mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-29 21:57:23 +00:00
Merge pull request #2181 from MicrosoftDocs/master
Publish 03/02/2020 10:30 am PST
This commit is contained in:
Rebecca Agiewich
GitHub
commit
dab37bbb38
@ -22,8 +22,8 @@ ms.topic: reference
|
||||
|
||||
Microsoft Edge loads the default New tab page by default. With the relevant New Tab policies, you can set a URL to load in the New Tab page and prevent users from making changes. You can also load a blank page instead or let the users choose what loads.
|
||||
|
||||
>[!NOTE]
|
||||
>New tab pages do not load while running InPrivate mode.
|
||||
> [!NOTE]
|
||||
> New tab pages do not load while running InPrivate mode.
|
||||
|
||||
## Relevant group policies
|
||||
|
||||
|
||||
@ -13,8 +13,8 @@ ms.topic: include
|
||||
|
||||
By default, all sites open the currently active browser. With this policy, you can automatically open all sites not included in the Enterprise Mode Site List in Microsoft Edge. When you enable this policy, you must also turn on the Internet Explorer\Use the Enterprise Mode IE website list policy and include at least one site in the Enterprise Mode Site List.
|
||||
|
||||
>[!NOTE]
|
||||
>If you’ve also enabled the Microsoft Edge [Send all intranet sites to Internet Explorer 11](../available-policies.md#send-all-intranet-sites-to-internet-explorer-11) policy, all intranet sites continue to open in Internet Explorer 11.
|
||||
> [!NOTE]
|
||||
> If you’ve also enabled the Microsoft Edge [Send all intranet sites to Internet Explorer 11](../available-policies.md#send-all-intranet-sites-to-internet-explorer-11) policy, all intranet sites continue to open in Internet Explorer 11.
|
||||
|
||||
You can find the group policy settings in the following location of the Group Policy Editor:
|
||||
|
||||
|
||||
@ -19,8 +19,8 @@ ms.date: 10/19/2018
|
||||
|
||||
ADMX files, which are registry-based policy settings provide an XML-based structure for defining the display of the Administrative Template policy settings in the Group Policy Object Editor. The ADMX files replace ADM files, which used a different markup language.
|
||||
|
||||
>[!NOTE]
|
||||
>The administrative tools you use—Group Policy Object Editor and Group Policy Management Console—remain mostly unchanged. In the majority of situations, you won’t notice the presence of ADMX files during your day-to-day Group Policy administration tasks.
|
||||
> [!NOTE]
|
||||
> The administrative tools you use—Group Policy Object Editor and Group Policy Management Console—remain mostly unchanged. In the majority of situations, you won’t notice the presence of ADMX files during your day-to-day Group Policy administration tasks.
|
||||
|
||||
Unlike ADM files, ADMX files are not stored in individual GPOs by default; however, this behavior supports less common scenarios. For domain-based enterprises, you can create a central store location of ADMX files accessible by anyone with permission to create or edit GPOs. Group Policy tools continue to recognize other earlier ADM files you have in your existing environment. The Group Policy Object Editor automatically reads and displays Administrative Template policy settings from both the ADMX and ADM files.
|
||||
|
||||
|
||||
@ -35,8 +35,8 @@ You must download the deployment folder (**EMIEWebPortal/**), which includes all
|
||||
|
||||
2. Install the Node.js® package manager, [npm](https://www.npmjs.com/).
|
||||
|
||||
>[!Note]
|
||||
>You need to install the npm package manager to replace all the third-party libraries we removed to make the Enterprise Mode Site List Portal open-source.
|
||||
> [!NOTE]
|
||||
> You need to install the npm package manager to replace all the third-party libraries we removed to make the Enterprise Mode Site List Portal open-source.
|
||||
|
||||
3. Open File Explorer and then open the **EMIEWebPortal/** folder.
|
||||
|
||||
@ -105,8 +105,8 @@ Create a new Application Pool and the website, by using the IIS Manager.
|
||||
|
||||
9. Double-click the **Authentication** icon, right-click on **Windows Authentication**, and then click **Enable**.
|
||||
|
||||
>[!Note]
|
||||
>You must also make sure that **Anonymous Authentication** is marked as **Enabled**.
|
||||
> [!NOTE]
|
||||
> You must also make sure that **Anonymous Authentication** is marked as **Enabled**.
|
||||
|
||||
10. Return to the **<<i>website_name</i>> Home** pane, and double-click the **Connection Strings** icon.
|
||||
|
||||
@ -116,8 +116,8 @@ Create a new Application Pool and the website, by using the IIS Manager.
|
||||
|
||||
- **Initial catalog.** The name of your database.
|
||||
|
||||
>[!Note]
|
||||
>Step 3 of this topic provides the steps to create your database.
|
||||
> [!NOTE]
|
||||
> Step 3 of this topic provides the steps to create your database.
|
||||
|
||||
## Step 3 - Create and prep your database
|
||||
Create a SQL Server database and run our custom query to create the Enterprise Mode Site List tables.
|
||||
@ -216,8 +216,8 @@ Register the EMIEScheduler tool and service for production site list changes.
|
||||
|
||||
1. Open File Explorer and go to EMIEWebPortal.SchedulerService\EMIEWebPortal.SchedulerService in your deployment directory, and then copy the **App_Data**, **bin**, and **Logs** folders to a separate folder. For example, C:\EMIEService\.
|
||||
|
||||
>[!Important]
|
||||
>If you can't find the **bin** and **Logs** folders, you probably haven't built the Visual Studio solution. Building the solution creates the folders and files.
