mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge branch 'main' into nimishasatapathy-5825705-part2
This commit is contained in:
Alekhya Jupudi
GitHub
commit
d4978469aa
@ -33,7 +33,7 @@
|
||||
"ms.technology": "microsoft-edge",
|
||||
"audience": "ITPro",
|
||||
"ms.topic": "article",
|
||||
"manager": "laurawi",
|
||||
"manager": "dansimp",
|
||||
"ms.prod": "edge",
|
||||
"feedback_system": "None",
|
||||
"hideEdit": true,
|
||||
|
||||
@ -48,8 +48,6 @@ landingContent:
|
||||
links:
|
||||
- text: Test your site on Microsoft Edge for free on BrowserStack
|
||||
url: https://developer.microsoft.com/microsoft-edge/tools/remote/
|
||||
- text: Use sonarwhal to improve your website
|
||||
url: https://sonarwhal.com/
|
||||
|
||||
# Card (optional)
|
||||
- title: Improve compatibility with Enterprise Mode
|
||||
@ -126,10 +124,8 @@ landingContent:
|
||||
url: ./edge-technical-demos.md
|
||||
- linkListType: how-to-guide
|
||||
links:
|
||||
- text: Import bookmarks
|
||||
url: https://microsoftedgetips.microsoft.com/2/39
|
||||
- text: Password management
|
||||
url: https://microsoftedgetips.microsoft.com/2/18
|
||||
- text: Microsoft Edge features and tips
|
||||
url: https://microsoftedgetips.microsoft.com
|
||||
|
||||
# Card (optional)
|
||||
- title: Stay informed
|
||||
|
||||
@ -30,7 +30,7 @@
|
||||
"ms.technology": "internet-explorer",
|
||||
"ms.prod": "ie11",
|
||||
"ms.topic": "article",
|
||||
"manager": "laurawi",
|
||||
"manager": "dansimp",
|
||||
"ms.date": "04/05/2017",
|
||||
"feedback_system": "None",
|
||||
"hideEdit": true,
|
||||
|
||||
@ -35,7 +35,7 @@ If you don't want to use the Enterprise Mode Site List Manager, you also have th
|
||||
The following is an example of the Enterprise Mode schema v.1. This schema can run on devices running Windows 7 and Windows 8.1.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Make sure that you don't specify a protocol when adding your URLs. Using a URL like `<domain>contoso.com</domain>` automatically applies to both http://contoso.com and https://contoso.com.
|
||||
> Make sure that you don't specify a protocol when adding your URLs. Using a URL like `<domain>contoso.com</domain>` automatically applies to both `http://contoso.com` and `https://contoso.com`.
|
||||
|
||||
```xml
|
||||
<rules version="1">
|
||||
@ -71,7 +71,7 @@ This table includes the elements used by the Enterprise Mode schema.
|
||||
|<emie> |The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied. <br> **Example** <pre class="syntax"><rules version="205"> <br> <emie> <br> <domain>contoso.com</domain> <br> </emie><br></rules> <br> </pre><p> **or** <br> For IPv6 ranges: <pre class="syntax"><br><rules version="205"> <br> <emie> <br> <domain>[10.122.34.99]:8080</domain> <br> </emie><br></rules> </pre><p> <br> **or**<br> For IPv4 ranges:<pre class="syntax"><rules version="205"> <br> <emie> <br> <domain>[10.122.34.99]:8080</domain> <br> </emie><br></rules> | Internet Explorer 11 and Microsoft Edge |
|
||||
|<docMode> |The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the docMode section that uses the same value as a <domain> element in the emie section, the emie element is applied. <br> **Example** <pre class="syntax"> <br/><rules version="205"> <br> <docmode> <br> <domain docMode="7">contoso.com</domain> <br> </docmode><br></rules> |Internet Explorer 11 |
|
||||
|<domain> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element. <br> **Example** <pre class="syntax"> <br/><emie> <br> <domain>contoso.com:8080</domain><br></emie> |Internet Explorer 11 and Microsoft Edge |
|
||||
|<path> |A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section.<br> **Example** <pre class="syntax"> <br/><emie> <br> <domain exclude="true">fabrikam.com <br> <path exclude="false">/products</path><br> </domain><br></emie></pre><p> <br> Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does. |Internet Explorer 11 and Microsoft Edge |
|
||||
|<path> |A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section.<br> **Example** <pre class="syntax"> <br/><emie> <br> <domain exclude="true">fabrikam.com <br> <path exclude="false">/products</path><br> </domain><br></emie></pre><p> <br> Where `https://fabrikam.com` doesn't use IE8 Enterprise Mode, but `https://fabrikam.com/products` does. |Internet Explorer 11 and Microsoft Edge |
|
||||
|
||||
### Schema attributes
|
||||
This table includes the attributes used by the Enterprise Mode schema.
|
||||
@ -79,10 +79,10 @@ This table includes the attributes used by the Enterprise Mode schema.
|
||||
|Attribute|Description|Supported browser|
|
||||
|--- |--- |--- |
|
||||
|version|Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.|Internet Explorer 11 and Microsoft Edge|
|
||||
|exclude|Specifies the domain or path that is excluded from getting the behavior applied. This attribute is supported on the <domain> and <path> elements.<br> **Example** <pre class="syntax"><emie><br> <domain exclude="false">fabrikam.com <br> <path exclude="true">/products</path><br> </domain><br></emie> </pre><p> Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does.|Internet Explorer 11 and Microsoft Edge|
|
||||
|exclude|Specifies the domain or path that is excluded from getting the behavior applied. This attribute is supported on the <domain> and <path> elements.<br> **Example** <pre class="syntax"><emie><br> <domain exclude="false">fabrikam.com <br> <path exclude="true">/products</path><br> </domain><br></emie> </pre><p> Where `https://fabrikam.com` doesn't use IE8 Enterprise Mode, but `https://fabrikam.com/products` does.|Internet Explorer 11 and Microsoft Edge|
|
||||
|docMode|Specifies the document mode to apply. This attribute is only supported on <domain> or <path>elements in the <docMode> section.<br> **Example**<pre class="syntax"><docMode> <br> <domain exclude="false">fabrikam.com <br> <path docMode="9">/products</path><br> </domain><br></docMode>|Internet Explorer 11|
|
||||
|doNotTransition| Specifies that the page should load in the current browser, otherwise it will open in IE11. This attribute is supported on all <domain> or <path> elements. If this attribute is absent, it defaults to false.<br> **Example**<pre class="syntax"><emie><br> <domain doNotTransition="false">fabrikam.com <br> <path doNotTransition="true">/products</path><br> </domain><br></emie></pre><p>Where [https://fabrikam.com](https://fabrikam.com) opens in the IE11 browser, but [https://fabrikam.com/products](https://fabrikam.com/products) loads in the current browser (eg. Microsoft Edge)|Internet Explorer 11 and Microsoft Edge|
|
||||
|forceCompatView|Specifies that the page should load in IE7 document mode (Compat View). This attribute is only supported on <domain> or <path> elements in the <emie> section. If the page is also configured to load in Enterprise Mode, it will load in IE7 Enterprise Mode. Otherwise (exclude="true"), it will load in IE11's IE7 document mode. If this attribute is absent, it defaults to false. <br> **Example**<pre class="syntax"><emie><br> <domain exclude="true">fabrikam.com <br> <path forcecompatview="true">/products</path><br> </domain><br></emie></pre><p>Where [https://fabrikam.com](https://fabrikam.com) does not use Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) uses IE7 Enterprise Mode.|Internet Explorer 11|
|
||||
|doNotTransition| Specifies that the page should load in the current browser, otherwise it will open in IE11. This attribute is supported on all <domain> or <path> elements. If this attribute is absent, it defaults to false.<br> **Example**<pre class="syntax"><emie><br> <domain doNotTransition="false">fabrikam.com <br> <path doNotTransition="true">/products</path><br> </domain><br></emie></pre><p>Where `https://fabrikam.com` opens in the IE11 browser, but `https://fabrikam.com/products` loads in the current browser (eg. Microsoft Edge)|Internet Explorer 11 and Microsoft Edge|
|
||||
|forceCompatView|Specifies that the page should load in IE7 document mode (Compat View). This attribute is only supported on <domain> or <path> elements in the <emie> section. If the page is also configured to load in Enterprise Mode, it will load in IE7 Enterprise Mode. Otherwise (exclude="true"), it will load in IE11's IE7 document mode. If this attribute is absent, it defaults to false. <br> **Example**<pre class="syntax"><emie><br> <domain exclude="true">fabrikam.com <br> <path forcecompatview="true">/products</path><br> </domain><br></emie></pre><p>Where `https://fabrikam.com` does not use Enterprise Mode, but `https://fabrikam.com/products` uses IE7 Enterprise Mode.|Internet Explorer 11|
|
||||
|
||||
### Using Enterprise Mode and document mode together
|
||||
If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain.
|
||||
|
||||
@ -45,7 +45,7 @@ You can continue to use the v.1 version of the schema on Windows 10, but you wo
|
||||
The following is an example of the v.2 version of the Enterprise Mode schema.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Make sure that you don't specify a protocol when adding your URLs. Using a URL like `<url="contoso.com">`, automatically applies to both http://contoso.com and https://contoso.com.
|
||||
> Make sure that you don't specify a protocol when adding your URLs. Using a URL like `<url="contoso.com">`, automatically applies to both `http://contoso.com` and `https://contoso.com`.
|
||||
|
||||
```xml
|
||||
<site-list version="205">
|
||||
@ -109,9 +109,9 @@ The <url> attribute, as part of the <site> element in the v.2 versio
|
||||
|
||||
|Attribute|Description|Supported browser|
|
||||
|---------|---------|---------|
|
||||
|allow-redirect|A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).<br>**Example**<pre class="syntax"><site url="contoso.com/travel"><br> <open-in allow-redirect="true">IE11 </open-in><br></site></pre> In this example, if [https://contoso.com/travel](https://contoso.com/travel) is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer. <li>| Internet Explorer 11 and Microsoft Edge|
|
||||
|allow-redirect|A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).<br>**Example**<pre class="syntax"><site url="contoso.com/travel"><br> <open-in allow-redirect="true">IE11 </open-in><br></site></pre> In this example, if `https://contoso.com/travel` is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer. | Internet Explorer 11 and Microsoft Edge|
|
||||
|version |Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element. | Internet Explorer 11 and Microsoft Edge|
|
||||
|url|Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.<br> **Note**<br> Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both [https://contoso.com](https://contoso.com) and [https://contoso.com](https://contoso.com). <br> **Example**<pre class="syntax"><site url="contoso.com:8080"><br> <compat-mode>IE8Enterprise</compat-mode> <br> <open-in>IE11</open-in><br></site></pre>In this example, going to [https://contoso.com:8080](https://contoso.com:8080) using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode. | Internet Explorer 11 and Microsoft Edge|
|
||||
|url|Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.<br> **Note**<br> Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both `http://contoso.com` and `https://contoso.com`. <br> **Example**<pre class="syntax"><site url="contoso.com:8080"><br> <compat-mode>IE8Enterprise</compat-mode> <br> <open-in>IE11</open-in><br></site></pre>In this example, going to `https://contoso.com:8080` using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode. | Internet Explorer 11 and Microsoft Edge|
|
||||
|
||||
### Deprecated attributes
|
||||
These v.1 version schema attributes have been deprecated in the v.2 version of the schema:
|
||||
|
||||
@ -47,7 +47,7 @@ For more info about this, see [Deploy and configure apps](/mem/intune/).
|
||||
|
||||
2. Any employee in the assigned group can now install the package.
|
||||
|
||||
For more info about this, see [Update apps using Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=301808)
|
||||
For more info about this, see [Update apps using Microsoft Intune](/mem/intune/apps/apps-windows-10-app-deploy)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -42,7 +42,7 @@ RIES does not:
|
||||
|
||||
- Affect the applied Administrative Template Group Policy settings.
|
||||
|
||||
RIES turns off all custom toolbars, browser extensions, and customizations installed with IE11. If you change your mind, you can turn each of the customizations back on through the **Manage Add-ons** dialog box. For more information about resetting IE settings, see [How to Reset Internet Explorer Settings](https://go.microsoft.com/fwlink/p/?LinkId=214528).
|
||||
RIES turns off all custom toolbars, browser extensions, and customizations installed with IE11. If you change your mind, you can turn each of the customizations back on through the **Manage Add-ons** dialog box. For more information about resetting IE settings, see [How to Reset Internet Explorer Settings](https://support.microsoft.com/windows/change-or-reset-internet-explorer-settings-2d4bac50-5762-91c5-a057-a922533f77d5).
|
||||
|
||||
## IE is crashing or seems slow
|
||||
If you notice that CPU usage is running higher than normal, or that IE is frequently crashing or slowing down, you should check your browser add-ons and video card. By default, IE11 uses graphics processing unit (GPU) rendering mode. However, some outdated video cards and video drivers don't support GPU hardware acceleration. If IE11 determines that your current video card or video driver doesn't support GPU hardware acceleration, it'll use Software Rendering mode.
|
||||
|
||||
@ -27,7 +27,7 @@ We strongly suggest that while you're using virtualization, you also update your
|
||||
|
||||
The Microsoft-supported options for virtualizing web apps are:
|
||||
|
||||
- **Microsoft Enterprise Desktop Virtualization (MED-V).** Uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. With MED-V, you can easily create, deliver, and manage corporate Virtual PC images on any Windows®-based desktop. For more information, see [MED-V](https://go.microsoft.com/fwlink/p/?LinkId=271653).
|
||||
- **Microsoft Enterprise Desktop Virtualization (MED-V).** Uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. With MED-V, you can easily create, deliver, and manage corporate Virtual PC images on any Windows®-based desktop. For more information, see [MED-V](/microsoft-desktop-optimization-pack/medv-v2/).
|
||||
|
||||
- **Client Hyper-V.** Uses the same virtualization technology previously available in Windows Server, but now installed for Windows 8.1. For more information, see [Client Hyper-V](/previous-versions/windows/it-pro/windows-8.1-and-8/hh857623(v=ws.11)).<p>
|
||||
For more information about virtualization options, see [Microsoft Desktop Virtualization](https://go.microsoft.com/fwlink/p/?LinkId=271662).
|
||||
|
||||
@ -83,7 +83,7 @@ sections:
|
||||
- question: |
|
||||
What test tools exist to test for potential application compatibility issues?
|
||||
answer: |
|
||||
The Compat Inspector tool supports Windows Internet Explorer 9 through IE11. For more information, see [Compat Inspector User Guide](https://go.microsoft.com/fwlink/p/?LinkId=313189). In addition, you can use the new [F12 Developer Tools](/previous-versions/windows/internet-explorer/ie-developer/dev-guides/bg182632(v=vs.85)) that are included with IE11, or the [modern.ie](https://go.microsoft.com/fwlink/p/?linkid=308902) website for Microsoft Edge.
|
||||
The Compat Inspector tool supports Windows Internet Explorer 9 through IE11. For more information, see [Compat Inspector User Guide](https://testdrive-archive.azurewebsites.net/html5/compatinspector/help/post.htm). In addition, you can use the new [F12 Developer Tools](/previous-versions/windows/internet-explorer/ie-developer/dev-guides/bg182632(v=vs.85)) that are included with IE11, or the [modern.ie](https://go.microsoft.com/fwlink/p/?linkid=308902) website for Microsoft Edge.
|
||||
|
||||
- question: |
|
||||
Why am I having problems launching my legacy apps with Internet Explorer 11?
