diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 83ddf2f2b7..1ac5a9f388 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -281,8 +281,8 @@ #### [SurfaceHub DDF file](surfacehub-ddf-file.md) ### [TPMPolicy CSP](tpmpolicy-csp.md) #### [TPMPolicy DDF file](tpmpolicy-ddf-file.md) -### [Uefi CSP](uefi-csp.md) -#### [Uefi DDF file](uefi-ddf.md) +### [UEFI CSP](uefi-csp.md) +#### [UEFI DDF file](uefi-ddf.md) ### [UnifiedWriteFilter CSP](unifiedwritefilter-csp.md) #### [UnifiedWriteFilter DDF file](unifiedwritefilter-ddf.md) ### [Update CSP](update-csp.md) diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index c48d6ddd3b..e69e71e093 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -13,6 +13,9 @@ ms.date: 11/01/2017 # DMClient CSP +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + The DMClient configuration service provider is used to specify additional enterprise-specific mobile device management configuration settings for identifying the device in the enterprise domain, security mitigation for certificate renewal, and server-triggered enterprise unenrollment. The following diagram shows the DMClient configuration service provider in tree format. @@ -257,6 +260,11 @@ Optional. Number of days after last sucessful sync to unenroll. Supported operations are Add, Delete, Get, and Replace. Value type is integer. +**Provider/*ProviderID*/AADSendDeviceToken** +Device. Added in Windows 10 next major update. For AZure AD backed enrollments, this will cause the client to send a Device Token if the User Token can not be obtained. + +Supported operations are Add, Delete, Get, and Replace. Value type is bool. + **Provider/*ProviderID*/Poll** Optional. Polling schedules must utilize the DMClient CSP. The Registry paths previously associated with polling using the Registry CSP are now deprecated. @@ -690,19 +698,45 @@ Required. Added in Windows 10, version 1709. This node determines how long we wi Supported operations are Get and Replace. Value type is integer. **Provider/*ProviderID*/FirstSyncStatus/ServerHasFinishedProvisioning** -Required. Added in Windows 10, version 1709. This node is set by the server to inform the UX that the server has finished provisioning the device. This was added so that the server can “change its mind" about what it needs to provision on the device. When this node is set, many other DM Client nodes will no longer be able to be changed. If this node is not True, the UX will consider the provisioning a failure. Once set to true, it would reject attempts to change it back to false with CFGMGR_E_COMMANDNOTALLOWED. +Required. Added in Windows 10, version 1709. This node is set by the server to inform the UX that the server has finished provisioning the device. This was added so that the server can “change its mind" about what it needs to provision on the device. When this node is set, many other DM Client nodes will no longer be able to be changed. If this node is not True, the UX will consider the provisioning a failure. Once set to true, it would reject attempts to change it back to false with CFGMGR_E_COMMANDNOTALLOWED. This node applies to the per user expected policies and resources lists. Supported operations are Get and Replace. Value type is boolean. -**Provider/*ProviderID*/FirstSyncStatus/IsSyncDone**Required. Added in Windows 10, version 1709. This node, when doing a get, tells the server if the “First Syncs" are done and the device is fully provisioned. When doing a Set, this triggers the UX to override whatever state it is in and tell the user that the device is provisioned. It cannot be set from True to False (it will not change its mind on whether or not the sync is done), and it cannot be set from True to True (to prevent notifications from firing multiple times). +**Provider/*ProviderID*/FirstSyncStatus/IsSyncDone** +Required. Added in Windows 10, version 1709. This node, when doing a get, tells the server if the “First Syncs" are done and the device is fully provisioned. When doing a Set, this triggers the UX to override whatever state it is in and tell the user that the device is provisioned. It cannot be set from True to False (it will not change its mind on whether or not the sync is done), and it cannot be set from True to True (to prevent notifications from firing multiple times). This node only applies to the user MDM status page (on a per user basis). Supported operations are Get and Replace. Value type is boolean. **Provider/*ProviderID*/FirstSyncStatus/WasDeviceSuccessfullyProvisioned** -Required. Added in Windows 10, version 1709. Integer node determining if a device was successfully provisioned. 