**: There was an unhandled exception on the Mobile Device Management (MDM) server. Try again or contact your system administrator.
|
||||||
<td><p>The user is not authorized to enroll to Mobile Device Management (MDM). Try again or contact your system administrator.</p></td>
|
- **HRESULT**: 80180006
|
||||||
<td><p>80180003</p></td>
|
|
||||||
</tr>
|
- **Namespace**: `a:`
|
||||||
<tr class="even">
|
- **Subcode**: InvalidSecurity
|
||||||
<td><p>s:</p></td>
|
- **Error**: MENROLL_E_DEVICE_INVALIDSECURITY_ERROR
|
||||||
<td><p>CertificateRequest</p></td>
|
- **Description**: The Mobile Device Management (MDM) server was not able to validate your account. Try again or contact your system administrator.
|
||||||
<td><p>MENROLL_E_DEVICE_CERTIFICATEREQUEST_ERROR</p></td>
|
- **HRESULT**: 80180007
|
||||||
<td><p>The user has no permission for the certificate template or the certificate authority is unreachable. Try again or contact your system administrator.</p></td>
|
|
||||||
<td><p>80180004</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>s:</p></td>
|
|
||||||
<td><p>EnrollmentServer</p></td>
|
|
||||||
<td><p>MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR</p></td>
|
|
||||||
<td>The Mobile Device Management (MDM) server encountered an error. Try again or contact your system administrator.</td>
|
|
||||||
<td><p>80180005</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>a:</p></td>
|
|
||||||
<td><p>InternalServiceFault</p></td>
|
|
||||||
<td><p>MENROLL_E_DEVICE_INTERNALSERVICE_ERROR</p></td>
|
|
||||||
<td><p> There was an unhandled exception on the Mobile Device Management (MDM) server. Try again or contact your system administrator.</p></td>
|
|
||||||
<td><p>80180006</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>a:</p></td>
|
|
||||||
<td><p>InvalidSecurity</p></td>
|
|
||||||
<td><p>MENROLL_E_DEVICE_INVALIDSECURITY_ERROR</p></td>
|
|
||||||
<td><p>The Mobile Device Management (MDM) server was not able to validate your account. Try again or contact your system administrator.</p></td>
|
|
||||||
<td><p>80180007</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. Here is an example:
|
In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. Here is an example:
|
||||||
|
|
||||||
@ -212,66 +186,42 @@ In Windows 10, version 1507, we added the deviceenrollmentserviceerror element.
|
|||||||
</s:envelope>
|
</s:envelope>
|
||||||
```
|
```
|
||||||
|
|
||||||
<table>
|
**Sample error messages**
|
||||||
<colgroup>
|
|
||||||
<col width="25%" />
|
- **Subcode**: DeviceCapReached
|
||||||
<col width="25%" />
|
- **Error**: MENROLL_E_DEVICECAPREACHED
|
||||||
<col width="25%" />
|
- **Description**: The account has too many devices enrolled to Mobile Device Management (MDM). Delete or unenroll old devices to fix this error.
|
||||||
<col width="25%" />
|
- **HRESULT**: 80180013
|
||||||
</colgroup>
|
|
||||||
<thead>
|
- **Subcode**: DeviceNotSupported
|
||||||
<tr class="header">
|
- **Error**: MENROLL_E_DEVICENOTSUPPORTED
|
||||||
<th>Subcode</th>
|
- **Description**: The Mobile Device Management (MDM) server doesn't support this platform or version, consider upgrading your device.
|
||||||
<th>Error</th>
|
- **HRESULT**: 80180014
|
||||||
<th>Description</th>
|
|
||||||
<th>HRESULT</th>
|
- **Subcode**: NotSupported
|
||||||
</tr>
|
- **Error**: MENROLL_E_NOT_SUPPORTED
|
||||||
</thead>
|
- **Description**: Mobile Device Management (MDM) is generally not supported for this device.
|
||||||
<tbody>
|
- **HRESULT**: 80180015
|
||||||
<tr class="odd">
|
|
||||||
<td><p>DeviceCapReached</p></td>
|
- **Subcode**: NotEligibleToRenew
|
||||||
<td><p>MENROLL_E_DEVICECAPREACHED</p></td>
|
- **Error**: MENROLL_E_NOTELIGIBLETORENEW
|
||||||
<td><p>The account has too many devices enrolled to Mobile Device Management (MDM). Delete or unenroll old devices to fix this error.</p></td>
|
- **Description**: The device is attempting to renew the Mobile Device Management (MDM) certificate, but the server rejected the request. Check renew schedule on the device.
|
||||||
<td><p>80180013</p></td>
|
- **HRESULT**: 80180016
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
- **Subcode**: InMaintenance
|
||||||
<td><p>DeviceNotSupported</p></td>
|
- **Error**: MENROLL_E_INMAINTENANCE
|
||||||
<td><p>MENROLL_E_DEVICENOTSUPPORTED</p></td>
|
- **Description**: The Mobile Device Management (MDM) server states your account is in maintenance, try again later.
|
||||||
<td><p>The Mobile Device Management (MDM) server doesn't support this platform or version, consider upgrading your device.</p></td>
|
- **HRESULT**: 80180017
|
||||||
<td><p>80180014</p></td>
|
|
||||||
</tr>
|
- **Subcode**: UserLicense
|
||||||
<tr class="odd">
|
- **Error**: MENROLL_E_USER_LICENSE
|
||||||
<td><p>NotSupported</p></td>
|
- **Description**: There was an error with your Mobile Device Management (MDM) user license. Contact your system administrator.
|
||||||
<td><p>MENROLL_E_NOT_SUPPORTED</p></td>
|
- **HRESULT**: 80180018
|
||||||
<td><p>Mobile Device Management (MDM) is generally not supported for this device.</p></td>
|
|
||||||
<td><p>80180015</p></td>
|
- **Subcode**: InvalidEnrollmentData
|
||||||
</tr>
|
- **Error**: MENROLL_E_ENROLLMENTDATAINVALID
|
||||||
<tr class="even">
|
- **Description**: The Mobile Device Management (MDM) server rejected the enrollment data. The server may not be configured correctly.
|
||||||
<td><p>NotEligibleToRenew</p></td>
|
- **HRESULT**: 80180019
|
||||||
<td><p>MENROLL_E_NOTELIGIBLETORENEW</p></td>
|
|
||||||
<td><p>The device is attempting to renew the Mobile Device Management (MDM) certificate, but the server rejected the request. Check renew schedule on the device.</p></td>
|
|
||||||
<td><p>80180016</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>InMaintenance</p></td>
|
|
||||||
<td><p>MENROLL_E_INMAINTENANCE</p></td>
|
|
||||||
<td><p>The Mobile Device Management (MDM) server states your account is in maintenance, try again later.</p></td>
|
|
||||||
<td><p>80180017</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>UserLicense</p></td>
|
|
||||||
<td><p>MENROLL_E_USER_LICENSE</p></td>
|
|
||||||
<td><p>There was an error with your Mobile Device Management (MDM) user license. Contact your system administrator.</p></td>
|
|
||||||
<td><p>80180018</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>InvalidEnrollmentData</p></td>
|
|
||||||
<td><p>MENROLL_E_ENROLLMENTDATAINVALID</p></td>
|
|
||||||
<td><p>The Mobile Device Management (MDM) server rejected the enrollment data. The server may not be configured correctly.</p></td>
|
|
||||||
<td><p>80180019</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
TraceID is a freeform text node which is logged. It should identify the server side state for this enrollment attempt. This information may be used by support to look up why the server declined the enrollment.
|
TraceID is a freeform text node which is logged. It should identify the server side state for this enrollment attempt. This information may be used by support to look up why the server declined the enrollment.
|
||||||
|
|
||||||
|
|||||||
@ -14,17 +14,16 @@ ms.date: 06/26/2017
|
|||||||
|
|
||||||
# NAP CSP
|
# NAP CSP
|
||||||
|
|
||||||
|
|
||||||
The NAP (Network Access Point) Configuration Service Provider is used to manage and query GPRS and CDMA connections.
|
The NAP (Network Access Point) Configuration Service Provider is used to manage and query GPRS and CDMA connections.
|
||||||
|
|
||||||
> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application.
|
> [!Note]
|
||||||
|
> This configuration service provider requires the `ID_CAP_CSP_FOUNDATION` and `ID_CAP_NETWORKING_ADMIN` capabilities to be accessed from a network configuration application.
|
||||||
|
|
||||||
|
|
||||||
For the NAP CSP, you cannot use the Replace command unless the node already exists.
|
For the NAP CSP, you cannot use the Replace command unless the node already exists.
|
||||||
|
|
||||||
The following shows the NAP configuration service provider management object in tree format as used by OMA DM. The OMA Client Provisioning protocol is not supported by this configuration service provider.
|
The following shows the NAP configuration service provider management object in tree format as used by OMA DM. The OMA Client Provisioning protocol is not supported by this configuration service provider.
|
||||||
```
|
|
||||||
|
```console
|
||||||
./Vendor/MSFT
|
./Vendor/MSFT
|
||||||
NAP
|
NAP
|
||||||
----*
|
----*
|
||||||
@ -61,6 +60,7 @@ NAP
|
|||||||
----------------Secure
|
----------------Secure
|
||||||
----------------SecureLevel
|
----------------SecureLevel
|
||||||
```
|
```
|
||||||
|
|
||||||
<a href="" id="--vendor-msft-nap"></a>**./Vendor/MSFT/NAP**
|
<a href="" id="--vendor-msft-nap"></a>**./Vendor/MSFT/NAP**
|
||||||
Root node.
|
Root node.
|
||||||
|
|
||||||
@ -87,34 +87,11 @@ Required. Specifies the type of address used to identify the destination network
|
|||||||
|
|
||||||
The following table shows some commonly used ADDRTYPE values and the types of connection that corresponds with each value.
|
The following table shows some commonly used ADDRTYPE values and the types of connection that corresponds with each value.
|
||||||
|
|
||||||
<table>
|
|ADDRTYPE Value|Connection Type|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|E164|RAS connections|
|
||||||
<col width="50%" />
|
|APN|GPRS connections|
|
||||||
</colgroup>
|
|ALPHA|Wi-Fi-based connections|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th>ADDRTYPE Value</th>
|
|
||||||
<th>Connection Type</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>E164</p></td>
|
|
||||||
<td><p>RAS connections</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>APN</p></td>
|
|
||||||
<td><p>GPRS connections</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>ALPHA</p></td>
|
|
||||||
<td><p>Wi-Fi-based connections</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<a href="" id="napx-authinfo"></a>***NAPX*/AuthInfo**
|
<a href="" id="napx-authinfo"></a>***NAPX*/AuthInfo**
|
||||||
Optional node. Specifies the authentication information, including the protocol, user name, and password.
|
Optional node. Specifies the authentication information, including the protocol, user name, and password.
|
||||||
@ -136,17 +113,7 @@ Node.
|
|||||||
<a href="" id="napx-bearer-bearertype"></a>***NAPX*/Bearer/BearerType**
|
<a href="" id="napx-bearer-bearertype"></a>***NAPX*/Bearer/BearerType**
|
||||||
Required. Specifies the network type of the destination network. This can be set to GPRS, CDMA2000, WCDMA, TDMA, CSD, DTPT, WiFi.
|
Required. Specifies the network type of the destination network. This can be set to GPRS, CDMA2000, WCDMA, TDMA, CSD, DTPT, WiFi.
|
||||||
|
|
||||||
## Related topics
|
## Related articles
|
||||||
|
|
||||||
|
|
||||||
[Configuration service provider reference](configuration-service-provider-reference.md)
|
[Configuration service provider reference](configuration-service-provider-reference.md)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -14,16 +14,12 @@ ms.date: 06/26/2017
|
|||||||
|
|
||||||
# NAPDEF CSP
|
# NAPDEF CSP
|
||||||
|
|
||||||
|
|
||||||
The NAPDEF configuration service provider is used to add, modify, or delete WAP network access points (NAPs). For complete information about these settings, see the standard WAP specification WAP-183-ProvCont-20010724-a.
|
The NAPDEF configuration service provider is used to add, modify, or delete WAP network access points (NAPs). For complete information about these settings, see the standard WAP specification WAP-183-ProvCont-20010724-a.
|
||||||
|
|
||||||
> **Note** You cannot use NAPDEF CSP on the desktop to update the Push Proxy Gateway (PPG) list.
|
> [!Note]
|
||||||
|
> You cannot use NAPDEF CSP on the desktop to update the Push Proxy Gateway (PPG) list.
|
||||||
>
|
>
|
||||||
>
|
> This configuration service provider requires the `ID_CAP_CSP_FOUNDATION` and `ID_CAP_NETWORKING_ADMIN` capabilities to be accessed from a network configuration application.
|
||||||
>
|
|
||||||
> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The following shows the NAPDEF configuration service provider management object in tree format as used by OMA Client Provisioning for **initial bootstrapping of the phone**. The OMA DM protocol is not supported by this configuration service provider.
|
The following shows the NAPDEF configuration service provider management object in tree format as used by OMA Client Provisioning for **initial bootstrapping of the phone**. The OMA DM protocol is not supported by this configuration service provider.
|
||||||
|
|
||||||
@ -77,9 +73,8 @@ Specifies the protocol used to authenticate the user.
|
|||||||
|
|
||||||
The only permitted values for this element are "POP" (Password Authentication Protocol) and "CHAP" (Challenge Handshake Authentication Protocol) authentication protocols. Note
|
The only permitted values for this element are "POP" (Password Authentication Protocol) and "CHAP" (Challenge Handshake Authentication Protocol) authentication protocols. Note
|
||||||
|
|
||||||
> **Note** **AuthName** and **AuthSecret** are not created if **AuthType** is not included in the initial device configuration. **AuthName** and **AuthSecret** cannot be changed if **AuthType** is not included in the provisioning XML used to make the change.
|
> [!Note]
|
||||||
|
> **AuthName** and **AuthSecret** are not created if **AuthType** is not included in the initial device configuration. **AuthName** and **AuthSecret** cannot be changed if **AuthType** is not included in the provisioning XML used to make the change.
|
||||||
|
|
||||||
|
|
||||||
<a href="" id="bearer"></a>**BEARER**
|
<a href="" id="bearer"></a>**BEARER**
|
||||||
Specifies the type of bearer.
|
Specifies the type of bearer.
|
||||||
@ -124,54 +119,15 @@ The name of the *NAPID* element is the same as the value passed during initial b
|
|||||||
|
|
||||||
## Microsoft Custom Elements
|
## Microsoft Custom Elements
|
||||||
|
|
||||||
|
|
||||||
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
|
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
|
||||||
|
|
||||||
<table>
|
|Elements|Available|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="20%" />
|
|Parm-query|Yes <br>Note that some GPRS parameters will not necessarily contain the exact same value as was set.|
|
||||||
<col width="80%" />
|
|Noparm|Yes|
|
||||||
</colgroup>
|
|Nocharacteristic|Yes|
|
||||||
<thead>
|
|Characteristic-query|Yes|
|
||||||
<tr class="header">
|
|
||||||
<th>Elements</th>
|
|
||||||
<th>Available</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>Parm-query</p></td>
|
|
||||||
<td><p>Yes</p>
|
|
||||||
<p>Note that some GPRS parameters will not necessarily contain the exact same value as was set.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>Noparm</p></td>
|
|
||||||
<td><p>Yes</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>Nocharacteristic</p></td>
|
|
||||||
<td><p>Yes</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>Characteristic-query</p></td>
|
|
||||||
<td><p>Yes</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
|
|
||||||
|
## Related articles
|
||||||
|
|
||||||
[Configuration service provider reference](configuration-service-provider-reference.md)
|
[Configuration service provider reference](configuration-service-provider-reference.md)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -18,10 +18,11 @@ The Office configuration service provider (CSP) enables a Microsoft Office clien
|
|||||||
|
|
||||||
This CSP was added in Windows 10, version 1703.
|
This CSP was added in Windows 10, version 1703.
|
||||||
|
|
||||||
For additional information, see [Office DDF](office-ddf.md).
|
For more information, see [Office DDF](office-ddf.md).
|
||||||
|
|
||||||
The following shows the Office configuration service provider in tree format.
|
The following shows the Office configuration service provider in tree format.
|
||||||
```
|
|
||||||
|
```console
|
||||||
./Vendor/MSFT
|
./Vendor/MSFT
|
||||||
Office
|
Office
|
||||||
----Installation
|
----Installation
|
||||||
@ -46,6 +47,7 @@ Office
|
|||||||
------------Install
|
------------Install
|
||||||
------------Status
|
------------Status
|
||||||
```
|
```
|
||||||
|
|
||||||
<a href="" id="office"></a>**./Device/Vendor/MSFT/Office/ or ./User/Vendor/MSFT/Office**
|
<a href="" id="office"></a>**./Device/Vendor/MSFT/Office/ or ./User/Vendor/MSFT/Office**
|
||||||
The root node for the Office configuration service provider.</p>
|
The root node for the Office configuration service provider.</p>
|
||||||
|
|
||||||
@ -151,140 +153,22 @@ To get the current status of Office 365 on the device.
|
|||||||
|
|
||||||
## Status code
|
## Status code
|
||||||
|
|
||||||
<table>
|
|Status|Description|Comment|
|
||||||
<colgroup>
|
|--- |--- |--- |
|
||||||
<col width="30%" />
|
|0|Installation succeeded|OK|
|
||||||
<col width="50%" />
|
|997|Installation in progress||
|
||||||
<col width="20%" />
|
|13|ERROR_INVALID_DATA <br>Cannot verify signature of the downloaded Office Deployment Tool (ODT)|Failure|
|
||||||
|
|1460|ERROR_TIMEOUT <br>Failed to download ODT|Failure|
|
||||||
</colgroup>
|
|1602|ERROR_INSTALL_USEREXIT <br>User canceled the installation|Failure|
|
||||||
<thead>
|
|1603|ERROR_INSTALL_FAILURE<br>Failed any pre-req check.<li>SxS (Tried to install when 2016 MSI is installed)<li>Bit mismatch between the currently installed Office and the Office that was attempting to be installed (such as when you try to install a 32-bit version while 64-bit version is currently installed.)|Failure|
|
||||||
<tr class="header">
|
|17000|ERROR_PROCESSPOOL_INITIALIZATION <br/>Failed to start C2RClient|Failure|
|
||||||
<th>Status</th>
|
|17001|ERROR_QUEUE_SCENARIO <br/>Failed to queue installation scenario in C2RClient|Failure|
|
||||||
<th>Description</th>
|
|17002|ERROR_COMPLETING_SCENARIO <br>Failed to complete the process. Possible reasons:<li>Installation canceled by user<li>Installation canceled by another installation<li>Out of disk space during installation <li>Unknown language ID|Failure|
|
||||||
<th>Comment</th>
|
|17003|ERROR_ANOTHER_RUNNING_SCENARIO <br>Another scenario is running|Failure|
|
||||||
</tr>
|
|17004|ERROR_COMPLETING_SCENARIO_NEED_CLEAN_UP<br>Possible reasons:<li>Unknown SKUs<li>Content does't exist on CDN<ul><li>Such as trying to install an unsupported LAP, like zh-sg<li>CDN issue that content is not available</li></ul><li>Signature check issue, such as failed the signature check for Office content<li>User canceled|Failure|
|
||||||
</thead>
|
|17005|ERROR_SCENARIO_CANCELLED_AS_PLANNED|Failure|
|
||||||
<tbody>
|
|17006|ERROR_SCENARIO_CANCELLED<br>Blocked update by running apps|Failure|
|
||||||
<tr>
|
|17007|ERROR_REMOVE_INSTALLATION_NEEDED<br>The client is requesting client clean-up in a "Remove Installation" scenario|Failure|
|
||||||
<td>0</td>
|
|17100|ERROR_HANDLING_COMMAND_LINE<br>C2RClient command-line error|Failure|
|
||||||
<td>Installation succeeded</td>
|
|0x80004005|E_FAIL <br>ODT cannot be used to install Volume license|Failure|
|
||||||
<td>OK</td>
|
|0x8000ffff|E_UNEXPECTED<br>Tried to uninstall when there is no C2R Office on the machine.|Failure|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>997</td>
|
|
||||||
<td>Installation in progress</td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>13</td>
|
|
||||||
<td>ERROR_INVALID_DATA
|
|
||||||
<p>Cannot verify signature of the downloaded Office Deployment Tool (ODT)<p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>1460</td>
|
|
||||||
<td>ERROR_TIMEOUT
|
|
||||||
<p>Failed to download ODT</p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>1602 </td>
|
|
||||||
<td>ERROR_INSTALL_USEREXIT
|
|
||||||
<p>User cancelled the installation </p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>1603</td>
|
|
||||||
<td>ERROR_INSTALL_FAILURE
|
|
||||||
<p>Failed any pre-req check.</p>
|
|
||||||
<ul>
|
|
||||||
<li>SxS (Tried to install when 2016 MSI is installed)</li>
|
|
||||||
<li>Bit mismatch between the currently installed Office and the Office that was attempting to be installed (such as when you try to install a 32-bit version while 64-bit version is currently installed.)</li>
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>17000</td>
|
|
||||||
<td>ERROR_PROCESSPOOL_INITIALIZATION
|
|
||||||
<p>Failed to start C2RClient </p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>17001</td>
|
|
||||||
<td>ERROR_QUEUE_SCENARIO
|
|
||||||
<p>Failed to queue installation scenario in C2RClient</p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>17002</td>
|
|
||||||
<td>ERROR_COMPLETING_SCENARIO
|
|
||||||
<p>Failed to complete the process. Possible reasons:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Installation cancelled by user</li>
|
|
||||||
<li>Installation cancelled by another installation</li>
|
|
||||||
<li>Out of disk space during installation </li>
|
|
||||||
<li>Unknown language ID</li>
|
|
||||||
</ul></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>17003</td>
|
|
||||||
<td>ERROR_ANOTHER_RUNNING_SCENARIO
|
|
||||||
<p>Another scenario is running</p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>17004</td>
|
|
||||||
<td>ERROR_COMPLETING_SCENARIO_NEED_CLEAN_UP
|
|
||||||
<p>Possible reasons:</p>
|
|
||||||
<ul>
|
|
||||||
<li>Unknown SKUs</li>
|
|
||||||
<li>Content does't exist on CDN
|
|
||||||
<ul><li>such as trying to install an unsupported LAP, like zh-sg</li>
|
|
||||||
<li>CDN issue that content is not available</li></ul>
|
|
||||||
</li>
|
|
||||||
<li>Signature check issue, such as failed the signature check for Office content</li>
|
|
||||||
<li>User cancelled
|
|
||||||
</ul>
|
|
||||||
</td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>17005</td>
|
|
||||||
<td>ERROR_SCENARIO_CANCELLED_AS_PLANNED</td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>17006</td>
|
|
||||||
<td>ERROR_SCENARIO_CANCELLED
|
|
||||||
<p>Blocked update by running apps</p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>17007</td>
|
|
||||||
<td>ERROR_REMOVE_INSTALLATION_NEEDED
|
|
||||||
<p>The client is requesting client clean up in a "Remove Installation" scenario</p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>17100</td>
|
|
||||||
<td>ERROR_HANDLING_COMMAND_LINE
|
|
||||||
<p>C2RClient command line error </p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>0x80004005</td>
|
|
||||||
<td>E_FAIL
|
|
||||||
<p>ODT cannot be used to install Volume license</p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>0x8000ffff </td>
|
|
||||||
<td>E_UNEXPECTED
|
|
||||||
<p>Tried to uninstall when there is no C2R Office on the machine.</p></td>
|
|
||||||
<td>Failure</td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|||||||
@ -17,131 +17,21 @@ ms.date: 06/26/2017
|
|||||||
|
|
||||||
The OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. This topic describes the OMA DM functionality that the DM client supports in general. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/OMA-TS-DM_Protocol-V1_2-20070209-A.pdf).
|
The OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. This topic describes the OMA DM functionality that the DM client supports in general. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/OMA-TS-DM_Protocol-V1_2-20070209-A.pdf).
|
||||||
|
|
||||||
|
|
||||||
## In this topic
|
|
||||||
|
|
||||||
- [OMA DM standards](#oma-dm-standards)
|
|
||||||
|
|
||||||
- [OMA DM protocol common elements](#protocol-common-elements)
|
|
||||||
|
|
||||||
- [Device management session](#device-management-session)
|
|
||||||
|
|
||||||
- [User targeted vs. Device targeted configuration](#user-targeted-vs-device-targeted-configuration)
|
|
||||||
|
|
||||||
- [SyncML response codes](#syncml-response-codes)
|
|
||||||
|
|
||||||
|
|
||||||
## OMA DM standards
|
## OMA DM standards
|
||||||
|
|
||||||
The following table shows the OMA DM standards that Windows uses.
|
The following table shows the OMA DM standards that Windows uses.
|
||||||
|
|
||||||
<table>
|
|General area|OMA DM standard that is supported|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|Data transport and session|<li>Client-initiated remote HTTPS DM session over SSL.<li>Remote HTTPS DM session over SSL.<li>Remote DM server initiation notification using WAP Push over Short Message Service (SMS). Not used by enterprise management.<li>Remote bootstrap by using WAP Push over SMS. Not used by enterprise management.|
|
||||||
<col width="50%" />
|
|Bootstrap XML|OMA Client Provisioning XML.|
|
||||||
</colgroup>
|
|DM protocol commands|The following list shows the commands that are used by the device. For more information about the OMA DM command elements, see "[OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/)" available from the OMA website.<br/><li>Add (Implicit Add supported)<li>Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.<li>Atomic: Performing an Add command followed by Replace on the same node within an atomic element is not supported. Nested Atomic and Get commands are not allowed and will generate error code 500.<li>Delete: Removes a node from the DM tree, and the entire subtree beneath that node if one exists<li>Exec: Invokes an executable on the client device<li>Get: Retrieves data from the client device; for interior nodes, the child node names in the Data element are returned in URI-encoded format<li>Replace: Overwrites data on the client device<li>Result: Returns the data results of a Get command to the DM server<li>Sequence: Specifies the order in which a group of commands must be processed<li>Status: Indicates the completion status (success or failure) of an operation<br/><br/>If an XML element that is not a valid OMA DM command is under one of the following elements, the status code 400 is returned for that element:<br/><li>SyncBody<li>Atomic<li>Sequence<br><br/>If no CmdID is provided in the DM command, the client returns blank in the status element and the status code 400.<br/><br/>If Atomic elements are nested, the following status codes are returned:<br/><li>The nested Atomic command returns 500.<li>The parent Atomic command returns 507.<br/><br/>For more information about the Atomic command, see OMA DM protocol common elements.<br>Performing an Add command followed by Replace on the same node within an Atomic element is not supported.<br><br/>LocURI cannot start with `/`.<br/><br/>Meta XML tag in SyncHdr is ignored by the device.|
|
||||||
<thead>
|
|OMA DM standard objects|DevInfo<li>DevDetail<li>OMA DM DMS account objects (OMA DM version 1.2)|
|
||||||
<tr class="header">
|
|Security|<li>Authenticate DM server initiation notification SMS message (not used by enterprise management)<li>Application layer Basic and MD5 client authentication<li>Authenticate server with MD5 credential at application level<li>Data integrity and authentication with HMAC at application level<li>SSL level certificate-based client/server authentication, encryption, and data integrity check|
|
||||||
<th>General area</th>
|
|Nodes|In the OMA DM tree, the following rules apply for the node name:<br/><li>"." can be part of the node name.<li>The node name cannot be empty.<li>The node name cannot be only the asterisk (*) character.|
|
||||||
<th>OMA DM standard that is supported</th>
|
|Provisioning Files|Provisioning XML must be well formed and follow the definition in SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905).<br/><br/>If an XML element that is not a valid OMA DM command is under SyncBody, the status code 400 is returned for that element.<div class="alert">**Note**<br>To represent a Unicode string as a URI, first encode the string as UTF-8. Then encode each of the UTF-8 bytes using URI encoding.</div>|
|
||||||
</tr>
|
|WBXML support|Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification.|
|
||||||
</thead>
|
|Handling of large objects|In Windows 10, version 1511, client support for uploading large objects to the server was added.|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>Data transport and session</p></td>
|
|
||||||
<td><ul>
|
|
||||||
<li><p>Client-initiated remote HTTPS DM session over SSL.</p></li>
|
|
||||||
<li><p>Remote HTTPS DM session over SSL.</p></li>
|
|
||||||
<li><p>Remote DM server initiation notification using WAP Push over Short Message Service (SMS). Not used by enterprise management.</p></li>
|
|
||||||
<li><p>Remote bootstrap by using WAP Push over SMS. Not used by enterprise management.</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>Bootstrap XML</p></td>
|
|
||||||
<td><ul>
|
|
||||||
<li><p>OMA Client Provisioning XML.</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>DM protocol commands</p></td>
|
|
||||||
<td><p>The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see "SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)" available from the <a href="https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/" data-raw-source="[OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/)">OMA website</a>.</p>
|
|
||||||
<ul>
|
|
||||||
<li><p>Add (Implicit Add supported)</p></li>
|
|
||||||
<li><p>Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.</p></li>
|
|
||||||
<li><p>Atomic: Note that performing an Add command followed by Replace on the same node within an atomic element is not supported. Nested Atomic and Get commands are not allowed and will generate error code 500.</p></li>
|
|
||||||
<li><p>Delete: Removes a node from the DM tree, and the entire subtree beneath that node if one exists</p></li>
|
|
||||||
<li><p>Exec: Invokes an executable on the client device</p></li>
|
|
||||||
<li><p>Get: Retrieves data from the client device; for interior nodes, the child node names in the Data element are returned in URI-encoded format</p></li>
|
|
||||||
<li><p>Replace: Overwrites data on the client device</p></li>
|
|
||||||
<li><p>Result: Returns the data results of a Get command to the DM server</p></li>
|
|
||||||
<li><p>Sequence: Specifies the order in which a group of commands must be processed</p></li>
|
|
||||||
<li><p>Status: Indicates the completion status (success or failure) of an operation</p></li>
|
|
||||||
</ul>
|
|
||||||
<p>If an XML element that is not a valid OMA DM command is under one of the following elements, the status code 400 is returned for that element:</p>
|
|
||||||
<ul>
|
|
||||||
<li><p>SyncBody</p></li>
|
|
||||||
<li><p>Atomic</p></li>
|
|
||||||
<li><p>Sequence</p></li>
|
|
||||||
</ul>
|
|
||||||
<p>If no CmdID is provided in the DM command, the client returns blank in the status element and the status code 400.</p>
|
|
||||||
<p>If Atomic elements are nested, the following status codes are returned:</p>
|
|
||||||
<ul>
|
|
||||||
<li><p>The nested Atomic command returns 500.</p></li>
|
|
||||||
<li><p>The parent Atomic command returns 507.</p></li>
|
|
||||||
</ul>
|
|
||||||
<p>For more information about the Atomic command, see OMA DM protocol common elements.</p>
|
|
||||||
<p>Performing an Add command followed by Replace on the same node within an Atomic element is not supported.</p>
|
|
||||||
<p>LocURI cannot start with "/".</p>
|
|
||||||
<p>Meta XML tag in SyncHdr is ignored by the device.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>OMA DM standard objects</p></td>
|
|
||||||
<td><ul>
|
|
||||||
<li><p>DevInfo</p></li>
|
|
||||||
<li><p>DevDetail</p></li>
|
|
||||||
<li><p>OMA DM DMS account objects (OMA DM version 1.2)</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>Security</p></td>
|
|
||||||
<td><ul>
|
|
||||||
<li><p>Authenticate DM server initiation notification SMS message (not used by enterprise management)</p></li>
|
|
||||||
<li><p>Application layer Basic and MD5 client authentication</p></li>
|
|
||||||
<li><p>Authenticate server with MD5 credential at application level</p></li>
|
|
||||||
<li><p>Data integrity and authentication with HMAC at application level</p></li>
|
|
||||||
<li><p>SSL level certificate based client/server authentication, encryption, and data integrity check</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>Nodes</p></td>
|
|
||||||
<td><p>In the OMA DM tree, the following rules apply for the node name:</p>
|
|
||||||
<ul>
|
|
||||||
<li><p>"." can be part of the node name.</p></li>
|
|
||||||
<li><p>The node name cannot be empty.</p></li>
|
|
||||||
<li><p>The node name cannot be only the asterisk (*) character.</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>Provisioning Files</p></td>
|
|
||||||
<td><p>Provisioning XML must be well formed and follow the definition in <a href="https://go.microsoft.com/fwlink/p/?LinkId=526905" data-raw-source="[SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905)">SyncML Representation Protocol</a> specification.</p>
|
|
||||||
<p>If an XML element that is not a valid OMA DM command is under SyncBody, the status code 400 is returned for that element.</p>
|
|
||||||
<div class="alert">
|
|
||||||
<strong>Note</strong><br/><p>To represent a Unicode string as a URI, first encode the string as UTF-8. Then encode each of the UTF-8 bytes using URI encoding.</p>
|
|
||||||
</div>
|
|
||||||
<div>
|
|
||||||
|
|
||||||
</div></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>WBXML support</p></td>
|
|
||||||
<td><p>Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the <a href="https://go.microsoft.com/fwlink/p/?LinkId=526905" data-raw-source="[SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905)">SyncML Representation Protocol</a> specification.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>Handling of large objects</p></td>
|
|
||||||
<td><p>In Windows 10, version 1511, client support for uploading large objects to the server was added.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
<a href="" id="protocol-common-elements"></a>
|
<a href="" id="protocol-common-elements"></a>
|
||||||
@ -149,99 +39,26 @@ The following table shows the OMA DM standards that Windows uses.