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 07/27/2017
|
||||
|
||||
[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)]
|
||||
|
||||
Internet Explorer lets websites advertise any search provider that uses the open search standard described at the A9 website ( [OpenSearch 1.1 Draft 5](https://go.microsoft.com/fwlink/p/?LinkId=208582)). When IE detects new search providers, the **Search** box becomes active and adds the new providers to the drop-down list of providers.
|
||||
Internet Explorer lets websites advertise any search provider that uses the open search standard described at the A9 website ([OpenSearch 1.1 Draft 5](https://opensearch.org/docs/latest/opensearch/index/)). When IE detects new search providers, the **Search** box becomes active and adds the new providers to the drop-down list of providers.
|
||||
|
||||
Using the **Administrative Templates** section of Group Policy, you can prevent the search box from appearing, you can add a list of acceptable search providers, or you can restrict your employee’s ability to add or remove search providers.
|
||||
|
||||
|
||||
@ -39,8 +39,6 @@ These command-line options work with IExpress:<br>
|
||||
|`/r:a` |Always restarts the computer after installation. |
|
||||
|`/r:s` |Restarts the computer after installation without prompting the employee. |
|
||||
|
||||
For more information, see [Command-line switches for IExpress software update packages](https://go.microsoft.com/fwlink/p/?LinkId=317973).
|
||||
|
||||
## Related topics
|
||||
- [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md)
|
||||
- [Internet Explorer Setup command-line options and return codes](ie-setup-command-line-options-and-return-codes.md)
|
||||
|
||||
@ -35,7 +35,7 @@
|
||||
"ms.technology": "windows",
|
||||
"ms.topic": "article",
|
||||
"audience": "ITPro",
|
||||
"manager": "laurawi",
|
||||
"manager": "dansimp",
|
||||
"ms.date": "04/05/2017",
|
||||
"feedback_system": "GitHub",
|
||||
"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
|
||||
|
||||
@ -30,7 +30,7 @@
|
||||
"ms.technology": "windows",
|
||||
"audience": "ITPro",
|
||||
"ms.topic": "article",
|
||||
"manager": "laurawi",
|
||||
"manager": "dansimp",
|
||||
"ms.mktglfcycl": "manage",
|
||||
"ms.sitesec": "library",
|
||||
"ms.date": "05/23/2017",
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
"ms.technology": "windows",
|
||||
"audience": "ITPro",
|
||||
"ms.topic": "article",
|
||||
"manager": "laurawi",
|
||||
"manager": "dansimp",
|
||||
"ms.date": "05/09/2017",
|
||||
"feedback_system": "GitHub",
|
||||
"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
|
||||
|
||||
@ -31,7 +31,7 @@
|
||||
"audience": "windows-education",
|
||||
"ms.topic": "article",
|
||||
"ms.technology": "windows",
|
||||
"manager": "laurawi",
|
||||
"manager": "dansimp",
|
||||
"audience": "ITPro",
|
||||
"breadcrumb_path": "/education/breadcrumb/toc.json",
|
||||
"ms.date": "05/09/2017",
|
||||
|
||||
@ -2,6 +2,15 @@
|
||||
|
||||
|
||||
|
||||
## Week of April 25, 2022
|
||||
|
||||
|
||||
| Published On |Topic title | Change |
|
||||
|------|------------|--------|
|
||||
| 4/25/2022 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified |
|
||||
| 4/25/2022 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified |
|
||||
|
||||
|
||||
## Week of April 18, 2022
|
||||
|
||||
|
||||
|
||||
@ -642,7 +642,7 @@ Several methods are available to bulk-import user accounts into AD DS domains. T
|
||||
|Method |Description and reason to select this method |
|
||||
|-------|---------------------------------------------|
|
||||
|Ldifde.exe|This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren't comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)).|
|
||||
|VBScript|This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)) and [ADSI Scriptomatic](https://technet.microsoft.com/scriptcenter/dd939958.aspx).|
|
||||
|VBScript|This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)).|
|
||||
|Windows PowerShell|This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Windows PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).|
|
||||
|
||||
*Table 12. AD DS bulk-import account methods*
|
||||
|
||||
@ -36,7 +36,7 @@ Teachers and IT administrators can now get early access to **Minecraft: Educatio
|
||||
- **Minecraft: Education Edition** requires Windows 10.
|
||||
- Trials or subscriptions of **Minecraft: Education Edition** are offered to education tenants that are managed by Azure Active Directory (Azure AD).
|
||||
- If your school doesn't have an Azure AD tenant, the [IT administrator can set one up](school-get-minecraft.md) as part of the process of getting **Minecraft: Education Edition**.
|
||||
- Office 365 Education, which includes online versions of Office apps plus 1 TB online storage. [Sign up your school for Office 365 Education.](https://products.office.com/academic/office-365-education-plan)
|
||||
- Office 365 Education, which includes online versions of Office apps plus 1 TB online storage. [Sign up your school for Office 365 Education.](https://www.microsoft.com/education/products/office)
|
||||
- If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](/windows/client-management/mdm/register-your-free-azure-active-directory-subscription)
|
||||
|
||||
<!--  -->
|
||||
|
||||
@ -2,21 +2,10 @@
|
||||
|
||||
|
||||
|
||||
## Week of December 13, 2021
|
||||
## Week of April 25, 2022
|
||||
|
||||
|
||||
| Published On |Topic title | Change |
|
||||
|------|------------|--------|
|
||||
| 12/13/2021 | [Microsoft Store for Business and Education release history](/microsoft-store/release-history-microsoft-store-business-education) | modified |
|
||||
| 12/13/2021 | [Change history for Microsoft Store for Business and Education](/microsoft-store/sfb-change-history) | modified |
|
||||
| 12/14/2021 | [Manage user accounts in Microsoft Store for Business and Microsoft Store for Education (Windows 10)](/microsoft-store/manage-users-and-groups-microsoft-store-for-business) | modified |
|
||||
| 12/14/2021 | [Troubleshoot Microsoft Store for Business (Windows 10)](/microsoft-store/troubleshoot-microsoft-store-for-business) | modified |
|
||||
|
||||
|
||||
## Week of November 15, 2021
|
||||
|
||||
|
||||
| Published On |Topic title | Change |
|
||||
|------|------------|--------|
|
||||
| 11/16/2021 | [Microsoft Store for Business and Microsoft Store for Education overview (Windows 10)](/microsoft-store/microsoft-store-for-business-overview) | modified |
|
||||
| 11/19/2021 | [Microsoft Store for Business and Microsoft Store for Education overview (Windows 10)](/microsoft-store/microsoft-store-for-business-overview) | modified |
|
||||
| 4/28/2022 | [Prerequisites for Microsoft Store for Business and Education (Windows 10)](/microsoft-store/prerequisites-microsoft-store-for-business) | modified |
|
||||
| 4/28/2022 | [Prerequisites for Microsoft Store for Business and Education (Windows 10)](/microsoft-store/prerequisites-microsoft-store-for-business) | modified |
|
||||
|
||||
@ -59,17 +59,17 @@ While not required, you can use a management tool to distribute and manage apps.
|
||||
|
||||
If your organization restricts computers on your network from connecting to the Internet, there is a set of URLs that need to be available for devices to use Microsoft Store. Some of the Microsoft Store features use Store services. Devices using Microsoft Store – either to acquire, install, or update apps – will need access to these URLs. If you use a proxy server to block traffic, your configuration needs to allow these URLs:
|
||||
|
||||
- login.live.com
|
||||
- login.windows.net
|
||||
- account.live.com
|
||||
- clientconfig.passport.net
|
||||
- windowsphone.com
|
||||
- \*.wns.windows.com
|
||||
- \*.microsoft.com
|
||||
- \*.s-microsoft.com
|
||||
- www.msftncsi.com (prior to Windows 10, version 1607)
|
||||
- www.msftconnecttest.com/connecttest.txt (replaces www.msftncsi.com
|
||||
- `login.live.com`
|
||||
- `login.windows.net`
|
||||
- `account.live.com`
|
||||
- `clientconfig.passport.net`
|
||||
- `windowsphone.com`
|
||||
- `\*.wns.windows.com`
|
||||
- `\*.microsoft.com`
|
||||
- `\*.s-microsoft.com`
|
||||
- `www.msftncsi.com` (prior to Windows 10, version 1607)
|
||||
- `www.msftconnecttest.com/connecttest.txt` (replaces `www.msftncsi.com`
|
||||
starting with Windows 10, version 1607)
|
||||
|
||||
Store for Business requires Microsoft Windows HTTP Services (WinHTTP) to install, or update apps.
|
||||
For more information about how to configure WinHTTP proxy settings to devices, see [Use Group Policy to apply WinHTTP proxy settings to Windows clients](https://support.microsoft.com/help/4494447/use-group-policy-to-apply-winhttp-proxy-settings-to-clients).
|
||||
|
||||
|
||||
@ -423,7 +423,7 @@ This section describes the requirements and options for deploying Visio 2013 and
|
||||
### Additional resources for Connection Groups
|
||||
|
||||
* [Managing Connection Groups](appv-managing-connection-groups.md)
|
||||
* [Connection groups on the App-V team blog](https://blogs.msdn.microsoft.com/gladiator/tag/connection-groups/)
|
||||
* [Connection groups on the App-V team blog](/archive/blogs/gladiator/app-v-5-more-on-connection-groups)
|
||||
|
||||
### Additional resources for Dynamic Configuration
|
||||
|
||||
|
||||
@ -350,8 +350,6 @@ Server Performance Tuning Guidelines for
|
||||
|
||||
**Windows Client (Guest OS) Performance Tuning Guidance**
|
||||
|
||||
- [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx)
|
||||
|
||||
- [Optimization Script: (Provided by Microsoft Support)](/archive/blogs/jeff_stokes/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density)
|
||||
|
||||
- [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf)
|
||||
|
||||
@ -28,9 +28,9 @@ The following list displays the end–to-end high-level workflow for reporting i
|
||||
* Windows Authentication role (under **IIS / Security**)
|
||||
* SQL Server installed and running with SQL Server Reporting Services (SSRS)
|
||||
|
||||
To confirm SQL Server Reporting Services is running, enter <https://localhost/Reports> in a web browser as administrator on the server that will host App-V Reporting. The SQL Server Reporting Services Home page should appear.
|
||||
To confirm SQL Server Reporting Services is running, enter `https://localhost/Reports` in a web browser as administrator on the server that will host App-V Reporting. The SQL Server Reporting Services Home page should appear.
|
||||
2. Install the App-V reporting server and associated database. For more information about installing the reporting server see [How to install the Reporting Server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md). Configure the time when the computer running the App-V client should send data to the reporting server.
|
||||
3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at [Application Virtualization SSRS Reports](https://www.microsoft.com/download/details.aspx?id=42630).
|
||||
3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service.
|
||||
|
||||
> [!NOTE]
|
||||
>If you are using the Configuration Manager integration with App-V, most reports are generated from Configuration Manager rather than from App-V.
|
||||
|
||||
@ -19,13 +19,6 @@ ms.author: aaroncz
|
||||
|
||||
This topic provides information about using the Application Virtualization (App-V) client management console to manage packages on the computer running the App-V client.
|
||||
|
||||
## Obtain the client management console
|
||||
|
||||
The client management console is separate from the App-V client itself. You can download the client management console from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=41186).
|
||||
|
||||
> [!NOTE]
|
||||
> To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V client.