0 is failure, 1 is success, 2 is in progress. Once the value is changed to 0 or 1, the value cannot be changed again. The client will change the value of success or failure and update the node. The server can, however, force a failure or success message to appear on the device by setting this value and then setting the IsSyncDone node to true. +Required. Added in Windows 10, version 1709. Integer node determining if a device was successfully provisioned. 0 is failure, 1 is success, 2 is in progress. Once the value is changed to 0 or 1, the value cannot be changed again. The client will change the value of success or failure and update the node. The server can, however, force a failure or success message to appear on the device by setting this value and then setting the IsSyncDone node to true. This node only applies to the user MDM status page (on a per user basis). Supported operations are Get and Replace. Value type is integer. +**Provider/*ProviderID*/FirstSyncStatus/BlockInStatusPage** +Required. Device Only. Added in Windows 10, next major update. This node determines whether or not the MDM progress page is blocking in the Azure AD joined or DJ++ case, as well as which remediation options are available. + +Supported operations are Get and Replace. Value type is integer. + +**Provider/*ProviderID*/FirstSyncStatus/AllowCollectLogsButton** +Required. Added in Windows 10, next major update. This node decides whether or not the MDM progress page displays the Collect Logs button. + +Supported operations are Get and Replace. Value type is bool. + +**Provider/*ProviderID*/FirstSyncStatus/CustomErrorText** +Required. Added in Windows 10, next major update. This node allows the MDM to set custom error text, detailing what the user needs to do in case of error. + +Supported operations are Add, Get, Delete, and Replace. Value type is string. + +**Provider/*ProviderID*/FirstSyncStatus/SkipDeviceStatusPage** +Required. Device only. Added in Windows 10, next major update. This node decides wheter or not the MDM device progress page skips after Azure AD joined or Hybrid Azure AD joined in OOBE. + +Supported operations are Get and Replace. Value type is bool. + +**Provider/*ProviderID*/FirstSyncStatus/SkipUserStatusPage** +Required. Device only. Added in Windows 10, next major update. This node decides wheter or not the MDM user progress page skips after Azure AD joined or DJ++ after user login. + +Supported operations are Get and Replace. Value type is bool. + **Provider/*ProviderID*/EnhancedAppLayerSecurity** Required node. Added in Windows 10, version 1709. diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index 22082b40c3..51a46a8897 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -13,11 +13,14 @@ ms.date: 12/05/2017 # DMClient DDF file +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + This topic shows the OMA DM device description framework (DDF) for the **DMClient** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1907. +The XML below is for Windows 10, next major update. ``` syntax @@ -28,7 +31,355 @@ The XML below is for Windows 10, version 1907. 1.2 DMClient - ./Vendor/MSFT + ./User/Vendor/MSFT + + + + + + + + + + + + + + + com.microsoft/1.5/MDM/DMClient + + + + Provider + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + text/plain + + + + FirstSyncStatus + + + + + + + + + + + + + + + + + + + + + ExpectedPolicies + + + + + + + + This node contains a list of LocURIs that refer to Policies the ISV expects to provision, delimited by the character L"\xF000" (the CSP_LIST_DELIMITER). This is per user. + + + + + + + + + + + text/plain + + + + + ExpectedNetworkProfiles + + + + + + + + This node contains a list of LocURIs that refer to Wi-Fi profiles and VPN profiles the ISV expects to provision, delimited by the character L"\xF000". This is per user. + + + + + + + + + + + text/plain + + + + + ExpectedMSIAppPackages + + + + + + + + This node contains a list of LocURIs that refer to App Packages the ISV expects to provision via EnterpriseDesktopAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the amount of apps included in the App Package. We will not verify that number. E.G. ./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID1/Status;4"\xF000" ./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID2/Status;2 Which will represent that App Package ProductID1 contains 4 apps, whereas ProductID2 contains 2 apps. This is per user. + + + + + + + + + + + text/plain + + + + + ExpectedModernAppPackages + + + + + + + + This node contains a list of LocURIs that