|
||||
> [!IMPORTANT]
|
||||
> If you can't find the **bin** and **Logs** folders, you probably haven't built the Visual Studio solution. Building the solution creates the folders and files.
|
||||
|
||||
2. In Visual Studio start the Developer Command Prompt as an administrator, and then change the directory to the location of the InstallUtil.exe file. For example, _C:\Windows\Microsoft.NET\Framework\v4.0.30319_.
|
||||
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
Before you can use a site list with Enterprise Mode, you must turn the functionality on and set up the system for centralized control. By allowing
|
||||
centralized control, you can create one global list of websites that render using Enterprise Mode. Approximately 65 seconds after Internet Explorer 11 starts, it looks for a properly formatted site list. If a new site list if found, with a different version number than the active list, IE11 loads and uses the newer version. After the initial check, IE11 won’t look for an updated list again until you restart the browser.
|
||||
|
||||
>[!NOTE]
|
||||
>We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employees' computers so if the centralized file location is unavailable, they can still use Enterprise Mode.
|
||||
> [!NOTE]
|
||||
> We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employees' computers so if the centralized file location is unavailable, they can still use Enterprise Mode.
|
||||
|
||||
**Group Policy**
|
||||
|
||||
|
||||
@ -7,7 +7,8 @@ author: dansimp
|
||||
ms.prod: ie11
|
||||
ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd
|
||||
ms.reviewer:
|
||||
audience: itpro
manager: dansimp
|
||||
audience: itpro
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros)
|
||||
ms.sitesec: library
|
||||
@ -62,15 +63,15 @@ Each XML file must include:
|
||||
|
||||
The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md).
|
||||
|
||||
```
|
||||
```xml
|
||||
<site-list version="205">
|
||||
<!--- File creation header --->
|
||||
<!-- File creation header -->
|
||||
<created-by>
|
||||
<tool>EnterpriseSitelistManager</tool>
|
||||
<version>10240</version>
|
||||
<date-created>20150728.135021</date-created>
|
||||
</created-by>
|
||||
<!--- Begin Site List --->
|
||||
<!-- Begin Site List -->
|
||||
<site url="www.cpandl.com">
|
||||
<compat-mode>IE8Enterprise</compat-mode>
|
||||
<open-in>MSEdge</open-in>
|
||||
@ -115,8 +116,3 @@ After you’ve added all of your sites to the tool and saved the file to XML, yo
|
||||
- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853)
|
||||
- [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -81,8 +81,8 @@ Every add-on has a Class ID (CLSID) that you use to enable and disable specific
|
||||
|
||||
2. From the copied information, select and copy just the **Class ID** value.
|
||||
|
||||
>[!NOTE]
|
||||
>You want to copy the curly brackets as well as the CLSID: **{47833539-D0C5-4125-9FA8-0819E2EAAC93}**.
|
||||
> [!NOTE]
|
||||
> You want to copy the curly brackets as well as the CLSID: **{47833539-D0C5-4125-9FA8-0819E2EAAC93}**.
|
||||
|
||||
3. Open the Group Policy Management Editor and go to: Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management.
|
||||
<br>**-OR-**<br>
|
||||
|
||||
@ -37,8 +37,8 @@ current version of Internet Explorer.
|
||||
|
||||
Internet Explorer 11 replaces Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10. If you decide you don’t want Internet Explorer 11, and you’re running Windows 7 SP1 or Windows Server 2008 R2 with SP1, you can uninstall it from the **View installed updates** section of the **Uninstall an update** page of the Control Panel.
|
||||
|
||||
>[!Note]
|
||||
>If a user installs Internet Explorer 11 and then removes it, it won’t be re-offered to that computer through Automatic Updates. Instead, the user will have to manually re-install the app.
|
||||
> [!NOTE]
|
||||
> If a user installs Internet Explorer 11 and then removes it, it won’t be re-offered to that computer through Automatic Updates. Instead, the user will have to manually re-install the app.
|
||||
|
||||
## Internet Explorer 11 automatic upgrades
|
||||
|
||||
@ -52,14 +52,14 @@ If you use Automatic Updates in your company, but want to stop your users from a
|
||||
|
||||
- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722).
|
||||
|
||||
>[!Note]
|
||||
>The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](../ie11-faq/faq-ie11-blocker-toolkit.md).
|
||||
> [!NOTE]
|
||||
> The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](../ie11-faq/faq-ie11-blocker-toolkit.md).
|
||||
|
||||
- **Use an update management solution to control update deployment.**
|
||||
If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [Microsoft Endpoint Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit.
|
||||
|
||||
>[!Note]
|
||||
>If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. This scenario is discussed in detail in the Knowledge Base article [here](https://support.microsoft.com/kb/946202).
|
||||
> [!NOTE]
|
||||
> If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. This scenario is discussed in detail in the Knowledge Base article [here](https://support.microsoft.com/kb/946202).
|
||||
|
||||
Additional information on Internet Explorer 11, including a Readiness Toolkit, technical overview, in-depth feature summary, and Internet Explorer 11 download is available on the [Internet Explorer 11 page of the Microsoft Edge IT Center](https://technet.microsoft.com/microsoft-edge/dn262703.aspx).
|
||||
|
||||
@ -81,13 +81,13 @@ Internet Explorer 11 will be released to WSUS as an Update Rollup package. There
|
||||
4. Click the rule that automatically approves an update that is classified as
|
||||
Update Rollup, and then click **Edit.**
|
||||
|
||||
>[!Note]
|
||||
>If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else.
|
||||
> [!NOTE]
|
||||
> If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else.