|
||||
|
||||
## Options for managing the App-V client
|
||||
|
||||
The App-V client has associated settings that can be configured to determine how the client will run in your environment. You can manage these settings on the computer that runs the client, or you can use Windows PowerShell or Group Policy. For more information about configuring the client by using Windows PowerShell or Group Policy, see:
|
||||
|
||||
@ -47,16 +47,8 @@ You can use the same management tools to manage all device types running Windows
|
||||
|
||||
[Microsoft Intune End User Enrollment Guide](/samples/browse/?redirectedfrom=TechNet-Gallery)
|
||||
|
||||
[Azure AD Join on Windows 10 (and Windows 11) devices](https://go.microsoft.com/fwlink/p/?LinkId=616791)
|
||||
|
||||
[Azure AD support for Windows 10 (and Windows 11)](https://go.microsoft.com/fwlink/p/?LinkID=615765)
|
||||
|
||||
[Windows 10 (and Windows 11) and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768)
|
||||
|
||||
[How to manage Windows 10 (and Windows 11) devices using Intune](https://go.microsoft.com/fwlink/p/?LinkId=613620)
|
||||
|
||||
[Using Intune alone and with Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=613207)
|
||||
|
||||
Microsoft Virtual Academy course: [System Center 2012 R2 Configuration Manager & Windows Intune](/learn/)
|
||||
|
||||
|
||||
|
||||
@ -135,6 +135,6 @@ There are a variety of steps you can take to begin the process of modernizing de
|
||||
|
||||
## Related topics
|
||||
|
||||
- [What is Intune?](//mem/intune/fundamentals/what-is-intune)
|
||||
- [What is Intune?](/mem/intune/fundamentals/what-is-intune)
|
||||
- [Windows 10 Policy CSP](./mdm/policy-configuration-service-provider.md)
|
||||
- [Windows 10 Configuration service Providers](./mdm/configuration-service-provider-reference.md)
|
||||
|
||||
@ -24,7 +24,7 @@ This CSP was added in Windows 10, version 1511.
|
||||
|
||||
|
||||
|
||||
For the firewall settings, note that PublicProfile and PrivateProfile are mutually exclusive. The Private Profile must be set on the directly on the device itself, and the only supported operation is Get. For PublicProfile, both Add and Get are supported. This CSP is intended to be used in conjunction with the AllJoyn Device System Bridge, and an understanding of the bridge will help when determining when and how to use this CSP. For more information, see [Device System Bridge (DSB) Project](https://go.microsoft.com/fwlink/p/?LinkId=615876) and [AllJoyn Device System Bridge](https://go.microsoft.com/fwlink/p/?LinkId=615877).
|
||||
For the firewall settings, note that PublicProfile and PrivateProfile are mutually exclusive. The Private Profile must be set on the directly on the device itself, and the only supported operation is Get. For PublicProfile, both Add and Get are supported. This CSP is intended to be used in conjunction with the AllJoyn Device System Bridge, and an understanding of the bridge will help when determining when and how to use this CSP. For more information, see [Device System Bridge (DSB)](https://wikipedia.org/wiki/AllJoyn). For more information, see [AllJoyn - Wikipedia](https://wikipedia.org/wiki/AllJoyn).
|
||||
|
||||
The following shows the AllJoynManagement configuration service provider in tree format
|
||||
|
||||
|
||||
@ -378,9 +378,10 @@ Additional claims may be present in the Azure AD token, such as:
|
||||
|
||||
Access tokens issued by Azure AD are JSON web tokens (JWTs). A valid JWT token is presented by Windows at the MDM enrollment endpoint to start the enrollment process. There are a couple of options to evaluate the tokens:
|
||||
|
||||
- Use the JWT Token Handler extension for WIF to validate the contents of the access token and extract claims required for use. For more information, see [JSON Web Token Handler](/previous-versions/dotnet/framework/security/json-web-token-handler).
|
||||
- Use the JWT Token Handler extension for WIF to validate the contents of the access token and extract claims required for use. For more information, see [JwtSecurityTokenHandler Class](/dotnet/api/system.identitymodel.tokens.jwt.jwtsecuritytokenhandler).
|
||||
- Refer to the Azure AD authentication code samples to get a sample for working with access tokens. For an example, see [NativeClient-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613667).
|
||||
|
||||
|
||||
## Device Alert 1224 for Azure AD user token
|
||||
|
||||
An alert is sent when the DM session starts and there's an Azure AD user logged in. The alert is sent in OMA DM pkg\#1. Here's an example:
|
||||
|
||||
@ -225,7 +225,7 @@ This article lists new and updated articles for the Mobile Device Management (MD
|
||||
|New or updated article|Description|
|
||||
|--- |--- |
|
||||
|[WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)|Added the following node in Windows 10, version 1803:<li>Settings/AllowVirtualGPU<li>Settings/SaveFilesToHost|
|
||||
|[NetworkProxy CSP](\networkproxy--csp.md)|Added the following node in Windows 10, version 1803:<li>ProxySettingsPerUser|
|
||||
|[NetworkProxy CSP](networkproxy-csp.md)|Added the following node in Windows 10, version 1803:<li>ProxySettingsPerUser|
|
||||
|[Accounts CSP](accounts-csp.md)|Added a new CSP in Windows 10, version 1803.|
|
||||
|[MDM Migration Analysis Tool (MMAT)](https://aka.ms/mmat)|Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.|
|
||||
|[CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download)|Added the DDF download of Windows 10, version 1803 configuration service providers.|
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: dansimp
|
||||
ms.date: 03/02/2022
|
||||
ms.date: 04/30/2022
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.collection: highpri
|
||||
@ -18,7 +18,7 @@ ms.collection: highpri
|
||||
|
||||
- Windows 10
|
||||
|
||||
Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices.
|
||||
Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to Mobile Device Management (MDM) for Active Directory (AD) domain-joined devices.
|
||||
|
||||
The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Azure AD account.
|
||||
|
||||
@ -42,9 +42,9 @@ The auto-enrollment relies on the presence of an MDM service and the Azure Activ
|
||||
|
||||
When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. If multi-factor authentication is required, the user will get a prompt to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page.
|
||||
|
||||
In Windows 10, version 1709 or later, when the same policy is configured in GP and MDM, the GP policy wins (GP policy takes precedence over MDM). Since Windows 10, version 1803, a new setting allows you to change the policy conflict winner to MDM. For additional information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](/archive/blogs/cbernier/windows-10-group-policy-vs-intune-mdm-policy-who-wins)
|
||||
In Windows 10, version 1709 or later, when the same policy is configured in Group Policy and MDM, Group Policy policy takes precedence over MDM. Since Windows 10, version 1803, a new setting allows you to change precedence to MDM. For additional information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](/archive/blogs/cbernier/windows-10-group-policy-vs-intune-mdm-policy-who-wins)
|
||||
|
||||
For this policy to work, you must verify that the MDM service provider allows the GP triggered MDM enrollment for domain joined devices.
|
||||
For this policy to work, you must verify that the MDM service provider allows Group Policy initiated MDM enrollment for domain-joined devices.
|
||||
|
||||
## Verify auto-enrollment requirements and settings
|
||||
|
||||
@ -60,12 +60,13 @@ The following steps demonstrate required settings using the Intune service:
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled.
|
||||
> For bring-your-own devices (BYOD devices), the Mobile Application Management (MAM) user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled.
|
||||
>
|
||||
> For corporate devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled.
|
||||
> For corporate-owned devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled.
|
||||
|
||||
3. Verify that the device OS version is Windows 10, version 1709 or later.
|
||||
4. Auto-enrollment into Intune via Group Policy is valid only for devices which are hybrid Azure AD joined. This means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line.
|
||||
|
||||
4. Auto-enrollment into Intune via Group Policy is valid only for devices which are hybrid Azure AD joined. The device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line.
|
||||
|
||||
You can confirm that the device is properly hybrid-joined if both **AzureAdJoined** and **DomainJoined** are set to **YES**.
|
||||
|
||||
@ -87,7 +88,7 @@ The following steps demonstrate required settings using the Intune service:
|
||||
|
||||
:::image type="content" alt-text="Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png":::
|
||||
|
||||
7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices which should be enrolled into Intune.
|
||||
7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor** > **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM**) is properly deployed to all devices which should be enrolled into Intune.
|
||||
You may contact your domain administrators to verify if the group policy has been deployed successfully.
|
||||
|
||||
8. Verify that the device is not enrolled with the old Intune client used on the Intune Silverlight Portal (this is the Intune portal used before the Azure portal).
|
||||
@ -105,35 +106,31 @@ Requirements:
|
||||
- Enterprise has MDM service already configured
|
||||
- Enterprise AD must be registered with Azure AD
|
||||
|
||||
1. Run GPEdit.msc
|
||||
|
||||
Click Start, then in the text box type gpedit.
|
||||
1. Run `GPEdit.msc`. Choose **Start**, then in the text box type `gpedit`.
|
||||
|
||||
|
||||
|
||||
2. Under **Best match**, click **Edit group policy** to launch it.
|
||||
2. Under **Best match**, select **Edit group policy** to launch it.
|
||||
|
||||
3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**.
|
||||
3. In **Local Computer Policy**, select **Administrative Templates** > **Windows Components** > **MDM**.
|
||||
|
||||
:::image type="content" alt-text="MDM policies." source="images/autoenrollment-mdm-policies.png" lightbox="images/autoenrollment-mdm-policies.png":::
|
||||
|
||||
4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use.
|
||||
4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the **Selected Credential Type to use**.
|
||||
|
||||
:::image type="content" alt-text="MDM autoenrollment policy." source="images/autoenrollment-policy.png" lightbox="images/autoenrollment-policy.png":::
|
||||
|
||||
5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**.
|
||||
5. Select **Enable**, select **User Credential** from the dropdown **Select Credential Type to Use**, then select **OK**.
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later.
|
||||
>
|
||||
> The default behavior for older releases is to revert to **User Credential**.
|
||||
> **Device Credential** is only supported for Microsoft Intune enrollment in scenarios with Co-management or Azure Virtual Desktop.
|
||||
> In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later. The default behavior for older releases is to revert to **User Credential**.
|
||||
> **Device Credential** is only supported for Microsoft Intune enrollment in scenarios with Co-management or Azure Virtual Desktop because the Intune subscription is user centric.
|
||||
|
||||
When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called "Schedule created by enrollment client for automatically enrolling in MDM from AAD."
|
||||
|
||||
To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app).
|
||||
|
||||
If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot.
|
||||
If two-factor authentication is required, you'll be prompted to complete the process. Here is an example screenshot.
|
||||
|
||||
|
||||
|
||||
@ -141,33 +138,33 @@ Requirements:
|
||||
> You can avoid this behavior by using Conditional Access Policies in Azure AD.
|
||||
Learn more by reading [What is Conditional Access?](/azure/active-directory/conditional-access/overview).
|
||||
|
||||
6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account.
|
||||
6. To verify successful enrollment to MDM, go to **Start** > **Settings** > **Accounts** > **Access work or school**, then select your domain account.
|
||||
|
||||
7. Click **Info** to see the MDM enrollment information.
|
||||
7. Select **Info** to see the MDM enrollment information.
|
||||
|
||||
|
||||
|
||||
If you do not see the **Info** button or the enrollment information, it is possible that the enrollment failed. Check the status in [Task Scheduler app](#task-scheduler-app).
|
||||
If you do not see the **Info** button or the enrollment information, enrollment might have failed. Check the status in [Task Scheduler app](#task-scheduler-app).
|
||||
|
||||
|
||||
### Task Scheduler app
|
||||
|
||||
1. Click **Start**, then in the text box type **task scheduler**.
|
||||
1. Select **Start**, then in the text box type `task scheduler`.
|
||||
|
||||
|
||||
|
||||
2. Under **Best match**, click **Task Scheduler** to launch it.
|
||||
2. Under **Best match**, select **Task Scheduler** to launch it.
|
||||
|
||||
3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**.
|
||||
3. In **Task Scheduler Library**, open **Microsoft > Windows** , then select **EnterpriseMgmt**.
|
||||
|
||||
:::image type="content" alt-text="Auto-enrollment scheduled task." source="images/autoenrollment-scheduled-task.png" lightbox="images/autoenrollment-scheduled-task.png":::
|
||||
|
||||
To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab.
|
||||
To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (`MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED`). You can see the logs in the **History** tab.
|
||||
|
||||
If the device enrollment is blocked, your IT admin may have enabled the **Disable MDM Enrollment** policy.
|
||||
If the device enrollment is blocked, your IT admin might have enabled the **Disable MDM Enrollment** policy.
|
||||
|
||||
> [!NOTE]
|
||||
> The GPEdit console does not reflect the status of policies set by your IT admin on your device. It is only used by the user to set policies.
|
||||
> The GPEdit console does not reflect the status of policies set by your IT admin on your device. GPEdit is only used by the user to set policies.
|
||||
|
||||
## Configure the auto-enrollment for a group of devices
|
||||
|
||||
@ -178,7 +175,7 @@ Requirements:
|
||||
- Ensure that PCs belong to same computer group.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you do not see the policy, it may be because you don't have the ADMX for Windows 10, version 1803, version 1809, or version 1903 installed. To fix the issue, use the following procedures. Note that the latest MDM.admx is backwards compatible.
|
||||
> If you do not see the policy, you might not have the ADMX for Windows 10, version 1803, version 1809, or version 1903 installed. To fix the issue, use the following procedures. Note that the latest MDM.admx is backwards compatible.
|
||||
|
||||
1. Download:
|
||||
|
||||
@ -219,9 +216,9 @@ Requirements:
|
||||
|
||||
- 21H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 November 2021 Update (21H2)**
|
||||
|
||||
4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**.
|
||||
4. Rename the extracted Policy Definitions folder to `PolicyDefinitions`.
|
||||
|
||||
5. Copy PolicyDefinitions folder to **\\SYSVOL\contoso.com\policies\PolicyDefinitions**.
|
||||
5. Copy the PolicyDefinitions folder to `\\SYSVOL\contoso.com\policies\PolicyDefinitions`.
|
||||
|
||||
If this folder does not exist, then be aware that you will be switching to a [central policy store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for your entire domain.