|
|||||||
|
|
||||||
Common elements are used by other OMA DM element types. The following table lists the OMA DM common elements used to configure the devices. For more information about OMA DM common elements, see "SyncML Representation Protocol Device Management Usage" (OMA-SyncML-DMRepPro-V1_1_2-20030613-A) available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).
|
Common elements are used by other OMA DM element types. The following table lists the OMA DM common elements used to configure the devices. For more information about OMA DM common elements, see "SyncML Representation Protocol Device Management Usage" (OMA-SyncML-DMRepPro-V1_1_2-20030613-A) available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).
|
||||||
|
|
||||||
<table>
|
|Element|Description|
|
||||||
<colgroup>
|
|--- |--- |
|
||||||
<col width="50%" />
|
|Chal|Specifies an authentication challenge. The server or client can send a challenge to the other if no credentials or inadequate credentials were given in the original request message.|
|
||||||
<col width="50%" />
|
|Cmd|Specifies the name of an OMA DM command referenced in a Status element.|
|
||||||
</colgroup>
|
|CmdID|Specifies the unique identifier for an OMA DM command.|
|
||||||
<thead>
|
|CmdRef|Specifies the ID of the command for which status or results information is being returned. This element takes the value of the CmdID element of the corresponding request message.|
|
||||||
<tr class="header">
|
|Cred|Specifies the authentication credential for the originator of the message.|
|
||||||
<th>Element</th>
|
|Final|Indicates that the current message is the last message in the package.|
|
||||||
<th>Description</th>
|
|LocName|Specifies the display name in the Target and Source elements, used for sending a user ID for MD5 authentication.|
|
||||||
</tr>
|
|LocURI|Specifies the address of the target or source location. If the address contains a non-alphanumeric character, it must be properly escaped according to the URL encoding standard.|
|
||||||
</thead>
|
|MsgID|Specifies a unique identifier for an OMA DM session message.|
|
||||||
<tbody>
|
|MsgRef|Specifies the ID of the corresponding request message. This element takes the value of the request message MsgID element.|
|
||||||
<tr class="odd">
|
|RespURI|Specifies the URI that the recipient must use when sending a response to this message.|
|
||||||
<td><p>Chal</p></td>
|
|SessionID|Specifies the identifier of the OMA DM session associated with the containing message.<div class="alert">**Note**<br> If the server does not notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the desktop client returns the SessionID in integer in decimal format and the mobile device client returns 2 bytes as a string. If the server supports DM session sync version 2.0, which is used in Windows 10, the desktop and mobile device client returns 2 bytes.</div>|
|
||||||
<td><p>Specifies an authentication challenge. The server or client can send a challenge to the other if no credentials or inadequate credentials were given in the original request message.</p></td>
|
|Source|Specifies the message source address.|
|
||||||
</tr>
|
|SourceRef|Specifies the source of the corresponding request message. This element takes the value of the request message Source element and is returned in the Status or Results element.|
|
||||||
<tr class="even">
|
|Target|Specifies the address of the node, in the DM Tree, that is the target of the OMA DM command.|
|
||||||
<td><p>Cmd</p></td>
|
|TargetRef|Specifies the target address in the corresponding request message. This element takes the value of the request message Target element and is returned in the Status or Results element.|
|
||||||
<td><p>Specifies the name of an OMA DM command referenced in a Status element.</p></td>
|
|VerDTD|Specifies the major and minor version identifier of the OMA DM representation protocol specification used to represent the message.|
|
||||||
</tr>
|
|VerProto|Specifies the major and minor version identifier of the OMA DM protocol specification used with the message.|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>CmdID</p></td>
|
|
||||||
<td><p>Specifies the unique identifier for an OMA DM command.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>CmdRef</p></td>
|
|
||||||
<td><p>Specifies the ID of the command for which status or results information is being returned. This element takes the value of the CmdID element of the corresponding request message.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>Cred</p></td>
|
|
||||||
<td><p>Specifies the authentication credential for the originator of the message.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>Final</p></td>
|
|
||||||
<td><p>Indicates that the current message is the last message in the package.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>LocName</p></td>
|
|
||||||
<td><p>Specifies the display name in the Target and Source elements, used for sending a user ID for MD5 authentication.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>LocURI</p></td>
|
|
||||||
<td><p>Specifies the address of the target or source location. If the address contains a non-alphanumeric character, it must be properly escaped according to the URL encoding standard.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>MsgID</p></td>
|
|
||||||
<td><p>Specifies a unique identifier for an OMA DM session message.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>MsgRef</p></td>
|
|
||||||
<td><p>Specifies the ID of the corresponding request message. This element takes the value of the request message MsgID element.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>RespURI</p></td>
|
|
||||||
<td><p>Specifies the URI that the recipient must use when sending a response to this message.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>SessionID</p></td>
|
|
||||||
<td><p>Specifies the identifier of the OMA DM session associated with the containing message.</p>
|
|
||||||
<div class="alert">
|
|
||||||
<strong>Note</strong> If the server does not notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the desktop client returns the SessionID in integer in decimal format and the mobile device client returns 2 bytes as a string. If the server supports DM session sync version 2.0, which is used in Windows 10, the desktop and mobile device client returns 2 bytes.
|
|
||||||
</div>
|
|
||||||
<div>
|
|
||||||
|
|
||||||
</div></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>Source</p></td>
|
|
||||||
<td><p>Specifies the message source address.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>SourceRef</p></td>
|
|
||||||
<td><p>Specifies the source of the corresponding request message. This element takes the value of the request message Source element and is returned in the Status or Results element.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>Target</p></td>
|
|
||||||
<td><p>Specifies the address of the node, in the DM Tree, that is the target of the OMA DM command.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>TargetRef</p></td>
|
|
||||||
<td><p>Specifies the target address in the corresponding request message. This element takes the value of the request message Target element and is returned in the Status or Results element.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>VerDTD</p></td>
|
|
||||||
<td><p>Specifies the major and minor version identifier of the OMA DM representation protocol specification used to represent the message.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>VerProto</p></td>
|
|
||||||
<td><p>Specifies the major and minor version identifier of the OMA DM protocol specification used with the message.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
## Device management session
|
## Device management session
|
||||||
|
|
||||||
@ -255,56 +72,25 @@ A DM session can be divided into two phases:
|
|||||||
1. **Setup phase**: In response to a trigger event, a client device sends an initiating message to a DM server. The device and server exchange needed authentication and device information. This phase is represented by steps 1, 2, and 3 in the following table.
|
1. **Setup phase**: In response to a trigger event, a client device sends an initiating message to a DM server. The device and server exchange needed authentication and device information. This phase is represented by steps 1, 2, and 3 in the following table.
|
||||||
2. **Management phase**: The DM server is in control. It sends management commands to the device and the device responds. Phase two ends when the DM server stops sending commands and terminates the session. This phase is represented by steps 3, 4, and 5 in the following table.
|
2. **Management phase**: The DM server is in control. It sends management commands to the device and the device responds. Phase two ends when the DM server stops sending commands and terminates the session. This phase is represented by steps 3, 4, and 5 in the following table.
|
||||||
|
|
||||||
The following table shows the sequence of events during a typical DM session.
|
The following information shows the sequence of events during a typical DM session.
|
||||||
|
|
||||||
<table>
|
1. DM client is invoked to call back to the management server<br><br>Enterprise scenario – The device task schedule invokes the DM client.
|
||||||
<colgroup>
|
|
||||||
<col width="33%" />
|
|
||||||
<col width="33%" />
|
|
||||||
<col width="33%" />
|
|
||||||
</colgroup>
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th>Step</th>
|
|
||||||
<th>Action</th>
|
|
||||||
<th>Description</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>1</p></td>
|
|
||||||
<td><p>DM client is invoked to call back to the management server</p>
|
|
||||||
<p>Enterprise scenario – The device task schedule invokes the DM client.</p></td>
|
|
||||||
<td><p>The MO server sends a server trigger message to invoke the DM client.</p>
|
|
||||||
<p>The trigger message includes the server ID and tells the client device to initiate a session with the server. The client device authenticates the trigger message and verifies that the server is authorized to communicate with it.</p>
|
|
||||||
<p>Enterprise scenario - At the scheduled time, the DM client is invoked periodically to call back to the enterprise management server over HTTPS.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>2</p></td>
|
|
||||||
<td><p>The device sends a message, over an IP connection, to initiate the session.</p></td>
|
|
||||||
<td><p>This message includes device information and credentials. The client and server do mutual authentication over an SSL channel or at the DM application level.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>3</p></td>
|
|
||||||
<td><p>The DM server responds, over an IP connection (HTTPS).</p></td>
|
|
||||||
<td><p>The server sends initial device management commands, if any.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td><p>4</p></td>
|
|
||||||
<td><p>The device responds to server management commands.</p></td>
|
|
||||||
<td><p>This message includes the results of performing the specified device management operations.</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td><p>5</p></td>
|
|
||||||
<td><p>The DM server terminates the session or sends another command.</p></td>
|
|
||||||
<td><p>The DM session ends, or Step 4 is repeated.</p></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
The MO server sends a server trigger message to invoke the DM client.
|
||||||
|
|
||||||
|
The trigger message includes the server ID and tells the client device to initiate a session with the server. The client device authenticates the trigger message and verifies that the server is authorized to communicate with it.<br><br>Enterprise scenario - At the scheduled time, the DM client is invoked periodically to call back to the enterprise management server over HTTPS.
|
||||||
|
|
||||||
The step numbers in the table do not represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each additional message. For more information about MsgID and OMA SyncML protocol, see "OMA Device Management Representation Protocol" (DM_RepPro-V1_2-20070209-A) available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/).
|
2. The device sends a message, over an IP connection, to initiate the session.
|
||||||
|
|
||||||
|
This message includes device information and credentials. The client and server do mutual authentication over an SSL channel or at the DM application level.
|
||||||
|
|
||||||
|
3. The DM server responds, over an IP connection (HTTPS). The server sends initial device management commands, if any.
|
||||||
|
|
||||||
|
4. The device responds to server management commands. This message includes the results of performing the specified device management operations.
|
||||||
|
|
||||||
|
5. The DM server terminates the session or sends another command. The DM session ends, or Step 4 is repeated.
|
||||||
|
|
||||||
|
The step numbers don't represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each extra message. For more information about MsgID and OMA SyncML protocol, see [OMA Device Management Representation Protocol (DM_RepPro-V1_2-20070209-A)](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/).
|
||||||
|
|
||||||
During OMA DM application level mutual authentication, if the device response code to Cred element in the server request is 212, no further authentication is needed for the remainder of the DM session. In the case of the MD5 authentication, the Chal element can be returned. Then the next nonce in Chal must be used for the MD5 digest when the next DM session is started.
|
During OMA DM application level mutual authentication, if the device response code to Cred element in the server request is 212, no further authentication is needed for the remainder of the DM session. In the case of the MD5 authentication, the Chal element can be returned. Then the next nonce in Chal must be used for the MD5 digest when the next DM session is started.
|
||||||
|
|
||||||
@ -319,13 +105,13 @@ For CSPs and policies that support per user configuration, the MDM server can se
|
|||||||
|
|
||||||
The data part of this alert could be one of following strings:
|
The data part of this alert could be one of following strings:
|
||||||
|
|
||||||
- user – the user that enrolled the device is actively logged in. The MDM server could send user specific configuration for CSPs/policies that support per user configuration
|
- User – the user that enrolled the device is actively logged in. The MDM server could send user-specific configuration for CSPs/policies that support per user configuration
|
||||||
- others – another user login but that user does not have an MDM account. The server can only apply device wide configuration, e.g. configuration applies to all users in the device.
|
- Others – another user login but that user does not have an MDM account. The server can only apply device-wide configuration, for example, configuration applies to all users in the device.
|
||||||
- none – no active user login. The server can only apply device wide configuration and available configuration is restricted to the device environment (no active user login).
|
- None – no active user login. The server can only apply device-wide configuration and available configuration is restricted to the device environment (no active user login).
|
||||||
|
|
||||||
Below is an alert example:
|
Below is an alert example:
|
||||||
|
|
||||||
```
|
```xml
|
||||||
<Alert>
|
<Alert>
|
||||||
<CmdID>1</CmdID>
|
<CmdID>1</CmdID>
|
||||||
<Data>1224</Data>
|
<Data>1224</Data>
|
||||||
@ -352,11 +138,11 @@ The following LocURL shows a per device CSP node configuration: **./device/vendo
|
|||||||
When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification.
|
When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification.
|
||||||
|
|
||||||
| Status code | Description |
|
| Status code | Description |
|
||||||
|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|---|----|
|
||||||
| 200 | The SyncML command completed successfully. |
|
| 200 | The SyncML command completed successfully. |
|
||||||
| 202 | Accepted for processing. This is usually an asynchronous operation, such as a request to run a remote execution of an application. |
|
| 202 | Accepted for processing. This is usually an asynchronous operation, such as a request to run a remote execution of an application. |
|
||||||
| 212 | Authentication accepted. Normally you'll only see this in response to the SyncHdr element (used for authentication in the OMA-DM standard). You may see this if you look at OMA DM logs, but CSPs do not typically generate this. |
|
| 212 | Authentication accepted. Normally you'll only see this in response to the SyncHdr element (used for authentication in the OMA-DM standard). You may see this if you look at OMA DM logs, but CSPs do not typically generate this. |
|
||||||
| 214 | Operation cancelled. The SyncML command completed successfully, but no more commands will be processed within the session. |
|
| 214 | Operation canceled. The SyncML command completed successfully, but no more commands will be processed within the session. |
|
||||||
| 215 | Not executed. A command was not executed as a result of user interaction to cancel the command. |
|
| 215 | Not executed. A command was not executed as a result of user interaction to cancel the command. |
|
||||||
| 216 | `Atomic` roll back OK. A command was inside an `Atomic` element and `Atomic` failed. This command was rolled back successfully. |
|
| 216 | `Atomic` roll back OK. A command was inside an `Atomic` element and `Atomic` failed. This command was rolled back successfully. |
|
||||||
| 400 | Bad request. The requested command could not be performed because of malformed syntax. CSPs do not usually generate this error, however you might see it if your SyncML is malformed. |
|
| 400 | Bad request. The requested command could not be performed because of malformed syntax. CSPs do not usually generate this error, however you might see it if your SyncML is malformed. |
|
||||||
@ -372,16 +158,6 @@ When using SyncML in OMA DM, there are standard response status codes that are r
|
|||||||
| 507 | `Atomic` failed. One of the operations in an `Atomic` block failed. |
|
| 507 | `Atomic` failed. One of the operations in an `Atomic` block failed. |
|
||||||
| 516 | `Atomic` roll back failed. An `Atomic` operation failed and the command was not rolled back successfully. |
|
| 516 | `Atomic` roll back failed. An `Atomic` operation failed and the command was not rolled back successfully. |
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
[Configuration service provider reference](configuration-service-provider-reference.md)
|
[Configuration service provider reference](configuration-service-provider-reference.md)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -38,33 +38,13 @@ manager: dansimp
|
|||||||
<a href="" id="abovelock-allowcortanaabovelock"></a>**AboveLock/AllowCortanaAboveLock**
|
<a href="" id="abovelock-allowcortanaabovelock"></a>**AboveLock/AllowCortanaAboveLock**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|
||||||
<th>Edition</th>
|
|
||||||
<th>Windows 10</th>
|
|
||||||
<th>Windows 11</th>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Home</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
|
|
||||||
</table>
|
|Edition|Windows 10|Windows 11|
|
||||||
|
|--- |--- |--- |
|
||||||
|
|Home|No|No|
|
||||||
|
|Pro|Yes|Yes|
|
||||||
|
|Enterprise|Yes|Yes|
|
||||||
|
|Education|Yes|Yes|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -105,28 +85,13 @@ The following list shows the supported values:
|
|||||||
<a href="" id="abovelock-allowtoasts"></a>**AboveLock/AllowToasts**
|
<a href="" id="abovelock-allowtoasts"></a>**AboveLock/AllowToasts**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|Yes, starting in Windows 10, version 1607|Yes|
|
||||||
</tr>
|
|Enterprise|Yes, starting in Windows 10, version 1607|Yes|
|
||||||
<tr>
|
|Education|Yes, starting in Windows 10, version 1607|Yes|
|
||||||
<td>Home</td>
|
|
||||||
<td>No</td><td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>Yes, starting in Windows 10, version 1607</td><td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes, starting in Windows 10, version 1607</td><td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes, starting in Windows 10, version 1607</td><td>Yes</td>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
|
|||||||
@ -40,43 +40,15 @@ manager: dansimp
|
|||||||
<a href="" id="accounts-allowaddingnonmicrosoftaccountsmanually"></a>**Accounts/AllowAddingNonMicrosoftAccountsManually**
|
<a href="" id="accounts-allowaddingnonmicrosoftaccountsmanually"></a>**Accounts/AllowAddingNonMicrosoftAccountsManually**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|Yes|Yes|
|
||||||
</tr>
|
|Enterprise|Yes|Yes|
|
||||||
<tr>
|
|Education|Yes|Yes|
|
||||||
<td>Home</td>
|
|Mobile|Yes|Yes|
|
||||||
<td>No</td>
|
|Mobile Enterprise|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Mobile</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Mobile Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -114,48 +86,16 @@ The following list shows the supported values:
|
|||||||
<a href="" id="accounts-allowmicrosoftaccountconnection"></a>**Accounts/AllowMicrosoftAccountConnection**
|
<a href="" id="accounts-allowmicrosoftaccountconnection"></a>**Accounts/AllowMicrosoftAccountConnection**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|Yes|Yes|
|
||||||
</tr>
|
|Business|Yes|Yes|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|Mobile|Yes|Yes|
|
||||||
<td>No</td>
|
|Mobile Enterprise|Yes|Yes|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Mobile</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Mobile Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -190,48 +130,16 @@ The following list shows the supported values:
|
|||||||
<a href="" id="accounts-allowmicrosoftaccountsigninassistant"></a>**Accounts/AllowMicrosoftAccountSignInAssistant**
|
<a href="" id="accounts-allowmicrosoftaccountsigninassistant"></a>**Accounts/AllowMicrosoftAccountSignInAssistant**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|Yes|Yes|
|
||||||
</tr>
|
|Business|Yes|Yes|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|Mobile|Yes|Yes|
|
||||||
<td>No</td>
|
|Mobile Enterprise|Yes|Yes|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Mobile</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Mobile Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
|
|||||||
@ -40,31 +40,13 @@ manager: dansimp
|
|||||||
<a href="" id="activexcontrols-approvedinstallationsites"></a>**ActiveXControls/ApprovedInstallationSites**
|
<a href="" id="activexcontrols-approvedinstallationsites"></a>**ActiveXControls/ApprovedInstallationSites**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|Yes|Yes|
|
||||||
</tr>
|
|Enterprise|Yes|Yes|
|
||||||
<tr>
|
|Education|Yes|Yes|
|
||||||
<td>Home</td>
|
|
||||||
<td>No</td><td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
|
|||||||
@ -40,31 +40,14 @@ manager: dansimp
|
|||||||
<a href="" id="admx-activexinstallservice-axisurlzonepolicies"></a>**ADMX_ActiveXInstallService/AxISURLZonePolicies**
|
<a href="" id="admx-activexinstallservice-axisurlzonepolicies"></a>**ADMX_ActiveXInstallService/AxISURLZonePolicies**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|Yes|Yes|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
|
|||||||
@ -70,20 +70,10 @@ manager: dansimp
|
|||||||
<a href="" id="admx-addremoveprograms-defaultcategory"></a>**ADMX_AddRemovePrograms/DefaultCategory**
|
<a href="" id="admx-addremoveprograms-defaultcategory"></a>**ADMX_AddRemovePrograms/DefaultCategory**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|
||||||
<th>Edition</th>
|
|
||||||
<th>Windows 10</th>
|
|
||||||
<th>Windows 11</th>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Home</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
</table>
|
|--- |--- |--- |
|
||||||
|
|Home|No|No|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -135,34 +125,14 @@ ADMX Info:
|
|||||||
<a href="" id="admx-addremoveprograms-noaddfromcdorfloppy"></a>**ADMX_AddRemovePrograms/NoAddFromCDorFloppy**
|
<a href="" id="admx-addremoveprograms-noaddfromcdorfloppy"></a>**ADMX_AddRemovePrograms/NoAddFromCDorFloppy**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|No|No|
|
||||||
</tr>
|
|Business|||
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|||
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -212,38 +182,14 @@ ADMX Info:
|
|||||||
<a href="" id="admx-addremoveprograms-noaddfrominternet"></a>**ADMX_AddRemovePrograms/NoAddFromInternet**
|
<a href="" id="admx-addremoveprograms-noaddfrominternet"></a>**ADMX_AddRemovePrograms/NoAddFromInternet**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|No|No|
|
||||||
</tr>
|
|Business|No|No|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -294,38 +240,14 @@ ADMX Info:
|
|||||||
<a href="" id="admx-addremoveprograms-noaddfromnetwork"></a>**ADMX_AddRemovePrograms/NoAddFromNetwork**
|
<a href="" id="admx-addremoveprograms-noaddfromnetwork"></a>**ADMX_AddRemovePrograms/NoAddFromNetwork**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|No|No|
|
||||||
</tr>
|
|Business|No|No|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -377,38 +299,14 @@ ADMX Info:
|
|||||||
<a href="" id="admx-addremoveprograms-noaddpage"></a>**ADMX_AddRemovePrograms/NoAddPage**
|
<a href="" id="admx-addremoveprograms-noaddpage"></a>**ADMX_AddRemovePrograms/NoAddPage**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|No|No|
|
||||||
</tr>
|
|Business|No|No|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -456,38 +354,14 @@ ADMX Info:
|
|||||||
<a href="" id="admx-addremoveprograms-noaddremoveprograms"></a>**ADMX_AddRemovePrograms/NoAddRemovePrograms**
|
<a href="" id="admx-addremoveprograms-noaddremoveprograms"></a>**ADMX_AddRemovePrograms/NoAddRemovePrograms**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|No|No|
|
||||||
</tr>
|
|Business|No|No|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -535,38 +409,14 @@ ADMX Info:
|
|||||||
<a href="" id="admx-addremoveprograms-nochooseprogramspage"></a>**ADMX_AddRemovePrograms/NoChooseProgramsPage**
|
<a href="" id="admx-addremoveprograms-nochooseprogramspage"></a>**ADMX_AddRemovePrograms/NoChooseProgramsPage**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|No|No|
|
||||||
</tr>
|
|Business|No|No|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -615,37 +465,14 @@ ADMX Info:
|
|||||||
<a href="" id="admx-addremoveprograms-noremovepage"></a>**ADMX_AddRemovePrograms/NoRemovePage**
|
<a href="" id="admx-addremoveprograms-noremovepage"></a>**ADMX_AddRemovePrograms/NoRemovePage**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|No|No|
|
||||||
</tr>
|
|Business|No|No|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -693,38 +520,14 @@ ADMX Info:
|
|||||||
<a href="" id="admx-addremoveprograms-noservices"></a>**ADMX_AddRemovePrograms/NoServices**
|
<a href="" id="admx-addremoveprograms-noservices"></a>**ADMX_AddRemovePrograms/NoServices**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|No|No|
|
||||||
</tr>
|
|Business|No|No|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -775,38 +578,14 @@ ADMX Info:
|
|||||||
<a href="" id="admx-addremoveprograms-nosupportinfo"></a>**ADMX_AddRemovePrograms/NoSupportInfo**
|
<a href="" id="admx-addremoveprograms-nosupportinfo"></a>**ADMX_AddRemovePrograms/NoSupportInfo**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|No|No|
|
||||||
</tr>
|
|Business|No|No|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
@ -856,38 +635,14 @@ ADMX Info:
|
|||||||
<a href="" id="admx-addremoveprograms-nowindowssetuppage"></a>**ADMX_AddRemovePrograms/NoWindowsSetupPage**
|
<a href="" id="admx-addremoveprograms-nowindowssetuppage"></a>**ADMX_AddRemovePrograms/NoWindowsSetupPage**
|
||||||
|
|
||||||
<!--SupportedSKUs-->
|
<!--SupportedSKUs-->
|
||||||
<table>
|
|
||||||
<tr>
|
|Edition|Windows 10|Windows 11|
|
||||||
<th>Edition</th>
|
|--- |--- |--- |
|
||||||
<th>Windows 10</th>
|
|Home|No|No|
|
||||||
<th>Windows 11</th>
|
|Pro|No|No|
|
||||||
</tr>
|
|Business|No|No|
|
||||||
<tr>
|
|Enterprise|Yes|Yes|
|
||||||
<td>Home</td>
|
|Education|Yes|Yes|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Business</td>
|
|
||||||
<td>No</td>
|
|
||||||
<td>No</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
<td>Yes</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
<!--/SupportedSKUs-->
|
<!--/SupportedSKUs-->
|
||||||
<hr/>
|
<hr/>
|
||||||
|
|||||||
@ -7,7 +7,7 @@ ms.prod: w10
|
|||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: manikadhiman
|
author: manikadhiman
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
ms.date: 09/27/2019
|
ms.date: 11/11/2021
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
manager: dansimp
|
manager: dansimp
|
||||||
---
|
---
|
||||||
@ -1080,9 +1080,10 @@ GP Info:
|
|||||||
|
|
||||||
<!--/Scope-->
|
<!--/Scope-->
|
||||||
<!--Description-->
|
<!--Description-->
|
||||||
This security setting determines which service accounts are prevented from registering a process as a service.
|
This security setting determines which users are prevented from logging on to the computer. This policy setting supersedes the **Allow log on locally** policy setting if an account is subject to both policies.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> This security setting does not apply to the System, Local Service, or Network Service accounts.
|
> If you apply this security policy to the **Everyone** group, no one will be able to log on locally.
|
||||||
|
|
||||||
<!--/Description-->
|
<!--/Description-->
|
||||||
<!--DbMapped-->
|
<!--DbMapped-->
|
||||||
|
|||||||
@ -295,7 +295,7 @@ SurfaceHub
|
|||||||
<p>The data type is boolean. Supported operation is Get and Replace.
|
<p>The data type is boolean. Supported operation is Get and Replace.
|
||||||
|
|
||||||
<a href="" id="inboxapps-welcome-currentbackgroundpath"></a>**InBoxApps/Welcome/CurrentBackgroundPath**
|
<a href="" id="inboxapps-welcome-currentbackgroundpath"></a>**InBoxApps/Welcome/CurrentBackgroundPath**
|
||||||
<p>Download location for image to be used as the background during user sessions and on the welcome screen. To set this, specify an https URL to a PNG file (only PNGs are supported for security reasons). If any certificate authorities need to be trusted in order to access the URL, please ensure they are valid and installed on the Hub, otherwise it may not be able to load the image.
|
<p>Download location for image to be used as the background during user sessions and on the welcome screen. To set this, specify an https URL to a 32-bit PNG file (only PNGs are supported for security reasons). If any certificate authorities need to be trusted in order to access the URL, please ensure they are valid and installed on the Hub, otherwise it may not be able to load the image.
|
||||||
|
|
||||||
<p>The data type is string. Supported operation is Get and Replace.
|
<p>The data type is string. Supported operation is Get and Replace.
|
||||||
|
|
||||||
|
|||||||
@ -19,13 +19,13 @@ Use these settings to configure the Account Manager service.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Settings | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Settings | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [DeletionPolicy](#deletionpolicy) | | | | ✔️ | |
|
| [DeletionPolicy](#deletionpolicy) | | | ✔️ | |
|
||||||
| [EnableProfileManager](#enableprofilemanager) | | | | ✔️ | |
|
| [EnableProfileManager](#enableprofilemanager) | | | ✔️ | |
|
||||||
| [ProfileInactivityThreshold](#profileinactivitythreshold) | | | | ✔️ | |
|
| [ProfileInactivityThreshold](#profileinactivitythreshold) | | | ✔️ | |
|
||||||
| [StorageCapacityStartDeletion](#storagecapacitystartdeletion) | | | | ✔️ | |
|
| [StorageCapacityStartDeletion](#storagecapacitystartdeletion) | | | ✔️ | |
|
||||||
| [StorageCapacityStopDeletion](#storagecapacitystopdeletion) | | | | ✔️ | |
|
| [StorageCapacityStopDeletion](#storagecapacitystopdeletion) | | | ✔️ | |
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>Although the AccountManagement settings are available in advanced provisioning for other editions, you should only use them for HoloLens devices.
|
>Although the AccountManagement settings are available in advanced provisioning for other editions, you should only use them for HoloLens devices.