|
||||
|
||||
5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section.
|
||||
|
||||
>[!Note]
|
||||
>The properties for this rule will resemble the following:<ul><li>When an update is in Update Rollups</li><li>Approve the update for all computers</li></ul>
|
||||
> [!NOTE]
|
||||
> The properties for this rule will resemble the following:<ul><li>When an update is in Update Rollups</li><li>Approve the update for all computers</li></ul>
|
||||
|
||||
6. Clear the **Update Rollup** check box, and then click **OK**.
|
||||
|
||||
@ -101,12 +101,12 @@ Internet Explorer 11 will be released to WSUS as an Update Rollup package. There
|
||||
|
||||
11. Expand *ComputerName*, expand **Updates**, and then click **All Updates**.
|
||||
|
||||
12. Choose **Unapproved** in the **Approval**drop down box.
|
||||
12. Choose **Unapproved** in the **Approval** drop down box.
|
||||
|
||||
13. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update.
|
||||
|
||||
>[!Note]
|
||||
>There may be multiple updates, depending on the imported language and operating system updates.
|
||||
> [!NOTE]
|
||||
> There may be multiple updates, depending on the imported language and operating system updates.
|
||||
|
||||
**Optional**
|
||||
|
||||
@ -126,8 +126,8 @@ If you need to reset your Update Rollups packages to auto-approve, do this:
|
||||
|
||||
7. Click **OK** to close the **Automatic Approvals** dialog box.
|
||||
|
||||
>[!Note]
|
||||
>Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved.
|
||||
> [!NOTE]
|
||||
> Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved.
|
||||
|
||||
|
||||
## Additional resources
|
||||
|
||||
@ -36,8 +36,8 @@ You must download the deployment folder (**EMIEWebPortal/**), which includes all
|
||||
|
||||
2. Install the Node.js® package manager, [npm](https://www.npmjs.com/).
|
||||
|
||||
>[!Note]
|
||||
>You need to install the npm package manager to replace all the third-party libraries we removed to make the Enterprise Mode Site List Portal open-source.
|
||||
> [!NOTE]
|
||||
> You need to install the npm package manager to replace all the third-party libraries we removed to make the Enterprise Mode Site List Portal open-source.
|
||||
|
||||
3. Open File Explorer and then open the **EMIEWebPortal/** folder.
|
||||
|
||||
@ -49,8 +49,8 @@ You must download the deployment folder (**EMIEWebPortal/**), which includes all
|
||||
|
||||
6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, open **Web.config** from **EMIEWebPortal/** folder, and replace MSIT-LOB-COMPAT with your server name hosting your database, replace LOBMerged with your database name, and build the entire solution.
|
||||
|
||||
>[!Note]
|
||||
>Step 3 of this topic provides the steps to create your database.
|
||||
> [!NOTE]
|
||||
> Step 3 of this topic provides the steps to create your database.
|
||||
|
||||
7. Copy the contents of the **EMIEWebPortal/** folder to a dedicated folder on your file system. For example, _D:\EMIEWebApp_. In a later step, you'll designate this folder as your website in the IIS Manager.
|
||||
|
||||
@ -109,8 +109,8 @@ Create a new Application Pool and the website, by using the IIS Manager.
|
||||
|
||||
9. Double-click the **Authentication** icon, right-click on **Windows Authentication**, and then click **Enable**.
|
||||
|
||||
>[!Note]
|
||||
>You must also make sure that **Anonymous Authentication** is marked as **Enabled**.
|
||||
> [!NOTE]
|
||||
> You must also make sure that **Anonymous Authentication** is marked as **Enabled**.
|
||||
|
||||
## Step 3 - Create and prep your database
|
||||
Create a SQL Server database and run our custom query to create the Enterprise Mode Site List tables.
|
||||
@ -209,8 +209,8 @@ Register the EMIEScheduler tool and service for production site list changes.
|
||||
|
||||
1. Open File Explorer and go to EMIEWebPortal.SchedulerService\EMIEWebPortal.SchedulerService in your deployment directory, and then copy the **App_Data**, **bin**, and **Logs** folders to a separate folder. For example, C:\EMIEService\.
|
||||
|
||||
>[!Important]
|
||||
>If you can't find the **bin** and **Logs** folders, you probably haven't built the Visual Studio solution. Building the solution creates the folders and files.
|
||||
> [!IMPORTANT]
|
||||
> If you can't find the **bin** and **Logs** folders, you probably haven't built the Visual Studio solution. Building the solution creates the folders and files.
|
||||
|
||||
2. In Visual Studio start the Developer Command Prompt as an administrator, and then change the directory to the location of the InstallUtil.exe file. For example, _C:\Windows\Microsoft.NET\Framework\v4.0.30319_.
|
||||
|
||||
|
||||
@ -85,8 +85,8 @@ To see if the site works in the Internet Explorer 5, Internet Explorer 7, Intern
|
||||
|
||||
- Run the site in each document mode until you find the mode in which the site works.
|
||||
|
||||
>[!NOTE]
|
||||
>You will need to make sure the User agent string dropdown matches the same browser version as the Document mode dropdown. For example, if you were testing to see if the site works in Internet Explorer 10, you should update the Document mode dropdown to 10 and the User agent string dropdown to Internet Explorer 10.
|
||||
> [!NOTE]
|
||||
> You will need to make sure the User agent string dropdown matches the same browser version as the Document mode dropdown. For example, if you were testing to see if the site works in Internet Explorer 10, you should update the Document mode dropdown to 10 and the User agent string dropdown to Internet Explorer 10.