|
||||
|
||||
@ -238,12 +235,14 @@ This procedure will work for any future version as well.
|
||||
4. Filter using Security Groups.
|
||||
|
||||
## Troubleshoot auto-enrollment of devices
|
||||
|
||||
Investigate the log file if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows 10 device.
|
||||
|
||||
To collect Event Viewer logs:
|
||||
|
||||
1. Open Event Viewer.
|
||||
2. Navigate to **Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin**.
|
||||
|
||||
2. Navigate to **Applications and Services Logs** > **Microsoft** > **Windows** > **DeviceManagement-Enterprise-Diagnostic-Provider** > **Admin**.
|
||||
|
||||
> [!Tip]
|
||||
> For guidance on how to collect event logs for Intune, see [Collect MDM Event Viewer Log YouTube video](https://www.youtube.com/watch?v=U_oCe2RmQEc).
|
||||
@ -260,18 +259,17 @@ To collect Event Viewer logs:
|
||||
|
||||
To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](/troubleshoot/mem/intune/troubleshoot-windows-enrollment-errors) for more information.
|
||||
|
||||
- The auto-enrollment did not trigger at all. In this case, you will not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described in the following section.
|
||||
- The auto-enrollment did not initiate at all. In this case, you will not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described in the following section.
|
||||
|
||||
The auto-enrollment process is triggered by a task (**Microsoft > Windows > EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is successfully deployed to the target machine as shown in the following screenshot:
|
||||
The auto-enrollment process is triggered by a task (**Microsoft** > **Windows** > **EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM**) is successfully deployed to the target machine as shown in the following screenshot:
|
||||
|
||||
:::image type="content" alt-text="Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png":::
|
||||
|
||||
> [!Note]
|
||||
> This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task.
|
||||
> This task isn't visible to standard users, run Scheduled Tasks with administrative credentials to find the task.
|
||||
|
||||
This task runs every 5 minutes for the duration of 1 day. To confirm if the task succeeded, check the task scheduler event logs:
|
||||
**Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**.
|
||||
Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107.
|
||||
This task runs every 5 minutes for the duration of one day. To confirm if the task succeeded, check the task scheduler event logs:
|
||||
**Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107.
|
||||
|
||||
:::image type="content" alt-text="Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png":::
|
||||
|
||||
@ -279,14 +277,14 @@ To collect Event Viewer logs:
|
||||
|
||||
:::image type="content" alt-text="Event ID 102." source="images/auto-enrollment-event-id-102.png" lightbox="images/auto-enrollment-event-id-102.png":::
|
||||
|
||||
Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It does not indicate the success or failure of auto-enrollment.
|
||||
Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. The task scheduler log is only useful to confirm if the auto-enrollment task is initiated or not. It does not indicate the success or failure of auto-enrollment.
|
||||
|
||||
If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required.
|
||||
One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen:
|
||||
If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there might be an issue with Group Policy. Immediately run the command `gpupdate /force` in command prompt to get the Group Policy Object applied. If you still have an issue, further troubleshooting on the Active Directory is required.
|
||||
One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (in any MDM solution and not only Intune), some enrollment information added into the registry is seen:
|
||||
|
||||
:::image type="content" alt-text="Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png":::
|
||||
|
||||
By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational** event log file under event ID 7016.
|
||||
By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs** > **Microsoft** > **Windows** > **Task Scheduler** > **Operational** event log file under event ID 7016.
|
||||
|
||||
A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot:
|
||||
|
||||
|
||||
@ -400,7 +400,7 @@ If you purchased an app from the Store for Business and the app is specified for
|
||||
|
||||
Here are the requirements for this scenario:
|
||||
|
||||
- The location of the app can be a local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (https://contoso.com/app1.appx\_
|
||||
- The location of the app can be a local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (`https://contoso.com/app1.appx`).
|
||||
- The user must have permission to access the content location. For HTTPs, you can use server authentication or certificate authentication using a certificate associated with the enrollment. HTTP locations are supported, but not recommended because of lack of authentication requirements.
|
||||
- The device doesn't need to have connectivity to the Microsoft Store, store services, or have the Microsoft Store UI be enabled.
|
||||
- The user must be logged in, but association with Azure AD identity isn't required.
|
||||
@ -517,7 +517,7 @@ Provisioning allows you to stage the app to the device and all users of the devi
|
||||
|
||||
Here are the requirements for this scenario:
|
||||
|
||||
- The location of the app can be the local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (https://contoso.com/app1.appx\_
|
||||
- The location of the app can be the local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (`https://contoso.com/app1.appx\`)
|
||||
- The user must have permission to access the content location. For HTTPs, you can use server authentication or certificate authentication using a certificate associated with the enrollment. HTTP locations are supported, but not recommended because of lack of authentication requirements.
|
||||
- The device doesn't need to have connectivity to the Microsoft Store, or store services enabled.
|
||||
- The device doesn't need any Azure AD identity or domain membership.
|
||||
|
||||
@ -291,7 +291,7 @@ The deep link used for connecting your device to work will always use the follow
|
||||
> [!NOTE]
|
||||
> Deep links only work with Internet Explorer or Microsoft Edge browsers. When connecting to MDM using a deep link, the URI you should use is:
|
||||
> **ms-device-enrollment:?mode=mdm**
|
||||
> **ms-device-enrollment:?mode=mdm&username=someone@example.com&servername=<https://example.server.com>**
|
||||
> **ms-device-enrollment:?mode=mdm&username=someone@example.com&servername=<`https://example.server.com`>**
|
||||
|
||||
To connect your devices to MDM using deep links:
|
||||
|
||||
|
||||
@ -33,9 +33,9 @@ For details about Microsoft mobile device management protocols for Windows 10 a
|
||||
|
||||
## Breaking changes and known issues
|
||||
|
||||
### Get command inside an atomic command is not supported
|
||||
### Get command inside an atomic command isn’t supported
|
||||
|
||||
In Windows 10 and Windows 11, a Get command inside an atomic command is not supported.
|
||||
In Windows 10 and Windows 11, a Get command inside an atomic command isn't supported.
|
||||
|
||||
### Apps installed using WMI classes are not removed
|
||||
|
||||
@ -270,7 +270,7 @@ The DM agent for [push-button reset](/windows-hardware/manufacture/desktop/push-
|
||||
No. Only one MDM is allowed.
|
||||
|
||||
### How do I set the maximum number of Azure Active Directory joined devices per user?
|
||||
1. Login to the portal as tenant admin: https://manage.windowsazure.com.
|
||||
1. Login to the portal as tenant admin: https://portal.azure.com.
|
||||
2. Click Active Directory on the left pane.
|
||||
3. Choose your tenant.
|
||||
4. Click **Configure**.
|
||||
|
||||
@ -25,12 +25,12 @@ The following table shows the OMA DM standards that Windows uses.
|
||||
|--- |--- |
|
||||
|Data transport and session|<li>Client-initiated remote HTTPS DM session over SSL.<li>Remote HTTPS DM session over SSL.<li>Remote DM server initiation notification using WAP Push over Short Message Service (SMS). Not used by enterprise management.<li>Remote bootstrap by using WAP Push over SMS. Not used by enterprise management.|
|
||||
|Bootstrap XML|OMA Client Provisioning XML.|
|
||||
|DM protocol commands|The following list shows the commands that are used by the device. For more information about the OMA DM command elements, see "[OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/)" available from the OMA website.<br/><li>Add (Implicit Add supported)<li>Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.<li>Atomic: Performing an Add command followed by Replace on the same node within an atomic element is not supported. Nested Atomic and Get commands are not allowed and will generate error code 500.<li>Delete: Removes a node from the DM tree, and the entire subtree beneath that node if one exists<li>Exec: Invokes an executable on the client device<li>Get: Retrieves data from the client device; for interior nodes, the child node names in the Data element are returned in URI-encoded format<li>Replace: Overwrites data on the client device<li>Result: Returns the data results of a Get command to the DM server<li>Sequence: Specifies the order in which a group of commands must be processed<li>Status: Indicates the completion status (success or failure) of an operation<br/><br/>If an XML element that is not a valid OMA DM command is under one of the following elements, the status code 400 is returned for that element:<br/><li>SyncBody<li>Atomic<li>Sequence<br><br/>If no CmdID is provided in the DM command, the client returns blank in the status element and the status code 400.<br/><br/>If Atomic elements are nested, the following status codes are returned:<br/><li>The nested Atomic command returns 500.<li>The parent Atomic command returns 507.<br/><br/>For more information about the Atomic command, see OMA DM protocol common elements.<br>Performing an Add command followed by Replace on the same node within an Atomic element is not supported.<br><br/>LocURI cannot start with `/`.<br/><br/>Meta XML tag in SyncHdr is ignored by the device.|
|
||||
|DM protocol commands|The following list shows the commands that are used by the device. For more information about the OMA DM command elements, see "[OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/)" available from the OMA website.<br/><li>Add (Implicit Add supported)<li>Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.<li>Atomic: Performing an Add command followed by Replace on the same node within an atomic element isn't supported. Nested Atomic and Get commands aren't allowed and will generate error code 500.<li>Delete: Removes a node from the DM tree, and the entire subtree beneath that node if one exists<li>Exec: Invokes an executable on the client device<li>Get: Retrieves data from the client device; for interior nodes, the child node names in the Data element are returned in URI-encoded format<li>Replace: Overwrites data on the client device<li>Result: Returns the data results of a Get command to the DM server<li>Sequence: Specifies the order in which a group of commands must be processed<li>Status: Indicates the completion status (success or failure) of an operation<br/><br/>If an XML element that isn't a valid OMA DM command is under one of the following elements, the status code 400 is returned for that element:<br/><li>SyncBody<li>Atomic<li>Sequence<br><br/>If no CmdID is provided in the DM command, the client returns blank in the status element and the status code 400.<br/><br/>If Atomic elements are nested, the following status codes are returned:<br/><li>The nested Atomic command returns 500.<li>The parent Atomic command returns 507.<br/><br/>For more information about the Atomic command, see OMA DM protocol common elements.<br>Performing an Add command followed by Replace on the same node within an Atomic element isn't supported.<br><br/>LocURI can't start with `/`.<br/><br/>Meta XML tag in SyncHdr is ignored by the device.|
|
||||
|OMA DM standard objects|DevInfo<li>DevDetail<li>OMA DM DMS account objects (OMA DM version 1.2)|
|
||||
|Security|<li>Authenticate DM server initiation notification SMS message (not used by enterprise management)<li>Application layer Basic and MD5 client authentication<li>Authenticate server with MD5 credential at application level<li>Data integrity and authentication with HMAC at application level<li>SSL level certificate-based client/server authentication, encryption, and data integrity check|
|
||||
|Nodes|In the OMA DM tree, the following rules apply for the node name:<br/><li>"." can be part of the node name.<li>The node name cannot be empty.<li>The node name cannot be only the asterisk (*) character.|
|
||||
|Provisioning Files|Provisioning XML must be well formed and follow the definition in SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905).<br/><br/>If an XML element that is not a valid OMA DM command is under SyncBody, the status code 400 is returned for that element.<div class="alert">**Note**<br>To represent a Unicode string as a URI, first encode the string as UTF-8. Then encode each of the UTF-8 bytes using URI encoding.</div>|
|
||||
|WBXML support|Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification.|
|
||||
|Nodes|In the OMA DM tree, the following rules apply for the node name:<br/><li>"." can be part of the node name.<li>The node name can't be empty.<li>The node name can’t be only the asterisk (*) character.|
|
||||
|Provisioning Files|Provisioning XML must be well formed and follow the definition in [SyncML Representation Protocol](https://www.openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf).<br/><br/>If an XML element that isn't a valid OMA DM command is under SyncBody, the status code 400 is returned for that element.<div class="alert">**Note**<br>To represent a Unicode string as a URI, first encode the string as UTF-8. Then encode each of the UTF-8 bytes using URI encoding.</div>|
|
||||
|WBXML support|Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the [SyncML Representation Protocol](https://www.openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification.|
|
||||
|Handling of large objects|In Windows 10, version 1511, client support for uploading large objects to the server was added.|
|
||||
|
||||
|
||||
@ -52,7 +52,7 @@ Common elements are used by other OMA DM element types. The following table list
|
||||
|MsgID|Specifies a unique identifier for an OMA DM session message.|
|
||||
|MsgRef|Specifies the ID of the corresponding request message. This element takes the value of the request message MsgID element.|
|
||||
|RespURI|Specifies the URI that the recipient must use when sending a response to this message.|
|
||||
|SessionID|Specifies the identifier of the OMA DM session associated with the containing message.<div class="alert">**Note**<br> If the server does not notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the client returns the SessionID in integer in decimal format. If the server supports DM session sync version 2.0, which is used in Windows 10, the device client returns 2 bytes.</div>|
|
||||
|SessionID|Specifies the identifier of the OMA DM session associated with the containing message.<div class="alert">**Note**<br> If the server doesn't notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the client returns the SessionID in integer in decimal format. If the server supports DM session sync version 2.0, which is used in Windows 10, the device client returns 2 bytes.</div>|
|
||||
|Source|Specifies the message source address.|
|
||||
|SourceRef|Specifies the source of the corresponding request message. This element takes the value of the request message Source element and is returned in the Status or Results element.|
|
||||
|Target|Specifies the address of the node, in the DM Tree, that is the target of the OMA DM command.|
|
||||
@ -106,7 +106,7 @@ For CSPs and policies that support per user configuration, the MDM server can se
|
||||
The data part of this alert could be one of following strings:
|
||||
|
||||
- User – the user that enrolled the device is actively logged in. The MDM server could send user-specific configuration for CSPs/policies that support per user configuration
|
||||
- Others – another user login but that user does not have an MDM account. The server can only apply device-wide configuration, for example, configuration applies to all users in the device.
|
||||
- Others – another user login but that user doesn't have an MDM account. The server can only apply device-wide configuration, for example, configuration applies to all users in the device.
|
||||
- None – no active user login. The server can only apply device-wide configuration and available configuration is restricted to the device environment (no active user login).
|
||||
|
||||
Below is an alert example:
|
||||
@ -125,7 +125,7 @@ Below is an alert example:
|
||||
</Alert>
|
||||
```
|
||||
|
||||
The server notifies the device whether it is a user targeted or device targeted configuration by a prefix to the management node’s LocURL, with ./user for user targeted configuration, or ./device for device targeted configuration. By default, if no prefix with ./device or ./user, it is device targeted configuration.
|
||||
The server notifies the device whether it's a user targeted or device targeted configuration by a prefix to the management node’s LocURL, with ./user for user targeted configuration, or ./device for device targeted configuration. By default, if no prefix with ./device or ./user, it's device targeted configuration.
|
||||
|
||||
The following LocURL shows a per user CSP node configuration: **./user/vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/<PackageFamilyName>/StoreInstall**
|
||||
|
||||
@ -135,13 +135,13 @@ The following LocURL shows a per device CSP node configuration: **./device/vendo
|
||||
<a href="" id="syncml-response-codes"></a>
|
||||
## SyncML response status codes
|
||||
|
||||
When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification.
|
||||
When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you're likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification.
|
||||
|
||||
| Status code | Description |
|
||||
|---|----|
|
||||
| 200 | The SyncML command completed successfully. |
|
||||
| 202 | Accepted for processing. This is usually an asynchronous operation, such as a request to run a remote execution of an application. |
|
||||
| 212 | Authentication accepted. Normally you'll only see this in response to the SyncHdr element (used for authentication in the OMA-DM standard). You may see this if you look at OMA DM logs, but CSPs do not typically generate this. |
|
||||
| 212 | Authentication accepted. Normally you'll only see this in response to the SyncHdr element (used for authentication in the OMA-DM standard). You may see this if you look at OMA DM logs, but CSPs don't typically generate this. |
|
||||
| 214 | Operation canceled. The SyncML command completed successfully, but no more commands will be processed within the session. |
|
||||
| 215 | Not executed. A command was not executed as a result of user interaction to cancel the command. |
|
||||
| 216 | `Atomic` roll back OK. A command was inside an `Atomic` element and `Atomic` failed. This command was rolled back successfully. |
|
||||
|
||||
@ -98,7 +98,7 @@ PassportForWork
|
||||
Root node for PassportForWork configuration service provider.
|
||||
|
||||
<a href="" id="tenantid"></a>***TenantId***
|
||||
A globally unique identifier (GUID), without curly braces ( { , } ), that is used as part of Windows Hello for Business provisioning and management. To get a GUID, use the PowerShell cmdlet [Get-AzureAccount](/powershell/module/servicemanagement/azure/get-azureaccount). For more information see [Get Windows Azure Active Directory Tenant ID in Windows PowerShell](https://devblogs.microsoft.com/scripting/get-windows-azure-active-directory-tenant-id-in-windows-powershell).
|
||||
A globally unique identifier (GUID), without curly braces ( { , } ), that is used as part of Windows Hello for Business provisioning and management. To get a GUID, use the PowerShell cmdlet [Get-AzureAccount](/powershell/module/servicemanagement/azure.service/get-azureaccount). For more information, see [Get Windows Azure Active Directory Tenant ID in Windows PowerShell](https://devblogs.microsoft.com/scripting/get-windows-azure-active-directory-tenant-id-in-windows-powershell).
|
||||
|
||||
<a href="" id="tenantid-policies"></a>***TenantId*/Policies**
|
||||
Node for defining the Windows Hello for Business policy settings.
|
||||
@ -113,7 +113,7 @@ Supported operations are Add, Get, Delete, and Replace.
|
||||
<a href="" id="tenantid-policies-requiresecuritydevice"></a>***TenantId*/Policies/RequireSecurityDevice**
|
||||
Boolean value that requires a Trusted Platform Module (TPM) for Windows Hello for Business. TPM provides an additional security benefit over software so that data stored in it cannot be used on other devices.
|
||||
|
||||
Default value is false. If you set this policy to true, only devices with a usable TPM can provision Windows Hello for Business. If you set this policy to false, all devices can provision Windows Hello for Business using software even if there is not a usable TPM. If you do not configure this setting, all devices can provision Windows Hello for Business using software if the TPM is non-functional or unavailable.
|
||||
Default value is false. If you set this policy to true, only devices with a usable TPM can provision Windows Hello for Business. If you set this policy to false, all devices can provision Windows Hello for Business using software even if there isn't a usable TPM. If you don’t configure this setting, all devices can provision Windows Hello for Business using software if the TPM is non-functional or unavailable.
|
||||
|
||||
Supported operations are Add, Get, Delete, and Replace.
|
||||
|
||||
@ -136,7 +136,7 @@ This cloud service encrypts a recovery secret, which is stored locally on the cl
|
||||
|
||||
Default value is false. If you enable this policy setting, the PIN recovery secret will be stored on the device and the user can change their PIN if needed.
|
||||
|
||||
If you disable or do not configure this policy setting, the PIN recovery secret will not be created or stored. If the user's PIN is forgotten, the only way to get a new PIN is by deleting the existing PIN and creating a new one, which will require the user to re-register with any services the old PIN provided access to.
|
||||
If you disable or don't configure this policy setting, the PIN recovery secret won't be created or stored. If the user's PIN is forgotten, the only way to get a new PIN is by deleting the existing PIN and creating a new one, which will require the user to re-register with any services the old PIN provided access to.
|
||||
|
||||
Supported operations are Add, Get, Delete, and Replace.
|
||||
|
||||
@ -560,7 +560,3 @@ Here's an example for setting Windows Hello for Business and setting the PIN pol
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
@ -980,7 +980,7 @@ ms.date: 10/08/2020
|
||||
- [ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy](./policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticsexecutionpolicy)
|
||||
- [ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy](./policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticssecuritypolicy)
|
||||
- [ADMX_sdiagschd/ScheduledDiagnosticsExecutionPolicy](./policy-csp-admx-sdiagschd.md#admx-sdiagschd-scheduleddiagnosticsexecutionpolicy)
|
||||
- [ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain](/policy-csp-admx-securitycenter.md#admx-securitycenter-securitycenter-securitycenterindomain)
|
||||
- [ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain](./policy-csp-admx-securitycenter.md#admx-securitycenter-securitycenter-securitycenterindomain)
|
||||
- [ADMX_Sensors/DisableLocationScripting_1](./policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-1)
|
||||
- [ADMX_Sensors/DisableLocationScripting_2](./policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-2)
|
||||
- [ADMX_Sensors/DisableLocation_1](./policy-csp-admx-sensors.md#admx-sensors-disablelocation-1)
|
||||
|
||||
@ -3686,7 +3686,7 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows you to add Internet or intranet sites to the "Search again" links located at the bottom of search results in File Explorer and the Start menu links. The "Search again" links at the bottom of the Search Results view allow the user to reconduct a search but in a different location. The Internet search site will be searched with the text in the search box. To add an Internet search site, specify the URL of the search site in OpenSearch format with {searchTerms} for the query string (for example, http://www.example.com/results.aspx?q={searchTerms}).
|
||||
This policy setting allows you to add Internet or intranet sites to the "Search again" links located at the bottom of search results in File Explorer and the Start menu links. The "Search again" links at the bottom of the Search Results view allow the user to reconduct a search but in a different location. The Internet search site will be searched with the text in the search box. To add an Internet search site, specify the URL of the search site in OpenSearch format with {searchTerms} for the query string (for example, `https://www.example.com/results.aspx?q={searchTerms}`).
|
||||
|
||||
You can add up to five additional links to the "Search again" links at the bottom of results returned in File Explorer after a search is executed. These links will be shared between Internet search sites and Search Connectors/Libraries. Search Connector/Library links take precedence over Internet search links.
|
||||
|
||||
|
||||
@ -2866,7 +2866,7 @@ Define a default list of favorites in Microsoft Edge. In this case, the Save a F
|
||||
To define a default list of favorites:
|
||||
1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**.
|
||||
2. Click **Import from another browser**, click **Export to file** and save the file.
|
||||
3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision. <p><p>Specify the URL as:<ul><li>HTTP location: "SiteList"=<http://localhost:8080/URLs.html></li><li>Local network: "SiteList"="\network\shares\URLs.html"</li><li>Local file: "SiteList"=file:///c:/Users/Documents/URLs.html</li></ul>
|
||||
3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision. <p><p>Specify the URL as:<ul><li>HTTP location: "SiteList"=`<http://localhost:8080/URLs.html>`</li><li>Local network: "SiteList"="\network\shares\URLs.html"</li><li>Local file: "SiteList"=file:///c:/Users/Documents/URLs.html</li></ul>
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
|
||||
@ -649,7 +649,7 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to <http://www.msftconnecttest.com/connecttest.txt> to determine if the device can communicate with the Internet. This policy disables the NCSI active probe, preventing network connectivity to www.msftconnecttest.com.
|
||||
Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to `<http://www.msftconnecttest.com/connecttest.txt>` to determine if the device can communicate with the Internet. This policy disables the NCSI active probe, preventing network connectivity to `www.msftconnecttest.com`.
|
||||
|
||||
Value type is integer.
|
||||
|
||||
|
||||
@ -1960,7 +1960,7 @@ Internet Explorer has 4 security zones, numbered 1-4, and these are used by this
|
||||
|
||||
If you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site. For each entry that you add to the list, enter the following information:
|
||||
|
||||
Valuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter <http://www.contoso.com> as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.
|
||||
Valuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter `<http://www.contoso.com>` as the valuename, other protocols are not affected. If you enter just `www.contoso.com,` then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for `www.contoso.com` and `www.contoso.com/mail` would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.
|
||||
|
||||
Value - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.
|
||||
|
||||
@ -2002,8 +2002,8 @@ ADMX Info:
|
||||
```
|
||||
|
||||
Value and index pairs in the SyncML example:
|
||||
- http://adfs.contoso.org 1
|
||||
- https://microsoft.com 2
|
||||
- `https://adfs.contoso.org 1`
|
||||
- `https://microsoft.com 2`
|
||||
|
||||
<!--/Example-->
|
||||
<!--/Policy-->
|
||||
|
||||
@ -529,7 +529,7 @@ The following list shows the supported values:
|
||||
|
||||
This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data.
|
||||
|
||||
For customers who enroll into the Microsoft Managed Desktop service, this policy will be enabled by default to allow Microsoft to process data for operational and analytic needs. For more information, see [Privacy and personal data](/microsoft-365/managed-desktop/service-description/privacy-personal-data.md).
|
||||
For customers who enroll into the Microsoft Managed Desktop service, this policy will be enabled by default to allow Microsoft to process data for operational and analytic needs. For more information, see [Privacy and personal data](/microsoft-365/managed-desktop/service-description/privacy-personal-data).
|
||||
|
||||
This setting has no effect on devices unless they're properly enrolled in Microsoft Managed Desktop.
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ The following table shows the OMA DM versions that are supported.
|
||||
|
||||
## File format
|
||||
|
||||
The following example shows the general structure of the XML document sent by the server using OMA DM version 1.2.1 for demonstration purposes only. The initial XML packages exchanged between client and server could contain extra XML tags. For a detailed description and samples for those packages, see the [OMA Device Management Protocol 1.2.1](https://go.microsoft.com/fwlink/p/?LinkId=526902) specification.
|
||||
The following example shows the general structure of the XML document sent by the server using OMA DM version 1.2.1 for demonstration purposes only. The initial XML packages exchanged between client and server could contain additional XML tags. For a detailed description and samples for those packages, see the [OMA Device Management Protocol 1.2.1](https://www.openmobilealliance.org/release/DM/V1_2_1-20080617-A/OMA-TS-DM_Protocol-V1_2_1-20080617-A.pdf) specification.
|
||||
|
||||
```xml
|
||||
<SyncML xmlns='SYNCML:SYNCML1.2'>
|
||||
|
||||
@ -17,7 +17,7 @@ ms.date: 06/26/2017
|
||||
|
||||
# Enterprise settings, policies, and app management
|
||||
|
||||
The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526).
|
||||
The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://technical.openmobilealliance.org/).
|
||||
|
||||
Windows currently supports one MDM server. The DM client that is configured via the enrollment process is granted access to enterprise related settings. Enterprise MDM settings are exposed via various configuration service providers to the DM client. For the list of available configuration service providers, see [Configuration service provider reference](configuration-service-provider-reference.md).
|
||||
|
||||
|
||||
@ -507,7 +507,7 @@ Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, and Wi
|
||||
|
||||
Windows 10, version 1703, adds a number of [ADMX-backed policies to MDM](./mdm/policy-configuration-service-provider.md).
|
||||
|
||||
If you use Microsoft Intune for MDM, you can [configure custom policies](https://go.microsoft.com/fwlink/p/?LinkId=616316) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=616317).
|
||||
If you use Microsoft Intune for MDM, you can [configure custom policies](/mem/intune/configuration/custom-settings-configure) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](/mem/intune/configuration/custom-settings-windows-10).
|
||||
|
||||
No new [Exchange ActiveSync policies](/exchange/mobile-device-mailbox-policies-exchange-2013-help). For more information, see the [ActiveSync configuration service provider](./mdm/activesync-csp.md) technical reference.
|
||||
|
||||
|
||||
@ -82,7 +82,8 @@ Restart on Idle Time | Specify when Kiosk Browser should restart in a fresh stat
|
||||
>
|
||||
> 1. Create the provisioning package. When ready to export, close the project in Windows Configuration Designer.
|
||||
> 2. Open the customizations.xml file in the project folder (e.g C:\Users\name\Documents\Windows Imaging and Configuration Designer (WICD)\Project_18).
|
||||
> 3. Insert the null character string in between each URL (e.g www.bing.com``www.contoso.com).
|
||||
> 3. Insert the null character string in between each URL
|
||||
(e.g `www.bing.com` and `www.contoso.com`).
|
||||
> 4. Save the XML file.
|
||||
> 5. Open the project again in Windows Configuration Designer.
|
||||
> 6. Export the package. Ensure you do not revisit the created policies under Kiosk Browser or else the null character will be removed.
|
||||
@ -120,8 +121,8 @@ The following table describes the results for different combinations of blocked
|
||||
|
||||
Blocked URL rule | Block URL exception rule | Result
|
||||
--- | --- | ---
|
||||
`*` | `contoso.com`<br>`fabrikam.com` | All requests are blocked unless it is to contoso.com, fabrikam.com, or any of their subdomains.
|
||||
`contoso.com` | `mail.contoso.com`<br>`.contoso.com`<br>`.www.contoso.com` | Block all requests to contoso.com, except for the main page and its mail subdomain.
|
||||
`*` | `contoso.com`<br>`fabrikam.com` | All requests are blocked unless it is to `contoso.com, fabrikam.com,` or any of their subdomains.
|
||||
`contoso.com` | `mail.contoso.com`<br>`.contoso.com`<br>`.www.contoso.com` | Block all requests to `contoso.com,` except for the main page and its mail subdomain.
|
||||
`youtube.com` | `youtube.com/watch?v=v1`<br>`youtube.com/watch?v=v2` | Blocks all access to youtube.com except for the specified videos (v1 and v2).
|
||||
|
||||
The following table gives examples for blocked URLs.
|
||||
@ -129,11 +130,11 @@ The following table gives examples for blocked URLs.
|
||||
|
||||
| Entry | Result |
|
||||
|--------------------------|-------------------------------------------------------------------------------|
|
||||
| `contoso.com` | Blocks all requests to contoso.com, www.contoso.com, and sub.www.contoso.com |
|
||||
| `contoso.com` | Blocks all requests to contoso.com, `www.contoso.com,` and sub.www.contoso.com |
|
||||
| `https://*` | Blocks all HTTPS requests to any domain. |
|
||||
| `mail.contoso.com` | Blocks requests to mail.contoso.com but not to www.contoso.com or contoso.com |
|
||||
| `mail.contoso.com` | Blocks requests to mail.contoso.com but not to `www.contoso.com` or `contoso.com` |
|
||||
| `.contoso.com` | Blocks contoso.com but not its subdomains, like subdomain.contoso.com. |
|
||||
| `.www.contoso.com` | Blocks www.contoso.com but not its subdomains. |
|
||||
| `.www.contoso.com` | Blocks `www.contoso.com` but not its subdomains. |
|
||||
| `*` | Blocks all requests except for URLs in the Blocked URL Exceptions list. |
|
||||
| `*:8080` | Blocks all requests to port 8080. |
|
||||
| `contoso.com/stuff` | Blocks all requests to contoso.com/stuff and its subdomains. |
|
||||
|
||||
@ -27,4 +27,4 @@ Set to **True** or **False**.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [AllJoyn](https://developer.microsoft.com/windows/iot/docs/alljoyn)
|
||||
- [AllJoyn – Wikipedia](https://wikipedia.org/wiki/AllJoyn)
|
||||
|
||||
@ -25,7 +25,7 @@ ms.custom: seo-marvel-apr2020
|
||||
|
||||
This topic provides a brief overview of Microsoft 365 and describes how to use a free 90-day trial account to review some of the benefits of Microsoft 365.
|
||||
|
||||
[Microsoft 365](https://www.microsoft.com/microsoft-365) is a new offering from Microsoft that combines [Windows 10](https://www.microsoft.com/windows/features) with [Office 365](https://products.office.com/business/explore-office-365-for-business), and [Enterprise Mobility and Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) (EMS). See the [M365 Enterprise poster](#m365-enterprise-poster) for an overview.
|
||||
[Microsoft 365](https://www.microsoft.com/microsoft-365) is a new offering from Microsoft that combines [Windows 10](https://www.microsoft.com/windows/features) with [Office 365](https://www.microsoft.com/microsoft-365/office-365), and [Enterprise Mobility and Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) (EMS). See the [M365 Enterprise poster](#m365-enterprise-poster) for an overview.
|
||||
|
||||
For Windows 10 deployment, Microsoft 365 includes a fantastic deployment advisor that can walk you through the entire process of deploying Windows 10. The wizard supports multiple Windows 10 deployment methods, including:
|
||||
|
||||
|
||||
@ -61,7 +61,7 @@ On **CM01**:
|
||||
|
||||
## Add drivers for Windows 10
|
||||
|
||||
This section illustrates how to add drivers for Windows 10 using the HP EliteBook 8560w as an example. For the HP EliteBook 8560w, you use HP SoftPaq Download Manager to get the drivers. The HP SoftPaq Download Manager can be accessed on the [HP Support site](https://go.microsoft.com/fwlink/p/?LinkId=619545).
|
||||
This section illustrates how to add drivers for Windows 10 using the HP EliteBook 8560w as an example. Use the HP Image Assistant from the [HP Client Management Solutions site](https://hp.com/go/clientmanagement).
|
||||
|
||||
For the purposes of this section, we assume that you have downloaded the Windows 10 drivers for the HP EliteBook 8560w model and copied them to the **D:\Sources$\OSD\DriverSources\Windows 10 x64\Hewlett-Packard\HP EliteBook 8560w** folder on CM01.
|
||||
|
||||
|
||||
@ -359,7 +359,7 @@ On **MDT01**:
|
||||
- Specify Product Key: Do not specify a product key at this time
|
||||
- Full Name: Contoso
|
||||
- Organization: Contoso
|
||||
- Internet Explorer home page: https://www.contoso.com
|
||||
- Internet Explorer home page: `https://www.contoso.com`
|
||||
- Admin Password: Do not specify an Administrator Password at this time
|
||||
|
||||
### Edit the Windows 10 task sequence
|
||||
|
||||
@ -974,9 +974,6 @@ write-output "" "Provisioning script complete."
|
||||
|
||||
## Considerations when using different USB keyboard layouts with Windows To Go
|
||||
|
||||
|
||||
Before provisioning your Windows To Go drive you need to consider if your workspace will boot on a computer with a non-English USB keyboard attached. As described in [KB article 927824](https://go.microsoft.com/fwlink/p/?LinkId=619176) there is a known issue where the plug and play ID causes the keyboard to be incorrectly identified as an English 101 key keyboard. To avoid this problem, you can modify the provisioning script to set the override keyboard parameters.
|
||||
|
||||
In the PowerShell provisioning script, after the image has been applied, you can add the following commands that will correctly set the keyboard settings. The following example uses the Japanese keyboard layout:
|
||||
|
||||
```
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Using a proxy with Delivery Optimization
|
||||
manager: laurawi
|
||||
manager: dansimp
|
||||
description: Settings to use with various proxy configurations to allow Delivery Optimization to work
|
||||
keywords: updates, downloads, network, bandwidth
|
||||
ms.prod: w10
|
||||
|
||||
@ -137,7 +137,7 @@ sections:
|
||||
The desktop experience in Windows 10 has been improved to provide a better experience for people that use a traditional mouse and keyboard. Key changes include:
|
||||
- Start menu is a launching point for access to apps.
|
||||
- Universal apps now open in windows instead of full screen.
|
||||
- [Multitasking is improved with adjustable Snap](http://blogs.windows.com/bloggingwindows/2015/06/04/arrange-your-windows-in-a-snap/), which allows you to have more than two windows side-by-side on the same screen and to customize how those windows are arranged.
|
||||
- [Multitasking is improved with adjustable Snap](https://blogs.windows.com/windows-insider/2015/06/04/arrange-your-windows-in-a-snap/), which allows you to have more than two windows side-by-side on the same screen and to customize how those windows are arranged.
|
||||
- Tablet Mode to simplify using Windows with a finger or pen by using touch input.
|
||||
|
||||
- name: Help and support
|
||||
|
||||
@ -48,7 +48,7 @@ Windows 10 Insider Preview builds offer organizations a valuable and exciting op
|
||||
|Release channel |**Fast Ring:** Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration.|
|
||||
|Users | Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary devices. |
|
||||
|Tasks | - Install and manage Insider Preview builds on devices (per device or centrally across multiple devices)<br> - Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications<br> - Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary of current features. |
|
||||
|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible.<br> - Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)<br> - [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/how-to-feedback/) |
|
||||
|Feedback | - This helps us make adjustments to features as quickly as possible.<br> - Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)<br> - [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/how-to-feedback/) |
|
||||
|
||||
## Validate Insider Preview builds
|
||||
Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. Early validation has several benefits:
|
||||
|
||||
@ -241,7 +241,7 @@ When you run Disk Cleanup and enable the option to Clean up system files, you ca
|
||||
|
||||
To launch an elevated command prompt, press the Windows key on your keyboard, type **cmd**, press Ctrl+Shift+Enter, and then click **Yes** to confirm the elevation prompt. Screenshots and other steps to open an elevated command prompt are [here](https://answers.microsoft.com/en-us/windows/forum/windows_7-security/command-prompt-admin-windows-7/6a188166-5e23-461f-b468-f325688ec8c7).
|
||||
|
||||
Note: When you open an elevated command prompt, you will usually start in the **C:\WINDOWS\system32** directory. To run a program that you recently downloaded, you must change to the directory where the program is located. Alternatively, you can move or copy the program to a location on the computer that is automatically searched. These directories are listed in the [PATH variable](https://answers.microsoft.com/windows/forum/windows_10-other_settings-winpc/adding-path-variable/97300613-20cb-4d85-8d0e-cc9d3549ba23).
|
||||
Note: When you open an elevated command prompt, you will usually start in the **C:\WINDOWS\system32** directory. To run a program that you recently downloaded, you must change to the directory where the program is located. Alternatively, you can move or copy the program to a location on the computer that is automatically searched. These directories are listed in the [PATH variable](https://answers.microsoft.com/windows/forum/all/adding-path-variable/97300613-20cb-4d85-8d0e-cc9d3549ba23).
|
||||
|
||||
If this is too complicated for you, then use File Explorer to create a new folder under C: with a short name such as "new" then copy or move the programs you want to run (like SetupDiag) to this folder using File Explorer. When you open an elevated command prompt, change to this directory by typing "cd c:\new" and now you can run the programs in that folder.
|
||||
|
||||
|
||||
@ -95,6 +95,6 @@ WIM = Windows image (Microsoft)
|
||||
|
||||
[Windows 10 FAQ for IT professionals](../planning/windows-10-enterprise-faq-itpro.yml)
|
||||
<br>[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
|
||||
<br>[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications)
|
||||
<br>[Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications)
|
||||
<br>[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
|
||||
<br>[Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors)
|
||||
|
||||
@ -394,7 +394,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env
|
||||
|
||||
2. On the **Monitoring** tab, select the **Enable monitoring for this deployment share** checkbox, and then click **OK**.
|
||||
|
||||
3. Verify the monitoring service is working as expected by opening the following link on SRV1 in Internet Explorer: [http://localhost:9800/MDTMonitorEvent/](http://localhost:9800/MDTMonitorEvent/). If you do not see "**You have created a service**" at the top of the page, see [Troubleshooting MDT 2012 Monitoring](/archive/blogs/mniehaus/troubleshooting-mdt-2012-monitoring).
|
||||
3. Verify the monitoring service is working as expected by opening the following link on SRV1: `http://localhost:9800/MDTMonitorEvent/`. If you do not see "**You have created a service**" at the top of the page, see [Troubleshooting MDT 2012 Monitoring](/archive/blogs/mniehaus/troubleshooting-mdt-2012-monitoring).
|
||||
|
||||
4. Close Internet Explorer.
|
||||
|
||||
|
||||
@ -99,8 +99,8 @@ Internet Explorer shares many of the Windows essential services listed above. Th
|
||||
## Related links
|
||||
|
||||
- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
|
||||
- [Connected Experiences in Office](/deployoffice/privacy/connected-experiences.md)
|
||||
- [Essential Services in Office](/deployoffice/privacy/essential-services.md)
|
||||
- [Connected Experiences in Office](/deployoffice/privacy/connected-experiences)
|
||||
- [Essential Services in Office](/deployoffice/privacy/essential-services)
|
||||
|
||||
To view endpoints for Windows Enterprise, see:
|
||||
|
||||
|
||||
@ -93,7 +93,7 @@ The following methodology was used to derive these network endpoints:
|
||||
|||HTTP|share.microsoft.com|
|
||||
||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com|
|
||||
|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)|
|
||||
||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTPS|www.msftconnecttest.com*|
|
||||
||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTPS|`www.msftconnecttest.com`|
|
||||
|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)|
|
||||
|||HTTPS|www.office.com|
|
||||
|||HTTPS|blobs.officehome.msocdn.com|
|
||||
|
||||
@ -342,7 +342,7 @@ This security group has not changed since Windows Server 2008.
|
||||
|
||||
Members of the Cloneable Domain Controllers group that are domain controllers may be cloned. In Windows Server 2012 R2 and Windows Server 2012, you can deploy domain controllers by copying an existing virtual domain controller. In a virtual environment, you no longer have to repeatedly deploy a server image that is prepared by using sysprep.exe, promote the server to a domain controller, and then complete additional configuration requirements for deploying each domain controller (including adding the virtual domain controller to this security group).
|
||||
|
||||
For more information, see [Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100)](https://technet.microsoft.com/library/hh831734.aspx).
|
||||
For more information, see [Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100)](/windows-server/identity/ad-ds/introduction-to-active-directory-domain-services-ad-ds-virtualization-level-100).
|
||||
|
||||
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
|
||||
|
||||
|
||||
@ -245,8 +245,8 @@ Whenever an application verifies a TLS/SSL certificate chain that contains a ser
|
||||
The output file name consists of the leading eight ASCII hex digits of the root’s SHA1 thumbprint followed by the server name.
|
||||
For example:
|
||||
|
||||
- D4DE20D0_xsi.outlook.com.p7b
|
||||
- DE28F4A4_www.yammer.com.p7b
|
||||
- `D4DE20D0_xsi.outlook.com.p7b`
|
||||
- `DE28F4A4_www.yammer.com.p7b`
|
||||
|
||||
If there's either an enterprise certificate pin rule or a Microsoft certificate pin rule mismatch, then Windows writes the .p7b file to the **MismatchPinRules** child folder.
|
||||
If the pin rules have expired, then Windows writes the .p7b to the **ExpiredPinRules** child folder.
|
||||
|
||||
@ -193,7 +193,7 @@ The web server is ready to host the CRL distribution point. Now, configure the
|
||||
1. On the issuing certificate authority, sign-in as a local administrator. Start the **Certificate Authority** console from **Administrative Tools**.
|
||||
2. In the navigation pane, right-click the name of the certificate authority and click **Properties**
|
||||
3. Click **Extensions**. On the **Extensions** tab, select **CRL Distribution Point (CDP)** from the **Select extension** list.
|
||||
4. On the **Extensions** tab, click **Add**. Type <b>http://crl.[domainname]/cdp/</b> in **location**. For example, *<http://crl.corp.contoso.com/cdp/>* or *<http://crl.contoso.com/cdp/>* (do not forget the trailing forward slash).
|
||||
4. On the **Extensions** tab, click **Add**. Type <b>http://crl.[domainname]/cdp/</b> in **location**. For example, `<http://crl.corp.contoso.com/cdp/>` or `<http://crl.contoso.com/cdp/>` (do not forget the trailing forward slash).
|
||||
|
||||
5. Select **\<CaName>** from the **Variable** list and click **Insert**. Select **\<CRLNameSuffix>** from the **Variable** list and click **Insert**. Select **\<DeltaCRLAllowed>** from the **Variable** list and click **Insert**.
|
||||
6. Type **.crl** at the end of the text in **Location**. Click **OK**.
|
||||
|
||||
@ -82,7 +82,7 @@ Credential providers must be registered on a computer running Windows, and they
|
||||
|
||||
## Smart card subsystem architecture
|
||||
|
||||
Vendors provide smart cards and smart card readers, and in many cases the vendors are different for the smart card and the smart card reader. Drivers for smart card readers are written to the [Personal Computer/Smart Card (PC/SC) standard](https://www.pcscworkgroup.com/). Each smart card must have a Cryptographic Service Provider (CSP) that uses the CryptoAPI interfaces to enable cryptographic operations, and the WinSCard APIs to enable communications with smart card hardware.
|
||||
Vendors provide smart cards and smart card readers, and in many cases the vendors are different for the smart card and the smart card reader. Drivers for smart card readers are written to the [Personal Computer/Smart Card (PC/SC) standard](https://pcscworkgroup.com/). Each smart card must have a Cryptographic Service Provider (CSP) that uses the CryptoAPI interfaces to enable cryptographic operations, and the WinSCard APIs to enable communications with smart card hardware.
|
||||
|
||||
### Base CSP and smart card minidriver architecture
|
||||
|
||||
|
||||
@ -187,7 +187,7 @@ The smart card certificate has specific format requirements when it is used with
|
||||
|
||||
| **Component** | **Requirements for Windows 8.1, Windows 8, Windows 7, Windows Vista, Windows 10, and Windows 11** | **Requirements for Windows XP** |
|
||||
|--------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| CRL distribution point location | Not required | The location must be specified, online, and available, for example:<br>\[1\]CRL Distribution Point<br>Distribution Point Name:<br>Full Name:<br>URL=<http://server1.contoso.com/CertEnroll/caname.crl> |
|
||||
| CRL distribution point location | Not required | The location must be specified, online, and available, for example:<br>\[1\]CRL Distribution Point<br>Distribution Point Name:<br>Full Name:<br>URL=`<https://server1.contoso.com/CertEnroll/caname.crl>` |
|
||||
| Key usage | Digital signature | Digital signature |
|
||||
| Basic constraints | Not required | \[Subject Type=End Entity, Path Length Constraint=None\] (Optional) |
|
||||
| Enhanced key usage (EKU) | The smart card sign-in object identifier is not required.<br><br>**Note** If an EKU is present, it must contain the smart card sign-in EKU. Certificates with no EKU can be used for sign-in. | - Client Authentication (1.3.6.1.5.5.7.3.2)<br>The client authentication object identifier is required only if a certificate is used for SSL authentication.<br><br>- Smart Card Sign-in (1.3.6.1.4.1.311.20.2.2) |
|
||||
|
||||
@ -22,7 +22,7 @@ Applies To: Windows 10, Windows 11, Windows Server 2016 and above
|
||||
|
||||
This topic for the IT professional and smart card developers describes how the Smart Cards for Windows service (formerly called Smart Card Resource Manager) manages readers and application interactions.
|
||||
|
||||
The Smart Cards for Windows service provides the basic infrastructure for all other smart card components as it manages smart card readers and application interactions on the computer. It is fully compliant with the specifications set by the PC/SC Workgroup. For information about these specifications, see the [PC/SC Workgroup Specifications website](https://www.pcscworkgroup.com/).
|
||||
The Smart Cards for Windows service provides the basic infrastructure for all other smart card components as it manages smart card readers and application interactions on the computer. It is fully compliant with the specifications set by the PC/SC Workgroup. For information about these specifications, see the [PC/SC Workgroup Specifications website](https://pcscworkgroup.com/).
|
||||
|
||||
The Smart Cards for Windows service runs in the context of a local service, and it is implemented as a shared service of the services host (svchost) process. The Smart Cards for Windows service, Scardsvr, has the following service description:
|
||||
|
||||
|
||||
@ -35,8 +35,7 @@ VPN profiles in Windows 10 or Windows 11 can be configured to connect automatica
|
||||
|
||||
The app identifier for a desktop app is a file path. The app identifier for a UWP app is a package family name.
|
||||
|
||||
[Find a package family name (PFN) for per-app VPN configuration](/intune/deploy-use/find-a-pfn-for-per-app-vpn)
|
||||
|
||||
[Find a package family name (PFN) for per-app VPN configuration](/mem/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn)
|
||||
|
||||
## Name-based trigger
|
||||
|
||||
|
||||
@ -124,7 +124,9 @@ Figure 2 illustrates the Measured Boot and remote attestation process.
|
||||
**Figure 2. Measured Boot proves the PC’s health to a remote server**
|
||||
|
||||
|
||||
Windows includes the application programming interfaces to support Measured Boot, but you’ll need non-Microsoft tools to implement a remote attestation client and trusted attestation server to take advantage of it. For an example of such a tool, download the [TPM Platform Crypto-Provider Toolkit](https://research.microsoft.com/en-us/downloads/74c45746-24ad-4cb7-ba4b-0c6df2f92d5d/) from Microsoft Research or Microsoft Enterprise Security MVP Dan Griffin’s [Measured Boot Tool](http://mbt.codeplex.com/).
|
||||
Windows includes the application programming interfaces to support Measured Boot, but you’ll need non-Microsoft tools to implement a remote attestation client and trusted attestation server to take advantage of it. For example, see the following tools from Microsoft Research:
|
||||
- [TPM Platform Crypto-Provider Toolkit](https://www.microsoft.com/download/details.aspx?id=52487)
|
||||
- [TSS.MSR](https://github.com/microsoft/TSS.MSR#tssmsr)
|
||||
|
||||
Measured Boot uses the power of UEFI, TPM, and Windows to give you a way to confidently assess the trustworthiness of a client PC across the network.
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ author: jsuther1974
|
||||
ms.reviewer: jogeurte
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 02/01/2022
|
||||
ms.date: 04/30/2022
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
|
||||
@ -39,7 +39,7 @@ A Windows Defender Application Control (WDAC) policy logs events locally in Wind
|
||||
| 3076 | This event is the main WDAC block event for audit mode policies. It indicates that the file would have been blocked if the WDAC policy was enforced. |
|
||||
| 3077 | This event is the main WDAC block event for enforced policies. It indicates that the file did not pass your WDAC policy and was blocked. |
|
||||
| 3089 | This event contains signature information for files that were blocked or would have been blocked by WDAC. One 3089 event is created for each signature of a file. The event shows the total number of signatures found and an index value to identify the current signature. Unsigned files produce a single 3089 event with TotalSignatureCount 0. 3089 events are correlated with 3004, 3033, 3034, 3076 and 3077 events. You can match the events using the "Correlation ActivityID" found in the "System" portion of the event. |
|
||||
| 3099 | Indicates that a policy has been loaded. This event also includes information about the policy options that were specified by the policy. Refer to the |
|
||||
| 3099 | Indicates that a policy has been loaded. This event also includes information about the WDAC policy options that were specified by the WDAC policy. |
|
||||
|
||||
## WDAC events found in the Microsoft Windows AppLocker MSI and Script log
|
||||
|
||||
@ -57,7 +57,7 @@ Events 3090, 3091 and 3092 prove helpful diagnostic information when the ISG or
|
||||
| Event ID | Explanation |
|
||||
|--------|---------|
|
||||
| 3090 | *Optional* This event indicates that a file was allowed to run based purely on ISG or managed installer. |
|
||||
| 3091 | This event indicates that a file did not have ISG or managed installer authorization and the policy is in audit mode. |
|
||||
| 3091 | This event indicates that a file did not have ISG or managed installer authorization and the WDAC policy is in audit mode. |
|
||||
| 3092 | This event is the enforcement mode equivalent of 3091. |
|
||||
|
||||
The above events are reported per active policy on the system, so you may see multiple events for the same file.
|
||||
@ -72,8 +72,8 @@ The following information is found in the details for 3090, 3091, and 3092 event
|
||||
| PassesManagedInstaller | Indicates whether the file originated from a MI |
|
||||
| SmartlockerEnabled | Indicates whether the specified policy enables ISG trust |
|
||||
| PassesSmartlocker | Indicates whether the file had positive reputation according to the ISG |
|
||||
| AuditEnabled | True if the policy is in audit mode, otherwise it is in enforce mode |
|
||||
| PolicyName | The name of the policy to which the event applies |
|
||||
| AuditEnabled | True if the WDAC policy is in audit mode, otherwise it is in enforce mode |
|
||||
| PolicyName | The name of the WDAC policy to which the event applies |
|
||||
|
||||
### Enabling ISG and MI diagnostic events
|
||||
|
||||
@ -149,28 +149,38 @@ A list of other relevant event IDs and their corresponding description.
|
||||
| 3023 | The driver file under validation did not meet the requirements to pass the application control policy. |
|
||||
| 3024 | Windows application control was unable to refresh the boot catalog file. |
|
||||
| 3026 | The catalog loaded is signed by a signing certificate that has been revoked by Microsoft and/or the certificate issuing authority. |
|
||||
| 3032 | The file under validation is revoked by the system or the file has a signature that has been revoked.
|
||||
| 3033 | The file under validation did not meet the requirements to pass the application control policy. |
|
||||
| 3034 | The file under validation would not meet the requirements to pass the application control policy if the policy was enforced. The file was allowed since the policy is in audit mode. |
|
||||
| 3034 | The file under validation would not meet the requirements to pass the application control policy if the WDAC policy was enforced. The file was allowed since the WDAC policy is in audit mode. |
|
||||
| 3036 | The signed file under validation is signed by a code signing certificate that has been revoked by Microsoft or the certificate issuing authority. |
|
||||
| 3064 | If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. The DLL was allowed since the policy is in audit mode. |
|
||||
| 3065 | [Ignored] If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. |
|
||||
| 3064 | If the WDAC policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. The DLL was allowed since the WDAC policy is in audit mode. |
|
||||
| 3065 | If the WDAC policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. |
|
||||
| 3074 | Page hash failure while hypervisor-protected code integrity was enabled. |
|
||||
| 3075 | This event monitors the performance of the Code Integrity policy check a file. |
|
||||
| 3075 | This event measures the performance of the WDAC policy check during file validation. |
|
||||
| 3076 | This event is the main WDAC block event for audit mode policies. It indicates that the file would have been blocked if the WDAC policy was enforced. |
|
||||
| 3077 | This event is the main WDAC block event for enforced policies. It indicates that the file did not pass your WDAC policy and was blocked. |
|
||||
| 3079 | The file under validation did not meet the requirements to pass the application control policy. |
|
||||
| 3080 | If the policy was in enforced mode, the file under validation would not have met the requirements to pass the application control policy. |
|
||||
| 3080 | If the WDAC policy was in enforced mode, the file under validation would not have met the requirements to pass the application control policy. |
|
||||
| 3081 | The file under validation did not meet the requirements to pass the application control policy. |
|
||||
| 3082 | If the policy was in enforced mode, the non-WHQL driver would have been denied by the policy. |
|
||||
| 3084 | Code Integrity will enforce the WHQL Required policy setting on this session. |
|
||||
| 3085 | Code Integrity will not enforce the WHQL Required policy setting on this session. |
|
||||
| 3082 | If the WDAC policy was in enforced mode, the non-WHQL driver would have been denied by the WDAC policy. |
|
||||
| 3084 | Code Integrity will enforce the WHQL driver signing requirements on this boot session. |
|
||||
| 3085 | Code Integrity will not enforce the WHQL driver signing requirements on this boot session. |
|
||||
| 3086 | The file under validation does not meet the signing requirements for an isolated user mode (IUM) process. |
|
||||
| 3095 | This Code Integrity policy cannot be refreshed and must be rebooted instead. |
|
||||
| 3097 | The Code Integrity policy cannot be refreshed. |
|
||||
| 3089 | This event contains signature information for files that were blocked or would have been blocked by WDAC. One 3089 event is created for each signature of a file. |
|
||||
| 3090 | *Optional* This event indicates that a file was allowed to run based purely on ISG or managed installer. |
|
||||
| 3091 | This event indicates that a file did not have ISG or managed installer authorization and the WDAC policy is in audit mode. |
|
||||
| 3092 | This event is the enforcement mode equivalent of 3091. |
|
||||
| 3095 | The WDAC policy cannot be refreshed and must be rebooted instead. |
|
||||
| 3096 | The WDAC policy was not refreshed since it is already up-to-date. |
|
||||
| 3097 | The WDAC policy cannot be refreshed. |
|
||||
| 3099 | Indicates that a policy has been loaded. This event also includes information about the WDAC policy options that were specified by the WDAC policy. |
|
||||
| 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. |
|
||||
| 3101 | Code Integrity started refreshing the policy. |
|
||||
| 3102 | Code Integrity finished refreshing the policy. |
|
||||
| 3103 | Code Integrity is ignoring the policy refresh. |
|
||||
| 3101 | The system started refreshing the WDAC policy. |
|
||||
| 3102 | The system finished refreshing the WDAC policy. |
|
||||
| 3103 | The system is ignoring the WDAC policy refresh. |
|
||||
| 3104 | The file under validation does not meet the signing requirements for a PPL (protected process light) process. |
|
||||
| 3105 | Code Integrity is attempting to refresh the policy. |
|
||||
| 3105 | The system is attempting to refresh the WDAC policy. |
|
||||
| 3108 | Windows mode change event was successful. |
|
||||
| 3110 | Windows mode change event was unsuccessful. |
|
||||
| 3111 | The file under validation did not meet the hypervisor-protected code integrity (HVCI) policy. |
|
||||
| 3112 | The file under validation is signed by a certificate that has been explicitly revoked by Windows. |
|
||||
|
||||
@ -62,8 +62,6 @@ In some cases, IPsec-secured traffic might have to pass through a router, perime
|
||||
|
||||
In the case of a filtering router or a firewall, you must configure these devices to allow IPsec traffic to be forwarded. Configure the firewall to allow IPsec traffic on UDP source and destination port 500 (IKE), UDP source and destination port 4500 (IPsec NAT-T), and IP Protocol 50 (ESP). You might also have to configure the firewall to allow IPsec traffic on IP protocol 51 (AH) to allow troubleshooting by IPsec administrators and to allow the IPsec traffic to be inspected.
|
||||
|
||||
For more info, see [How to Enable IPsec Traffic Through a Firewall](https://go.microsoft.com/fwlink/?LinkId=45085).
|
||||
|
||||
## Network load balancing and server clusters
|
||||
|
||||
There are challenges implementing connection security for network traffic going to and from network load balancing (NLB) clusters and server clusters. NLB enables multiple servers to be clustered together to provide high availability for a service by providing automatic failover to other nodes in the cluster. Because IPsec matches a security association to a specific device, it prevents different devices from handling the same client connection. If a different node in the cluster responds to an IPsec connection that was originally established by another node, the traffic will be dropped by the client device as untrusted.
|
||||
|
||||
@ -35,7 +35,8 @@ In these procedures, you confirm that the rules you deployed are working correct
|
||||
|
||||
- **Encryption zone.** Similar to the main isolation zone, after you confirm that the network traffic to zone members is properly authenticated and encrypted, you must convert your zone rules from request mode to require mode.
|
||||
|
||||
>**Note:** In addition to the steps shown in this procedure, you can also use network traffic capture tools such as Microsoft Network Monitor, which can be downloaded from <https://go.microsoft.com/fwlink/?linkid=94770>. Network Monitor and similar tools allow you to capture, parse, and display the network packets received by the network adapter on your device. Current versions of these tools include full support for IPsec. They can identify encrypted network packets, but they cannot decrypt them.
|
||||
> [!NOTE]
|
||||
> In addition to the steps shown in this procedure, you can also use network traffic capture tools such as [Microsoft Network Monitor](https://www.microsoft.com/download/4865). Network Monitor and similar tools allow you to capture, parse, and display the network packets received by the network adapter on your device. Current versions of these tools include full support for IPsec. They can identify encrypted network packets, but they cannot decrypt them.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
|
||||
@ -234,33 +234,6 @@ Certified against the Protection Profile for General Purpose Operating Systems.
|
||||
- [Administrative Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=cb19538d-9e13-4ab6-af38-8f48abfdad08)
|
||||
- [Certification Report](http://www.commoncriteriaportal.org:80/files/epfiles/0570a_pdf.pdf)
|
||||
|
||||
### Windows XP and Windows Server 2003
|
||||
|
||||
- [Security Target - Windows Server 2003 SP2 including R2, x64, and IA64; Windows XP Professional SP2 and x64 SP2; and Windows XP Embedded SP2](https://www.commoncriteriaportal.org/files/epfiles/st_vid10184-st.pdf)
|
||||
- [Identifying Windows XP and Windows Server 2003 Common Criteria Certified Requirements for the NIST Special Publication 800-53](https://download.microsoft.com/download/a/9/6/a96d1dfc-2bd4-408d-8d93-e0ede7529691/xpws03_ccto800-53.doc)
|
||||
- [Windows Server 2003 SP2 R2 Administrator Guide 3.0](https://www.microsoft.com/downloads/details.aspx?familyid=39598841-e693-4891-9234-cfd1550f3949)
|
||||
- [Windows Server 2003 SP2 R2 Configuration Guide 3.0](https://www.microsoft.com/downloads/details.aspx?familyid=4f7b6a93-0307-480f-a5af-a20268cbd7cc)
|
||||
- [Windows Server 2003 SP1 Administrator's Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=75736009-59e9-4a71-879e-cf581817b8cc)
|
||||
- [Windows Server 2003 SP1 Configuration Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=a0ad1856-beb7-4285-b47c-381e8a210c38)
|
||||
- [Windows Server 2003 with x64 Hardware Administrator's Guide](https://www.microsoft.com/downloads/details.aspx?familyid=8a26829f-c177-4b79-913a-4135fb7b96ef)
|
||||
- [Windows Server 2003 with x64 Hardware Configuration Guide](https://www.microsoft.com/downloads/details.aspx?familyid=3f9ecd0a-74dd-4d23-a4e5-d7b63fed70e8)
|
||||
- [Windows XP Administrator Guide 3.0](https://www.microsoft.com/downloads/details.aspx?familyid=9a7f0b16-72ce-4675-aec8-58785c4e37ee)
|
||||
- [Windows XP Configuration Guide 3.0](https://www.microsoft.com/downloads/details.aspx?familyid=165da57d-f066-4ddf-9462-cbecfcd68694)
|
||||
- [Windows XP User Guide 3.0](https://www.microsoft.com/downloads/details.aspx?familyid=7c1a4761-9b9e-429c-84eb-cd7b034c5779)
|
||||
- [Windows XP Professional with x64 Hardware Administrator's Guide](https://www.microsoft.com/downloads/details.aspx?familyid=346f041e-d641-4af7-bdea-c5a3246d0431)
|
||||
- [Windows XP Professional with x64 Hardware Configuration Guide](https://www.microsoft.com/downloads/details.aspx?familyid=a7075319-cc3d-4420-a00b-8c9a7068ad54)
|
||||
- [Windows XP Professional with x64 Hardware User’s Guide](https://www.microsoft.com/downloads/details.aspx?familyid=26c49cf5-6159-4197-97ce-bf1fdfc54569)
|
||||
- [Windows XP Professional Administrator's Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=9bcac470-a0b3-4d34-a561-fa8308c0ff60)
|
||||
- [Windows XP Professional Configuration Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=9f04915e-571a-422d-8ffa-5797051e81de)
|
||||
- [Windows XP Professional User's Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=d39d0028-7093-495c-80da-2b5b29a54bd8)
|
||||
- [Windows XP / Windows Server 2003 with x64 Hardware ETR](https://www.microsoft.com/downloads/details.aspx?familyid=6e8d98f9-25b9-4c85-9bd9-24d91ea3c9ef)
|
||||
- [Windows XP / Windows Server 2003 with x64 Hardware ETR, Part II](https://www.microsoft.com/downloads/details.aspx?familyid=0c35e7d8-9c56-4686-b902-d5ffb9915658)
|
||||
- [Windows Server 2003 SP2 including R2, Standard, Enterprise, Datacenter, x64, and Itanium Editions Validation Report](https://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf)
|
||||
- [Windows XP Professional SP2 and x64 SP2 Validation Report](https://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf)
|
||||
- [Windows XP Embedded SP2 Validation Report](https://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf)
|
||||
- [Windows XP and Windows Server 2003 ETR](https://www.microsoft.com/downloads/details.aspx?familyid=63cf2a1e-f578-4bb5-9245-d411f0f64265)
|
||||
- [Windows XP and Windows Server 2003 Validation Report](https://www.commoncriteriaportal.org/files/epfiles/st_vid9506-vr.pdf)
|
||||
|
||||
### Windows Server 2003 Certificate Server
|
||||
|
||||
- [Security Target](https://www.commoncriteriaportal.org/files/epfiles/st_vid9507-st.pdf)
|
||||
|
||||
@ -18,7 +18,7 @@ ms.technology: windows-sec
|
||||
|
||||
Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation. Software installed inside the Windows Sandbox environment remains "sandboxed" and runs separately from the host machine.
|
||||
|
||||
A sandbox is temporary. When it's closed, all the software and files and the state are deleted. You get a brand-new instance of the sandbox every time you open the application.
|
||||
A sandbox is temporary. When it's closed, all the software and files and the state are deleted. You get a brand-new instance of the sandbox every time you open the application. Note, however, that as of [Windows 11 Build 22509](https://blogs.windows.com/windows-insider/2021/12/01/announcing-windows-11-insider-preview-build-22509/), your data will persist through a restart initiated from inside the virtualized environment—useful for installing applications that require the OS to reboot.
|
||||
|
||||
Software and applications installed on the host aren't directly available in the sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment.
|
||||
|
||||
@ -40,7 +40,7 @@ The following video provides an overview of Windows Sandbox.
|
||||
## Prerequisites
|
||||
|
||||
- Windows 10 Pro, Enterprise or Education build 18305 or Windows 11 (*Windows Sandbox is currently not supported on Windows Home edition*)
|
||||
- AMD64 architecture
|
||||
- AMD64 or (as of [Windows 11 Build 22483](https://blogs.windows.com/windows-insider/2021/10/20/announcing-windows-11-insider-preview-build-22483/)) ARM64 architecture
|
||||
- Virtualization capabilities enabled in BIOS
|
||||
- At least 4 GB of RAM (8 GB recommended)
|
||||
- At least 1 GB of free disk space (SSD recommended)
|
||||
|
||||
@ -36,7 +36,7 @@ With Windows 10, you can create provisioning packages that let you quickly and e
|
||||
|
||||
### AppLocker
|
||||
|
||||
AppLocker was available for Windows 8.1, and is improved with Windows 10. See [Requirements to use AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md) for a list of operating system requirements.
|
||||
AppLocker was available for Windows 8.1, and is improved with Windows 10. See [Requirements to use AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker) for a list of operating system requirements.
|
||||
|
||||
Enhancements to AppLocker in Windows 10 include:
|
||||
|
||||
|
||||
@ -56,7 +56,7 @@ Windows 10, version 1909 also includes two new features called **Key-rolling** a
|
||||
|
||||
### Transport Layer Security (TLS)
|
||||
|
||||
An experimental implementation of TLS 1.3 is included in Windows 10, version 1909. TLS 1.3 disabled by default system wide. If you enable TLS 1.3 on a device for testing, then it can also be enabled in Internet Explorer 11.0 and Microsoft Edge by using Internet Options. For beta versions of Microsoft Edge on Chromium, TLS 1.3 is not built on the Windows TLS stack, and is instead configured independently, using the **Edge://flags** dialog. Also see [Microsoft Edge platform status](https://developer.microsoft.com/microsoft-edge/platform/status/tls13/).
|
||||
An experimental implementation of TLS 1.3 is included in Windows 10, version 1909. TLS 1.3 disabled by default system wide. If you enable TLS 1.3 on a device for testing, then it can also be enabled in Internet Explorer 11.0 and Microsoft Edge by using Internet Options. For beta versions of Microsoft Edge on Chromium, TLS 1.3 is not built on the Windows TLS stack, and is instead configured independently, using the **Edge://flags** dialog. Also see [Microsoft Edge platform status](https://developer.microsoft.com/microsoft-edge/status/tls13/)
|
||||
|
||||
## Virtualization
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user