|
||||||
|
|||||||
@ -19,7 +19,7 @@ Use these settings to join a device to an Active Directory domain or an Azure Ac
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [Azure](#azure) | ✔️ | ✔️ | ✔️ | |
|
| [Azure](#azure) | ✔️ | ✔️ | ✔️ | |
|
||||||
| [ComputerAccount](#computeraccount) | ✔️ | ✔️ | | ✔️ |
|
| [ComputerAccount](#computeraccount) | ✔️ | ✔️ | | ✔️ |
|
||||||
|
|||||||
@ -26,10 +26,10 @@ Starting in Windows 10, version 1703, you can import (*ingest*) select Group Pol
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [ConfigADMXInstalledPolicy](#configadmxinstalledpolicy) | ✔️ | | | | |
|
| [ConfigADMXInstalledPolicy](#configadmxinstalledpolicy) | ✔️ | | | |
|
||||||
| [ConfigOperations](#configoperations) | ✔️ | | | | |
|
| [ConfigOperations](#configoperations) | ✔️ | | | |
|
||||||
|
|
||||||
## ConfigADMXInstalledPolicy
|
## ConfigADMXInstalledPolicy
|
||||||
|
|
||||||
|
|||||||
@ -19,10 +19,10 @@ Use this setting to configure single use (kiosk) devices.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [AssignedAccessSettings](#assignedaccesssettings) | ✔️ | | | ✔️ | |
|
| [AssignedAccessSettings](#assignedaccesssettings) | ✔️ | | ✔️ | |
|
||||||
| [MultiAppAssignedAccessSettings](#multiappassignedaccesssettings) | ✔️ | | | ✔️ | |
|
| [MultiAppAssignedAccessSettings](#multiappassignedaccesssettings) | ✔️ | | ✔️ | |
|
||||||
|
|
||||||
|
|
||||||
## AssignedAccessSettings
|
## AssignedAccessSettings
|
||||||
|
|||||||
@ -19,13 +19,13 @@ Use to configure browser settings that should only be set by OEMs who are part o
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowPrelaunch](#allowprelaunch) | | | ✔️ | | |
|
| [AllowPrelaunch](#allowprelaunch) | | ✔️ | | |
|
||||||
| [FavoriteBarItems](#favoritebaritems) | ✔️ | | | | |
|
| [FavoriteBarItems](#favoritebaritems) | ✔️ | | | |
|
||||||
| [Favorites](#favorites) | | ✔️ | | | |
|
| [Favorites](#favorites) | | | | |
|
||||||
| [PartnerSearchCode](#partnersearchcode) | ✔️ | ✔️ | ✔️ | | |
|
| [PartnerSearchCode](#partnersearchcode) | ✔️ | ✔️ | | |
|
||||||
| [SearchProviders](#searchproviders) | | ✔️ | | | |
|
| [SearchProviders](#searchproviders) | | | | |
|
||||||
|
|
||||||
|
|
||||||
## AllowPrelaunch
|
## AllowPrelaunch
|
||||||
|
|||||||
@ -24,26 +24,26 @@ Use to configure settings for cellular data.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core
|
Setting groups | Windows client | Surface Hub | HoloLens | IoT Core
|
||||||
--- | :---: | :---: | :---: | :---: | :---:
|
--- | :---: | :---: | :---: | :---:
|
||||||
PerDevice: [CellConfigurations](#cellconfigurations) | | ✔️ | | | |
|
PerDevice: [CellConfigurations](#cellconfigurations) | | | | |
|
||||||
PerDevice: [CellData](#celldata) | ✔️ | ✔️ | ✔️ | |
|
PerDevice: [CellData](#celldata) | ✔️ | ✔️ | |
|
||||||
PerDevice: [CellUX](#cellux) | ✔️ | ✔️ | ✔️ | |
|
PerDevice: [CellUX](#cellux) | ✔️ | ✔️ | |
|
||||||
PerDevice: [CGDual](#cgdual) | | ✔️ | | |
|
PerDevice: [CGDual](#cgdual) | | | |
|
||||||
PerDevice: [eSim](#esim) | ✔️ | ✔️ | ✔️ | |
|
PerDevice: [eSim](#esim) | ✔️ | ✔️ | |
|
||||||
PerDevice: [External](#external) | | ✔️ | | |
|
PerDevice: [External](#external) | | | |
|
||||||
PerDevice: [General](#general) | | ✔️ | | |
|
PerDevice: [General](#general) | | | |
|
||||||
PerDevice: [RCS](#rcs) | | ✔️ | | |
|
PerDevice: [RCS](#rcs) | | | |
|
||||||
PerDevice: [SMS](#sms) | ✔️ | ✔️ | ✔️ | |
|
PerDevice: [SMS](#sms) | ✔️ | ✔️ | |
|
||||||
PerDevice: [UIX](#uix) | | ✔️ | | |
|
PerDevice: [UIX](#uix) | | | |
|
||||||
PerDevice: [UTK](#utk) | | ✔️ | | |
|
PerDevice: [UTK](#utk) | | | |
|
||||||
PerlMSI: [CellData](#celldata2) | | ✔️ | | |
|
PerlMSI: [CellData](#celldata2) | | | |
|
||||||
PerIMSI: [CellUX](#cellux2) | | ✔️ | | |
|
PerIMSI: [CellUX](#cellux2) | | | |
|
||||||
PerIMSI: [General](#general2) | | ✔️ | | |
|
PerIMSI: [General](#general2) | | | |
|
||||||
PerIMSI: [RCS](#rcs2) | | ✔️ | | |
|
PerIMSI: [RCS](#rcs2) | | | |
|
||||||
PerIMSI: [SMS](#sms2) | ✔️ | ✔️ | ✔️ | |
|
PerIMSI: [SMS](#sms2) | ✔️ | ✔️ | |
|
||||||
PerIMSI: [UTK](#utk2) | | ✔️ | | |
|
PerIMSI: [UTK](#utk2) | | | |
|
||||||
PerIMSI: [VoLTE](#volte) | | ✔️ | | |
|
PerIMSI: [VoLTE](#volte) | | | |
|
||||||
|
|
||||||
|
|
||||||
## PerDevice
|
## PerDevice
|
||||||
|
|||||||
@ -21,9 +21,9 @@ Use to configure settings for cellular connections.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | | | | |
|
| All settings | ✔️ | | | |
|
||||||
|
|
||||||
## PerDevice
|
## PerDevice
|
||||||
|
|
||||||
|
|||||||
@ -25,9 +25,9 @@ Use to deploy Root Certificate Authority (CA) certificates to devices. The follo
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All setting groups | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| All setting groups | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
|
|
||||||
|
|
||||||
## CACertificates
|
## CACertificates
|
||||||
|
|||||||
@ -19,10 +19,10 @@ Use to remove user-installed and pre-installed applications, with the option to
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Settings | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Settings | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| CleanPCRetainingUserData | ✔️ | | | | |
|
| CleanPCRetainingUserData | ✔️ | | | |
|
||||||
| CleanPCWithoutRetainingUserData | ✔️ | | | | |
|
| CleanPCWithoutRetainingUserData | ✔️ | | | |
|
||||||
|
|
||||||
For each setting, the options are **Enable** and **Not configured**.
|
For each setting, the options are **Enable** and **Not configured**.
|
||||||
|
|
||||||
|
|||||||
@ -19,9 +19,9 @@ Use to configure settings related to various types of phone connections.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | ✔️ | ✔️ | | |
|
| All settings | ✔️ | ✔️ | | |
|
||||||
|
|
||||||
|
|
||||||
For each setting group:
|
For each setting group:
|
||||||
|
|||||||
@ -19,14 +19,14 @@ Use to configure profiles that a user will connect with, such as an email accoun
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [Email](#email) | ✔️ | ✔️ | ✔️ | | |
|
| [Email](#email) | ✔️ | ✔️ | | |
|
||||||
| [Exchange](#exchange) | ✔️ | ✔️ | ✔️ | | |
|
| [Exchange](#exchange) | ✔️ | ✔️ | | |
|
||||||
| [KnownAccounts](#knownaccounts) | ✔️ | ✔️ | ✔️ | | |
|
| [KnownAccounts](#knownaccounts) | ✔️ | ✔️ | | |
|
||||||
| [VPN](#vpn) | ✔️ | ✔️ | ✔️ | ✔️ | |
|
| [VPN](#vpn) | ✔️ | ✔️ | ✔️ | |
|
||||||
| [WiFiSense](#wifisense) | ✔️ | ✔️ | ✔️ | | |
|
| [WiFiSense](#wifisense) | ✔️ | ✔️ | | |
|
||||||
| [WLAN](#wlan) | ✔️ | ✔️ | ✔️ | ✔️ | |
|
| [WLAN](#wlan) | ✔️ | ✔️ | ✔️ | |
|
||||||
|
|
||||||
## Email
|
## Email
|
||||||
|
|
||||||
|
|||||||
@ -19,8 +19,8 @@ Use to configure a setting that partners must customize to ship Windows devices
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| CountryCodeForExtendedCapabilityPrompts | ✔️ | ✔️ | ✔️ | | |
|
| CountryCodeForExtendedCapabilityPrompts | ✔️ | ✔️ | | |
|
||||||
|
|
||||||
You can set the **CountryCodeForExtendedCapabilityPrompts** setting for **China** to enable additional capability prompts when apps use privacy-sensitive features (such as Contacts or Microphone).
|
You can set the **CountryCodeForExtendedCapabilityPrompts** setting for **China** to enable additional capability prompts when apps use privacy-sensitive features (such as Contacts or Microphone).
|
||||||
|
|||||||
@ -19,7 +19,7 @@ Do not use. Instead, use the [Personalization settings](wcd-personalization.md).
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | | | | |
|
| All settings | ✔️ | | | |
|
||||||
|
|
||||||
|
|||||||
@ -19,18 +19,16 @@ Use to unlock developer mode on HoloLens devices and configure authentication to
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [EnableDeveloperMode](#enabledevelopermode) | | | | ✔️ | |
|
| [EnableDeveloperMode](#developersetupsettings-enabledevelopermode) | | | ✔️ | |
|
||||||
| [AuthenticationMode](#authenticationmode) | | | | ✔️ | |
|
| [AuthenticationMode](#windowsdeviceportalsettings-authentication-mode) | | | ✔️ | |
|
||||||
|
|
||||||
|
|
||||||
<span id="enabledevelopermode" />
|
|
||||||
## DeveloperSetupSettings: EnableDeveloperMode
|
## DeveloperSetupSettings: EnableDeveloperMode
|
||||||
|
|
||||||
When this setting is configured as **True**, the device is unlocked for developer functionality.
|
When this setting is configured as **True**, the device is unlocked for developer functionality.
|
||||||
|
|
||||||
<span id="authenticationmode" />
|
|
||||||
## WindowsDevicePortalSettings: Authentication Mode
|
## WindowsDevicePortalSettings: Authentication Mode
|
||||||
|
|
||||||
When AuthenticationMode is set to **Basic Auth**, enter a user name and password to enable the device to connect to and authenticate with the Windows Device Portal.
|
When AuthenticationMode is set to **Basic Auth**, enter a user name and password to enable the device to connect to and authenticate with the Windows Device Portal.
|
||||||
|
|||||||
@ -19,9 +19,9 @@ Use to identify the form factor of the device.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| DeviceForm | ✔️ | ✔️ | ✔️ | | |
|
| DeviceForm | ✔️ | ✔️ | | |
|
||||||
|
|
||||||
Specifies the device form factor running Windows 10. Generally, the device form is set by the original equipment manufacturer (OEM), however you might want to change the device form based on its usage in your organization.
|
Specifies the device form factor running Windows 10. Generally, the device form is set by the original equipment manufacturer (OEM), however you might want to change the device form based on its usage in your organization.
|
||||||
|
|
||||||
|
|||||||
@ -19,12 +19,12 @@ Use to configure device management settings.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [Accounts](#accounts) | ✔️ | ✔️ | ✔️ | | |
|
| [Accounts](#accounts) | ✔️ | ✔️ | | |
|
||||||
| [PGList](#pglist) | ✔️ | ✔️ | ✔️ | | |
|
| [PGList](#pglist) | ✔️ | ✔️ | | |
|
||||||
| [Policies](#policies) | ✔️ | ✔️ | ✔️ | | |
|
| [Policies](#policies) | ✔️ | ✔️ | | |
|
||||||
| [TrustedProvisioningSource](#trustedprovisioningsource) | ✔️ | ✔️ | ✔️ | | |
|
| [TrustedProvisioningSource](#trustedprovisioningsource) | ✔️ | ✔️ | | |
|
||||||
|
|
||||||
## Accounts
|
## Accounts
|
||||||
|
|
||||||
|
|||||||
@ -17,7 +17,7 @@ Do not use **DeviceUpdateCenter** settings at this time.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | | | | |
|
| All settings | ✔️ | | | |
|
||||||
|
|
||||||
|
|||||||
@ -19,9 +19,9 @@ Use to specify enterprise-specific mobile device management configuration settin
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| UpdateManagementServiceAddress | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| UpdateManagementServiceAddress | ✔️ | ✔️ | | ✔️ |
|
||||||
|
|
||||||
For the **UpdateManagementServiceAddress** setting, enter a list of servers. The first server in the semi-colon delimited list is the server that will be used to instantiate MDM sessions.
|
For the **UpdateManagementServiceAddress** setting, enter a list of servers. The first server in the semi-colon delimited list is the server that will be used to instantiate MDM sessions.
|
||||||
|
|
||||||
|
|||||||
@ -19,11 +19,11 @@ Use to upgrade the edition of Windows 10 on the device. [Learn about Windows 10
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [ChangeProductKey](#changeproductkey) | ✔️ | ✔️ | | | |
|
| [ChangeProductKey](#changeproductkey) | ✔️ | | | |
|
||||||
| [UpgradeEditionWithLicense](#upgradeeditionwithlicense) | ✔️ | ✔️ | | ✔️ | |
|
| [UpgradeEditionWithLicense](#upgradeeditionwithlicense) | ✔️ | | ✔️ | |
|
||||||
| [UpgradeEditionWithProductKey](#upgradeeditionwithproductkey) | ✔️ | ✔️ | | | |
|
| [UpgradeEditionWithProductKey](#upgradeeditionwithproductkey) | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
## ChangeProductKey
|
## ChangeProductKey
|
||||||
|
|||||||
@ -19,9 +19,9 @@ Use to enable AllJoyn router to work on public networks.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| EnableAllJoynOnPublicNetwork | | | | | ✔️ |
|
| EnableAllJoynOnPublicNetwork | | | | ✔️ |
|
||||||
|
|
||||||
Set to **True** or **False**.
|
Set to **True** or **False**.
|
||||||
|
|
||||||
|
|||||||
@ -19,9 +19,9 @@ Use these settings to configure the out-of-box experience (OOBE) to set up HoloL
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | | | | ✔️ | |
|
| All settings | | | ✔️ | |
|
||||||
|
|
||||||
Setting | Description
|
Setting | Description
|
||||||
--- | ---
|
--- | ---
|
||||||
|
|||||||
@ -19,8 +19,8 @@ Use to add files to the device.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| PublicDocuments | ✔️ | ✔️ | ✔️ | | |
|
| PublicDocuments | ✔️ | ✔️ | | |
|
||||||
|
|
||||||
Browse to and select a file or files that will be included in the provisioning package and added to the public profile documents folder on the target device. You can use the **Relative path to directory on target device** field to create a new folder within the public profile documents folder.
|
Browse to and select a file or files that will be included in the provisioning package and added to the public profile documents folder on the target device. You can use the **Relative path to directory on target device** field to create a new folder within the public profile documents folder.
|
||||||
|
|||||||
@ -19,12 +19,12 @@ Use KioskBrowser settings to configure Internet sharing.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | | | | | ✔️ |
|
| All settings | | | | ✔️ |
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>To configure Kiosk Browser settings for desktop editions, go to [Policies > KioskBrowser](wcd-policies.md#kioskbrowser).
|
>To configure Kiosk Browser settings for Windows client, go to [Policies > KioskBrowser](wcd-policies.md#kioskbrowser).
|
||||||
|
|
||||||
Kiosk Browser settings | Use this setting to
|
Kiosk Browser settings | Use this setting to
|
||||||
--- | ---
|
--- | ---
|
||||||
|
|||||||
@ -19,10 +19,10 @@ Use for settings related to Microsoft licensing programs.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowWindowsEntitlementReactivation](#allowwindowsentitlementreactivation) | ✔️ | | | | |
|
| [AllowWindowsEntitlementReactivation](#allowwindowsentitlementreactivation) | ✔️ | | | |
|
||||||
| [DisallowKMSClientOnlineAVSValidation](#disallowkmsclientonlineavsvalidation) | ✔️ | | | | |
|
| [DisallowKMSClientOnlineAVSValidation](#disallowkmsclientonlineavsvalidation) | ✔️ | | | |
|
||||||
|
|
||||||
## AllowWindowsEntitlementReactivation
|
## AllowWindowsEntitlementReactivation
|
||||||
|
|
||||||
|
|||||||
@ -18,9 +18,9 @@ Use Location settings to configure location services.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [EnableLocation](#enablelocation) | | | | | ✔️ |
|
| [EnableLocation](#enablelocation) | | | | ✔️ |
|
||||||
|
|
||||||
## EnableLocation
|
## EnableLocation
|
||||||
|
|
||||||
|
|||||||
@ -18,11 +18,11 @@ Use for settings related to Maps.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [ChinaVariantWin10](#chinavariantwin10) | ✔️ | ✔️ | ✔️ | | |
|
| [ChinaVariantWin10](#chinavariantwin10) | ✔️ | ✔️ | | |
|
||||||
| [UseExternalStorage](#useexternalstorage) | ✔️ | ✔️ | ✔️ | | |
|
| [UseExternalStorage](#useexternalstorage) | ✔️ | ✔️ | | |
|
||||||
| [UseSmallerCache](#usesmallercache) | ✔️ | ✔️ | ✔️ | | |
|
| [UseSmallerCache](#usesmallercache) | ✔️ | ✔️ | | |
|
||||||
|
|
||||||
|
|
||||||
## ChinaVariantWin10
|
## ChinaVariantWin10
|
||||||
|
|||||||
@ -18,9 +18,9 @@ Use for settings related to NetworkProxy.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | | | ✔️ | | |
|
| All settings | | ✔️ | | |
|
||||||
|
|
||||||
|
|
||||||
## AutoDetect
|
## AutoDetect
|
||||||
|
|||||||
@ -18,9 +18,9 @@ Use to create network Quality of Service (QoS) policies. A QoS policy performs a
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | | | ✔️ | | |
|
| All settings | | ✔️ | | |
|
||||||
|
|
||||||
1. In **Available customizations**, select **NetworkQ0SPolicy**, enter a friendly name for the account, and then click **Add**.
|
1. In **Available customizations**, select **NetworkQ0SPolicy**, enter a friendly name for the account, and then click **Add**.
|
||||||
2. In **Available customizations**, select the name that you just created. The following table describes the settings you can configure.
|
2. In **Available customizations**, select the name that you just created. The following table describes the settings you can configure.
|
||||||
|
|||||||
@ -18,21 +18,15 @@ Use to configure settings for the [Out Of Box Experience (OOBE)](/windows-hardwa
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [Desktop > EnableCortanaVoice](#enablecortanavoice) | ✔️ | | | | |
|
| [Desktop > EnableCortanaVoice](#enablecortanavoice) | ✔️ | | | |
|
||||||
| [Desktop > HideOobe](#hided) | ✔️ | | | | |
|
| [Desktop > HideOobe](#hideoobe-for-desktop) | ✔️ | | | |
|
||||||
| [Mobile > EnforceEnterpriseProvisioning](#nforce) | | ✔️ | | | |
|
|
||||||
| [Mobile > HideOobe](#hidem) | | ✔️ | | | |
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## EnableCortanaVoice
|
## EnableCortanaVoice
|
||||||
|
|
||||||
Use this setting to control whether Cortana voice-over is enabled during OOBE. The voice-over is disabled by default on Windows 10 Pro, Education, and Enterprise. The voice-over is enabled by default on Windows 10 Home. Select **True** to enable voice-over during OOBE, or **False** to disable voice-over during OOBE.
|
Use this setting to control whether Cortana voice-over is enabled during OOBE. The voice-over is disabled by default on Windows 10 Pro, Education, and Enterprise. The voice-over is enabled by default on Windows 10 Home. Select **True** to enable voice-over during OOBE, or **False** to disable voice-over during OOBE.
|
||||||
|
|
||||||
<span id="hided" />
|
|
||||||
## HideOobe for desktop
|
## HideOobe for desktop
|
||||||
|
|
||||||
When set to **True**, it hides the interactive OOBE flow for Windows 10.
|
When set to **True**, it hides the interactive OOBE flow for Windows 10.
|
||||||
@ -42,11 +36,3 @@ When set to **True**, it hides the interactive OOBE flow for Windows 10.
|
|||||||
|
|
||||||
When set to **False**, the OOBE screens are displayed.
|
When set to **False**, the OOBE screens are displayed.
|
||||||
|
|
||||||
<span id="nforce" />
|
|
||||||
## EnforceEnterpriseProvisioning
|
|
||||||
|
|
||||||
When set to **True**, it forces the OOBE flow into using the enterprise provisioning page without making the user interact with the Windows button. This is the default setting.
|
|
||||||
|
|
||||||
When set to **False**, it does not force the OOBE flow to the enterprise provisioning page.
|
|
||||||
|
|
||||||
<span id="hidem" />
|
|
||||||
|
|||||||
@ -18,12 +18,12 @@ Use to configure settings to personalize a PC.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [DeployDesktopImage](#deploydesktopimage) | ✔️ | | | | |
|
| [DeployDesktopImage](#deploydesktopimage) | ✔️ | | | |
|
||||||
| [DeployLockScreenImage](#deploylockscreenimage) | ✔️ | | | | |
|
| [DeployLockScreenImage](#deploylockscreenimage) | ✔️ | | | |
|
||||||
| [DesktopImageUrl](#desktopimageurl) | ✔️ | | | | |
|
| [DesktopImageUrl](#desktopimageurl) | ✔️ | | | |
|
||||||
| [LockScreenImageUrl](#lockscreenimageurl) | ✔️ | | | | |
|
| [LockScreenImageUrl](#lockscreenimageurl) | ✔️ | | | |
|
||||||
|
|
||||||
## DeployDesktopImage
|
## DeployDesktopImage
|
||||||
|
|
||||||
|
|||||||
@ -18,315 +18,316 @@ This section describes the **Policies** settings that you can configure in [prov
|
|||||||
|
|
||||||
## AboveLock
|
## AboveLock
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowActionCenterNotifications](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowactioncenternotifications) | Allow Action Center notifications above the device lock screen. | | ✔️ | | | |
|
| [AllowActionCenterNotifications](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowactioncenternotifications) | Allow Action Center notifications above the device lock screen. | | | | |
|
||||||
| [AllowToasts](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowtoasts) | Allow toast notifications above the device lock screen. | ✔️ | ✔️ | | | |
|
| [AllowToasts](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowtoasts) | Allow toast notifications above the device lock screen. | ✔️ | | | |
|
||||||
|
|
||||||
## Accounts
|
## Accounts
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowAddingNonMicrosoftAccountManually](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowaddingnonmicrosoftaccountsmanually) | Whether users can add non-Microsoft email accounts | ✔️ | ✔️ | | | |
|
| [AllowAddingNonMicrosoftAccountManually](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowaddingnonmicrosoftaccountsmanually) | Whether users can add non-Microsoft email accounts | ✔️ | | | |
|
||||||
| [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountconnection) | Whether users can use a Microsoft account for non-email-related connection authentication and services | ✔️ | ✔️ | | ✔️ | |
|
| [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountconnection) | Whether users can use a Microsoft account for non-email-related connection authentication and services | ✔️ | | ✔️ | |
|
||||||
| [AllowMicrosoftAccountSigninAssistant](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountsigninassistant) | Disable the **Microsoft Account Sign-In Assistant** (wlidsvc) NT service | ✔️ | ✔️ | | | |
|
| [AllowMicrosoftAccountSigninAssistant](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountsigninassistant) | Disable the **Microsoft Account Sign-In Assistant** (wlidsvc) NT service | ✔️ | | | |
|
||||||
| [DomainNamesForEmailSync](/windows/client-management/mdm/policy-configuration-service-provider#accounts-domainnamesforemailsync) | List of domains that are allowed to sync email on the devices | ✔️ | ✔️ | | | |
|
| [DomainNamesForEmailSync](/windows/client-management/mdm/policy-configuration-service-provider#accounts-domainnamesforemailsync) | List of domains that are allowed to sync email on the devices | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
## ApplicationDefaults
|
## ApplicationDefaults
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [DefaultAssociationsConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#applicationdefaults-defaultassociationsconfiguration) | Set default file type and protocol associations | ✔️ | | | | |
|
| [DefaultAssociationsConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#applicationdefaults-defaultassociationsconfiguration) | Set default file type and protocol associations | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
## ApplicationManagement
|
## ApplicationManagement
|
||||||
|
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowAllTrustedApps](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowalltrustedapps) | Whether non-Microsoft Store apps are allowed | ✔️ | ✔️ | | | ✔️ |
|
| [AllowAllTrustedApps](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowalltrustedapps) | Whether non-Microsoft Store apps are allowed | ✔️ | | | ✔️ |
|
||||||
| [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowappstoreautoupdate) | Whether automatic update of apps from Microsoft Store is allowed | ✔️ | ✔️ | | | ✔️ |
|
| [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowappstoreautoupdate) | Whether automatic update of apps from Microsoft Store is allowed | ✔️ | | | ✔️ |
|
||||||
| [AllowDeveloperUnlock](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowdeveloperunlock) | Whether developer unlock of device is allowed | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowDeveloperUnlock](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowdeveloperunlock) | Whether developer unlock of device is allowed | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [AllowGameDVR](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowgamedvr) |Whether DVR and broadcasting is allowed | ✔️ | | | | |
|
| [AllowGameDVR](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowgamedvr) |Whether DVR and broadcasting is allowed | ✔️ | | | |
|
||||||
| [AllowSharedUserAppData](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowshareduserappdata) | Whether multiple users of the same app can share data | ✔️ | ✔️ | | | |
|
| [AllowSharedUserAppData](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowshareduserappdata) | Whether multiple users of the same app can share data | ✔️ | | | |
|
||||||
| [AllowStore](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowstore) | Whether app store is allowed at device | | ✔️ | | | |
|
| [AllowStore](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowstore) | Whether app store is allowed at device | | | | |
|
||||||
| [ApplicationRestrictions](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-applicationrestrictions) | An XML blob that specifies app restrictions, such as an allow list, disallow list, etc. | | ✔️ | | | |
|
| [ApplicationRestrictions](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-applicationrestrictions) | An XML blob that specifies app restrictions, such as an allow list, disallow list, etc. | | | | |
|
||||||
| [LaunchAppAfterLogOn](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-launchappafterlogon) |Whether to launch an app or apps when the user signs in. | ✔️ | | | | |
|
| [LaunchAppAfterLogOn](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-launchappafterlogon) |Whether to launch an app or apps when the user signs in. | ✔️ | | | |
|
||||||
| [RestrictAppDataToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictappdatatosystemvolume) | Whether app data is restricted to the system drive | ✔️ | ✔️ | | | ✔️ |
|
| [RestrictAppDataToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictappdatatosystemvolume) | Whether app data is restricted to the system drive | ✔️ | | | ✔️ |
|
||||||
| [RestrictAppToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictapptosystemvolume) | Whether the installation of apps is restricted to the system drive | ✔️ | ✔️ | | | ✔️ |
|
| [RestrictAppToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictapptosystemvolume) | Whether the installation of apps is restricted to the system drive | ✔️ | | | ✔️ |
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Authentication
|
## Authentication
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowFastReconnect](/windows/client-management/mdm/policy-csp-authentication#authentication-allowfastreconnect) | Allows EAP Fast Reconnect from being attempted for EAP Method TLS. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowFastReconnect](/windows/client-management/mdm/policy-csp-authentication#authentication-allowfastreconnect) | Allows EAP Fast Reconnect from being attempted for EAP Method TLS. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [EnableFastFirstSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablefastfirstsignin) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [EnableFastFirstSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablefastfirstsignin) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [EnableWebSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablewebsignin) | Enables Windows logon support for non-ADFS federated providers (e.g. SAML). | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [EnableWebSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablewebsignin) | Enables Windows logon support for non-ADFS federated providers (e.g. SAML). | ✔️ | ✔️ | | ✔️ |
|
||||||
| [PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#authentication-preferredaadtenantdomainname) | Specifies the preferred domain among available domains in the Azure AD tenant. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#authentication-preferredaadtenantdomainname) | Specifies the preferred domain among available domains in the Azure AD tenant. | ✔️ | ✔️ | | ✔️ |
|
||||||
|
|
||||||
|
|
||||||
## BitLocker
|
## BitLocker
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [EncryptionMethod](/windows/client-management/mdm/policy-configuration-service-provider#bitlocker-encryptionmethod) | Specify BitLocker drive encryption method and cipher strength | ✔️ | ✔️ | | | |
|
| [EncryptionMethod](/windows/client-management/mdm/policy-configuration-service-provider#bitlocker-encryptionmethod) | Specify BitLocker drive encryption method and cipher strength | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
## Bluetooth
|
## Bluetooth
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowAdvertising](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowadvertising) | Whether the device can send out Bluetooth advertisements | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowAdvertising](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowadvertising) | Whether the device can send out Bluetooth advertisements | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [AllowDiscoverableMode](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowdiscoverablemode) | Whether other Bluetooth-enabled devices can discover the device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowDiscoverableMode](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowdiscoverablemode) | Whether other Bluetooth-enabled devices can discover the device | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [AllowPrepairing](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowprepairing) | Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowPrepairing](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowprepairing) | Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| AllowPromptedProximalConnections | Whether Windows will prompt users when Bluetooth devices that are connectable are in range of the user's device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| AllowPromptedProximalConnections | Whether Windows will prompt users when Bluetooth devices that are connectable are in range of the user's device | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [LocalDeviceName](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-localdevicename) | Set the local Bluetooth device name | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [LocalDeviceName](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-localdevicename) | Set the local Bluetooth device name | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [ServicesAllowedList](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-servicesallowedlist) | Set a list of allowable services and profiles | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [ServicesAllowedList](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-servicesallowedlist) | Set a list of allowable services and profiles | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
|
|
||||||
## Browser
|
## Browser
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowAddressBarDropdown](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowaddressbardropdown) | Specify whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality. | ✔️ | | | | |
|
| [AllowAddressBarDropdown](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowaddressbardropdown) | Specify whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality. | ✔️ | | | |
|
||||||
| [AllowAutofill](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowautofill) | Specify whether autofill on websites is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowAutofill](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowautofill) | Specify whether autofill on websites is allowed. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowBrowser](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowbrowser) | Specify whether the browser is allowed on the device (for Windows 10, version 1803 and earlier only). | ✔️ | ✔️ | | | |
|
| [AllowBrowser](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowbrowser) | Specify whether the browser is allowed on the device (for Windows 10, version 1803 and earlier only). | ✔️ | | | |
|
||||||
[AllowConfigurationUpdateForBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) | Specify whether Microsoft Edge can automatically update the configuration data for the Books Library. | ✔️ | ✔️ | | | |
|
[AllowConfigurationUpdateForBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) | Specify whether Microsoft Edge can automatically update the configuration data for the Books Library. | ✔️ | | | |
|
||||||
| [AllowCookies](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowcookies) | Specify whether cookies are allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowCookies](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowcookies) | Specify whether cookies are allowed. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowDeveloperTools](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdevelopertools) | Specify whether employees can use F12 Developer Tools on Microsoft Edge. | ✔️ | | | | |
|
| [AllowDeveloperTools](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdevelopertools) | Specify whether employees can use F12 Developer Tools on Microsoft Edge. | ✔️ | | | |
|
||||||
| [AllowDoNotTrack](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdonottrack) | Specify whether Do Not Track headers are allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowDoNotTrack](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdonottrack) | Specify whether Do Not Track headers are allowed. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowextensions) | Specify whether Microsoft Edge extensions are allowed. | ✔️ | | | | |
|
| [AllowExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowextensions) | Specify whether Microsoft Edge extensions are allowed. | ✔️ | | | |
|
||||||
| [AllowFlash](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflash) | Specify whether Adobe Flash can run in Microsoft Edge. | ✔️ | | | | |
|
| [AllowFlash](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflash) | Specify whether Adobe Flash can run in Microsoft Edge. | ✔️ | | | |
|
||||||
| [AllowFlashClickToRun](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflashclicktorun) | Specify whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. | ✔️ | | | | |
|
| [AllowFlashClickToRun](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflashclicktorun) | Specify whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. | ✔️ | | | |
|
||||||
| [AllowFullScreenMode](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowfullscreenmode) | Specify whether full-screen mode is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowFullScreenMode](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowfullscreenmode) | Specify whether full-screen mode is allowed. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowInPrivate](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowinprivate) | Specify whether InPrivate browsing is allowed on corporate networks. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowInPrivate](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowinprivate) | Specify whether InPrivate browsing is allowed on corporate networks. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowMicrosoftCompatibilityList](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowmicrosoftcompatibilitylist) | Specify whether to use the Microsoft compatibility list in Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowMicrosoftCompatibilityList](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowmicrosoftcompatibilitylist) | Specify whether to use the Microsoft compatibility list in Microsoft Edge. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowPasswordManager](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpasswordmanager) | Specify whether saving and managing passwords locally on the device is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowPasswordManager](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpasswordmanager) | Specify whether saving and managing passwords locally on the device is allowed. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowPopups](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpopups) | Specify whether pop-up blocker is allowed or enabled. | ✔️ | | | ✔️ | |
|
| [AllowPopups](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpopups) | Specify whether pop-up blocker is allowed or enabled. | ✔️ | | ✔️ | |
|
||||||
| [AllowPrelaunch](/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) | Specify whether Microsoft Edge can pre-launch as a background process during Windows startup when the system is idle waiting to be launched by the user. | ✔️ | | | | |
|
| [AllowPrelaunch](/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) | Specify whether Microsoft Edge can pre-launch as a background process during Windows startup when the system is idle waiting to be launched by the user. | ✔️ | | | |
|
||||||
| [AllowPrinting](/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) | Specify whether users can print web content in Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowPrinting](/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) | Specify whether users can print web content in Microsoft Edge. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowSavingHistory](/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) | Specify whether Microsoft Edge saves the browsing history. | ✔️ | | | | |
|
| [AllowSavingHistory](/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) | Specify whether Microsoft Edge saves the browsing history. | ✔️ | | | |
|
||||||
| [AllowSearchEngineCustomization](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchenginecustomization) | Allow search engine customization for MDM-enrolled devices. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowSearchEngineCustomization](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchenginecustomization) | Allow search engine customization for MDM-enrolled devices. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowSearchSuggestionsinAddressBar](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchsuggestionsinaddressbar) | Specify whether search suggestions are allowed in the address bar. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowSearchSuggestionsinAddressBar](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchsuggestionsinaddressbar) | Specify whether search suggestions are allowed in the address bar. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowSideloadingOfExtensions](/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) | Specify whether extensions can be sideloaded in Microsoft Edge. | ✔️ | | | | |
|
| [AllowSideloadingOfExtensions](/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) | Specify whether extensions can be sideloaded in Microsoft Edge. | ✔️ | | | |
|
||||||
| [AllowSmartScreen](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsmartscreen) | Specify whether Windows Defender SmartScreen is allowed. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowSmartScreen](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsmartscreen) | Specify whether Windows Defender SmartScreen is allowed. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [AllowTabPreloading](/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) | Specify whether preloading the Start and New tab pages during Windows sign-in is allowed. | ✔️ | | | | |
|
| [AllowTabPreloading](/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) | Specify whether preloading the Start and New tab pages during Windows sign-in is allowed. | ✔️ | | | |
|
||||||
| [AllowWebContentOnNewTabPage](/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) | Specify whether a New tab page opens with the default content or a blank page. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowWebContentOnNewTabPage](/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) | Specify whether a New tab page opens with the default content or a blank page. | ✔️ | ✔️ | | ✔️ |
|
||||||
[AlwaysEnableBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | Always show the Books Library in Microsoft Edge. | ✔️ | ✔️ | | | |
|
[AlwaysEnableBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | Always show the Books Library in Microsoft Edge. | ✔️ | | | |