|
||||
|
||||
- If you find a mode in which your site works, you will need to add the site domain, sub-domain, or URL to the Enterprise Mode Site List for the document mode in which the site works, or ask the IT administrator to do so. You can add the *x-ua-compatible* meta tag or HTTP header as well.
|
||||
|
||||
@ -116,8 +116,8 @@ If IE8 Enterprise Mode doesn't work, IE7 Enterprise Mode will give you the Compa
|
||||
|
||||
If the site works, inform the IT administrator that the site needs to be added to the IE7 Enterprise Mode section.\
|
||||
|
||||
>[!NOTE]
|
||||
>Adding the same Web path to the Enterprise Mode and sections of the Enterprise Mode Site List will not work, but we will address this in a future update.
|
||||
> [!NOTE]
|
||||
> Adding the same Web path to the Enterprise Mode and sections of the Enterprise Mode Site List will not work, but we will address this in a future update.
|
||||
|
||||
### Update the site for modern web standards
|
||||
|
||||
|
||||
@ -28,8 +28,8 @@ ms.localizationpriority: medium
|
||||
|
||||
Before you can use a site list with Enterprise Mode, you need to turn the functionality on and set up the system for centralized control. By allowing centralized control, you can create one global list of websites that render using Enterprise Mode. Approximately 65 seconds after Internet Explorer 11 starts, it looks for a properly formatted site list. If a new site list if found, with a different version number than the active list, IE11 loads and uses the newer version. After the initial check, IE11 won’t look for an updated list again until you restart the browser.
|
||||
|
||||
>[!NOTE]
|
||||
>We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employees' computers so if the centralized file location is unavailable, they can still use Enterprise Mode.
|
||||
> [!NOTE]
|
||||
> We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employees' computers so if the centralized file location is unavailable, they can still use Enterprise Mode.
|
||||
|
||||
**To turn on Enterprise Mode using Group Policy**
|
||||
|
||||
@ -64,8 +64,3 @@ Before you can use a site list with Enterprise Mode, you need to turn the functi
|
||||
- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md)
|
||||
- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -46,14 +46,6 @@ For IE11, the UI has been changed to provide just the controls needed to support
|
||||
## Where did the search box go?
|
||||
IE11 uses the **One Box** feature, which lets users type search terms directly into the **Address bar**. Any text entered into the **Address bar** that doesn't appear to be a URL is automatically sent to the currently selected search provider.
|
||||
|
||||
>[!NOTE]
|
||||
>Depending on how you've set up your intranet search, the text entry might resolve to an intranet site. For more information about this, see [Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> Depending on how you've set up your intranet search, the text entry might resolve to an intranet site. For more information about this, see [Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md).
|
||||
|
||||
|
||||
@ -29,8 +29,8 @@ ms.date: 05/10/2018
|
||||
|
||||
The Internet Explorer 11 Blocker Toolkit lets you turn off the automatic delivery of IE11 through the **Automatic Updates** feature of Windows Update.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The IE11 Blocker Toolkit does not stop users from manually installing IE11 from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?linkid=327753). Also, even if you have installed previous versions of the toolkit before, like for Internet Explorer 10, you still need to install this version to prevent the installation of IE11.
|
||||
> [!IMPORTANT]
|
||||
> The IE11 Blocker Toolkit does not stop users from manually installing IE11 from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?linkid=327753). Also, even if you have installed previous versions of the toolkit before, like for Internet Explorer 10, you still need to install this version to prevent the installation of IE11.
|
||||
|
||||
## Install the toolkit
|
||||
|
||||
@ -69,13 +69,13 @@ If you use Automatic Updates in your company, but want to stop your users from a
|
||||
|
||||
- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722).
|
||||
|
||||
>[!NOTE]
|
||||
> [!NOTE]
|
||||
>The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11).
|
||||
|
||||
- **Use an update management solution to control update deployment.** If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit.
|
||||
|
||||
>[!NOTE]
|
||||
>If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company.
|
||||
> [!NOTE]
|
||||
> If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company.
|
||||
|
||||
|
||||
### Prevent automatic installation of Internet Explorer 11 with WSUS
|
||||
@ -90,13 +90,13 @@ Internet Explorer 11 will be released to WSUS as an Update Rollup package. There
|
||||
|
||||
4. Click the rule that automatically approves an update that is classified as Update Rollup, and then click **Edit.**
|
||||
|
||||
>[!NOTE]
|
||||
>If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else.
|
||||
> [!NOTE]
|
||||
> If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else.
|
||||
|
||||
5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section.
|
||||
|
||||
>[!NOTE]
|
||||
>The properties for this rule will resemble the following:<ul><li>When an update is in Update Rollups</li><li>Approve the update for all computers</li></ul>
|
||||
> [!NOTE]
|
||||
> The properties for this rule will resemble the following:<ul><li>When an update is in Update Rollups</li><li>Approve the update for all computers</li></ul>
|
||||
|
||||
6. Clear the **Update Rollup** check box, and then click **OK**.
|
||||
|
||||
@ -116,8 +116,8 @@ After the new Internet Explorer 11 package is available for download, you should
|
||||
|
||||
6. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update.
|
||||
|
||||
>[!NOTE]
|
||||
>There may be multiple updates, depending on the imported language and operating system updates.
|
||||
> [!NOTE]
|
||||
> There may be multiple updates, depending on the imported language and operating system updates.
|
||||
|
||||
### Optional - Reset update rollups packages to auto-approve
|
||||
|
||||
@ -135,8 +135,8 @@ After the new Internet Explorer 11 package is available for download, you should
|
||||
|
||||
7. Click **OK** to close the **Automatic Approvals** dialog box.
|
||||
|
||||
>[!NOTE]
|
||||
>Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved.