refer to App Packages the ISV expects to provision via EnterpriseModernAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the amount of apps included in the App Package. We will not verify that number. E.G. ./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName/Name;4"\xF000" ./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName2/Name;2 Which will represent that App Package PackageFullName contains 4 apps, whereas PackageFullName2 contains 2 apps. This is per user. + + + + + + + + + + + text/plain + + + + + ExpectedPFXCerts + + + + + + + + This node contains a list of LocURIs that refer to certs the ISV expects to provision via ClientCertificateInstall CSP, delimited by the character L"\xF000" (the CSP_LIST_DELIMITER). This is per user. + + + + + + + + + + + text/plain + + + + + ExpectedSCEPCerts + + + + + + + + This node contains a list of LocURIs that refer to SCEP certs the ISV expects to provision via ClientCertificateInstall CSP, delimited by the character L"\xF000" (the CSP_LIST_DELIMITER). This is per user. + + + + + + + + + + + text/plain + + + + + ServerHasFinishedProvisioning + + + + + + This node is set by the server to inform the UX that the server has finished provisioning the device. This was added so that the server can “change its mind" about what it needs to provision on the device. When this node is set, many other DM Client nodes will no longer be able to be changed. If this node is not True, the UX will consider the provisioning a failure. Once set to true, it would reject attempts to change it back to false with CFGMGR_E_COMMANDNOTALLOWED. This node applies to the per user expected policies and resources lists. + + + + + + + + + + + text/plain + + + + + IsSyncDone + + + + + + This node, when doing a get, tells the server if the “First Syncs" are done and the device is fully provisioned. When doing a Set, this triggers the UX to override whatever state it is in and tell the user that the device is provisioned. It cannot be set from True to False (it will not change its mind on whether or not the sync is done), and it cannot be set from True to True (to prevent notifications from firing multiple times). This node only applies to the user MDM status page (on a per user basis). + + + + + + + + + + + text/plain + + + + + WasDeviceSuccessfullyProvisioned + + + + + + Integer node determining if a Device was Successfully provisioned. 0 is failure, 1 is success, 2 is in progress. Once the value is changed to 0 or 1, the value cannot be changed again. The client will change the value of success or failure and update the node. The server can, however, force a failure or success message to appear on the device by setting this value and then setting the IsSyncDone node to true. This node only applies to the user MDM status page (on a per user basis). + + + + + + + + + + + text/plain + + + + + AllowCollectLogsButton + + + + + + false + This node decides whether or not the MDM progress page displays the Collect Logs button. This node only applies to the user MDM status page (on a per user basis). + + + + + + + + + + + + + + text/plain + + + + + CustomErrorText + + + + + + + + This node allows the MDM to set custom error text, detailing what the user needs to do in case of error. This node only applies to the user MDM status page (on a per user basis). + + + + + + + + + + + + + + text/plain + + + + + + + + + DMClient + ./Device/Vendor/MSFT @@ -622,6 +973,30 @@ The XML below is for Windows 10, version 1907. + + AADSendDeviceToken + + + + + + + + Send the device AAD token, if the user one can't be returned + + + + + + + + + + + text/plain + + + Push @@ -1221,7 +1596,7 @@ The XML below is for Windows 10, version 1907. - This node is set by the server to inform the UX that the server has finished provisioning the device. This was added so that the server can “change its mind" about what it needs to provision on the device. When this node is set, many other DM Client nodes will no longer be able to be changed. If this node is not True, the UX will consider the provisioning a failure. Once set to true, it would reject attempts to change it back to false with CFGMGR_E_COMMANDNOTALLOWED. + This node is set by the server to inform the UX that the server has finished provisioning the device. This was added so that the server can “change its mind" about what it needs to provision on the device. When this node is set, many other DM Client nodes will no longer be able to be changed. If this node is not True, the UX will consider the provisioning a failure. Once set to true, it would reject attempts to