|
||||||
| [ClearBrowsingDataOnExit](/windows/client-management/mdm/policy-configuration-service-provider#browser-clearbrowsingdataonexit) | Specify whether to clear browsing data when exiting Microsoft Edge. | ✔️ | | | | |
|
| [ClearBrowsingDataOnExit](/windows/client-management/mdm/policy-configuration-service-provider#browser-clearbrowsingdataonexit) | Specify whether to clear browsing data when exiting Microsoft Edge. | ✔️ | | | |
|
||||||
| [ConfigureAdditionalSearchEngines](/windows/client-management/mdm/policy-configuration-service-provider#browser-configureadditionalsearchengines) | Allows you to add up to 5 additional search engines for MDM-enrolled devices. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [ConfigureAdditionalSearchEngines](/windows/client-management/mdm/policy-configuration-service-provider#browser-configureadditionalsearchengines) | Allows you to add up to 5 additional search engines for MDM-enrolled devices. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [ConfigureFavoritesBar](/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) | Specify whether the Favorites bar is shown or hidden on all pages. | ✔️ | | | | |
|
| [ConfigureFavoritesBar](/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) | Specify whether the Favorites bar is shown or hidden on all pages. | ✔️ | | | |
|
||||||
| [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) | Configure whether the Home button will be shown, and what should happen when it is selected. You should also configure the [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) setting. To configure this setting and also allow users to make changes to the Home button, see the [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) setting. | ✔️ | | | | |
|
| [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) | Configure whether the Home button will be shown, and what should happen when it is selected. You should also configure the [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) setting. To configure this setting and also allow users to make changes to the Home button, see the [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) setting. | ✔️ | | | |
|
||||||
| [ConfigureKioskMode](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) | Configure how Microsoft Edge operates when it's running in kiosk mode, either as a single-app kiosk or as one of multiple apps running on the kiosk device. | ✔️ | | | | |
|
| [ConfigureKioskMode](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) | Configure how Microsoft Edge operates when it's running in kiosk mode, either as a single-app kiosk or as one of multiple apps running on the kiosk device. | ✔️ | | | |
|
||||||
| [ConfigureKioskResetAfterIdleTimeout](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) | Specify the time, in minutes, after which Microsoft Edge running in kiosk mode resets to the default kiosk configuration. | ✔️ | | | | |
|
| [ConfigureKioskResetAfterIdleTimeout](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) | Specify the time, in minutes, after which Microsoft Edge running in kiosk mode resets to the default kiosk configuration. | ✔️ | | | |
|
||||||
| [ConfigureOpenMicrosoftEdgeWith](/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) | Specify which pages should load when Microsoft Edge opens. You should also configure the [ConfigureStartPages](/windows/client-management/mdm/policy-csp-browser#browser-configurestartpages) setting and [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) setting. | ✔️ | | | | |
|
| [ConfigureOpenMicrosoftEdgeWith](/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) | Specify which pages should load when Microsoft Edge opens. You should also configure the [ConfigureStartPages](/windows/client-management/mdm/policy-csp-browser#browser-configurestartpages) setting and [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) setting. | ✔️ | | | |
|
||||||
| [ConfigureTelemetryForMicrosoft365Analytics](/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) | Specify whether to send Microsoft Edge browsing history data to Microsoft 365 Analytics. | ✔️ | | | | |
|
| [ConfigureTelemetryForMicrosoft365Analytics](/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) | Specify whether to send Microsoft Edge browsing history data to Microsoft 365 Analytics. | ✔️ | | | |
|
||||||
| [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) | Specify whether the lockdown on the Start pages is disabled. | ✔️ | | | | |
|
| [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) | Specify whether the lockdown on the Start pages is disabled. | ✔️ | | | |
|
||||||
[EnableExtendedBooksTelemetry](/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) | Enable this setting to send additional diagnostic data, on top of the basic diagnostic data, from the Books tab. | ✔️ | ✔️ | | | |
|
[EnableExtendedBooksTelemetry](/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) | Enable this setting to send additional diagnostic data, on top of the basic diagnostic data, from the Books tab. | ✔️ | ✔️ | | |
|
||||||
| [EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist) | Allow the user to specify a URL of an enterprise site list. | ✔️ | | | | |
|
| [EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist) | Allow the user to specify a URL of an enterprise site list. | ✔️ | | | |
|
||||||
| [EnterpriseSiteListServiceUrl](/windows/client-management/mdm/policy-csp-browser#browser-enterprisesitelistserviceurl) | This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by [Browser/EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist). | ✔️ | | | | |
|
| [EnterpriseSiteListServiceUrl](/windows/client-management/mdm/policy-csp-browser#browser-enterprisesitelistserviceurl) | This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by [Browser/EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist). | ✔️ | | | |
|
||||||
| [FirstRunURL](/windows/client-management/mdm/policy-configuration-service-provider#browser-firstrunurl) | Specify the URL that Microsoft Edge will use when it is opened for the first time. | ✔️ | ✔️ | | | |
|
| [FirstRunURL](/windows/client-management/mdm/policy-configuration-service-provider#browser-firstrunurl) | Specify the URL that Microsoft Edge will use when it is opened for the first time. | ✔️ | | | |
|
||||||
| [HomePages](/windows/client-management/mdm/policy-configuration-service-provider#browser-homepages) | Specify your Start pages for MDM-enrolled devices. | ✔️ | | | | |
|
| [HomePages](/windows/client-management/mdm/policy-configuration-service-provider#browser-homepages) | Specify your Start pages for MDM-enrolled devices. | ✔️ | | | |
|
||||||
[LockdownFavorites](/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | Configure whether employees can add, import, sort, or edit the Favorites list in Microsoft Edge. | ✔️ | ✔️ | | | |
|
[LockdownFavorites](/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | Configure whether employees can add, import, sort, or edit the Favorites list in Microsoft Edge. | ✔️ | | | |
|
||||||
| [PreventAccessToAboutFlagsInMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventaccesstoaboutflagsinmicrosoftedge) | Specify whether users can access the **about:flags** page, which is used to change developer settings and to enable experimental features. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [PreventAccessToAboutFlagsInMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventaccesstoaboutflagsinmicrosoftedge) | Specify whether users can access the **about:flags** page, which is used to change developer settings and to enable experimental features. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [PreventCertErrorOverrides](/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | Specify whether to override security warnings about sites that have SSL errors. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [PreventCertErrorOverrides](/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | Specify whether to override security warnings about sites that have SSL errors. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [PreventFirstRunPage](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventfirstrunpage) | Specify whether to enable or disable the First Run webpage. | ✔️ | | | | |
|
| [PreventFirstRunPage](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventfirstrunpage) | Specify whether to enable or disable the First Run webpage. | ✔️ | | | |
|
||||||
| [PreventLiveTileDataCollection](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventlivetiledatacollection) | Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [PreventLiveTileDataCollection](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventlivetiledatacollection) | Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files. | ✔️ | ✔️ | | ✔️ |
|
||||||
PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only. | ✔️ | | | | |
|
PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only. | ✔️ | | | |
|
||||||
| [PreventTurningOffRequiredExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-forceenabledextensions) | Enter a list of extensions in Microsoft Edge that users cannot turn off, using a semi-colon delimited list of extension package family names. | ✔️ | | | | |
|
| [PreventTurningOffRequiredExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-forceenabledextensions) | Enter a list of extensions in Microsoft Edge that users cannot turn off, using a semi-colon delimited list of extension package family names. | ✔️ | | | |
|
||||||
| [PreventUsingLocalHostIPAddressForWebRTC](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventusinglocalhostipaddressforwebrtc) | Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [PreventUsingLocalHostIPAddressForWebRTC](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventusinglocalhostipaddressforwebrtc) | Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. | ✔️ | ✔️ | | ✔️ |
|
||||||
[ProvisionFavorites](/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) | Configure a default set of favorites which will appear for employees. | ✔️ | ✔️ | | | |
|
[ProvisionFavorites](/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) | Configure a default set of favorites which will appear for employees. | ✔️ | | | |
|
||||||
| [SendIntranetTraffictoInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-sendintranettraffictointernetexplorer) | Specify whether to send intranet traffic to Internet Explorer. | ✔️ | | | | |
|
| [SendIntranetTraffictoInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-sendintranettraffictointernetexplorer) | Specify whether to send intranet traffic to Internet Explorer. | ✔️ | | | |
|
||||||
| [SetDefaultSearchEngine](/windows/client-management/mdm/policy-configuration-service-provider#browser-setdefaultsearchengine) | Configure the default search engine for your employees. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [SetDefaultSearchEngine](/windows/client-management/mdm/policy-configuration-service-provider#browser-setdefaultsearchengine) | Configure the default search engine for your employees. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) | Specify a custom URL for the Home button. You should also enable the [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) setting and select the **Show the home button; clicking the home button loads a specific URL** option. | ✔️ | | | | |
|
| [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) | Specify a custom URL for the Home button. You should also enable the [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) setting and select the **Show the home button; clicking the home button loads a specific URL** option. | ✔️ | | | |
|
||||||
| [SetNewTabPageURL](/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) | Specify a custom URL for a New tab page. | ✔️ | | | | |
|
| [SetNewTabPageURL](/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) | Specify a custom URL for a New tab page. | ✔️ | | | |
|
||||||
| [ShowMessageWhenOpeningSitesInInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-showmessagewhenopeningsitesininternetexplorer) | Specify whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site list. | ✔️ | | | | |
|
| [ShowMessageWhenOpeningSitesInInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-showmessagewhenopeningsitesininternetexplorer) | Specify whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site list. | ✔️ | | | |
|
||||||
| [SyncFavoritesBetweenIEAndMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-syncfavoritesbetweenieandmicrosoftedge) | Specify whether favorites are kept in sync between Internet Explorer and Microsoft Edge. | ✔️ | | | | |
|
| [SyncFavoritesBetweenIEAndMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-syncfavoritesbetweenieandmicrosoftedge) | Specify whether favorites are kept in sync between Internet Explorer and Microsoft Edge. | ✔️ | | | |
|
||||||
| [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) | Specify whether users can make changes to the Home button. | ✔️ | | | | |
|
| [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) | Specify whether users can make changes to the Home button. | ✔️ | | | |
|
||||||
[UseSharedFolderForBooks](/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) | Specify whether organizations should use a folder shared across users to store books from the Books Library. | ✔️ | ✔️ | | | |
|
[UseSharedFolderForBooks](/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) | Specify whether organizations should use a folder shared across users to store books from the Books Library. | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
## Camera
|
## Camera
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowCamera](/windows/client-management/mdm/policy-configuration-service-provider#camera-allowcamera) | Disable or enable the camera. | ✔️ | ✔️ | ✔️ | | |
|
| [AllowCamera](/windows/client-management/mdm/policy-configuration-service-provider#camera-allowcamera) | Disable or enable the camera. | ✔️ | ✔️ | | |
|
||||||
|
|
||||||
|
|
||||||
## Connectivity
|
## Connectivity
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowBluetooth](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowbluetooth) | Allow the user to enable Bluetooth or restrict access. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowBluetooth](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowbluetooth) | Allow the user to enable Bluetooth or restrict access. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [AllowCellularData](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardata) | Allow the cellular data channel on the device. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowCellularData](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardata) | Allow the cellular data channel on the device. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowCellularDataRoaming](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardataroaming) | Allow or disallow cellular data roaming on the device. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowCellularDataRoaming](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardataroaming) | Allow or disallow cellular data roaming on the device. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowConnectedDevices](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowconnecteddevices) | Allows IT admins the ability to disable the Connected Devices Platform component. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowConnectedDevices](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowconnecteddevices) | Allows IT admins the ability to disable the Connected Devices Platform component. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowNFC](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allownfc) | Allow or disallow near field communication (NFC) on the device. | | ✔️ | | | ✔️ |
|
| [AllowNFC](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allownfc) | Allow or disallow near field communication (NFC) on the device. | | | | ✔️ |
|
||||||
| [AllowUSBConnection](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowusbconnection) | Enable USB connection between the device and a computer to sync files with the device or to use developer tools or to deploy or debug applications. | | ✔️ | | | ✔️ |
|
| [AllowUSBConnection](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowusbconnection) | Enable USB connection between the device and a computer to sync files with the device or to use developer tools or to deploy or debug applications. | | | | ✔️ |
|
||||||
| [AllowVPNOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnovercellular) | Specify what type of underlyinng connections VPN is allowed to use. |✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowVPNOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnovercellular) | Specify what type of underlying connections VPN is allowed to use. |✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowVPNRoamingOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnroamingovercellular) | Prevent the device from connecting to VPN when the device roams over cellular networks. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowVPNRoamingOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnroamingovercellular) | Prevent the device from connecting to VPN when the device roams over cellular networks. | ✔️ | ✔️ | | ✔️ |
|
||||||
| HideCellularConnectionMode | Hide the checkbox that lets the user change the connection mode. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| HideCellularConnectionMode | Hide the checkbox that lets the user change the connection mode. | ✔️ | ✔️ | | ✔️ |
|
||||||
| HideCellularRoamingOption | Hide the dropdown menu that lets the user change the roaming preferences. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| HideCellularRoamingOption | Hide the dropdown menu that lets the user change the roaming preferences. | ✔️ | ✔️ | | ✔️ |
|
||||||
|
|
||||||
## CredentialProviders
|
## CredentialProviders
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
[DisableAutomaticReDeploymentCredentials](/windows/client-management/mdm/policy-csp-credentialproviders) | This setting disables the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device. The Windows 10 Autopilot Reset feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students. | ✔️ | | | | |
|
[DisableAutomaticReDeploymentCredentials](/windows/client-management/mdm/policy-csp-credentialproviders) | This setting disables the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device. The Windows 10 Autopilot Reset feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students. | ✔️ | | | |
|
||||||
|
|
||||||
## Cryptography
|
## Cryptography
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowFipsAlgorithmPolicy](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-allowfipsalgorithmpolicy) | Allow or disallow the Federal Information Processing Standard (FIPS) policy. | ✔️ | ✔️ | | | |
|
| [AllowFipsAlgorithmPolicy](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-allowfipsalgorithmpolicy) | Allow or disallow the Federal Information Processing Standard (FIPS) policy. | ✔️ | | | |
|
||||||
| [TLSCiperSuites](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-tlsciphersuites) | List the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. | ✔️ | ✔️ | | | |
|
| [TLSCiperSuites](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-tlsciphersuites) | List the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. | ✔️ | | | |
|
||||||
|
|
||||||
## Defender
|
## Defender
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowArchiveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowarchivescanning) | Allow or disallow scanning of archives. | ✔️ | | | | |
|
| [AllowArchiveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowarchivescanning) | Allow or disallow scanning of archives. | ✔️ | | | |
|
||||||
| [AllowBehaviorMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowbehaviormonitoring) | Allow or disallow Windows Defender Behavior Monitoring functionality. | ✔️ | | | | |
|
| [AllowBehaviorMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowbehaviormonitoring) | Allow or disallow Windows Defender Behavior Monitoring functionality. | ✔️ | | | |
|
||||||
| [AllowCloudProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowcloudprotection) | To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. | ✔️ | | | | |
|
| [AllowCloudProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowcloudprotection) | To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. | ✔️ | | | |
|
||||||
| [AllowEmailScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowemailscanning) | Allow or disallow scanning of email. | ✔️ | | | | |
|
| [AllowEmailScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowemailscanning) | Allow or disallow scanning of email. | ✔️ | | | |
|
||||||
| [AllowFullScanOnMappedNetworkDrives](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanonmappednetworkdrives) | Allow or disallow a full scan of mapped network drives. | ✔️ | | | | |
|
| [AllowFullScanOnMappedNetworkDrives](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanonmappednetworkdrives) | Allow or disallow a full scan of mapped network drives. | ✔️ | | | |
|
||||||
| [AllowFullScanRemovableDriveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanremovabledrivescanning) | Allow or disallow a full scan of removable drives. | ✔️ | | | | |
|
| [AllowFullScanRemovableDriveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanremovabledrivescanning) | Allow or disallow a full scan of removable drives. | ✔️ | | | |
|
||||||
| [AllowIOAVProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowioavprotection) | Allow or disallow Windows Defender IOAVP Protection functionality. | ✔️ | | | | |
|
| [AllowIntrusionPreventionSystem](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowintrusionpreventionsystem) | Allow or disallow Windows Defender Intrusion Prevention functionality. | ✔️ | | | |
|
||||||
| [AllowOnAccessProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowonaccessprotection) | Allow or disallow Windows Defender On Access Protection functionality. | ✔️ | | | | |
|
| [AllowIOAVProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowioavprotection) | Allow or disallow Windows Defender IOAVP Protection functionality. | ✔️ | | | |
|
||||||
| [AllowRealtimeMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowrealtimemonitoring) | Allow or disallow Windows Defender Realtime Monitoring functionality. | ✔️ | | | | |
|
| [AllowOnAccessProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowonaccessprotection) | Allow or disallow Windows Defender On Access Protection functionality. | ✔️ | | | |
|
||||||
| [AllowScanningNetworkFiles](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscanningnetworkfiles) | Allow or disallow scanning of network files. | ✔️ | | | | |
|
| [AllowRealtimeMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowrealtimemonitoring) | Allow or disallow Windows Defender Realtime Monitoring functionality. | ✔️ | | | |
|
||||||
| [AllowScriptScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscriptscanning) | Allow or disallow Windows Defender Script Scanning functionality. | ✔️ | | | | |
|
| [AllowScanningNetworkFiles](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscanningnetworkfiles) | Allow or disallow scanning of network files. | ✔️ | | | |
|
||||||
| [AllowUserUIAccess](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowuseruiaccess) | Allow or disallow user access to the Windows Defender UI. | ✔️ | | | | |
|
| [AllowScriptScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscriptscanning) | Allow or disallow Windows Defender Script Scanning functionality. | ✔️ | | | |
|
||||||
| [AvgCPULoadFactor](/windows/client-management/mdm/policy-configuration-service-provider#defender-avgcpuloadfactor) | Represents the average CPU load factor for the Windows Defeder scan (in percent). | ✔️ | | | | |
|
| [AllowUserUIAccess](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowuseruiaccess) | Allow or disallow user access to the Windows Defender UI. | ✔️ | | | |
|
||||||
| [DaysToRetainCleanedMalware](/windows/client-management/mdm/policy-configuration-service-provider#defender-daystoretaincleanedmalware) | Specify time period (in days) that quarantine items will be stored on the system. | ✔️ | | | | |
|
| [AvgCPULoadFactor](/windows/client-management/mdm/policy-configuration-service-provider#defender-avgcpuloadfactor) | Represents the average CPU load factor for the Windows Defender scan (in percent). | ✔️ | | | |
|
||||||
| [ExcludedExtensions](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedextensions) | Specify a list of file type extensions to ignore durinng a scan. Separate each file type in the list by using \|. | ✔️ | | | | |
|
| [DaysToRetainCleanedMalware](/windows/client-management/mdm/policy-configuration-service-provider#defender-daystoretaincleanedmalware) | Specify time period (in days) that quarantine items will be stored on the system. | ✔️ | | | |
|
||||||
| [ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) | Specify a list of directory paths to ignore during a scan. Separate each path in the list by using \|. | ✔️ | | | | |
|
| [ExcludedExtensions](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedextensions) | Specify a list of file type extensions to ignore during a scan. Separate each file type in the list by using \|. | ✔️ | | | |
|
||||||
| [ExcludedProcesses](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedprocesses) | Specify a list of files opened by processes to ignore durinng a scan. Separate each file type in the list by using \|. The process itself is not excluded from the scan, but can be excluded by using the [Defender/ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) policy to exclude its path. | ✔️ | | | | |
|
| [ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) | Specify a list of directory paths to ignore during a scan. Separate each path in the list by using \|. | ✔️ | | | |
|
||||||
| [RealTimeScanDirection](/windows/client-management/mdm/policy-configuration-service-provider#defender-realtimescandirection) | Control which sets of files should be monitored. | ✔️ | | | | |
|
| [ExcludedProcesses](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedprocesses) | Specify a list of files opened by processes to ignore during a scan. Separate each file type in the list by using \|. The process itself is not excluded from the scan, but can be excluded by using the [Defender/ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) policy to exclude its path. | ✔️ | | | |
|
||||||
| [ScanParameter](/windows/client-management/mdm/policy-configuration-service-provider#defender-scanparameter) | Select whether to perform a quick scan or full scan. | ✔️ | | | | |
|
| [RealTimeScanDirection](/windows/client-management/mdm/policy-configuration-service-provider#defender-realtimescandirection) | Control which sets of files should be monitored. | ✔️ | | | |
|
||||||
| [ScheduleQuickScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulequickscantime) | Specify the time of day that Windows Defender quick scan should run. | ✔️ | | | | |
|
| [ScanParameter](/windows/client-management/mdm/policy-configuration-service-provider#defender-scanparameter) | Select whether to perform a quick scan or full scan. | ✔️ | | | |
|
||||||
| [ScheduleScanDay](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescanday) | Select the day that Windows Defender scan should run. | ✔️ | | | | |
|
| [ScheduleQuickScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulequickscantime) | Specify the time of day that Windows Defender quick scan should run. | ✔️ | | | |
|
||||||
| [ScheduleScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescantime) | Select the time of day that the Windows Defender scan should run. | ✔️ | | | | |
|
| [ScheduleScanDay](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescanday) | Select the day that Windows Defender scan should run. | ✔️ | | | |
|
||||||
| [SignatureUpdateInterval](/windows/client-management/mdm/policy-configuration-service-provider#defender-signatureupdateinterval) | Specify the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. | ✔️ | | | | |
|
| [ScheduleScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescantime) | Select the time of day that the Windows Defender scan should run. | ✔️ | | | |
|
||||||
| [SubmitSamplesConsent](/windows/client-management/mdm/policy-configuration-service-provider#defender-submitsamplesconsent) | Checks for the user consent level in Windows Defender to send data. | ✔️ | | | | |
|
| [SignatureUpdateInterval](/windows/client-management/mdm/policy-configuration-service-provider#defender-signatureupdateinterval) | Specify the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. | ✔️ | | | |
|
||||||
| [ThreatSeverityDefaultAction](/windows/client-management/mdm/policy-configuration-service-provider#defender-threatseveritydefaultaction) | Specify any valid threat severity levels and the corresponding default action ID to take. | ✔️ | | | | |
|
| [SubmitSamplesConsent](/windows/client-management/mdm/policy-configuration-service-provider#defender-submitsamplesconsent) | Checks for the user consent level in Windows Defender to send data. | ✔️ | | | |
|
||||||
|
| [ThreatSeverityDefaultAction](/windows/client-management/mdm/policy-configuration-service-provider#defender-threatseveritydefaultaction) | Specify any valid threat severity levels and the corresponding default action ID to take. | ✔️ | | | |
|
||||||
|
|
||||||
## DeliveryOptimization
|
## DeliveryOptimization
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [DOAbsoluteMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doabsolutemaxcachesize) | Specify the maximum size in GB of Delivery Optimization cache. | ✔️ | | | | |
|
| [DOAbsoluteMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doabsolutemaxcachesize) | Specify the maximum size in GB of Delivery Optimization cache. | ✔️ | | | |
|
||||||
| [DOAllowVPNPeerCaching](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doallowvpnpeercaching) | Specify whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. | ✔️ | | | | |
|
| [DOAllowVPNPeerCaching](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doallowvpnpeercaching) | Specify whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. | ✔️ | | | |
|
||||||
| [DODelayBackgroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelaybackgrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. | ✔️ | | | | |
|
| [DODelayBackgroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelaybackgrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. | ✔️ | | | |
|
||||||
| [DODelayForegroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelayforegrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. | ✔️ | | | | |
|
| [DODelayForegroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelayforegrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. | ✔️ | | | |
|
||||||
| [DODownloadMode](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dodownloadmode) | Specify the download method that Delivery Optimization can use in downloads of Windows Updates, apps, and app updates. | ✔️ | | | | |
|
| [DODownloadMode](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dodownloadmode) | Specify the download method that Delivery Optimization can use in downloads of Windows Updates, apps, and app updates. | ✔️ | | | |
|
||||||
| [DOGroupId](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupid) | Specify an arbitrary group ID that the device belongs to. | ✔️ | | | | |
|
| [DOGroupId](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupid) | Specify an arbitrary group ID that the device belongs to. | ✔️ | | | |
|
||||||
| [DOGroupIdSource](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupidsource) | Set this policy to restrict peer selection to a specific source | ✔️ | | | | |
|
| [DOGroupIdSource](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupidsource) | Set this policy to restrict peer selection to a specific source | ✔️ | | | |
|
||||||
| [DOMaxCacheAge](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcacheage) | Specify the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. | ✔️ | | | | |
|
| [DOMaxCacheAge](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcacheage) | Specify the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. | ✔️ | | | |
|
||||||
| [DOMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcachesize) | Specify the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). | ✔️ | | | | |
|
| [DOMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcachesize) | Specify the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). | ✔️ | | | |
|
||||||
| [DOMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxdownloadbandwidth) | Specify the maximum download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. | ✔️ | | | | |
|
| [DOMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxdownloadbandwidth) | Specify the maximum download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. | ✔️ | | | |
|
||||||
| [DOMaxUploadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxuploadbandwidth) | Specify the maximum upload bandwidth in kilobytes/second that a device will use across all concurrent upload activity usinng Delivery Optimization. | ✔️ | | | | |
|
| [DOMaxUploadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxuploadbandwidth) | Specify the maximum upload bandwidth in kilobytes/second that a device will use across all concurrent upload activity using Delivery Optimization. | ✔️ | | | |
|
||||||
| [DOMinBackgroundQos](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbackgroundqos) | Specify the minimum download QoS (Quality of Service or speed) i kilobytes/second for background downloads. | ✔️ | | | | |
|
| [DOMinBackgroundQos](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbackgroundqos) | Specify the minimum download QoS (Quality of Service or speed) i kilobytes/second for background downloads. | ✔️ | | | |
|
||||||
| [DOMinBatteryPercentageAllowedToUpload](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbatterypercentageallowedtoupload) | Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and group peers while on battery power. | ✔️ | | | | |
|
| [DOMinBatteryPercentageAllowedToUpload](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbatterypercentageallowedtoupload) | Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and group peers while on battery power. | ✔️ | | | |
|
||||||
| [DOMinDiskSizeAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domindisksizeallowedtopeer) | Specify the required minimum disk size (capabity in GB) for the device to use Peer Caching. | ✔️ | | | | |
|
| [DOMinDiskSizeAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domindisksizeallowedtopeer) | Specify the required minimum disk size (capacity in GB) for the device to use Peer Caching. | ✔️ | | | |
|
||||||
| [DOMinFileSizeToCache](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominfilesizetocache) | Specify the minimum content file size in MB enabled to use Peer Caching. | ✔️ | | | | |
|
| [DOMinFileSizeToCache](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominfilesizetocache) | Specify the minimum content file size in MB enabled to use Peer Caching. | ✔️ | | | |
|
||||||
| [DOMinRAMAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominramallowedtopeer) | Specify the minimum RAM size in GB requried to use Peer Caching. | ✔️ | | | | |
|
| [DOMinRAMAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominramallowedtopeer) | Specify the minimum RAM size in GB required to use Peer Caching. | ✔️ | | | |
|
||||||
| [DOModifyCacheDrive](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domodifycachedrive) | Specify the drive that Delivery Optimization should use for its cache. | ✔️ | | | | |
|
| [DOModifyCacheDrive](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domodifycachedrive) | Specify the drive that Delivery Optimization should use for its cache. | ✔️ | | | |
|
||||||
| [DOMonthlyUploadDataCap](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domonthlyuploaddatacap) | Specify the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. | ✔️ | | | | |
|
| [DOMonthlyUploadDataCap](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domonthlyuploaddatacap) | Specify the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. | ✔️ | | | |
|
||||||
| [DOPercentageMaxBackDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxbackgroundbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
| [DOPercentageMaxBackDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxbackgroundbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
|
||||||
| [DOPercentageMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxdownloadbandwidth) | Specify the maximum download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
| [DOPercentageMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxdownloadbandwidth) | Specify the maximum download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
|
||||||
| [DOPercentageMaxForeDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxforegroundbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
| [DOPercentageMaxForeDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxforegroundbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
|
||||||
| [DORestrictPeerSelectionBy](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dorestrictpeerselectionby) | Set this policy to restrict peer selection by the selected option. | ✔️ | | | | |
|
| [DORestrictPeerSelectionBy](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dorestrictpeerselectionby) | Set this policy to restrict peer selection by the selected option. | ✔️ | | | |
|
||||||
| [DOSetHoursToLimitBackgroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
| [DOSetHoursToLimitBackgroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
|
||||||
| [DOSetHoursToLimitForegroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
| [DOSetHoursToLimitForegroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
|
||||||
|
|
||||||
## DeviceGuard
|
## DeviceGuard
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
[EnableVirtualizationBasedSecurity](/windows/client-management/mdm/policy-csp-deviceguard) | Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. | ✔️ | | | | |
|
[EnableVirtualizationBasedSecurity](/windows/client-management/mdm/policy-csp-deviceguard) | Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. | ✔️ | | | |
|
||||||
|
|
||||||
## DeviceLock
|
## DeviceLock
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowIdleReturnWithoutPassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowidlereturnwithoutpassword) | Specify whether the user must input a PIN or password when the device resumes from an idle state. | | ✔️ | | | |
|
| [AllowIdleReturnWithoutPassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowidlereturnwithoutpassword) | Specify whether the user must input a PIN or password when the device resumes from an idle state. | | | | |
|
||||||
| [AllowScreenTimeoutWhileLockedUserConfig](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowscreentimeoutwhilelockeduserconfig) | Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen. | | ✔️ | | | |
|
| [AllowScreenTimeoutWhileLockedUserConfig](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowscreentimeoutwhilelockeduserconfig) | Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen. | | | | |
|
||||||
| [AllowSimpleDevicePassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowsimpledevicepassword) | Specify whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords. | ✔️ | ✔️ | | ✔️ | |
|
| [AllowSimpleDevicePassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowsimpledevicepassword) | Specify whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords. | ✔️ | | ✔️ | |
|
||||||
|[AlphanumericDevicePasswordRequired](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-alphanumericdevicepasswordrequired) | Select the type of PIN or password required. | ✔️ | ✔️ | | ✔️ | |
|
|[AlphanumericDevicePasswordRequired](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-alphanumericdevicepasswordrequired) | Select the type of PIN or password required. | ✔️ | | ✔️ | |
|
||||||
| [DevicePasswordEnabled](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordenabled) | Specify whether device password is enabled. | ✔️ | ✔️ | | ✔️ | |
|
| [DevicePasswordEnabled](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordenabled) | Specify whether device password is enabled. | ✔️ | | ✔️ | |
|
||||||
| [DevicePasswordExpiration](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordexpiration) | Specify when the password expires (in days). | ✔️ | ✔️ | | ✔️ | |
|
| [DevicePasswordExpiration](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordexpiration) | Specify when the password expires (in days). | ✔️ | | ✔️ | |
|
||||||
| [DevicePasswordHistory](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordhistory) | Specify how many passwords can be stored in the history that can't be reused. | ✔️ | ✔️ | | ✔️ | |
|
| [DevicePasswordHistory](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordhistory) | Specify how many passwords can be stored in the history that can't be reused. | ✔️ | | ✔️ | |
|
||||||
| [MaxDevicePasswordFailedAttempts](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxdevicepasswordfailedattempts) | Specify the number of authentication failures allowed before the device will be wiped. | ✔️ | ✔️ | | ✔️ | |
|
| [MaxDevicePasswordFailedAttempts](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxdevicepasswordfailedattempts) | Specify the number of authentication failures allowed before the device will be wiped. | ✔️ | | ✔️ | |
|
||||||
| [MaxInactivityTimeDeviceLock](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxinactivitytimedevicelock) |Specify the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. | ✔️ | ✔️ | | ✔️ | |
|
| [MaxInactivityTimeDeviceLock](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxinactivitytimedevicelock) |Specify the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. | ✔️ | | ✔️ | |
|
||||||
| [MinDevicePasswordComplexCharacters](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordcomplexcharacters) | Specify the number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. | ✔️ | ✔️ | | ✔️ | |
|
| [MinDevicePasswordComplexCharacters](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordcomplexcharacters) | Specify the number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. | ✔️ | | ✔️ | |
|
||||||
| [MinDevicePasswordLength](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordlength) | Specify the minimum number or characters required in the PIN or password. | ✔️ | ✔️ | | ✔️ | |
|
| [MinDevicePasswordLength](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordlength) | Specify the minimum number or characters required in the PIN or password. | ✔️ | | ✔️ | |
|
||||||
| [ScreenTimeoutWhileLocked](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-screentimeoutwhilelocked) | Specify the duration in seconds for the screen timeout while on the lock screen. | | ✔️ | | | |
|
| [ScreenTimeoutWhileLocked](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-screentimeoutwhilelocked) | Specify the duration in seconds for the screen timeout while on the lock screen. | | | | |
|
||||||
|
|
||||||
|
|
||||||
## DeviceManagement
|
## DeviceManagement
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| DisableMDMEnrollment | Use this setting to prevent the device from enrolling in MDM. | ✔️ | | | | |
|
| DisableMDMEnrollment | Use this setting to prevent the device from enrolling in MDM. | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Experience
|
## Experience
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowCopyPaste](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcopypaste) | Specify whether copy and paste is allowed. | | ✔️ | | | |
|
| [AllowCopyPaste](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcopypaste) | Specify whether copy and paste is allowed. | | | | |
|
||||||
| [AllowCortana](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcortana) | Specify whether Cortana is allowed on the device. | ✔️ | ✔️ | | ✔️ | |
|
| [AllowCortana](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcortana) | Specify whether Cortana is allowed on the device. | ✔️ | | ✔️ | |
|
||||||
| [AllowDeviceDiscovery](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowdevicediscovery) | Allow users to turn device discovery on or off in the UI. | ✔️ | ✔️ | | | |
|
| [AllowDeviceDiscovery](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowdevicediscovery) | Allow users to turn device discovery on or off in the UI. | ✔️ | | | |
|
||||||
| [AllowFindMyDevice](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowfindmydevice) | Turn on **Find my device** feature. | ✔️ | ✔️ | | | |
|
| [AllowFindMyDevice](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowfindmydevice) | Turn on **Find my device** feature. | ✔️ | | | |
|
||||||
| [AllowManualMDMUnenrollment](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowmanualmdmunenrollment) | Specify whether the user is allowed to delete the workplace account. | ✔️ | ✔️ | | ✔️ | |
|
| [AllowManualMDMUnenrollment](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowmanualmdmunenrollment) | Specify whether the user is allowed to delete the workplace account. | ✔️ | | ✔️ | |
|
||||||
| [AllowScreenCapture](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowscreencapture) | Specify whether screen capture is allowed. | | ✔️ | | | |
|
| [AllowScreenCapture](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowscreencapture) | Specify whether screen capture is allowed. | | | | |
|
||||||
| [AllowSIMErrorDialogPromptWhenNoSIM](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsimerrordialogpromptwhennosim) | Specify whether to display a dialog prompt when no SIM card is detected. | | ✔️ | | | |
|
| [AllowSIMErrorDialogPromptWhenNoSIM](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsimerrordialogpromptwhennosim) | Specify whether to display a dialog prompt when no SIM card is detected. | | | | |
|
||||||
| [AllowSyncMySettings](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsyncmysettings) | Allow or disallow all Windows sync settings on the device. | ✔️ | ✔️ | | | |
|
| [AllowSyncMySettings](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsyncmysettings) | Allow or disallow all Windows sync settings on the device. | ✔️ | | | |
|
||||||
| [AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtailoredexperienceswithdiagnosticdata) | Prevent Windows from using diagnostic data to provide customized experiences to the user. | ✔️ | | | | |
|
| [AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtailoredexperienceswithdiagnosticdata) | Prevent Windows from using diagnostic data to provide customized experiences to the user. | ✔️ | | | |
|
||||||
| [AllowTaskSwitcher](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtaskswitcher) | Allow or disallow task switching on the device. | | ✔️ | | | |
|
| [AllowTaskSwitcher](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtaskswitcher) | Allow or disallow task switching on the device. | | | | |
|
||||||
| [AllowThirdPartySuggestionsInWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowthirdpartysuggestionsinwindowsspotlight) | Specify whether to allow app and content suggestions from third-party software publishers in Windows Spotlight. | ✔️ | | | | |
|
| [AllowThirdPartySuggestionsInWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowthirdpartysuggestionsinwindowsspotlight) | Specify whether to allow app and content suggestions from third-party software publishers in Windows Spotlight. | ✔️ | | | |
|
||||||
| [AllowVoiceRecording](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowvoicerecording) | Specify whether voice recording is allowed for apps. | | ✔️ | | | |
|
| [AllowVoiceRecording](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowvoicerecording) | Specify whether voice recording is allowed for apps. | | | | |
|
||||||
| [AllowWindowsConsumerFeatures](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures) | Turn on experiences that are typically for consumers only, such as Start suggetions, membership notifications, post-OOBE app install, and redirect tiles. | ✔️ | | | | |
|
| [AllowWindowsConsumerFeatures](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures) | Turn on experiences that are typically for consumers only, such as Start suggestions, membership notifications, post-OOBE app install, and redirect tiles. | ✔️ | | | |
|
||||||
| [AllowWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlight) |Specify whether to turn off all Windows Spotlight features at once. | ✔️ | | | | |
|
| [AllowWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlight) |Specify whether to turn off all Windows Spotlight features at once. | ✔️ | | | |
|
||||||
| [AllowWindowsSpotlightOnActionCenter](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightonactioncenter) | Prevent Windows Spotlight notifications from being displayed in the Action Center. | ✔️ | | | | |
|
| [AllowWindowsSpotlightOnActionCenter](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightonactioncenter) | Prevent Windows Spotlight notifications from being displayed in the Action Center. | ✔️ | | | |
|
||||||
| [AllowWindowsSpotlightWindowsWelcomeExperience](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightwindowswelcomeexperience) | Turn off the Windows Spotlight Windows welcome experience feature. | ✔️ | | | | |
|
| [AllowWindowsSpotlightWindowsWelcomeExperience](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightwindowswelcomeexperience) | Turn off the Windows Spotlight Windows welcome experience feature. | ✔️ | | | |
|
||||||
| [AllowWindowsTips](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowstips) | Enable or disable Windows Tips. | ✔️ | | | | |
|
| [AllowWindowsTips](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowstips) | Enable or disable Windows Tips. | ✔️ | | | |
|
||||||
| [ConfigureWindowsSpotlightOnLockScreen](/windows/client-management/mdm/policy-configuration-service-provider#experience-configurewindowsspotlightonlockscreen) | Specify whether Spotlight should be used on the user's lock screen. | ✔️ | | | | |
|
| [ConfigureWindowsSpotlightOnLockScreen](/windows/client-management/mdm/policy-configuration-service-provider#experience-configurewindowsspotlightonlockscreen) | Specify whether Spotlight should be used on the user's lock screen. | ✔️ | | | |
|
||||||
|
|
||||||
## ExploitGuard
|
## ExploitGuard
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) | See the [explanation of ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) in the Policy CSP for instructions. In the **ExploitProtectionSettings** field, you can enter a path (local, UNC, or URI) to the mitigation options config, or you can enter the XML for the config. | ✔️ | ✔️ | | | |
|
| [ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) | See the [explanation of ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) in the Policy CSP for instructions. In the **ExploitProtectionSettings** field, you can enter a path (local, UNC, or URI) to the mitigation options config, or you can enter the XML for the config. | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
## Games
|
## Games
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowAdvancedGamingServices](/windows/client-management/mdm/policy-configuration-service-provider#games-allowadvancedgamingservices) | Currently not supported. | ✔️ | | | | |
|
| [AllowAdvancedGamingServices](/windows/client-management/mdm/policy-configuration-service-provider#games-allowadvancedgamingservices) | Currently not supported. | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
## KioskBrowser
|
## KioskBrowser
|
||||||
|
|
||||||
These settings apply to the **Kiosk Browser** app available in Microsoft Store. For more information, see [Guidelines for web browsers](../guidelines-for-assigned-access-app.md#guidelines-for-web-browsers).
|
These settings apply to the **Kiosk Browser** app available in Microsoft Store. For more information, see [Guidelines for web browsers](../guidelines-for-assigned-access-app.md#guidelines-for-web-browsers).
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
[BlockedUrlExceptions](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurlexceptions) | List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. | ✔️ | | | | |
|
|[BlockedUrlExceptions](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurlexceptions) | List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. | ✔️ | | | |
|
||||||
[BlockedUrls](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurls) | List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. | ✔️ | | | | |
|
|[BlockedUrls](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurls) | List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. | ✔️ | | | |
|
||||||
[DefaultURL](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-defaulturl) | Configures the default URL kiosk browsers to navigate on launch and restart. | ✔️ | | | | |
|
|[DefaultURL](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-defaulturl) | Configures the default URL kiosk browsers to navigate on launch and restart. | ✔️ | | | |
|
||||||
[EnableEndSessionButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enableendsessionbutton) | Enable/disable kiosk browser's end session button. | ✔️ | | | | |
|
|[EnableEndSessionButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enableendsessionbutton) | Enable/disable kiosk browser's end session button. | ✔️ | | | |
|
||||||
[EnableHomeButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablehomebutton) | Enable/disable kiosk browser's home button. | ✔️ | | | | |
|
|[EnableHomeButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablehomebutton) | Enable/disable kiosk browser's home button. | ✔️ | | | |
|
||||||
[EnableNavigationButtons](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablenavigationbuttons) | Enable/disable kiosk browser's navigation buttons (forward/back). | ✔️ | | | | |
|
|[EnableNavigationButtons](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablenavigationbuttons) | Enable/disable kiosk browser's navigation buttons (forward/back). | ✔️ | | | |
|
||||||
[RestartOnIdleTime](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-restartonidletime) | Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. | ✔️ | | | | |
|
|[RestartOnIdleTime](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-restartonidletime) | Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. | ✔️ | | | |
|
||||||
|
|
||||||
To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer:
|
To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer:
|
||||||
|
|
||||||
@ -339,252 +340,253 @@ To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in
|
|||||||
|
|
||||||
## LocalPoliciesSecurityOptions
|
## LocalPoliciesSecurityOptions
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [InteractiveLogon_DoNotDisplayLastSignedIn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) | Specify whether the Windows sign-in screen will show the username of the last person who signed in. | ✔️ | | | | |
|
| [InteractiveLogon_DoNotDisplayLastSignedIn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) | Specify whether the Windows sign-in screen will show the username of the last person who signed in. | ✔️ | | | |
|
||||||
| [Shutdown_AllowSystemtobeShutDownWithoutHavingToLogOn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) | Specify whether a computer can be shut down without signing in. | ✔️ | | | | |
|
| [Shutdown_AllowSystemtobeShutDownWithoutHavingToLogOn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) | Specify whether a computer can be shut down without signing in. | ✔️ | | | |
|
||||||
| [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) | Configure how an elevation prompt should behave for standard users. | ✔️ | | | | |
|
| [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) | Configure how an elevation prompt should behave for standard users. | ✔️ | | | |
|
||||||
|
|
||||||
## Location
|
## Location
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [EnableLocation](/windows/client-management/mdm/policy-configuration-service-provider#location-enablelocation) | Do not use. | | | | | |
|
| [EnableLocation](/windows/client-management/mdm/policy-configuration-service-provider#location-enablelocation) | Do not use. | | | | |
|
||||||
|
|
||||||
## Power
|
## Power
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowStandbyStatesWhenSleepingOnBattery](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingonbattery) | Specify whether Windows can use standby states when putting the computer in a sleep state while on battery. | ✔️ | | | | |
|
| [AllowStandbyStatesWhenSleepingOnBattery](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingonbattery) | Specify whether Windows can use standby states when putting the computer in a sleep state while on battery. | ✔️ | | | |
|
||||||
| [AllowStandbyWhenSleepingPluggedIn](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingpluggedin) | Specify whether Windows can use standby states when putting the computer in a sleep state while plugged in. | ✔️ | | | | |
|
| [AllowStandbyWhenSleepingPluggedIn](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingpluggedin) | Specify whether Windows can use standby states when putting the computer in a sleep state while plugged in. | ✔️ | | | |
|
||||||
| [DisplayOffTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#displayofftimeoutonbattery) | Specify the period of inactivity before Windows turns off the display while on battery. | ✔️ | | | | |
|
| [DisplayOffTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#displayofftimeoutonbattery) | Specify the period of inactivity before Windows turns off the display while on battery. | ✔️ | | | |
|
||||||
| [DisplayOffTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#displayofftimeoutpluggedin) | Specify the period of inactivity before Windows turns off the display while plugged in. | ✔️ | | | | |
|
| [DisplayOffTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#displayofftimeoutpluggedin) | Specify the period of inactivity before Windows turns off the display while plugged in. | ✔️ | | | |
|
||||||
| [EnergySaverBatteryThresholdOnBattery](/windows/client-management/mdm/policy-csp-power#energysaverbatterythresholdonbattery) | Specify the battery charge level at which Energy Saver is turned on while on battery. | ✔️ | | | | |
|
| [EnergySaverBatteryThresholdOnBattery](/windows/client-management/mdm/policy-csp-power#energysaverbatterythresholdonbattery) | Specify the battery charge level at which Energy Saver is turned on while on battery. | ✔️ | | | |
|
||||||
| [EnergySaverBatteryThresholdPluggedIn](/windows/client-management/mdm/policy-csp-power#EnergySaverBatteryThresholdPluggedIn) | Specify the battery charge level at which Energy Saver is turned on while plugged in. | ✔️ | | | | |
|
| [EnergySaverBatteryThresholdPluggedIn](/windows/client-management/mdm/policy-csp-power#EnergySaverBatteryThresholdPluggedIn) | Specify the battery charge level at which Energy Saver is turned on while plugged in. | ✔️ | | | |
|
||||||
| [HibernateTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to hibernate while on battery. | ✔️ | | | | |
|
| [HibernateTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to hibernate while on battery. | ✔️ | | | |
|
||||||
| [HibernateTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to hibernate while plugged in. | ✔️ | | | | |
|
| [HibernateTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to hibernate while plugged in. | ✔️ | | | |
|
||||||
| [RequirePasswordWhenComputerWakesOnBattery](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakesonbattery) | Specify whether the user is prompted for a password when the system resumes from sleep while on battery. | ✔️ | | | | |
|
| [RequirePasswordWhenComputerWakesOnBattery](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakesonbattery) | Specify whether the user is prompted for a password when the system resumes from sleep while on battery. | ✔️ | | | |
|
||||||
| [RequirePasswordWhenComputerWakesPluggedIn](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakespluggedin) | Specify whether the user is prompted for a password when the system resumes from sleep while plugged in. | ✔️ | | | | |
|
| [RequirePasswordWhenComputerWakesPluggedIn](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakespluggedin) | Specify whether the user is prompted for a password when the system resumes from sleep while plugged in. | ✔️ | | | |
|
||||||
| [SelectLidCloseActionBattery](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on battery. | ✔️ | | | | |
|
| [SelectLidCloseActionBattery](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on battery. | ✔️ | | | |
|
||||||
| [SelectLidCloseActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on plugged in. | ✔️ | | | | |
|
| [SelectLidCloseActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on plugged in. | ✔️ | | | |
|
||||||
| [SelectPowerButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactiononbattery) | Select the action to be taken when the user presses the power button while on battery. | ✔️ | | | | |
|
| [SelectPowerButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactiononbattery) | Select the action to be taken when the user presses the power button while on battery. | ✔️ | | | |
|
||||||
| [SelectPowerButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactionpluggedin) | Select the action to be taken when the user presses the power button while on plugged in. | ✔️ | | | | |
|
| [SelectPowerButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactionpluggedin) | Select the action to be taken when the user presses the power button while on plugged in. | ✔️ | | | |
|
||||||
| [SelectSleepButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactiononbattery) | Select the action to be taken when the user presses the sleep button while on battery. | ✔️ | | | | |
|
| [SelectSleepButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactiononbattery) | Select the action to be taken when the user presses the sleep button while on battery. | ✔️ | | | |
|
||||||
| [SelectSleepButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactionpluggedin) | Select the action to be taken when the user presses the sleep button while plugged in. | ✔️ | | | | |
|
| [SelectSleepButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactionpluggedin) | Select the action to be taken when the user presses the sleep button while plugged in. | ✔️ | | | |
|
||||||
| [StandbyTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#StandbyTimeoutOnBattery) | Specify the period of inactivity before Windows transitions the system to sleep while on battery. | ✔️ | | | | |
|
| [StandbyTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#StandbyTimeoutOnBattery) | Specify the period of inactivity before Windows transitions the system to sleep while on battery. | ✔️ | | | |
|
||||||
| [StandbyTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#standbytimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep while plugged in. | ✔️ | | | | |
|
| [StandbyTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#standbytimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep while plugged in. | ✔️ | | | |
|
||||||
| [TurnOffHybridSleepOnBattery](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeponbattery) | Turn off hybrid sleep while on battery. | ✔️ | | | | |
|
| [TurnOffHybridSleepOnBattery](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeponbattery) | Turn off hybrid sleep while on battery. | ✔️ | | | |
|
||||||
| [TurnOffHybridSleepPluggedIn](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeppluggedin) | Turn off hybrid sleep while plugged in. | ✔️ | | | | |
|
| [TurnOffHybridSleepPluggedIn](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeppluggedin) | Turn off hybrid sleep while plugged in. | ✔️ | | | |
|
||||||
| [UnattendedSleepTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while on battery. | ✔️ | | | | |
|
| [UnattendedSleepTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while on battery. | ✔️ | | | |
|
||||||
| [UnattendedSleepTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while plugged in. | ✔️ | | | | |
|
| [UnattendedSleepTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while plugged in. | ✔️ | | | |
|
||||||
|
|
||||||
## Privacy
|
## Privacy
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowAutoAcceptPairingAndPrivacyConsentPrompts](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowautoacceptpairingandprivacyconsentprompts) | Allow or disallow the automatic acceptance of the pairing and privacy user consent dialog boxes when launching apps. | | ✔️ | | | |
|
| [AllowAutoAcceptPairingAndPrivacyConsentPrompts](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowautoacceptpairingandprivacyconsentprompts) | Allow or disallow the automatic acceptance of the pairing and privacy user consent dialog boxes when launching apps. | | | | |
|
||||||
| [AllowInputPersonalization](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowinputpersonalization) | Allow the use of cloud-based speech services for Cortana, dictation, or Store apps. | ✔️ | ✔️ | | ✔️ | |
|
| [AllowInputPersonalization](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowinputpersonalization) | Allow the use of cloud-based speech services for Cortana, dictation, or Store apps. | ✔️ | | ✔️ | |
|
||||||
|
|
||||||
|
|
||||||
## Search
|
## Search
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
[AllowCloudSearch](/windows/client-management/mdm/policy-csp-search#search-allowcloudsearch) | Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T | ✔️ | ✔️ | | | |
|
[AllowCloudSearch](/windows/client-management/mdm/policy-csp-search#search-allowcloudsearch) | Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T | ✔️ | | | |
|
||||||
[AllowCortanaInAAD](/windows/client-management/mdm/policy-csp-search#search-allowcortanainaad) | This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. | ✔️ | | | | |
|
[AllowCortanaInAAD](/windows/client-management/mdm/policy-csp-search#search-allowcortanainaad) | This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. | ✔️ | | | |
|
||||||
| [AllowIndexingEncryptedStoresOrItems](/windows/client-management/mdm/policy-configuration-service-provider#search-allowindexingencryptedstoresoritems) | Allow or disallow the indexing of items. | ✔️ | ✔️ | | | |
|
| [AllowIndexingEncryptedStoresOrItems](/windows/client-management/mdm/policy-configuration-service-provider#search-allowindexingencryptedstoresoritems) | Allow or disallow the indexing of items. | ✔️ | | | |
|
||||||
| [AllowSearchToUseLocation](/windows/client-management/mdm/policy-configuration-service-provider#search-allowsearchtouselocation) | Specify whether search can use location information. | ✔️ | ✔️ | | ✔️ | |
|
| [AllowSearchToUseLocation](/windows/client-management/mdm/policy-configuration-service-provider#search-allowsearchtouselocation) | Specify whether search can use location information. | ✔️ | | ✔️ | |
|
||||||
| [AllowUsingDiacritics](/windows/client-management/mdm/policy-configuration-service-provider#search-allowusingdiacritics) | Allow the use of diacritics. | ✔️ | ✔️ | | | |
|
| [AllowUsingDiacritics](/windows/client-management/mdm/policy-configuration-service-provider#search-allowusingdiacritics) | Allow the use of diacritics. | ✔️ | | | |
|
||||||
| [AllowWindowsIndexer](/windows/client-management/mdm/policy-csp-search#search-allowwindowsindexer) | The indexer provides fast file, email, and web history search for apps and system components including Cortana, Outlook, file explorer, and Edge. To do this, it requires access to the file system and app data stores such as Outlook OST files.</br></br>- **Off** setting disables Windows indexer</br>- **EnterpriseSecure** setting stops the indexer from indexing encrypted files or stores, and is recommended for enterprises using Windows Information Protection (WIP)</br>- **Enterprise** setting reduces potential network loads for enterprises</br>- **Standard** setting is appropriate for consuemrs | ✔️ | ✔️ | | | |
|
| [AllowWindowsIndexer](/windows/client-management/mdm/policy-csp-search#search-allowwindowsindexer) | The indexer provides fast file, email, and web history search for apps and system components including Cortana, Outlook, file explorer, and Edge. To do this, it requires access to the file system and app data stores such as Outlook OST files.</br></br>- **Off** setting disables Windows indexer</br>- **EnterpriseSecure** setting stops the indexer from indexing encrypted files or stores, and is recommended for enterprises using Windows Information Protection (WIP)</br>- **Enterprise** setting reduces potential network loads for enterprises</br>- **Standard** setting is appropriate for consumers | ✔️ | | | |
|
||||||
| [AlwaysUseAutoLangDetection](/windows/client-management/mdm/policy-configuration-service-provider#search-alwaysuseautolangdetection) | Specify whether to always use automatic language detection when indexing content and properties. | ✔️ | ✔️ | | | |
|
| [AlwaysUseAutoLangDetection](/windows/client-management/mdm/policy-configuration-service-provider#search-alwaysuseautolangdetection) | Specify whether to always use automatic language detection when indexing content and properties. | ✔️ | | | |
|
||||||
| [DoNotUseWebResults](/windows/client-management/mdm/policy-configuration-service-provider#search-donotusewebresults) | Specify whether to allow Search to perform queries on the web. | ✔️ | ✔️ | | | |
|
| [DoNotUseWebResults](/windows/client-management/mdm/policy-configuration-service-provider#search-donotusewebresults) | Specify whether to allow Search to perform queries on the web. | ✔️ | | | |
|
||||||
| [DisableBackoff](/windows/client-management/mdm/policy-configuration-service-provider#search-disablebackoff) | If enabled, the search indexer backoff feature will be disabled. | ✔️ | ✔️ | | | |
|
| [DisableBackoff](/windows/client-management/mdm/policy-configuration-service-provider#search-disablebackoff) | If enabled, the search indexer backoff feature will be disabled. | ✔️ | | | |
|
||||||
| [DisableRemovableDriveIndexing](/windows/client-management/mdm/policy-configuration-service-provider#search-disableremovabledriveindexing) | Configure whether locations on removable drives can be added to libraries. | ✔️ | ✔️ | | | |
|
| [DisableRemovableDriveIndexing](/windows/client-management/mdm/policy-configuration-service-provider#search-disableremovabledriveindexing) | Configure whether locations on removable drives can be added to libraries. | ✔️ | | | |
|
||||||
| [PreventIndexingLowDiskSpaceMB](/windows/client-management/mdm/policy-configuration-service-provider#search-preventindexinglowdiskspacemb) | Prevent indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. | ✔️ | ✔️ | | | |
|
| [PreventIndexingLowDiskSpaceMB](/windows/client-management/mdm/policy-configuration-service-provider#search-preventindexinglowdiskspacemb) | Prevent indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. | ✔️ | | | |
|
||||||
| [PreventRemoteQueries](/windows/client-management/mdm/policy-configuration-service-provider#search-preventremotequeries) | If enabled, clients will be unable to query this device's index remotely. | ✔️ | ✔️ | | | |
|
| [PreventRemoteQueries](/windows/client-management/mdm/policy-configuration-service-provider#search-preventremotequeries) | If enabled, clients will be unable to query this device's index remotely. | ✔️ | | | |
|
||||||
| [SafeSearchPermissions](/windows/client-management/mdm/policy-configuration-service-provider#search-safesearchpermissions) | Specify the level of safe search (filtering adult content) required. | | ✔️ | | | |
|
| [SafeSearchPermissions](/windows/client-management/mdm/policy-configuration-service-provider#search-safesearchpermissions) | Specify the level of safe search (filtering adult content) required. | | | | |
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Security
|
## Security
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowAddProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowaddprovisioningpackage) | Specify whether to allow installation of provisioning packages. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowAddProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowaddprovisioningpackage) | Specify whether to allow installation of provisioning packages. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowManualRootCertificateInstallation](/windows/client-management/mdm/policy-configuration-service-provider#security-allowmanualrootcertificateinstallation) | Specify whether the user is allowed to manually install root and intermediate CA certificates. | | ✔️ | | | |
|
| [AllowManualRootCertificateInstallation](/windows/client-management/mdm/policy-configuration-service-provider#security-allowmanualrootcertificateinstallation) | Specify whether the user is allowed to manually install root and intermediate CA certificates. | | | | |
|
||||||
| [AllowRemoveProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowremoveprovisioningpackage) | Specify whether removal of provisioning packages is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowRemoveProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowremoveprovisioningpackage) | Specify whether removal of provisioning packages is allowed. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AntiTheftMode](/windows/client-management/mdm/policy-configuration-service-provider#security-antitheftmode) | Allow or disallow Anti Theft Mode on the device. | | ✔️ | | | |
|
| [AntiTheftMode](/windows/client-management/mdm/policy-configuration-service-provider#security-antitheftmode) | Allow or disallow Anti Theft Mode on the device. | | | | |
|
||||||
| [RequireDeviceEncryption](/windows/client-management/mdm/policy-configuration-service-provider#security-requiredeviceencryption) | Specify whether encryption is required. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [RequireDeviceEncryption](/windows/client-management/mdm/policy-configuration-service-provider#security-requiredeviceencryption) | Specify whether encryption is required. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [RequireProvisioningPackageSignature](/windows/client-management/mdm/policy-configuration-service-provider#security-requireprovisioningpackagesignature) | Specify whether provisioning packages must have a certificate signed by a device-trusted authority. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [RequireProvisioningPackageSignature](/windows/client-management/mdm/policy-configuration-service-provider#security-requireprovisioningpackagesignature) | Specify whether provisioning packages must have a certificate signed by a device-trusted authority. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [RequireRetrieveHealthCertificateOnBoot](/windows/client-management/mdm/policy-configuration-service-provider#security-requireretrievehealthcertificateonboot) | Specify whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service when a device boots or reboots. | ✔️ | ✔️ | | | |
|
| [RequireRetrieveHealthCertificateOnBoot](/windows/client-management/mdm/policy-configuration-service-provider#security-requireretrievehealthcertificateonboot) | Specify whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service when a device boots or reboots. | ✔️ | | | |
|
||||||
|
|
||||||
## Settings
|
## Settings
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowAutoPlay](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowautoplay) | Allow the user to change AutoPlay settings. | | ✔️ | | | |
|
| [AllowAutoPlay](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowautoplay) | Allow the user to change AutoPlay settings. | | | | |
|
||||||
| [AllowDataSense](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowdatasense) | Allow the user to change Data Sense settings. | | ✔️ | | | |
|
| [AllowDataSense](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowdatasense) | Allow the user to change Data Sense settings. | | | | |
|
||||||
| [AllowVPN](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowvpn) | Allow the user to change VPN settings. | | ✔️ | | ✔️ | |
|
| [AllowVPN](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowvpn) | Allow the user to change VPN settings. | | | ✔️ | |
|
||||||
| [ConfigureTaskbarCalendar](/windows/client-management/mdm/policy-configuration-service-provider#settings-configuretaskbarcalendar) | Configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. | ✔️ | | | | |
|
| [ConfigureTaskbarCalendar](/windows/client-management/mdm/policy-configuration-service-provider#settings-configuretaskbarcalendar) | Configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. | ✔️ | | | |
|
||||||
[PageVisiblityList](/windows/client-management/mdm/policy-csp-settings#settings-pagevisibilitylist) | Allows IT admins to prevent specific pages in the System Settings app from being visible or accessible. Pages are identified by a shortened version of their already [published URIs](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference), which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons. | ✔️ | | | | |
|
[PageVisiblityList](/windows/client-management/mdm/policy-csp-settings#settings-pagevisibilitylist) | Allows IT admins to prevent specific pages in the System Settings app from being visible or accessible. Pages are identified by a shortened version of their already [published URIs](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference), which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons. | ✔️ | | | |
|
||||||
|
|
||||||
## Start
|
## Start
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | Control the visibility of the Documents shortcut on the Start menu. | ✔️ | | | | |
|
| [AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | Control the visibility of the Documents shortcut on the Start menu. | ✔️ | | | |
|
||||||
| [AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | Control the visibility of the Downloadds shortcut on the Start menu. | ✔️ | | | | |
|
| [AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | Control the visibility of the Downloads shortcut on the Start menu. | ✔️ | | | |
|
||||||
| [AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | Control the visibility of the File Explorer shortcut on the Start menu. | ✔️ | | | | |
|
| [AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | Control the visibility of the File Explorer shortcut on the Start menu. | ✔️ | | | |
|
||||||
| [AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | Control the visibility of the Home Group shortcut on the Start menu. | ✔️ | | | | |
|
| [AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | Control the visibility of the Home Group shortcut on the Start menu. | ✔️ | | | |
|
||||||
| [AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | Control the visibility of the Music shortcut on the Start menu. | ✔️ | | | | |
|
| [AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | Control the visibility of the Music shortcut on the Start menu. | ✔️ | | | |
|
||||||
| [AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | Control the visibility of the Network shortcut on the Start menu. | ✔️ | | | | |
|
| [AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | Control the visibility of the Network shortcut on the Start menu. | ✔️ | | | |
|
||||||
| [AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | Control the visibility of the Personal Folder shortcut on the Start menu. | ✔️ | | | | |
|
| [AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | Control the visibility of the Personal Folder shortcut on the Start menu. | ✔️ | | | |
|
||||||
| [AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | Control the visibility of the Pictures shortcut on the Start menu. | ✔️ | | | | |
|
| [AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | Control the visibility of the Pictures shortcut on the Start menu. | ✔️ | | | |
|
||||||
| [AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | Control the visibility of the Settings shortcut on the Start menu. | ✔️ | | | | |
|
| [AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | Control the visibility of the Settings shortcut on the Start menu. | ✔️ | | | |
|
||||||
| [AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) |Control the visibility of the Videos shortcut on the Start menu. | ✔️ | | | | |
|
| [AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) |Control the visibility of the Videos shortcut on the Start menu. | ✔️ | | | |
|
||||||
DisableContextMenus | Prevent context menus from being invoked in the Start menu. | ✔️ | | | | |
|
| DisableContextMenus | Prevent context menus from being invoked in the Start menu. | ✔️ | | | |
|
||||||
| [ForceStartSize](/windows/client-management/mdm/policy-configuration-service-provider#start-forcestartsize) | Force the size of the Start screen. | ✔️ | | | | |
|
| [ForceStartSize](/windows/client-management/mdm/policy-configuration-service-provider#start-forcestartsize) | Force the size of the Start screen. | ✔️ | | | |
|
||||||
| [HideAppList](/windows/client-management/mdm/policy-configuration-service-provider#start-hideapplist) | Collapse or remove the all apps list. | ✔️ | | | | |
|
| [HideAppList](/windows/client-management/mdm/policy-configuration-service-provider#start-hideapplist) | Collapse or remove the all apps list. | ✔️ | | | |
|
||||||
| [HideChangeAccountSettings](/windows/client-management/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) | Hide **Change account settings** from appearing in the user tile. | ✔️ | | | | |
|
| [HideChangeAccountSettings](/windows/client-management/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) | Hide **Change account settings** from appearing in the user tile. | ✔️ | | | |
|
||||||
| [HideFrequentlyUsedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps) | Hide **Most used** section of Start. | ✔️ | | | | |
|
| [HideFrequentlyUsedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps) | Hide **Most used** section of Start. | ✔️ | | | |
|
||||||
| [HideHibernate](/windows/client-management/mdm/policy-configuration-service-provider#start-hidehibernate) | Prevent **Hibernate** option from appearing in the Power button. | ✔️ | | | | |
|
| [HideHibernate](/windows/client-management/mdm/policy-configuration-service-provider#start-hidehibernate) | Prevent **Hibernate** option from appearing in the Power button. | ✔️ | | | |
|
||||||
| [HideLock](/windows/client-management/mdm/policy-configuration-service-provider#start-hidelock) | Prevent **Lock** from appearing in the user tile. | ✔️ | | | | |
|
| [HideLock](/windows/client-management/mdm/policy-configuration-service-provider#start-hidelock) | Prevent **Lock** from appearing in the user tile. | ✔️ | | | |
|
||||||
| HidePeopleBar | Remove the people icon from the taskbar, as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. | ✔️ | | | | |
|
| HidePeopleBar | Remove the people icon from the taskbar, as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. | ✔️ | | | |
|
||||||
| [HidePowerButton](/windows/client-management/mdm/policy-configuration-service-provider#start-hidepowerbutton) | Hide the **Power** button. | ✔️ | | | | |
|
| [HidePowerButton](/windows/client-management/mdm/policy-configuration-service-provider#start-hidepowerbutton) | Hide the **Power** button. | ✔️ | | | |
|
||||||
| [HideRecentJumplists](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentjumplists) | Hide jumplists of recently opened items. | ✔️ | | | | |
|
| [HideRecentJumplists](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentjumplists) | Hide jumplists of recently opened items. | ✔️ | | | |
|
||||||
| [HideRecentlyAddedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps) | Hide **Recently added** section of Start. | ✔️ | | | | |
|
| [HideRecentlyAddedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps) | Hide **Recently added** section of Start. | ✔️ | | | |
|
||||||
| [HideRestart](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderestart) | Prevent **Restart** and **Update and restart** from appearing in the Power button. | ✔️ | | | | |
|
| [HideRestart](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderestart) | Prevent **Restart** and **Update and restart** from appearing in the Power button. | ✔️ | | | |
|
||||||
| [HideShutDown](/windows/client-management/mdm/policy-configuration-service-provider#start-hideshutdown) | Prevent **Shut down** and **Update and shut down** from appearing in the Power button. | ✔️ | | | | |
|
| [HideShutDown](/windows/client-management/mdm/policy-configuration-service-provider#start-hideshutdown) | Prevent **Shut down** and **Update and shut down** from appearing in the Power button. | ✔️ | | | |
|
||||||
| [HideSignOut](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesignout) | Prevent **Sign out** from appearing in the user tile. | ✔️ | | | | |
|
| [HideSignOut](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesignout) | Prevent **Sign out** from appearing in the user tile. | ✔️ | | | |
|
||||||
| [HideSleep](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesleep) | Prevent **Sleep** from appearing in the Power button. | ✔️ | | | | |
|
| [HideSleep](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesleep) | Prevent **Sleep** from appearing in the Power button. | ✔️ | | | |
|
||||||
| [HideSwitchAccount](/windows/client-management/mdm/policy-configuration-service-provider#start-hideswitchaccount) | Prevent **Switch account** from appearing in the user tile. | ✔️ | | | | |
|
| [HideSwitchAccount](/windows/client-management/mdm/policy-configuration-service-provider#start-hideswitchaccount) | Prevent **Switch account** from appearing in the user tile. | ✔️ | | | |
|
||||||
| [HideUserTile](/windows/client-management/mdm/policy-configuration-service-provider#start-hideusertile) | Hide the user tile. | ✔️ | | | | |
|
| [HideUserTile](/windows/client-management/mdm/policy-configuration-service-provider#start-hideusertile) | Hide the user tile. | ✔️ | | | |
|
||||||
| [ImportEdgeAssets](/windows/client-management/mdm/policy-configuration-service-provider#start-importedgeassets) | Import Edge assets for secondary tiles. For more information, see [Add image for secondary Microsoft Edge tiles](../start-secondary-tiles.md). | ✔️ | | | | |
|
| [ImportEdgeAssets](/windows/client-management/mdm/policy-configuration-service-provider#start-importedgeassets) | Import Edge assets for secondary tiles. For more information, see [Add image for secondary Microsoft Edge tiles](../start-secondary-tiles.md). | ✔️ | | | |
|
||||||
| [NoPinningToTaskbar](/windows/client-management/mdm/policy-configuration-service-provider#start-nopinningtotaskbar) | Prevent users from pinning and unpinning apps on the taskbar. | ✔️ | | | | |
|
| [NoPinningToTaskbar](/windows/client-management/mdm/policy-configuration-service-provider#start-nopinningtotaskbar) | Prevent users from pinning and unpinning apps on the taskbar. | ✔️ | | | |
|
||||||
| [StartLayout](/windows/client-management/mdm/policy-configuration-service-provider#start-startlayout) | Apply a custom Start layout. For more information, see [Customize Windows 10 Start and taskbar with provisioning packages](../customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) | ✔️ | | | | |
|
| [StartLayout](/windows/client-management/mdm/policy-configuration-service-provider#start-startlayout) | Apply a custom Start layout. For more information, see [Customize Windows 10 Start and taskbar with provisioning packages](../customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) | ✔️ | | | |
|
||||||
|
|
||||||
## System
|
## System
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowBuildPreview](/windows/client-management/mdm/policy-configuration-service-provider#system-allowbuildpreview) | Specify whether users can access the Insider build controls in the **Advanced Options** for Windows Update. | ✔️ | ✔️ | | | |
|
| [AllowBuildPreview](/windows/client-management/mdm/policy-configuration-service-provider#system-allowbuildpreview) | Specify whether users can access the Insider build controls in the **Advanced Options** for Windows Update. | ✔️ | | | |
|
||||||
| [AllowEmbeddedMode](/windows/client-management/mdm/policy-configuration-service-provider#system-allowembeddedmode) | Specify whether to set general purpose device to be in embedded mode. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowEmbeddedMode](/windows/client-management/mdm/policy-configuration-service-provider#system-allowembeddedmode) | Specify whether to set general purpose device to be in embedded mode. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowExperimentation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowexperimentation) | Determine the level that Microsoft can experiment with the product to study user preferences or device behavior. | ✔️ | ✔️ | | | |
|
| [AllowExperimentation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowexperimentation) | Determine the level that Microsoft can experiment with the product to study user preferences or device behavior. | ✔️ | | | |
|
||||||
| [AllowLocation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowlocation) | Specify whether to allow app access to the Location service. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowLocation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowlocation) | Specify whether to allow app access to the Location service. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [AllowStorageCard](/windows/client-management/mdm/policy-configuration-service-provider#system-allowstoragecard) | Specify whether the user is allowed to use the storage card for device storage. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowStorageCard](/windows/client-management/mdm/policy-configuration-service-provider#system-allowstoragecard) | Specify whether the user is allowed to use the storage card for device storage. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowTelemetry](/windows/client-management/mdm/policy-configuration-service-provider#system-allowtelemetry) | Allow the device to send diagnostic and usage data. | ✔️ | ✔️ | | ✔️ | |
|
| [AllowTelemetry](/windows/client-management/mdm/policy-configuration-service-provider#system-allowtelemetry) | Allow the device to send diagnostic and usage data. | ✔️ | | ✔️ | |
|
||||||
| [AllowUserToResetPhone](/windows/client-management/mdm/policy-configuration-service-provider#system-allowusertoresetphone) | Allow the user to factory reset the phone. | ✔️ | ✔️ | | | |
|
| [AllowUserToResetPhone](/windows/client-management/mdm/policy-configuration-service-provider#system-allowusertoresetphone) | Allow the user to factory reset the phone. | ✔️ | | | |
|
||||||
ConfigureTelemetryOptInChangeNotification | This policy setting determines whether a device shows notifications about telemetry levels to people on first sign-in or when changes occur in Settings. | ✔️ | ✔️ | | | |
|
ConfigureTelemetryOptInChangeNotification | This policy setting determines whether a device shows notifications about telemetry levels to people on first sign-in or when changes occur in Settings. | ✔️ | | | |
|
||||||
ConfigureTelemetryOptInSettingsUx | This policy setting determines whether people can change their own telemetry levels in Settings | ✔️ | ✔️ | | | |
|
ConfigureTelemetryOptInSettingsUx | This policy setting determines whether people can change their own telemetry levels in Settings | ✔️ | | | |
|
||||||
| DisableDeviceDelete | Specify whether the delete diagnostic data is enabled in the Diagnostic & Feedback Settings page. | ✔️ | ✔️ | | | |
|
| DisableDeviceDelete | Specify whether the delete diagnostic data is enabled in the Diagnostic & Feedback Settings page. | ✔️ | | | |
|
||||||
| DisableDataDiagnosticViewer | Configure whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page. | ✔️ | ✔️ | | | |
|
| DisableDataDiagnosticViewer | Configure whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page. | ✔️ | | | |
|
||||||
| [DisableOneDriveFileSync](/windows/client-management/mdm/policy-configuration-service-provider#system-disableonedrivefilesync) | Prevent apps and features from working with files on OneDrive. | ✔️ | | | | |
|
| [DisableOneDriveFileSync](/windows/client-management/mdm/policy-configuration-service-provider#system-disableonedrivefilesync) | Prevent apps and features from working with files on OneDrive. | ✔️ | | | |
|
||||||
| [LimitEnhancedDiagnosticDataWindowsAnalytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | ✔️ | ✔️ | | | |
|
| [LimitEnhancedDiagnosticDataWindowsAnalytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
## TextInput
|
## TextInput
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowIMELogging](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimelogging) | Allow the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. | ✔️ | | | | |
|
| [AllowIMELogging](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimelogging) | Allow the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. | ✔️ | | | |
|
||||||
| [AllowIMENetworkAccess](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimenetworkaccess) | Allow the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary. | ✔️ | | | | |
|
| [AllowIMENetworkAccess](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimenetworkaccess) | Allow the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary. | ✔️ | | | |
|
||||||
| [AllowInputPanel](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowinputpanel) | Disable the touch/handwriting keyboard. | ✔️ | | | | |
|
| [AllowInputPanel](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowinputpanel) | Disable the touch/handwriting keyboard. | ✔️ | | | |
|
||||||
| [AllowJapaneseIMESurrogatePairCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseimesurrogatepaircharacters) | Allow the Japanese IME surrogate pair characters. | ✔️ | | | | |
|
| [AllowJapaneseIMESurrogatePairCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseimesurrogatepaircharacters) | Allow the Japanese IME surrogate pair characters. | ✔️ | | | |
|
||||||
| [AllowJapaneseIVSCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseivscharacters) | Allow Japanese Ideographic Variation Sequence (IVS) characters. | ✔️ | | | | |
|
| [AllowJapaneseIVSCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseivscharacters) | Allow Japanese Ideographic Variation Sequence (IVS) characters. | ✔️ | | | |
|
||||||
| [AllJapaneseNonPublishingStandardGlyph](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapanesenonpublishingstandardglyph) | All the Japanese non-publishing standard glyph. | ✔️ | | | | |
|
| [AllJapaneseNonPublishingStandardGlyph](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapanesenonpublishingstandardglyph) | All the Japanese non-publishing standard glyph. | ✔️ | | | |
|
||||||
| [AllowJapaneseUserDictionary](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseuserdictionary) | Allow the Japanese user dictionary. | ✔️ | | | | |
|
| [AllowJapaneseUserDictionary](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseuserdictionary) | Allow the Japanese user dictionary. | ✔️ | | | |
|
||||||
| [AllowKeyboardTextSuggestions](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowkeyboardtextsuggestions) | Specify whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. | ✔️ | | | | |
|
| [AllowKeyboardTextSuggestions](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowkeyboardtextsuggestions) | Specify whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. | ✔️ | | | |
|
||||||
| [AllowLanguageFeaturesUninstall](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowlanguagefeaturesuninstall) | All language features to be uninstalled. | ✔️ | | | | |
|
| [AllowLanguageFeaturesUninstall](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowlanguagefeaturesuninstall) | All language features to be uninstalled. | ✔️ | | | |
|
||||||
| AllowUserInputsFromMiracastRecevier | Do not use. Instead, use [WirelessDisplay](#wirelessdisplay)/[AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | | | | | |
|
| AllowUserInputsFromMiracastRecevier | Do not use. Instead, use [WirelessDisplay](#wirelessdisplay)/[AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | | | | |
|
||||||
| [ExcludeJapaneseIMEExceptISO208](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
|
| [ExcludeJapaneseIMEExceptISO208](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | |
|
||||||
| [ExcludeJapaneseIMEExceptISO208andEUDC](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208andeudc) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
|
| [ExcludeJapaneseIMEExceptISO208andEUDC](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208andeudc) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | |
|
||||||
| [ExcludeJapaneseIMEExceptShiftJIS](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptshiftjis) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
|
| [ExcludeJapaneseIMEExceptShiftJIS](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptshiftjis) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
## TimeLanguageSettings
|
## TimeLanguageSettings
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowSet24HourClock](/windows/client-management/mdm/policy-configuration-service-provider#timelanguagesettings-allowset24hourclock) | Configure the default clock setting to be the 24 hour format. | | ✔️ | | | |
|
| [AllowSet24HourClock](/windows/client-management/mdm/policy-configuration-service-provider#timelanguagesettings-allowset24hourclock) | Configure the default clock setting to be the 24 hour format. | | | | |
|
||||||
|
|
||||||
|
|
||||||
## Update
|
## Update
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------:|:---------------:|:-----------:|:--------:|:--------:|
|
|---------|-------------|:--------------:|:-----------:|:--------:|:--------:|
|
||||||
| [ActiveHoursEnd](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursend) | Use with **Update/ActiveHoursStart** to manage the range of active hours where update rboots are not scheduled. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [ActiveHoursEnd](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursend) | Use with **Update/ActiveHoursStart** to manage the range of active hours where update reboots are not scheduled. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [ActiveHoursMaxRange](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursmaxrange) | Specify the maximum active hours range. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [ActiveHoursMaxRange](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursmaxrange) | Specify the maximum active hours range. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [ActiveHoursStart](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursstart) | Use with **Update/ActiveHoursEnd** to manage the range of active hours where update reboots are not scheduled. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [ActiveHoursStart](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursstart) | Use with **Update/ActiveHoursEnd** to manage the range of active hours where update reboots are not scheduled. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | Configure automatic update behavior to scan, download, and install updates. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | Configure automatic update behavior to scan, download, and install updates. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](/windows/client-management/mdm/policy-csp-update#update-allowautowindowsupdatedownloadovermeterednetwork) | Option to download updates automatically over metered connections (off by default). Enter `0` for not allowed, or `1` for allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](/windows/client-management/mdm/policy-csp-update#update-allowautowindowsupdatedownloadovermeterednetwork) | Option to download updates automatically over metered connections (off by default). Enter `0` for not allowed, or `1` for allowed. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowMUUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowmuupdateservice) | Manage whether to scan for app updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowMUUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowmuupdateservice) | Manage whether to scan for app updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | Manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | Manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AllowUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowupdateservice) | Specify whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [AllowUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowupdateservice) | Specify whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [AutoRestartDeadlinePeriodInDays](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AutoRestartDeadlinePeriodInDays](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindaysforfeatureupdates) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindaysforfeatureupdates) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AutoRestartNotificationSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartnotificationschedule) | Specify the period for auto-restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AutoRestartNotificationSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartnotificationschedule) | Specify the period for auto-restart reminder notifications. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [AutoRestartRequiredNotificationDismissal](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartrequirednotificationdismissal) | Specify the method by which the auto-restart required notification is dismissed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [AutoRestartRequiredNotificationDismissal](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartrequirednotificationdismissal) | Specify the method by which the auto-restart required notification is dismissed. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [BranchReadinessLevel](/windows/client-management/mdm/policy-configuration-service-provider#update-branchreadinesslevel) | Select which branch a device receives their updates from. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [BranchReadinessLevel](/windows/client-management/mdm/policy-configuration-service-provider#update-branchreadinesslevel) | Select which branch a device receives their updates from. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferfeatureupdatesperiodindays) | Defer Feature Updates for the specified number of days. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferfeatureupdatesperiodindays) | Defer Feature Updates for the specified number of days. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferqualityupdatesperiodindays) | Defer Quality Updates for the specified number of days. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferqualityupdatesperiodindays) | Defer Quality Updates for the specified number of days. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [DeferUpdatePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupdateperiod) | Specify update delays for up to 4 weeks. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [DeferUpdatePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupdateperiod) | Specify update delays for up to 4 weeks. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [DeferUpgradePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupgradeperiod) | Specify upgrade delays for up to 8 months. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [DeferUpgradePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupgradeperiod) | Specify upgrade delays for up to 8 months. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [DetectionFrequency](/windows/client-management/mdm/policy-configuration-service-provider#update-detectionfrequency) | Specify the frequency to scan for updates, from every 1-22 hours. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [DetectionFrequency](/windows/client-management/mdm/policy-configuration-service-provider#update-detectionfrequency) | Specify the frequency to scan for updates, from every 1-22 hours. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [DisableDualScan](/windows/client-management/mdm/policy-csp-update#update-disabledualscan) | Do not allow update deferral policies to cause scans against Windows Update. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [DisableDualScan](/windows/client-management/mdm/policy-csp-update#update-disabledualscan) | Do not allow update deferral policies to cause scans against Windows Update. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [EngagedRestartDeadline](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadline) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [EngagedRestartDeadline](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadline) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [EngagedRestartDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadlineforfeatureupdates) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [EngagedRestartDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadlineforfeatureupdates) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [EngagedRestartSnoozeSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozeschedule) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [EngagedRestartSnoozeSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozeschedule) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [EngagedRestartSnoozeScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozescheduleforfeatureupdates) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [EngagedRestartSnoozeScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozescheduleforfeatureupdates) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [EngagedRestartTransitionSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionschedule) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [EngagedRestartTransitionSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionschedule) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [EngagedRestartTransitionScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionscheduleforfeatureupdates) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [EngagedRestartTransitionScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionscheduleforfeatureupdates) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | Exclude Windws Update (WU) drivers during quality updates. | ✔️ | | ✔️ | | ✔️ |
|
| [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | Exclude Windows Update (WU) drivers during quality updates. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [FillEmptyContentUrls](/windows/client-management/mdm/policy-configuration-service-provider#update-fillemptycontenturls) | Allow Windows Update Agent to determine the download URL when it is missing from the metadata. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [FillEmptyContentUrls](/windows/client-management/mdm/policy-configuration-service-provider#update-fillemptycontenturls) | Allow Windows Update Agent to determine the download URL when it is missing from the metadata. | ✔️ | ✔️ | | ✔️ |
|
||||||
| ManagePreviewBuilds | Use to enable or disable preview builds. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| ManagePreviewBuilds | Use to enable or disable preview builds. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| PhoneUpdateRestrictions | Deprecated | | ✔️ | | | |
|
| PhoneUpdateRestrictions | Deprecated | | ✔️ | | |
|
||||||
| [RequireDeferUpgrade](/windows/client-management/mdm/policy-configuration-service-provider#update-requiredeferupgrade) | Configure device to receive updates from Current Branch for Business (CBB). | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [RequireDeferUpgrade](/windows/client-management/mdm/policy-configuration-service-provider#update-requiredeferupgrade) | Configure device to receive updates from Current Branch for Business (CBB). | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [ScheduledInstallDay](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstallday) | Schedule the day for update installation. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [ScheduledInstallDay](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstallday) | Schedule the day for update installation. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) | To schedule update installation every week, set the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) | To schedule update installation every week, set the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek) | To schedule update installation the first week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek) | To schedule update installation the first week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek) | To schedule update installation the fourth week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek) | To schedule update installation the fourth week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek) | To schedule update installation the second week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek) | To schedule update installation the second week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek) | To schedule update installation the third week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek) | To schedule update installation the third week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [ScheduledInstallTime](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstalltime) | Schedule the time for update installation. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [ScheduledInstallTime](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstalltime) | Schedule the time for update installation. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduleimminentrestartwarning) | Specify the period for auto-restart imminent warning notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduleimminentrestartwarning) | Specify the period for auto-restart imminent warning notifications. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [ScheduleRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-schedulerestartwarning) | Specify the period for auto-restart warning reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [ScheduleRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-schedulerestartwarning) | Specify the period for auto-restart warning reminder notifications. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [SetAutoRestartNotificationDisable](/windows/client-management/mdm/policy-configuration-service-provider#update-setautorestartnotificationdisable) | Disable auto-restart notifications for update installations. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [SetAutoRestartNotificationDisable](/windows/client-management/mdm/policy-configuration-service-provider#update-setautorestartnotificationdisable) | Disable auto-restart notifications for update installations. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [SetDisablePauseUXAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisablepauseuxaccess) | Disable access to scan Windows Update. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [SetDisablePauseUXAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisablepauseuxaccess) | Disable access to scan Windows Update. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [SetDisableUXWUAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisableuxwuaccess) | Disable the **Pause updates** feature. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [SetDisableUXWUAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisableuxwuaccess) | Disable the **Pause updates** feature. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [SetEDURestart](/windows/client-management/mdm/policy-configuration-service-provider#update-setedurestart) | Skip the check for battery level to ensure that the reboot will happen at ScheduledInstallTime. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [SetEDURestart](/windows/client-management/mdm/policy-configuration-service-provider#update-setedurestart) | Skip the check for battery level to ensure that the reboot will happen at ScheduledInstallTime. | ✔️ | ✔️ | | ✔️ |
|
||||||
| UpdateNotificationLevel | Specify whether to enable or disable Windows Update notifications, including restart warnings. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| UpdateNotificationLevel | Specify whether to enable or disable Windows Update notifications, including restart warnings. | ✔️ | ✔️ | | ✔️ |
|
||||||
| [UpdateServiceUrl](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurl) | Configure the device to check for updates from a WSUS server instead of Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [UpdateServiceUrl](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurl) | Configure the device to check for updates from a WSUS server instead of Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
| [UpdateServiceUrlAlternate](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | Specify an alternate intranet server to host updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [UpdateServiceUrlAlternate](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | Specify an alternate intranet server to host updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
|
|
||||||
## WiFi
|
## WiFi
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowAutoConnectToWiFiSenseHotspots](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowautoconnecttowifisensehotspots) | Allow the device to connect automatically to Wi-Fi hotspots. | ✔️ | ✔️ | | | |
|
| [AllowAutoConnectToWiFiSenseHotspots](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowautoconnecttowifisensehotspots) | Allow the device to connect automatically to Wi-Fi hotspots. | ✔️ | | | |
|
||||||
| [AllowInternetSharing](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowinternetsharing) | Allow Internet sharing. | ✔️ | ✔️ | | | |
|
| [AllowInternetSharing](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowinternetsharing) | Allow Internet sharing. | ✔️ | | | |
|
||||||
| [AllowManualWiFiConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowmanualwificonfiguration) | Allow connecting to Wi-Fi outside of MDM server-installed networks. | | ✔️ | | | |
|
| [AllowManualWiFiConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowmanualwificonfiguration) | Allow connecting to Wi-Fi outside of MDM server-installed networks. | | | | |
|
||||||
| [AllowWiFi](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowwifi) | Allow Wi-Fi connections. | | ✔️ | | | |
|
| [AllowWiFi](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowwifi) | Allow Wi-Fi connections. | | | | |
|
||||||
| [WLANScanMode](/windows/client-management/mdm/policy-configuration-service-provider#wifi-wlanscanmode) | Configure the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [WLANScanMode](/windows/client-management/mdm/policy-configuration-service-provider#wifi-wlanscanmode) | Configure the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. | ✔️ | ✔️ | | ✔️ |
|
||||||
|
|
||||||
## WindowsInkWorkspace
|
## WindowsInkWorkspace
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowSuggestedAppsInWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) | Show recommended app suggestions in the ink workspace. | ✔️ | | | | |
|
| [AllowSuggestedAppsInWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) | Show recommended app suggestions in the ink workspace. | ✔️ | | | |
|
||||||
| [AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowwindowsinkworkspace) | Specify whether to allow the user to access the ink workspace. | ✔️ | | | | |
|
| [AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowwindowsinkworkspace) | Specify whether to allow the user to access the ink workspace. | ✔️ | | | |
|
||||||
|
|
||||||
|
|
||||||
## WindowsLogon
|
## WindowsLogon
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| [HideFastUserSwitching](/windows/client-management/mdm/policy-configuration-service-provider#windowslogon-hidefastuserswitching) | Hide the **Switch account** button on the sign-in screen, Start, and the Task Manager. | ✔️ | | | | |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
|
| [HideFastUserSwitching](/windows/client-management/mdm/policy-configuration-service-provider#windowslogon-hidefastuserswitching) | Hide the **Switch account** button on the sign-in screen, Start, and the Task Manager. | ✔️ | | | |
|
||||||
|
|
||||||
## WirelessDisplay
|
## WirelessDisplay
|
||||||
|
|
||||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | --- | :---: | :---: | :---: | :---: |
|
||||||
| [AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | This policy controls whether or not the wireless display can send input (keyboard, mouse, pen, and touch, dependent upon display support) back to the source device. For example, a Surface Laptop is projecting wirelessly to a Surface Hub. If input from the wireless display receiver is allowed, users can draw with a pen on the Surface Hub. | ✔️ | ✔️ | | | |
|
| [AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | This policy controls whether or not the wireless display can send input (keyboard, mouse, pen, and touch, dependent upon display support) back to the source device. For example, a Surface Laptop is projecting wirelessly to a Surface Hub. If input from the wireless display receiver is allowed, users can draw with a pen on the Surface Hub. | ✔️ | | | |
|
||||||
|
|||||||
@ -17,9 +17,9 @@ Use **Privacy** to configure settings for app activation with voice.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| All settings | ✔️ | ✔️ | | ✔️ |
|
||||||
|
|
||||||
## LetAppsActivateWithVoice
|
## LetAppsActivateWithVoice
|
||||||
|
|
||||||
|
|||||||
@ -19,9 +19,9 @@ Use ProvisioningCommands settings to install Windows desktop applications using
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | | | | |
|
| All settings | ✔️ | | | |
|
||||||
|
|
||||||
For instructions on adding apps to provisioning packages, see [Provision PCs with apps](../provisioning-packages/provision-pcs-with-apps.md).
|
For instructions on adding apps to provisioning packages, see [Provision PCs with apps](../provisioning-packages/provision-pcs-with-apps.md).
|
||||||
|
|
||||||
|
|||||||
@ -20,9 +20,9 @@ Use SharedPC settings to optimize Windows 10 for shared use scenarios, such as t
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | | | | |
|
| All settings | ✔️ | | | |
|
||||||
|
|
||||||
## AccountManagement
|
## AccountManagement
|
||||||
|
|
||||||
|
|||||||
@ -19,9 +19,9 @@ Use SMISettings settings to customize the device with custom shell, suppress Win
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | | | | |
|
| All settings | ✔️ | | | |
|
||||||
|
|
||||||
## All settings in SMISettings
|
## All settings in SMISettings
|
||||||
|
|
||||||
|
|||||||
@ -19,12 +19,12 @@ Use Start settings to apply a customized Start screen to devices.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| StartLayout | ✔️ | | | |
|
| StartLayout | ✔️ | | | |
|
||||||
|
|
||||||
>[!IMPORTANT]
|
>[!IMPORTANT]
|
||||||
>The StartLayout setting is available in the advanced provisioning for Windows 10 desktop editions, but shouldn't be used. For desktop editions, use [Policies > StartLayout](wcd-policies.md#start).
|
>The StartLayout setting is available in the advanced provisioning for Windows 10, but shouldn't be used. For Windows client, use [Policies > StartLayout](wcd-policies.md#start).
|
||||||
|
|
||||||
## StartLayout
|
## StartLayout
|
||||||
|
|
||||||
|
|||||||
@ -19,8 +19,8 @@ Use StartupApp settings to configure the default app that will run on start for
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| Default | | | | | ✔️ |
|
| Default | | | | ✔️ |
|
||||||
|
|
||||||
Enter the [Application User Model ID (AUMID)](/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app) for the default app.
|
Enter the [Application User Model ID (AUMID)](/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app) for the default app.
|
||||||
@ -19,7 +19,7 @@ Documentation not available at this time.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | | | | | ✔️ |
|
| All settings | | | | ✔️ |
|
||||||
|
|
||||||
|
|||||||
@ -22,6 +22,6 @@ Use **StorageD3InModernStandby** to enable or disable low-power state (D3) durin
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| All settings | ✔️ | ✔️ | | ✔️ |
|
||||||
@ -24,9 +24,9 @@ Use SurfaceHubManagement settings to set the administrator group that will manag
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | | | ✔️ | | |
|
| All settings | | ✔️ | | |
|
||||||
|
|
||||||
|
|
||||||
## GroupName
|
## GroupName
|
||||||
|
|||||||
@ -19,9 +19,9 @@ Use TabletMode to configure settings related to tablet mode.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | ✔️ | ✔️ | | |
|
| All settings | ✔️ | ✔️ | | |
|
||||||
|
|
||||||
## ConvertibleSlateModePromptPreference
|
## ConvertibleSlateModePromptPreference
|
||||||
|
|
||||||
|
|||||||
@ -19,9 +19,9 @@ Use TakeATest to configure the Take A Test app, a secure browser for test-taking
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | | | | |
|
| All settings | ✔️ | | | |
|
||||||
|
|
||||||
## AllowScreenMonitoring
|
## AllowScreenMonitoring
|
||||||
|
|
||||||
|
|||||||
@ -17,9 +17,9 @@ Use **Time** to configure settings for time zone setup for Windows 10, version (
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [ProvisionSetTimeZone](#provisionsettimezone) | ✔️ | | | | |
|
| [ProvisionSetTimeZone](#provisionsettimezone) | ✔️ | | | |
|
||||||
|
|
||||||
## ProvisionSetTimeZone
|
## ProvisionSetTimeZone
|
||||||
|
|
||||||
|
|||||||
@ -40,9 +40,9 @@ The overlay doesn't mirror the entire volume. It dynamically grows to keep track
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | ✔️ | | | | ✔️ |
|
| All settings | ✔️ | | | ✔️ |
|
||||||
|
|
||||||
## FilterEnabled
|
## FilterEnabled
|
||||||
|
|
||||||
|
|||||||
@ -22,13 +22,13 @@ Use UniversalAppInstall settings to install Windows apps from the Microsoft Stor
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [DeviceContextApp](#devicecontextapp) | ✔️ | | ✔️ | | |
|
| [DeviceContextApp](#devicecontextapp) | ✔️ | ✔️ | | |
|
||||||
| [DeviceContextAppLicense](#devicecontextapplicense) | ✔️ | | ✔️ | | |
|
| [DeviceContextAppLicense](#devicecontextapplicense) | ✔️ | ✔️ | | |
|
||||||
| [StoreInstall](#storeinstall) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [StoreInstall](#storeinstall) | ✔️ | ✔️ | | ✔️ |
|
||||||
| [UserContextApp](#usercontextapp) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [UserContextApp](#usercontextapp) | ✔️ | ✔️ | | ✔️ |
|
||||||
| [UserContextAppLicense](#usercontextapplicense) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [UserContextAppLicense](#usercontextapplicense) | ✔️ | ✔️ | | ✔️ |
|
||||||
|
|
||||||
## DeviceContextApp
|
## DeviceContextApp
|
||||||
|
|
||||||
|
|||||||
@ -20,10 +20,10 @@ Use UniversalAppUninstall settings to uninstall or remove Windows apps.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [RemoveProvisionedApp](#removeprovisionedapp) | ✔️ | | | | |
|
| [RemoveProvisionedApp](#removeprovisionedapp) | ✔️ | | | |
|
||||||
| [Uninstall](#uninstall) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [Uninstall](#uninstall) | ✔️ | ✔️ | | ✔️ |
|
||||||
|
|
||||||
## RemoveProvisionedApp
|
## RemoveProvisionedApp
|
||||||
|
|
||||||
|
|||||||
@ -20,9 +20,9 @@ Allows an OEM to hide the USB option UI in Settings and all USB device errors.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [HideUsbErrorNotifyOptionUI](#hideusberrornotifyoptionui) | ✔️ | ✔️ | ✔️ | ✔️ | |
|
| [HideUsbErrorNotifyOptionUI](#hideusberrornotifyoptionui) | ✔️ | ✔️ | ✔️ | |
|
||||||
|
|
||||||
## HideUsbErrorNotifyOptionUI
|
## HideUsbErrorNotifyOptionUI
|
||||||
|
|
||||||
|
|||||||
@ -20,10 +20,10 @@ Use WeakCharger settings to configure the charger notification UI.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [HideWeakChargerNotifyOptionUI](#hideweakchargernotifyoptionui) | ✔️ | ✔️ | ✔️ | | |
|
| [HideWeakChargerNotifyOptionUI](#hideweakchargernotifyoptionui) | ✔️ | ✔️ | | |
|
||||||
| [NotifyOnWeakCharger](#notifyonweakcharger) | ✔️ | ✔️ | ✔️ | | |
|
| [NotifyOnWeakCharger](#notifyonweakcharger) | ✔️ | ✔️ | | |
|
||||||
|
|
||||||
|
|
||||||
## HideWeakChargerNotifyOptionUI
|
## HideWeakChargerNotifyOptionUI
|
||||||
|
|||||||
@ -19,9 +19,9 @@ Use WindowsHelloForBusiness settings to specify whether [FIDO2 security keys for
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [SecurityKeys](#securitykeys) | ✔️ | | | | |
|
| [SecurityKeys](#securitykeys) | ✔️ | | | |
|
||||||
|
|
||||||
## SecurityKeys
|
## SecurityKeys
|
||||||
|
|
||||||
|
|||||||
@ -20,9 +20,9 @@ Use WindowsTeamSettings settings to configure Surface Hub.
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | | | ✔️ | | |
|
| All settings | | ✔️ | | |
|
||||||
|
|
||||||
## Connect
|
## Connect
|
||||||
|
|
||||||
|
|||||||
@ -20,7 +20,7 @@ Do not use at this time. Instead, use [ConnectivityProfiles > WLAN](wcd-connecti
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| All settings | | | | | |
|
| All settings | | | | |
|
||||||
|
|
||||||
|
|||||||
@ -20,9 +20,9 @@ Use Workplace settings to configure bulk user enrollment to a mobile device mana
|
|||||||
|
|
||||||
## Applies to
|
## Applies to
|
||||||
|
|
||||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [Enrollments](#enrollments) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
| [Enrollments](#enrollments) | ✔️ | ✔️ | | ✔️ |
|
||||||
|
|
||||||
## Enrollments
|
## Enrollments
|
||||||
|
|
||||||
|
|||||||
@ -18,7 +18,7 @@ This section describes the settings that you can configure in [provisioning pack
|
|||||||
|
|
||||||
## Edition that each group of settings applies to
|
## Edition that each group of settings applies to
|
||||||
|
|
||||||
| Setting group | Desktop editions | Surface Hub | HoloLens | IoT Core |
|
| Setting group | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||||
| --- | :---: | :---: | :---: | :---: |
|
| --- | :---: | :---: | :---: | :---: |
|
||||||
| [AccountManagement](wcd-accountmanagement.md) | | | ✔️ | |
|
| [AccountManagement](wcd-accountmanagement.md) | | | ✔️ | |
|
||||||
| [Accounts](wcd-accounts.md) | ✔️ | ✔️ | ✔️ | ✔️ |
|
| [Accounts](wcd-accounts.md) | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||||
|
|||||||
@ -36,46 +36,13 @@ Windows 10 also introduces two additional scenarios that organizations should c
|
|||||||
|
|
||||||
So how do you choose? At a high level:
|
So how do you choose? At a high level:
|
||||||
|
|
||||||
<table>
|
| Consider ... | For these scenarios |
|
||||||
<colgroup>
|
|---|---|
|
||||||
<col width="50%" />
|
| In-place upgrade | - When you want to keep all (or at least most) existing applications<br/>- When you do not plan to significantly change the device configuration (for example, BIOS to UEFI) or operating system configuration (for example, x86 to x64, language changes, Administrators to non-Administrators, Active Directory domain consolidations)<br/>- To migrate from Windows 10 to a later Windows 10 release |
|
||||||
<col width="50%" />
|
| Traditional wipe-and-load | - When you upgrade significant numbers of applications along with the new Windows OS<br/>- When you make significant device or operating system configuration changes<br/>- When you “start clean”. For example, scenarios where it is not necessary to preserve existing apps or data (for example, call centers) or when you move from unmanaged to well-managed PCs<br/>- When you migrate from Windows Vista or other previous operating system versions |
|
||||||
</colgroup>
|
| Dynamic provisioning | - For new devices, especially in “choose your own device” scenarios when simple configuration (not reimaging) is all that is required. <br/>- When used in combination with a management tool (for example, an MDM service like Microsoft Intune) that enables self-service installation of user-specific or role-specific apps |
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Consider ...</th>
|
|
||||||
<th align="left">For these scenarios</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">In-place upgrade</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p>When you want to keep all (or at least most) existing applications</p></li>
|
|
||||||
<li><p>When you do not plan to significantly change the device configuration (for example, BIOS to UEFI) or operating system configuration (for example, x86 to x64, language changes, Administrators to non-Administrators, Active Directory domain consolidations)</p></li>
|
|
||||||
<li><p>To migrate from Windows 10 to a later Windows 10 release</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Traditional wipe-and-load</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p>When you upgrade significant numbers of applications along with the new Windows OS</p></li>
|
|
||||||
<li><p>When you make significant device or operating system configuration changes</p></li>
|
|
||||||
<li><p>When you “start clean”. For example, scenarios where it is not necessary to preserve existing apps or data (for example, call centers) or when you move from unmanaged to well-managed PCs</p></li>
|
|
||||||
<li><p>When you migrate from Windows Vista or other previous operating system versions</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Dynamic provisioning</td>
|
|
||||||
<td align="left"><ul>
|
|
||||||
<li><p>For new devices, especially in “choose your own device” scenarios when simple configuration (not reimaging) is all that is required</p></li>
|
|
||||||
<li><p>When used in combination with a management tool (for example, an MDM service like Microsoft Intune) that enables self-service installation of user-specific or role-specific apps</p></li>
|
|
||||||
</ul></td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
## Migration from previous Windows versions
|
## Migration from previous Windows versions
|
||||||
|
|
||||||
For existing PCs running Windows 7 or Windows 8.1, in-place upgrade is the recommended method for Windows 10 deployment and should be used whenever possible. Although wipe-and-load (OS refresh) deployments are still fully supported (and necessary in some scenarios, as mentioned previously), in-place upgrade is simpler and faster, and enables a faster Windows 10 deployment overall.
|
For existing PCs running Windows 7 or Windows 8.1, in-place upgrade is the recommended method for Windows 10 deployment and should be used whenever possible. Although wipe-and-load (OS refresh) deployments are still fully supported (and necessary in some scenarios, as mentioned previously), in-place upgrade is simpler and faster, and enables a faster Windows 10 deployment overall.
|
||||||
@ -105,7 +72,7 @@ In either of these scenarios, you can make a variety of configuration changes to
|
|||||||
|
|
||||||
## Stay up to date
|
## Stay up to date
|
||||||
|
|
||||||
For computers already running Windows 10 on the Semi-Annual Channel, new upgrades will be deployed two times per year. You can deploy these upgrades by using a variety of methods:
|
For computers using the [General Availability Channel](../update/waas-overview.md#general-availability-channel), you can deploy these upgrades by using a variety of methods:
|
||||||
|
|
||||||
- Windows Update or Windows Update for Business, for devices where you want to receive updates directly from the Internet.
|
- Windows Update or Windows Update for Business, for devices where you want to receive updates directly from the Internet.
|
||||||
- Windows Server Update Services (WSUS), for devices configured to pull updates from internal servers after they are approved (deploying like an update).
|
- Windows Server Update Services (WSUS), for devices configured to pull updates from internal servers after they are approved (deploying like an update).
|
||||||
|
|||||||
@ -103,7 +103,7 @@ sections:
|
|||||||
- question: |
|
- question: |
|
||||||
What are the servicing channels?
|
What are the servicing channels?
|
||||||
answer: |
|
answer: |
|
||||||
To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how aggressively their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. With that in mind, Microsoft offers two servicing channels for Windows 10: Semi-Annual Channel, and Long-Term Servicing Channel (LTSC). For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). For more information on each channel, see [servicing channels](../update/waas-overview.md#servicing-channels).
|
To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how aggressively their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. With that in mind, Microsoft offers two servicing channels for Windows 10: General Availability Channel, and Long-Term Servicing Channel (LTSC). For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). For more information on each channel, see [servicing channels](../update/waas-overview.md#servicing-channels).
|
||||||
|
|
||||||
- question: |
|
- question: |
|
||||||
What tools can I use to manage Windows as a service updates?
|
What tools can I use to manage Windows as a service updates?
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
title: Introduction to the Windows Insider Program for Business
|
title: Introduction to the Windows Insider Program for Business
|
||||||
description: In this article, you'll learn about the Windows Insider Program for Business and why IT Pros should join.
|
description: In this article, you'll learn about the Windows Insider Program for Business and why IT Pros should join.
|
||||||
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight
|
keywords: updates, servicing, current, deployment, General Availability Channel, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight
|
||||||
ms.custom: seo-marvel-apr2020
|
ms.custom: seo-marvel-apr2020
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
@ -22,7 +22,7 @@ ms.topic: article
|
|||||||
|
|
||||||
> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||||
|
|
||||||
For many IT Pros, it's valuable to have visibility into feature updates early--before they’re available in the Semi-Annual Channel. With Windows 10, feature flighting enables participants in the Windows Insider Preview program can consume and deploy preproduction code to test devices, gaining early visibility into the next build. This is better for your organization because you can test the early builds of Windows 10 to discover possible issues with the code or with device and app compatibility in your organization before the update is ever publicly available. We at Microsoft also appreciate it because Insiders can report issues back to us in time for us to make improvements in a release before it is more generally available.
|
For many IT Pros, it's valuable to have visibility into feature updates early--before they’re available in the General Availability Channel. With Windows 10, feature flighting enables participants in the Windows Insider Preview program can consume and deploy preproduction code to test devices, gaining early visibility into the next build. This is better for your organization because you can test the early builds of Windows 10 to discover possible issues with the code or with device and app compatibility in your organization before the update is ever publicly available. We at Microsoft also appreciate it because Insiders can report issues back to us in time for us to make improvements in a release before it is more generally available.
|
||||||
|
|
||||||
The Windows Insider Program for Business gives you the opportunity to:
|
The Windows Insider Program for Business gives you the opportunity to:
|
||||||
|
|
||||||
@ -35,7 +35,7 @@ The Windows Insider Program for Business gives you the opportunity to:
|
|||||||
|
|
||||||
Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans, and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App.
|
Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans, and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App.
|
||||||
|
|
||||||
The Windows Insider Program doesn't replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft.
|
The Windows Insider Program doesn't replace General Availability Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft.
|
||||||
|
|
||||||
[](images/WIP4Biz_deployment.png)<br>
|
[](images/WIP4Biz_deployment.png)<br>
|
||||||
Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments.
|
Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments.
|
||||||
@ -56,8 +56,8 @@ Along with exploring new features, you also have the option to validate your app
|
|||||||
- Get a head start on your Windows validation process
|
- Get a head start on your Windows validation process
|
||||||
- Identify issues sooner to accelerate your Windows deployment
|
- Identify issues sooner to accelerate your Windows deployment
|
||||||
- Engage Microsoft earlier for help with potential compatibility issues
|
- Engage Microsoft earlier for help with potential compatibility issues
|
||||||
- Deploy Windows 10 Semi-Annual releases faster and more confidently
|
- Deploy Windows 10 General Availability Channel releases faster and more confidently
|
||||||
- Maximize the 18-month support Window that comes with each Semi-Annual release.
|
- Maximize the support Window that comes with each General Availability Channel release.
|
||||||
|
|
||||||
|Objective |Feature exploration|
|
|Objective |Feature exploration|
|
||||||
|---------|---------|
|
|---------|---------|
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
title: Windows client updates, channels, and tools
|
title: Windows client updates, channels, and tools
|
||||||
description: Brief summary of the kinds of Windows updates, the channels they are served through, and the tools for managing them
|
description: Brief summary of the kinds of Windows updates, the channels they are served through, and the tools for managing them
|
||||||
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
|
keywords: updates, servicing, current, deployment, General Availability Channel, semi-annual channel, feature, quality, rings, insider, tools
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
author: jaimeo
|
author: jaimeo
|
||||||
@ -35,7 +35,7 @@ version of the software.
|
|||||||
|
|
||||||
We include information here about many different update types you'll hear about, but the two overarching types that you have the most direct control over are *feature updates* and *quality updates*.
|
We include information here about many different update types you'll hear about, but the two overarching types that you have the most direct control over are *feature updates* and *quality updates*.
|
||||||
|
|
||||||
- **Feature updates:** Released as soon as they become available. Feature updates add new features and functionality to Windows 10. Because they are delivered frequently (rather than every 3-5 years), they are easier to manage.
|
- **Feature updates:** Released annually. Feature updates add new features and functionality to Windows 10. Because they are delivered frequently (rather than every 3-5 years), they are easier to manage.
|
||||||
- **Quality updates:** Quality updates deliver both security and non-security fixes. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. They are typically released on the second Tuesday of each month, though they can be released at any time. The second-Tuesday releases are the ones that focus on security updates. Quality updates are *cumulative*, so installing the latest quality update is sufficient to get all the available fixes for a specific feature update, including any out-of-band security fixes and any *servicing stack updates* that might have been released previously.
|
- **Quality updates:** Quality updates deliver both security and non-security fixes. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. They are typically released on the second Tuesday of each month, though they can be released at any time. The second-Tuesday releases are the ones that focus on security updates. Quality updates are *cumulative*, so installing the latest quality update is sufficient to get all the available fixes for a specific feature update, including any out-of-band security fixes and any *servicing stack updates* that might have been released previously.
|
||||||
- **Servicing stack updates:** The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates are not necessarily included in *every* monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). For more detail about servicing stack updates, see [Servicing stack updates](servicing-stack-updates.md).
|
- **Servicing stack updates:** The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates are not necessarily included in *every* monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). For more detail about servicing stack updates, see [Servicing stack updates](servicing-stack-updates.md).
|
||||||
- **Driver updates**: These update drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they are installed or not.
|
- **Driver updates**: These update drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they are installed or not.
|
||||||
@ -51,7 +51,7 @@ The first step of controlling when and how devices install updates is assigning
|
|||||||
|
|
||||||
### General Availability Channel
|
### General Availability Channel
|
||||||
|
|
||||||
In the General Availability Channel, feature updates are available as soon as Microsoft releases them. As long as a device isn't set to defer feature updates, any device in this channel will install a feature update as soon as it's released. If you use Windows Update for Business, the channel provides three months of additional total deployment time before being required to update to the next release.
|
In the General Availability Channel, feature updates are released annually. As long as a device isn't set to defer feature updates, any device in this channel will install a feature update as soon as it's released. If you use Windows Update for Business, the channel provides three months of additional total deployment time before being required to update to the next release.
|
||||||
|
|
||||||
|
|
||||||
### Windows Insider Program for Business
|
### Windows Insider Program for Business
|
||||||
|
|||||||
@ -60,7 +60,7 @@ When using WSUS to manage updates on Windows client devices, start by configurin
|
|||||||
|
|
||||||
3. Right-click **Your_Domain**, and then select **Create a GPO in this domain, and Link it here**.
|
3. Right-click **Your_Domain**, and then select **Create a GPO in this domain, and Link it here**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>In this example, the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings are specified for the entire domain. This is not a requirement; you can target these settings to any security group by using Security Filtering or a specific OU.
|
>In this example, the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings are specified for the entire domain. This is not a requirement; you can target these settings to any security group by using Security Filtering or a specific OU.
|
||||||
@ -73,13 +73,13 @@ When using WSUS to manage updates on Windows client devices, start by configurin
|
|||||||
|
|
||||||
7. Right-click the **Configure Automatic Updates** setting, and then click **Edit**.
|
7. Right-click the **Configure Automatic Updates** setting, and then click **Edit**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
8. In the **Configure Automatic Updates** dialog box, select **Enable**.
|
8. In the **Configure Automatic Updates** dialog box, select **Enable**.
|
||||||
|
|
||||||
9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**.
|
9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
>[!IMPORTANT]
|
>[!IMPORTANT]
|
||||||
> Use Regedit.exe to check that the following key is not enabled, because it can break Windows Store connectivity: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations
|
> Use Regedit.exe to check that the following key is not enabled, because it can break Windows Store connectivity: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations
|
||||||
@ -91,12 +91,12 @@ When using WSUS to manage updates on Windows client devices, start by configurin
|
|||||||
|
|
||||||
11. In the **Specify intranet Microsoft update service location** dialog box, select **Enable**.
|
11. In the **Specify intranet Microsoft update service location** dialog box, select **Enable**.
|
||||||
|
|
||||||
12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type <strong>http://Your_WSUS_Server_FQDN:PortNumber</strong>, and then select **OK**.
|
12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type `http://Your_WSUS_Server_FQDN:PortNumber`, and then select **OK**.
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>The URL `http://CONTOSO-WSUS1.contoso.com:8530` in the following image is just an example. In your environment, be sure to use the server name and port number for your WSUS instance.
|
>The URL `http://CONTOSO-WSUS1.contoso.com:8530` in the following image is just an example. In your environment, be sure to use the server name and port number for your WSUS instance.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>The default HTTP port for WSUS is 8530, and the default HTTP over Secure Sockets Layer (HTTPS) port is 8531. (The other options are 80 and 443; no other ports are supported.)
|
>The default HTTP port for WSUS is 8530, and the default HTTP over Secure Sockets Layer (HTTPS) port is 8531. (The other options are 80 and 443; no other ports are supported.)
|
||||||
@ -116,7 +116,7 @@ You can use computer groups to target a subset of devices that have specific qua
|
|||||||
|
|
||||||
2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**.
|
2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
3. Type **Ring 2 Pilot Business Users** for the name, and then click **Add**.
|
3. Type **Ring 2 Pilot Business Users** for the name, and then click **Add**.
|
||||||
|
|
||||||
@ -144,7 +144,7 @@ When new computers communicate with WSUS, they appear in the **Unassigned Comput
|
|||||||
|
|
||||||
2. Select both computers, right-click the selection, and then click **Change Membership**.
|
2. Select both computers, right-click the selection, and then click **Change Membership**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**.
|
3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**.
|
||||||
|
|
||||||
@ -162,7 +162,7 @@ Another way to add multiple computers to a deployment ring in the WSUS Administr
|
|||||||
|
|
||||||
3. In the search results, select the computers, right-click the selection, and then click **Change Membership**.
|
3. In the search results, select the computers, right-click the selection, and then click **Change Membership**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**.
|
4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**.
|
||||||
|
|
||||||
@ -179,7 +179,7 @@ The WSUS Administration Console provides a friendly interface from which you can
|
|||||||
|
|
||||||
1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**.
|
1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**.
|
2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**.
|
||||||
|
|
||||||
@ -203,7 +203,7 @@ Now that WSUS is ready for client-side targeting, complete the following steps t
|
|||||||
|
|
||||||
5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**.
|
5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update.
|
6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update.
|
||||||
|
|
||||||
@ -213,7 +213,7 @@ Now that WSUS is ready for client-side targeting, complete the following steps t
|
|||||||
|
|
||||||
9. In the **Target group name for this computer** box, type *Ring 4 Broad Business Users*. This is the name of the deployment ring in WSUS to which these computers will be added.
|
9. In the **Target group name for this computer** box, type *Ring 4 Broad Business Users*. This is the name of the deployment ring in WSUS to which these computers will be added.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
> [!WARNING]
|
> [!WARNING]
|
||||||
> The target group name must match the computer group name.
|
> The target group name must match the computer group name.
|
||||||
@ -230,7 +230,7 @@ Now you’re ready to deploy this GPO to the correct computer security group for
|
|||||||
|
|
||||||
3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group.
|
3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The next time the clients in the **Ring 4 Broad Business Users** security group receive their computer policy and contact WSUS, they will be added to the **Ring 4 Broad Business Users** deployment ring.
|
The next time the clients in the **Ring 4 Broad Business Users** security group receive their computer policy and contact WSUS, they will be added to the **Ring 4 Broad Business Users** deployment ring.
|
||||||
|
|
||||||
@ -239,7 +239,7 @@ The next time the clients in the **Ring 4 Broad Business Users** security group
|
|||||||
For clients that should have their feature updates approved as soon as they’re available, you can configure Automatic Approval rules in WSUS.
|
For clients that should have their feature updates approved as soon as they’re available, you can configure Automatic Approval rules in WSUS.
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>WSUS respects the client device's servicing branch. If you approve a feature update while it is still in one branch, such as Insider Preview, WSUS will install the update only on devices that are in that servicing branch. When Microsoft releases the build for Semi-Annual Channel (or General Availability Channel), the devices in that will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS.
|
>WSUS respects the client device's servicing branch. If you approve a feature update while it is still in one branch, such as Insider Preview, WSUS will install the update only on devices that are in that servicing branch. When Microsoft releases the build for the [General Availability Channel](waas-overview.md#general-availability-channel), the devices in that will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS.
|
||||||
|
|
||||||
|
|
||||||
**To configure an Automatic Approval rule for Windows client feature updates and approve them for the Ring 3 Broad IT deployment ring**
|
**To configure an Automatic Approval rule for Windows client feature updates and approve them for the Ring 3 Broad IT deployment ring**
|
||||||
@ -251,7 +251,7 @@ This example uses Windows 10, but the process is the same for Windows 11.
|
|||||||
|
|
||||||
3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes.
|
3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**.
|
4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**.
|
||||||
|
|
||||||
@ -265,7 +265,7 @@ This example uses Windows 10, but the process is the same for Windows 11.
|
|||||||
|
|
||||||
8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**.
|
8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
9. In the **Automatic Approvals** dialog box, click **OK**.
|
9. In the **Automatic Approvals** dialog box, click **OK**.
|
||||||
|
|
||||||
@ -300,7 +300,7 @@ To simplify the manual approval process, start by creating a software update vie
|
|||||||
|
|
||||||
5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**.
|
5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Now that you have the **All Windows 10 Upgrades** view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring:
|
Now that you have the **All Windows 10 Upgrades** view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring:
|
||||||
|
|
||||||
@ -308,21 +308,21 @@ Now that you have the **All Windows 10 Upgrades** view, complete the following s
|
|||||||
|
|
||||||
2. Right-click the feature update you want to deploy, and then click **Approve**.
|
2. Right-click the feature update you want to deploy, and then click **Approve**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
3. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Approved for Install**.
|
3. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Approved for Install**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**.
|
4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**.
|
5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**.
|
||||||
|
|
||||||
If the deployment is successful, you should receive a successful progress report.
|
If the deployment is successful, you should receive a successful progress report.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
6. In the **Approval Progress** dialog box, click **Close**.
|
6. In the **Approval Progress** dialog box, click **Close**.
|
||||||
|
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
title: Overview of Windows as a service
|
title: Overview of Windows as a service
|
||||||
description: Windows as a service is a way to build, deploy, and service Windows. Learn how Windows as a service works.
|
description: Windows as a service is a way to build, deploy, and service Windows. Learn how Windows as a service works.
|
||||||
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
|
keywords: updates, servicing, current, deployment, General Availability Channel, semi-annual channel, feature, quality, rings, insider, tools
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
author: jaimeo
|
author: jaimeo
|
||||||
@ -90,9 +90,9 @@ There are three servicing channels. The [Windows Insider Program](#windows-insid
|
|||||||
|
|
||||||
### General Availability Channel
|
### General Availability Channel
|
||||||
|
|
||||||
In the General Availability Channel, feature updates are available as soon as Microsoft releases them. This servicing model is ideal for pilot deployments and testing of feature updates and for users such as developers who need to work with the latest features immediately. Once the latest release has gone through pilot deployment and testing, you will be able to choose the timing at which it goes into broad deployment.
|
In the General Availability Channel, feature updates are available annually. This servicing model is ideal for pilot deployments and testing of feature updates and for users such as developers who need to work with the latest features. Once the latest release has gone through pilot deployment and testing, you will be able to choose the timing at which it goes into broad deployment.
|
||||||
|
|
||||||
When Microsoft officially releases a feature update, we make it available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the Semi-Annual Channel will be available but not necessarily immediately mandatory, depending on the policy of the management system. For more details about servicing tools, see [Servicing tools](#servicing-tools).
|
When Microsoft officially releases a feature update, we make it available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the General Availability Channel will be available but not necessarily immediately mandatory, depending on the policy of the management system. For more details about servicing tools, see [Servicing tools](#servicing-tools).
|
||||||
|
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
@ -120,7 +120,7 @@ The Long-term Servicing Channel is available only in the Windows 10 Enterprise L
|
|||||||
|
|
||||||
### Windows Insider
|
### Windows Insider
|
||||||
|
|
||||||
For many IT pros, gaining visibility into feature updates early--before they’re available to the Semi-Annual Channel — can be both intriguing and valuable for future end user communications as well as provide the means to test for any issues on the next General Availability release. Windows Insiders can consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft.
|
For many IT pros, gaining visibility into feature updates early--before they’re available to the General Availability Channel — can be both intriguing and valuable for future end user communications as well as provide the means to test for any issues on the next General Availability release. Windows Insiders can consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft.
|
||||||
|
|
||||||
Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about the Windows Insider Program for Business, go to [Windows Insider Program for Business](/windows-insider/at-work-pro/wip-4-biz-get-started).
|
Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about the Windows Insider Program for Business, go to [Windows Insider Program for Business](/windows-insider/at-work-pro/wip-4-biz-get-started).
|
||||||
|
|
||||||
@ -130,7 +130,7 @@ Microsoft recommends that all organizations have at least a few devices enrolled
|
|||||||
|
|
||||||
There are many tools you can use to service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows as a service updates:
|
There are many tools you can use to service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows as a service updates:
|
||||||
|
|
||||||
- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the Semi-Annual Channel. Organizations can target which devices defer updates by selecting the **Defer upgrades** check box in **Start\Settings\Update & Security\Advanced Options** on a Windows client device.
|
- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the General Availability Channel. Organizations can target which devices defer updates by selecting the **Defer upgrades** check box in **Start\Settings\Update & Security\Advanced Options** on a Windows client device.
|
||||||
- **Windows Update for Business** includes control over update deferment and provides centralized management using Group Policy or MDM. Windows Update for Business can be used to defer updates by up to 365 days, depending on the version. These deployment options are available to clients in the General Availability Channel. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Microsoft Intune.
|
- **Windows Update for Business** includes control over update deferment and provides centralized management using Group Policy or MDM. Windows Update for Business can be used to defer updates by up to 365 days, depending on the version. These deployment options are available to clients in the General Availability Channel. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Microsoft Intune.
|
||||||
- **Windows Server Update Services (WSUS)** provides extensive control over updates and is natively available in the Windows Server operating system. In addition to the ability to defer updates, organizations can add an approval layer for updates and choose to deploy them to specific computers or groups of computers whenever ready.
|
- **Windows Server Update Services (WSUS)** provides extensive control over updates and is natively available in the Windows Server operating system. In addition to the ability to defer updates, organizations can add an approval layer for updates and choose to deploy them to specific computers or groups of computers whenever ready.
|
||||||
- **Microsoft Endpoint Configuration Manager** provides the greatest control over servicing Windows as a service. IT pros can defer updates, approve them, and have multiple options for targeting deployments and managing bandwidth usage and deployment times.
|
- **Microsoft Endpoint Configuration Manager** provides the greatest control over servicing Windows as a service. IT pros can defer updates, approve them, and have multiple options for targeting deployments and managing bandwidth usage and deployment times.
|
||||||
|
|||||||
@ -1,14 +1,14 @@
|
|||||||
---
|
---
|
||||||
title: Quick guide to Windows as a service (Windows 10)
|
title: Quick guide to Windows as a service (Windows 10)
|
||||||
description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy.
|
description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy.
|
||||||
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
|
keywords: updates, servicing, current, deployment, General Availability Channel, semi-annual channel, feature, quality, rings, insider, tools
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
author: jaimeo
|
author: jaimeo
|
||||||
ms.localizationpriority: high
|
ms.localizationpriority: high
|
||||||
ms.author: jaimeo
|
ms.author: jaimeo
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
manager: laurawi
|
manager: dougeby
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
@ -25,11 +25,12 @@ Here is a quick guide to the most important concepts in Windows as a service. Fo
|
|||||||
## Definitions
|
## Definitions
|
||||||
|
|
||||||
Some new terms have been introduced as part of Windows as a service, so you should know what these terms mean.
|
Some new terms have been introduced as part of Windows as a service, so you should know what these terms mean.
|
||||||
- **Feature updates** are released twice per year, around March and September. As the name suggests, these updates add new features, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years.
|
|
||||||
|
- **Feature updates** are released annually. As the name suggests, these updates add new features, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years.
|
||||||
- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month, though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md).
|
- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month, though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md).
|
||||||
- **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and confirm compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered.
|
- **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and confirm compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered.
|
||||||
- **Servicing channels** allow organizations to choose when to deploy new features.
|
- **Servicing channels** allow organizations to choose when to deploy new features.
|
||||||
- The **General Availability Channel** receives feature updates as they become available.
|
- The **General Availability Channel** receives feature updates annually.
|
||||||
- The **Long-Term Servicing Channel**, which meant only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years.
|
- The **Long-Term Servicing Channel**, which meant only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years.
|
||||||
- **Deployment rings** are groups of devices used to initially pilot, and then to broadly deploy, each feature update in an organization.
|
- **Deployment rings** are groups of devices used to initially pilot, and then to broadly deploy, each feature update in an organization.
|
||||||
|
|
||||||
@ -51,6 +52,6 @@ To stay up to date, deploy feature updates at an appropriate time after their re
|
|||||||
|
|
||||||
Extensive advanced testing isn’t required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin.
|
Extensive advanced testing isn’t required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin.
|
||||||
|
|
||||||
This process repeats with each new feature update as they become available. These are small deployment projects, compared to the large projects that were necessary with the old three-to-five-year Windows release cycles.
|
This process repeats with each new feature update. These are small deployment projects, compared to the large projects that were necessary with the old three-to-five-year Windows release cycles.
|
||||||
|
|
||||||
Other technologies such as BranchCache and Delivery Optimization, both peer-to-peer distribution tools, can help with the distribution of the feature update installation files.
|
Other technologies such as BranchCache and Delivery Optimization, both peer-to-peer distribution tools, can help with the distribution of the feature update installation files.
|
||||||
|
|||||||
@ -43,7 +43,7 @@ The General Availability Channel is the default servicing channel for all Window
|
|||||||
>The LTSC edition is only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx).
|
>The LTSC edition is only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx).
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>Devices will automatically receive updates from the Semi-Annual Channel, unless they are configured to receive preview updates through the Windows Insider Program.
|
>Devices will automatically receive updates from the General Availability Channel, unless they are configured to receive preview updates through the Windows Insider Program.
|
||||||
|
|
||||||
|
|
||||||
## Enroll devices in the Windows Insider Program
|
## Enroll devices in the Windows Insider Program
|
||||||
|
|||||||
@ -15,6 +15,7 @@ ms.topic: article
|
|||||||
---
|
---
|
||||||
|
|
||||||
# Windows 10 upgrade paths
|
# Windows 10 upgrade paths
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
- Windows 10
|
- Windows 10
|
||||||
@ -25,194 +26,73 @@ This topic provides a summary of available upgrade paths to Windows 10. You can
|
|||||||
|
|
||||||
If you are also migrating to a different edition of Windows, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). Methods and supported paths are described on this page to change the edition of Windows. These methods require that you input a license or product key for the new Windows edition prior to starting the upgrade process. Edition downgrade is also supported for some paths, but please note that applications and settings are not maintained when the Windows edition is downgraded.
|
If you are also migrating to a different edition of Windows, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). Methods and supported paths are described on this page to change the edition of Windows. These methods require that you input a license or product key for the new Windows edition prior to starting the upgrade process. Edition downgrade is also supported for some paths, but please note that applications and settings are not maintained when the Windows edition is downgraded.
|
||||||
|
|
||||||
> **Windows 10 version upgrade**: You can directly upgrade any semi-annual channel version of Windows 10 to a newer, supported semi-annual channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information.
|
- **Windows 10 version upgrade**: You can directly upgrade any General Availability Channel version of Windows 10 to a newer, supported General Availability Channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information.
|
||||||
>
|
|
||||||
> In-place upgrade from Windows 7, Windows 8.1, or [Windows 10 semi-annual channel](/windows/release-health/release-information) to Windows 10 LTSC is not supported. **Note**: Windows 10 LTSC 2015 did not block this upgrade path. This was corrected in the Windows 10 LTSC 2016 release, which will now only allow data-only and clean install options. You can upgrade from Windows 10 LTSC to Windows 10 semi-annual channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later. Upgrade is supported using the in-place upgrade process (using Windows setup). You will need to use the Product Key switch if you want to keep your apps. If you don't use the switch the option 'Keep personal files and apps' will be grayed out. The command line would be **setup.exe /pkey xxxxx-xxxxx-xxxxx-xxxxx-xxxxx**, using your relevant Windows 10 SAC product key. For example, if using a KMS, the command line would be **setup.exe /pkey NPPR9-FWDCX-D2C8J-H872K-2YT43**.
|
- **In-place upgrade from Windows 7, Windows 8.1, or [Windows 10 General Availability Channel](/windows/release-health/release-information)** to Windows 10 LTSC is not supported. Windows 10 LTSC 2015 did not block this in-place upgrade path. This issue was corrected in the Windows 10 LTSC 2016 release, which only allows data-only and clean install options.
|
||||||
>
|
|
||||||
> **Windows N/KN**: Windows "N" and "KN" SKUs (editions without media-related functionality) follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process.
|
You can upgrade from Windows 10 LTSC to Windows 10 General Availability Channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later. Upgrade is supported using the in-place upgrade process (using Windows setup). You will need to use the Product Key switch if you want to keep your apps. If you don't use the switch, the option **Keep personal files and apps** option is grayed out. The command line would be `setup.exe /pkey xxxxx-xxxxx-xxxxx-xxxxx-xxxxx`, using your relevant Windows 10 SAC product key. For example, if using a KMS, the command line would be `setup.exe /pkey NPPR9-FWDCX-D2C8J-H872K-2YT43`.
|
||||||
>
|
|
||||||
> **Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355).
|
- **Windows N/KN**: Windows "N" and "KN" SKUs (editions without media-related functionality) follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process.
|
||||||
|
|
||||||
|
- **Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355).
|
||||||
|
|
||||||
|
## Windows 10
|
||||||
|
|
||||||
|
✔ = Full upgrade is supported including personal data, settings, and applications.
|
||||||
|
|
||||||
✔ = Full upgrade is supported including personal data, settings, and applications.<br>
|
|
||||||
D = Edition downgrade; personal data is maintained, applications and settings are removed.
|
D = Edition downgrade; personal data is maintained, applications and settings are removed.
|
||||||
|
|
||||||
<br>
|
---
|
||||||
<table border="0" cellpadding="1">
|
| | Windows 10 Home | Windows 10 Pro | Windows 10 Pro Education | Windows 10 Education | Windows 10 Enterprise |
|
||||||
<tr>
|
|---|---|---|---|---|---|
|
||||||
<td> </td>
|
| **Home** | | ✔ | ✔ | ✔ | |
|
||||||
<td> </td>
|
| **Pro** | D | | ✔ | ✔ | ✔ |
|
||||||
<th>Windows 10 Home</th>
|
| **Education** | | | | | D |
|
||||||
<th>Windows 10 Pro</th>
|
| **Enterprise** | | | | ✔ | |
|
||||||
<th>Windows 10 Pro Education</th>
|
|
||||||
<th>Windows 10 Education</th>
|
|
||||||
<th>Windows 10 Enterprise</th>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<th rowspan="7">Windows 7</th>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Starter</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Home Basic</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Home Premium</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Professional</td>
|
|
||||||
<td>D</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Ultimate</td>
|
|
||||||
<td>D</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<th rowspan="10">Windows 8.1</th>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>(Core)</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Connected</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>D</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro Student</td>
|
|
||||||
<td>D</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro WMC</td>
|
|
||||||
<td>D</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Embedded Industry</td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td>✔</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Windows RT</td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Windows Phone 8.1</td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<th rowspan="8">Windows 10</th>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Home</td>
|
|
||||||
<td></td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Pro</td>
|
|
||||||
<td>D</td>
|
|
||||||
<td></td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td>✔</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Education</td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td>D</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Enterprise</td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td></td>
|
|
||||||
<td>✔</td>
|
|
||||||
<td></td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Windows 8.1
|
||||||
|
|
||||||
|
✔ = Full upgrade is supported including personal data, settings, and applications.
|
||||||
|
|
||||||
|
D = Edition downgrade; personal data is maintained, applications and settings are removed.
|
||||||
|
|
||||||
|
---
|
||||||
|
| | Windows 10 Home | Windows 10 Pro | Windows 10 Pro Education | Windows 10 Education | Windows 10 Enterprise |
|
||||||
|
|---|---|---|---|---|---|
|
||||||
|
| **(Core)** | ✔ | ✔ | ✔ | ✔ | |
|
||||||
|
| **Connected** | ✔ | ✔ | ✔ | ✔ | |
|
||||||
|
| **Pro** | D | ✔ | ✔ | ✔ | ✔ |
|
||||||
|
| **Pro Student** | D | ✔ | ✔ | ✔ | ✔ |
|
||||||
|
| **Pro WMC** | D | ✔ | ✔ | ✔ | ✔ |
|
||||||
|
| **Enterprise** | | | | ✔ | ✔ |
|
||||||
|
| **Embedded Industry** | | | | | ✔ |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Windows 7
|
||||||
|
|
||||||
|
✔ = Full upgrade is supported including personal data, settings, and applications.
|
||||||
|
|
||||||
|
D = Edition downgrade; personal data is maintained, applications and settings are removed.
|
||||||
|
|
||||||
|
---
|
||||||
|
| | Windows 10 Home | Windows 10 Pro | Windows 10 Pro Education | Windows 10 Education | Windows 10 Enterprise |
|
||||||
|
|---|---|---|---|---|---|
|
||||||
|
| **Starter** | ✔ | ✔ | ✔ | ✔ | |
|
||||||
|
| **Home Basic** | ✔ | ✔ | ✔ | ✔ | |
|
||||||
|
| **Home Premium** | ✔ | ✔ | ✔ | ✔ | |
|
||||||
|
| **Professional** | D | ✔ | ✔ | ✔ | ✔ |
|
||||||
|
| **Ultimate** | D | ✔ | ✔ | ✔ | ✔ |
|
||||||
|
| **Enterprise** | | | | ✔ | ✔ |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## Related Topics
|
## Related Topics
|
||||||
|
|
||||||
[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)<br>
|
[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
|
||||||
[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)<br>
|
|
||||||
|
[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)
|
||||||
|
|
||||||
[Windows 10 edition upgrade](windows-10-edition-upgrades.md)
|
[Windows 10 edition upgrade](windows-10-edition-upgrades.md)
|
||||||
@ -34,43 +34,12 @@ When you select a product, for example “Windows 10 Enterprise” or “Windows
|
|||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> If you do not see a Windows 10 release available in the list of downloads, verify the [release date](https://technet.microsoft.com/windows/release-info.aspx).
|
> If you do not see a Windows 10 release available in the list of downloads, verify the [release date](https://technet.microsoft.com/windows/release-info.aspx).
|
||||||
|
|
||||||
In Windows 10, version 1709 the packaging of volume licensing media and upgrade packages is different than it has been for previous releases. Instead of having separate media and packages for Windows 10 Pro (volume licensing version), Windows 10 Enterprise, and Windows 10 Education, all three are bundled together. The following section explains this change.
|
Instead of having separate media and packages for Windows 10 Pro (volume licensing version), Windows 10 Enterprise, and Windows 10 Education, all three are bundled together.
|
||||||
|
|
||||||
### Windows 10, version 1709
|
|
||||||
|
|
||||||
Windows 10, version 1709 is available starting on 10/17/2017 in all relevant distribution channels. Note: An updated [Windows ADK for Windows 10](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) is also available.
|
|
||||||
|
|
||||||
For ISOs that you download from the VLSC or Visual Studio Subscriptions, you can still search for the individual Windows editions. However, each of these editions (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education) will point to the same ISO file, so you only need to download the ISO once. A single Windows image (WIM) file is included in the ISO that contains all the volume licensing images:
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
When using the contents of these ISOs with tools such as the Microsoft Deployment Toolkit or Microsoft Endpoint Configuration Manager, make sure you select the appropriate image index in any task sequences that you create or update.
|
|
||||||
|
|
||||||
For packages published to Windows Server Update Services (WSUS), you’ll also notice the change because, instead of having separate packages for each Windows edition, there will be just one package:
|
|
||||||
|
|
||||||
<br>
|
|
||||||
|
|
||||||
| Title | Classification | Description |
|
|
||||||
| --- | --- | --- |
|
|
||||||
| Feature update to Windows 10, version 1709, \<language\> | Upgrades | Package to upgrade Windows 10 Pro (VL), Windows 10 Enterprise, or Windows 10 Education to version 1709 |
|
|
||||||
| Windows 7 and 8.1 upgrade to Windows 10, version 1709, \<language\> | Upgrades | Package to upgrade Windows 7 Professional (VL), Windows 7 Enterprise, Windows 8.1 Professional (VL), or Windows 8.1 Enterprise to Windows 10 1709 |
|
|
||||||
|
|
||||||
<br>
|
|
||||||
|
|
||||||
When you approve one of these packages, it applies to all of the editions.
|
|
||||||
|
|
||||||
This Semi-Annual Channel release of Windows 10 continues the Windows as a service methodology. For more information about implementing Windows as a service in your organization in order to stay up to date with Windows, see [Update Windows 10 in the enterprise](./update/index.md).
|
|
||||||
|
|
||||||
|
|
||||||
### Language packs
|
### Language packs
|
||||||
|
|
||||||
- **Windows 10 versions 1507 and 1511**: you can select **Windows 10 Enterprise Language Pack**, click **Download** and then select **English** and **64-bit** to see these downloads.
|
|
||||||
- **Windows 10 1607 and later**: you must select **Multilanguage** from the drop-down list of languages.
|
- **Windows 10 1607 and later**: you must select **Multilanguage** from the drop-down list of languages.
|
||||||
|
|
||||||
See the following example for Windows 10, version 1709:
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Features on demand
|
### Features on demand
|
||||||
|
|
||||||
[Features on demand](/archive/blogs/mniehaus/adding-features-including-net-3-5-to-windows-10) can be downloaded by searching for "**Windows 10 Enterprise Features on Demand**" and then following the same download process that is described above.
|
[Features on demand](/archive/blogs/mniehaus/adding-features-including-net-3-5-to-windows-10) can be downloaded by searching for "**Windows 10 Enterprise Features on Demand**" and then following the same download process that is described above.
|
||||||
|
|||||||
@ -23,7 +23,7 @@ Applies to:
|
|||||||
- Windows 10
|
- Windows 10
|
||||||
- Windows 11
|
- Windows 11
|
||||||
|
|
||||||
Starting with Windows 10, version 1703, Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro or Windows 11 Pro to **Windows 10 Enterprise** or **Windows 11 Enterprise**, respectively, if they are subscribed to Windows 10/11 Enterprise E3 or E5.
|
Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro or Windows 11 Pro to **Windows 10 Enterprise** or **Windows 11 Enterprise**, respectively, if they are subscribed to Windows 10/11 Enterprise E3 or E5.
|
||||||
|
|
||||||
With Windows 10, version 1903 and later, the Subscription Activation feature also supports the ability to step-up from Windows 10 Pro Education or Windows 11 Pro Education to the Enterprise grade editions for educational institutions—**Windows 10 Education** or **Windows 11 Education**.
|
With Windows 10, version 1903 and later, the Subscription Activation feature also supports the ability to step-up from Windows 10 Pro Education or Windows 11 Pro Education to the Enterprise grade editions for educational institutions—**Windows 10 Education** or **Windows 11 Education**.
|
||||||
|
|
||||||
@ -44,9 +44,10 @@ For information on how to deploy Enterprise licenses, see [Deploy Windows 10/11
|
|||||||
|
|
||||||
## Subscription Activation for Windows 10/11 Enterprise
|
## Subscription Activation for Windows 10/11 Enterprise
|
||||||
|
|
||||||
With Windows 10, version 1703 and later both Windows 10/11 Enterprise E3 and Windows 10/11 Enterprise E5 are available as online services via subscription. Deploying Windows 10 Enterprise or Windows 11 Enterprise in your organization can now be accomplished with no keys and no reboots.
|
Windows 10/11 Enterprise E3 and Windows 10/11 Enterprise E5 are available as online services via subscription. Deploying Windows 10 Enterprise or Windows 11 Enterprise in your organization can now be accomplished with no keys and no reboots.
|
||||||
|
|
||||||
If you are running Windows 10, version 1703 or later:
|
If you are running Windows 10, version 1703 or later:
|
||||||
|
|
||||||
- Devices with a current Windows 10 Pro license or Windows 11 Pro license can be seamlessly upgraded to Windows 10 Enterprise or Windows 11 Enterprise, respectively.
|
- Devices with a current Windows 10 Pro license or Windows 11 Pro license can be seamlessly upgraded to Windows 10 Enterprise or Windows 11 Enterprise, respectively.
|
||||||
- Product key-based Windows 10 Enterprise or Windows 11 Enterprise software licenses can be transitioned to Windows 10 Enterprise and Windows 11 Enterprise subscriptions.
|
- Product key-based Windows 10 Enterprise or Windows 11 Enterprise software licenses can be transitioned to Windows 10 Enterprise and Windows 11 Enterprise subscriptions.
|
||||||
|
|
||||||
@ -109,8 +110,6 @@ An issue has been identified with Hybrid Azure AD joined devices that have enabl
|
|||||||
|
|
||||||
To resolve this issue:
|
To resolve this issue:
|
||||||
|
|
||||||
If the device is running Windows 10, version 1703, 1709, or 1803, the user must either sign in with an Azure AD account, or you must disable MFA for this user during the 30-day polling period and renewal.
|
|
||||||
|
|
||||||
If the device is running Windows 10, version 1809 or later:
|
If the device is running Windows 10, version 1809 or later:
|
||||||
|
|
||||||
- Windows 10, version 1809 must be updated with [KB4497934](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934). Later versions of Windows 10 automatically include this patch.
|
- Windows 10, version 1809 must be updated with [KB4497934](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934). Later versions of Windows 10 automatically include this patch.
|
||||||
@ -166,7 +165,7 @@ The IT administrator assigns Windows 10 Enterprise to a user. See the following
|
|||||||
|
|
||||||
When a licensed user signs in to a device that meets requirements using their Azure AD credentials, the operating system steps up from Windows 10 Pro to Windows 10 Enterprise (or Windows 10 Pro Education to Windows 10 Education) and all the appropriate Windows 10 Enterprise/Education features are unlocked. When a user’s subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro / Windows 10 Pro Education edition, once current subscription validity expires.
|
When a licensed user signs in to a device that meets requirements using their Azure AD credentials, the operating system steps up from Windows 10 Pro to Windows 10 Enterprise (or Windows 10 Pro Education to Windows 10 Education) and all the appropriate Windows 10 Enterprise/Education features are unlocked. When a user’s subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro / Windows 10 Pro Education edition, once current subscription validity expires.
|
||||||
|
|
||||||
Devices running Windows 10 Pro, version 1703 or Windows 10 Pro Education, version 1903 or later can get Windows 10 Enterprise or Education Semi-Annual Channel on up to five devices for each user covered by the license. This benefit does not include Long Term Servicing Channel.
|
Devices running Windows 10 Pro Education, version 1903 or later can get Windows 10 Enterprise or Education General Availability Channel on up to five devices for each user covered by the license. This benefit does not include Long Term Servicing Channel.
|
||||||
|
|
||||||
The following figures summarize how the Subscription Activation model works:
|
The following figures summarize how the Subscription Activation model works:
|
||||||
|
|
||||||
@ -192,18 +191,6 @@ All of your Windows 10 Pro devices will step-up to Windows 10 Enterprise, and de
|
|||||||
|
|
||||||
#### Scenario #2
|
#### Scenario #2
|
||||||
|
|
||||||
You are using Windows 10, version 1607, 1703, or 1709 with KMS for activation, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise).
|
|
||||||
|
|
||||||
To change all of your Windows 10 Pro devices to Windows 10 Enterprise, run the following command on each computer:
|
|
||||||
|
|
||||||
```console
|
|
||||||
cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
|
|
||||||
```
|
|
||||||
|
|
||||||
The command causes the OS to change to Windows 10 Enterprise and then seek out the KMS server to reactivate. This key comes from [Appendix A: KMS Client Setup Keys](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj612867(v=ws.11)) in the Volume Activation guide. It is also possible to inject the Windows 10 Pro key from this article if you wish to step back down from Enterprise to Pro.
|
|
||||||
|
|
||||||
#### Scenario #3
|
|
||||||
|
|
||||||
Using Azure AD-joined devices or Active Directory-joined devices running Windows 10 1709 or later, and with Azure AD synchronization configured, just follow the steps in [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) to acquire a $0 SKU and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. Then, assign that license to all of your Azure AD users. These can be AD-synced accounts. The device will automatically change from Windows 10 Pro to Windows 10 Enterprise when that user signs in.
|
Using Azure AD-joined devices or Active Directory-joined devices running Windows 10 1709 or later, and with Azure AD synchronization configured, just follow the steps in [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) to acquire a $0 SKU and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. Then, assign that license to all of your Azure AD users. These can be AD-synced accounts. The device will automatically change from Windows 10 Pro to Windows 10 Enterprise when that user signs in.
|
||||||
|
|
||||||
In summary, if you have a Windows 10 Enterprise E3 or E5 subscription, but are still running Windows 10 Pro, it’s really simple (and quick) to move to Windows 10 Enterprise using one of the scenarios above.
|
In summary, if you have a Windows 10 Enterprise E3 or E5 subscription, but are still running Windows 10 Pro, it’s really simple (and quick) to move to Windows 10 Enterprise using one of the scenarios above.
|
||||||
@ -231,7 +218,7 @@ If you are running Windows 10, version 1803 or later, Subscription Activation wi
|
|||||||
|
|
||||||
If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key.
|
If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key.
|
||||||
|
|
||||||
If the computer has never been activated with a Pro key, run the following script. Copy the text below into a .cmd file and run the file from an elevated command prompt:
|
If the computer has never been activated with a Pro key, run the following script. Copy the text below into a `.cmd` file, and run the file from an elevated command prompt:
|
||||||
|
|
||||||
```console
|
```console
|
||||||
@echo off
|
@echo off
|
||||||
@ -249,6 +236,12 @@ changepk.exe /ProductKey %ProductKey%
|
|||||||
)
|
)
|
||||||
```
|
```
|
||||||
|
|
||||||
|
Since [WMIC was deprecated](/windows/win32/wmisdk/wmic) in Windows 10, version 21H1, you can use the following Windows PowerShell script instead:
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
$(Get-WmiObject SoftwareLicensingService).OA3xOriginalProductKey | foreach{ if ( $null -ne $_ ) { Write-Host "Installing"$_;.\changepk.exe /Productkey $_ } else { Write-Host "No key present" } }
|
||||||
|
```
|
||||||
|
|
||||||
### Obtaining an Azure AD license
|
### Obtaining an Azure AD license
|
||||||
|
|
||||||
Enterprise Agreement/Software Assurance (EA/SA):
|
Enterprise Agreement/Software Assurance (EA/SA):
|
||||||
|
|||||||
@ -47,7 +47,7 @@ These are the things you'll need to complete this lab:
|
|||||||
|
|
||||||
| | Description |
|
| | Description |
|
||||||
|:---|:---|
|
|:---|:---|
|
||||||
|**Windows 10 installation media**|Windows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, semi-annual channel. If you don't already have an ISO to use, a link is provided to download an <a href="https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise" data-raw-source="[evaluation version of Windows 10 Enterprise](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise)">evaluation version of Windows 10 Enterprise</a>.|
|
|**Windows 10 installation media**|Windows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, General Availability Channel. If you don't already have an ISO to use, a link is provided to download an <a href="https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise" data-raw-source="[evaluation version of Windows 10 Enterprise](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise)">evaluation version of Windows 10 Enterprise</a>.|
|
||||||
|**Internet access**|If you're behind a firewall, see the detailed <a href="/mem/autopilot/software-requirements#networking-requirements" data-raw-source="[networking requirements](/mem/autopilot/software-requirements#networking-requirements)">networking requirements</a>. Otherwise, just ensure that you have a connection to the internet.|
|
|**Internet access**|If you're behind a firewall, see the detailed <a href="/mem/autopilot/software-requirements#networking-requirements" data-raw-source="[networking requirements](/mem/autopilot/software-requirements#networking-requirements)">networking requirements</a>. Otherwise, just ensure that you have a connection to the internet.|
|
||||||
|**Hyper-V or a physical device running Windows 10**|The guide assumes that you'll use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.|
|
|**Hyper-V or a physical device running Windows 10**|The guide assumes that you'll use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.|
|
||||||
|**An account with Azure Active Directory (AD) Premium license**|This guide will describe how to obtain a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.|
|
|**An account with Azure Active Directory (AD) Premium license**|This guide will describe how to obtain a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.|
|
||||||
|
|||||||
2
windows/manage/TOC.yml
Normal file
2
windows/manage/TOC.yml
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
- name: Test
|
||||||
|
href: test.md
|
||||||
19
windows/manage/test.md
Normal file
19
windows/manage/test.md
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
title: Test
|
||||||
|
description: Test
|
||||||
|
ms.prod: w11
|
||||||
|
ms.mktglfcycl: deploy
|
||||||
|
ms.sitesec: library
|
||||||
|
author: dstrome
|
||||||
|
ms.author: dstrome
|
||||||
|
ms.reviewer:
|
||||||
|
manager: dstrome
|
||||||
|
ms.topic: article
|
||||||
|
---
|
||||||
|
|
||||||
|
# Test
|
||||||
|
|
||||||
|
## Deployment planning
|
||||||
|
|
||||||
|
This article provides guidance to help you plan for Windows 11 in your organization.
|
||||||
|
|
||||||
@ -13,7 +13,7 @@ manager: dansimp
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.date: 09/08/2021
|
ms.date:
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
---
|
---
|
||||||
|
|
||||||
@ -34,7 +34,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
|||||||
You can learn more about Windows functional and diagnostic data through these articles:
|
You can learn more about Windows functional and diagnostic data through these articles:
|
||||||
|
|
||||||
- [Required Windows 11 diagnostic events and fields](required-windows-11-diagnostic-events-and-fields.md)
|
- [Required Windows 11 diagnostic events and fields](required-windows-11-diagnostic-events-and-fields.md)
|
||||||
- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
- [Windows 10, version 21H2, Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||||
- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
||||||
|
|||||||
@ -13,7 +13,7 @@ manager: dansimp
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.date: 09/08/2021
|
ms.date:
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
---
|
---
|
||||||
|
|
||||||
@ -34,7 +34,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
|||||||
You can learn more about Windows functional and diagnostic data through these articles:
|
You can learn more about Windows functional and diagnostic data through these articles:
|
||||||
|
|
||||||
- [Required Windows 11 diagnostic events and fields](required-windows-11-diagnostic-events-and-fields.md)
|
- [Required Windows 11 diagnostic events and fields](required-windows-11-diagnostic-events-and-fields.md)
|
||||||
- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
- [Windows 10, version 21H2, Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||||
- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
||||||
@ -3029,22 +3029,6 @@ The following fields are available:
|
|||||||
|
|
||||||
- **winInetError** The HResult of the operation.
|
- **winInetError** The HResult of the operation.
|
||||||
|
|
||||||
|
|
||||||
## Other events
|
|
||||||
|
|
||||||
### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties
|
|
||||||
|
|
||||||
This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management.
|
|
||||||
|
|
||||||
The following fields are available:
|
|
||||||
|
|
||||||
- **nodeId** The nodeTypeId concatenated with the hostname or IP address that gateway uses to connect to this node.
|
|
||||||
- **nodeOperatingSystem** A user friendly description of the node's OS version.
|
|
||||||
- **nodeOSVersion** A major or minor build version string for the node's OS.
|
|
||||||
- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyper-converged cluster.
|
|
||||||
- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string.
|
|
||||||
|
|
||||||
|
|
||||||
## Privacy logging notification events
|
## Privacy logging notification events
|
||||||
|
|
||||||
### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted
|
### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted
|
||||||
|
|||||||
@ -13,7 +13,7 @@ manager: dansimp
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.date: 09/08/2021
|
ms.date:
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
---
|
---
|
||||||
|
|
||||||
@ -34,7 +34,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
|||||||
You can learn more about Windows functional and diagnostic data through these articles:
|
You can learn more about Windows functional and diagnostic data through these articles:
|
||||||
|
|
||||||
- [Required Windows 11 diagnostic events and fields](required-windows-11-diagnostic-events-and-fields.md)
|
- [Required Windows 11 diagnostic events and fields](required-windows-11-diagnostic-events-and-fields.md)
|
||||||
- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
- [Windows 10, version 21H2, Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||||
- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
|
- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
|
||||||
@ -44,7 +44,6 @@ You can learn more about Windows functional and diagnostic data through these ar
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Appraiser events
|
## Appraiser events
|
||||||
|
|
||||||
### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
|
### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
|
||||||
@ -4370,14 +4369,6 @@ The following fields are available:
|
|||||||
|
|
||||||
## Other events
|
## Other events
|
||||||
|
|
||||||
### Microsoft.Surface.Battery.Prod.BatteryInfoEvent
|
|
||||||
|
|
||||||
This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly.
|
|
||||||
|
|
||||||
The following fields are available:
|
|
||||||
|
|
||||||
- **pszBatteryDataXml** Battery performance data.
|
|
||||||
- **szBatteryInfo** Battery performance data.
|
|
||||||
|
|
||||||
|
|
||||||
## Privacy consent logging events
|
## Privacy consent logging events
|
||||||
@ -5473,6 +5464,17 @@ The following fields are available:
|
|||||||
- **UpdateId** The update ID for a specific piece of content.
|
- **UpdateId** The update ID for a specific piece of content.
|
||||||
- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
|
- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
|
||||||
|
|
||||||
|
## Surface events
|
||||||
|
|
||||||
|
### Microsoft.Surface.Battery.Prod.BatteryInfoEvent
|
||||||
|
|
||||||
|
This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly.
|
||||||
|
|
||||||
|
The following fields are available:
|
||||||
|
|
||||||
|
- **pszBatteryDataXml** Battery performance data.
|
||||||
|
- **szBatteryInfo** Battery performance data.
|
||||||
|
|
||||||
|
|
||||||
## Update Assistant events
|
## Update Assistant events
|
||||||
|
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user