|
||||
> [!NOTE]
|
||||
> Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -36,22 +36,22 @@ You can customize and install IEAK 11 on the following supported operating syste
|
||||
|
||||
- Windows Server 2008 R2 Service Pack 1 (SP1)
|
||||
|
||||
>[!Note]
|
||||
>IEAK 11 does not support building custom packages for Windows RT.
|
||||
> [!NOTE]
|
||||
> IEAK 11 does not support building custom packages for Windows RT.
|
||||
|
||||
|
||||
**What can I customize with IEAK 11?**
|
||||
|
||||
The IEAK 11 enables you to customize branding and settings for Internet Explorer 11. For PCs running Windows 7, the custom package also includes the Internet Explorer executable.
|
||||
|
||||
>[!Note]
|
||||
>Internet Explorer 11 is preinstalled on PCs running Windows 8. Therefore, the executable is not included in the customized package.
|
||||
> [!NOTE]
|
||||
> Internet Explorer 11 is preinstalled on PCs running Windows 8. Therefore, the executable is not included in the customized package.
|
||||
|
||||
**Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?**
|
||||
Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard.
|
||||
|
||||
>[!Note]
|
||||
>IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. To download IEAK 11, see [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md).
|
||||
> [!NOTE]
|
||||
> IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. To download IEAK 11, see [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md).
|
||||
|
||||
**Q: Is there a version of the Internet Explorer Administration Kit (IEAK) supporting IE11?**<br>
|
||||
Yes. The Internet Explorer Administration Kit 11 (IEAK 11) is available for download. IEAK 11 lets you create custom versions of IE11 for use in your organization. For more information, see the following resources:
|
||||
|
||||
@ -98,14 +98,14 @@ Pressing the **F1** button on the **Automatic Version Synchronization** page of
|
||||
## Certificate installation does not work on IEAK 11
|
||||
IEAK 11 doesn't install certificates added using the Add a Root Certificate page of the Internet Explorer Customization Wizard 11. Administrators can manually install certificates using the Certificates Microsoft Management Console snap-in (Certmgr.msc) or using the command-line tool, Certificate Manager (Certmgr.exe).
|
||||
|
||||
>[!NOTE]
|
||||
>This applies only when using the External licensing mode of IEAK 11.
|
||||
> [!NOTE]
|
||||
> This applies only when using the External licensing mode of IEAK 11.
|
||||
|
||||
## The Additional Settings page appears in the wrong language when using a localized version of IEAK 11
|
||||
When using IEAK 11 in other languages, the settings on the Additional Settings page appear in the language of the target platform, regardless of the IEAK 11 language.
|
||||
|
||||
>[!NOTE]
|
||||
>This applies only when using the Internal licensing mode of IEAK 11.
|
||||
> [!NOTE]
|
||||
> This applies only when using the Internal licensing mode of IEAK 11.
|
||||
|
||||
To work around this issue, run the customization wizard following these steps:
|
||||
1. On the **Language Selection** page, select the language that matches the language of your installed IEAK 11.
|
||||
|
||||
@ -32,8 +32,8 @@ IEAK 10 and newer includes the ability to install using one of the following ins
|
||||
- Internal
|
||||
- External
|
||||
|
||||
>[!NOTE]
|
||||
>IEAK 11 works in network environments, with or without Microsoft Active Directory service.
|
||||
> [!NOTE]
|
||||
> IEAK 11 works in network environments, with or without Microsoft Active Directory service.
|
||||
|
||||
|
||||
### Corporations
|
||||
|
||||
@ -30,7 +30,7 @@ Deployment status summarizes detailed status into higher-level states to get a q
|
||||
|Deployment status |Description |
|
||||
|---------|---------|
|
||||
|Failed | The device encountered a failure during the update process. Note that due to latency, devices reporting this status may have since retried the update. |
|
||||
|Progress stalled | he device started the update process, but no progress has been reported in the last 7 days. |
|
||||
|Progress stalled | The device started the update process, but no progress has been reported in the last 7 days. |
|
||||
|Deferred | The device is currently deferring the update process due to Windows Update for Business policies. |
|
||||
|In progress | The device has begun the updating process for this update. This status appears if the device is in any stage of the update process including and after download, but before completing the update. If no progress has been reported in the last 7 days, devices will move to **Progress stalled**.** |
|
||||
|Update completed | The device has completed the update process. |
|
||||
@ -42,7 +42,7 @@ Deployment status summarizes detailed status into higher-level states to get a q
|
||||
Detailed status provides a detailed stage-level representation of where in the update process the device was last reported to be in relative to this specific update. Note that with the latency of deployment data, devices might have since moved on from the reported detailed status.
|
||||
|
||||
|
||||
|Detaild status |Description |
|
||||
|Detailed status |Description |
|
||||
|---------|---------|
|
||||
|Scheduled in next X days | The device is currently deferring the update with Windows Update for Business policies but will be offered the update within the next X days. |
|
||||
|Compatibility hold | The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#compatibility-holds) |
|
||||
@ -59,7 +59,7 @@ Detailed status provides a detailed stage-level representation of where in the u
|
||||
|Commit | The device, after a restart, is committing changes relevant to the update. |
|
||||
|Finalize succeeded | The device has finished final tasks after a restart to apply the update. |
|
||||
|Update successful | The device has successfully applied the update. |
|
||||
|Cancelled | The update was cancelled at some point in the update process. |
|
||||
|Cancelled | The update was canceled at some point in the update process. |
|
||||
|Uninstalled | The update was successfully uninstalled from the device. |
|
||||
|Rollback | The update failed to apply during the update process, causing the device to roll back changes and revert to the previous update. |
|
||||
|
||||
|
||||
@ -21,20 +21,23 @@ ms.custom: autopilot
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
|
||||
To get started with Windows Autopilot, you should try it out with a virtual machine (VM) or you can use a physical device that will be wiped and then have a fresh install of Windows 10.
|
||||
|
||||
In this topic you'll learn how to set-up a Windows Autopilot deployment for a VM using Hyper-V. Note: Although there are [multiple platforms](administer.md) available to enable Autopilot, this lab primarily uses Intune.
|
||||
In this topic you'll learn how to set-up a Windows Autopilot deployment for a VM using Hyper-V.
|
||||
|
||||
>Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you are using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual.
|
||||
> [!NOTE]
|
||||
> Although there are [multiple platforms](administer.md) available to enable Autopilot, this lab primarily uses Intune.
|
||||
|
||||
> Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you are using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual.
|
||||
|
||||
The following video provides an overview of the process:
|
||||
|
||||
</br>
|
||||
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/KYVptkpsOqs" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe>
|
||||
|
||||
>For a list of terms used in this guide, see the [Glossary](#glossary) section.
|
||||
> For a list of terms used in this guide, see the [Glossary](#glossary) section.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
@ -85,7 +88,7 @@ A summary of the sections and procedures in the lab is provided below. Follow ea
|
||||
|
||||
If you don't already have Hyper-V, we must first enable this on a computer running Windows 10 or Windows Server (2012 R2 or later).
|
||||
|
||||
>If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you are using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10).
|
||||
> If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you are using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10).
|
||||
|
||||
If you are not sure that your device supports Hyper-V, or you have problems installing Hyper-V, see [appendix A](#appendix-a-verify-support-for-hyper-v) below for details on verifying that Hyper-V can be successfully installed.
|
||||
|
||||
@ -105,7 +108,7 @@ Install-WindowsFeature -Name Hyper-V -IncludeManagementTools
|
||||
|
||||
When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once.
|
||||
|
||||
>Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below:
|
||||
> Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below:
|
||||
|
||||
|
||||
|
||||
@ -121,7 +124,7 @@ To read more about Hyper-V, see [Introduction to Hyper-V on Windows 10](https://
|
||||
|
||||
Now that Hyper-V is enabled, we need to create a VM running Windows 10. We can [create a VM](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/create-virtual-machine) and [virtual network](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/connect-to-network) using Hyper-V Manager, but it is simpler to use Windows PowerShell.
|
||||
|
||||
To use Windows Powershell we just need to know two things:
|
||||
To use Windows PowerShell, we just need to know two things:
|
||||
|
||||
1. The location of the Windows 10 ISO file.
|
||||
- In the example, we assume the location is **c:\iso\win10-eval.iso**.
|
||||
@ -157,8 +160,8 @@ For example, if the command above displays Ethernet but you wish to use Ethernet
|
||||
|
||||
All VM data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the following commands.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>**VM switch**: a VM switch is how Hyper-V connects VMs to a network. <br><br>If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."<br><br>If you have never created an external VM switch before, then just run the commands below.
|
||||
> [!IMPORTANT]
|
||||
> **VM switch**: a VM switch is how Hyper-V connects VMs to a network. <br><br>If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."<br><br>If you have never created an external VM switch before, then just run the commands below.
|
||||
|
||||
```powershell
|
||||
New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name
|
||||
@ -222,7 +225,7 @@ Ensure the VM booted from the installation ISO, click **Next** then click **Inst
|
||||
|
||||
|
||||
|
||||
>After the VM restarts, during OOBE, it’s fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example:
|
||||
After the VM restarts, during OOBE, it’s fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example:
|
||||
|
||||
|
||||
|
||||
@ -240,7 +243,8 @@ Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see
|
||||
|
||||
## Capture the hardware ID
|
||||
|
||||
>NOTE: Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you’re not going to use the OA3 Tool to capture the full 4K HH for various reasons (you’d have to install the OA3 tool, your device couldn’t have a volume license version of Windows, it’s a more complicated process than using a PS script, etc.). Instead, you’ll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool.
|
||||
> [!NOTE]
|
||||
> Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you’re not going to use the OA3 Tool to capture the full 4K HH for various reasons (you’d have to install the OA3 tool, your device couldn’t have a volume license version of Windows, it’s a more complicated process than using a PS script, etc.). Instead, you’ll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool.
|
||||
|
||||
Follow these steps to run the PS script:
|
||||
|
||||
@ -294,7 +298,8 @@ PS C:\HWID>
|
||||
|
||||
Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size. This file contains the complete 4K HH.
|
||||
|
||||
**Note**: Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below.
|
||||
> [!NOTE]
|
||||
> Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below.
|
||||
|
||||
|
||||
|
||||
@ -302,8 +307,8 @@ You will need to upload this data into Intune to register your device for Autopi
|
||||
|
||||
If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this.
|
||||
|
||||
>[!NOTE]
|
||||
>When copying and pasting to or from VMs, avoid clicking other things with your mouse cursor between the copy and paste process as this can empty or overwrite the clipboard and require that you start over. Go directly from copy to paste.
|
||||
> [!NOTE]
|
||||
> When copying and pasting to or from VMs, avoid clicking other things with your mouse cursor between the copy and paste process as this can empty or overwrite the clipboard and require that you start over. Go directly from copy to paste.
|
||||
|
||||
## Reset the VM back to Out-Of-Box-Experience (OOBE)
|
||||
|
||||
@ -336,8 +341,8 @@ To convert your Intune trial account to a free Premium trial account, navigate t
|
||||
|
||||
If you already have company branding configured in Azure Active Directory, you can skip this step.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Make sure to sign-in with a Global Administrator account.
|
||||
> [!IMPORTANT]
|
||||
> Make sure to sign-in with a Global Administrator account.
|
||||
|
||||
Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), click on **Configure** and configure any type of company branding you'd like to see during the OOBE.
|
||||
|
||||
@ -345,8 +350,8 @@ Navigate to [Company branding in Azure Active Directory](https://portal.azure.co
|
||||
|
||||
When you are finished, click **Save**.
|
||||
|
||||
>[!NOTE]
|
||||
>Changes to company branding can take up to 30 minutes to apply.
|
||||
> [!NOTE]
|
||||
> Changes to company branding can take up to 30 minutes to apply.
|
||||
|
||||
## Configure Microsoft Intune auto-enrollment
|
||||
|
||||
@ -368,8 +373,8 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared.
|
||||
> [!NOTE]
|
||||
> If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared.
|
||||
|
||||
2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It’s okay if other fields (Windows Product ID) are left blank.
|
||||
|
||||
@ -385,8 +390,8 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B
|
||||
|
||||
### Autopilot registration using MSfB
|
||||
|
||||
>[!IMPORTANT]
|
||||
>If you've already registered your VM (or device) using Intune, then skip this step.
|
||||
> [!IMPORTANT]
|
||||
> If you've already registered your VM (or device) using Intune, then skip this step.
|
||||
|
||||
Optional: see the following video for an overview of the process.
|
||||
|
||||
@ -408,8 +413,8 @@ Click the **Add devices** link to upload your CSV file. A message will appear in
|
||||
|
||||
## Create and assign a Windows Autopilot deployment profile
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only <U>pick one for purposes of this lab</U>:
|
||||
> [!IMPORTANT]
|
||||
> Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only <U>pick one for purposes of this lab</U>:
|
||||
|
||||
Pick one:
|
||||
- [Create profiles using Intune](#create-a-windows-autopilot-deployment-profile-using-intune)
|
||||
@ -417,12 +422,12 @@ Pick one:
|
||||
|
||||
### Create a Windows Autopilot deployment profile using Intune
|
||||
|
||||
>[!NOTE]
|
||||
>Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first:
|
||||
> [!NOTE]
|
||||
> Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first:
|
||||
|
||||
|
||||
|
||||
>The example above lists both a physical device and a VM. Your list should only include only one of these.
|
||||
> The example above lists both a physical device and a VM. Your list should only include only one of these.
|
||||
|
||||
To create a Windows Autopilot profile, select **Device enrollment** > **Windows enrollment** > **Deployment profiles**
|
||||
|
||||
@ -458,7 +463,7 @@ See the following example:
|
||||
|
||||
Click on **OK** and then click on **Create**.
|
||||
|
||||
>If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile).
|
||||
> If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile).
|
||||
|
||||
#### Assign the profile
|
||||
|
||||
@ -534,8 +539,8 @@ Confirm the profile was successfully assigned to the intended device by checking
|
||||
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device.
|
||||
> [!IMPORTANT]
|
||||
> The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device.
|
||||
|
||||
## See Windows Autopilot in action
|
||||
|
||||
@ -545,8 +550,8 @@ If you shut down your VM after the last reset, it’s time to start it back up a
|
||||
|
||||
Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up.
|
||||
|
||||
>[!TIP]
|
||||
>If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you’re expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset).
|
||||
> [!TIP]
|
||||
> If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you’re expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset).
|
||||
|
||||
- Ensure your device has an internet connection.
|
||||
- Turn on the device
|
||||
@ -580,7 +585,10 @@ This will remove the device from Intune management, and it will disappear from *
|
||||
|
||||
|
||||
|
||||
The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. Note: A device will only appear in the All devices list once it has booted. The latter (Windows Autopilot Deployment Program > Devices) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune.
|
||||
The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune.
|
||||
|
||||
> [!NOTE]
|
||||
> A device will only appear in the All devices list once it has booted. The latter (Windows Autopilot Deployment Program > Devices) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune.
|
||||
|
||||
To remove the device from the Autopilot program, select the device and click Delete.
|
||||
|
||||
@ -618,9 +626,9 @@ Hyper-V Requirements: VM Monitor Mode Extensions: Yes
|
||||
|
||||
In this example, the computer supports SLAT and Hyper-V.
|
||||
|
||||
>If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings.
|
||||
> If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings.
|
||||
|
||||
You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/library/cc731397.aspx) tool, or you can download the [coreinfo](https://technet.microsoft.com/sysinternals/cc835722) utility and run it, as shown in the following example:
|
||||
You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/library/cc731397.aspx) tool, or you can download the [Coreinfo](https://technet.microsoft.com/sysinternals/cc835722) utility and run it, as shown in the following example:
|
||||
|
||||
<pre style="overflow-y: visible">
|
||||
C:>coreinfo -v
|
||||
@ -637,7 +645,8 @@ VMX * Supports Intel hardware-assisted virtualization
|
||||
EPT * Supports Intel extended page tables (SLAT)
|
||||
</pre>
|
||||
|
||||
Note: A 64-bit operating system is required to run Hyper-V.
|
||||
> [!NOTE]
|
||||
> A 64-bit operating system is required to run Hyper-V.
|
||||
|
||||
## Appendix B: Adding apps to your profile
|
||||
|
||||
@ -645,7 +654,7 @@ Note: A 64-bit operating system is required to run Hyper-V.
|
||||
|
||||
#### Prepare the app for Intune
|
||||
|
||||
Before we can pull an application into Intune to make it part of our AP profile, we need to “package” the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool). After downloading the tool, gather the following three bits of information to use the tool:
|
||||
Before we can pull an application into Intune to make it part of our AP profile, we need to “package” the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). After downloading the tool, gather the following three bits of information to use the tool:
|
||||
|
||||
1. The source folder for your application
|
||||
2. The name of the setup executable file
|
||||
@ -686,7 +695,8 @@ On the **Program Configuration** blade, supply the install and uninstall command
|
||||
Install: msiexec /i "npp.7.6.3.installer.x64.msi" /q
|
||||
Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q
|
||||
|
||||
NOTE: Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool) automatically generated them when it converted the .msi file into a .intunewin file.
|
||||
> [!NOTE]
|
||||
> Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) automatically generated them when it converted the .msi file into a .intunewin file.
|
||||
|
||||
|
||||
|
||||
@ -728,7 +738,8 @@ You will be able to find your app in your app list:
|
||||
|
||||
#### Assign the app to your Intune profile
|
||||
|
||||
**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here.
|
||||
> [!NOTE]
|
||||
> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here.
|
||||
|
||||
In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu:
|
||||
|
||||
@ -738,7 +749,7 @@ Select **Add Group** to open the **Add group** pane that is related to the app.
|
||||
|
||||
For our purposes, select **Required** from the **Assignment type** dropdown menu:
|
||||
|
||||
>**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website.
|
||||
> **Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website.
|
||||
|
||||
Select **Included Groups** and assign the groups you previously created that will use this app:
|
||||
|
||||
@ -782,7 +793,7 @@ Click **OK**.
|
||||
|
||||
In the **App Suite Information** pane, enter a <i>unique</i> suite name, and a suitable description.
|
||||
|
||||
>Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal.
|
||||
> Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal.
|
||||
|
||||
|
||||
|
||||
@ -796,7 +807,8 @@ Click **OK** and then click **Add**.
|
||||
|
||||
#### Assign the app to your Intune profile
|
||||
|
||||
**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here.
|
||||
> [!NOTE]
|
||||
> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here.
|
||||
|
||||
In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu:
|
||||
|
||||
@ -806,7 +818,7 @@ Select **Add Group** to open the **Add group** pane that is related to the app.
|
||||
|
||||
For our purposes, select **Required** from the **Assignment type** dropdown menu:
|
||||
|
||||
>**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website.
|
||||
> **Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website.
|
||||
|
||||
Select **Included Groups** and assign the groups you previously created that will use this app:
|
||||
|
||||
|
||||
@ -3375,7 +3375,7 @@ This security group has not changed since Windows Server 2008.
|
||||
|
||||
### <a href="" id="bkmk-serveroperators"></a>Server Operators
|
||||
|
||||
Members in the Server Operators group can administer domain servers. This group exists only on domain controllers. By default, the group has no members. Memebers of the Server Operators group can sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group cannot be renamed, deleted, or moved.
|
||||
Members in the Server Operators group can administer domain servers. This group exists only on domain controllers. By default, the group has no members. Members of the Server Operators group can sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group cannot be renamed, deleted, or moved.
|
||||
|
||||
By default, this built-in group has no members, and it has access to server configuration options on domain controllers. Its membership is controlled by the service administrator groups, Administrators and Domain Admins, in the domain, and the Enterprise Admins group. Members in this group cannot change any administrative group memberships. This is considered a service administrator account because its members have physical access to domain controllers, they can perform maintenance tasks (such as backup and restore), and they have the ability to change binaries that are installed on the domain controllers. Note the default user rights in the following table.
|
||||
|
||||
|
||||
@ -35,7 +35,7 @@ ms.reviewer:
|
||||
The Microsoft PIN reset services enables you to help users recover who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment.
|
||||
|
||||
>[!IMPORTANT]
|
||||
> The Microsoft PIN Reset service only works with Windows 10, version 1709 to 1809 with **Enterprise Edition**. The feature works with **Pro** edition with Windows 10, version 1903 and newer.
|
||||
> The Microsoft PIN Reset service only works with **Enterprise Edition** for Windows 10, version 1709 to 1809. The feature works with **Enterprise Edition** and **Pro** edition with Windows 10, version 1903 and newer.
|
||||
|
||||
### Onboarding the Microsoft PIN reset service to your Intune tenant
|
||||
|
||||
|
||||
@ -45,7 +45,7 @@ Download the installation and onboarding packages from Microsoft Defender Securi
|
||||
3. Set the deployment method to **Mobile Device Management / Microsoft Intune**.
|
||||
|
||||
>[!NOTE]
|
||||
>JamF falls under **Mobile Device Management**.
|
||||
>Jamf falls under **Mobile Device Management**.
|
||||
|
||||
4. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory.
|
||||
5. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory.
|
||||
|
||||
@ -62,7 +62,7 @@ In general you need to take the following steps:
|
||||
- [Manual deployment](linux-install-manually.md)
|
||||
- Third-party management tools:
|
||||
- [Deploy using Puppet configuration management tool](linux-install-with-puppet.md)
|
||||
- [Deploy using Ansbile configuration management tool](linux-install-with-ansible.md)
|
||||
- [Deploy using Ansible configuration management tool](linux-install-with-ansible.md)
|
||||
|
||||
### System requirements
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user