change it back to false with CFGMGR_E_COMMANDNOTALLOWED. This node applies to the per user expected policies and resources lists. @@ -1243,7 +1618,7 @@ The XML below is for Windows 10, version 1907. - This node, when doing a get, tells the server if the “First Syncs" are done and the device is fully provisioned. When doing a Set, this triggers the UX to override whatever state it is in and tell the user that the device is provisioned. It cannot be set from True to False (it will not change its mind on whether or not the sync is done), and it cannot be set from True to True (to prevent notifications from firing multiple times). + This node, when doing a get, tells the server if the “First Syncs" are done and the device is fully provisioned. When doing a Set, this triggers the UX to override whatever state it is in and tell the user that the device is provisioned. It cannot be set from True to False (it will not change its mind on whether or not the sync is done), and it cannot be set from True to True (to prevent notifications from firing multiple times). This node only applies to the user MDM status page (on a per user basis). @@ -1265,7 +1640,7 @@ The XML below is for Windows 10, version 1907. - Integer node determining if a Device was Successfully provisioned. 0 is failure, 1 is success, 2 is in progress. Once the value is changed to 0 or 1, the value cannot be changed again. The client will change the value of success or failure and update the node. The server can, however, force a failure or success message to appear on the device by setting this value and then setting the IsSyncDone node to true. + Integer node determining if a Device was Successfully provisioned. 0 is failure, 1 is success, 2 is in progress. Once the value is changed to 0 or 1, the value cannot be changed again. The client will change the value of success or failure and update the node. The server can, however, force a failure or success message to appear on the device by setting this value and then setting the IsSyncDone node to true. This node only applies to the user MDM status page (on a per user basis). @@ -1280,6 +1655,137 @@ The XML below is for Windows 10, version 1907. + + BlockInStatusPage + + + + + + 0 + Device Only. This node determines whether or not the MDM progress page is blocking in the AADJ or DJ++ case, as well as which remediation options are available. + + + + + + + + + + + + + + text/plain + + + + + AllowCollectLogsButton + + + + + + false + This node decides whether or not the MDM progress page displays the Collect Logs button. This node only applies to the device MDM status page. + + + + + + + + + + + + + + text/plain + + + + + CustomErrorText + + + + + + + + This node allows the MDM to set custom error text, detailing what the user needs to do in case of error. This node only applies to the user MDM status page (on a per user basis). + + + + + + + + + + + + + + text/plain + + + + + SkipDeviceStatusPage + + + + + + true + Device only. This node decides wheter or not the MDM device progress page skips after AADJ or Hybrid AADJ in OOBE. + + + + + + + + + + + + + + text/plain + + + + + SkipUserStatusPage + + + + + + false + Device only. This node decides wheter or not the MDM user progress page skips after AADJ or DJ++ after user login. + + + + + + + + + + + + + + text/plain + + + EnhancedAppLayerSecurity diff --git a/windows/client-management/mdm/images/provisioning-csp-dmclient-th2.png b/windows/client-management/mdm/images/provisioning-csp-dmclient-th2.png index 88398bc1c5..486779f038 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-dmclient-th2.png and b/windows/client-management/mdm/images/provisioning-csp-dmclient-th2.png differ diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index a3df920a18..8c40978809 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -10,12 +10,16 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/12/2018 +ms.date: 02/05/2018 --- # What's new in MDM enrollment and management +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + This topic provides information about what's new and breaking changes in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](http://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347). @@ -1517,6 +1521,18 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware

Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, next major update.

+[DMClient CSP](dmclient-csp.md) +

Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, next major update:

+ + + [RemoteWipe CSP](remotewipe-csp.md)

Added the following nodes in Windows 10, next major update: