From 8477dc757e339c0d22eadea033bbe7670d8dfa34 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 13 Apr 2016 16:42:05 -0700 Subject: [PATCH 01/38] stubs of new merged server content --- windows/manage/TOC.md | 3 +- ...onfigure-telemetry-in-your-organization.md | 304 ++++++++++++++++++ ...onnect-your-organization-from-microsoft.md | 8 +- 3 files changed, 310 insertions(+), 5 deletions(-) create mode 100644 windows/manage/configure-telemetry-in-your-organization.md diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index 2398446f4f..bacbfb101a 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -17,7 +17,8 @@ #### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) #### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md) -### [Configure telemetry and other settings in your organization](disconnect-your-organization-from-microsoft.md) +### [Disconnect your organization from Microsoft](disconnect-your-organization-from-microsoft.md) +### [Configure telemetry in your organization](configure-telemetry-in-your-organization.md) ### [Configure access to Windows Store](stop-employees-from-using-the-windows-store.md) ### [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) ### [Configure Windows 10 Mobile using Lockdown XML](lockdown-xml.md) diff --git a/windows/manage/configure-telemetry-in-your-organization.md b/windows/manage/configure-telemetry-in-your-organization.md new file mode 100644 index 0000000000..401c40d256 --- /dev/null +++ b/windows/manage/configure-telemetry-in-your-organization.md @@ -0,0 +1,304 @@ +--- +description: Use this article to make informed decisions about how you can configure telemetry in your organization. +title: Configure telemetry in your organization +--- + +# Configure telemetry in your organization + +**Applies to** + +- Windows 10 +- Windows 10 Mobile +- Windows Server 2016 Technical Preview + +Use this article to make informed decisions about how you can configure telemetry in your organization. Telemetry is a term that means different things to different people and organizations. For the purpose of this article, we discuss telemetry as system data that is uploaded by the Connected User Experience and Telemetry component. The telemetry data is used to keep Windows devices secure, and to help Microsoft improve the quality of Windows and Microsoft services. + +**Note**   +This article does not apply to System Center Configuration Manager, System Center Endpoint Protection, or System Center Data Protection Manager because those components use a different telemetry service than Windows and Windows Server + +It describes the types of telemetry we gather and the ways you can manage its telemetry. This article also lists some examples of how telemetry can provide you with valuable insights into your enterprise deployments, and how Microsoft uses the data to quickly identify and address issues affecting its customers. + +We understand that the privacy and security of our customers’ information is important and we have taken a thoughtful and comprehensive approach to customer privacy and the protection of their data with Windows 10, Windows Server 2016 Technical Preview, and System Center 2016. + +## Overview + +In previous versions of Windows and Windows Server, Microsoft used telemetry to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC) on Windows Server, and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server 2016 Technical Preview, you can control telemetry streams by using **Settings** > **Privacy**, Group Policy, or MDM. + +Microsoft is committed to improving customer experiences in a mobile-first and cloud-first world, and it all starts with our customers. Telemetry is one critical way Microsoft is using data to improve our products and services. Telemetry gives every enterprise customer a voice that helps us shape future versions of Windows, Windows Server and System Center, allowing us to respond quickly to your feedback and providing new features and improved quality to our customers. + +Our goal is to leverage the aggregated data to drive changes in the product and ecosystem to improve our customer experiences. We are also partnering with enterprises to provide added value from the telemetry information shared by their devices. Some examples include identifying outdated patches and downloading the latest antimalware signatures to help keep their devices secure, identifying application compatibility issues prior to upgrades, gaining insights into driver reliability issues affecting other customers, and using usage data to tune some of their operations to reduce the total cost of ownership (TCO) and downtime. + +For Windows 10, we invite IT pros to join the Windows Insider Program to give us feedback on what we can do to make Windows work better for youcr organization. + +## How is telemetry data handled by Microsoft? + +### Data collection + +Data gathered by the Connected User Experience and Telemetry component complies with Microsoft’s [security and privacy policies](https://privacy.microsoft.com/privacystatement/), as well as international laws and regulations. The principle of least privilege guides access to telemetry data. Only Microsoft personnel who can demonstrate a valid business need can access the telemetry data. + +### Data transfer + +All telemetry data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10,data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection,are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks. + +### Endpoints + +The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access. + +The Connected User Experience and Telemetry component connects to the Microsoft Data Management service at v10.vortex-win.data.microsoft.com. + +The Connected User Experience and Telemetry component also connects to settings-win.data.microsoft.com to download configuration information. + +[Windows Error Reporting](http://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) connects to watson.telemetry.microsoft.com. + +[Online Crash Analysis](http://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) connects to oca.telemetry.microsoft.com. + +### Data usage + +Data gathered from telemetry is used by Microsoft teams primarily to improve our customer experiences, and for security, health, quality, and performance analysis. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the Privacy Statement. We do share business reports with OEMs and third party partners that includes aggregated, anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. + +### Retention + +Microsoft only gathers the information we need, and it is only stored for as long as it is needed to provide a service or for analysis. Most of the data is deleted within 30 days. + +Windows Error Reporting and Online Crash Analysis data is kept for 60 days. + +## How is the data gathered? + + +Windows 10 and Windows Server 2016 Technical Preview includes the Connected User Experience and Telemetry component, which uses Event Tracing for Windows (ETW) [tracelogging](http://msdn.microsoft.com/library/dn904632.aspx) technology to gather and store telemetry events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology. + +1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces. + +2. Events are gathered using public operating system event logging and tracing APIs. + +3. You can configure the telemetry level by using an MDM policy, Group Policy, or registry settings. + +4. The Connected User Experience and Telemetry component transmits telemetry data over HTTPS to Microsoft and uses certificate pinning. + +## Telemetry levels + + +This section explains the different telemetry levels in Windows 10, Windows Server 2016 Technical Preview, and System Center. These levels are available on all desktop and mobile editions of Windows 10, with the exception of the **Security** level which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016 Technical Preview. + +The telemetry data is categorized into four levels: + +- **Security**. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. + +- **Basic**. Basic device info, including: quality-related data, app compat, app usage data, and data from the **Security** level. + +- **Enhanced**. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels. + +- **Full**. All data necessary to identify and help to fix problems, plus data from the **Security**, **Basic**, and **Enhanced** levels. + +The levels are cumulative and are illustrated in the following diagram. These levels apply to all editions of Windows Server 2016 Technical Preview. + +![breakdown of telemetry levels and types of administrative controls](images/priv-telemetry-levels.png) + +### Security level + +The Security level gathers only the telemetry info that is required to keep Windows devices, Windows Server, and guests secure with the latest security updates. + +**Note**   +If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. + +Windows Server Update Services (WSUS) and System Center Configuration Manager functionality is not affected at this level, nor is telemetry data about Windows Server features or System Center gathered. + +  + +The data gathered at this level includes: + +- **Connected User Experience and Telemetry component settings**. If data has been gathered and is queued to be sent, the Connected User Experience and Telemetry component downloads its settings file from Microsoft’s servers. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop). + +- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address. + + **Note**   + You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716). + +   + +- **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address. + + **Note**   + This reporting can be turned off and no information is included if a customer is using third party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-privacy-for-windows-10-in-your-company.md#windows-defender). + + Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates. + +   + +For servers with default telemetry settings and no Internet connectivity, you should set the telemetry level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity. + +No user content, such as user files or communications, is gathered at the **Security** telemetry level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time. + +### Basic level + +The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. The Connected User Experience and Telemetry component does not gather telemetry data about System Center, but it can transmit telemetry for other non-Windows applications if they have user consent. + +The data gathered at this level includes: + +- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Server 2016 Technical Previewinstances in the ecosystem, including: + + - Device attributes, such as camera resolution and display type + + - Internet Explorer version + + - Battery attributes, such as capacity and type + + - Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number + + - Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware + + - Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system + + - Operating system attributes, such as Windows edition and virtualization state + + - Storage attributes, such as number of drives, type, and size + +- **Connected User Experience and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experience and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time. + +- **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app. + +- **Compatibility data**. Helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems. + + - **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade.This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage. + + - **App usage data**. Includes how an app is used, including how long an app is used for, when the app has focus, and when the app is started + + - **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade. + + - **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS. + + - **Accessory device data**. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system. + + - **Driver data**. Includes specific driver usage that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements. + +- **Store**. Provides information about how the Windows Store performs, including app downloads, installations, and updates. It also includes Windows Store launches, page views, suspend and resumes, and obtaining licenses. + +### Enhanced level + +The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the **Basic** and **Security** levels. This level helps to improve the user experiencewith the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements. + +This is the default level, and the minimum level needed to quickly identify and address Windows, Windows Server, and System Center quality issues. + +The data gathered at this level includes: + +- **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components. + +- **Operating system app events**. A set of events resulting from Microsoft applications and management tools that were downloaded from the Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge. + +- **Device-specific events**. Contains data about events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events. + +- **Some crash dump types**. All crash dump types, except for heap dumps and full dumps. + +If the Connected User Experience and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experience and Telemetry component at the **Enhanced** telemetry level will only gather data about the events associated with the specific issue. + +### Full level + +The Full level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the **Basic**, **Enhanced**, and **Security** levels. + +Additionally, at this level, devices opted in to the Windows Insider Program will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the Windows Insider Program are automatically set to this level. + +If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** telemetry level and have exhibited the problem. + +However, before more data is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information: + +- Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe. + +- Ability to get registry keys. + +- All crash dump types, including heap dumps and full dumps. + +### Manage your telemetry settings + +We do not recommend that you turn off telemetry in your organization as valuable functionality may be impacted, but we recognize that in some scenarios this may be required. Use the steps in this section to do so for Windows, Windows Server, and System Center. + +**Important**   +These telemetry levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experience and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these telemetry levels. You should work with your app vendors to understand their telemetry policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses telemetry, see [Overview of Office Telemetry](http://technet.microsoft.com/library/jj863580.aspx). + +  + +You can turn on or turn off System Center telemetry gathering. The default is on and the data gathered at this level represents what is gathered by default when System Center telemetry is turned on. However, setting the operating system telemetry level to **Basic** will turn off System Center telemetry, even if the System Center telemetry switch is turned on. + +The lowest telemetry setting level supported through management policies is **Security**. The lowest telemetry setting supported through the Settings UI is **Basic**. The default telemetry setting for Windows Server 2016 Technical Preview is **Enhanced.** + +### Configure the operating system telemetry level + +You can configure your operating system telemetry settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your telemetry levels through a management policy overrides any devicelevel settings. + +Use the appropriate value in the table below when you configure the management policy. + +| Value | Level | Data gathered | +|-------|----------|---------------------------------------------------------------------------------------------------------------------------| +| **0** | Security | Security data only. | +| **1** | Basic | Security data, and basic system and quality data. | +| **2** | Enhanced | Security data, basic system and quality data, and enhanced insights and advanced reliability data. | +| **3** | Full | Security data, basic system and quality data, enhanced insights and advanced reliability data, and full diagnostics data. | + +  + +### Use Group Policy to set the telemetry level + +Use a Group Policy object to set your organization’s telemetry level. + +1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**. + +2. Double-click **Allow Telemetry**. + +3. In the **Options** box, select the level that you want to configure, and then click **OK**. + +### Use MDM to set the telemetry level + +Use the [Policy Configuration Service Provider (CSP)](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy. + +### Use Registry Editor to set the telemetry level + +Use Registry Editor to manually set the registry level on each device in your organization, or write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting. + +1. Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection**. + +2. Right-click **DataCollection**, click New, and then click **DWORD (32-bit) Value**. + +3. Type **AllowTelemetry**, and then press ENTER. + +4. Double-click **AllowTelemetry**, set the desired value from the table above, and then click **OK.** + +5. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization. + +### Configure System Center 2016 telemetry + +For System Center 2016 Technical Preview, you can turn off System Center telemetry by following these steps: + +- Turn off telemetry by using the System Center UI Console settings workspace. + +- For information about turning off telemetry for Service Management Automation and Service Provider Foundation, see [How to disable telemetry for Service Management Automation and Service Provider Foundation](https://support.microsoft.com/kb/3096505). + +### Additional telemetry controls + +There are a few more settings that you can turn off that may send telemetry information: + +- To turn off Windows Update telemetry, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](http://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/). + +- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**. + +- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716). + +- Turn off **Linguistic Data Collection** in **Settings** > **Privacy**. At telemetry levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary. + + **Note**   + Microsoft do not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information. + +   + +## Examples of how Microsoft uses the telemetry data + + +### Drive higher apps and driver quality in the ecosystem + +Telemetry plays an important role in quickly identifying and fixing critical reliability and security issues in our customers’ deployments and configurations. Insights into the telemetry data we gather helps us to quickly identify crashes or hangs associated with a certain application or driver on a given configuration, like a particular storage type (for example, SCSI) or a memory size. For System Center, job usages and statuses can also help us enhance the job workload and the communication between System Center and its managed products. Microsoft’s ability to get this data from customers and drive improvements into the ecosystem helps raise the bar for the quality of System Center, Windows Server applications, Windows apps, and drivers. Real-time data about Windows installations reduces downtime and the cost associated with troubleshooting unreliable drivers or unstable applications + +### Reduce your total cost of ownership and downtime + +Telemetry provides a view of which features and services customers use most. For example, the telemetry data provides us with a heat map of the most commonly deployed Windows Server roles, most used Windows features, and which ones are used the least. This helps us make informed decisions on where we should invest our engineering resources to build a leaner operating system. For System Center, understanding the customer environment for management and monitoring will help drive the support compatibilities matrix, such as host and guest OS. This can help you use existing hardware to meet your business needs and reduce your total cost of ownership, as well as reducing downtime associated with security updates. + +### Build features that address our customers’ needs + +Telemetry also helps us better understand how customers deploy components, use features, and use services to achieve their business goals. Getting insights from that information helps us prioritize our engineering investments in areas that can directly affect our customers’ experiences and workloads. Some examples include customer usage of containers, storage, and networking configurations associated with Windows Server roles like Clustering and Web. Another example could be to find out when is CPU hyper-threading turned off and the resulting impact. We use the insights to drive improvements and intelligence into some of our management and monitoring solutions, to help customers diagnose quality issues, and save money by making fewer help calls to Microsoft. \ No newline at end of file diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index 925e0f6684..e7e12620ef 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1,15 +1,15 @@ --- -title: Configure telemetry and other settings in your organization (Windows 10) -description: Learn about the telemetry that Microsoft gathers, the network connections that Windows components make to Microsoft, and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. +title: Disconnect from Microsoft and configure privacy settings in your organization +description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider.If you’re looking for content on what each telemetry level means and how to configure it in your organization, see Configure telemetry in your organization. ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 +keywords: privacy ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: brianlic-msft --- -# Configure telemetry and other settings in your organization - +# Disconnect from Microsoft and configure privacy settings in your organization **Applies to** From 665acdc7bc320ab0c9af64d26ada591808bec4a8 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 14 Apr 2016 15:07:09 -0700 Subject: [PATCH 02/38] updating to split out telemetry from network exhaust --- ...onfigure-telemetry-in-your-organization.md | 21 +- ...onnect-your-organization-from-microsoft.md | 632 +++--------------- windows/manage/lock-down-windows-10.md | 14 +- 3 files changed, 120 insertions(+), 547 deletions(-) diff --git a/windows/manage/configure-telemetry-in-your-organization.md b/windows/manage/configure-telemetry-in-your-organization.md index 401c40d256..419bc3113d 100644 --- a/windows/manage/configure-telemetry-in-your-organization.md +++ b/windows/manage/configure-telemetry-in-your-organization.md @@ -1,6 +1,7 @@ --- description: Use this article to make informed decisions about how you can configure telemetry in your organization. -title: Configure telemetry in your organization +title: Configure telemetry in your organization (Windows 10) +keywords: privacy --- # Configure telemetry in your organization @@ -14,7 +15,7 @@ title: Configure telemetry in your organization Use this article to make informed decisions about how you can configure telemetry in your organization. Telemetry is a term that means different things to different people and organizations. For the purpose of this article, we discuss telemetry as system data that is uploaded by the Connected User Experience and Telemetry component. The telemetry data is used to keep Windows devices secure, and to help Microsoft improve the quality of Windows and Microsoft services. **Note**   -This article does not apply to System Center Configuration Manager, System Center Endpoint Protection, or System Center Data Protection Manager because those components use a different telemetry service than Windows and Windows Server +This article does not apply to System Center Configuration Manager, System Center Endpoint Protection, or System Center Data Protection Manager because those components use a different telemetry service than Windows and Windows Server. It describes the types of telemetry we gather and the ways you can manage its telemetry. This article also lists some examples of how telemetry can provide you with valuable insights into your enterprise deployments, and how Microsoft uses the data to quickly identify and address issues affecting its customers. @@ -22,7 +23,7 @@ We understand that the privacy and security of our customers’ information is i ## Overview -In previous versions of Windows and Windows Server, Microsoft used telemetry to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC) on Windows Server, and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server 2016 Technical Preview, you can control telemetry streams by using **Settings** > **Privacy**, Group Policy, or MDM. +In previous versions of Windows and Windows Server, Microsoft used telemetry to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC) on Windows Server, and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server 2016 Technical Preview, you can control telemetry streams by using Settings > Privacy, Group Policy, or MDM. Microsoft is committed to improving customer experiences in a mobile-first and cloud-first world, and it all starts with our customers. Telemetry is one critical way Microsoft is using data to improve our products and services. Telemetry gives every enterprise customer a voice that helps us shape future versions of Windows, Windows Server and System Center, allowing us to respond quickly to your feedback and providing new features and improved quality to our customers. @@ -34,11 +35,11 @@ For Windows 10, we invite IT pros to join the Windows Insider Program to give u ### Data collection -Data gathered by the Connected User Experience and Telemetry component complies with Microsoft’s [security and privacy policies](https://privacy.microsoft.com/privacystatement/), as well as international laws and regulations. The principle of least privilege guides access to telemetry data. Only Microsoft personnel who can demonstrate a valid business need can access the telemetry data. +Data gathered by the Connected User Experience and Telemetry component complies with Microsoft’s [security and privacy policies](https://privacy.microsoft.com/privacystatement), as well as international laws and regulations. The principle of least privilege guides access to telemetry data. Only Microsoft personnel who can demonstrate a valid business need can access the telemetry data. ### Data transfer -All telemetry data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10,data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection,are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks. +All telemetry data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks. ### Endpoints @@ -58,9 +59,7 @@ Data gathered from telemetry is used by Microsoft teams primarily to improve our ### Retention -Microsoft only gathers the information we need, and it is only stored for as long as it is needed to provide a service or for analysis. Most of the data is deleted within 30 days. - -Windows Error Reporting and Online Crash Analysis data is kept for 60 days. +Microsoft believes in and practices information minimization. We strive to gather only the info we need, and store it for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Store purchase history. Info is typically gathered at a fractional sampling rate, which can be as low as 1% of clients reporting data. ## How is the data gathered? @@ -119,7 +118,7 @@ The data gathered at this level includes: - **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address. **Note**   - This reporting can be turned off and no information is included if a customer is using third party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-privacy-for-windows-10-in-your-company.md#windows-defender). + This reporting can be turned off and no information is included if a customer is using third party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](disconnect-your-organization-from-microsoft.md#windows-defender). Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates. @@ -214,8 +213,6 @@ We do not recommend that you turn off telemetry in your organization as valuable **Important**   These telemetry levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experience and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these telemetry levels. You should work with your app vendors to understand their telemetry policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses telemetry, see [Overview of Office Telemetry](http://technet.microsoft.com/library/jj863580.aspx). -  - You can turn on or turn off System Center telemetry gathering. The default is on and the data gathered at this level represents what is gathered by default when System Center telemetry is turned on. However, setting the operating system telemetry level to **Basic** will turn off System Center telemetry, even if the System Center telemetry switch is turned on. The lowest telemetry setting level supported through management policies is **Security**. The lowest telemetry setting supported through the Settings UI is **Basic**. The default telemetry setting for Windows Server 2016 Technical Preview is **Enhanced.** @@ -299,6 +296,6 @@ Telemetry plays an important role in quickly identifying and fixing critical rel Telemetry provides a view of which features and services customers use most. For example, the telemetry data provides us with a heat map of the most commonly deployed Windows Server roles, most used Windows features, and which ones are used the least. This helps us make informed decisions on where we should invest our engineering resources to build a leaner operating system. For System Center, understanding the customer environment for management and monitoring will help drive the support compatibilities matrix, such as host and guest OS. This can help you use existing hardware to meet your business needs and reduce your total cost of ownership, as well as reducing downtime associated with security updates. -### Build features that address our customers’ needs +### Build features that address our customers’ needs Telemetry also helps us better understand how customers deploy components, use features, and use services to achieve their business goals. Getting insights from that information helps us prioritize our engineering investments in areas that can directly affect our customers’ experiences and workloads. Some examples include customer usage of containers, storage, and networking configurations associated with Windows Server roles like Clustering and Web. Another example could be to find out when is CPU hyper-threading turned off and the resulting impact. We use the insights to drive improvements and intelligence into some of our management and monitoring solutions, to help customers diagnose quality issues, and save money by making fewer help calls to Microsoft. \ No newline at end of file diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index e7e12620ef..f4ceaf4890 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1,28 +1,26 @@ --- -title: Disconnect from Microsoft and configure privacy settings in your organization -description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider.If you’re looking for content on what each telemetry level means and how to configure it in your organization, see Configure telemetry in your organization. +title: Disconnect your organization from Microsoft (Windows 10) +description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 -keywords: privacy +keywords: privacy, disconnect from Microsoft ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: brianlic-msft --- -# Disconnect from Microsoft and configure privacy settings in your organization +# Disconnect your organization from Microsoft **Applies to** - Windows 10 -Learn about the telemetry that Microsoft gathers, the network connections that Windows components make to Microsoft, and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. +If you’re looking for content on what each telemetry level means and how to configure it in your organization, see [Configure telemetry in your organization](configure-telemetry-in-your-organization.md). + +Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. -**Note**  Telemetry is a term that means different things to different people and organizations. For the purpose of this article, we discuss telemetry as system data that is uploaded by the Connected User Experience and Telemetry component. The telemetry data is used to keep Windows devices secure, and to help Microsoft improve the quality of Windows and Microsoft services. We discuss separately the network connections that Windows features and components make directly to Microsoft Services. It is used to provide a service to the user as part of Windows. - -  - Some of the network connections discussed in this article can be managed in Windows 10 Mobile, Windows 10 Mobile Enterprise, and the July release of Windows 10. However, you must use Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511 to manage them all. In Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511, you can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. @@ -133,10 +131,6 @@ Here's what's covered in this article: - [23. Windows Update](#bkmk-wu) -- [Manage your telemetry settings](#bkmk-utc) - -- [How telemetry works](#bkmk-moreutc) - ## What's new in Windows 10, version 1511 @@ -255,46 +249,14 @@ Use either Group Policy or MDM policies to manage settings for Cortana. For more Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PolicyDescription

Allow Cortana

Choose whether to let Cortana install and run on the device.

-

Default: Enabled

Allow search and Cortana to use location

Choose whether Cortana and Search can provide location-aware search results.

-

Default: Enabled

Do not allow web search

Choose whether to search the web from Windows Desktop Search.

-

Default: Disabled

Don't search the web or display web results in Search

Choose whether to search the web from Cortana.

-

Default: Disabled

Set what information is shared in Search

Control what information is shared with Bing in Search.

-  +| Policy | Description | +-------------------------------------------------------|---------------------------------------------------------------------------------------| +| Allow Cortana | Choose whether to let Cortana install and run on the device. | +| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results. | +| Do not allow web search | Choose whether to search the web from Windows Desktop Search.
Default: Disabled| +| Don't search the web or display web results in Search| Choose whether to search the web from Cortana. | +| Set what information is shared in Search | Control what information is shared with Bing in Search. | When you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. @@ -325,38 +287,14 @@ When you enable the **Don't search the web or display web results in Search** Gr **Note**   If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. You should use a network traffic analyzer, such as WireShark or Message Analyzer. -  - ### 1.2 Cortana MDM policies The following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - ---- - - - - - - - - - - - - - - - - -
PolicyDescription

Experience/AllowCortana

Choose whether to let Cortana install and run on the device.

-

Default: Allowed

Search/AllowSearchToUseLocation

Choose whether Cortana and Search can provide location-aware search results.

-

Default: Allowed

- -  +| Policy | Description | +-------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Experience/AllowCortana | Choose whether to let Cortana install and run on the device. | +| Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results.
Default: Allowed| ### 1.3 Cortana Windows Provisioning @@ -385,8 +323,6 @@ To turn off font streaming, create a REG\_DWORD registry setting called **Disabl **Note**   This may change in future versions of Windows. -  - ### 5. Insider Preview builds To turn off Insider Preview builds if you're running a released version of Windows 10. If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. @@ -425,49 +361,13 @@ Use Group Policy to manage settings for Internet Explorer. Find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PolicyDescription

Turn on Suggested Sites

Choose whether an employee can configure Suggested Sites.

-

Default: Enabled

-

You can also turn this off in the UI by clearing the Internet Options > Advanced > Enable Suggested Sites check box.

Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar

Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the address bar.

-

Default: Enabled

Turn off the auto-complete feature for web addresses

Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.

-

Default: Disabled

-

You can also turn this off in the UI by clearing the Internet Options > Advanced > Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog check box.

Disable Periodic Check for Internet Explorer software updates

Choose whether Internet Explorer periodically checks for a new version.

-

Default: Enabled

Turn off browser geolocation

Choose whether websites can request location data from Internet Explorer.

-

Default: Disabled

- -  +| Policy | Description | +-------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
Default: Enabled
You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.| +| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the address bar.
Default: Enabled| +| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.
Default: Disabled
You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| +| Disable Periodic Check for Internet Explorer software updates| Choose whether Internet Explorer periodically checks for a new version.
Default: Enabled | +| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
Default: Disabled| ### 6.2 ActiveX control blocking @@ -504,105 +404,27 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g **Note**   The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. -  - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PolicyDescription

Turn off autofill

Choose whether employees can use autofill on websites.

-

Default: Enabled

Allow employees to send Do Not Track headers

Choose whether employees can send Do Not Track headers.

-

Default: Disabled

Turn off password manager

Choose whether employees can save passwords locally on their devices.

-

Default: Enabled

Turn off address bar search suggestions

Choose whether the address bar shows search suggestions.

-

Default: Enabled

Turn off the SmartScreen Filter

Choose whether SmartScreen is turned on or off.

-

Default: Enabled

Open a new tab with an empty tab

Choose whether a new tab page appears.

-

Default: Enabled

Configure corporate Home pages

Choose the corporate Home page for domain-joined devices.

-

Set this to about:blank

- -  +| Policy | Description | +-------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Turn off autofill | Choose whether employees can use autofill on websites.
Default: Enabled | +| Allow employees to send Do Not Track headers | Choose whether employees can send Do Not Track headers.
Default: Disabled | +| Turn off password manager | Choose whether employees can save passwords locally on their devices.
Default: Enabled | +| Turn off address bar search suggestions | Choose whether the address bar shows search suggestions.
Default: Enabled | +| Turn off the SmartScreen Filter | Choose whether SmartScreen is turned on or off.
Default: Enabled | +| Open a new tab with an empty tab | Choose whether a new tab page appears.
Default: Enabled | +| Configure corporate Home pages | Choose the corporate Home page for domain-joined devices.
Set this to **about:blank** | ### 8.2 Microsoft Edge MDM policies The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PolicyDescription

Browser/AllowAutoFill

Choose whether employees can use autofill on websites.

-

Default: Allowed

Browser/AllowDoNotTrack

Choose whether employees can send Do Not Track headers.

-

Default: Not allowed

Browser/AllowPasswordManager

Choose whether employees can save passwords locally on their devices.

-

Default: Allowed

Browser/AllowSearchSuggestionsinAddressBar

Choose whether the address bar shows search suggestions.

-

Default: Allowed

Browser/AllowSmartScreen

Choose whether SmartScreen is turned on or off.

-

Default: Allowed

- -  +| Policy | Description | +-------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Browser/AllowAutoFill | Choose whether employees can use autofill on websites.
Default: Allowed | +| Browser/AllowDoNotTrack | Choose whether employees can send Do Not Track headers.
Default: Not allowed | +| Browser/AllowPasswordManager | Choose whether employees can save passwords locally on their devices.
Default: Allowed | +| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions..
Default: Allowed | +| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
Default: Allowed | ### 8.3 Microsoft Edge Windows Provisioning @@ -830,7 +652,7 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Window To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: **Note**   -If the telemetry level is set to either [Basic](#bkmk-utc-basic) or [Security](#bkmk-utc-security), this is turned off automatically. +If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically.   @@ -877,8 +699,6 @@ To turn off **Location for this device**: **Note**   You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). -   - -or- - Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowLocation**, where @@ -929,10 +749,8 @@ To turn off **Let apps use my camera**: **Note**   You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). - -   - - -or- + + -or- - Create a provisioning package with use Windows ICD, using **Runtime settings** > **Policies** > **Camera** > **AllowCamera**, where: @@ -952,7 +770,7 @@ To turn off **Let apps use my microphone**: - Turn off the feature in the UI. - -or- + -or- - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the microphone** @@ -975,15 +793,15 @@ To turn off the functionality: - Click the **Stop getting to know me** button, and then click **Turn off**. - -or- + -or- - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Regional and Language Options** > **Handwriting personalization** > **Turn off automatic learning** - -or- + -or- - Create a REG\_DWORD registry setting called **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Personalization\\Settings**, with a value of 0 (zero). - -and- + -and- Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero). @@ -995,7 +813,7 @@ To turn off **Let apps access my name, picture, and other account info**: - Turn off the feature in the UI. - -or- + -or- - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access account information** @@ -1013,7 +831,7 @@ To turn off **Choose apps that can access contacts**: - Turn off the feature in the UI for each app. - -or- + -or- - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** @@ -1027,7 +845,7 @@ To turn off **Let apps access my calendar**: - Turn off the feature in the UI. - -or- + -or- - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the calendar** @@ -1045,7 +863,7 @@ To turn off **Let apps access my call history**: - Turn off the feature in the UI. - -or- + -or- - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access call history** @@ -1059,7 +877,7 @@ To turn off **Let apps access and send email**: - Turn off the feature in the UI. - -or- + -or- - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access email** @@ -1132,11 +950,11 @@ Feedback frequency only applies to user-generated feedback, not diagnostic and u - To change from **Automatically (Recommended)**, use the drop-down list in the UI. - -or- + -or- - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Do not show feedback notifications** - -or- + -or- - Create the registry keys (REG\_DWORD type): @@ -1158,40 +976,40 @@ Feedback frequency only applies to user-generated feedback, not diagnostic and u To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**: -- To change from [Enhanced](#bkmk-utc-enhanced), use the drop-down list in the UI. The other levels are **Basic** and **Full**. For more info about these levels, see [How telemetry works](#bkmk-moreutc). +- To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. **Note**   - You can't use the UI to change the telemetry level to [Security](#bkmk-utc-security). + You can't use the UI to change the telemetry level to **Security**.   - -or- + -or- - Apply the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** - -or- + -or- - Apply the System/AllowTelemetry MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - **0**. Maps to the [Security](#bkmk-utc-security) level. + - **0**. Maps to the **Security** level. - - **1**. Maps to the [Basic](#bkmk-utc-basic) level. + - **1**. Maps to the **Basic** level. - - **2**. Maps to the [Enhanced](#bkmk-utc-enhanced) level. + - **2**. Maps to the **Enhanced** level. - - **3**. Maps to the [Full](#bkmk-utc-full) level. + - **3**. Maps to the **Full** level. - -or- + -or- - Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowTelemetry**, where: - - **0**. Maps to the [Security](#bkmk-utc-security) level. + - **0**. Maps to the **Security** level. - - **1**. Maps to the [Basic](#bkmk-utc-basic) level. + - **1**. Maps to the **Basic** level. - - **2**. Maps to the [Enhanced](#bkmk-utc-enhanced) level. + - **2**. Maps to the **Enhanced** level. - - **3**. Maps to the [Full](#bkmk-utc-full) level. + - **3**. Maps to the **Full** level. ### 13.15 Background apps @@ -1263,7 +1081,7 @@ To turn off **Connect to suggested open hotspots** and **Connect to networks sha -or- -- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed.](http://go.microsoft.com/fwlink/p/?LinkId=620910) +- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620910). When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. @@ -1360,7 +1178,7 @@ You can turn off the ability to launch apps from the Windows Store that were pre ### 22. Windows Update Delivery Optimization -Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization’s PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. +Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. By default, PCs running Windows 10 Enterprise and Windows 10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. @@ -1376,115 +1194,26 @@ You can set up Delivery Optimization from the **Settings** UI. You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PolicyDescription

Download Mode

Lets you choose where Delivery Optimization gets or sends updates and apps, including

-
    -

  • None. Turns off Delivery Optimization.

    • -

  • Group. Gets or sends updates and apps to PCs on the same local network domain.

    • -

  • Internet. Gets or sends updates and apps to PCs on the Internet.

    • -

  • LAN. Gets or sends updates and apps to PCs on the same NAT only.

    • -

Group ID

Lets you provide a Group ID that limits which PCs can share apps and updates.

-
-Note   -

This ID must be a GUID.

-
-
-  -

Max Cache Age

Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.

-

The default value is 259200 seconds (3 days).

Max Cache Size

Lets you specify the maximum cache size as a percentage of disk size.

-

The default value is 20, which represents 20% of the disk.

Max Upload Bandwidth

Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.

-

The default value is 0, which means unlimited possible bandwidth.

- -  +| Policy | Description | +----------------------------|-----------------------------------------------------------------------------------------------------| +| Download Mode | Lets you choose where Delivery Optimization gets or sends updates and apps, including | +| Group ID | Lets you provide a Group ID that limits which PCs can share apps and updates.
** Note** This ID must be a GUID.| +| Max Cache Age | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
The default value is 259200 seconds (3 days).| +| Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
The default value is 20, which represents 20% of the disk.| +| Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.| ### 22.3 Delivery Optimization MDM policies The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PolicyDescription

DeliveryOptimization/DODownloadMode

Lets you configure where Delivery Optimization gets or sends updates and apps, including:

-
    -

  • 0. Turns off Delivery Optimization.

    • -

  • 1. Gets or sends updates and apps to PCs on the same NAT only.

    • -

  • 2. Gets or sends updates and apps to PCs on the same local network domain.

    • -

  • 3. Gets or sends updates and apps to PCs on the Internet.

    • -

DeliveryOptimization/DOGroupID

Lets you provide a Group ID that limits which PCs can share apps and updates.

-
-Note   -

This ID must be a GUID.

-
-
-  -

DeliveryOptimization/DOMaxCacheAge

Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.

-

The default value is 259200 seconds (3 days).

DeliveryOptimization/DOMaxCacheSize

Lets you specify the maximum cache size as a percentage of disk size.

-

The default value is 20, which represents 20% of the disk.

DeliveryOptimization/DOMaxUploadBandwidth

Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.

-

The default value is 0, which means unlimited possible bandwidth.

+| Policy | Description | +----------------------------|-----------------------------------------------------------------------------------------------------| +| DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including | +| DeliveryOptimization/DOGroupID | Lets you provide a Group ID that limits which PCs can share apps and updates.
** Note** This ID must be a GUID.| +| DeliveryOptimization/DOMaxCacheAge | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
The default value is 259200 seconds (3 days).| +| DeliveryOptimization/DOMaxCacheSize | Lets you specify the maximum cache size as a percentage of disk size.
The default value is 20, which represents 20% of the disk.| +| DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.| -  ### 22.4 Delivery Optimization Windows Provisioning @@ -1541,15 +1270,15 @@ You can manage your telemetry settings using the management tools you're already You can set your organization's devices to use 1 of 4 telemetry levels: -- [Security](#bkmk-utc-security) (only available on Windows 10 Enterprise, Windows 10 Education, and Windows 10 IoT Core (IoT Core) editions) +- **Security** (only available on Windows 10 Enterprise, Windows 10 Education, and Windows 10 IoT Core (IoT Core) editions) -- [Basic](#bkmk-utc-basic) +- **Basic** -- [Enhanced](#bkmk-utc-enhanced) +- **Enhanced** -- [Full](#bkmk-utc-full) +- **Full** -For more info about these telemetry levels, see [Telemetry levels](#bkmk-telemetrylevels). In Windows 10 Enterprise, Windows 10 Education, and IoT Core, the default telemetry level is [Enhanced](#bkmk-utc-enhanced). +In Windows 10 Enterprise, Windows 10 Education, and IoT Core, the default telemetry level is **Enhanced**. **Important**   These telemetry levels only apply to Windows components and apps that use the Connected User Experience and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these telemetry levels. App publishers must let people know about how they use their telemetry, ways to opt in or opt out, and they must separately document their privacy policies. @@ -1570,13 +1299,13 @@ Use a Group Policy object to set your organization’s telemetry level. Use the [Policy Configuration Service Provider (CSP)](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy, using one of these telemetry values: -- **0**. Maps to the [Security](#bkmk-utc-security) level. +- **0**. Maps to the **Security** level. -- **1**. Maps to the [Basic](#bkmk-utc-basic) level. +- **1**. Maps to the **Basic** level. -- **2**. Maps to the [Enhanced](#bkmk-utc-enhanced) level. +- **2**. Maps to the **Enhanced** level. -- **3**. Maps to the [Full](#bkmk-utc-full) level. +- **3**. Maps to the **Full** level. ### Use Windows Provisioning to set the telemetry level @@ -1594,13 +1323,13 @@ After you create the provisioning package, you can email it to your employees, p 4. Go to **Runtime settings** > **Policies** > **System** > **AllowTelemetry** to configure the policies. You can set it to one of the following: - - **Disabled \[Enterprise SKU Only\]**. Maps to the [Security](#bkmk-utc-security) level. + - **Disabled \[Enterprise SKU Only\]**. Maps to the **Security** level. - - **Basic**. Maps to the [Basic](#bkmk-utc-basic) level. + - **Basic**. Maps to the **Basic** level. - - **Full**. Maps to the [Enhanced](#bkmk-utc-enhanced) level + - **Full**. Maps to the **Enhanced** level - - **Diagnostic**. Maps to the [Full](#bkmk-utc-full) level. + - **Diagnostic**. Maps to the **Full** level. 5. After you've added all of your settings to the provisioning package, click **Export** > **Provisioning package**. @@ -1626,13 +1355,13 @@ If a management policy already exists (from Group Policy, MDM, or Windows Provis 4. Double-click **AllowTelemetry** and set the value to one of the following levels, and the click **OK**. - - **0**. This setting maps to the [Security](#bkmk-utc-security) level. + - **0**. This setting maps to the **Security** level. - - **1**. This setting maps to the [Basic](#bkmk-utc-basic) level. + - **1**. This setting maps to the **Basic** level. - - **2**. This setting maps to the [Enhanced](#bkmk-utc-enhanced) level + - **2**. This setting maps to the **Enhanced** level - - **3**. This setting maps to the [Full](#bkmk-utc-full) level. + - **3**. This setting maps to the **Full** level. 5. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization. @@ -1649,161 +1378,4 @@ There are a few more settings that you can turn off that may send telemetry info - Turn off Linguistic Data Collection in **Settings** > **Privacy**. At telemetry levels Enhanced and Full, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary. For more info, see the **Get to know me** setting in the [Speech, inking, & typing](#bkmk-priv-speech) section of this article and the **Send Microsoft info about how I write to help us improve typing and writing in the future** setting in the [General](#bkmk-priv-general) section of this article. **Note**   - Microsoft doesn't intentionally gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information. - -   - -## How telemetry works - - -Windows uses telemetry information to analyze and fix software problems. It also helps Microsoft improve its software and provide updates that enhance the security and reliability of devices within your organization. - -### Telemetry levels - -This section explains the different telemetry levels in Windows 10. These levels are available on all desktop and mobile editions of Windows 10, with the exception of the Security level which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and IoT Core. - -- **Security**. Information that's required to help keep Windows secure, including info about theConnected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. This level is available only on Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and IoT Core. - -- **Basic**. Basic device info, including: quality-related info, app compat, and info from the Security level. - -- **Enhanced** Additional insights, including: how Windows and Windows apps are used, how they perform, advanced reliability info, and info from both the Basic and the Security levels. - -- **Full**. All info necessary to identify and help to fix problems, plus info from the Security, Basic, and Enhanced levels. - -As a diagram: - -![](images/priv-telemetry-levels.png) - -### Security level - -The Security level gathers only telemetry info that's required to keep Windows devices secure. This level is only available on Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and IoT Core editions. - -**Note**   -If your organization relies on Windows Update for updates, you shouldn't use the Security level. Because no Windows Update information is gathered at this level, Microsoft can't tell whether an update successfully installed. - -You can continue to use Windows Server Update Services and System Center Configuration Manager while using the Security level. - -  - -Security level info includes: - -- **Connected User Experience and Telemetry component settings**. If data has been gathered and is queued to be sent, the Connected User Experience and Telemetry component downloads its settings file from Microsoft’s servers. The data collected by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop). - -- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address. - - **Note**   - You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. - -   - -- **Windows Defender**. Windows Defender requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address. To configure this, see [Windows Defender](#bkmk-defender). - - **Note**   - This reporting can be turned off and no information is included if a customer is using third party antimalware software, or if Windows Defender is turned off. - - Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates; moreover, Window Defender requires updated anti-malware signatures in order to provide security functionality. - -   - -No user content, such as user files or communications, is gathered at the Security telemetry level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer's registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time. - -To set the telemetry level to Security, use a management policy (Group Policy or MDM) or by manually changing the setting in the registry. For more info, see the [Manage your telemetry settings](#bkmk-utc) section of this article. - -### Basic level - -The Basic level gathers a limited set of info that’s critical for understanding the device and its configuration. This level also includes the Security level info. This level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. - -Basic level info includes: - -- **Basic device info**. Helps provide an understanding about the various types of devices in the Windows 10 ecosystem, including: - - - Device attributes, such as camera resolution and display type - - - Internet Explorer version - - - Battery attributes, such as capacity and type - - - Networking attributes, such as mobile operator network and IMEI number - - - Processor and memory attributes, such as number of cores, speed, and firmware - - - Operating system attributes, such as Windows edition and IsVirtualDevice - - - Storage attributes, such as number of drives and memory size - -- **Connected User Experience and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experience and Telemetry component is functioning, including uploaded events, dropped events, and the last upload time. - -- **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the amount of time a connected standby device was able to fullsleep, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app. - -- **App compat info**. Helps provide understanding about which apps are installed on a device and to help identify potential compatibility problems. - - - **General app info and app info for Internet Explorer add-ons**. Includes a list of apps and Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade. This app info includes the app name, publisher, version, and basic details about which files have been blocked from usage. - - - **System info**. Helps provide understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as info about the processor and BIOS. - - - **Accessory device info**. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system. - - - **Driver info**. Includes specific driver usage that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This info can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements. - -- **Store**. Provides info about how the Windows Store performs, including app downloads, installations, and updates. It also includes Windows Store launches, page views, suspend and resumes, and obtaining licenses. - -### Enhanced level - -The Enhanced level gathers info about how Windows and apps are used and how they perform. This level also includes info from both the Basic and Security levels. This level helps to improve experiences by analyzing user interaction with the operating system and apps. Info from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements. - -Enhanced level info includes: - -- **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, and other components. - -- **Operating system app events**. A set of events resulting from Microsoft apps that were downloaded from the Store or pre-installed with Windows, including Photos, Mail, and Microsoft Edge. - -- **Device-specific events**. Contains info about events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events. - -If the Connected User Experience and Telemetry component detects a problem that requires gathering more detailed instrumentation, then the Connected User Experience and Telemetry component will only gather info about the events associated with the specific issue, for no more than 2 weeks. Also, if the operating system or an app crashes or hangs, Microsoft will gather the memory contents of the faulting process only at the time of the crash or hang. - -### Full level - -The Full level gathers info necessary to identify and to help fix problems, following the approval process described below. This level also includes info from the Basic, Enhanced, and Security levels. - -Additionally, at this level, devices opted in to the Windows Insider Program will send events that can show Microsoft how pre-release binaries and features are performing. All devices in the Windows Insider Program are automatically set to this level. - -If a device experiences problems that are difficult to identify or repeat using Microsoft's internal testing, additional info becomes necessary. This info can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the Full telemetry level and have exhibited the problem. - -However, before more info is gathered, Microsoft's privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information: - -- Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe. - -- Ability to get registry keys. - -- Ability to gather user content, such as documents, if they might have been the trigger for the issue. - -### How is telemetry information handled by Microsoft? - -### Collection - -Information gathered by the Connected User Experience and Telemetry component complies with Microsoft's security and privacy policies, as well as international laws and regulations. Only those who can demonstrate a valid business need can access the telemetry info. - -### Data Transfer - -All telemetry info is encrypted during transfer from the device to the Microsoft Data Management Service. Data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as gaming achievements, are always sent immediately. Normal events are not uploaded on metered networks. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks. - -### Microsoft Data Management Service - -The Microsoft Data Management Service routes information to internal cloud storage, where it's compiled into business reports for analysis and research. Sensitive info is stored in a separate data store that's locked down to a small subset of Microsoft employees in the Windows Devices Group. The privacy governance team permits access only to people with a valid business justification. The Connected User Experiences and Telemetry component connects to the Microsoft Data Management service at v10.vortex-win.data.microsoft.com. The Connected User Experience and Telemetry component connects to settings-win.data.microsoft.com to collect its settings. - -### Usage - -Information is used by teams within Microsoft to provide, improve, and personalize experiences, and for security, health, quality, and performance analysis. - -An example of personalization is to create individually tailored in-product messages. - -Microsoft doesn't share organization-specific customer information with third parties, except at the customer's direction or for the limited purposes described in the privacy statement. However, we do share business reports with partners that include aggregated, anonymous telemetry information. Decisions to share info are made by an internal team that includes privacy, legal, and data management professionals. - -### Retention - -Microsoft believes in and practices information minimization, so we only gather the info we need, and we only store it for as long as it's needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, particularly if there is a regulatory requirement to do so. Info is typically gathered at a fractional sampling rate, which for some client services, can be as low as 1%. - - - - - + Microsoft doesn't intentionally gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information. \ No newline at end of file diff --git a/windows/manage/lock-down-windows-10.md b/windows/manage/lock-down-windows-10.md index ffe9e7c732..72dbc00ec1 100644 --- a/windows/manage/lock-down-windows-10.md +++ b/windows/manage/lock-down-windows-10.md @@ -43,23 +43,27 @@ Enterprises often need to manage how people use corporate devices. Windows 10 p

Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings.

-

[Configure telemetry and other settings in your organization](disconnect-your-organization-from-microsoft.md)

-

Learn about the telemetry that Microsoft gathers, the network connections that Windows components make to Microsoft, and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro.

+

[Configure telemetry in your organization](configure-telemetry-in-your-organization.md)

+

Use this article to make informed decisions about how you can configure telemetry in your organization.

+

[Disconnect your organization from Microsoft](disconnect-your-organization-from-microsoft.md)

+

Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro.

+ +

[Configure access to Windows Store](stop-employees-from-using-the-windows-store.md)

IT Pros can configure access to Windows Store for client computers in their organization. For some organizations, business policies require blocking access to Windows Store.

- +

[Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md)

Wi-Fi Sense automatically connects you to Wi-Fi, so you can get online quickly in more places. It can connect you to open Wi-Fi hotspots it knows about through crowdsourcing, or to Wi-Fi networks your contacts have shared with you by using Wi-Fi Sense.

The initial settings for Wi-Fi Sense are determined by the options you chose when you first set up your PC with Windows 10.

- +

[Configure Windows 10 Mobile using Lockdown XML](lockdown-xml.md)

Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device.

- +

[Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md)

There are two methods for resetting a Windows 10 Mobile device: factory reset and "wipe and persist" reset.

From b7c4a15927826cbacc772a2f3d9c5eb19790dda3 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 14 Apr 2016 15:23:21 -0700 Subject: [PATCH 03/38] fixing tables --- ...onnect-your-organization-from-microsoft.md | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index f4ceaf4890..e87264821a 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -73,7 +73,7 @@ Here's what's covered in this article: - [13. Settings > Privacy](#bkmk-settingssection) - - [13.1 General](#bkmk-general) + - [13.1 General](https://tnstage.redmond.corp.microsoft.com/en-us/itpro/windows/manage/change-history-for-manage-and-update-windows-10?branch=7087905) - [13.2 Location](#bkmk-priv-location) @@ -249,9 +249,8 @@ Use either Group Policy or MDM policies to manage settings for Cortana. For more Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**. - | Policy | Description | --------------------------------------------------------|---------------------------------------------------------------------------------------| +|------------------------------------------------------|---------------------------------------------------------------------------------------| | Allow Cortana | Choose whether to let Cortana install and run on the device. | | Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results. | | Do not allow web search | Choose whether to search the web from Windows Desktop Search.
Default: Disabled| @@ -292,7 +291,7 @@ If your organization tests network traffic, you should not use Fiddler to test W The following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). | Policy | Description | --------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| | Experience/AllowCortana | Choose whether to let Cortana install and run on the device. | | Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results.
Default: Allowed| @@ -362,7 +361,7 @@ Use Group Policy to manage settings for Internet Explorer. Find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. | Policy | Description | --------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| | Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
Default: Enabled
You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.| | Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the address bar.
Default: Enabled| | Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.
Default: Disabled
You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| @@ -405,7 +404,7 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. | Policy | Description | --------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| | Turn off autofill | Choose whether employees can use autofill on websites.
Default: Enabled | | Allow employees to send Do Not Track headers | Choose whether employees can send Do Not Track headers.
Default: Disabled | | Turn off password manager | Choose whether employees can save passwords locally on their devices.
Default: Enabled | @@ -419,7 +418,7 @@ The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). | Policy | Description | --------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| | Browser/AllowAutoFill | Choose whether employees can use autofill on websites.
Default: Allowed | | Browser/AllowDoNotTrack | Choose whether employees can send Do Not Track headers.
Default: Not allowed | | Browser/AllowPasswordManager | Choose whether employees can save passwords locally on their devices.
Default: Allowed | @@ -602,7 +601,7 @@ Use Settings > Privacy to configure some settings that may be important to yo - [13.15 Background apps](#bkmk-priv-background) -### 13.1 General +### 13.1 General **General** includes options that don't fall into other areas. @@ -1195,7 +1194,7 @@ You can set up Delivery Optimization from the **Settings** UI. You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. | Policy | Description | -----------------------------|-----------------------------------------------------------------------------------------------------| +|---------------------------|-----------------------------------------------------------------------------------------------------| | Download Mode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

  • None. Turns off Delivery Optimization.

  • Group. Gets or sends updates and apps to PCs on the same local network domain.

  • Internet. Gets or sends updates and apps to PCs on the Internet.

  • LAN. Gets or sends updates and apps to PCs on the same NAT only.

| | Group ID | Lets you provide a Group ID that limits which PCs can share apps and updates.
** Note** This ID must be a GUID.| | Max Cache Age | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
The default value is 259200 seconds (3 days).| @@ -1207,7 +1206,7 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). | Policy | Description | -----------------------------|-----------------------------------------------------------------------------------------------------| +|---------------------------|-----------------------------------------------------------------------------------------------------| | DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

  • 0. Turns off Delivery Optimization.

  • 1. Gets or sends updates and apps to PCs on the same NAT only.

  • 2. Gets or sends updates and apps to PCs on the same local network domain.

  • 3. Gets or sends updates and apps to PCs on the Internet.

| | DeliveryOptimization/DOGroupID | Lets you provide a Group ID that limits which PCs can share apps and updates.
** Note** This ID must be a GUID.| | DeliveryOptimization/DOMaxCacheAge | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
The default value is 259200 seconds (3 days).| From 91ea078a3f83aa6a7849d2234f87b862b6b26974 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 25 Apr 2016 09:37:16 -0700 Subject: [PATCH 04/38] Added text in Security level section that lists supported editions --- windows/manage/configure-telemetry-in-your-organization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/configure-telemetry-in-your-organization.md b/windows/manage/configure-telemetry-in-your-organization.md index 419bc3113d..30c5e247ea 100644 --- a/windows/manage/configure-telemetry-in-your-organization.md +++ b/windows/manage/configure-telemetry-in-your-organization.md @@ -95,7 +95,7 @@ The levels are cumulative and are illustrated in the following diagram. These le ### Security level -The Security level gathers only the telemetry info that is required to keep Windows devices, Windows Server, and guests secure with the latest security updates. +The Security level gathers only the telemetry info that is required to keep Windows devices, Windows Server, and guests secure with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and IoT Core editions. **Note**   If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. From 2b037a6363d55cbcc0eeaf8c5a4d08760cfecefa Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 26 Apr 2016 09:25:23 -0700 Subject: [PATCH 05/38] Adding bug# 7333625 and tech review feedback --- ...onfigure-telemetry-in-your-organization.md | 6 +- ...onnect-your-organization-from-microsoft.md | 232 +++++++++--------- windows/manage/images/settings-table.png | Bin 16920 -> 70908 bytes 3 files changed, 124 insertions(+), 114 deletions(-) diff --git a/windows/manage/configure-telemetry-in-your-organization.md b/windows/manage/configure-telemetry-in-your-organization.md index 30c5e247ea..ace5305f29 100644 --- a/windows/manage/configure-telemetry-in-your-organization.md +++ b/windows/manage/configure-telemetry-in-your-organization.md @@ -55,11 +55,11 @@ The Connected User Experience and Telemetry component also connects to settings- ### Data usage -Data gathered from telemetry is used by Microsoft teams primarily to improve our customer experiences, and for security, health, quality, and performance analysis. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the Privacy Statement. We do share business reports with OEMs and third party partners that includes aggregated, anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. +Data gathered from telemetry is used by Microsoft teams primarily to improve our customer experiences, and for security, health, quality, and performance analysis. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the Privacy Statement. We do share business reports with OEMs and third party partners that includes aggregated, anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. Info is typically gathered at a fractional sampling rate, which can be as low as 1% of clients reporting data. ### Retention -Microsoft believes in and practices information minimization. We strive to gather only the info we need, and store it for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Store purchase history. Info is typically gathered at a fractional sampling rate, which can be as low as 1% of clients reporting data. +Microsoft believes in and practices information minimization. We strive to gather only the info we need, and store it for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Store purchase history. ## How is the data gathered? @@ -288,7 +288,7 @@ There are a few more settings that you can turn off that may send telemetry info ## Examples of how Microsoft uses the telemetry data -### Drive higher apps and driver quality in the ecosystem +### Drive higher application and driver quality in the ecosystem Telemetry plays an important role in quickly identifying and fixing critical reliability and security issues in our customers’ deployments and configurations. Insights into the telemetry data we gather helps us to quickly identify crashes or hangs associated with a certain application or driver on a given configuration, like a particular storage type (for example, SCSI) or a memory size. For System Center, job usages and statuses can also help us enhance the job workload and the communication between System Center and its managed products. Microsoft’s ability to get this data from customers and drive improvements into the ecosystem helps raise the bar for the quality of System Center, Windows Server applications, Windows apps, and drivers. Real-time data about Windows installations reduces downtime and the cost associated with troubleshooting unreliable drivers or unstable applications diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index 1b08b376bb..6159d95499 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -53,83 +53,85 @@ Here's what's covered in this article: - [6.2 ActiveX control blocking](#bkmk-ie-activex) - - [7. Mail synchronization](#bkmk-mailsync) + - [7. Live Tiles](#live-tiles) + + - [8. Mail synchronization](#bkmk-mailsync) - - [8. Microsoft Edge](#bkmk-edge) + - [9. Microsoft Edge](#bkmk-edge) - - [8.1 Microsoft Edge Group Policies](#bkmk-edgegp) + - [9.1 Microsoft Edge Group Policies](#bkmk-edgegp) - - [8.2 Microsoft Edge MDM policies](#bkmk-edge-mdm) + - [9.2 Microsoft Edge MDM policies](#bkmk-edge-mdm) - - [8.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov) + - [9.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov) - - [9. Network Connection Status Indicator](#bkmk-ncsi) + - [10. Network Connection Status Indicator](#bkmk-ncsi) - - [10. Offline maps](#bkmk-offlinemaps) + - [11. Offline maps](#bkmk-offlinemaps) - - [11. OneDrive](#bkmk-onedrive) + - [12. OneDrive](#bkmk-onedrive) - - [12. Preinstalled apps](#bkmk-preinstalledapps) + - [13. Preinstalled apps](#bkmk-preinstalledapps) - - [13. Settings > Privacy](#bkmk-settingssection) + - [14. Settings > Privacy](#bkmk-settingssection) - - [13.1 General](#bkmk-priv-general) + - [14.1 General](#bkmk-priv-general) - - [13.2 Location](#bkmk-priv-location) + - [14.2 Location](#bkmk-priv-location) - - [13.3 Camera](#bkmk-priv-camera) + - [14.3 Camera](#bkmk-priv-camera) - - [13.4 Microphone](#bkmk-priv-microphone) + - [14.4 Microphone](#bkmk-priv-microphone) - - [13.5 Speech, inking, & typing](#bkmk-priv-speech) + - [14.5 Speech, inking, & typing](#bkmk-priv-speech) - - [13.6 Account info](#bkmk-priv-accounts) + - [14.6 Account info](#bkmk-priv-accounts) - - [13.7 Contacts](#bkmk-priv-contacts) + - [14.7 Contacts](#bkmk-priv-contacts) - - [13.8 Calendar](#bkmk-priv-calendar) + - [14.8 Calendar](#bkmk-priv-calendar) - - [13.9 Call history](#bkmk-priv-callhistory) + - [14.9 Call history](#bkmk-priv-callhistory) - - [13.10 Email](#bkmk-priv-email) + - [14.10 Email](#bkmk-priv-email) - - [13.11 Messaging](#bkmk-priv-messaging) + - [14.11 Messaging](#bkmk-priv-messaging) - - [13.12 Radios](#bkmk-priv-radios) + - [14.12 Radios](#bkmk-priv-radios) - - [13.13 Other devices](#bkmk-priv-other-devices) + - [14.13 Other devices](#bkmk-priv-other-devices) - - [13.14 Feedback & diagnostics](#bkmk-priv-feedback) + - [14.14 Feedback & diagnostics](#bkmk-priv-feedback) - - [13.15 Background apps](#bkmk-priv-background) + - [14.15 Background apps](#bkmk-priv-background) - - [14. Software Protection Platform](#bkmk-spp) + - [15. Software Protection Platform](#bkmk-spp) - - [15. Sync your settings](#bkmk-syncsettings) + - [16. Sync your settings](#bkmk-syncsettings) - - [16. Teredo](#bkmk-teredo) + - [17. Teredo](#bkmk-teredo) - - [17. Wi-Fi Sense](#bkmk-wifisense) + - [18. Wi-Fi Sense](#bkmk-wifisense) - - [18. Windows Defender](#bkmk-defender) + - [19. Windows Defender](#bkmk-defender) - - [19. Windows Media Player](#bkmk-wmp) + - [20. Windows Media Player](#bkmk-wmp) - - [20. Windows spotlight](#bkmk-spotlight) + - [21. Windows spotlight](#bkmk-spotlight) - - [21. Windows Store](#bkmk-windowsstore) + - [22. Windows Store](#bkmk-windowsstore) - - [22. Windows Update Delivery Optimization](#bkmk-updates) + - [23. Windows Update Delivery Optimization](#bkmk-updates) - - [22.1 Settings > Update & security](#bkmk-wudo-ui) + - [23.1 Settings > Update & security](#bkmk-wudo-ui) - - [22.2 Delivery Optimization Group Policies](#bkmk-wudo-gp) + - [23.2 Delivery Optimization Group Policies](#bkmk-wudo-gp) - - [22.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm) + - [23.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm) - - [22.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov) + - [23.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov) - - [23. Windows Update](#bkmk-wu) + - [24. Windows Update](#bkmk-wu) ## What's new in Windows 10, version 1511 @@ -203,43 +205,45 @@ The settings in this section assume you are using Windows 10, version 1511 (cur - [6. Internet Explorer](#bkmk-ie) -- [7. Mail synchronization](#bkmk-mailsync) +- [7. Live Tiles](#live-tiles) -- [8. Microsoft Edge](#bkmk-edge) +- [8. Mail synchronization](#bkmk-mailsync) -- [9. Network Connection Status Indicator](#bkmk-ncsi) +- [9. Microsoft Edge](#bkmk-edge) -- [10. Offline maps](#bkmk-offlinemaps) +- [10. Network Connection Status Indicator](#bkmk-ncsi) -- [11. OneDrive](#bkmk-onedrive) +- [11. Offline maps](#bkmk-offlinemaps) -- [12. Preinstalled apps](#bkmk-preinstalledapps) +- [12. OneDrive](#bkmk-onedrive) -- [13. Settings > Privacy](#bkmk-settingssection) +- [13. Preinstalled apps](#bkmk-preinstalledapps) -- [14. Software Protection Platform](#bkmk-spp) +- [14. Settings > Privacy](#bkmk-settingssection) -- [15. Sync your settings](#bkmk-syncsettings) +- [15. Software Protection Platform](#bkmk-spp) -- [16. Teredo](#bkmk-teredo) +- [16. Sync your settings](#bkmk-syncsettings) -- [17. Wi-Fi Sense](#bkmk-wifisense) +- [17. Teredo](#bkmk-teredo) -- [18. Windows Defender](#bkmk-defender) +- [18. Wi-Fi Sense](#bkmk-wifisense) -- [19. Windows Media Player](#bkmk-wmp) +- [19. Windows Defender](#bkmk-defender) -- [20. Windows spotlight](#bkmk-spotlight) +- [20. Windows Media Player](#bkmk-wmp) -- [21. Windows Store](#bkmk-windowsstore) +- [21. Windows spotlight](#bkmk-spotlight) -- [22. Windows Update](#bkmk-wu) +- [22. Windows Store](#bkmk-windowsstore) -- [23. Windows Update Delivery Optimization](#bkmk-updates) +- [23. Windows Update](#bkmk-wu) + +- [24. Windows Update Delivery Optimization](#bkmk-updates) See the following table for a summary of the management settings. For more info, see its corresponding section. -![](images/settings-table.png) +![Management settings table](images/settings-table.png) ### 1. Cortana @@ -374,7 +378,13 @@ ActiveX control blocking periodically downloads a new list of out-of-date Active For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx). -### 7. Mail synchronization +### 7. Live Tiles + +To turn off Live Tiles: + +- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage** + +### 8. Mail synchronization To turn off mail synchronization for Microsoft Accounts that are configured on a device: @@ -392,11 +402,11 @@ To turn off the Windows Mail app: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application** -### 8. Microsoft Edge +### 9. Microsoft Edge Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730682). -### 8.1 Microsoft Edge Group Policies +### 9.1 Microsoft Edge Group Policies Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. @@ -413,7 +423,7 @@ The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. | Open a new tab with an empty tab | Choose whether a new tab page appears.
Default: Enabled | | Configure corporate Home pages | Choose the corporate Home page for domain-joined devices.
Set this to **about:blank** | -### 8.2 Microsoft Edge MDM policies +### 9.2 Microsoft Edge MDM policies The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). @@ -425,13 +435,13 @@ The following Microsoft Edge MDM policies are available in the [Policy CSP](http | Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions..
Default: Allowed | | Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
Default: Allowed | -### 8.3 Microsoft Edge Windows Provisioning +### 9.3 Microsoft Edge Windows Provisioning Use Windows ICD to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies**. For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx). -### 9. Network Connection Status Indicator +### 10. Network Connection Status Indicator Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftncsi.com to determine if the device can communicate with the Internet. For more info about NCIS, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). @@ -439,7 +449,7 @@ You can turn off NCSI through Group Policy: - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** -### 10. Offline maps +### 11. Offline maps You can turn off the ability to download and update offline maps. @@ -449,13 +459,13 @@ You can turn off the ability to download and update offline maps. - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** -### 11. OneDrive +### 12. OneDrive To turn off OneDrive in your organization: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage** -### 12. Preinstalled apps +### 13. Preinstalled apps Some preinstalled apps get content before they are opened to ensure a great experience. You can remove these using the steps in this section. @@ -567,41 +577,41 @@ To remove the Get Skype app: Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage** -### 13. Settings > Privacy +### 14. Settings > Privacy Use Settings > Privacy to configure some settings that may be important to your organization. Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. -- [13.1 General](#bkmk-general) +- [14.1 General](#bkmk-general) -- [13.2 Location](#bkmk-priv-location) +- [14.2 Location](#bkmk-priv-location) -- [13.3 Camera](#bkmk-priv-camera) +- [14.3 Camera](#bkmk-priv-camera) -- [13.4 Microphone](#bkmk-priv-microphone) +- [14.4 Microphone](#bkmk-priv-microphone) -- [13.5 Speech, inking, & typing](#bkmk-priv-speech) +- [14.5 Speech, inking, & typing](#bkmk-priv-speech) -- [13.6 Account info](#bkmk-priv-accounts) +- [14.6 Account info](#bkmk-priv-accounts) -- [13.7 Contacts](#bkmk-priv-contacts) +- [14.7 Contacts](#bkmk-priv-contacts) -- [13.8 Calendar](#bkmk-priv-calendar) +- [14.8 Calendar](#bkmk-priv-calendar) -- [13.9 Call history](#bkmk-priv-callhistory) +- [14.9 Call history](#bkmk-priv-callhistory) -- [13.10 Email](#bkmk-priv-email) +- [14.10 Email](#bkmk-priv-email) -- [13.11 Messaging](#bkmk-priv-messaging) +- [14.11 Messaging](#bkmk-priv-messaging) -- [13.12 Radios](#bkmk-priv-radios) +- [14.12 Radios](#bkmk-priv-radios) -- [13.13 Other devices](#bkmk-priv-other-devices) +- [14.13 Other devices](#bkmk-priv-other-devices) -- [13.14 Feedback & diagnostics](#bkmk-priv-feedback) +- [14.14 Feedback & diagnostics](#bkmk-priv-feedback) -- [13.15 Background apps](#bkmk-priv-background) +- [14.15 Background apps](#bkmk-priv-background) -### 13.1 General +### 14.1 General **General** includes options that don't fall into other areas. @@ -673,7 +683,7 @@ To turn off **Let websites provide locally relevant content by accessing my lang - Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1. -### 13.2 Location +### 14.2 Location In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location. @@ -724,7 +734,7 @@ To turn off **Choose apps that can use your location**: - Turn off each app using the UI. -### 13.3 Camera +### 14.3 Camera In the **Camera** area, you can choose which apps can access a device's camera. @@ -761,7 +771,7 @@ To turn off **Choose apps that can use your camera**: - Turn off the feature in the UI for each app. -### 13.4 Microphone +### 14.4 Microphone In the **Microphone** area, you can choose which apps can access a device's microphone. @@ -779,7 +789,7 @@ To turn off **Choose apps that can use your microphone**: - Turn off the feature in the UI for each app. -### 13.5 Speech, inking, & typing +### 14.5 Speech, inking, & typing In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. @@ -804,7 +814,7 @@ To turn off the functionality: Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero). -### 13.6 Account info +### 14.6 Account info In the **Account Info** area, you can choose which apps can access your name, picture, and other account info. @@ -822,7 +832,7 @@ To turn off **Choose the apps that can access your account info**: - Turn off the feature in the UI for each app. -### 13.7 Contacts +### 14.7 Contacts In the **Contacts** area, you can choose which apps can access an employee's contacts list. @@ -836,7 +846,7 @@ To turn off **Choose apps that can access contacts**: - Set the **Select a setting** box to **Force Deny**. -### 13.8 Calendar +### 14.8 Calendar In the **Calendar** area, you can choose which apps have access to an employee's calendar. @@ -854,7 +864,7 @@ To turn off **Choose apps that can access calendar**: - Turn off the feature in the UI for each app. -### 13.9 Call history +### 14.9 Call history In the **Call history** area, you can choose which apps have access to an employee's call history. @@ -868,7 +878,7 @@ To turn off **Let apps access my call history**: - Set the **Select a setting** box to **Force Deny**. -### 13.10 Email +### 14.10 Email In the **Email** area, you can choose which apps have can access and send email. @@ -882,7 +892,7 @@ To turn off **Let apps access and send email**: - Set the **Select a setting** box to **Force Deny**. -### 13.11 Messaging +### 14.11 Messaging In the **Messaging** area, you can choose which apps can read or send messages. @@ -900,7 +910,7 @@ To turn off **Choose apps that can read or send messages**: - Turn off the feature in the UI for each app. -### 13.12 Radios +### 14.12 Radios In the **Radios** area, you can choose which apps can turn a device's radio on or off. @@ -918,7 +928,7 @@ To turn off **Choose apps that can control radios**: - Turn off the feature in the UI for each app. -### 13.13 Other devices +### 14.13 Other devices In the **Other Devices** area, you can choose whether devices that aren't paired to PCs, such as an Xbox One, can share and sync info. @@ -936,7 +946,7 @@ To turn off **Let your apps use your trusted devices (hardware you've already co - Set the **Select a setting** box to **Force Deny**. -### 13.14 Feedback & diagnostics +### 14.14 Feedback & diagnostics In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. @@ -1010,7 +1020,7 @@ To change the level of diagnostic and usage data sent when you **Send your devic - **3**. Maps to the **Full** level. -### 13.15 Background apps +### 14.15 Background apps In the **Background Apps** area, you can choose which apps can run in the background. @@ -1018,7 +1028,7 @@ To turn off **Let apps run in the background**: - Turn off the feature in the UI for each app. -### 14. Software Protection Platform +### 15. Software Protection Platform Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by applying the following Group Policy: @@ -1026,7 +1036,7 @@ Enterprise customers can manage their Windows activation status with volume lice The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. -### 15. Sync your settings +### 16. Sync your settings You can control if your settings are synchronized: @@ -1052,13 +1062,13 @@ To turn off Messaging cloud sync: - Create a REG\_DWORD registry setting called **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging**, with a value of 0 (zero). -### 16. Teredo +### 17. Teredo You can disable Teredo by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](http://technet.microsoft.com/library/cc722030.aspx). - From an elevated command prompt, run **netsh interface teredo set state disabled** -### 17. Wi-Fi Sense +### 18. Wi-Fi Sense Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them. @@ -1084,7 +1094,7 @@ To turn off **Connect to suggested open hotspots** and **Connect to networks sha When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. -### 18. Windows Defender +### 19. Windows Defender You can opt of the Microsoft Antimalware Protection Service. @@ -1128,7 +1138,7 @@ You can stop downloading definition updates: You can also use the registry to turn off Malicious Software Reporting Tool telemetry by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1. -### 19. Windows Media Player +### 20. Windows Media Player To remove Windows Media Player: @@ -1138,7 +1148,7 @@ To remove Windows Media Player: - Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** -### 20. Windows spotlight +### 21. Windows spotlight Windows spotlight provides different background images and text on the lock screen. You can control it by using the user interface or through Group Policy. @@ -1169,13 +1179,13 @@ Windows spotlight provides different background images and text on the lock scre For more info, see [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md). -### 21. Windows Store +### 22. Windows Store You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**. -### 22. Windows Update Delivery Optimization +### 23. Windows Update Delivery Optimization Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. @@ -1183,13 +1193,13 @@ By default, PCs running Windows 10 Enterprise and Windows 10 Education will on Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization. -### 22.1 Settings > Update & security +### 23.1 Settings > Update & security You can set up Delivery Optimization from the **Settings** UI. - Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. -### 22.2 Delivery Optimization Group Policies +### 23.2 Delivery Optimization Group Policies You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. @@ -1201,7 +1211,7 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con | Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
The default value is 20, which represents 20% of the disk.| | Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.| -### 22.3 Delivery Optimization MDM policies +### 23.3 Delivery Optimization MDM policies The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). @@ -1214,7 +1224,7 @@ The following Delivery Optimization MDM policies are available in the [Policy CS | DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.| -### 22.4 Delivery Optimization Windows Provisioning +### 23.4 Delivery Optimization Windows Provisioning If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies @@ -1230,7 +1240,7 @@ Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windo For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730684). -### 23. Windows Update +### 24. Windows Update You can turn off Windows Update by setting the following registry entries: diff --git a/windows/manage/images/settings-table.png b/windows/manage/images/settings-table.png index 1a4aff8def3cba2193a7136a295e3ff11b38089f..527d92d9b23c3efbd4c6d9083b60c520191b738d 100644 GIT binary patch literal 70908 zcmce;by$>Z*EWta${-C&cMT2FAT@MI3?U(c2uMgHT{0kzG$`FEA(B!O;sBBkBHbc` zfPi%UZeVY>KF{9Y^StkO{JuXp96aW}@9SRIy4G6fd9FpMhMEG-HS%j{XlOV}in5w$ zXy|&tk0kgq@INxx3sk^Amz*^fq|wUyD3^g>Ko(F{C>q+UD6AusE5PrV4vPBDXlS_Y zXFr$T+ZURlp`GR_$wIZ=jlLb9+7s)XoJJiMG!pspc2}xDaL7aMTvo=)lM1i?q=!w* zVe9A*f1)hdjpYh`%#>0*h~SzdS9}70qQUZmJx_x}!{*u*w)iU&nX(VUjSp7mw!Ur) zr;2|N_}IrIKJvl;kQ36o@7p)w_2s79QnrygupTtDC-0Nk&OdyAP8TtAy55Py$f!j~ zWvGHf$b^`agv#t<8h9v2_xQnsk_jVdV?8iu-wHyBPcg~gs1I~&!3|G{_>uAVK`|dx zz!)`{m3!&~13vIO>4XcL8JSu6Achb#BWd9Z)#!J?9oC4dHsfiNPC+;VOr%i8Ey6Z` zTQ~=BhsPP22?e0~BZy@oYb%)kMG`))%|}!Eo|5urWxAD>$p+5t_E>5q90As#@d2%C zhGjY>ca|F*3F90VB=#4G4w#12Rhs%`opJ9MRWnLR5waPG*4_5TDJm+mW+IFoxo#tz z$#-;m?01@>#Wc;)?wj*QDc$VV1X6Zx_jW(ys~sQBdms#}M|*^Ymdi5`oFcmQQ7hOK z1-sIc|0WyimB`e9lt2;gNKewvK+LCDepbQ8T9YG_kd~eaNb|xhp@ZJgjMIik#gTQP zC4qnW%DUg_q0HCz7N4O}P02=90fB@&Sv@fVjb+y+X*XKz9w4TZo*~p%I@zu6k_B}z zTYom)esU0)cSrT;?qfd%eZg)FU2$SXMTxj)4l@#i9@LBu-;a5}2^FU-7!i-L*=qWr zIwYM4qdD@!^0eH{Q-pIZJ=1ZDvb>+Xd(ZEiNOUxA5o6AdAwSA?YupGdR3G&w0HPX( zvuVHKC?qq&i_uGQSaKPk+cCt(S~;F@WTOHEEz zZZYgBPg$vd{W4TtlwPuwl)K0_uSXVrQLnjoxaY@<{* z@apO&;x#EUUuk^QqVpVsYzOy-gHqgsb}tH15p;dZ&JH-^UJ-w;;nCOlhFFN|RPhF( zhq8BB&@ri=X7K}%hu^QRgXU$6=!Dmw+wU-lJ$=-6R$MUXXyvL?Skw>~`Oy0KC6ZS>^M8QcgP z)rzwh_7ufNzE~MH#@L3i$ZVr*5ec`|)Se+G6(kbs6x|71eaJPrj8sls-BliwF8Jh5ggdk%HEhcqx_a=fmS3c(;XIfL=u9TdfL~mMWxYZL+u64IB-%eh2qFA|? zRcAl%J%lPIBXNGEvh=n~ViGr0dOK0e+CM)VhEig1XDeo0h*Z~zNnt74ZhYZB>cgBq z0drHEP@tw&tAZ6T;B3^J&FW#*!`3>3m5wL1f@bK%Qlou@)s;?g7aV1!hX`;dAfl1p zcDC#SlZAG%6#5*s7T&RLl+){*Q}IHX9G&WNa>V}Yo}=C3^Kx3~mm#S3Nq35(U7ELI z=p-Iae3)ud;T_(xs*dn{*WjZB}}_Q_GR*b2q?(k%#X?R#@MS(29RiQV@2?_{!f+LDw8>A8677n`9KK#HO}jb;R&^ z)I*`=8twLKQLR8$PM~a1yOPzHTG@$>D_?^2goD0^%q&Pqsss@+mSGw{LEZcC#lVGI z<}cbJJg3m;Nb(kuxT)^C{E2){ArbccVFtG4A%xt;pHu|C7A#&ikNbeIvR&FO{``F^ z$QzSQ?bd91l}B-I#LEK4M}-L%GuSw=hF7#NMf#bScG&=Xp6ujeuZPvNk{xtW0c`gAre)1D2M@p#WukKPgudD{e~ zGRvacW1p^EhRu&o8!Zp?U!Z8YNzCUw*909NP>ZQ~zpze^Yt;LstoCT%1u?vcU;R*z zuvg?s-Y3BgbNnimDNC^`NjRTaSb4O1K%-c`bkA<4A0dYOg!UV2`axt6zu@`g#^tqz6T%1&2B zL`DXJ(xhdrvAe%ZBjYv$3g`qDiY%>M)QEetsgenGk)Qy4}Lujb+Gsh8w~wx<$2kmM@NcobfnboV82bSzOm?PNYc2n~14cNmVt0 zBJ-)D5P6#$|M3Dgx9WGbIW5%jaRq`uVT_H4JGZ+}>3F!~A_l0u*3QRe<0kQ_B`ixa zfIX<+XGEILRh`!5u5~7*SkW7w6=^Yzl0SN(SJ;2y9OM$%c9L$r0PWO`fQzSeh_D>82E!k#E@IH55~ z>rj!dg}$z_bzU7zs&!S3nszw;v2+ z)>9bgUyn;cc6e%HaCO5BxpfOVutwG9AcLvsde#_9-Z71XNDO;vwZzC`-RzS!R)%-k zvez_mToipY+?0{MngKtapC?e|NGh1eN6k6De%KTB&5CItmL5V>k8qgQwR%qKjhgg4 zNSuSplL;g9=%y8|Kn`cVSb5RCOIL z)k(~i+hi~FvXP(Fgw>CSJr9(eH6t7OyGyL_O_nX-Hz=mYqu=G0I>FXnY;Gt!g_Rf3 zk9;=D{MH}0RsNxp3sUTOVZB5Rw7kME z%jtPy)AgG*ixe443lzqx)>0LW)UlqDmc?@EhMm`}vz5CYm=-+@rV`8{GWmdCcI8PF zy;=%v1nGzq2dWu=L%k07#7L6$U+O^->Wqq_-L9QF4;P# z1E+h)sVhE<9_nG2Ey17lO-cZ@uU&qxtf#99ycVZYzxM$1#KmEb{Nx=>^IcX(d{WxJ zQz66xTxJ0U7cb3%qAIU@peHI+aA*eAnv_uFX`4$r;qe!Ilj763=_@>Z*Lp7Q8G>8L zsze@@DIc8|-NMVY`P9KLopbvH)9hwF1yg$DfrB^@YZYKj7T~EThKj?^dW7nSEtWSj z_TWsY^-wo%r6#{>4iMCIF#$jE)Cb#T{v_W02C=jeXH0T(cS!}lqGCL7(AAYXaYJq9 z;>6BNQzamCs;gqIkGh^tKsN89%k%1o9?)^Wc7kNfRnaauL$>S*D_?6vaBOc(gEC-s5y^I3T!ULxi2df;wK8Zn-TXzS>NQffTmIPni!^S_h+#1Qz9{Dc7X#oysRme~d#|6{zWP0+$79zPNk zLCb>|h<=wg+%GfBD>DH?n*@Adz7O*Ecus_yotAd5mvf|H%{Ba58YwjsQE>v%Lu=BA z$L?%iZQk|p78%C{{!0wt5A7ii10y5Os2@*-?ojplEPhRRmLXTF_8~Ghbfg<|o*!F7 zR4hT@P>^gM=NAxDY^3`nMK~|(M&mUx1 z-{u@Vhp=i3Ah>>Sox%E&qOb`r#^mIr!phyS#BZwIR-|de$uDY4XFK!<^U3D3&7K&D zn1ltHMB}QPt3PMa{k*0@DWY2E(z%c^J4v_Lk;_i|M1RjWl=4RVRV$7E2I z;DSm>8*S3E8_Tm)=Fb?o4?(qdlcMezyKlj86S|n$OdI;HuhMXYs7&h}s#RnVD@?`$=+@CurXYsko959*qN;VcdBK1;3r(C#r7ni?IX zbu8m8jdL3U*kE;T`^A;&D{{5Q>3&CXs@t{p(*!s-MH}9@u2~~8Ui%o@spjsr?Zt-Y zIJ14MR4yqd&l&U`WQBpKnQ(@>Lo@mLVQ20`aJBySxyM28Sfc?;=}lzmXcdI{+*3f1 z55K)h%wP${jkgEYr-v9nrF$Kc1dpP_#KlNyu}1h-FZbezdz1?#y*&EzE7dG zAB#RigXUrmCJVRji7!>LHHhr>6XD~xxi9eo4$7B!WR8A+XJ-m- zNs@3)iPtWm8Zst(IBj}T?$tQ!9+MbTztFGX6lr0$?b;7z;$+22kyo82da-Gw<8t4T z4;wagy)+f9Av2%bt~E+T7t{0g)^!CnqBgbASSlpStj3!h+Fhce<*Uem$dFYrRo-d` zO9U}WP^Q|5W{5a@ZH)E3quFk*__4W{y4r8CuE=ha-Zqx&rU1pg#Q-yIwsELR z&S2^29$z4lS^(32YzkVW3I9IC18l5+V8C6;39jc`%ekZPw>~{KYZ~UYTCOd6SFMD_ zrl2;-Yu7fuxHu;-HQ!9jtb$6g=` zUimlt^iyEMZ>;s{HZ)Q6!jicJ3nanV!vkVx4~0GrK#k?UB07!PNXq|_7s)D@ptOZ2 zp0;29Dkk9&4;eUHj*`B?BvY0^WHK;tefhigj_l_J-VNM$F&_hYbh1HDFhL}^*?xC- zGbCkCUT7K$?DQ|HTiB7OyzxFgu`VWA^(U-kA+rYdJviv0;<>+>jn9~8wK&^Ud@0%weZ=oJpE%z~Qs{l^)}VlZ z8}Btg>K3RQzjm9B@!Bi2(~vGnAetTIIXeHkL$~>-U%x&z)$F{)RaikvyvUXd#}jBX&b9V;v;Aqp4Y0NF|*#|EdSxDLb>Jv~LM z+rSdBfg+TT-P~wO?O6>fg;)zr9^ZNNaH=MV$U-jVAwJVFU^dgRJC~+n*@O+w(lmaJ zQv5esn$CP>=}%!n(db0x7KKZnO7F_G3Vd5dU>R)6NcZ5Zk+Jy$a1-GxCOgz=zcC9h)oz(Pu z+B=4>w%zb&H}?y8og~Ujaun3&nmed23dY17($n;-J1|s_TJ;LC9DiC;GO`-J;4N=p}R(h9s;?4PaRB~LlIE+^L0B|e_ zODXmnCLM>WGatNJHS$UT4$@~4RA2a@o4;F{=PqFBo4Ev4QmMvll&w*)N;Ww$9$)(#07q7i_A}f~;46iA|VJ zm2h63YO?h6n|{HUlvvKD(lwgKTPsqU%USugK~hbUhjpbr(@5+OTS%4OuK&{(P-Y7> zSY^P=gi?ZBSaH|92kBh~L|GsFT`hrF!a>n1eg|#IIy#CWaB(SW3Y?r8j`X{4ftS4l z@{gNw`2I011B+xm{jSsYWdGVCam`{c*LZ!&NjP`Z2aeB)sm5_N3r8KXiSbWWbMn_i zZ+ny%i&iM$X6K$&l$Vj+@pm<^D4ZYcwy!`!sgaLfC0{DiN%P-SlaCHdr2&mEUafII zJq7cD+s#42hG3A&TzhL*{?-e=T9Wcr!z0)_mI`-N|LBSL&afVZ3@|LFQ3z}WN(yG9)E*IxOxuf!XyMP}w!O_-d^_3i>+%P` z$jFxyewoalB^Ay7h#6N)rF~V3XDrWRwX{1G?DAU>91CNxrSuRGBTjF#mXRMWZ5Hqe zMXKIw_VW`M4&RZ2#{U4|g}QLnwe6n~;VdFw3JN$iYKTcV9w}fxJuE6RK4LW=O)tk& z$k|g+jKT$?E8QU5huYk0&l3N{A0P@`+&h#is>W#&KD|>u3Tsc7=OGuC2vjH;_!%+J zfDM6-@YmJVTW)JkUWe5uzDEqX3OJTu)4yBZ82iinz_HEeIcesVG%3^s>k`i;(K>pJ z>wg1%{yn3efgJSNx5S9KvxH;0h>7@_Yyg#zluM=R_3M)QMbD8*I~V~-*x=uAS9pEp zkL~SLQJ>jJonU8U5zoAN3mC<3-vqw}+fBYnxKrh=o~Hj@cPUg_Z+89a^`|D;6%{<# z(~S`h_rtR)CmQ$X^Lwjb>|_*?n+Sd zz(X&|e|Kyb)_>E`5cR3{I_GFg{6`+q5&=H@yX~Q`vpH#hyZHXMtF>4Q5RU#60tWd3 z{G7DZK(0W;G?u!~JOain#CBMlgUkWsq!x{V^x@^CyxQ9J-8E_$Dg1<;YD6fJTFK9G z`t`o8>83$JQ`O?vS6bOOg@3(2)aU_lSQvmR%M6TI41sqIRJViQV94`)0CB1OSGk9Q zg!D+aW6rYvXCd+6?G?gov*1z!GZK2v>m+0+GtWz7QLpxhOu7dGi$k^F7jMT$m1~=5 zwb48wY~(uD4ksLqoVmB*%lPdxQn^Q`=LKdsLHu1Ncc(Sltl=W3=q@G>+}(JeIid1T z_}Z*~42CjtpMouDk;B8`dFd1WGsCPoCz@b8CJyJTSAYV>zo+tFQI<8&nCmPG<#I?b zVjPv?;(9dq%)%+k{KH<|n=iSRc;u9vyHf1xQe0<&N-yKbMzlzU&(3S(EbJ7#Wk_Lq zkVcTaV^ECTvLKkcXA8fw#bDV?;`56Qd_gWJ6~n5u*2=rxS~yFXE_5DrpkCVD+XF1{ zEq+7SoEzribi3`ss%6p%{OFvJ?!J_zNAV73Gevv8Wh5Ld|dn7xVuv;T$i?A4$7A<<`=>ft6JQkFP z;M;O2GczNCsumMyXGwU^iUo{Ca`o~S$gV0K!V+LHad$I4UA{mC?PH#XqnwJZw7dwB zvOsdaYCB#@ob#!~`6?JNxkRxUANx1XMx`6I0X^bp&arW24t9=1)_uyj{Lwd6pM&bW29CVvsLmoI))$%}tEgfksuOe|9Zz`t za~A&!lb#)Tw92lZ4TyQ!hg@Jr2NYNfbcG2VA=Y-<IhDB8Epf`d^&9)j7Z7Mlb5lnL_+Lpn{NP|URcUT`$ zF`3JlEBwsB{FSmoiEAm*S`zj$OD|n&AHJ;PG1p&NShQfkqKL&>kyo2c7TZXZxv@Qn ze-!B;_G_@tR5(Hd0?E79iV}@SpIH<$pk(B29&j5RmphMurFyt1w{TKTs}I z41u4e^Ed3pNhhJGMd?PezSm^2TUtUQ=t5oT@iBZFer(-6uw5R+0vl45s{^~zBUzTb z*S%Ije339dsf4I1Y%ETQphwYi^h3?_et6g^S zSw6*EAJff=?lP4viJ89As0_`|o}-OZ;h5ubqRp~P7jtLueKD#@2KRCVbXyh}Z`xwKzZA++aW9FAw z4bRvPAcLZ{T?Gy?T^!Rvt;^}Y%t8k1I~~(g!;{Bf@?RD8?5>yNwx0@k;{WRNf282V zimuJ+M?#gArw7OdKS_b@aLGK5@vZGyOMWC*^xHwFf8#c#S$bN-OpBIFJ{FXZHmoC> z@crmHTL1QoDgXso@0>I~UcS9cF>@L7*C-8UP&_zmivl`~u9<+Ia)RE1zRraG-}9_L ziw)EKJA-|FWnU6k?zuI{$z{JC{C9>n;$v}n`4Vy&%l@Tk>S6aFJC$Vkm@IJE&Y^E> zD+>ol#A%xlzA)fPQp9Ife&4%t=eLZ?zkX|ECnvmeQECMV!cilA zyeN_}iLtlfAflgS@a@6khK55+AC%WVaaV*hGsGs2*HtzlXRu*d?<%>!x};)+sFei$QH`RsWx7> zR>4EiqmpF{^#K{2ybx$Dgkpds86}2GVf<>c@pmhHSk_o!b}eG3dyo{A{d6+}`Gd!< zE~^v6(UKO2brZ>o8&5ZwNEDW|^UV|P=m^N?Kz(NgE;jUY6}AaTu7LEL`(9qs!CE8^ z{zzeGNJS%EPGc#7wuMF(j$TBjxl^^G25d|qR8+*6V1$T2D^Jm3>H)|+J-T7;#V~vJ z@Gxd;MZlj*gZdK#+mm9t!{K}(p&tuPpA0KEQ$AX7O*W9MuCL#6{xYV(eeyCj8O8@<&ObhqWhKJLoqH|pw8HJ+v4Ggg6M zOCjqf9Gi>-#X$9$Rz5O1h=aN~N%d$-EeahQoiM@1up7+l9 zCffJBPgq7xHk1g9wO6k%=2?(WfDI@U0^f9b4o~U7OgDFeGiyH*?w60A)*wVGtU*16 zJDvQEB59#yFP6fY>cEem{M_mpgUSB_(ayQZ!2dY%DT%>1;h^F04ZIVw^%?o-NGiH} zuHJ8|QbO zljJ=aif^vEnODebb&^%UcPb!Q>2&I!eE(ElnEDS^z{~#;nHonq&#z7@Tora=JLz|V zzi*-JIQ&^MNiwb8$_BN0d{`22&?1j_`H%B~(N>KOsafY}<$?cvYsIRA^=be^%SE2p_yC>0aq%Qx#uQY@ZqA~y6 zkDrM!kO!X2eGYxyU*gMae3nML{RFoRap}t6quGnR@e`fA1z+C!8S{QZt~2g7SY(!V zY;<&Z!l`M+uC{O>bQZ>&1xRoCL9OTH^@k+(y>rpxjM0q%WBB-p7pNJ#n-0%T=sq)A z-qS~-Iwn|NxR<8#sI{Zzo#`C%J=-%kSFTrMVgOo)=Q+ok#*BALvN^PaW`0v7-9jD1#*_{}vHLAwlw8QdLfE95?|9=QR#)laq zWc*CXBQmcf6Uh%q{%l}N!ScuGk}{`HkH!E3mP4r1hL%uzGB}(`BGTCq3~P%x3TyuRHmEi<_q3Nx(beb zj?;cL?(zJJ>=5|Sfb6*tLAv0HFx}DAJJ&+b?;KzaVwHT*0T!f;IB0r zh|#{@t1d>cZcvx55v&oDO4NT_M%EVFAep`B^lb$sJ<~3Gwb^9uhShjwtQVo7j7%Zk z5}9@Ojm3rRPj+7My7$ryB3eX)4!@U?4&sleOh8(7dp%IxB#SF^Vp(eD`ury&8;I!t z8)5RR@|*D4*mG45%2n(3bz0_J&3Ry%bN?nBsZZSXRPl8-`E@HxZHydOW~2*enMzt% zLy@aiTMk$x`b$y|EGSt!N50g_G=8?X&^J6<&P7FST&w)qRZW_D+hpS}I)!+2ZgTC5 zsQ9FD24rLrR@X3QcVWs>mq@v*R)G({qM5K|gS*c|s4aAGHED_F)J*Gmb=*x>CZeyb zEUkfjbIFD#=`Im#Gf(rv+}G6Zs+U8>#hsS?gTHPI{bUsLg~sz!KNfT6gQr41)4ft* zP@q4KlocfnPon=U;+X!X=;6~hUCiCW`=sew_u?@&eJ$_R+rr-z$-zB0ea(V0B^p!T zm=vsbVYm924c@_lixz4Xl_2uS$R+9sC=E3WaKy+Ng(+?RCKC_(3GMFgrinOP?H5HVSPmNFXw3@ z^f6t$t}(R8D9|?AoNf8Oc2rv-SJ;;b93QkD=Xgh6{tdN|Xn`S~oAETye?Z+ITF<46 z(Uq5|N$l;^;hEP#ZVY>HXf!Q4<(lT;c=5uK{v-(lLzSI7XAbkfAfmb7zIP_g&SeGE zzsw*!MP0Ke=jtD$lgAsG5*gQX1#q(MzH4h9ff*u4L$xsgW{Z>ahS*wDJo?)9D`AMz z5i0OyOi(DSDgFwo-%G1pJIyNK0gm&t>%Krf_xwiC?wODX+7CQq zEQYCJMlLsM?nGoN3knUjRw%%XV+XaJ?pfK*#b~{2FDWT4CaU~kHClhg`T-xLT&}4K zTBA_n%x*73tfNvO?Od$dc&&#Q5mc0JAi~{%!&P)mN7Txa1sWLewR6aa$f5bV(i)F!%uHmQOePUUcjF+<&V|_$p*yb>*$%g~z3HN` z|2rkPm7Ox3h0GUFRt?(^hXewR&;6IJ9=qwxe_OwpkVeoBZ)peqxLq7TXGT+OHcwA} zou*x}M0US5GE+3V1~T?7f|l;!okqc85ptIJbfHQdPE0RLcSoD4Qp(ioUQvK~u=au{ z>g}XilOdcJ#R5?>7oTO!tOwn|Eq;{Jsdl8$X`DQiB$$6)hq+hs$Kx+8o$`0qBsGYF zT8goB;<4)ic@-+7b*}cC#PxJssQv6Au`sMQU92|&yQ_l5WVp-M@tBdcK{dkB~& zG-%}Z#l;$2D^zbF-_9l8&lqjs%W*)K0Fq5&aObO z#q;z%8{hNteBs~FO+fxi0EO@Ab=a5IFfrv@+9GM_$QKCXtpZj_jnmFemEN5WE--vJ znI-I$e4l0y^#4RMe&8N|yYPAS8@n65)+WPi1i#av$KU5x< z)ye;&cq{NIKY)v;1#GTWnK+v465vq#6JSIBbIIWkiTtZ8>oYS>6hW>B;g=VdSGu1 zAonPQfZ=oCO|yhT-!uG884xznQcN0y{SlZ=6C)jicxx8O z!+Kl3z0Z-IS5#1Vx*03WuY4wN*fzMkY`^h|NiBchD|*Y<@jYMtd)|lMhWDH`s~}-- zb8?{uBEQ-7fy6sN4(zLBX}T_>TKqc84(Y%3?YfA)qsox~s|?d5)+LjGcOKn{#X5?m z`7EXdmK!1|qN&{7ynOck4?wKkZkLox3cNv zEp$iv?&0h^*F^P{hF&)&HFk1*tY&U-$4W=Xlz(=5hWesz`=0CgvwjDS6WYs1Z-K_C zmaSO0OYzKes~;31*1{gf5fO@o{&)(iu58U#u7=Ph0S(`390M%Y35rCWIhJzuWNl6` z(DssxhkYZx%WFe|UfM@247xzeSkl|VhP;R|5H%bW9MEelVAeAB<4aI_<4Cf~9be~z z4|!g@+5gZYWq;tWq)&542V={Z{h~|hZCvMHM5LL@8C*wHD+)clDO0RYj}+UEP(4Dk zd15Iz%%{&xXNGamg|74YZP6z->g3ign~l`XFmR9DS<{MFct+f=ln)EgynTmFGw#Zo z64^4ewLRwFQ-Ae;(xADeEQo?wtipbGP|O+@gNV#`_mpz`O|J^Ui%qpmh?uWAcBBYm z4u6z#LEpGbMa=NE>Js^7hOcoQ!2xlqOMDh~+(zT|dpT1iiAK~JuaEb?QCU6hjnhqy z;;>fcvL+R*qdDa_`=p?*f&27PS0 z+>9x*xFz_w&%o_bXBd`NVzrvl$-RHi%F|6j7g^bTsO~3RgWGhS5!=>JSR_LTs-Dxa z756E9;bgYLXHe9L8`D=KlvIBDrs!4-f~r^|!5XPk7iv-SGTU{Y*=m_%L`?>H2ldj3 zAR<%!GA2f?Z{0nfrH@LlDK`J9?`lWkW=tSNImnnD@|z!z#-5cfn?ggrFkgHI1aX+g zD!~Z;5X6HQ4#Kn0#**`?i+zZ%vztX$rzE}g@gcHTi-v1cuB(^Gsco;x5ktPTfJ_@$ zamiN_nLZ^CQfS71kzKuTF0$)yA>WlXfUH%4I=tb^ETql>|9Je(=@H##fBanWD?ctj zQRk1Jk&B1Bx>`+^c=6G4T^f%TLFxRzin@UW{84D_t<`_eM04~p+rW4~{7am<4>AGu zGJJM$sF>5UK0y6gezdbD?!#R5ICyV@3 z1^)l52@7Z<4xg=*y>+W0`EHrpJQ+(j#Xo z`09oO2taJWqX7;2-ze*U%cQ>x+JEX2Z_Qc9#}A-Z^Y7N}Ln_f*PIds<;p6M@?)08A zRsDgR%%|G&eM>Gb3zu`U6&!w*MCRxs@87#e6=@AT`i%>_g{;iWmLrsro%z*MN|7lP z3|98YYEeCsY%H{}$t~*Bjp_g+0v;-WsK1TQ&#YPXZU{A>fG?~ z%8r~-hdX)yL`F~ZrNXG_DvQJ1PPmm4%|xCqhq)tzORn zgz7d*5Ghf`Z}FA^6ELQK&yefJ!3X#lJbRqGU-G0Y|A6MdYvHy0Rlot-5-?$vriu)O zt}~u}J-FEQ{8q?0m@TD@oJgsSxlC6Aw!o{^*L$$X14`O3#cz64z&`{--sE?0ZHkz=$kNVta08@XyWE* z5|gkv+#0<#bS(u^E=;43j5kE`SdTqZ>>TSZCVC+C{5N&0KL0G33du(wk!@!wkH#4j zRkA(~sPZJd%kXu`Sd+&4_R+Z=EzLszo)>Nj=de-adPyPT@@TWe4Oa)LAoKlS#X63U zXK8~1h`BLuigv<{`$DB{(xKj2DhvpZ?WZ)uTY_d5<^!@5NA!)tg<}0 zz+LT<_Zl$VS5=y@+n%R1V8R7lxf@0p5~wpZnoa-zjHuFE2%cg58Y6@*#n zKM}p{-~A$~LBA?~e=wg+HkF1At_I-3WA1^(De00lEQp--HFUp83eUH0?!WH@G2c};^1`FD)HX2;JsUyda zU&cNh1*kJqW$b#&SuEWf%p?Muxt`~l(Ej?|O3E|opU~2AQ(YlI6!OrH%%oAA{qf^542=tb z4M4ZpVN-*`^`OjC<@ei>c?!Hn6T3FPRu<1$#36x04=&^CFJZW#KH#8NgJ-*I!nA5gY?-l^gX<+~hjd z1mMVE2;;(1ZZRH32Y86^l_R=_&|1+Op*5)&fWT=Ga*Joee^%X!Y${~}O_z}WhT9kB z6Q#lg!ZOCWr7Us1WR`waHp6lw+I!MA6K^e6vQZ~?`>47E4Q{Oj15~>zXcbx|j$-7c zeCg5h@V50loM}6_q<{Oz=jPX;HTN3dcuqDe_KnOxOrvV4n}0E3O2#KqRwlwaMsx-6 z7JyXFG-Yn}*t!@Z3jB@_1c|CA$VeO<8Q-VLh-Zp!(xpSwg`JAMuYE#YJkYAsJvC!^ z`S~nJ$F5Qc8$1>5sV+=+Q~Yk=bbWV88P4v(S))2}-M*qO;r?#E5x7-#g71V}r%=;Q z-Y!;SC9f^Q8U)CS%?^EAD5s@~xUDF$zvr0s9lj(V(78+iJP9nQo_%*u9$3?L*Nenk0a`ZUn1tz=SKRVLZ9`*`UauDA8T_z15 z`%f|{$;><%aAGc5TXz3)VjjGWIdcwcEtd8>0oXVx)NINOidUcJ$36@})xWlmom&mR zw#&%UE`SQF)HGm{?^Ab>=buoRM3Z@KB>)%0({YNK!CHDmXQ>9?;(;3}c?%1VK9+F) zvNKnm7A}eMFvnU{S5smL0z= z3jU$}91Uq9k~PvNg7|O7C&_DwN(SXGW?RP=KK#B2UJeAK)IG@Ab?K0}fub$ucoAd% zj=T=CN7z-LXwz&{3XPOIG+?D!BIbi#U_yRK?*|Wg04OT4bs8TsDB;i2zIpX{Ixuz9 zgF@7zv_Zi1-BZ>c0|@siS7ilVeTCfuvb2k6T0|R0gEJQ;!~`@iV;abyKYIaM>iuH~ z!i@S{^%i`(8Tc5oAcjbGFmjQM&$1d#Dr9DzYUV*2zhOx>?vnv}j4G!e6e{}2&bICs zQ7kU**xVzZHJbrXWr?ES5LtJkE{;i7wCt~pO^P0|9F%PmHM&{35cg1Mp>!GHSzPe5kU|HI|D&>tcIvJL z40dGjSdwo35|U&;7-L(5(BIF=UiweW=@q~~W(RnXzosETbOSH;%c9X<#>N;an?!V< ztZ2oZ9wU+5C-Idw{UgCSgB4=wK*K)~Ax^vZ2S#E0Kc+0f4FnU#-aoL>h-`#~^&B|_ zd|VEG2zc#M*9S+Ts5#qmOe~{*+2vUQ_$JMGC@^tv5t6(SD!5`2&*tL$~tZ=({`+%3lGU=uI(YW^Hx| zP!*7#2@rw%PFMWS{A9|JZV3=x40F^QSd4B~W9kc02bu#VD$DC5 zcY{7AYGVk_%rv$TnClhrfzR6D@d0&8Zg_`jmt#~9!b^ke}G+R?Q3Ytv-ZUSWRE ztIa4o3$;mN&RvZ|C?QKswQCi;G8>=n?YCC^jqLhA;9fz6v*<%NaOv*3fd8Cgtvh#1 zOcQ+oyIO%TyDOR)rrWtJ@PRo`8_+nnzWquk!lmfpv!(b+mYi|$P+&H`j9Ru4D^Oh} z`b*J-;$i#`K{I|JqcV9`0#U2AaNy&of3yuKaJ_!^;uTNaZRMNL# zu-ym#|BymA3#`Skwf8| zf&9+El++e5Y3&s*1fNj-r1$cM1$e(Xa`Jg{vTMEYID&DzGpTI*Du|n0T+L^j%GRj*1%Ul_N4dTtp!>m^z`w z-(kx!We%UE|4&Js=Sb&XVYV5f+KC>UJemGnDNHeBo;p(s@yq1mpOA2Lk}yWhv_XH^ zubgZJBP6xLN;*&KkCs2EnrbDjPaCUlXNzk{6En$_0yC}y1K8&>`rZQX`niODC{_0& znC|2XqarpinDl7G&dmIDyQu5b*BV9Qr>tMIw9-CksWkXNdy;%j0aAwAz2SJbtOjCLm&JukOH9pcY)OSPl1&E=;G=#h4db5Z$@Zj*7(v@ zxr*6LV3KB{zGroH&q#dh6Y)!1AZfB|CrysshxN+PV1_C z(h7-t*6-Dn{d%j+^7q?f+k!^Qjn&V<)HFm~T)a8fA}(aC?i8Iyca!8~?z9u55oomw zcdYz}A=alpL7oR!l&x?ZAtx%$zYU$5WFG z*JK9#^5zdZhZvT**SrK05VdDR}Ez3ysB3swLooQLR{wptq&J_)4WuL*CL2ru6(R3ITsbd;x zmpCiNUmvR(kwU*aoUvVX9FL~T$>PT9?kgS7qMXIWYs#L=ONOXaCaU zE}j7_d&GCBR*6A4HzUUmnFWZk@$2XeU~1fR8aeNO@h2Lx_G`R;b&zNxiZcuiwB<%5 zTQKP9>I&^)gS;f9s{?r8GqXSkAu#&#cMVAYu@yMo%^&;!BksK8ss7*p-#BrUEqgmw zp=>GZ*dr^X>>UzPGP3u~CVS^ZN;WBb3yJJdMoEzsGJelP^+xKgKA+F`_rAUV=+^Dk zdF|KrysqoyZgs*dKj zHwpz4pTe?p>}LJuLd0YnJuy=6ee^MSkp18+HHya$C&5*7A-qNJ$4jC(U*9ES|EqZZS~+|QwZA0Su^w?y@?E(c*^hZLIiVHfvi5mI_&Lf z+4nM}N`5E9#wqR3&S~qzn7&XV(AtKe^+4tPPq%2%=zrh_$(sP`ThpC4^*d~UI(%%W z;?_qHskr^;?*FqP(%bm`i;Q8pv%v3xL+iK+-Ko&`WOb_|IHYsvrllAr;~vS?-s0I` zfDc;GP`8;tJmt`XLeaW*wv>_C-5$UlImIlz8>t3w3U(58mBT$Ews=ht)^ zWF1@1nmAx<{7+r>#11d%cjfF3ok)&4X&-bp>X;1k5c_!rI&~p&7Vt8R(EX+?tFIA` zuCTMGDcbT1!w}L~dU++lhx+K3PX$FqN~kL)>S-e#&_lyWf$RQNvpc%%-&#wcjhHzR zrjYJ%x`7fRGjZj_<}v7^IH_f`T2-ESkI;$_Z}0` z!Y}aU51TSNfvE>UD>USby&2b;D1QAld#uNYv3_Y#!s7K~XP4(6OX*l`EMuOfC}xDmL8ja1}HC>>g?QBX3p^~r^t!5Qa#oTpM%KL9Q~qBr<^7&Ln$2ZQ7FB< zWDOq%LfJpJXgGk;eQ1mMBaX`bMAoG^2aKvmxY&OH338cgd+l+7wh@pjFX3B3ItVSl1vd)$uvttUXL; z8AY<=GS+h&96LRYEy_?MY|Ei;bUv2YgO^GH!g09_BR=odV9et;RpEx&VNr>JyBmdv z*Pe8@i%K2dr6vom22cVrsxLm{|f-q;#w!omt8Nu`A*Q#H;8tLY~k zP4uM|4LepvH8U7nKg^}O^rTxstTA|(@Wb{&;2l!}SNJ|TK0B0A-!zeXLVOm< z?ub{vF{>h=tA4QSVFor3Dpp^e>dKuaMpnlr;wnaBpupT~C%c4~d&)+7PzB&C|074E zUNQ5wFeZi#0&M;H>_g{_wkS8>V01r25mJ>pQ4WH|Uck$fJ^Ef-cBrrbD(C0%j4t&= zV6BQCF}6jGix1slXWZ0=07B0aTlF_PVMX#F{>JGqw6kB`C}S2EZ?Q$W8Q(Y{j?Icx zm@vrL*nD}h5}87GJIsni{7Qk*__eENu3yYQf^6fTe{qtw9(~JHV^-m1srvr?`$z$p zo==rXrFgKD->hTe#E_nw1jW|kd7lUbK!)+6;Mj5@Z7l(*t{8n-Msx(3fZSdbC_q#? zh5v(Mih+2Vx|(JT5@H$KEM#p`8nl3@}r40ukayDXsHl$U)o zCYoM1tezbDkO7D?Y#Jgw)Y35JWZWfC{yG_Xk>h~J2JW0&M^pQ^=f?M72A7X|?xj=s z+@_tbvj*ioDQu$^qcZR&OUk-8b6%WoQzXQo1Qm0UTaiCjP)+h-Gh(m;hV*9rXK(?$ zq>J?5?{jeX7A=m*q8r-P7$T_8RM((-eW3o(Z7%ELqt8=G;9a6k^ujA*!nabJT#rzA zoGc-=HP}j){w4@*aRRm<0knu#`j$f0M;Wfn@JB;P)njzn8DjV{riCS}Av;{L2%aE6 zUI{}7r%fF)X7F;kCA#0g`_`#-#23%>sQL*rXMx)iYPxfy_!BVyn9yUS;J~`HOL~>9022Ht*U%NyO0;8BJ5^U%snJf=L23%*$lmf0<5zkRc)D1nTKx7tar%1BPw zsTs8WCNC{pg*YboIg~emU7<}TJ#5aoX2^WQP2w+YQzDldM{_ViNi`=lAI{N!qd4ZjU2q(unE%AtM9SDqDeQ;QFvnhs7LNm;BMd*`>5VXQ>t zAV$&9?lDjk!Ksi*{Y4xh(&>08YA?MBNkE}yap}tR-lQD)<6C5}9~@ikTcV%@K?J`g zW|o0SnC(~tZX#TXJkOg`nzQ1a zq_;8D4aPU|VV?CE2z%riJg1aUR2jw0pnMvmm=+|8e^CcR+nBw*>z>pM_z}V+<5hyv zxfSJmML`Rk!GO&z^J_9SpI<=u3a+BC%$X9pMfJE0sZk@w>KhkOo8y!XhVGmD<}7hA zFf*yqt9BQ((DNhC9tKtdGE8pguHZG(m$9VwvszbAU0#0vo+Ikhp#S3Ue0%3tfrB2j zwzrcNN2NBk`7FM2Y|3-Aj#wgMFQi}&7SfvUo?Uc+-X zUCy7!LZXlKht6H?h>T0T)DfDSW70X#A97+^MHTh!A+%i=3%!Q~6qSO<=_%e95y>dl zf{I%Y>wQOr${jj{)S~Lp!~1g$@$Ev*GUvn#3~@67)X)5)fd&cO%g@8!q=If=9ig7> zGD_?%gxf#b_`!x5qDotR+Uph&;;stCEV8T>R$-^t(ulc+!29IPmkKL6>PagrRr8C_ zmvk-l8tatNksI9B!FGe9z6ebJND2klug=;n_cl~{jaHS0C>7Dm zJ4`5uIdZx>!^p69eMlO-(LuB<=5br?kcr_I#sq-V`|da8GP9KC2;8}HtZO3ypCyDe zHQkUuSx!cOjOlEGbb)!xFw+GsEkZ*?1Kup-`&DJbcYR}HO0s3=AR@SuXNni9Kf3WI z%EdVHS;$JfQfCQ^bc$8eh|N#38tr6xOJAm`WzNs*i`2I5crxTSpNt0xacQvyb@X!- zzVq_t0aPlpjKT#HR&rYYYXsF!{!be1pv`s0+@Itdu3>jdbk@-)Ct6jXbbo{>wBoNE zTw;KozMM^4jBER^9iEyEKp@!lX1kEv*(!f9aUD!>7=(I7{ieGU->`9Yo@)1P1c}mc zHK39m-y1f^4@4UZAYkn}b7WRVi9%GFw6lQ&9B#)dfogNt!-{m%IS}bU+-Z7{U+W){ zklM->vg_{toL+4SH!xV;w*GM9H-D%kf~zU6W%A@n22mrYa~(KPS0!Kxg&~~cPmOFi z2T6o^G(kJ?Kc`Efl!z0-ksI)lK!;$`w~iAK+#zBUKCX8!2av9hll7EZXPxy(qVpod zr!s@2FQ=|~JAi3j;Jj)9p5C0>so&`o5Rfd0*C!7vr?GmZ)}3#SIJ0B8eYgLv?lwy&dC z(-K!pxVsRPmRa3m`X|~h2|!e1jjj693^zChPh%jDA_;#)67+&^2@~X1DLkFOHmV8i zm*LNXlM_0^?tA%S5LC*RMRFQs(&d`D&sv%Izr2u4+=&)H%yNIwm^$HA?kVa(sx{>g zT`4UHLK%gp%3d+XRu^5a`YgpGfBk^5n?^m7@oST}M6pmCF{#rqWXtXbXe+K$Gd-@? z>0nRqsTPUGqfT2y2NR^wOxTf5UNV8Oq>i?-v?r7}ui~>!3i+2nkU!Oq${Ti2)P%9K zbyT$&Q5AW|ERX?ad^N9AH6Xw=)Ye))!FL5OWrnJZ&bM^g_6xm@WIM{4Ho~fi^Jes} zFToF4zZkv1i2S7k+0YCc=~GnARi_Ub(kG07j`Fffb&bLml27>Hxp^bKs*4&*j%|QImpRb1i&ad_l|X zZbNQEnW=_B8+?kq@-T2`35RkUSY9KfdNh5jl4jH%<) znT8axd~KGYGUhGeZ&KiYZuSIq^OwnkIY2S!jgEI(70R8*`I)i?SBpda%`%`(GYD|Y zl3V2?AWs;ZODDm)iy=S$3gB2rQL&J7Lhk{ZKY*JJ;PV4tv9|C%6SoAl?j`3lq|!^(m0M<+ zb96hY#Xr~?U)XEs3^Iypn>2VusifGYRtQ^#_fFFsY+^V;u=pFN(JT=D;! z@Z5qlto!W8bQX!A`0e5-K)MIlLYI~8-cYh``%H+3W0Dq(NUr(F)^GjZj#_r}By3`? z^sHa3;tP>)=2oEEkqyUGv!g+$ubV%|iB2LAN?Qf(Shcpc23qo7_Sb0C=LiW10J6$r zuvCSUuULK|&uAI{nuZjIC4ag5C?9M{x(XVzSDD`VyabZ%wD#rq&QhFkV827n=EFh3 z(_bMcLBXJu^5Dm%!^mO4JA&FXb3Nf}p5|Mu@bt!1fxY??B*8O%{8p6K7sgl^{?c&$5@EgncBZ zRvqc>q{lZ;PYn0Q;f&hb7D~4=J-)vFjN{5F7HyTt(7bbo<~P)&)D2$PILA5ZTzKUT zU+ew{xlkvCybic{`t#%@xEPfD4TPXNKtd&NbgtatSOYopjJi;-x8l$tE1qM@Z5M;= z>%^hVG8NDmIk)Occ^juw8fCZ58@p@-pG2wmMDjc_n|Qc#`WYX4o(=#s$@YcL;mN37 zAm9#+dB(s#_H=Tx;*HS{+QaT$d+>l;&~ugp)SpW_s)m8UuRwd%YIHGeZ$d0DuMf1MF~;vkGAhqlpWk^k*kaA>Txg#+tkK-d>>CadcJ;I3~DJ zw3_(el`4lx5En$m^kiY^L6-SbI32=uwHsQ2M|tdth?-dI0q|Ds50~)D=Cv=w4{$!p z=6yVgr~i(e^Q1F9ALy_!Z_EZUv4{sNJh{&S?xW1V z7umB)w~FkdM4X&rXN|{vbE1jxrrUE&mKrKhPT+`RyNuB6&z~uJhLckS`3p1AM020o zXH1rS4uD1}tip2UXI$WBgLpgmKwJ{}s0!oh50H}xV^Csj;`Vm~h(}UO;b`A6_{i<$ z@bq7ilgMFE9{jfbZ)gYkv!Z8Y11{SbpW$+V>^+R-|H|<5hn%L}p$I7meqrS~ij-2- zq?$n9`@I4yz@x(<|BQ6mRh+-6XB>_$3iQMste3vYcs(b+DY2f4=dgM)(n3mUh$S<#e+?mEruIBu4BXsJB>_0)X(;M1EOF18$z^P$6PP=$+}S#p$6bW>Dj{q znzCX3>9_2_PG^4atyU~Bqr`n<{t!EE@_vwp#x(D{SotJycHLPO;5~gURdzeflClvf zmjdF)=n^N{P4Ek>gRS8R$)8*>`%)8K8bB8b=M-aNIMmsGW>a`5Im*7W`L?*k(}+r8 z0Z7=jp_UieCY?PWE1?1j`MI8vnpS60kO1E0QG{zXRThy%|h#y1H-I&LoUWOK4?eKp5ILzn{dh}!?g7iz& zX`K5JejU&YigM{l9jn#Cl9UcamUe$#-ngOzX!7Cc67h&3H%A z;O%SpsrpplwP?}Ov-CjM!Z|SAmPpQFMmC1sD@yDSxPiWkK=g+}_aA9Z7bU|Fu)6-H z67hSTDQMgxApy>hesYi`>=KxgP;b5|$r^Q=IGk@x`|S=Aa-@RFxJ&bQ6CA@J8N zYoB9_H@2IOiQ00aZ%KLMtfH-v?*O3RcMxu7KYSOVFh(=#1N1_us-rH4_B|TxXV}1| zCMnJm`{UGq3>mqgKcQrGN(F)*$tyHbEss0{s#$Ww0V&-Ra=}o_FCK93~Q>%%NEt}^Ewtf>|cpH|D-s+Uq7{O z>25X?jLq3V-??$Px)76fAoEl7(FZNxGE`wlS;^NSWVGedvWPt0U}$ zW2nz38IcV5DNL1S#_l)HIcI$MkLc3>ZJ{0I%daj$1LkIGK}jFq8yp-MrWGiTPe5Rm zkR+?-*8$7C7#b|AY+-UCnZE2eXZU|7wb|5y(?q@4T!NrzP*F>h3>VpeB-4)lH41fh z>`FpVQp$>XkiC`STE1$PEN8?dIq?e^NP+5I-Vw zdbqe93~EOwS8ugv;f$8m&NK$3YjJ-r1?RTEsyD?dC57h}ljcx&`=*;r6fw#^zqt(U zO+F|p#W31fqsNve2D?$m6;6GH{%Oo@nB)vPm<4?wKxcd?*p4+c`=aO^|IfyNiKqN; z#(-@qh;VtTw-iLwFWRA-OAqK6`=`xQM8=}sA|ieVWgf=lt|s3ZVaqlo5}nerUtkemv-Xbs{Ti_RmMHsjjvo$z0thz@X26`FoTywqlf8k6c1!vSMA_p`|$C_AJ5E{m}3r|LM9(0E~pDDJR ztCx+vnlVc0!2W)zteffVxoJO?cp?(I!!LHKZ*lTmV*;t1n{&cGq|h&~Re@{);}1D* zn;$EC9T?+aLK8>};$v=#e5itwNbiMl`{fAA9Xz5q08>b9 zY5qw2I!OGp(iAj=Cwag)0ep7{BH~IgFB81$c9|o5@H)k*X*`4VBh`}sB?+u0OG+AQt|%my z791RTL>P`ikpy|Mq-^d5>)XomT(g=m7FyMiTY>&%2f-vV`WV({zKf}+;C3Y<35mc2 zH))7BE&Itsyb-N(2DlpAcN1>7_Nh~hOh&)IN|w)F~}Dx$yOpzF|B`+_&ZIWaxA`e zyilw#Na62Wpw>>N7bc=&^OtztuF-TWQ1TwGjOTr%MGm(sU?39z%l0q&X z-vZQe1$v54C|<~_;4U;y&cC8@y1HC>W4ESh?vRwzRy_)~qd6ll5cDx#<0dwY5hIay zR9qn*`yK4_$nYNuk=%ksrC__&sJB4_VxCp!@H8nrS2~;_Ps}pVw2bkzHt_}e*Q%ET zsNiCm$32OxsMhjtUhGbxw|45o=c$dAiGjDmp0G^<#IBv95YrzKQGdZ+YeD9m2T5&* zz|f<+4Kh;BK&o^?o-~X;h#w%%N6mA+2tqk>aKgjpE}5)%^1%-q$~QGgL7SS_vcTX0 z!LqmkRzur1ou2*83@cja@T$Sv^78F?Fby;}3zK%C;(k=O4Nmldz?zL;Eds<+m0H1y znlU$x21F$R2?2>T2%n(#n4Dl9Wd5qibKa7U=$6}2)Zbe>s=>*hl=jltDfzESHM`ss z>3hi5TJdp)-1Uhd$` zZH@wiT$wE^NjCYwSaqF5=ZLKS3SGnvztCCQSV4?C@tQVWy z_!zzm(Ib*-K(!S@TRKk8{7_aRIiK7Os=g6=K7AfD?}#h!dK^X!*+0M{g3JHHs26Lr z<+(@3EjF>NV6tyY*qqe%4=oLk5RsmI1SNEe?QK9F#RCM2gNUfN;~fp57kCtHmG>g{ zbZBoU_SjE_8+Xe8^EKWkhlP9<3KS2gH(osI+;}ebH*c$g2lUIYCWEP_+ z?tH`~B~OTqJtOa*8&6Y=^<^TviQXS8wXEzCgRj{L6OApt8&9>}v3%5$gKnjt6NpXU zFc~&8@>G0Pd?cJ5MWf{0?AhFCC!FBW19H;8q^fT-?Z|@>SoYsu7dX}ju&gJYQigVY z$f*uC_o7OytaDrSFx7^dTxLvF1GAl;iQXv?ikM8v-JoiJXv^}taMH+_`MD6Wc}hIO z$VW#oO^tEkkR8Yd!G*WQeTvp&AeGH30hg>k4SR0ui4)ak$-*lIUQ3uuj6>f)7vk8-$#3D3*9Or zf=>XLp%QJor|wi-&q6m=IBgR&FJmCs+_z&iK#LtQ9Xu$FQ#gFit(#ZHot~W zn%pNo^_Tjt#Rjy!k2`4kpy&zeU_qUY5|lbr5&}F8g=T-%0XmI!Z>gz8wt-% z{eAfqAVCv!3fMn=6U4ev3?25lARJ8LL+&+C1L;y?GE|<^b)CHS(Ua_|>y(da3G>A| zf)WqYn?xpe4e(?oiS6)}Vg8?0;bIBV^pB?^Z`E>~tK{&na(rWB>>8P;ar)X_f)wgW z6h_K&%Ga6p_yh}`UH7%RqGN5nbQ%8IZUf1V(Ea|t&gW1Fg>wp>f-mq)8TFh6Px-og zY??KdezF=~bP>_%$u^N5yM_W|Zmn891!X3fjUL<__S)zLw=G(MuPI}jdJ0K&h7_Yb zF&e&|(I} ziev{n(Y&LCsw%T7%?VqUZ+1+*wYz#Y_qAzs{(OJuo4&Lo5ny&IG0(`yS*zF~Rkv>? zUF1ctC}98aF3pAB3b*6{g5Xs%wyHBe#$QU!Ar}#4``<0=8nWvzO{-vDKQ{ zFAD4TRwBf`fd)`RUMwc=wD%*$0tIyZbe=Z}=qergd~;N!Fk5QzTVZYp^@s-Q6o+#0 z<9ajJI0H(9F825r`0Hrg22kL#ol06$Gq}oU5D%}Bocl~k>}(>f-FNqbax~{g`^)GJ z64J{h8$z-~>z}xk71>9(;$Kx#1pNC|M}8%J>0UF?;aahnl?fkGXKSL>(La1=x{_`b zjD20RqGW^FPHXK4P5^vs3}kA=H@>~zAiE3#0>}^gU)Px#C65-$qV*7E*G@CjRhxqr z*Be#hQ-Dac@$@Ge;cd*#Nvew;U<5ewi?L1S?M4AE@C7}zS5TB=%d}m#Ay}lNZ-++= zpAKqwE%CTn4kY)TN4~JyqcA=dtgU><1UR0oLja+k8rAFZVa}j0#C+?$P2yeC<1d(caZ=9bn zM)4^Z8OFsMYj%0QTyV$&79LNZ$Mb}boK}bBuUjY`z+1PpoEr~{xN}DJ7#{RUg}`xxFOG~vDYH!liz+9IX|2Nv<>%z@xxku*)zxV+GvLw8|f$M zWr-H38AUFhA7rr(eu>#r0S`>7Exn$QWDh2?aVDEWOu|d~OUTsEzoxEiZlpPV<@2)& ztiS7z$}U9>q5fD&{$Mr32@DS?cA%6nnj|yA_=(|my|j<#b(x*~L%7%|&wyF!r*J3v zJ_RPV-~rl8d+y^UrWDuD-B5~{y=&ROp|_t|t4Mo*|v0iyw^wX z?-?3=7ToxJNofWd{}mU3dt=U zg1q!o$>YQ)o5Z}kp}3#%IxabI@&){vO6Lp7mP%*GE4Fz}QQpWBi9}3AHc%^Sl`?Xl zH_J}@oO1D#5Z9!cK@PN43DugSsX5{E?WB}>Q%?8E8D)xAs8tyA>=7#p^ke&z?7ZnF zryB7M9qHcr<=A?%DxhOQ&MFPcig**fylk1hxGHR-U5=+45bkIe z)5)K2U<3WmBS|fKqEmmF@_Vo{{Xva;M}-2Zh5U7Z)4k5E>mRE7YUdduTaUY->gRp~ zRYz9Aca*i8dp&-pum2xQady-rkXj-l9L!yqozHoDSG18^|IsKC+E(Z+;jHuwM%i#O z+Mk6XYO`oY6Bs{#{6*^1j7^V8LT)qmT+GC?ubQyLX8tqn=k{>CIlep18x)tZzJ3)X zs;rL&(wE;eb-s@}`wgDSQ)9AZtNO|tIq$8>@#z+B2IRXLU+%GF{hhZNgVnsOJaCoET12dZMhA= z__WDi^5Wo=a^Q!O?#nr}1Hk^BCAaew~J?i@+}Gr`T?Yz5?<%!kWd5=e=_3}QFM8%xJZ4G6=bWqkDPP)CiM)`@8dxzB)=Y=1J; z^({@HUNLEMYg;^;^%?7NzGO_u2<^X1ZU(Pz;oWw=F<)TP2kr`4j!^w-DD*x17Zi-t z{-Mcxg@8SUo||)_e>IK66**o5^CFpytaiMB!5}!QZE46OvW_I+~_7d3e#_q8p z2%hu*hk(`{Rd3MY#e!AAf1bMW-AJ%~Yf)P;_riJNwC254Cte-S9~IzhMmu0_?Y_y1 z?ASjsCh&BTmeX22wuT8`6jTs`@cys`+7n^I;|4y)`A30+;7*rM++h&<_Z*w~cF(by zl)_o_F1z|YHD*ahFi9u#hA+;a0g0dCUp1WHF{-?=HI7fr|EV4S@Cr{I2I7MlXKd6$ zfKPgTIQbcUJ`r-f^b0AwJjn=7(RkMn#03f56@n#F@v;xAD79|L3p+Za35)%@#o7JQ zf7F5B{8jH~|8ohA{E=*L-%iGarSL0m%>vy)HL6UINX0SGraOA;Otc`Eyki5%Nj{QK z^tK^$mMd?~J6aU^@zZg_2h*0r?A&67jQ=YY)E{18$T`ZuSKjE+U)wwzm!m>3ji~d$M_hQ ztjY0!z!#W`hv|WJOAsJ9R^zfi=5?aCSW$LC`(nhfPySW4QU!I~tZH+#<<844E}4o$ zHlX>~TAxx}q3#tl^U<0z04K}?fMsxh5?U9_3-mJVAgjKUP^|w_42f$)W<6GFnVL$9 z@s!CV=S(1|b{X%GT|(jo5iN7QFbNS`Bk@xZnDNp7LPK(McNl6_vloLf$aq;x&fYGt z1p__0W*S$i#DilD5|a3+1Cz*VNnLO_{kIqRyvn%9FIyCxS6jJedi`35TN7}&2E@+X zva_41r{`0geRi=P39Z~7A8E#e=1Jjh@zEZB8uAGNR~bdT&Z}{DL2;Ew%{?Aa)&Pux zpK@Aa$LMvsN+w{v5&L)3z@B6topa$(7_`C?N8^mouSR^_*UCqgZb&ge>}u;F=XOB% zY%)4Ho*}{T&qGrWN6*_eOAI+RaKA0az3c&dGI@|2{;aP2UyX9ol{@2e>((u&1xjyWuW=$j6&Kj6p5+laZ#p$CS#8t)YG=ujfMp#%g3 z9k|HV`50>QJ>;YgD6|h)W#IqL@!k=uziD9rnzs8R;zNP|;u^BRads zKv}Eif2{iD7^nosLz@!)9oJ1qH4F-C_#~}dOGPNgEmNS>;e9>i8jT?$mP{twtkqbK zH`vtnxM6Wb(qqoU6LvNX31pO`Pk#8?Pnlo2`>FCU{X!cf90w?{Lo)H3RKAN=Ka%D+ZG{JkY)llO2*f9 zA&>N$=?Dvm;QpFQx>4dY=;#;|(x*CBArrkLQZU3F8bqurjPa2h7&_{=uTt7R<{DlB zr8IZbwNbaTwlsogNZTvqAfufSB1Nqapf*QBN37xGtV}wW0H5OWu9@0Pz=> zx?bbtW8>RVJx^_IkxdAovI!%s!mEO!2ycU8FMj@2P%Am3b`WbA+JzA;h@~4>*s&mI+M9@l4_usLBl02BDz0`Kfa3EhR>RX|8<;%CBol%}tA&@;O zbk78SEvc!H7=niCD-CVDpv$6^f8wf<3i?J~f|#YAVY_9ePk+ItVF>$J>Nc+PyR#YCEZa6w{+3l#J>R$cdK(BXWg{o5xg!fn+ z{EQZQdu4CjDv>_qn0^D_`ZP-r#~&qCpj$H9U&GEu(OO;W0FZw~RKI}=?ZH;{V7&sC zkX_X{AgjXCeajr?vROv^OQ0%_3yvAEso_6$YI|geJ97pU#ePo}I=_BDAg=AhWJ53Q zr+(`#2iVT=LU~sK)-be4fAle-2kLfPeR~nDO2}J;7y3Hs)9BbpYRVv z9doz*ODU*vO1UP_9$heY#m$aNmK4ge!d*VH^5e8aM$0xHnOR|W>*3L4wA~!J;;kqY zZ2w)Ar`{`OR|`mETq9q#kzCa)*#gJ&W|&!E#4$m+qyk3yMrtA-L$|wx*WbuFRemAo z%u$k#!^tnJPPISTWaBYQPH~yP*}G(t_EaF12)~K%l6i#&E+wWMcYIr1$y3{F6K{g- zwJ+J*IkYZLn)VNSVrNTLdcYeyYGD9r3V+?#` za66Ocv^jla28}d<(Z%A>SjrB@5=2fzSzxV zFm0KvchvtIs5bo-kLVpqt2gX};)vBby#yyBra$%^V^_W}CyXf{A3U3qs7HVnBis4L zdN}oOQzmQysXwr{ZC|}28|V@)Bf~$l=C(#B#K~@rPS{c3+sv|dkC8w2G9!*UAQYGo zcI4pSnmXGNJ0n)ydu;gsAvNMCI6Acrp|^*SK+yk(l?`0A`ZL)Sd`4gZslugoa+rJ;R`;44R^=otV@-Zd8}{nshY3W6}}DIXaRB zydS24?b3Ab%)*_ z#`GxFwJOq(Lg*VlEwwA)kfky8UU48h6S7Cwhk|CmT^}H!?AKrXVoCl@)C!fL0nHzg zanABS(MZPiz@!Jdb2SMqZz8f9c)jN}wZ4o;?On3%PqwS`7nB47D~ zG*^wb?%IgXOgYQ}5CZ=yliCrDwqsd0=YXdjoITs2e_3HLG@X=`-XslrGM5*IT6fP6 zDP|-tkP@@jL4OVlOfqCKrC}7wYZRCi?tpeMW`a~t0kvziF-wU7f+hRcnboh9jod~c zqYx@P9ENx$twu-hbR54|O_8TbU58YH_!A!1GPnQXu!MjjUDw#2iO-{KHyB?Zy1+CM z|L_#IH-6>>8d`?qA)dd|B4lDth5R!uKH)&Y?9GhI{w%EFr02#jNL(=E`21tMbD z7xDJ@1&LF5L8fnsz?hLDLac=m-mWZ#z@*Y^ja28T(-!h0j-X4usjh6iHy6!OMEK~V z#;W4%RNWRqY7|-7H8iz3}nl#+vUVneX`dMQS#-c6ijL${D+wCDuM})WpzJL5m44Rb;X; zVr;uT{P;7y6?V}{0L$Waz5UlAP`+J__`CWXzIlUCSdv#*7v(b(-$og9C<4$(Nd~6_ zr)X>HEA^ZQlBWXwI=n$unpa*SYw}o0#@Rehx45E!^u#h}UNpnv1o6hJ$_xh+ptNKI zDtp7&DF#bh3v$TAh|Ax# zV+N`q1B=h;4MoWL>q>|zBm^Gs=1>m581OVnRE??W9N^AAr4lI&NWvHEckfsFfM$;C zNko8^aVLUwSSHw#j^$+2^{fM5{%m@D0;{oM`!~e02P@qlY8*z|o9=#xq#{d)2ff@k zw4Q`StaWG5Z+yLfUwie0VQ<1Ctlc`kT#7t?YW{89Y@Ge8^!A9NOA?YI*x#Vx|3A2` zTM1Uxc?|aufN837z{6W5H+|+sePnM*-nK|uX97&&URS$LnBsZ9pr^m|o>u%Skx>h` zn0ZqSYNs+7Kxa#6|c zoY8p9-HPf-k<$yjbtXYXnGIUeXL`?p{H(n_R<+bR1<> zhW>eM_A00V8K{H)o~SjNxFza)WAx_PcTwLaA%*x}m&`%RJl4BJBI#is@M?+ByBO%L z&1s<&^b+m_9I<3(ZN!?EeC!0^ALoB3> zh^(RAMMXvavv~6D+{Lj1U|sU6Oq+wg;Cf}~N_E$Sy}j9n{@K1;pC>1+e+7}<#zi^R zskX_R9XY%Ga=jS=#s?~O{i~QgPb?GSk8W_BTcpvDSI{cOZjzC&8%&ee^QQHmO1BkW zIq{*(6Uu&Jk^=g0RHakOYy{I|03VK*StwN{GlvW5Ke5nZpcT=4;dHDmcNZXFfFbq< z$)lx{Vv1U=LgWUN1%hxfYb-0MY}JA(s>)GWAZ*OnEEC8}DolE}*gO~HoO^%0zTZYv zB%t--!}up8vlC{NQR;Xnp0Pd~ee*7^DgQx7W@epnRr#vGHi(Ud6u1ePOec>vWykpCSQ=QSiPUK1o%ov79x&@Sxy=;v>&J&!KvYz#K*O zr7p%Y-NQM;9m+NJ3n9r1XPz&6^J>fAqtY8XUQ!`%*~x7YH(sc}dr{Xm86P0TQf`I@ z8!x?s%g-P)u~A-Tf$e>(#hpBHl{vfYpcl{mJ^^vf=39dK&d)5HJsVmF0u`=N>fTSLnSP$@ z=W+6W(6unkpL>ca|4O($vSf?74gOMo^cMTC9k zIo;0ZFE6RXBn8L(3ejh;l8gU(rD7A}iP7k34J-w+2}`ZXek;bixM-divhu*VTwQiH zFDVAJFt4EF^PRvQF+V(7gt%ahKPucKq~P2a%86$n(BqlY7>wz)qNHd~7!&9>5H@_V z_2tQ2((W5Pg?hQZ;|z=lo@#ct2b3N*_Yaqy71b)BlUH!IPP97yTz-KwZ>r_$buG&65>AX?nIvX6 zmdBHz+qgHL;#qIS$?_DUiSp9IJfy27(Ckf-uQXLu5(y@LCgC~T8JHM1Q^5RL$X8M? zK2(g5RO6GUtg_DfX_APfBBc6AggI-5NxD!z%b9&?yC+d4C-abw=icmw#q@x47NV4A zef{*hfskW)-Hhq6LR41*X;*^BuY6Dx(pXL&hbZfXyPUQSf(ME#E4ZWi9fgj)VoFzF z=0Q_9C2Z&Fg6mtWZs9$BqqUE@=!Q`fdUaec>8lBEqeqUHZ?{#)aRn)jyzBOiUXg0A zzBd1otdvG*&1L1_+4pJ)%48?WLFl11L>WXUVsdT5)lPuimlQ&YrE@IFjkC<;W{nEw zBx%2u*HgtMW%bGjugaSG2JXkA5IBa1-7RtwaYu8`YDJthDZZ$6Hz}E=!}p>q>+_nP zB{VMCYEqPinTsJh_&E`!Sx@YI9+A;%YpwQv^evjpoU}?n5MRn?W^is@Sy*_d`u4Hj zr3g+nrqeC$?U?UHvxM$m(VP0}5tA{3;RYHh$x%rsi=%xWlf?-*78Z|s9)t-}u-Y#V z+U0dSJfVx`OgE3YNGJQM>6i#-zVKO*{FOwJEH1CtMkp~v>S_AuoilYp0ZFp&rZ?Ud zwOn4}f8bi9j>&EQIzc-pNoT66;A)Xpq;}VW|6?^f-8)|6GGGDnq2=lG7EZQ{lJ$4* zk6;{F7GiU|m9%j>LTKT&1Ng^ahzAz=+3TxI@1F_eP2O`=>9~|##wsB)myVZxNcW!a z;}3YI_q=!xG+hwVhGRp(|0DN=iQ$IFj#Q#pzRiqGqR#b@;G7RK#)pP5@uldBf)CJ? zNRulQjf}0R$cE2FSL~817>PLOwN(nFkrmVIv3YfZRq)hQS^jiIv`o46{X2{yCy6Ou zvDXA@$tf;7FWo@Vrl{c+b^H^B@&{`4XdjAcBbqa+`MxX~7zoUF{5}QWVR#4e zb*0w=h^gVbsH$dHUuUDFO6)oX(WWEfAJuNcpbwWxt!g)ar*g6YRa?8ye!f2MCz1lMdGC;Je!m8S$}fKNU~ODWFi z5a!Ec!d_?59DSbYcLTIf1J0p7Oa;MLdgoTGxSjB%IMCA4<@!SKz#9~fYGQ)#g-9HB zY7fE@MTt4Q)O|;VcIHdOtIU64Jw6J*)!v|8$F6iv}B!)^YqIB*G zY=ug}>v5Oc?s?y>Lkl4jDZ{>j-7z+NfDePe(~cwfxmCN#W|U)-h`*Kv#!b-t&t9-OMC5jw9_yo=fxGS zh1E4bN}^2d^eWelt!;-8aTU{Wiwk`bfrwkf8m_q%J|ocKUC`))PTG-W&HK|lx_8JT zI1o?onbT8yxt7nRr8nKmgKo|Rk6Fz$PO#7g74m;IwdvLWnmOTEbY=Q+b5xk4<5Mu( zJ(k1STI)TJozf!4BXfDawd#$)LDrO|=cOxV<;Q5#b{$)VMVf*l=b6=`W`X9lIxd~m z9Z3u?)o=_T6OP_=X;)jHu4lr`{cI=WETCbG0#V6_B4IDbF-joCvV7 z|CDI0XZ$|%w#+j!t;ZIl1J%A6{a(t218n2Xq9ZANrSYb4vfXbu)iE4*oK8{*F^TDw zJ}#j-U7KK8ZJ&1Ch@3bZQFR{6`>Dp>2dAPsRe&zA;7FRDcAGBw*% zLrJlh*HTq6i5K78d;YwUd7XUZ{N6V%Z7OJ7QRgZn?XlWA89_9=6BINE$ze&pK#kLsp^-VUHJkz{nwS={ z8G1MfJRM)BGSb*fO_j@ur_RT%uKP%_7#=(4mw1j<@70%OmB5mhrWT}6^=2H~x;tw& z`t9zAj^JRd!PJfjj~)#&Cc-f}jQbQvxj#+!%i)Gs*apd+E{mk{LNdl~pCYk4{6z}2 z5Afe@dtz{wcGeA@fmYd~?{=lh=gsSu>c-@K@Y0)NZ1Mzg21sWR1(`Z!x|0hxxx1GO z$x=qnN+@YUaTDB8U%fSl=V+oS)7`EZ)yuKxtY2271X&G*;wxOY`G^(%bW_Z6~SLHZo}#;?pFB6|LY4x3wa%_U5^ zL;-b;*(#S1N-UzMtDnkxuRa?LJx?-n$o1#XY5o9|n~UrH^oCCCymp`3!F6a2bcNxy zRnGOf#Z|W>NAw9FYCc)WJy?!owEJ!cW95UoZD{}}cON~OdO(u%8x~Z4{-@rU@n@V? zZ)zvPPhtP`+)m$2T{FE@{5ZsF*slS1M_^12pqj@=24y(5`N?n`jH zApHI&TI-cCH@3FQe8r3_nOBdR^f_Eou=>vf0;1&CU~o`R!Sv%>)30xgMlY+=^Ob!x zsDG5ngE{(Y_McUOs4+xUYdLrL-o2&rprK1iLF@Q+FGiNE3^tTCmc{k)NnOGZt1?H7 z4U{BCId)u9e)jp*0C|vLNlD%u4;MD7)z#&Hg6%sT=ZGtOd>%1T<4d34npTjuRGz=V zOeH7meWg=qV3@Z11$6O7bhiY_+zuuAjM0M9X0jUm#=%G*+a?h)Zpl`6BFi!dVCUNCB|c9m~N(@SIn0)`xb4~GMq*zr!M@B|m$ zDpI(eqMftNjPMep8bfP3pG0}%oyWV3uy*-FH^@e~U}F^#J%*Q;)T)zKUzu>k7Ijii ze!Atzb=OSL-n8=(eKB{eKE*}Bv*YeRTvw(S8J^^8Z(Dca z!#HK70OaOGeWJ7fIY;G^D9k#WTM zMr#Y7))N@D*HY;j!L!RVm?zp7JHj5u@N{_JTq!x3@>s~ZJvdRpuN#*O`UH9Aw^8-+oy)l1+|M2C>=MoO6R+}S;oRt zF%sH?5og)+SKh^^7gYO4z3M8U4|6oVFwl@a_RqSrqWY|-Us^Q46VW2z#NUCaHC1$`M5jaY?MT7 zlmlKrk{3ByU+}@yK&v1t#EMM5yrpFo5`R$e#7#2N*je#Af=Wpi-X?r_?bsP91@`ak zi4rAwEo&i{1(wUwM_&|P(f)Yqwwd-q+4SNR|E*=K+((aWreEvd7=P5tv_@~y^lYT- zqi=@uQu$+2@#E!}RV|vH2nn0B{IkS|B($DTzR5M;XggW0t`M7aMey=bZxc(trQZ6a zgRIijX5QvD?a{AUkHn&nR^pl-cEqgqa!<}AM)AR?VxLL{X@8a5y;B@Kc|mmuA#ba$s9DJ7Dkv~)KTQqmyJyMQN@$0xqO zga5(n<&oERt-0r#bB!_Y`!mM=wqE5-94}xt38sj0)pXyd;3ZZGs>lyZrwp8{-len= zY7W7YI-fl`&4DNSIxM!=^jzGmCxp-S;$?(XdSbmb{0e_s>NVe9A7Tu(VnvL!+Uel% z=MMf!Zr3lk!tI2<-47nTITD!Kt>9@cln8YE#EJ|4d1G273W@T~e04c*{K*PQa{f;Ny}ZudH5Ib zalR6E{K3>N*~~(@c8^*miP}maezC9BDO_?%kF3OjKDsQn`SW;tW18AuU{1w_%;KTC z=Z@Tk1ZE_Cz}v>*<(z4mxA3XGKz&0ezlaNuRFl3jyqH=`<1YWIi2!h_Yi1)ep-uuS;jbYDS#icCpANAUdFGUIa)&gCBp7*)eLlR$3sQq~q0Y3;< z$fbdQ&}wTZL;@#kh1|RNtX{8mE7NWS&fUinrzX+#70I@>T1QI*>*USeI>(SE87y>2 zx|cMuB<4!67(bqwpQ+GLdIf}dVHo18Lf>8P!&OT{MSiWUSeG&>Tq&Hg-X_?tJ8N0VTZLl7nq zjxqccV1tFZWyIxNaZVznAYgmDnGy7z*C`q@{O@<98e*XBau@}JF+G@R-+6#Z-^~@s zNa+}e*~EvTPc!NDTWW~=LWU#_!|K<-%IvxIB$93~$c(FLipDvwKu6g`>#5oLfHZsn zU%N!7dVN}B;`RCUADDa42~ou?4FRGlY6Rus_LpvR*_tF3rI;O&&kgBMxelKX6%}#J zY6q<&{xXysmHv$|F?Iv)m;b?|)O4bTw_ZoEam2@D*u2(s)5077Z$1eGND^+FF9%!w zE-tsL1jv32y?~~$bPw!F2K=2+q=Dp`rjd=nm}?B)WEF}2={O5!_VjcCURDfgAz+>8fbJI*z5qv=J;B)5AMt1$@krCE1~ zdgC>&LPd|pBLKnT<>A82ud^7+Xl02$W5pNc+aDOv=AtgIpu+I{>I#gID*d*bY>a4b z9&b`1P$rXD4fN{j>Iyc}+{Ab6m1PTEU%W)0YL~4|6g5*cSJUEWC~J+Rry=#VDR5!3 zw?7@DRy2R-FE=G4YR-9rCZ(&O5P@udpDfb#n;b%}Kr6*4-9?`1W^0>2L%W-_#|eA8oZ-u)OBDGQ-bBA2wa zXr{K+fa~$KbOh*Ftbg3AfO5M?GSZdjAna85nau>7uG4Il-74XW*ITAoPEosAgJB9N zXN2|2S|790f-WBdRqNB^tA~&*ENULQZ1ou5on+FraRP?5RdmbQrj#Bs_bGpO!Mh2k z*Lho5yww3_tj1^V4mu=vV+lq$R>~~di!w2;tH~GDY}-d<#q)ewjO!!p?)(uxQwupb z6;rr|ZD_mB)5|p4Yd_;zv#e?2V~5$a*F00|Lnk{v0mfv~U$Z2&T_zv#ISkGqp}ow5 z2&U!AV=@vM2K@jJe%IorEIK6iU1%d__!4$&G?$K~Uxgbam-HoD+R1k6c!=Fc@TWO&Jr)j`E8VV%(~2Pd+mGMslF0IM_el z^Qc)ivkTOWz}tJM!GIYnM|qy6^hv2KFGThpcp`46xwH##eo|1{>RhRe>^V;U z=pI@j6$Gw5ND0-^D0mWlGd7S!EGISM)Vlb8OcK5{gwi_T6wn3&yUm`hO!9KK5xrYG zz1(g3TyXa2lc&Wh{Vc`HZjl6^?Rch@i~mk` zCF*O#YO~#T@+Pf`vUgngtJ8Tb*$=CY%cp4yYW&rO6EY)mtjVOpJBDO)C#4uAgT8Y)BCdkq)UHr<*%!1JS8;6z=q*VejS6wAT$}m$AlG%*Dmd zJq20a;e&aaTA>HgpV3Rz=6^f)up~5Opj(QyO1e&NI-UR~i7s-6EZW-gEC&Ufx}N{Z zBgxSZ!C$_j2gdHXxGL$bmyL}>i}0MMci7le90rqabiNK(DI3#$18kMTG||f~4sCn7 ze7VIhw~8W5VQT$N_+rjr89&~1)CV2~7@MVr4Ys#<%P^PNQ5rnt`73e#+(72Git;*Yu1M6ixWzZ9%#_boRLX7# z=<%YY3wIU^rh9Zg05g~Okf1OMm&(vEz-C(!-P_1|^Z+SJoq;0qo1DC*&9E)8U{}Jt z3tpTg4*2YUa49Yp?#_Ja#?`{bsCfZ-lzPe*wkjI2KP+Nyf8_A&u056>7pKdSsZ|>a zJk<4p&hGa69fP977n1jl9!|0rJUr`88zk^5+x~!wRuFm-*_h-QRxcx)2oTKA)poey z^laeIpD2E>+T{*)vtT&5^B2A3B(G5WY{)oC^*8h4GVt7u(Yy>i6lU;V30!BSYrE&= z3=ekekCxBXr-BeQA zv{U1qE9xDgvP(f*TdX+~%)_JL+nMqn7PPdq=E-h?YT%GRk`B&1=edG+JS1+`&!2s@ zFeZCQR}fxexbP`xD--xRL?fJIGlPwSr(M*$2nY5AO6#%tc#TqeV&|TzbK@dRerH?t zorm1J8`P_E$*zH^XOkais@(!!>OiPsyb22o%|0X2J}dl8Z}#r(fsXtrE9? zIK4Rle!^(wDntdOK>5QY&Mro)y`b!|t0ogBnllt@UZ(=g^2OHHQ z%avZFqx?3|7ESC5++e55I^7t8?%O3Q5&^*e%B2pP{g@S%RT+m=84cuQ8GOkc0`K%9 zVIPGNZc3OYjI=dcl*|f;nD9iTLPMv-s!3$E)9b@U_{WYM?BiY8&2?@`=1L>P@Mh`I z0Tc2~tUEAegtKJ(gRp{KP34=z5C0*NSe>3B`RB=b`qur`1Q`dks9h(aRi#lp%q?A> zT~>w7b9wU2_oxl zfIMd@wzI)?PY;CDDM&I#tS+ZUJT@Hm>J4>yZ%BnJ41ulXUR;2Z)b@DRTXM$rUj?(08Ob4louVuTP610))_Z-I@___0485 zoPPGgL~AA~L|g~XaTEJnr+g#wf3ri%ezHUG9#Izbw4?MVvr=IfDGyB=EKaEHy9%M5 z*sE!-KrE~EL_L}K6`qbI%sB|UIs_!QRWo0ZDZlLl0iY89?RLBNeQe!H=6 zcB9JcgIDy=-_+JYdzkUbWrfx4vL^QLds;e86dm(-4%;;nZTT!>OLB3Z_xrqzm?mX5 z68qcmeSR=4tJj!FYg7lUfx}GZ$dU5WRd$w@q0(J!fSc=DHC)_FP z&3MlYqhRY2q;q70EN0*m=~oj-mKq1DA+v>}lds+82dfEbETqgU4HV>N z295XTt4|}ejtL)A1`W2OM5M50>jo<;PZ$_Xsl9L!LOZutQ(4EmIBs9(1o&1ElqK|l zbL=K{kbG=L6i#JaTxB#6sGInchoX3(fvGyA+hs4VAJOHYm`BK$M|>~`PCJ-Zod(SA zPN-52LJOmOke>FZ4li_Z0YLM{QU%a~A8huE2_Ro+!1+Jt5W*J|`vB zzxLoPmTa=W04T_nE}4kX{4G}9xaM`hu87^(WQbLemls59apu?W2lr`l7e6sxGwvzZ zW<(M9$Erd27sEm~z?Vw=&vBA5&KrGLx`Brp`ifCot5hG!v2`D-aEJ+Wl*1Evm6~ih zoY8dMg>Di6+UPGmiU&V=6yM$t>NsB>X#xHvH185_&@p|KOXDRKp&};-vjL~*{E04a zCf+}N5Zz7=kDEU`Q7IMHh`ay^m11G43&jPs}6vX_4MiR1dvw9|J=SBj0WzjLY!#90k)-%6n z06)N;6e~c8RsCt;czL86YrsxkQ{@aS&U_lmL4W0__!P0Bwp%2zzjcs2Oqe=Q>MS0SRxj{os(aJ|H8sm#0 zf*~de_ak^IrkjHilYO7V#Y>oNOFY0v^N#dB!Q9is-QCez$^jyY`4XTH8fH2VMa>_< z_Plg?E$x@a-s49@kI%REyuaOYJA^1-On&*Hg6Sr=o-t4=*mJ72dm&@3~V7Mw~ohm!j zINF+?=7EI1B!1NP`kVXxO%J3*OyNjaG)-*xxB+2mI{{&5c8_1X1!e#07G%{;(cywG zkNkjhC_Z>;mbY8xw!&9o+GF|o2obV>ngz`K6Ffmb`F@rR!Q_{{E;yr90tpo4W3e-v z5=&wvV_hC|w0Kj)R-)V^0mCb1h^K^tErY!{X^ltvecfT^G8bbw6u{#p1Ue=r%hs4mhYX3r|6|E-+}lv&8u}mL$poFu?9%hDOh;OAb$}sO=o&Cxy`Q z@td!Q$-l)2PJGLMoqUjhKMS^`vNAD@umPB^OydhI348#^INQG2%dRM9c(^TUlS`b7 zs|YClFy(FXRwT#{OAr)f=^psXS;~9*8m(Ba;mh2`u!qk)^I31I* zLQ;r7xjFn;JmYP%$<3|0Cm`YrUyDe!>)b~7%lvmSsWJJ#6Z(U8_`5sFU!c*4%K$8w zV!;J$2D=d^Bs$gLuM@wX-#T5aNJV^l(|NESs_&$LvwQ#pr3c+c~$^{Zlu97Wb zL`!~mmiq9z=9oNT)cc7Va#mWvaNC|BUnT{9cLMRI(-G0Y)L=lF4h+xw#}s16&KpP^ zgw-?u3>-AwX%vFRuy+v)@u(!X7e1u`i7ro39>dp{@gAZb*4tm-XlsYKvYFp8Ff{c0 zVQzoZ$Um{Fp4nYLw5z@aI72|rza$I+{_Rouk9^*fR60Tqi*Clpa!fB~$86OZ2~P-h zn~Bgq$NV`%mpI4C3TV;LuM7 zPaXIwD<#Pu%>OO0|0)mAmE{tD@j`3NZl*J9x>`}}FGSy^A@J+t^>xJJ_h2uqeVh%4 zlExU;BwMzuc7U=V@Z3ll+n&H75{#2i<-mk#aT8&`gKADlnA{% zfv&aga!w#E_QcE@bbS|Q4 zUMPGjjN(=JLczv*vc-2cr;TUON`)XDC$%!E*{bK1Aj#fcL{1==Mbb^l7ov zsIkE|5y0BX*2*c5#r;>UzCMHJ_)n9G=;UvHYN`6rN_N2bJXlIZ)!Gs z28cK4P3kOX(+R};9hUo4v@0WJwb<;1gwt1AdsZ^+qKD8KwbWFG<2#RHrX{c8uVgAS z=5pZ4M-5V;DLUtZ8EdpQU%g!?r#IF7#9*r>`sh&_QEdIZjl>HHsU9x1CL%$N81?(< zZ;j#gF}5(nF1^=@?Nj^cjnM6~V*)=uByqfMj17L&e9G8Y5GLA#TJ~~TVdvS@ov@Qn%5mb(YxtMA`|9(MuQ+Cf~ za$xHCQ*zMEI)=hetez_UnrLP-(qj?xh!zOE`o0y4m z_Tt`)Lrua&JS7h!bmRZL`ILnJcA#AQYR@43!ZyfrhYAnT#ND2H1i8+F3M9I;F?QHK7N*j zr&hf(70&3VvPQ`D-SW$F1vw6IL_NGOUzJ;7o}-3|_?LZ(4D3_*Qa+~J)yx!(p01M< zz;GjjOtC#EoqeTLLxg(Lmg7nu4-L%BLwwaVTj_xXL4Vvn!R61H9+ZtD!3bigTp zt(_A6?p0fjK7!;@UmwAV*^3ep3?sYf8=O>2mNHH+Gl=d?t5vVp^~JYne{bi^I2rW2UTFogFzEPJ?8!yn)gRI=%$&&LQpvcweas~OTd=a~ zq|E^T`fJ?s29TDanS!!QgyHnvM+mVtDO>}|$l%5Bfs>68bWaNwWwam0+fl8YDky)| zdQDU%%@Y*@e)O_1RU4f>ONK~5Ta+PaaS2z*Y#2g5s1!t|^U3lMvW&=w7TRn8digLRt}DVU;CN;=5@sHd8fQZ`Sue3y{>pW7?jB&4`&!;&A#LPv4e_ z^;f=NBB-=AO>|xtd|MLW_Nd<3r#z0u#LL@dRY%bJij_ex6dFdQF`0`UQW? zx2fHua#_3}SoK;CDmN+wBvlhtd6b6!bU!n%zax#;ILqHNo?m^uIEUyC4-exv9?Qi( z3(Y*pL%O1HRX|U1=sWn6S-em#bVa#<-%_5c{o2a1Qz>O{Ki(EBbHx>`0kRR`5&TJ3 z{x0w@b@V9eut-MJy<2FD__36|c$Ylxs2S`dB8Rs2rMn?U4lm52Zfdnt!Qx?!19E*rqr^m}iIb$!kIuQ`~H7Rh` zd?)KWCHCkl@8Bs0@(!(J)KlZ;DCy;!OL*Q*uFI14;v1Q@Hjvy7IHt^Ot#?}04Eh-_ z9Piv%7{-8qtOWb31Y`Z-KPMO;wJ7QPt}UR*Zn-eR>UX;JHv*c5K)i)!?NVAnf#~Wq zv3IU=445scZHY)wLTSQBhNZ8yJ+fw}FcUpichV3XLxWrr>h208#Ps+qsdG+{XyZn2 zVjh*e8iO%QB^1;WWibM$retBp{sJs;p8X)o7Mi`&msM0}emAAYc+=ZgWH2mkP;7&) zfLN=htgw(Ru5+IQtK}DC?u*XUhKLXOX<&7tsZy{Du;vlsqRJDVP9W4M%Zi8Mr&pK{ zfVKRMOkC=5BPkcCii&_NZC3Lt84({}( zhU`5c7CUb{NVa8|b=Qq)?vK>1I81*Vbz0kA(AU=9n5u1A?9@(DIg*}=bZN>T$Cf?c z+_5)`%*b$q4@=yI%%sBQSXeI-$>vcDE&tkF^8)m6_ zYqkjuCV)fKYn+rnY35MKldautTtLG4_B2A-ZO?XRTedPd<=|83w(l$p21Y(#C`awL z;1ZLY8CtK4LOzcIn1NaEwWTn_eG!YdS*xev44X25N|d~gN-P^ZHXwBXzm{HFe-((8 zDjkMtCe_mo(-ZQbEa_fs2vTBncXM%5lWZNum$5)H+nY~7!r}jkC`kViJG>wYjC_=} zS|ghOtj>ZR1`f<5p;1<`BzVN`u9KCGRmEl>Ld~BLHT#=lUM2{0qJJg`^kJiY-O)%X zm=YrmSk9;?nR+abKSU5`fLVfc79~PGa8lX#u$^hipgmE4UtKYp5<7K2GkqB#_WV$t ztoj!h_20N{493zLdHia0Q$4Jck*R12UmgdLY|Azlhk z;{GD=BTW5!z2uW3y4u>w_uq*e49=pFFf4dRdjSOTr;mQLW%s;cq&P!(#1XAT23EPK z=ZJ2%UZ3dh;4>mp`lnKgRz%16VktellLMV&B+vj{kkwPw`L?n1QlOG z+elym6{Y~MXb}5mbwInbUJD9yP%SQ(JUUkzs~PqMi-;E;ZzkoEnJSUlb7u?)f|$*H}4&AZ&qlbHnF z?jf*eLNM(?aK7B;K zZZZw{3;kO#TASfajd?EN?qH7A(ag5@tNl`m{Q9G6hr=B87TJ?0;toxlaejVEq^${4 zFIq;}Udk5@3@0qWdHjULFQ@?uJwDl_1#Fq_a*u4$DmVq&qZ_{4X;{nx83Dtw78CVk zi~F-vEj@#|Fb)dccISaM>T@GPHWxBCrs{tvjQo)V@R0av(Yt#9t{X<{_a#201{~Pk zRfN_MESoACcS>i3&RJBDnTQ#xJjqz3unXiv4p);95CB_k^2pFq=yz@s;ocK@b)jpA zQ63KU*?x~2dT?g^6%x=LlHjC2u;vB%x+eP{Y69?LuY3S4Ke|Z00#XQ=2~93R3g>HD zC~mq(C_OH;B$PU18msha=dLkmLy~NsvJAHz)~8jNyf8qFC8D3^yAFM7h2`Wmy1y*L zR99^4IU=<4h_616*-q^nP>G3Jw{aLx@O(O{PzYzSr`Bbac zFCGbv>Ob}w;Bph=#Qte*wpZnfW13!+SNOJtJ3DMWtE8Ul%FpX?NH@^wEloV(S{)uv z*ers6_xfq&{1=h`r~CYVxc!;g2LkHV$U-O0Gsy6pCV$KsbXG-F;0ix*;JF}kQg?FyRDJ6fe`G4%A#Rur3ku2SsODc4~ z9pLFM=zH;T0Sn0EQ0NV#rF*`6j93V_c7K!w04LsG+_ab#P|6TGgVxoU;u10IF`8%yQ#YZQoZ)0r#9Jx# zoI_uAz>CdRw5dFb)@2}VbjDd%7Zmr1oh;@ht8%Nd8^kcrglSzAPRmd!hq3!?)BLDr zZssarc+}yB+#isQk=<0XH1N#nrO{yn59W_*uOK?dt^q7!@%4C3+W(JWz_WlWo#C$q z6GFTLO7jQ~1jcitvStTJFWBcb?~e!asruFUAhXWA8o|?rBSg0;P3z_O!WA6EsgEsu zS`&S={0inBQ8EJNlVIdR_d_ibf4@-eZYjcL+z+^5OBwVMZ;nsS4~4|iL&t0shu@aK zy}{`@4)eo6pedMIEVIEWgJ{B~lAkh-0v#GsPnY7hunDP^wd@U7g1<+zX;=Mw_XDc8 zr{Aith(ihnG_%WU7bZc5asG>H7ZC5nF^gyQR~h;H?VBxX+ggX^U&`%2x% z=G{|z2OEq3h!n6Co;$LqJseAq!eur#OuEFT$*omSFR|%OOIaZHjgab4slt}tFyzz_ z&5nSne&08H2Ym!DEsT4DKMj6~FfD=@Nw$GTJ!O}hdMO7!RQ1koN29e$h8Lw40@%a| z{C>3*hL@!{PP#lzLN6npqEI%y;MD~$}AhJIU7BRyo?vPmQGu8i9 z4Ja^=zf=PP@Yu>^F5e26@7|nUz7_5UzyMjqJJ?dVywz8Cd!cswBFUNWVe z!SmeJC}|OLggdXbE9H(r#40-?yfA2kd$Kh$qLQ1~W{H9v>M)2iBy__pOGw1)59^T| zaD|-09)d8iY>X0-(bj~_PVc~w8>FYDq%<}f>SikkXBb5MUwj2$MTvW5+Z0-8-@-2` zaWMv`t2ITkenBd{M`p(+Gc$N}Zt%)nY=i?q0+=F|0UQBglIf`d#0J;%&YDLkw(#b? z>fxiI;Xe0NtheM=1jC|BAP!sAbAbGhKdJ{ax0FT@g*L=mRq z1#Z?N9&(8wXcAQu8S_-YKNkJkHqb6PNcTS?jTVDfNMk@1Tbab=bGY-)^s1)9zA6X6 z3R$J?kmjk0OxjX8HPF>D5#yjeVWFkV=3WZR44~(`Ub^7^U8Q;35%#p%r{*x+cj3Fc zLAbfppx6)+AUpSb<246^_v!Wk!ehc_@T2YBgXtdF+#n;vw>G!7l~y}gx|hY%O%^zf z*VUMcLI`nT6r3~$$mRGt;eTD!CDJ;x$Szpo_(NT9LZQ5$^7u z$E?R=LGbQwMSCSDPYL_U03~kKMcr=znly@48E72U+v9v$OT@BJy82s5#x0;!!21`) zjsH&pi^p1&Z}XyXUl`+sT)s!IS|9zpvtdinOmi_6zqKP;H3gycb9mzoI-p zLDwed`S01*Rl6oK(j}u07nTP6cze`6r9_11OXHmPzaEn(KzsI59Ge$3#_P}NpiH-= z7!d!i_XC!mW>ld3Jx0^s9?<24Up27GG)t{S@)G_))0y(B$obUwjMDUir{t)>y5nMl z<`epVOr(Bms!~kzhqv*p&kQ^6f~$A}@(}>8`Y&~q80!plr^T<4LcXrKymVSq>Z1TE zs3e66vo0#AuKHxb1_0$#<_$|ge=w#vXF}IU7|>DFMwv!He0{D{{5wE-rD1fvBu5cV zs(B3=NYZeWM^>@0Q-X+N@3L&-VBuxCYQ&p^h+DE{q~xp!_?SB2a>X`f0o3EeFag3s zrA)$TP1c#5UF9lIg8uPEA>?}o`J-<$V*40Ly;j4(Yh-S!z+xn;`K{E8O<)QZzu=wJlx_iG zQ&3507ZOv8F6LH*&M^}Yu2?M%;{=M=Pt*+im#>vWDV{#Q171 zyIp-_v!5haSJWcfOx^x*N<%})1K{0+*}?lhfx%4+OSch!H!;RDD%SVGTDjwFQUDG? zZKL1yanSxLfuJ$=ND_lGKXs!px+OyLawu4WNV3q;piwZoqmeqLGV;OL{#yRz(~xiZ z$=@fFYg-t!W%mE3G?L`KuE1L_D}*Z~!Gu@ccfLBZx}Fx{Y7cX?wk z*R@FV1bY^z_$-ZdJu1P%%r*@=s$_S@)4=GSr&QO8{H<&J3sudJ)izl zbwk3Difx7Ag6Qwnnpb-r{8Z#maYMT&M1F8#9L${6WkVPZ0GwWo)wiyBakKr)dBVKf{x1gZ2DGy-fi11`<$<5s?@&Gh1Hew z9kV#c&@SFY`)V_B(GFt0I;mR>c?ILIZ-4Y4SL#Cswup-G`^zBk!xkY4E$EfTAX5Pd zm&!&aU4n9E5Q?Z-1A>2P2{YW|56>Eix&(Tl1I?HVY0_K+92Bjt%g-S9?GTrV&!#*v zgg0q?iAb>2;aO?uZQ&CAg#EBOr6@p@!9YyR%K>IkA7`E&oyd@3gF&2__kkKLgIiBoq!BAKurrJE<1DqOi1 zrXBeE&{+ku8*kNiXic8ym=iqSm6v%kb%cgSbyBO6k(W6OoZmftE5t9V_^!J22svQk zAgKhVB7-3R(E90mE5?f=$KN{?+E74yoc})jZ`-q9ITOByhCV;cLL}C$-+C=^pY0W$ ZBSPUshBgVr*kFJ^5~4C9g+e->{~tUlwS52p literal 16920 zcmZ8}2|SeF_y5>;vZsXXYlg8TYh))`Bil?E*<(uChf-O}&WwG}mTgF~Q`sI%maI`| z$dWQ5`~MkzKHuNx^?#yy?mg$;d(Qiwd+xc*h`MoImx1;iEd&B#(AT?W27!K98HR9@1Ef?j_ubA1SA z-Y#d^d)cW`$#UQdeC7(WQTa}*ip>WVw=PxtZZ(%NHIF`ZuXzpdF=*3p?b7fbxq5d- z)4NmC`<>R!H(ECJS`HmrzLVEH$FBMIYoo?=tl#MB>grj&*7N+RZ!x5Qf84--*vK-` z2+?`nq21Je*dl!1^7bpM+by>u@U{+5ZJi43;Lq%D$J#sBI)aaLjH7!E+&LbBOhMfJ zinzPvbSK^EPL{J%ni}iWut##rw(MRCTpkW$|H*T~NLPja5d?-t)9c8Mer2fseq{RN*lF)- z;zklTFRzHdr^pD9)tf0QG4d&`$ZP80T&4;u`=Bh<0!Yt*XH7I0l(^N z9D%%#3ZQgT^jA0Hmewb8o~SXUlm4!l5QA!E9)x!U%zI)ke0i39?lD%cp*$!8W;k!F zwNFBG)@(SmaA9?jURx0Q>C>eygIoVk{{Dw66m?gs()3JEZ%td0{tE%xeKBP^6-q^+M5F?-R1!aGLetsUaR)- z+z+a22Z&EU&&LQ*X|%gvW@z6OU_lGlB6^v0HF}{u7gzWx&q4GI`AeVW-rI&>%-ATx zes+UOP-yJYcj!TO$@pj>Jv38U1AIWJfb4J~yZ~l+6@8JK zOBG-z5!$3@Z7o4@68_{7e`4q3sZ780i*O;xdRN7v?=6uNeUdx>_h5nvwJZ zpLagq##XvINw*) zG$T+$mi)W1GNCZM>&0@t0Du+}I{L1k1UsKtt(AYoiM}ED^;yqVIVBuwcy9j?@tkWq z<4jZiS?aj(aDJ+*jC^#Lmr))}D3v5PY8;z0$;jQpubquX&DJzHu6xL@ z(!=#bBqTRf2KdbQs5HFUkWU|8hUx%5V;3(lF4KPMz6SBNeV!gf#q{f~-S2iIGb#)T zANK`OpYQ?G8ZI_f|8&F=-_bLKd?varxUjw=7fG=5@!4pj~7ZYiMOZwOQ<{gZCDl3 z(|xSq)lMZZ{W3Uu-2k2~MtbuRS9?G$E^rY#-#8k2l(QMK?HjlMbF-5BXF~c*@wha5 zdOVgNdI4Y;$G?4J13fwDpFh+++~3U!`@YCa2oI{_{#lbQBJQZ^FNSfAZhs7Qwfu8? znc<2=0$I-+(i<`br2cblF$3+v^9PQQwfo{Bw zTxx;3%5w&&udO`}AU4v`oVc122}fGkk%=l%-SGX+dxaL7M#1UAiTCT4H^>z~gbg-P z7?f4Efz7ymxKegAH9|?cv7|BLWqpKn0j-p=$<)EklAO}< z57X7(eZRY!$6p&2^*(_+v<3=ws32nTC2~`YK>y7uK@4Y7H!WtvB8<-A;N&&ZOC>%|a;5<~Q`;E$h1#^*RyDAEAB_?PH?hau7 zk4JmKQ)4Ao+pUw!Jpy@JL7fH&hoLn$7N7;1BavYM-L3oGoGsiD%!br?pGnpjCiSke zMAm1T0>$yXsgE{y@Cc@@oJ%clrF?RwjI;+AShX*%btutmu+*yXnzDM)elKiiP_*0E z?rA>fu>TtlZ;keY1G8!!uW+3z&$ET$p%4_ZtWZpTG+C%du(s%BuytGEk%^(fZ=@zp zU~)QEVKHolE3tmCU|`EoSi){rII<*pWd4c-aN7LS6fQ`vq^6i;ss1?aYw2fHm>@H8 z*G=g!C(_Vyr~T-+Aq_@zAKtW;$v9jkgRqs2f0_X336g>7=)Fq-`$1ZR#Rco3qjA-H zTlKOHRRLuV*qDiNt$l+n2WyE1#su-BrnK^vWC^2W zi~eM2=;OxwaO51WI1TLVwQU+?0 z2UbCbPs{YA1VuPx0+>yovFj(rRRUr4(K;E-P%3}~)y_@)fORRbL&IbNL`I-{5jWI? zj<7sg%;Nv8t942EV{-A0Epk9zZMl28xRqgn0+8rBoO&&mvnW}JBoQ~y>FzUm8z#jW^6x9W{Q z7O%tdtNGzP)5zcoFIx1KX7@3L<0-@kMpW_8TF_8}>ZQq(!jXCR&W4phQoQmS&da?A3^+L&Pt z+t}62&@-{rUAFrDy@ z2qmEhK}YY^dfZcYmr2QW)f0D?(*CI1btvjClaT9r<1{JKbqIBriOY4hI8A~bJ@jmY z2KEl?zTE#z=T``OZ^nSObmP8>j+72;92o&;8WSFo zt#5YGLo8a27VlcXK}MmPRH*sMjO}x{QaR~+-N&y7JaM%}g$8|dI)$X@3h3ll_&BXX zLfq@m-9^1Z!QIv(K%^mfV5PeRnN3Cm__k1nAGkX7wCLGI= zp^J8WIUSBf@;M49R2R*OT{Z|0y`80+$WzPXSn%I`H6}cm?4nTZI%QKkgXg;R5P<1= zid$7YGuC!F?&&)nvxG#bG+PEOXly|qd6O34K%Td!dtXe7{{_teCtVvf0I!k!Edl-aZg&^4& zqVmp(g#~T=_vkX_i95t54sT&p72anyTu$!LyXxg8irl+}wRbejb(T$!7j^cdv7ES0 zLup?SdE1#z@x?d4&y%ciGkVv=G`j;}Ews;9DHcV=ZE^l;=xpNXEvWo>DyBHb zmb=gSsm<4dKF1)W_4!%FDU8pLI$9A2&q?`PqM&bbw8kEAzIAdr-lfYmaEC6>^hwV0 z3z8umPKhKqZ{HFDK(%xtC&*J3hvdL)>J0}WJ$wcV5DsEs@irbjZ8FExE1k34slbsN zC3@+JoP<8fOb&ACIQbGuiPk@Cl=%5qiI?vjm7e0MZhea9d^$ISIYQ!aaGA9`shFDyueN~-5a&O}JS*>R18Z03A zdF3->`+E|cwZ>8ql$Go_ejTRNnYm)w_&Tj_Xy#zpugE!+%h|iY&*tE}GN3*AP9^xg z=gNW8KM>Hh8(FZrtNlox7kAb1E47$|U;j;sTr_@H*oKd0{q?M(%d^iu%1<6h`xgxk zw34fs#U``2IILH)Fxg_a&#txe(B9>G0O}*by!F!}A=8-zYbktCT z)O(rR3snIl;_RuZnp1)J!%LW|f2AK_f{ojuQX#6HnP1D)CK+J_j)xmiUIF0}Hk24# zUc>AnlL_qY#A+Z$I_e*V2N(!UR$0Gp&O80vq2*l_Zv}z>b=;>Xjr_j)|5w162DRjM zTieqe+jn?#&CCMtxczrVH6bTxMr21O3Ky_x^D_MNzR0GX0}jB`d@^=z^>8lrKP{OH zGpcDaoB$n7AcsM^QNgK`pB(!xUK;mqFWx?E#tteixMCyfCL5Q(!iM*8GJn~>1VN?O z%ln3Cw#fw~h3uh*p&%>V3E`kWjJq-7d`|nL81QtG zP25tiAm3X?WGL2p>xi@!oGJD0S1}3ID2F`hY>v-$%`5Dci_S-3b|=SPBc6yiAoe8% zLxdeSIFJxgwP#FKYw~+0;~zSk6Hi$s|FW{VFIoiERYh3nv8LCN980Hg9p|KThw>tM z7zhTZYA1cHIu(!=ZOX~0b)aB|5OGOjXn-n;-{_Qca!ao z{u&(mgZ-h&f1@Na69sWOHZWY0R-1Y=d;@g2Z9C3nT3W<-D_gGj=w>J%7G3AV$pdYW zH@+hZS9_|Yh@qoBaoY6s6VweCJru0$vRNRlaZ$hB+Zy+aQJJoK)JEOrd)d1u+jOO4 zqn4j#IQGvW663lT=%b9Zp*xr2wv?PHw*gM3cNDbbkEuNId+Q2hXOrJ5xjZ z2!34lB;g4;VHXO!@>$V0gyt$VtP(*i20`Y(ng3=Xd}rXWQHRJPfHAk5T`vNshUIhD z&anV-aAZXq4V$d;b7#GXy_g5>GQ?tM@T9Ktx|)`Tb{_aDcX~HHXc!ft;{KorT1!tW z!Uo!wKXnF_fCG?rQ;3ig#He>j&g%$yt&YG5O@sNjkkrTyNlYAXK@@2qISw9b!Ah|W zW*t@w)2=WB(h*90qhIhw7;Zd~PM|{!mfYkYdF8O~Hb}E-|2ONp=m18xDlNE`1Rxg1 zb9UM>g%-C{x05Uds)t^!R8sl0@K8^XuP9I=R5g~(yoB>JDMAqAdfLFFfP|tOuVJWY z$!C(H+ix6rU-ZzIKX~EF!KTAjTs^0z#`w3=w2tN;v#&5f(CPL-{w|$I0Gjs-HY5tKz+M(< zeSkwv*oFl#jug1C`iz?JsdYmP3?}OY@26S11MUS7N#v-{uEK4P8l^+4H9-f+?o9HI1^Zjls5d5; z75B!)iDRT0h;OXmTNOR=4Hg$Dgi)o&M;Rp@#qE0+_lCGg=Fqz%g_Tm=wqkTc6i1iH zfN>@$s|I%ucK?A9H^=+aLQ+CCgZ5J!fP*k^vb( zq4V}*X5G6Ll|{*82y{L}_~bGaIN<&L*@%^GBr~;##R^ldvykFlO`e!qNlh>+?){+~ z(u8g7sv$etl()uz@23EfWoW`uoGQk4M*V}DfiwDwWGrqx;h@!KLUmM$MlA?Ee*qh#%_1v6TL621f2)36 z{c0Xplo3qU3KNrb@neGZjXTCR-3Ks(na@>mwUeSqAP;HIkF0f=Hqh29^6TfELeRrt5&&J=d5nIXWM1IZE)3?etutOB0ww+Th}r4N3`g65~f1jK0jQK2fM z&WI)YMk;;Uh)u5Jj(ay6FTLiL19Wop*1p&TW z3D~~!4oyC{6xet6HxWChuES|R+j$D*2_+I$(1+y6p2C8ItGUJol7mD1A|lnNAW@;n z?72mRjS$9CyraU52AQ&21%2wc{wl>+OTZ!x-8k!Jp4wxdA%xpWyz$1i;x_>oV5ofa8Ptr_ACM?SkBl{phV)9Y-iRe5EB;*4c({m^gL=u9?{`XS zUlkg4jy0nvuTmxrvxU(S-S+A5kmf1iAyJJBI(|!t^P>7bxRL<#(p>@h92jsU)aG5Fb-20?xhik^1YI8r6&Pm62UfNk z(G$5_RCCr3V_v`9URNZwN3>paNBeqY=2r7vluvTD#sraXuW#%*FFV$$7P+=Duh0_q zS>v4bY!?M7IL_Woa-MY20qe+8&Dm&f+fV|<(9p#g@^PVo8$HhDzPAOnY@9AkH@=lY z{9qo&;g)e(yA7%@i502Co*F^gX>nu_165K^l303F8ag{fHRnfj(}w=vdYs&$it5hF zFlmvWqhDaC9CWt5YR+bJ!-fr!u8x73*=kR6;9s|j8khAs4FTX><^Oy3*X?@TUyklq zO8KAt?%5hGRSS}E+?CgVay(q9t1*1Sg6i(Qxrv?T>?0iw zsCp#`wsPQ)@6A;k0bo;T_;DUMBvj^6H<#_bOx8hIk127%=TquR-H>=@B-4e#30W;D z*jgRvFe;G6zhv%=KJNa6!@47;VgLeJGlVsu%^!|xgXo!xQ)=@X^fMo zc+Fn=UYbsH^Scb7GK5DvgMCK}SpitOFay%(!RISytX0LR;{Et&_!21sGMW^IWf#F} zU%Gqo9NZZuM(OAj$3a>n9-Oj2E4Zxn4nxRP$7 z(AZ+G3k<1!#U8ffAjH&WY-wqE@8(r!G?0UwN(p{0Q zZ;4WVH%i(_Z=6&75+jnbfE-xY>I%L;TF3;9VudLoSO>D>I~sPZ4-}fXKGYzHC8&^C z;pO(fddM0Navg!nhrm@>8)pt%(sj#XZ>>;>`HM4pM0P zmj_E0m~PKBsy|ixGpW3YBM69=`G_ahBgW^&NGU^KT=Snov;yocqZMwus^hMn(*4|7y&IJ5sDA z!{3vwuWOd#u*XhLX zr=!2GUdH}M+ZJ)as&{&x4ApSt7RU~YRS>XN zMXO}045ugDv3W%H%nOB5td$GowLHiE+%r|ZCT?`#CgMGRtGw?2s;Dcr9`=*AbG|bbjij$qU z&qx>8c1;|Qjn4K(JDi8WTmCr0b$*f{*O;J>oc~0uoT*5U)43v)s%;$=hTi)zJ;s)& zj*}cn(ZjrYE?D2)f6_I3gBRgFOR=}Kso8N%0?m(&k2)lg03w^v18K`E_~|kFJazMJ zpfTSx{#^O^{pXJgskj_FWt<=!|&jNqVtb9p|~WwkXJJtqgH9 zp*7-#w&Lmes}^s!(-Q7n;ejKy*Wty>?mFp@*CEwkGff^v7Iw#5TVZV4+S0GiIb@{s zZM&u_EcSB7~hZG|XQ{0h5SX?S#e+UaWB%XZKM)JemF=gCReRx@S@alFv- zrmmE?#j@k@-LtmdSEvw-J2{l&rS;wY={s=y*hcX;Pp&P8lQqIHFAOofr} z!6hH8iep!^@E$i64h&LZ*bGAW!}f=zfQq3DQQpCQl)9nao6LK(IW9 zY9^b5_^#Bws;bSg!oqlO`f{xQ^Y5jQ2nx~B4oNQqXq@y5k9w6SxZIlL3g9EG?qz(+ zz^?8KlX0XTSoc!;Hgr1L%!dEL<4ay2Ci8Q=bn3;x*+dA_`?Vs`33WuRXoFCIgvj*| z=u>)Xg3}2NzM|*%i3IFilv?yIe1D+nXPc7lNHICAH#P2Ifh(R8CG^oo7w=3z@jF)= zw26p48VoGvC1{27@Ja}o=*o=EIc7&5pD;dfsvsx0J*gAx2o^Z4xF4JW4Ikqb z?x*(!kH0PK3+^I1CA?v$BnX=$IXJgQ?1@ABLFc8U7I&x0#U104PK}S8Z&A3fbNc$N zoN0QD3y}(XO;p7+8(I%TcJ~sq%3h=L&h{oMG2?;IW9!EtQcVfu9Jxi?Te#Jaw&Ud_w`fuo_Ia^CuqQ9PdiAO z6bC|g_^$dg35cXO9idir>Zm!zW;z+p1EtbeP?kOg7~O~#RLv|TOK6h0T>EfDJ&$Z$ z&%+SSqzq>^2k|z5GGPiVYHjb=vavj0v8#RfB+QKVI~kt&%cBo3l)y<`2*ZiVNGP&0 zi4>2xGwb@xdf{_gpOJ#$Cy~~S|BmhEjSTtwJLWyG^AtI9bFpcm1p!o%CQ(Gq*-}Nr@Kmr z)Bv>Y^T3uD(HF_oDLJO>i3FXlCI}=b!T;ZqW=bMM43(5fh+PBgRS{wiYY#5#BN`kN z<`KQJ{Arg_q8jcMy}q2ym`Hh+Gt3>Ypao96bK)rcriJa|!z+GTcYYOIcMf%V0Y)1uB^%jpt(y#$DoKuf)FrGZ`C|M{}`i49nT!!$jU|8@xXP^D~= zVPEgNQ`7Dz;|rwXvgIC{hH-9SW=3OUU7zf)J6I z-8jD1Ne@Zc8`)>aESD0q9NNaqJ7-Px`LELxz**jBcGVKGldiW*%Xj5gpipUAa`o)7 z4au$!<(J0qjmeCOjLF^bocWxB3=i}9H(=4&lH8kA=8-El{gWhDUVjQGP^?uds8&)=t#syHN4+D? zMS(|Fn`T(T5CmQOB=uqc$yvzdrkb$tHm2|ciE&wXf^*7RamDCRi}Q->PW05RU-^s%hM#c_`mhi+R@5N1yi-T3=vpAq=o zs>s;wj$TIk2B$*?Vf?R84-0#7-8sFvi#8z1%`e#l<$(crhW<%rdZ1kYlg#xXkU@2q zK73PGJ6Sz@gqNPOcppZN2SeV?YRx(4bfd*-6(&@L53Y>_7Zx0T)EST`9VKy7#&`}9 z+1x9K?XC|X!EYV)+0m)5_o)A;Ah0;yOph9Rg zzV|*~I&(AQPy`*k|4-1RnjEJk#0jaOWum0*Hx3I)EW1p>-G-QSggVZYjR%%+VUPSy zak%8hSvz&!hT?_Ym=iw|7FLKs(yR5*=kqXK5m{sYig>KQWkRduECeBd$8;=HqHj>#uDVPqGsw#QJERvR(kPnvd=wm zIOL9GlJk*JgDe?$DY{hF@?}_^w1+IUhvUovSuQ8HTj9~z*bl|T#@CGC()0oLm`(1N zQnCJHb{6M!U}1XQ9?K4aA89Mfqk3DKxSk)^NyXz{FErrk07|~+bvcYMy@o zLym+n%>M};<$>eG@7z3j_+1`#(G)B0kyM;44h&}9ytr5qE9Z_+*V7l+c-d8fRkb|x z1NSUV_Wd8No?jyW>ipCLcR*52+Ot>$(NB@5xp7F1SsJk@rj7EIqu*+ug8be4nX7;cBZdX_ME2SZNq1JItiZwecW)eKDSb( zT_|HqpjvFO8A+P^X0vdGKV0OYRvji0^K^Jo&5T>nock_T7n6qJ z731xsW33{MR?_vsrBWo7A!TA&ci|pOx2gsQ(4o6MFKHFn8YU!cfF!W&siDLmQ}iNZr?u zP~AJ`boilgo3=lNLANkkb)^)9WT^B!(%vv5eeu@7o`*|l2icd?o;#Mq#6`cffl6Z> zRVICZ$q~EMgGw2i4X(2#frsBI&xK8=wFWfo-(wm%Kx7LO^QnYw3goa`Fh}0Q0cbq#Jv5j}oB#R9GT~)P-0mXqS;zGdG&g=By$u!{+U%J$$}w z(o&Z{JxP|Vwu97E$(8S>agDwkmBjF-aBW}?X04`MWtR=K^TgkKiK&+daJx#c4ghDf z4nuP~N*W{A?f4%Y{v7hQV!%isju`g)JfSR+6z^NK9;yw0g_^LMfSU?`AfoZ9lfx!e zH>)ymv?yi8dEdm5wo!KPxY%yp29y$RyN4=_QG)vcFpFYBn%h^BEb0I|n^D)+I&1V>q zs#)tiQBw?FXndGXL3m(`DxG@;7+GSYGlV|}B>Me^OqNGBr33^o?}A5;huey8Y_ZFa z0uqVL1yt<|_r0y8pQ7CIgcBv?Q;@k=fb&&>bf~x~Q#WSS^^3|GJr`zrL=~Y2=Sw_2 z@K*$Yq*J)mAg{-Em$LdA<=C6rcLzn$+Y447Vdw_vE;P%Zmru%hS=_Ii^Lr5H;QZMe zp98#nRarY#bX5i-_L^iDV<*5XTFf9?4$wB|YA&MAbojWv0z2q@M{{t-eJL;ZSAd6$ zgUg3g8w>5=)+XO32UmWK%1nT6lvCI_{4;bmpVw*>!Zm#FvhTWd7dP`TYoW0!Y+Vq_ zEBc~^2_LbDctO2FGg7?66m%9CedYwN4L=qiyWD6M!Y*T#qEBg|GV7+$A%PdF=sl~9 zeR_-lX<$TMsUv+58$fvG#02+dQ0Eskw`BHF?(=HA{$6?6K6Xp(hF2|{zWT#PNE9U> z9r~6m!#LHMcI8xb!(iw&4U>3<`mo8azF4<+HM%ZOJj~?-_-JV5lWcl4109R|&J}>Xf(b_vKJJx(7$-MyWME zY1wghKoI4|CF&>^{1L}{s`LiW&KuBj-qrZ{!`|H=alU{zUec?~8pWFhVPzC9-AyQM zMRUDM^+s53W*(j5=Dt}?iBjD2X%+$v1O+)~z84ZC%0cu!|oeJfdQ#xQK zQN21nHi(Ej9Cl{(UH?i3A1$VR7>+GnGu@a3FZQP>NT6_e=|)05b*&j+!CgHHo|i{E z|DwPUv?78wf95ow!WA;VP`)x?ge%;r8khp)(*9&jBqy7^0a@Av1P zk74;DBgOo1Mzb1C*Dp68Id-kPdhNW9CL!#wCRaGWdKvMbS`WQ{dSDm?FTPh!|3-`7 zaS@rRPrOv%DVVeeS4&V}CqczWvtJ==JAYV=9E{YC{*$-h*jX{xGW8ap9_uHCHM)t+ z)XRt#g+*9Y40HV%|Dp&jzY!fS)Wk>8?t$d;you)deuJ}yI8u{x2!+;{xM=*&7@n88t4t%r$OJ_F|dXb(! znUPTMEPD}f9VsS-zaYW{Kl#!C&Dq`;^%95RMTx-rGabAB7lJ0L6Bsl{KO_1qOz%By zR(Q*!2beS;TxF4Q7Sct{|41d+<@gKNpGW_?hOH~68bcTJ)ame}?ZNrz>_?hm902GP zu92wfMjmt15uS_GH}GCsEVp`|>-=oDi^!v-88*jAn3x_jhmyUy;@`L=-L_#4R|6{& z%v1Myy654ws)Tu7XYBgnQ30nq1s*($H)7c*_+xzPOB2~e1!1{S&ZLPCc#0Mh7(L}|b7uar!L=L(j!PP772^#)`W*s`cw z%{_CSc9IEfK8(gX9EeNKy=s`Uo97;S?Gi|uxI}1Iu>9N0N6`5@<_t)~V_TkaG69T~ zje_iN*~Th>{cP6YpRgd;4}F*K)#H#E(E;5UuPSJf%|~yg2tTbvA3{;y$`i8^OzempVGG& z@W18l9w4jiF_AXCu ze%(~PC#L>+s^Yk2SA=-Z#tH>x=JDza(vUx*LvC)K2m+^-en-p|7?&ni=o1#SYaseC zT>M+SR!IP@!EHmMtG_~SK?H=Pvka*!O~DgAbijUkK%4?aA~KOvx-7pow*$~NFeRv+ zTnkJpIajJ<$r2gC=&@a_$Oe6?P^1$9a`n}zLi%KXlj2s)kj~PV6L(KCJ{vz=`m2ZQ zQ?NG6tL6p{&7uQ}7!+OHPb!Vyo%xV6vg7;}5J=O^Dw93&kduV41lSA*Yc{z5cG)P}uH(CJrx-z%ho&?qaQ869uQGLiU}m3S0L z#CfjL*fP#5rI~}BQcnT~SrGt?(6sud`(q`a;XhbFpoSO-&l38mKApnJ4ONd7@P5R_ zMnsSXB}yyP3EnTfh6-H=P-FkQmW^tk)yh~+1}`vD0Vj%qcg(XuCxU+jS9>RCQ)Og# zQhO!v`M(s7>%Rx${L+2*SozQynyiy1#|OVt5~ShXRO3wobbg2y``a4u75dv zp*{-6%^jVO3z0)%@!)L%ie7#PWJw4Io@d$uJYYlbUB)zI2tOGU_ma=4tS8tS! z$27Q`H~xuwvQ&iJsam7TKBny8F7922`Y^5ha_5(R$yG0;TVLHK(Fx`*L38fK{#8pB zREq`bNQEzt;GDLI{r|i~j%e<3&gdW+LDYA>96_8Oc#E?r@V*O^il@^^n~^dNK=!`o zGgRGK?C;=;G?sgalz^!Wmz{WgbmL*Z$G*PC?c;@Fh3 zR*4{a(_0t$-y8n2xQSt%;7trL?=ZK4Us~{a8a<&}ns z8C&ibQ`@9pAri>Ebew#lt_)j5fg5biWA!f5qj33n^ ztnu7=PA*d>)K9 z(b=?HjV>pYsO5^XVbD$LVj8Hn0eXEIp+1WW4NxTS8i6<)8-_AWfw%g9#Y8*RUeES{74HDX66?>NR?5`&;d{ch$_A4dE WJGRt60RLbEL|^;*wMtER#Qy^*WJQSp From c7579a5421956d8b98e4924aa4d2fd8e72c1e599 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 27 Apr 2016 08:41:43 -0700 Subject: [PATCH 06/38] billkar feedback --- windows/manage/configure-telemetry-in-your-organization.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/manage/configure-telemetry-in-your-organization.md b/windows/manage/configure-telemetry-in-your-organization.md index ace5305f29..419611612d 100644 --- a/windows/manage/configure-telemetry-in-your-organization.md +++ b/windows/manage/configure-telemetry-in-your-organization.md @@ -27,9 +27,9 @@ In previous versions of Windows and Windows Server, Microsoft used telemetry to Microsoft is committed to improving customer experiences in a mobile-first and cloud-first world, and it all starts with our customers. Telemetry is one critical way Microsoft is using data to improve our products and services. Telemetry gives every enterprise customer a voice that helps us shape future versions of Windows, Windows Server and System Center, allowing us to respond quickly to your feedback and providing new features and improved quality to our customers. -Our goal is to leverage the aggregated data to drive changes in the product and ecosystem to improve our customer experiences. We are also partnering with enterprises to provide added value from the telemetry information shared by their devices. Some examples include identifying outdated patches and downloading the latest antimalware signatures to help keep their devices secure, identifying application compatibility issues prior to upgrades, gaining insights into driver reliability issues affecting other customers, and using usage data to tune some of their operations to reduce the total cost of ownership (TCO) and downtime. +Our goal is to leverage the aggregated data to drive changes in the product and ecosystem to improve our customer experiences. We are also partnering with enterprises to provide added value from the telemetry information shared by their devices. Some examples include identifying outdated patches and downloading the latest antimalware signatures to help keep their devices secure, identifying application compatibility issues prior to upgrades, and gaining insights into driver reliability issues affecting other customers. -For Windows 10, we invite IT pros to join the Windows Insider Program to give us feedback on what we can do to make Windows work better for youcr organization. +For Windows 10, we invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows work better for youcr organization. ## How is telemetry data handled by Microsoft? @@ -194,7 +194,7 @@ If the Connected User Experience and Telemetry component detects a problem on Wi The Full level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the **Basic**, **Enhanced**, and **Security** levels. -Additionally, at this level, devices opted in to the Windows Insider Program will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the Windows Insider Program are automatically set to this level. +Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level. If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** telemetry level and have exhibited the problem. From 3815fabde5fff4ed9a087df92b32284f10a0941c Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 29 Apr 2016 14:21:05 -0700 Subject: [PATCH 07/38] changing name of telemetry doc --- windows/manage/TOC.md | 2 +- ...md => configure-windows-telemetry-in-your-organization.md} | 4 ++-- windows/manage/disconnect-your-organization-from-microsoft.md | 2 +- windows/manage/lock-down-windows-10.md | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) rename windows/manage/{configure-telemetry-in-your-organization.md => configure-windows-telemetry-in-your-organization.md} (99%) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index bacbfb101a..e82c688247 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -18,7 +18,7 @@ #### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md) ### [Disconnect your organization from Microsoft](disconnect-your-organization-from-microsoft.md) -### [Configure telemetry in your organization](configure-telemetry-in-your-organization.md) +### [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) ### [Configure access to Windows Store](stop-employees-from-using-the-windows-store.md) ### [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) ### [Configure Windows 10 Mobile using Lockdown XML](lockdown-xml.md) diff --git a/windows/manage/configure-telemetry-in-your-organization.md b/windows/manage/configure-windows-telemetry-in-your-organization.md similarity index 99% rename from windows/manage/configure-telemetry-in-your-organization.md rename to windows/manage/configure-windows-telemetry-in-your-organization.md index 419611612d..6ee41267e4 100644 --- a/windows/manage/configure-telemetry-in-your-organization.md +++ b/windows/manage/configure-windows-telemetry-in-your-organization.md @@ -1,10 +1,10 @@ --- description: Use this article to make informed decisions about how you can configure telemetry in your organization. -title: Configure telemetry in your organization (Windows 10) +title: Configure Windows telemetry in your organization (Windows 10) keywords: privacy --- -# Configure telemetry in your organization +# Configure Windows telemetry in your organization **Applies to** diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index 6159d95499..247a5b7d94 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -15,7 +15,7 @@ author: brianlic-msft - Windows 10 -If you’re looking for content on what each telemetry level means and how to configure it in your organization, see [Configure telemetry in your organization](configure-telemetry-in-your-organization.md). +If you’re looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. diff --git a/windows/manage/lock-down-windows-10.md b/windows/manage/lock-down-windows-10.md index 72dbc00ec1..af69f6baec 100644 --- a/windows/manage/lock-down-windows-10.md +++ b/windows/manage/lock-down-windows-10.md @@ -43,8 +43,8 @@ Enterprises often need to manage how people use corporate devices. Windows 10 p

Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings.

-

[Configure telemetry in your organization](configure-telemetry-in-your-organization.md)

-

Use this article to make informed decisions about how you can configure telemetry in your organization.

+

[Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md)

+

Use this article to make informed decisions about how you can configure Windows telemetry in your organization.

[Disconnect your organization from Microsoft](disconnect-your-organization-from-microsoft.md)

From 3ba2a8517e8748319cd4697369fe91f51518ef64 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 2 May 2016 09:17:40 -0700 Subject: [PATCH 08/38] Changing title of Disconnect from Microsoft topic --- windows/manage/disconnect-your-organization-from-microsoft.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index 247a5b7d94..9325fea667 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1,5 +1,5 @@ --- -title: Disconnect your organization from Microsoft (Windows 10) +title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 keywords: privacy, disconnect from Microsoft @@ -9,7 +9,7 @@ ms.sitesec: library author: brianlic-msft --- -# Disconnect your organization from Microsoft +# Configure Windows 10 devices to stop data flow to Microsoft **Applies to** From 59634eee2127458a7a2c8a66d999b91447f27424 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 4 May 2016 09:21:39 -0700 Subject: [PATCH 09/38] cleaning up content --- ...-as-part-of-a-windows-deploymentmbam-25.md | 373 ++++-------------- 1 file changed, 73 insertions(+), 300 deletions(-) diff --git a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md b/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md index 1924b4d39c..b2a620df28 100644 --- a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md +++ b/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md @@ -50,275 +50,70 @@ This topic explains how to enable BitLocker on an end user's computer by using M - Robust error handling - You can download the `Invoke-MbamClientDeployment.ps1` script from [Microsoft.com Download Center](https://www.microsoft.com/download/details.aspx?id=48698). This is the main script that your deployment system will call to configure BitLocker drive encryption and record recovery keys with the MBAM Server. + You can download the `Invoke-MbamClientDeployment.ps1` script from [Microsoft.com Download Center](https://www.microsoft.com/download/details.aspx?id=48698). This is the main script that your deployment system will call to configure BitLocker drive encryption and record recovery keys with the MBAM Server. - **WMI deployment methods for MBAM:** The following WMI methods have been added in MBAM 2.5 SP1 to support enabling BitLocker by using the `Invoke-MbamClientDeployment.ps1` PowerShell script. + **WMI deployment methods for MBAM:** The following WMI methods have been added in MBAM 2.5 SP1 to support enabling BitLocker by using the `Invoke-MbamClientDeployment.ps1` PowerShell script. - **MBAM\_Machine WMI Class** - **PrepareTpmAndEscrowOwnerAuth:** Reads the TPM OwnerAuth and sends it to the MBAM recovery database by using the MBAM recovery service. If the TPM is not owned and auto-provisioning is not on, it generates a TPM OwnerAuth and takes ownership. If it fails, an error code is returned for troubleshooting. + **MBAM\_Machine WMI Class** + **PrepareTpmAndEscrowOwnerAuth:** Reads the TPM OwnerAuth and sends it to the MBAM recovery database by using the MBAM recovery service. If the TPM is not owned and auto-provisioning is not on, it generates a TPM OwnerAuth and takes ownership. If it fails, an error code is returned for troubleshooting. - - - - - - - - - - - - - - - - - -
ParameterDescription

RecoveryServiceEndPoint

A string specifying the MBAM recovery service endpoint.

+| Parameter | Description | +| -------- | ----------- | +| RecoveryServiceEndPoint | A string specifying the MBAM recovery service endpoint. | -   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Common return valuesError message

S_OK

-

0 (0x0)

The method was successful

MBAM_E_TPM_NOT_PRESENT

-

2147746304 (0x80040200)

TPM is not present in the computer or is disabled in the BIOS configuration.

MBAM_E_TPM_INCORRECT_STATE

-

2147746305 (0x80040201)

TPM is not in the correct state (enabled, activated and owner installation allowed).

MBAM_E_TPM_AUTO_PROVISIONING_PENDING

-

2147746306 (0x80040202)

MBAM cannot take ownership of TPM because auto-provisioning is pending. Try again after auto-provisioning is completed.

MBAM_E_TPM_OWNERAUTH_READFAIL

-

2147746307 (0x80040203)

MBAM cannot read the TPM owner authorization value. The value might have been removed after a successful escrow. On Windows 7, MBAM cannot read the value if the TPM is owned by others.

MBAM_E_REBOOT_REQUIRED

-

2147746308 (0x80040204)

The computer must be restarted to set TPM to the correct state. You might need to manually reboot the computer.

MBAM_E_SHUTDOWN_REQUIRED

-

2147746309 (0x80040205)

The computer must be shut down and turned back on to set TPM to the correct state. You might need to manually reboot the computer.

WS_E_ENDPOINT_ACCESS_DENIED

-

2151481349 (0x803D0005)

Access was denied by the remote endpoint.

WS_E_ENDPOINT_NOT_FOUND

-

2151481357 (0x803D000D)

The remote endpoint does not exist or could not be located.

WS_E_ENDPOINT_FAILURE

-

2151481357 (0x803D000F)

The remote endpoint could not process the request.

WS_E_ENDPOINT_UNREACHABLE

-

2151481360 (0x803D0010)

The remote endpoint was not reachable.

WS_E_ENDPOINT_FAULT_RECEIVED

-

2151481363 (0x803D0013)

A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint.

WS_E_INVALID_ENDPOINT_URL

-

2151481376 (0x803D0020)

The endpoint address URL is not valid. The URL must start with “http” or “https”.

+| Common return values | Error message | +| -------------------- | ------------- | +| **S_OK**
0 (0x0) | The method was successful. | +| **MBAM_E_TPM_NOT_PRESENT**
2147746304 (0x80040200) | TPM is not present in the computer or is disabled in the BIOS configuration. | +| **MBAM_E_TPM_INCORRECT_STATE**
2147746305 (0x80040201) | TPM is not in the correct state (enabled, activated and owner installation allowed). | +| **MBAM_E_TPM_AUTO_PROVISIONING_PENDING**
2147746306 (0x80040202) | MBAM cannot take ownership of TPM because auto-provisioning is pending. Try again after auto-provisioning is completed. | +| **MBAM_E_TPM_OWNERAUTH_READFAIL**
2147746307 (0x80040203) | MBAM cannot read the TPM owner authorization value. The value might have been removed after a successful escrow. On Windows 7, MBAM cannot read the value if the TPM is owned by others. | +| **MBAM_E_REBOOT_REQUIRED**
2147746308 (0x80040204) | The computer must be restarted to set TPM to the correct state. You might need to manually reboot the computer. | +| **MBAM_E_SHUTDOWN_REQUIRED**
2147746309 (0x80040205) | The computer must be shut down and turned back on to set TPM to the correct state. You might need to manually reboot the computer. | +| **WS_E_ENDPOINT_ACCESS_DENIED**
2151481349 (0x803D0005) | Access was denied by the remote endpoint. | +| **WS_E_ENDPOINT_NOT_FOUND**
2151481357 (0x803D000D) | The remote endpoint does not exist or could not be located. | +| **WS_E_ENDPOINT_FAILURE
2151481357 (0x803D000F) | The remote endpoint could not process the request. | +| **WS_E_ENDPOINT_UNREACHABLE**
2151481360 (0x803D0010) | The remote endpoint was not reachable. | +| **WS_E_ENDPOINT_FAULT_RECEIVED**
2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. | +| **WS_E_INVALID_ENDPOINT_URL** 2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. | -   - - **ReportStatus:** Reads the compliance status of the volume and sends it to the MBAM compliance status database by using the MBAM status reporting service. The status includes cipher strength, protector type, protector state and encryption state. If it fails, an error code is returned for troubleshooting. - - - - - - - - - - - - - - - - - - -
ParameterDescription

ReportingServiceEndPoint

A string specifying the MBAM status reporting service endpoint.

- -   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Common return valuesError message

S_OK

-

0 (0x0)

The method was successful

WS_E_ENDPOINT_ACCESS_DENIED

-

2151481349 (0x803D0005)

Access was denied by the remote endpoint.

WS_E_ENDPOINT_NOT_FOUND

-

2151481357 (0x803D000D)

The remote endpoint does not exist or could not be located.

WS_E_ENDPOINT_FAILURE

-

2151481357 (0x803D000F)

The remote endpoint could not process the request.

WS_E_ENDPOINT_UNREACHABLE

-

2151481360 (0x803D0010)

The remote endpoint was not reachable.

WS_E_ENDPOINT_FAULT_RECEIVED

-

2151481363 (0x803D0013)

A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint.

WS_E_INVALID_ENDPOINT_URL

-

2151481376 (0x803D0020)

The endpoint address URL is not valid. The URL must start with “http” or “https”.

- -   - - **MBAM\_Volume WMI Class** - **EscrowRecoveryKey:** Reads the recovery numerical password and key package of the volume and sends them to the MBAM recovery database by using the MBAM recovery service. If it fails, an error code is returned for troubleshooting. - - - - - - - - - - - - - - - - - - -
ParameterDescription

RecoveryServiceEndPoint

A string specifying the MBAM recovery service endpoint.

- -   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Common return valuesError message

S_OK

-

0 (0x0)

The method was successful

FVE_E_LOCKED_VOLUME

-

2150694912 (0x80310000)

The volume is locked.

FVE_E_PROTECTOR_NOT_FOUND

-

2150694963 (0x80310033)

A Numerical Password protector was not found for the volume.

WS_E_ENDPOINT_ACCESS_DENIED

-

2151481349 (0x803D0005)

Access was denied by the remote endpoint.

WS_E_ENDPOINT_NOT_FOUND

-

2151481357 (0x803D000D)

The remote endpoint does not exist or could not be located.

WS_E_ENDPOINT_FAILURE

-

2151481357 (0x803D000F)

The remote endpoint could not process the request.

WS_E_ENDPOINT_UNREACHABLE

-

2151481360 (0x803D0010)

The remote endpoint was not reachable.

WS_E_ENDPOINT_FAULT_RECEIVED

-

2151481363 (0x803D0013)

A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint.

WS_E_INVALID_ENDPOINT_URL

-

2151481376 (0x803D0020)

The endpoint address URL is not valid. The URL must start with “http” or “https”.

+ **ReportStatus:** Reads the compliance status of the volume and sends it to the MBAM compliance status database by using the MBAM status reporting service. The status includes cipher strength, protector type, protector state and encryption state. If it fails, an error code is returned for troubleshooting. + + | Parameter | Description | + | --------- | ----------- | + | ReportingServiceEndPoint | A string specifying the MBAM status reporting service endpoint. | + + + | Common return values | Error message | + | -------------------- | ------------- | + | **S_OK**
0 (0x0) | The method was successful | + | **WS_E_ENDPOINT_ACCESS_DENIED**
2151481349 (0x803D0005) | Access was denied by the remote endpoint.| + | **WS_E_ENDPOINT_NOT_FOUND**
2151481357 (0x803D000D) | The remote endpoint does not exist or could not be located. | + | **WS_E_ENDPOINT_FAILURE**
2151481357 (0x803D000F) | The remote endpoint could not process the request. | + | **WS_E_ENDPOINT_UNREACHABLE**
2151481360 (0x803D0010) | The remote endpoint was not reachable. | + | **WS_E_ENDPOINT_FAULT_RECEIVED**
2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. | + | **WS_E_INVALID_ENDPOINT_URL**
2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. | + **MBAM\_Volume WMI Class** + **EscrowRecoveryKey:** Reads the recovery numerical password and key package of the volume and sends them to the MBAM recovery database by using the MBAM recovery service. If it fails, an error code is returned for troubleshooting. + + | Parameter | Description | + | --------- | ----------- | + | RecoveryServiceEndPoint | A string specifying the MBAM recovery service endpoint. | + + + | Common return values | Error message | + | -------------------- | ------------- | + | **S_OK**
0 (0x0) | The method was successful | + | **FVE_E_LOCKED_VOLUME**
2150694912 (0x80310000) | The volume is locked. | + | **FVE_E_PROTECTOR_NOT_FOUND**
2150694963 (0x80310033) | A Numerical Password protector was not found for the volume. | + | **WS_E_ENDPOINT_ACCESS_DENIED**
2151481349 (0x803D0005) | Access was denied by the remote endpoint. | + | **WS_E_ENDPOINT_NOT_FOUND**
2151481357 (0x803D000D) | The remote endpoint does not exist or could not be located. | + | **WS_E_ENDPOINT_FAILURE**
2151481357 (0x803D000F) | The remote endpoint could not process the request. | + | **WS_E_ENDPOINT_UNREACHABLE**
2151481360 (0x803D0010) | The remote endpoint was not reachable. | + | **WS_E_ENDPOINT_FAULT_RECEIVED**
2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. | + | **WS_E_INVALID_ENDPOINT_URL**
2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. |   2. **Deploy MBAM by using Microsoft Deployment Toolkit (MDT) and PowerShell** @@ -328,13 +123,9 @@ This topic explains how to enable BitLocker on an end user's computer by using M **Note**   The `Invoke-MbamClientDeployment.ps1` PowerShell script can be used with any imaging process or tool. This section shows how to integrate it by using MDT, but the steps are similar to integrating it with any other process or tool. -   - **Caution**   If you are using BitLocker pre-provisioning (WinPE) and want to maintain the TPM owner authorization value, you must add the `SaveWinPETpmOwnerAuth.wsf` script in WinPE immediately before the installation reboots into the full operating system. **If you do not use this script, you will lose the TPM owner authorization value on reboot.** - -   - + 2. Copy `Invoke-MbamClientDeployment.ps1` to **<DeploymentShare>\\Scripts**. If you are using pre-provisioning, copy the `SaveWinPETpmOwnerAuth.wsf` file into **<DeploymentShare>\\Scripts**. 3. Add the MBAM 2.5 SP1 client application to the Applications node in the deployment share. @@ -467,46 +258,40 @@ This topic explains how to enable BitLocker on an end user's computer by using M **Caution**   This step describes how to modify the Windows registry. Using Registry Editor incorrectly can cause serious issues that can require you to reinstall Windows. We cannot guarantee that issues resulting from the incorrect use of Registry Editor can be resolved. Use Registry Editor at your own risk. -   - 1. Set the TPM for **Operating system only encryption**, run Regedit.exe, and then import the registry key template from C:\\Program Files\\Microsoft\\MDOP MBAM\\MBAMDeploymentKeyTemplate.reg. 2. In Regedit.exe, go to HKLM\\SOFTWARE\\Microsoft\\MBAM, and configure the settings that are listed in the following table. **Note**   You can set Group Policy settings or registry values related to MBAM here. These settings will override previously set values. + + Registry entry + Configuration settings -   + DeploymentTime - Registry entry + 0 = Off - Configuration settings + 1 = Use deployment time policy settings (default) – use this setting to enable encryption at the time Windows is deployed to the client computer. - DeploymentTime + UseKeyRecoveryService - 0 = Off + 0 = Do not use key escrow (the next two registry entries are not required in this case) - 1 = Use deployment time policy settings (default) – use this setting to enable encryption at the time Windows is deployed to the client computer. + 1 = Use key escrow in Key Recovery system (default) - UseKeyRecoveryService + This is the recommended setting, which enables MBAM to store the recovery keys. The computer must be able to communicate with the MBAM Key Recovery service. Verify that the computer can communicate with the service before you proceed. - 0 = Do not use key escrow (the next two registry entries are not required in this case) + KeyRecoveryOptions - 1 = Use key escrow in Key Recovery system (default) + 0 = Uploads Recovery Key only - This is the recommended setting, which enables MBAM to store the recovery keys. The computer must be able to communicate with the MBAM Key Recovery service. Verify that the computer can communicate with the service before you proceed. + 1 = Uploads Recovery Key and Key Recovery Package (default) - KeyRecoveryOptions + KeyRecoveryServiceEndPoint - 0 = Uploads Recovery Key only + Set this value to the URL for the server running the Key Recovery service, for example, http://<computer name>/MBAMRecoveryAndHardwareService/CoreService.svc. - 1 = Uploads Recovery Key and Key Recovery Package (default) - - KeyRecoveryServiceEndPoint - - Set this value to the URL for the server running the Key Recovery service, for example, http://<computer name>/MBAMRecoveryAndHardwareService/CoreService.svc. - -   6. The MBAM Client will restart the system during the MBAM Client deployment. When you are ready for this restart, run the following command at a command prompt as an administrator: @@ -522,20 +307,8 @@ This topic explains how to enable BitLocker on an end user's computer by using M 9. To delete the bypass registry values, run Regedit.exe, and go to the HKLM\\SOFTWARE\\Microsoft registry entry. Right-click the **MBAM** node, and then click **Delete**. - **Got a suggestion for MBAM**? Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). **Got a MBAM issue**? Use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopmbam). - ## Related topics - [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) [Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md) - -  - -  - - - - - From 3b619cfb18fda8b83a32a4d366d6a08f4c28ffe7 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 4 May 2016 09:52:28 -0700 Subject: [PATCH 10/38] cleaning up content --- ...ker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md b/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md index b2a620df28..b9d94fab8e 100644 --- a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md +++ b/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md @@ -61,6 +61,7 @@ This topic explains how to enable BitLocker on an end user's computer by using M | -------- | ----------- | | RecoveryServiceEndPoint | A string specifying the MBAM recovery service endpoint. | +Here are a list of common error messages: | Common return values | Error message | | -------------------- | ------------- | @@ -84,6 +85,7 @@ This topic explains how to enable BitLocker on an end user's computer by using M | --------- | ----------- | | ReportingServiceEndPoint | A string specifying the MBAM status reporting service endpoint. | + Here are a list of common error messages: | Common return values | Error message | | -------------------- | ------------- | @@ -102,6 +104,7 @@ This topic explains how to enable BitLocker on an end user's computer by using M | --------- | ----------- | | RecoveryServiceEndPoint | A string specifying the MBAM recovery service endpoint. | + Here are a list of common error messages: | Common return values | Error message | | -------------------- | ------------- | From c749eb36a5d49a6700db25c4dda4001b288ecd1e Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 4 May 2016 10:57:19 -0700 Subject: [PATCH 11/38] updating INF to remove SHA1 support --- .../keep-secure/bitlocker-how-to-enable-network-unlock.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md index 0ee061cb84..1c26ced248 100644 --- a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md +++ b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md @@ -196,7 +196,12 @@ To create a self-signed certificate, do the following: Exportable=true RequestType=Cert KeyUsage="CERT_KEY_ENCIPHERMENT_KEY_USAGE" + KeyUsageProperty="NCRYPT_ALLOW_DECRYPT_FLAG" KeyLength=2048 + Keyspec="AT_KEYEXCHANGE" + SMIME=FALSE + HashAlgorithm=sha512 + [Extensions] 1.3.6.1.4.1.311.21.10 = "{text}" From 37da37dc47360e34a77222d2d1fe7a8d71209108 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 4 May 2016 11:23:12 -0700 Subject: [PATCH 12/38] updating INF to remove SHA1 support --- .../bitlocker-how-to-enable-network-unlock.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md index 1c26ced248..20a2231f7e 100644 --- a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md +++ b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md @@ -196,12 +196,11 @@ To create a self-signed certificate, do the following: Exportable=true RequestType=Cert KeyUsage="CERT_KEY_ENCIPHERMENT_KEY_USAGE" - KeyUsageProperty="NCRYPT_ALLOW_DECRYPT_FLAG" + KeyUsageProperty="NCRYPT_ALLOW_DECRYPT_FLAG" KeyLength=2048 - Keyspec="AT_KEYEXCHANGE" - SMIME=FALSE - HashAlgorithm=sha512 - + Keyspec="AT_KEYEXCHANGE" + SMIME=FALSE + HashAlgorithm=sha512 [Extensions] 1.3.6.1.4.1.311.21.10 = "{text}" From 5b33ec53de6cad42956d91a21cd95c4835c98c7e Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 4 May 2016 13:27:11 -0700 Subject: [PATCH 13/38] LCA feedback --- ...figure-windows-telemetry-in-your-organization.md | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/windows/manage/configure-windows-telemetry-in-your-organization.md b/windows/manage/configure-windows-telemetry-in-your-organization.md index 6ee41267e4..5a94140e3b 100644 --- a/windows/manage/configure-windows-telemetry-in-your-organization.md +++ b/windows/manage/configure-windows-telemetry-in-your-organization.md @@ -35,11 +35,18 @@ For Windows 10, we invite IT pros to join the [Windows Insider Program](http:// ### Data collection -Data gathered by the Connected User Experience and Telemetry component complies with Microsoft’s [security and privacy policies](https://privacy.microsoft.com/privacystatement), as well as international laws and regulations. The principle of least privilege guides access to telemetry data. Only Microsoft personnel who can demonstrate a valid business need can access the telemetry data. +Windows 10 and Windows Server 2016 Technical Preview includes the Connected User Experience and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology to gather and store telemetry events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology. -### Data transfer +1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces. +2. Events are gathered using public operating system event logging and tracing APIs. +3. You can configure the telemetry level by using an MDM policy, Group Policy, or registry settings. +4. The Connected User Experience and Telemetry component transmits telemetry data over HTTPS to Microsoft and uses certificate pinning. -All telemetry data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks. +Info collected at the Enhanced and Full levels of telemetry is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels. + +### Data transmission + +All telemetry data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks. ### Endpoints From 2410347627825b45274abad5e0321a59c6545e5d Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 4 May 2016 13:37:37 -0700 Subject: [PATCH 14/38] tech review feedback --- windows/manage/TOC.md | 2 +- ...re-windows-telemetry-in-your-organization.md | 17 ++--------------- 2 files changed, 3 insertions(+), 16 deletions(-) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index 01c1c8c7de..983de4d62e 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -17,7 +17,7 @@ #### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) #### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md) -### [Disconnect your organization from Microsoft](disconnect-your-organization-from-microsoft.md) +### [Configure Windows 10 devices to stop data flow to Microsoft](disconnect-your-organization-from-microsoft.md) ### [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) ### [Configure access to Windows Store](stop-employees-from-using-the-windows-store.md) ### [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) diff --git a/windows/manage/configure-windows-telemetry-in-your-organization.md b/windows/manage/configure-windows-telemetry-in-your-organization.md index 5a94140e3b..58de9307b7 100644 --- a/windows/manage/configure-windows-telemetry-in-your-organization.md +++ b/windows/manage/configure-windows-telemetry-in-your-organization.md @@ -60,27 +60,14 @@ The Connected User Experience and Telemetry component also connects to settings- [Online Crash Analysis](http://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) connects to oca.telemetry.microsoft.com. -### Data usage +### Data use and access -Data gathered from telemetry is used by Microsoft teams primarily to improve our customer experiences, and for security, health, quality, and performance analysis. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the Privacy Statement. We do share business reports with OEMs and third party partners that includes aggregated, anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. Info is typically gathered at a fractional sampling rate, which can be as low as 1% of clients reporting data. +Data gathered from telemetry is used by Microsoft teams primarily to improve our customer experiences, and for security, health, quality, and performance analysis. The principle of least privileged guides access to telemetry data. Only Microsoft personnel with a valid business need are permitted access to the telemetry data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the Privacy Statement. We do share business reports with OEMs and third party partners that include aggregated, anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. ### Retention Microsoft believes in and practices information minimization. We strive to gather only the info we need, and store it for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Store purchase history. -## How is the data gathered? - - -Windows 10 and Windows Server 2016 Technical Preview includes the Connected User Experience and Telemetry component, which uses Event Tracing for Windows (ETW) [tracelogging](http://msdn.microsoft.com/library/dn904632.aspx) technology to gather and store telemetry events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology. - -1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces. - -2. Events are gathered using public operating system event logging and tracing APIs. - -3. You can configure the telemetry level by using an MDM policy, Group Policy, or registry settings. - -4. The Connected User Experience and Telemetry component transmits telemetry data over HTTPS to Microsoft and uses certificate pinning. - ## Telemetry levels From aaa50bcbfc666f4ede7dc2c54af88b9e904dda65 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 4 May 2016 13:47:50 -0700 Subject: [PATCH 15/38] removing telemetry section that was somehow added back --- ...onnect-your-organization-from-microsoft.md | 117 ------------------ 1 file changed, 117 deletions(-) diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index 9325fea667..03d1063632 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1271,120 +1271,3 @@ You can turn off automatic updates by doing one of the following. This is not re - **5**. Turn off automatic updates. To learn more, see [Device update management](http://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](http://technet.microsoft.com/library/cc720539.aspx). - -## Manage your telemetry settings - - -You can manage your telemetry settings using the management tools you're already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your telemetry levels through a management policy overrides any device-level settings. - -You can set your organization's devices to use 1 of 4 telemetry levels: - -- **Security** (only available on Windows 10 Enterprise, Windows 10 Education, and Windows 10 IoT Core (IoT Core) editions) - -- **Basic** - -- **Enhanced** - -- **Full** - -For more info about these telemetry levels, see [Telemetry levels](#bkmk-telemetrylevels). If you choose Express settings during installation, your device is configured for the Full telemetry level. In Windows 10 Enterprise, Windows 10 Education, and Windows 10 IoT Core, unattended installations configure your device for the Enhanced telemetry level. - -**Important**   -These telemetry levels only apply to Windows components and apps that use the Connected User Experience and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these telemetry levels. App publishers must let people know about how they use their telemetry, ways to opt in or opt out, and they must separately document their privacy policies. - -  - -### Use Group Policy to set the telemetry level - -Use a Group Policy object to set your organization’s telemetry level. - -1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**. - -2. Double-click **Allow Telemetry**. - -3. In the **Options** box, select the level that you want to configure, and then click **OK**. - -### Use MDM to set the telemetry level - -Use the [Policy Configuration Service Provider (CSP)](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy, using one of these telemetry values: - -- **0**. Maps to the **Security** level. - -- **1**. Maps to the **Basic** level. - -- **2**. Maps to the **Enhanced** level. - -- **3**. Maps to the **Full** level. - -### Use Windows Provisioning to set the telemetry level - -Use Windows Provisioning and the Windows Imaging and Configuration Designer (Windows ICD) tool - part of the [Windows Assessment and Deployment Kit (Windows ADK) toolkit](http://go.microsoft.com/fwlink/p/?LinkId=526803) - to create a provisioning package and runtime setting that sets your organization's telemetry level. - -After you create the provisioning package, you can email it to your employees, put it on a network share, or integrate the package directly into a custom image using Windows ICD. - -**To use Windows ICD to integrate your package into a custom image** - -1. Open Windows ICD, and then click **New provisioning package**. - -2. In the **Name** box, type a name for the provisioning package, and then click **Next**. - -3. Click **Common to all Windows editions** > **Next** > **Finish**. - -4. Go to **Runtime settings** > **Policies** > **System** > **AllowTelemetry** to configure the policies. You can set it to one of the following: - - - **Disabled \[Enterprise SKU Only\]**. Maps to the **Security** level. - - - **Basic**. Maps to the **Basic** level. - - - **Full**. Maps to the **Enhanced** level - - - **Diagnostic**. Maps to the **Full** level. - -5. After you've added all of your settings to the provisioning package, click **Export** > **Provisioning package**. - -6. On the **Describe the provisioning package** step, in the **Owner** box, click **IT Admin** > **Next**. - -7. On the **Select security details for the provisioning package** step, if you want to protect the package with a password, select the **Encrypt package** check box. If you'd like to sign the package with a certificate, select the **Sign package** check box and select the certificate to use. Click **Next**. - -8. On the **Select where to save the provisioning package** step, if you want to save it somewhere other than the Windows ICD project folder, choose a new location, and then click **Next**. - -9. On the **Build the provisioning package** step, click **Build**. - -### Use Registry Editor to set the telemetry level - -Use Registry Editor to manually set the registry level on each device in your organization, or write a script to edit the registry. - -If a management policy already exists (from Group Policy, MDM, or Windows Provisioning), it will override this registry setting. - -1. Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection**. - -2. Right-click **DataCollection**, click **New**, and then click **DWORD (32-bit) Value**. - -3. Type **AllowTelemetry**, and then press ENTER. - -4. Double-click **AllowTelemetry** and set the value to one of the following levels, and the click **OK**. - - - **0**. This setting maps to the **Security** level. - - - **1**. This setting maps to the **Basic** level. - - - **2**. This setting maps to the **Enhanced** level - - - **3**. This setting maps to the **Full** level. - -5. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization. - -### Additional telemetry controls - -There are a few more settings that you can turn off that may send telemetry information: - -- To turn off Windows Update telemetry, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](http://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/). - -- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**. - -- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716). - -- Turn off Linguistic Data Collection in **Settings** > **Privacy**. At telemetry levels Enhanced and Full, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary. For more info, see the **Get to know me** setting in the [Speech, inking, & typing](#bkmk-priv-speech) section of this article and the **Send Microsoft info about how I write to help us improve typing and writing in the future** setting in the [General](#bkmk-priv-general) section of this article. - - **Note**   - Microsoft doesn't intentionally gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information. \ No newline at end of file From 9c793e2ef4f0bba911e7e1a180f87299fafc4a3b Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 4 May 2016 14:27:34 -0700 Subject: [PATCH 16/38] new content --- windows/plan/deploy-windows-10-in-a-school.md | 1251 +++++++++++++++++ .../images/deploy-win-10-school-figure1.png | Bin 0 -> 46486 bytes .../images/deploy-win-10-school-figure2.png | Bin 0 -> 61301 bytes .../images/deploy-win-10-school-figure3.png | Bin 0 -> 131013 bytes .../images/deploy-win-10-school-figure4.png | Bin 0 -> 18525 bytes .../images/deploy-win-10-school-figure5.png | Bin 0 -> 9897 bytes .../images/deploy-win-10-school-figure6.png | Bin 0 -> 18525 bytes .../images/deploy-win-10-school-figure7.png | Bin 0 -> 80870 bytes 8 files changed, 1251 insertions(+) create mode 100644 windows/plan/deploy-windows-10-in-a-school.md create mode 100644 windows/plan/images/deploy-win-10-school-figure1.png create mode 100644 windows/plan/images/deploy-win-10-school-figure2.png create mode 100644 windows/plan/images/deploy-win-10-school-figure3.png create mode 100644 windows/plan/images/deploy-win-10-school-figure4.png create mode 100644 windows/plan/images/deploy-win-10-school-figure5.png create mode 100644 windows/plan/images/deploy-win-10-school-figure6.png create mode 100644 windows/plan/images/deploy-win-10-school-figure7.png diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md new file mode 100644 index 0000000000..3627aaab6b --- /dev/null +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -0,0 +1,1251 @@ +--- +title: Deploy Windows 10 in a school (Windows 10) +description: Learn how to integrate your school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD). Deploy Windows 10 and apps to new devices or upgrade existing devices to Windows 10. Manage faculty, students, and devices by using Microsoft Intune and Group Policy. +ms.assetid: +keywords: ["configure", "tools", "device", "school"] +ms.prod: w10 +ms.mktglfcycl: plan +ms.pgtyp: edu +ms.sitesec: library +author: craigash +--- + +# Deploy Windows 10 in a school + + +**Applies to** + +- Windows 10 + +This guide shows you how to deploy the Windows 10 operating system in a school environment. You learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. This guide also describes how to use Microsoft Intune and Group Policy to manage devices. Finally, the guide discusses common, ongoing maintenance tasks that you will perform after initial deployment as well as the automated tools and built-in features of the operating system. + +## Prepare for school deployment + +Proper preparation is essential for a successful school deployment. To avoid common mistakes, your first step is to plan a typical school configuration. Just as with building a house, you need a blueprint for what your school should look like when it’s finished. The second step in preparation is to learn how you will configure your school. Just as a builder needs to have the right tools to build a house, you need the right set of tools to deploy your school. + +### Plan a typical school configuration + +As part of preparing for your school deployment, you need to plan your configuration—the focus of this guide. Figure 1 illustrates a typical finished school configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. + +![fig 1](images/deploy-win-10-school-figure1.png) + +*Figure 1. Typical school configuration for this guide* + +Figure 2 shows the classroom configuration this guide uses. + +![fig 2](images/deploy-win-10-school-figure2.png) + +*Figure 2. Typical classroom configuration in a school* + +This school configuration has the following characteristics: +
    +
  • It contains one or more admin devices.
    • +
  • It contains two or more classrooms.
    • +
  • Each classroom contains one teacher device.
    • +
  • The classrooms connect to each other through multiple subnets.
    • +
  • All devices in each classroom connect to a single subnet.
    • +
  • All devices have high-speed, persistent connections to each other and to the Internet.
    • +
  • All teachers and students have access to Windows Store or Windows Store for Business.
    • +
  • All devices receive software updates from Intune (or another device management system).
    • +
  • You install a 64-bit version of Windows 10 on the admin device.
    • +
  • You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device.
    • +
  • You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device.
    • +
  • You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 1 on the admin device.
    +**Note**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 1. +
    • +
  • The devices use Azure AD in Office 365 Education for identity management.
    • +
  • If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/).
    • +
  • Use [Intune](http://technet.microsoft.com/library/jj676587.aspx), [compliance settings in Office 365](https://support.office.com/en-us/article/Manage-mobile-devices-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy](http://technet.microsoft.com/en-us/library/cc725828%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396) in AD DS to manage devices.
    • +
  • Each device supports a one-student-per-device or multiple-students-per-device scenario.
    • +
  • The devices can be a mixture of different make, model, and processor architecture (32 bit or 64 bit) or be identical.
    • +
  • To initiate Windows 10 deployment, use a USB flash drive, DVD-ROM or CD-ROM, or Pre-Boot Execution Environment Boot (PXE Boot).
    • +
  • The devices can be a mixture of different Windows 10 editions, such as Windows 10 Home, Windows 10 Pro, and Windows 10 Education.
    • +
+ +Office 365 Education allows: + +- Students and faculty to use Microsoft Office Online to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser. +- Teachers to use the [OneNote Class Notebook app](https://www.onenote.com/classnotebook) to share content and collaborate with students. +- Faculty to use the [OneNote Staff Notebooks app](https://www.onenote.com/staffnotebookedu) to collaborate with other teachers, administration, and faculty. +- Teachers to employ Sway to create interactive educational digital storytelling. +- Students and faculty to use email and calendars, with mailboxes up to 50 GB per user. +- Faculty to use advanced email features like email archiving and legal hold capabilities. +- Faculty to help prevent unauthorized users from accessing documents and email by using Azure Rights Management. +- Faculty to use advanced compliance tools on the unified eDiscovery pages in the Office 365 Compliance Center. +- Faculty to host online classes, parent–teacher conferences, and other collaboration in Skype for Business or Skype. +- Students and faculty to access up to 1 TB of personal cloud storage that users inside and outside the educational institution can share through OneDrive for Business. +- Teachers to provide collaboration in the classroom through Microsoft SharePoint Online team sites. +- Students and faculty to use Office 365 Video to manage videos. +- Students and faculty to use Yammer to collaborate through private social networking. +- Students and faculty to access classroom resources from anywhere on any device (including Windows 10 Mobile, iOS, and Android devices). + +For more information about Office 365 Education features and a FAQ, go to [Office 365 Education](https://products.office.com/en-us/academic). + +## How to configure a school + +Now that you have the plan (blueprint) for your classroom, you’re ready to learn about the tools you will use to deploy it. There are many tools you could use to accomplish the task, but this guide focuses on using those tools that require the least infrastructure and technical knowledge. + +The primary tool you will use to deploy Windows 10 in your school is MDT, which uses Windows ADK components to make deployment easier. You could just use the Windows ADK to perform your deployment, but MDT simplifies the process by providing an intuitive, wizard-driven user interface (UI). + +You can use MDT as a stand-alone tool or integrate it with Microsoft System Center Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with System Center Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as System Center Configuration Manager) but result in fully automated deployments. + +MDT includes the Deployment Workbench—a console from which you can manage the deployment of Windows 10 and your apps. You configure the deployment process in the Deployment Workbench, including the management of operating systems, device drivers, apps and migration of user settings on existing devices. + +LTI performs deployment from a *deployment share*—a network-shared folder on the device where you installed MDT. You can perform over-the-network deployments from the deployment share or perform deployments from a local copy of the deployment share on a USB drive or DVD. You will learn more about MDT in the [Prepare the admin device](#prepare-the-admin-device) section. + +The focus of MDT is deployment, so you also need tools that help you manage your Windows 10 devices and apps. You can manage Windows 10 devices and apps with Intune, the Compliance Management feature in Office 365, or Group Policy in AD DS. You can use any combination of these tools based on your school requirements. + +The configuration process requires the following devices: + +- **Admin device.** This is the device you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK and MDT on this device. +- **Faculty devices.** These are the devices that the teachers and other faculty use for their day-to-day job functions. You use the admin device to deploy (or upgrade) Windows 10 and apps to these devices. +- **Student devices.** The students will use these devices. You will use the admin device deploy (or upgrade) Windows 10 and apps to them. + +The high-level process for deploying and configuring devices within individual classrooms and the school as a whole is as follows and illustrated in Figure 3: + +1. Prepare the admin device for use, which includes installing the Windows ADK and MDT. +2. On the admin device, create and configure the Office 365 Education subscription that you will use for each classroom in the school. +3. On the admin device, configure integration between on-premises AD DS and Azure AD (if you have an on premises AD DS configuration). +4. On the admin device, create and configure a Windows Store for Business portal. +5. On the admin device, prepare for management of the Windows 10 devices after deployment. +6. On the student and faculty devices, deploy Windows 10 to new or existing devices, or upgrade eligible devices to Windows 10. +7. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS and Azure AD integration. + +![fig 3](images/deploy-win-10-school-figure3.png) + +*Figure 3. How school configuration works* + +Each of the steps illustrated in Figure 3 directly correspond to the remaining high-level sections in this guide. + +### Summary + +In this section, you looked at the final configuration of your individual classrooms and the school as a whole upon completion of this guide. You also learned the high-level steps you need to perform to deploy the faculty and student devices in your school. + +## Prepare the admin device + +Now, you’re ready to prepare the admin device for use in the school. This process includes installing the Windows ADK, installing the MDT, and creating the MDT deployment share. + +### Install the Windows ADK + +The first step in preparing the admin device is to install the Windows ADK. The Windows ADK contains the deployment tools that MDT uses, including the Windows Preinstallation Environment (Windows PE), the Windows User State Migration Tool (USMT), and Deployment Image Servicing and Management. + +When you install the Windows ADK on the admin device, select the following features: + +- Deployment tools +- Windows Preinstallation Environment (Windows PE) +- User State Migration Tool (USMT) + +For more information about installing the Windows ADK, see [Step 2-2: Install the Windows ADK](http://technet.microsoft.com/en-us/library/dn781086.aspx?f=255&MSPPError=-2147217396#InstallWindowsADK). + +### Install MDT + +Next, install MDT. MDT uses the Windows ADK to help you manage and perform Windows 10 and app deployment and is a free tool available directly from Microsoft. + +You can use MDT to deploy 32-bit or 64-bit versions of Windows 10. Install the 64-bit version of MDT to support deployment of 32-bit and 64-bit operating systems. + +**Note**  If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32 bit versions of the operating system. + +For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](https://technet.microsoft.com/en-us/library/dn759415.aspx#InstallingaNewInstanceofMDT). + +Now, you’re ready to create the MDT deployment share and populate it with the operating system, apps, and device drivers you want to deploy to your devices. + +### Create a deployment share + +MDT includes the Deployment Workbench, a graphical user interface that you can use to manage MDT deployment shares. A deployment share is a shared folder that contains all the MDT deployment content. The LTI Deployment Wizard accesses the deployment content over the network or from a local copy of the deployment share (known as MDT deployment media). + +For more information about how to create a deployment share, see [Step 3-1: Create an MDT Deployment Share](http://technet.microsoft.com/en-us/library/dn781086.aspx?f=255&MSPPError=-2147217396#CreateMDTDeployShare). + +### Summary + +In this section, you installed the Windows ADK and MDT on the admin device. You also created the MDT deployment share that you will configure and use later in the LTI deployment process. + +## Create and configure Office 365 + +Office 365 is one of the core components of your classroom environment. You create and manage student identities in Office 365, and students and teachers use the suite as their email, contacts, and calendar system. Teachers and students use Office 365 collaboration features such as SharePoint, OneNote, and OneDrive for Business. + +As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](http://www.microsoft.com/en-us/education/products/office-365-deployment-resources/default.aspx). + +### Select the appropriate Office 365 Education license plan + +Complete the following steps to select the appropriate Office 365 Education license plan for your school: + +1. Determine the number of faculty members and students who will use the classroom. + + Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan. + +2. Determine the faculty members and students who need to install Office applications on devices (if any). + + Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans. + +*Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans* + + + +| Plan | Advantages | Disadvantages | +| ---------------|:------------- | :--------------| +| Standard |
  • Less expensive than Office 365 ProPlus
  • Can be run from any device
  • No installation necessary
|
  • Must have an Internet connection to use it
  • Does not support all the features found in Office 365 ProPlus
| +| Office ProPlus |
  • Only requires an Internet connection every 30 days (for activation)
  • Supports full set of Office features
|
  • Requires installation
  • Can be installed on only five devices per user (there is no limit to the number of devices on which you can run Office apps online)
| + +The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. + +3. Determine whether students or faculty need Azure Rights Management. + + You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management](https://technet.microsoft.com/library/jj585024.aspx). + +4. Record the Office 365 Education license plans needed for the classroom in Table 2. + +*Table 2. Office 365 Education license plans needed for the classroom* + +|Quantity | Plan | +| ---| ----------- | +| | Office 365 Education for students | +| | Office 365 Education for faculty | +| | Azure Rights Management for students | +| | Azure Rights Management for faculty | + +You will use the Office 365 Education license plan information you record in Table 2 in the [Create user accounts in Office 365](#create-user-accounts-in-office-365) section of this guide. + +### Create a new Office 365 Education subscription + +To create a new Office 365 Education subscription for use in the classroom, use your educational institution’s email account. There are no costs to you or to students for signing up for Office 365 Education subscriptions. + +**Note**  If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Add domains and subdomains](#add-domains-and-subdomains). + +#### To create a new Office 365 subscription + +1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar. + **Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window in one of the following: + - Microsoft Edge by opening the Microsoft Edge app, either pressing Ctrl+Shift+P or clicking or tapping **More actions**, and then clicking or tapping **New InPrivate window**. + - Internet Explorer 11 by opening Internet Explorer 11, either pressing Ctrl+Shift+P or clicking or tapping **Settings**, clicking or tapping **Safety**, and then clicking or tapping **InPrivate Browsing**. +2. On the **Get started** page, type your school email address in the **Enter your school email address** box, and then click **Sign up**. You will receive an email in your school email account. +3. Click the hyperlink in the email in your school email account. +4. On the **One last thing** page, complete your user information, and then click **Start**. The wizard creates your new Office 365 Education subscription, and you are automatically signed in as the administrative user you specified when you created the subscription. + +### Add domains and subdomains + +Now that you have created your new Office 365 Education subscription, add the domains and subdomains that your institution uses. For example, if your institution has `contoso.edu` as the primary domain name but you have subdomains for students or faculty (such as `students.contoso.edu` and `faculty.contoso.edu`), then you need to add the subdomains. + +#### To add additional domains and subdomains + +1. In the Office 365 admin center, in the list view, click **DOMAINS**. +2. In the details pane, above the list of domains, on the menu bar, click **Add domain**. +3. In the Add a New Domain in Office 365 Wizard, on the **Verify domain wizard** page, click **Let’s get started**. +4. On the **Verify domain** wizard page, in the **Enter a domain you already own** box, type your domain name, and then click **Next**. +5. Sign in to your domain name management provider (for example, Network Solutions or GoDaddy), and then complete the steps for your provider. +6. Repeat these steps for each domain and subdomain you want faculty and students to use for your institution. + +### Configure automatic tenant join + +To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant. + +**Note**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries require opt-in steps to add new users to existing Office 365 tenants. Check your country requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. + +Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of `user@contoso.edu`, then Office 365 automatically performs one of the following tasks: + +- If an Office 365 tenant with that domain name (`contoso.edu`) exists, Office 365 automatically adds the user to that tenant. +- If an Office 365 tenant with that domain name (`contoso.edu`) does not exists, Office 365 automatically creates a new Office 365 tenant with that domain name and adds the user to it. + +You will always want faculty and students to join the Office 365 tenant that you created. Ensure that you perform the steps in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) and [Add domains and subdomains](#add-domains-and-subdomains) sections before allowing other faculty and students to join Office 365. + +**Note**  You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. + +All new Office 365 Education subscriptions have automatic tenant join enabled by default, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 3. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). + +*Table 3. Windows PowerShell commands to enable or disable Automatic Tenant Join* + + +| Action | Windows PowerShell command | +|------- |----------------------------| +| Enable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $true`| +| Disable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $false`| + +**Note**  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. + +### Disable automatic licensing + +To reduce your administrative effort, automatically assign Office 365 Education or Office 365 Education Plus licenses to faculty and students when they sign up (automatic licensing). Automatic licensing also enables Office 365 Education or Office 365 Education Plus features that do not require administrative approval. + +**Note**  By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. + +Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 4. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). + +*Table 4. Windows PowerShell commands to enable or disable automatic licensing* + +| Action | Windows PowerShell command| +| -------| --------------------------| +| Enable |`Set-MsolCompanySettings -AllowAdHocSubscriptions $true`| +|Disable | `Set-MsolCompanySettings -AllowAdHocSubscriptions $false`| + +### Enable Azure AD Premium + +When you create your Office 365 subscription, you create an Office 365 tenant that includes an Azure AD directory. Azure AD is the centralized repository for all your student and faculty accounts in Office 365, Intune, and other Azure AD–integrated apps. Azure AD is available in Free, Basic, and Premium editions. Azure AD Free, which is included in Office 365 Education, has fewer features than Azure AD Basic, which in turn has fewer features than Azure AD Premium. + +Educational institutions can obtain Azure AD Basic edition licenses at no cost. After you obtain your licenses, activate your Azure AD access by completing the steps in [Step 3: Activate your Azure Active Directory access](https://azure.microsoft.com/en-us/documentation/articles/active-directory-get-started-premium/#step-3-activate-your-azure-active-directory-access). + +The Azure AD Premium features that are not in Azure AD Basic include: + +- Allow designated users to manage group membership +- Dynamic group membership based on user metadata +- Multifactor authentication (MFA) +- Identify cloud apps that your users run +- Automatic enrollment in a mobile device management (MDM) system (such as Intune) +- Self-service recovery of BitLocker +- Add local administrator accounts to Windows 10 devices +- Azure AD Connect health monitoring +- Extended reporting capabilities + +You can assign Azure AD Premium licenses to the users who need these features. For example, you may want the users who have access to confidential student information to use MFA. In this example, you could assign Azure AD Premium to only those users. + +You can sign up for Azure AD Premium, and then assign licenses to users. In this section, you sign up for Azure AD Premium. You will assign Azure AD Premium licenses to users later in the deployment process. + +For more information about: + +- Azure AD editions and the features in each, see [Azure Active Directory editions](https://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/). +- How to enable Azure AD premium, see [Associate an Azure AD directory with a new Azure subscription](https://msdn.microsoft.com/en-us/library/azure/jj573650.aspx#create_tenant3). + +### Summary +You provision and initially configure Office 365 Education as part of the initial configuration. With the subscription in place, automatic tenant join configured, automatic licensing established, and Azure AD Premium enabled (if required), you’re ready to select the method you will use to create user accounts in Office 365. + +## Select an Office 365 user account–creation method + + +Now that you have an Office 365 subscription, you need to determine how you will create your Office 365 user accounts. Use the following methods to create Office 365 user accounts: + +- **Method 1:** Automatically synchronize your on-premises AD DS domain with Azure AD. Select this method if you have an on-premises AD DS domain. +- **Method 2:** Bulk-import the user accounts from a .csv file (based on information from other sources) into Azure AD. Select this method if you don’t have an on-premises AD DS domain. + +### Method 1: Automatic synchronization between AD DS and Azure AD + +In this method, you have an on-premises AD DS domain. As shown in Figure 4, the Azure AD Connector tool automatically synchronizes AD DS with Azure AD. When you add or change any user accounts in AD DS, the Azure AD Connector tool automatically updates Azure AD. + +**Note**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/en-us/library/dn510997.aspx?f=255&MSPPError=-2147217396). + +![fig 4](images/deploy-win-10-school-figure4.png) + +*Figure 4. Automatic synchronization between AD DS and Azure AD* + +For more information about how to perform this step, see the [Integrate on-premises AD DS with Azure AD](#integrate-on-premises-ad-ds-with-azure-ad) section in this guide. + +### Method 2: Bulk import into Azure AD from a .csv file + +In this method, you have no on-premises AD DS domain. As shown in Figure 5, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies. + +![fig 5](images/deploy-win-10-school-figure5.png) + +*Figure 5. Bulk import into Azure AD from other sources* + +To implement this method, perform the following steps: + +1. Export the student information from the source. Ultimately, you want to format the student information in the format the bulk-import feature requires. +2. Bulk-import the student information into Azure AD. For more information about how to perform this step, see the [Bulk-import user accounts into Office 365](#bulk-import-user-accounts-into-office-365) section. + +### Summary + +In this section, you selected the method for creating user accounts in your Office 365 subscription. Ultimately, these user accounts are in Azure AD (which is the identity management system for Office 365). Now, you’re ready to create your Office 365 accounts. + +## Integrate on-premises AD DS with Azure AD + +You can integrate your on-premises AD DS domain with Azure AD to provide identity management for your Office 365 tenant. With this integration, you can synchronize the users, security groups, and distribution lists in your AD DS domain with Azure AD with the Azure AD Connect tool. Users will be able to sign in to Office 365 automatically by using their email account and the same password they use to sign in to AD DS. + +**Note**  If your institution does not have an on-premises AD DS domain, you can skip this section. + +### Select synchronization model + +Before you deploy AD DS and Azure AD synchronization, you need to determine where you want to deploy the server that runs Azure AD Connect. + +You can deploy the Azure AD Connect tool by using one of the following methods: + +- **On premises.** As shown in Figure 6, Azure AD Connect runs on premises, which has the advantage of not requiring a virtual private network (VPN) connection to Azure. It does, however, require a virtual machine (VM) or physical server. + + ![fig 6](images/deploy-win-10-school-figure6.png) + + *Figure 6. Azure AD Connect on premises* + +- **In Azure**. As shown in Figure 7, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. + + ![fig 7](images/deploy-win-10-school-figure7.png) + + *Figure 7. Azure AD Connect in Azure* + +This guide describes how to run Azure AD Connect on premises. For information about running Azure AD Connect in Azure, see [Deploy Office 365 Directory Synchronization (DirSync) in Microsoft Azure](https://technet.microsoft.com/en-us/library/dn635310.aspx). + +### Deploy Azure AD Connect on premises + +In this synchronization model (illustrated in Figure 6), you run Azure AD Connect on premises on a physical device or VM. Azure AD Connect synchronizes AD DS user and group accounts with Azure AD. Azure AD Connect includes a wizard that helps you configure Azure AD Connect for your AD DS domain and Office 365 subscription. First, you install Azure AD Connect; then, you run the wizard to configure it for your institution. + +#### To deploy AD DS and Azure AD synchronization + +1. Configure your environment to meet the prerequisites for installing Azure AD Connect by performing the steps in [Prerequisites for Azure AD Connect](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect-prerequisites/). +2. On the VM or physical device that will run Azure AD Connect, sign in with a domain administrator account. +3. Install Azure AD Connect by performing the steps in [Install Azure AD Connect](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/#install-azure-ad-connect). +4. Configure Azure AD Connect features based on your institution’s requirements by performing the steps in [Configure features](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/#configure-features). + +Now that you have used on premises Azure AD Connect to deploy AD DS and Azure AD synchronization, you’re ready to verify that Azure AD Connect is synchronizing AD DS user and group accounts with Azure AD. + +### Verify synchronization + +Azure AD Connect should start synchronization immediately. Depending on the number of users in your AD DS domain, the synchronization process can take some time. To monitor the process, view the number of AD DS users and groups the tool has synchronized with Azure AD in the Office 365 admin console. + +#### To verify AD DS and Azure AD synchronization + +1. Open https://portal.office.com in your web browser. +2. Using the administrative account that you created in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) section, sign in to Office 365. +3. In the list view, expand **USERS**, and then click **Active Users**. +4. In the details pane, view the list of users. The list of users should mirror the users in AD DS. +5. In the list view, click **GROUPS**. +6. In the details pane, view the list of security groups. The list of users should mirror the security groups in AD DS. +7. In the details pane, double-click one of the security groups. +8. The list of security group members should mirror the group membership for the corresponding security group in AD DS. +9. Close the browser. + +Now that you have verified Azure AD Connect synchronization, you’re ready to assign user licenses for Azure AD Premium. + +### Summary + +In this section, you selected your synchronization model, deployed Azure AD Connect, and verified that Azure AD is synchronizing properly. + +## Bulk-import user and group accounts into AD DS + +You can bulk-import user and group accounts into your on-premises AD DS domain. Bulk-importing accounts helps reduce the time and effort needed to create users compared to creating the accounts manually in the Office 365 Admin portal. First, you select the appropriate method for bulk-importing user accounts into AD DS. Next, you create the .csv file that contains the user accounts. Finally, you use the selected method to import the .csv file into AD DS. + +**Note**  If your institution doesn’t have an on-premises AD DS domain, you can skip this section. + +### Select the bulk import method + +Several methods are available to bulk-import user accounts into AD DS domains. Table 5 lists the methods that the Windows Server operating system supports natively. In addition, you can use partner solutions to bulk-import user and group accounts into AD DS. + +*Table 5. AD DS bulk-import account methods* + +|Method | Description and reason to select this method | +|-------| ---------------------------------------------| +|Ldifde.exe |This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| +|VBScript | This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx) and [ADSI Scriptomatic](https://technet.microsoft.com/en-us/scriptcenter/dd939958.aspx).| +|Windows PowerShell| This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| + +### Create a source file that contains the user and group accounts + +After you have selected your user and group account bulk import method, you’re ready to create the source file that contains the user and group account. You’ll use the source file as the input to the import process. The source file format depends on the method you selected. Table 6 lists the source file format for the bulk import methods. + +*Table 6. Source file format for each bulk import method* + +| Method | Source file format | +|--------| -------------------| +|Ldifde.exe|Ldifde.exe requires a specific format for the source file. Use Ldifde.exe to export existing user and group accounts so that you can see the format. For examples of the format that Ldifde.exe requires, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| +|VBScript | VBScript can use any .csv file format to create a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in comma-separated values (CSV) format, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx).| +| Windows PowerShell| Windows PowerShell can use any .csv file format you want to create as a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in CSV format, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| + +### Import the user accounts into AD DS + +With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method. + +**Note**  Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. + +For more information about how to import user accounts into AD DS by using: + +- Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx). +- VBScript, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx). +- Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). + +### Summary + +In this section, you selected the bulk-import method, created the source file that contains the user and group accounts, and imported the user and group accounts in to AD DS. If you have Azure AD Connect, it automatically synchronizes the new AD DS user and group accounts to Azure AD. Now, you’re ready to assign user licenses for Azure AD Premium in the [Assign user licenses for Azure AD Premium](#assign-user-licenses-for-azure-ad-premium) section later in this guide. + +## Bulk-import user accounts into Office 365 + +You can bulk-import user and group accounts directly into Office 365, reducing the time and effort required to create users. First, you bulk-import the user accounts into Office 365. Then, you create the security groups for your institution. Finally, you create the email distribution groups your institution requires. + +### Create user accounts in Office 365 + +Now that you have created your new Office 365 Education subscription, you need to create user accounts. You can add user accounts for the teachers, other faculty, and students who will use the classroom. + +You can use the Office 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you have many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users). + +The bulk-add process assigns the same Office 365 Education license plan to all users on the list. Therefore, you must create a separate list for each license plan you recorded in Table 2. Depending on the number of faculty members who need to use the classroom, you may want to add the faculty Office 365 accounts manually; however, use the bulk-add process to add student accounts. + +For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Office 365](https://support.office.com/en-us/article/Add-several-users-at-the-same-time-to-Office-365-Admin-Help-1f5767ed-e717-4f24-969c-6ea9d412ca88?ui=en-US&rs=en-US&ad=US). + +**Note**  If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. + +The email accounts are assigned temporary passwords upon creation. You must communicate these temporary passwords to your users before they can sign in to Office 365. + +### Create Office 365 security groups + +Assign SharePoint Online resource permissions to Office 365 security groups, not individual user accounts. For example, create one security group for faculty members and another for students. Then, you can assign unique SharePoint Online resource permissions to faculty members and a different set of permissions to students. Add or remove users from the security groups to grant or revoke access to SharePoint Online resources. + +**Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. + +For information about creating security groups, see Create and manage Office 365 groups in Admin Center Preview. + +You can add and remove users from security groups at any time. + +**Note**  Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may need to sign out, and then sign in again for the change to take effect. + +### Create email distribution groups + +Microsoft Exchange Online uses an email distribution group as a single email recipient for multiple users. For example, you could create an email distribution group that contains all students. Then, you could send a message to the email distribution group instead of individually addressing the message to each student. + +You can create email distribution groups based on job role (such as teachers, administration, or students) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group. + +**Note**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until Office 365 completes the Exchange Online creation process before you can perform the following steps. + +For information about how to create security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). + +### Summary + +Now, you have bulk-imported the user accounts into Office 365. First, you selected the bulk-import method. Next, you created the Office 365 security groups in Office 365. Finally, you created the Office 365 email distribution groups. Now, you’re ready to assign user licenses for Azure AD Premium. + +## Assign user licenses for Azure AD Premium + +Azure AD is available in Free, Basic, and Premium editions. Azure AD Free, which is included in Office 365 Education, has fewer features than Azure AD Basic, which in turn has fewer features than Azure AD Premium. Educational institutions can obtain Azure AD Basic licenses at no cost and Azure AD Premium licenses at a reduced cost. + +You can assign Azure AD Premium licenses to the users who need the features this edition offers. For example, you may want the users who have access to confidential student information to use MFA. In this example, you could assign Azure AD Premium only to those users. + +For more information about: + +- Azure AD editions, see [Azure Active Directory editions](https://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/). +- How to assign user licenses for Azure AD Premium, see [How to assign EMS/Azure AD Premium licenses to user accounts](https://channel9.msdn.com/Series/Azure-Active-Directory-Videos-Demos/How-to-assign-Azure-AD-Premium-Licenses-to-user-accounts). + +## Create and configure a Windows Store for Business portal + +Windows Store for Business allows you to create your own private portal to manage Windows Store apps in your institution. With Windows Store for Business, you can do the following: + +- Find and acquire Windows Store apps. +- Manage apps, app licenses, and updates. +- Distribute apps to your users. + +For more information about Windows Store for Business, see [Windows Store for Business overview](https://technet.microsoft.com/itpro/windows/whats-new/windows-store-for-business-overview). + +The following section shows you how to create a Windows Store for Business portal and configure it for your school. + +### Create and configure your Windows Store for Business portal + +To create and configure your Windows Store for Business portal, simply use the administrative account for your Office 365 subscription to sign in to Windows Store for Business. Windows Store for Business automatically creates a portal for your institution and uses your account as its administrator. + +#### To create and configure a Windows Store for Business portal + +1. In Microsoft Edge or Internet Explorer, type `http://microsoft.com/business-store` in the address bar. +2. On the **Windows Store for Business** page, click **Sign in with an organizational account**.

**Note**  If your institution has AD DS, then don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. +3. On the Windows Store for Business sign-in page, use the administrative account for the Office 365 subscription you created in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) section to sign in. +4. On the **Windows Store for Business Services Agreement** page, review the agreement, select the **I accept this agreement and certify that I have the authority to bind my organization to its terms** check box, and then click **Accept** +5. In the **Welcome to the Windows Store for Business** dialog box, click **OK**. + +After you create the Windows Store for Business portal, configure it by using the commands in the settings menu listed in Table 7. Depending on your institution, you may (or may not) need to change these settings to further customize your portal. + +*Table 7. Menu selections to configure Windows Store for Business settings* + +| Method | What you can do in this menu | +|---------------| -------------------| +|Account information|Displays information about your Windows Store for Business account (no settings can be changed). You make changes to this information in Office 365 or the Azure Portal. For more information, see [Update Windows Store for Business account settings](https://technet.microsoft.com/itpro/windows/manage/update-windows-store-for-business-account-settings).| +|Device Guard signing|Allows you to upload and sign Device Guard catalog and policy files. For more information about Device Guard, see [Device Guard deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide).| +|LOB publishers| Allows you to add line-of-business (LOB) publishers that can then publish apps to your private store. LOB publishers are usually internal developers or software vendors that are working with your institution. For more information, see [Working with line-of-business apps](https://technet.microsoft.com/itpro/windows/manage/working-with-line-of-business-apps).| +|Management tools| Allows you to add tools that you can use to distribute (deploy) apps in your private store. For more information, see [Distribute apps with a management tool](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-with-management-tool).| +|Offline licensing|Allows you to show (or not show) offline licensed apps to people shopping in your private store. For more information, see [Licensing model: online and offline licenses](https://technet.microsoft.com/itpro/windows/manage/apps-in-windows-store-for-business#licensing_model).| +|Permissions|Allows you to grant other users in your organization the ability to buy, manage, and administer your Windows Store for Business portal. You can also remove permissions you have previously granted. For more information, see [Roles and permissions in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business).| +|Private store|Allows you to change the organization name used in your Windows Store for Business portal. When you create your portal, the private store uses the organization name that you used to create your Office 365 subscription. For more information, see [Distribute apps using your private store](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-from-your-private-store).| + +### Find, acquire, and distribute apps in the portal + +Now that you have created your Windows Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this by using the Inventory page in Windows Store for Business. + +**Note**  Your educational institution can now use a credit card or purchase order to pay for apps in Windows Store for Business. + +You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users. + +For more information about how to find, acquire, and distribute apps in the portal, see [App inventory management for Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/app-inventory-managemement-windows-store-for-business). + +### Summary + +At the end of this section, you should have a properly configured Windows Store for Business portal. You have also found and acquired your apps from Windows Store. Finally, you should have deployed all your Windows Store apps to your users. Now, you’re ready to deploy Windows Store apps to your users. + +## Plan for deployment + +You will use the LTI deployment process in MDT to deploy Windows 10 to devices or to upgrade devices to Windows 10. Prior to preparing for deployment, you must make some deployment planning decisions, including selecting the operating systems you will use, the approach you will use to create your Windows 10 images, and the method you will use to initiate the LTI deployment process. + +### Select the operating systems + +Later in the process, you will import the versions of Windows 10 you want to deploy. You can deploy the operating system to new devices, refresh existing devices, or upgrade existing devices. In the case of: + +- New devices or refreshing existing devices, you will complete replace the existing operating system on a device with Windows 10. +- Upgrading existing devices, you will upgrade the existing operating system (the Windows 8.1 or Windows 7 operating system) to Windows 10. + +Depending on your school’s requirements, you may need any combination of the following Windows 10 editions: + +- **Windows 10 Home**. Use this operating system to upgrade existing eligible institution-owned and personal devices that are running Windows 8.1 Home or Windows 7 Home to Windows 10 Home. +- **Windows 10 Pro**. Use this operating system to: + - Upgrade existing eligible institution-owned and personal devices running Windows 8.1 Pro or Windows 7 Professional to Windows 10 Pro. + - Deploy new instances of Windows 10 Pro to devices so that new devices have a known configuration. +- **Windows 10 Education**. Use this operating system to: + - Upgrade institution-owned devices to Windows 10 Education. + - Deploy new instances of Windows 10 Education so that new devices have a known configuration. + +**Note**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Windows Store for Business. These features are not available in Windows 10 Home. + +One other consideration is the mix of processor architectures you will support. If you can, support only 64-bit versions of Windows 10. If you have devices that can run only 32 bit versions of Windows 10, you will need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above. + +**Note**  On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. + +Finally, as a best practice, minimize the number of operating systems that you deploy and manage. If possible, standardize institution-owned devices on one Windows 10 edition (such as a 64-bit version of Windows 10 Education or Windows 10 Pro). Of course, you cannot standardize personal devices on a specific operating system version or processor architecture. + +### Select an image approach + +A key operating system image decision is whether to use a “thin” or “thick” image. *Thin images* contain only the operating system, and MDT installs the necessary device drivers and apps after the operating system has been installed. *Thick images* contain the operating system, “core” apps (such as Office), and device drivers. With thick images, MDT installs any device drivers and apps not included in the thick image after the operating system has been installed. + +The advantage to a thin image is that the final deployment configuration is dynamic, and you can easily change the configuration without having to capture another image. The disadvantage of a thin image is that it takes longer to complete the deployment. + +The advantage of a thick image is that the deployment takes less time than it would for a thin image. The disadvantage of a thick image is that you need to capture a new image each time you want to make a change to the operating system, apps, or other software in the image. + +### Select a method to initiate deployment + +The MDT deployment process is highly automated, requiring minimal information to deploy or upgrade Windows 10, but you must manually initiate the MDT deployment process. To do so, use the method listed in Table 8 that best meets the needs of your institution. + +*Table 8. Methods to initiate MDT deployment* + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
MethodDescription and reason to select this method
Windows Deployment ServicesThis method: +
    +
  • Uses diskless booting to initiate MDT deployment.
    • +
  • Works only with devices that support PXE boot.
    • +
  • Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
    • +
  • Deploys images more slowly than when using local media.
    • +
  • Requires that you deploy a Windows Deployment Services server.
    • +
+ +Select this method when you want to deploy Windows over-the-network and perform diskless booting. The advantage of this method is that the diskless media are generic and typically don’t require updates after you create them (the Deployment Wizard accesses the centrally located deployment share over the network). The disadvantage of this method is that over-the-network deployments are slower than deployments from local media, and you must deploy a Windows Deployment Services server.
Bootable mediaThis method: +
    +
  • Initiates MDT deployment by booting from local media, including from USB drives, DVD-ROM, or CD-ROM.
    • +
  • Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
    • +
  • Deploys images more slowly than when using local media.
    • +
  • Requires no additional infrastructure.
    • +
+ +Select this method when you want to deploy Windows over-the-network and are willing to boot the target device from local media. The advantage of this method is that the media are generic and typically don’t require updates after you create them (the Deployment Wizard accesses the centrally located deployment share over the network). The disadvantage of this method is that over-the-network deployments are slower than deployment from local media.
MDT deployment mediaThis method: +
    +
  • Initiates MDT deployment by booting from a local USB hard disk.
    • +
  • Deploys Windows 10 from local media, which consumes less network bandwidth than over-the-network methods.
    • +
  • Deploys images more quickly than network-based methods do.
    • +
  • Requires a USB hard disk because of the deployment share’s storage requirements (up to 100 GB).
    • +
+ +Select this method when you want to perform local deployments and are willing to boot the target device from a local USB hard disk. The advantage of this method is that local deployments are faster than over-the-network deployments. The disadvantage of this method is that each time you change the deployment share, you must regenerate the MDT deployment media and update the USB hard disk.
+ + +### Summary + +At the end of this section, you should know the Windows 10 editions and processor architecture that you want to deploy (and will import later in the process). You also determined whether you want to use thin or thick images. Finally, you selected the method for initiating your LTI deployment. Now, you can prepare for Windows 10 deployment. + +## Prepare for deployment + +To deploy Windows 10 to devices, using the LTI deployment method in MDT. In this section, you prepare your MDT environment and Windows Deployment Services for Windows 10 deployment. + +### Configure the MDT deployment share + +The first step in preparation for Windows 10 deployment is to configure—that is, *populate*—the MDT deployment share. Table 9 lists the MDT deployment share configuration tasks that you must perform. Perform the tasks in the order represented in Table 9. + +*Table 9. Tasks to configure the MDT deployment share* + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
TaskDescription
1. Import operating systemsImport the operating systems that you selected in the [Select operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#ImportanOperatingSystemintotheDeploymentWorkbench). +
2. Import device drivesDevice drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.

+ +Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#ImportDeviceDriversintotheDeploymentWorkbench). + +
3. Create MDT applications for Windows Store appsCreate an MDT application for each Windows Store app you want to deploy. You can deploy Windows Store apps by using *sideloading*, which allows you to use the **Add-AppxPackage** Windows PowerShell cmdlet to deploy the .appx files associated with the app (called *provisioned apps*). Use this method to deploy up to 24 apps to Windows 10.

+ +Prior to sideloading the .appx files, obtain the Windows Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Windows Store, you will need to obtain the .appx files from the app software vendor directly. If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Windows Store or Windows Store for Business.

+ +If you have Intune, you can deploy Windows Store apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows Store apps, and you can use it for ongoing management of Windows Store apps. This is the preferred method of deploying and managing Windows Store apps.

+ +In addition, you must prepare your environment for sideloading (deploying) Windows Store apps. For more information about how to: +
    +
  • Prepare your environment for sideloading, see [Try it out: sideload Windows Store apps](https://technet.microsoft.com/en-us/itpro/windows/deploy/sideload-apps-in-windows-10).
    • +
  • Create an MDT application, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench).
    • +
+ + +
4. Create MDT applications for Windows desktop apps +You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.

+ +To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com/en-us/library/jj219423.aspx?f=255&MSPPError=-2147217396).

+ +If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.

+ +**Note**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.

+ +For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench). + +
5. Create task sequences. +You must create a separate task sequences for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in Step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education; (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education; or (3) if you want to run deployments and upgrades for both 32 bit and 64 bit versions of Windows 10. To do so, you must create task sequences that will: +
    +
  • Deploy Windows 10 Education 64-bit to devices.
    • +
  • Deploy Windows 10 Education 32-bit to devices.
    • +
  • Upgrade existing devices to Windows 10 Education 64-bit.
    • +
  • Upgrade existing devices to Windows 10 Education 32-bit.
    • +
+ +Again, you will create the task sequences based on the operating systems that you imported in Step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewTaskSequenceintheDeploymentWorkbench). + +
6. Update the deployment share. +Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32 bit and 64 bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.

+ +For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#UpdateaDeploymentShareintheDeploymentWorkbench). + +
+ +### Configure Window Deployment Services for MDT + +You can use Windows Deployment Services in conjunction with MDT to automatically initiate boot images on target computers. These boot images can be Windows PE images (which you generated in Step 6 in Table 9) or custom images that can deploy operating systems directly to the target computers. + +#### To configure Windows Deployment Services for MDT + +1. Set up and configure Windows Deployment Services.

Windows Deployment Services is a server role available in all Windows Server editions. You can enable the Windows Deployment Services server role on a new server or on any server running Windows Server in your institution. For more information about how to perform this step, see the following resources: + - [Windows Deployment Services overview](https://technet.microsoft.com/library/hh831764.aspx) + - The Windows Deployment Services Help file, included in Windows Deployment Services + - [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/en-us/library/jj648426.aspx) + +2. Add LTI boot images (Windows PE images) to Windows Deployment Services.

The LTI boot images (.wim files) that you will add to Windows Deployment Services are in the MDT deployment share. Locate the .wim files in the Boot subfolder in the deployment share. For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](https://technet.microsoft.com/en-us/library/dn759415.aspx#AddLTIBootImagestoWindowsDeploymentServices). + +### Summary + +Now, Windows Deployment Services is ready to initiate the LTI deployment process in MDT. You have set up and configured Windows Deployment Services and added the LTI boot images, which you generated in the previous section, to Windows Deployment Services. Now, you’re ready to prepare to manage the devices in your institution. + +## Prepare for device management + +Before you deploy Windows 10 in your institution, you must prepare for device management. You will deploy Windows 10 in a configuration that complies with your requirements, but you want to help ensure that your deployments remain compliant. + +### Select the management method + +If you have only one device to configure, manually configuring that one device is tedious but possible. When you have multiple classrooms of devices to configure, however, manually configuring each device becomes overwhelming. In addition, manually keeping an identical configuration on each device is virtually impossible as the number of devices in the school increases. + +For a school, there are many ways to manage devices. Table 10 lists the methods that this guide describes and recommends. Use the information in Table 10 to determine which combination of management methods is right for your institution. + +Table 10. School management methods + + ++++ + + + + + + + + + + + + + + + + + + + +
MethodDescription
Group Policy +Group Policy is an integral part of AD DS and allows you to specify configuration settings for Windows 10 and previous versions of Windows. Select this method when you: +
    +
  • Want to manage institution-owned devices that are domain joined (personally owned devices are typically not domain joined).
    • +
  • Want more granular control of device and user settings.
    • +
  • Have an existing AD DS infrastructure.
    • +
  • Typically manage on-premises devices.
    • +
  • Can manage a required setting only by using Group Policy.
    • +
+ +The advantages of this method include: +
    +
  • No cost beyond the AD DS infrastructure.
    • +
  • A larger number of settings (compared to Intune).
    • +
+The disadvantages of this method are: +
    +
  • Can only manage domain-joined (institution-owned devices).
    • +
  • Requires an AD DS infrastructure (if the institution does not have AD DS already).
    • +
  • Typically manages on-premises devices (unless devices connect by using a VPN or DirectAccess).
    • +
+
IntuneIntune is a cloud-based management system that allows you to specify configuration settings for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD. +Select this method when you: +
    +
  • Want to manage institution-owned and personal devices (does not require that the device be domain joined).
    • +
  • Don’t require the level of granular control over device and user settings (compared to Group Policy).
    • +
  • Don’t have an existing AD DS infrastructure.
    • +
  • Need to manage devices regardless of where they are (on or off premises).
    • +
  • Can manage a required setting only by using Intune.
    • +
+ +The advantages of this method are: +
    +
  • You can manage institution-owned and personal devices.
    • +
  • It doesn’t require that devices be domain joined.
    • +
  • It doesn’t require any on-premises infrastructure.
    • +
  • It can manage devices regardless of their location (on or off premises).
    • + +
+The disadvantages of this method are: +
    +
  • Carries an additional cost for subscription.
    • +
  • Doesn’t have a granular level control over device and user settings (compared to Group Policy).
    • +
+ +
+ +### Select Microsoft-recommended settings + +Microsoft has several recommended settings for educational institutions. Table 11 lists them, provides a brief description of why you need to configure them, and recommends methods for configuring the settings. Review the settings in Table 11 and evaluate their relevancy to your institution. Use the information to help you determine whether you need to configure the setting and which method you will use to do so. At the end, you will have a list of settings that you want to apply to the Windows 10 devices and know which management method you will use to configure the settings. + +Table 11. Recommended settings for educational institutions + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
RecommendationDescription
Use of Microsoft accountsYou want faculty and students to use only Azure AD accounts for institution-owned devices. For these devices, do not use Microsoft accounts or associate a Microsoft account with the Azure AD accounts.

+**Note**  Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.

+**Group Policy.** Configure the [Accounts: Block Microsoft accounts](https://technet.microsoft.com/en-us/library/jj966262.aspx?f=255&MSPPError=-2147217396) Group Policy setting to use the Users can’t add Microsoft accounts setting option.

+**Intune.** Enable or disable the camera by using the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy. +
Restrict local administrator accounts on the devicesEnsure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.

+**Group Policy**. Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](https://technet.microsoft.com/en-us/library/cc732525.aspx).

+**Intune**. Not available. +
Restrict the local administrator accounts on the devicesEnsure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.

+**Group Policy**. Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](https://technet.microsoft.com/en-us/library/cc732525.aspx).

+**Intune**. Not available. +
Manage the built-in administrator account created during device deploymentWhen you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and optionally disable it.

+**Group Policy**. Rename the built-in Administrator account by using the **Accounts: Rename administrator account** Group Policy setting. For more information about how to rename the built-in Administrator account, see [To rename the Administrator account using the Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc747484.aspx). You will specify the new name for the Administrator account. You can disable the built-in Administrator account by using the **Accounts: Administrator account status** Group Policy setting. For more information about how to disable the built-in Administrator account, see [Accounts: Administrator account status](https://technet.microsoft.com/en-us/library/jj852165.aspx).

+**Intune**. Not available. +
Control Windows Store accessYou can control access to Windows Store and whether existing Windows Store apps receive updates. You can only disable the Windows Store app in Windows 10 Education and Windows 10 Enterprise.

+**Group Policy**. You can disable the Windows Store app by using the **Turn off the Store Application** Group Policy setting. You can prevent Windows Store apps from receiving updates by using the **Turn off Automatic Download and Install of updates** Group Policy setting. For more information about configuring these settings, see [Can I use Group Policy to control the Windows Store in my enterprise environment?](https://technet.microsoft.com/en-us/library/hh832040.aspx#BKMK_UseGP).

+**Intune**. You can enable or disable the camera by using the **Allow application store** policy setting in the **Apps** section of a **Windows 10 General Configuration** policy. +
Use of Remote Desktop connections to devicesRemote Desktop connections could allow unauthorized access to the device. Depending on your institution’s policies, you may want to disable Remote Desktop connections on your devices.

+**Group Policy**. You can enable or disable Remote Desktop connections to devices by using the **Allow Users to connect remotely using Remote Desktop setting** in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.

+**Intune**. Not available. +
Use of cameraA device’s camera can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the camera on your devices.

+**Group Policy**. Not available.

+**Intune**. You can enable or disable the camera by using the **Allow camera** policy setting in the **Hardware** section of a **Windows 10 General Configuration** policy. +
Use of audio recordingAudio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices.

+**Group Policy**. You can disable the Sound Recorder app by using the **Do not allow Sound Recorder to run** Group Policy setting. You can disable other audio recording apps by using AppLocker policies. Create AppLocker policies by using the information in [Editing an AppLocker Policy](https://technet.microsoft.com/en-us/library/ee791894(v=ws.10).aspx) and [Create Your AppLocker Policies](https://technet.microsoft.com/en-us/library/ee791899.aspx).

+**Intune**. You can enable or disable the camera by using the **Allow voice recording** policy setting in the **Features** section of a **Windows 10 General Configuration** policy. +
Use of screen captureScreen captures can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the ability to perform screen captures on your devices.

+**Group Policy**. Not available.

+**Intune**. You can enable or disable the camera by using the **Allow screen capture** policy setting in the **System** section of a **Windows 10 General Configuration** policy. +
Use of location servicesProviding a device’s location can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the location service on your devices.

+**Group Policy**. You can enable or disable location services by using the **Turn off location** Group Policy setting in User Configuration\Windows Components\Location and Sensors.

+**Intune**. You can enable or disable the camera by using the **Allow geolocation** policy setting in the **Hardware** section of a **Windows 10 General Configuration** policy. +
Changing wallpaperDisplaying a custom wallpaper can be a source of disclosure or privacy issues in an education environment (if the wallpaper displays information about the user or the device). Depending on your institution’s policies, you may want to prevent users from changing the wallpaper on your devices.

+**Group Policy**. You can configure the wallpaper by using the **Desktop WallPaper** setting in User Configuration\Administrative Templates\Desktop\Desktop.

+**Intune**. Not available. +
+ +### Configure settings by using Group Policy + +Now, you’re ready to configure settings by using Group Policy. The steps in this section assume that you have an AD DS infrastructure. You will configure the Group Policy settings you select here in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) settings. + +For more information about Group Policy, see [Group Policy Planning and Deployment Guide](https://technet.microsoft.com/en-us/library/cc754948.aspx). + +#### To configure Group Policy settings + +1. Create a Group Policy object (GPO) that will contain the Group Policy settings by completing the steps in [Create a new Group Policy object](https://technet.microsoft.com/en-us/library/cc738830.aspx). +2. Configure the settings in the GPO by completing the steps in [Edit a Group Policy object](https://technet.microsoft.com/en-us/library/cc739902.aspx). +3. Link the GPO to the appropriate AD DS site, domain, or organizational unit by completing the steps in [Link a Group Policy object to a site, domain, or organizational unit](https://technet.microsoft.com/en-us/library/cc738954(v=ws.10).aspx). + +### Configure settings by using Intune + +Now, you’re ready to configure settings by using Intune. The steps in this section assume that you have an Office 365 subscription. You will configure the Intune settings that you selected in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) section. + +For more information about Intune, see [Documentation for Microsoft Intune](https://docs.microsoft.com/en-us/intune/). + +#### To configure Intune settings + +1. Add Intune to your Office 365 subscription by completing the steps in [Get started with a paid subscription to Microsoft Intune](https://docs.microsoft.com/en-us/intune/get-started/start-with-a-paid-subscription-to-microsoft-intune). +2. Enroll devices with Intune by completing the steps in [Get ready to enroll devices in Microsoft Intune](https://technet.microsoft.com/en-us/library/dn646962.aspx). +3. Configure the settings in Intune Windows 10 policies by completing the steps in [Manage settings and features on your devices with Microsoft Intune policies](https://technet.microsoft.com/en-us/library/dn646984.aspx). +4. Manage Windows 10 devices by completing the steps in [Manage Windows PCs with Microsoft Intune](https://technet.microsoft.com/en-us/library/dn646959.aspx). + +### Deploy apps by using Intune + +You can use Intune to deploy Windows Store and Windows desktop apps. Intune provides improved control over which users receive specific apps. In addition, Intune allows you deploy apps to companion devices (such as Windows 10 Mobile, iOS, or Android devices) Finally, Intune helps you manage app security and features, such as mobile application management policies that let you manage apps on devices that are not enrolled in Intune or are managed by another solution. + +For more information about how to configure Intune to manage your apps, see [Deploy and configure apps with Microsoft Intune](https://docs.microsoft.com/en-us/intune/). + +### Summary + +In this section, you prepared your institution for device management. You determined whether you want to use Group Policy or Intune to manage your devices. You identified the configuration settings that you want to use to manage your users and devices. Finally, you configured the Group Policy and Intune settings in Group Policy and Intune, respectively. + +## Deploy Windows 10 to devices + +You’re ready to deploy Windows 10 to faculty and student devices. You must complete the steps in this section for each student device in the classrooms as well as for any new student devices you add in the future. You can also perform these actions for any device that’s eligible for a Windows 10 upgrade. This section discusses deploying Windows 10 to new devices, refreshing Windows 10 on existing devices, and upgrading existing devices that are running eligible versions of Windows 8.1 or Windows to Windows 10. + +### Prepare for deployment + +Prior to deployment of Windows 10, ensure that you complete the tasks listed in Table 12. Most of these tasks are already complete, but use this step to make sure. + +*Table 12. Deployment preparation checklist* + +|Task | | +| ---| --- | +| |The target devices have sufficient system resources to run Windows 10. | +| | Identify the necessary devices drivers, and import them to the MDT deployment share.| +| | Create an MDT application for each Windows Store and Windows desktop app.| +| | Notify the students and faculty about the deployment.| + +### Perform the deployment + +Use the Deployment Wizard to deploy Windows 10. The LTI deployment process is almost fully automated: You provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. + +**Note**  To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/en-us/library/dn781089.aspx). + +In most instances, deployments occur without incident. Only in rare occasions do deployments experience problems. + +#### To deploy Windows 10 + +1. **Initiate the LTI deployment process**. Initiate the LTI deployment process booting over the network (PXE boot) or from local media. You selected the method for initiating the LTI deployment process in the [Select a method to initiate deployment](#select-a-method-to-initiate-deployment) section earlier in this guide. +2. **Complete the Deployment Wizard**. For more information about how to complete the Deployment Wizard, see the “Running the Deployment Wizard” topic in [Using the Microsoft Deployment Toolkit](https://technet.microsoft.com/en-us/library/dn759415.aspx#Running%20the%20Deployment%20Wizard). + +### Set up printers + +After you have deployed Windows 10, the devices are almost ready for use. First, you must set up the printers that each classroom will use. Typically, you connect the printers to the same network as the devices in the same classroom. If you don’t have printers in your classrooms, skip this section and proceed to the [Verify deployment](#verify-deployment) section. + +**Note**  If you’re performing an upgrade instead of a new deployment, the printers remain configured as they were in the previous version of Windows. As a result, you can skip this section and proceed to the [Verify deployment](#verify-deployment) section. + +#### To set up printers + +1. Review the printer manufacturer’s instructions for installing the printer drivers. +2. On the admin device, download the printer drivers. +3. Copy the printer drivers to a USB drive. +4. On a device, use the same account you used to set up Windows 10 in the [Prepare the device](#prepare-the-device) section to sign in to the device. +5. Insert the USB drive in the device. +6. Follow the printer manufacturer’s instructions to install the printer drivers from the USB drive. +7. Verify that the printer drivers were installed correctly by printing a test page. +8. Complete steps 1–8 for each printer. + +### Verify deployment + +As a final quality control step, verify the device configuration to ensure that all apps run. Microsoft recommends that you perform all the tasks that the user would perform. Specifically, verify the following: + +- The device can connect to the Internet and view the appropriate web content in Microsoft Edge. +- Windows Update is active and current with software updates. +- Windows Defender is active and current with malware signatures. +- The SmartScreen Filter is active. +- All Windows Store apps are properly installed and updated. +- All Windows desktop apps are properly installed and updated. +- Printers are properly configured. + +When you have verified that the first device is properly configured, you can move to the next device and perform the same steps. + +### Summary + +You prepared the devices for deployment by verifying that they have adequate system resources and that the resources in the devices have corresponding Windows 10 device drivers. You performed device deployment over the network or by using local MDT media. Next, you configured the appropriate printers on the devices. Finally, you verified that the devices are properly configured and ready for use. + +## Maintain Windows devices and Office 365 + +After the initial deployment, you will need to perform certain tasks to maintain the Windows 10 devices and your Office 365 Education subscription. You should perform these tasks on the following schedule: + +- **Monthly.** These tasks help ensure that the devices are current with software updates and properly protected against viruses and malware. +- **New semester or academic year.** Perform these tasks prior to the start of a new curriculum—for example, at the start of a new academic year or semester. These tasks help ensure that the classroom environments are ready for the next group of students. +- **As required (ad hoc).** Perform these tasks as necessary in a classroom. For example, a new version of an app may be available, or a student may inadvertently corrupt a device so that you must restore it to the default configuration. + +Table 13 lists the school and individual classroom maintenance tasks, the resources for performing the tasks, and the schedule (or frequency) on which you should perform the tasks. + +*Table 13. School and individual classroom maintenance tasks, with resources and the schedule for performing them* + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Task and resourcesMonthlyNew semester or academic yearAs required
Verify that Windows Update is active and current with operating system and software updates.

+For more information about completing this task when you have: +
    +
  • Intune, see [Keep Windows PCs up to date with software updates in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/keep-windows-pcs-up-to-date-with-software-updates-in-microsoft-intune).
    • +
  • Group Policy, see [Windows Update for Business](https://technet.microsoft.com/itpro/windows/plan/windows-update-for-business).
    • +
  • Windows Server Update Services (WSUS), see [Windows Server Update Services](https://msdn.microsoft.com/en-us/library/bb332157.aspx?f=255&MSPPError=-2147217396).
    • +
  • Neither Intune, Group Policy, or WSUS, see [Update Windows 10](http://windows.microsoft.com/en-id/windows-10/update-windows-10)
    • +
+		XXX
Verify that Windows Defender is active and current with malware signatures.

+For more information about completing this task, see [Turn Windows Defender on or off](http://windows.microsoft.com/en-us/windows-10/how-to-protect-your-windows-10-pc#v1h=tab02) and [Updating Windows Defender](http://windows.microsoft.com/en-us/windows-10/how-to-protect-your-windows-10-pc#v1h=tab03). 		XXX
Verify that Windows Defender has run a scan in the past week and that no viruses or malware were found.

+For more information about completing this task, see [How do I find and remove a virus?](http://windows.microsoft.com/en-US/windows-8/how-find-remove-virus) +		XXX
Verify that you are using the appropriate Windows 10 servicing options for updates and upgrades (such as selecting whether you want to use Current Branch or Current Branch for Business).

+For more information about Windows 10 servicing options for updates and upgrades, see [Windows 10 servicing options for updates and upgrades](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing).		XX
Refresh the operating system and apps on devices.

+For more information about completing this task, see the [Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section. + +		XX
Install any new Windows desktop apps or update any Windows desktop apps that are used in the curriculum.

+For more information, see the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. + +		XX
Install new or update existing Windows Store apps that are used in the curriculum.

+Windows Store apps are automatically updated from Windows Store. The menu bar in the Windows Store app shows whether any Windows Store app updates are available for download.

+You can also deploy Windows Store apps directly to devices by using Intune. For more information, see the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. + +		XX
Remove unnecessary user accounts (and corresponding licenses) from Office 365.

+For more information about how to: +
    +
  • Remove unnecessary user accounts, see [Delete or restore users](https://support.office.com/en-us/article/Delete-or-restore-users-d5155593-3bac-4d8d-9d8b-f4513a81479e?ui=en-US&rs=en-US&ad=US).
    • +
  • Unassign licenses, see [Assign or unassign licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-unassign-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US).
    • +
+ +		XX
Add new accounts (and corresponding licenses) to Office 365.

+For more information about how to: +
    +
  • Add user accounts, see [Add users to Office 365 for business](https://support.office.com/en-us/article/Add-users-to-Office-365-for-business-435ccec3-09dd-4587-9ebd-2f3cad6bc2bc) and [Add users individually or in bulk to Office 365](https://www.youtube.com/watch?v=zDs3VltTJps).
    • +
  • Assign licenses, see [Assign or unassign licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-unassign-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US).
    • +
+		XX
Create or modify security groups and manage group membership in Office 365.

+For more information about how to: +
    +
  • Create or modify security groups, see [View, create, and delete Groups in the Office 365 admin center](https://support.office.com/en-us/article/View-create-and-delete-groups-in-the-Office-365-admin-center-a6360120-2fc4-46af-b105-6a04dc5461c7).
    • +
  • Manage group membership, see [Manage Group membership in the Office 365 admin center](https://support.office.com/en-us/article/Manage-Group-membership-in-the-Office-365-admin-center-e186d224-a324-4afa-8300-0e4fc0c3000a).
    • +
+ +		XX
Create or modify Exchange Online or Microsoft Exchange Server distribution lists in Office 365.

+For more information about how to create or modify Exchange Online or Exchange Server distribution lists in Office 365, see [Manage Distribution Groups](https://technet.microsoft.com/library/bb124513.aspx) and [Groups in Exchange Online and SharePoint Online](https://support.office.com/en-us/article/Create-edit-or-delete-a-security-group-55C96B32-E086-4C9E-948B-A018B44510CB#__groups_in_exchange). + +		XX
Install new student devices

+Follow the same steps described in the [Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section. + +		X
+ +### Summary + +Now, you have identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your school configuration should match the typical school configuration that you saw in the [Plan a typical school configuration](#plan-a-typical-school-configuration) section. By performing these maintenance tasks you help ensure that your school stays secure and is configured as you specified. + +##Related resources +

    +
  • [Try it out: Windows 10 deployment (for educational institutions)](http://go.microsoft.com/fwlink/p/?LinkId=623254)
    • +
  • [Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255)
    • +
  • [Chromebook migration guide](http://go.microsoft.com/fwlink/p/?LinkId=623249)
    • +
+ diff --git a/windows/plan/images/deploy-win-10-school-figure1.png b/windows/plan/images/deploy-win-10-school-figure1.png new file mode 100644 index 0000000000000000000000000000000000000000..66113dcce1147b8a802aff95612240772dc17f27 GIT binary patch literal 46486 zcma&NWmKD8*DZ_{FA%iF6WraM;O6JSY65hZ+f5^kmus29ZO>D|? zGJ4+TCy$0&#AmB#3C0iaXwFK_n(%LQuMKK_H4PR;z413Lw(q3QOqy=0jH?epXmUK3 zFNn}*3PqT>i!jk~qhqnrabekX=xQ&5SRt=_gJCcjEo;x?N%!f&!9l_4!N-FF?|?(n zv$cThfS`xNj*5zkWhpFN3L4BVUuAXQ@gQp|D21`%q~Cr0Qz-4+pXjVV%E|%zTq|pj z%@L3;)5Wo1!>3D4sLYwYVSOn2n?XV9-!$Uhv{p~>QXWb3l=$h<(K;A&MPvW+SH&)c zZZG7W>b}2mMh;fZxA-)^yD0I)U}-e;+tWn~U24!bZ{n-Nof2I;^AFXpy5;`+#gcXtppbht?eZAj41Yoj z=r+OUH~u<>lEiX9(nY@7(nW_Orw9dJq_d10));mB-&N^Xw|8{N*KyTQ;D4=Mh%ZUm z{OVO7{gU8hi0z>Qza&y+a}YvVS)GIj6;?>Zr1A5t#d%Y%j*IyBWJN0e?`aI2 zA9IY0mai4izkN5Yz|DJDUf40Uq)Q_>UNS@@sP@sUk+iuBB&tCS>y1d+-B;pBL zYjal|gj;rLvNimfBJdlU@5eOExriuk3?80C8b__!+h+T~qNou2nnf1NRGsx1w)jQn z>)#xGL#qnCLqaC#VyspO;eh+b=(_>mLh0krJa~zno;69GUBXWOetsR%F9(JckpwrC z;RW6eokTns!hSb3(RUE;-*ze6?)e@MH;$moq53}}D=P~Xvx(h)w;F>eeQyj&P^jEawjYY{1c1sFQ=t_E_c7@eh)7M&@b=)q# zyZ(L+Z>?dcx1Gp~De=2K{d9XKJ#N5vE6G%;eW}>4H_Ol8! zQn)O7bmS}-_Gck)k$GQ`kzpezbta@|X2u#B(f*c~WekaDB7Q%w##H`$sNTHGc(4Q? zSRle5-hO8-KjMB5Nd-FWPtzs-9?HGko2CKbP!_h}FV(!Fvm$j_`Wt)Uh7GB;TCOwu zJ(Mu;ty9T_u~L)fP&X(GecZMNWy$$F?Ht0ze_P$4<1$gK+lenK!7J5#g$&VjQ#U>1 zr=AZ)EK;drwAnbG6iS~s4^Pj4CxjW#+tErxV&wb{c^fe=9W;mPfaMjI^=jTe(C?jZ z5rfAoUo(2bVIW#mjOP#>oVZwKMdWcA*8B4<)E#EZ>Ln?jt%$EfM<4-|;Wy;D#2*KS zRui}v$VwugxqxY{%KaDD;jrpUcWV8A1`vzA!v(fCLNcHd^*5sTpmf=!y?=ZVk|%ar zYXw^&Tn4>EPa*pH`r2~a3PgD1G>;8`Vz4RB=;zWZ>&)j2wJEUE&osBj;v`p&PTWQ{ zn|vkrbh}XvXF3dl$($tsMRivX(G|kz>;5>j$?tbG&ItupANcirjw{~LBsydOV^1DD zh4he*Z>8<4u3Y^HHyXBXyZ?qM$&tiIKYq;>_D&_Uo3*sr^peE?AOed=qdqUs0VEJ< zEVj=P&4*{;$ZPJ6LNiu8Z*1`>BDoS#{--u-r$!{XM=$d@BV}c0PzLK$C!@?pldr!3@6cu zc@#qI8a9eE?2X6qsl}PQzR@x7$B?NruYN`ix=un~H1CmgM!e%-$JOp}pVY5u$%R?wUeIG`N>-au*6RaZ*wUZQ{Va6T>H05~W=}wO;N?)kO5pA3`eR0h&v<5xNAL@Y zc`+8ThxHDxThD3z`zA`<^+&lu4}TzR8+kT4ib`$%H5)`3-nM&NXhDxZ>lVr(H1z9% zpLjfBLhIr{oz~u8u-GgqdndQW0X)uS(XA%pyB|OjIGi^zFIE3o)?E-A>tV6~LeO9M zRh>`Ky3DwViOEBG8U5`^M{(y@shxtJ9VMX5`fHC5CXHh+Je+w&SZ)@|D`qE#V57I8}>#i)@JK3BH= z#z>Nr4JU;q=uy5lIAzCny5NLvGqZg7crlusH8k(Ump!pfQ!N%H=fuGWGn0+$*SmnH z0tohRCbgmw)^$~XV`F1Ec7iMCYy+oUYQeuHQ5NF>NC?J6ytTC*kHiqz)sD6p2Qj_R za9$YQF(1s>k#lscjcz-+Ri-p{0yT@5zaED|7&)W@;jPgT(!%Wcmy?u_WbFaJiguKT zxMsX>PpRs@-=3~A&4ow@K%yISH47y$uHaV3VZN#d6FqE;3k&_Em3=-<)qjK{#lN>`dFYj+k-={98pk+IS{FHr>(q zRb|laNH4*yB2v@>KXN^-!0CFgw25-W@MzizC#cG^rSbYRmM3vC^E`YHbG8O_sd7|mie_)~WSj`@o0IGkWvrkZQC`1* z%wWZ0;<1s)<6W|ly=YDlr2-#Fx8Z-Hx1iK&iNy9*#UP6^=D-YodvRUJ-}Eg-zX?L$ zHbP`Eb$b=8z%S?qb({tjxA2L{#70#TgF`pc9ZRX%M(Pu|k}Kj=b2w9lQr=dHdzMuy z$m=wjcad|?ZVNo)l}MX=QB|auW;_}+o6so2ny~{yo0~$qJyiHw8+^XWh?qK8YXlaG zMTV|q?-R20otyZxBZF)tRDt!_(B7CE?G`5!7e&j&KsQ|ERryE{N{^OeWLV`;@(mxlKa^BjARiH7~$<*Zl`2l zD{Ier`C9;fyhO#==ngO`3zJ=;VW9om-CY3bD}H&MckBQ+Yjr7R#zT85rDmx~Y8QQx za36(F6T4KWuA-r#tp3T66LuzWqpGQ?u38GGQ%v-~zdHDaGq5*P8!Q3h5#bD|S*%EU zzdbTGHpaRxG|y2&eNCsYuOdGA*yMX8cLvLSJ? zDHWvl1mTcQk9;Hew~@XiQ5KT9GR=weC`qEyX$~0ivze}om*{THoK5)1|316a9;_$< za>#sxk&ueiVZl>hnsAh+iP*faW zUtdZ}PxXesZ)EiKNxDo}7z8rhCa?k)1Rj)S(m#H&+8Iks#FGO!g;t_Sap6bzFJF1) zRDfwGd{z#J-|-0vwbaxc1CdQR-~lrHhp%%wt2Ouct>=ZkgE*f_kZLaZ5qhNLVfZGE zJ9o*QHIuyeg2XxO;q}IWU@7;VQ8l9?){|f0{8QImL~5S*V8d=url8iFkqsdg#)#)l zg@YRV=OTyMLOImw=Ta?QbKA_wrHC^MiH<5fMs&npBB^@fcPy$83HMJ;r%v_CWTBWP z0n(*TkY|%zAux_*rM@yEo0cnMAv;e5+y|svTwi~jx`O9TCJ=NX&Rxl)RV#Reu3&nE zU7RS&iTTGcKr5$EszS*m*Q4l~sh3F;e%$E0pjjX)4=QD2>?t)jHC0Rbk}vkh(5!Lp z@#}V26mFkIA^O~>Pd|Fu4C{5aFKtKpyFvhbN66!hLgi`tG-sj|B3f76*=ah+UY|=j z+fIJuqzR_&37lDWuVd^WH%;L{zkucTm1@X+gM~S7cE@Btll1>9ouXZ;s4JI*Sl=CA z7b;*!ltl$DY`*BR@NIdBjGqly3zi($P8=GHA!4!8h%V(cm*D8}Hy&hVHRa5DEbVS; zystO-=Dw50zaXMM2^_w=~~am;VO*ZqtJUYqg%dFeC*MDZL5P^t`z<_EE?$g~ zTGWqz)tHEH|EtA9Ag78^q#bmAz6H$B{wISK5s?u)2Zu75b_0{upkAbVe&@PQwWqsF zCX##+KSAX{64KZU!`grN2yaI5dY7M&ijeaL9N<4qM@ua7J3BkDBm?I47H11x-854P zCGUl>zMIWqygKH0-V3O^wq9O_hGZJE_Z9L$#63a8TsS={TDJN4B#Xteva-r$=Hk;x zK`b6SeqaO5%7MsZ8`TF7VR6%$w$n?4i_w{av-9)wD=V)8;NCq~9(jHio&L(3bjZT0 zLQ+B9K*-1&O~a=YmYy~zWcGcy;V`{c%BptQo9gfH@9;X)0f}}7JbW1oSj8wwei!kviJFETF%j6!`;@pR7x za0oRuOW|#Gb@eOv59!B&tD!tjANiwG#kW7loq?w(Cd6HTp?yX<%Moru6D>)3UcOuRA33;4aKZQCTHIGzcJLS_h2Ap$ zCZR$7d08R*Sd|w;(iur&^5UmxiozS_E>T(e!)(Mr&|E^h0E*dWImp7{%t!uJLInWuXS~G&CLe% z*+$Sj2Y0tGVAHr_7%bVCrI#sfxm;77xKo$f|IX8uDL61U!xitO7@ri^%K7@WHgOQ> zXN4abf3F1_Njg{&Pi5!9r)5)b2PLiw&f#!h;=Xu-(&X%@1LF;^vtZ(wTN(;wrV}5t$dGV#w4J2d#GgQ z^0FEc09aHglJXVUqQ_~yd@|Rt*1XH~+ct|X5PwJnP@Hc}Rb-rgYO~J#yPNs|LQQUS8V;1R?nar5k z*huUtVJCp&-`zFn>gtB6S5NX`<>XwLQ(OSD0+VI|rGzgr**^#YP;aSt+_wK>5oPY~ zp00F|ecd};tiG}yAJg>12=N^m9~)y%yO}(r&M9*81N4tWDLy{kH?M}KlNAYgS!QU- z{eV~-_K}}OOsv*I%2!IVY>kN}24NM<5~`dm5C{iop-TqA3|Hy<-sAx`?atxGA(`mPlNKGZAt=0UMTn3_`V_wM(pl_aO- z*HWKJ`|X0sgn72l86j`kiq{xX#J59VkY9vh;Kv$iohRdXj}YNeUxbH6nU;9TggyM> z?$I=QhQQ2>zxg9|TWY%%6=nKUV7uy%R#LhcE5eYvw=^2j_om37E<7@?o1gx12iy`I z2CWm%s*EWki=V6yY%RaE>o@{UOOND3W)F*| zY;eQ-5h%SH)Lh$~(+ctTVYXBifa{$e2eZG2A>+iWQET^EQUFe`Gw+Br0~D@?5nhHt za1gf_a zl=*V_hvyNqTSwhg3V8XL^qKZ<((T#iZ(uh(6oJQhm4y z-NhM&1@j%I%Fff;Y{?sY6k|KLLF&K#d&%!}G{xttMzuq~P(;5rWTLrV(2Fgn3aWpj zlWlYz2|+%oN`O+E5=mQO{*2l{oykE>s7iM7uuCC#Q8OQ~OFu$?EzL8#q0?!ksL_-�(H zwcj8@pZz^@e_`I8+^$1b>(-Mzy`K;l7zLlo7lV{rCp>)cb$9<7I6}e?-PjRCgL&!u zge}C9urZf}Y}k^Cf?iytF=^_An>$xiUz}~qH<4U)2rMef`S2Vf`_z_j>QIxt6!7Io z+~+-45c*vMqwMs*(;39o64D-G>*Ke5q42vo?z6bABPAo#eG}D}+pWe}sCnP& z+GYxL;O2M*vQ(j2+=L&FLUG}Fv}A)vk(ra3xz@r3VKbpxlCJlT`Qkpj zzDH^4;f@I&ZA%?zgzve@F96nFQ^W52c{4aZo~26YszAg&()>a3?2aPm;~k)6kzYLj z_H7^%-w<~qYnq3DTgYjR+2|{JTG3N5^1SWD3#K4@X@l1^$(rbi)O?J#7jNDi#*Bh* zW4;k}ME;DuGSX|aP|Mj5Xp@!h7=unhPce7^=tb^5A|D?G5HX@i@Nm2IU=3J-7Xs~e zxO0nTUOvQrxH+pB8B|VVE;;}6TM;zxdOib=Wj6dv4jc|fE5r=0kD?-m{E%k0G)Tgi zZC{l5XGszSdvR_$OZ8`aJOtZ$qnm{1eYo&8iPM5BhQ3Cp51msPGr*D4AYxu8CDD=9 z%XKl?c#rMxr#HHY`xd$6;UzCG1}?@=k!x=kW_E;%nm%b3NX%m!e}v`=I+sVIA5Akw z2yf3N#f`vz3*!6O+U@~WI@hbur~RpKM^hO9npsj}(GzHyANGkXR%dRGQ9Y-uQsteeVMsbZ3OPoTQI5hecUL|Ft;`!{<1%yAP{RXe+I1E54AJC#Hu1skEXQBV3t zZJ_d<#sfvZDoDg>@o=%RnwebEDtsivxhkGYjI_L%xyhpE4u`a{)$4k?P%1TKpTI9Y zN7V9{+)kP2(T$@+G_G8$-))^$kq8*CZ6xCoV0Nzv+G4}$Sd(Or@0T=R`~+MxQ+M7fFd*WG%Yie6oeC= zO>@C~haFAgKy&dENbWR1T-e z;S95mHln%^IW5FX45SXfxxrYCSp>Hrz6D9BX0jJ6WjqXcD$aKL?*hyTD1ybE>0?H} zpmtMtIc<^zmu!rNynOkW4I5tEnG{Z4(GmxIv@@K~@|WrYpGI;G5Vm|_-9b+gaiko^ zU$#@#EogX{n8ZxJR+sc<1Ettl3BUVK6-ne0zFt0U*S6s`1eaOPV?rw^R*0BA2(Zps5Co$v$#%nc9nXA*m%^Zju;wJ0O8!Q703_)U%_`n z9jwsEXDwK}4NSDqofPpeFatJOVvnQ+{+lbC>b>btVzP%|=XdXlyr$F&c~FBEp>=C{ zH2mJ&@}YE$!0GgOS0#e+{O)wUBW=gIhJk_UY_%n+JBa?dkLL7{dTx4292wU}hnJ=k zQ$VHb%EeBAu8vlEPUh0Wf}Z=`7v60k2T=+5UbWWLjAwBb3cFezE!FaG<5Npg@_k^> zDYE>af#-H*k=2NY@57yK3cb^76Y;mYO?aV9eUZEc#zzPE46On$b|iea)?}R*Qi~GD zyiFtFt5>G~6B|$d{(7Bwu8Y#oO=4!xvMtwnBSzS%UBjn@bL%dSs zw~3bdgZO36M`ch%%aAio-&`K#KFcdyRt?Wbj?_*X+9A_+Kd+O$1x zzmD77?H=zrOqy{$ft?eF@{!H3?uv%{H3ELOTyLTIq30`_x+G9U4|+nxhoF8g8b&j2 z^yVS4gc5jN|M|UN@$TdY8J9&>3yCO?$TkB5!<8Fla&9i06$wd>eWDvs76-XsZVh0- z1FrT#@(ccV7tew||1{VP0S7+bNA!q!ot8zD+k3WFsRUhe5?i^AEJ`(2`1oq+xdo0` zXJx;16Zln7g{M7{O_&D7107k+42?A_so{wbVgL6a{ts*Z-*dT9oh8B8y1iU?Tk^C< zd?k3;DFdeo8~mFrq|`G{PnQ&u$DUj=H)09*y>^?m$Ra+{KRI0NFm$dgPc+w24l#Wd zt0Yoqk1LY%(-|7Fpt6`5xyE;H&d1Om6GhZPuWr|{Gr*~^F0suY+lBM4^QrO!xKLqg z$L;!*g8}PG<}wU2BEzPrs|c!c;wi= zrRe%$-#@9~rg?|k9X=iWz3@Fe|3@`YAMNU)T$YTV;*KvB{&cDN&@8ifIFpB>tVr_!9jgj|u)1_=7 zzuaO}ecDGb#yBJ*m5oqleALwwjHk)b@g}5MAmD?}Vrc_AsIzhYldd|*wZhC-W3p?) ziMfcCGb7$_oC$Lgr64(%M-7E2cnWNNjYD-c)6xr_ZF93wZx3Sh`#@`}N2kM4_$+_lXK&^m3Ih1-9-L&9*UHoByp{@Lkv-z72rQcEq?G=;B0!=5; zVQc8FyLV&^-(XpNRTcJ>-zrWFLG^o`4#iJZCU#@@YhAn*ymrVIGex8Pvp!)k+GVEv z>a!ak{i0zzn=A~*HI6D$r#9O>Y~Ec)q-`YxxV=NkD7&K@v@sT z=r)!-&i0PT^{(=TPoJq4t%n9p8J))UY-mAU3USO5{)JE&$F$=AFIoPduiJ-m|e=E zDhC^?G>`aC!6hGFG<&=d43)@nDssPH-~2A87X3Gp@sqouGU4ghum@kJzh9pTGI^e! zT4<+hb+7T{&)Y>|v9Qq1o!-Vpo8Bsm^Xn;$YF~5CDtui z#0_5!tc7i|@|5hf1Bga#ZnGXJQm?6jzIUQl>BI;vjkIbm@WztJF6JwM+C>%A=7eWQ$qa>Awvs z)9F9?2pQH9G&+~b#?*cJ{`}cknUh`NA`{AS*aiW}5QN^;F>PafC005F%ZNX9iHPMT z2;WP?J1+C6%EV6;)lil`Vb%yb*%0Du;IOePbug4jKUAB9yQXWk3?5zXE3lL89LU?3 zy(itN=SNQGORr(J)6q$cZ_f}Wn|T%u5rpesKjD{)%IoE$;a*G6lz*bCA1xpVw)iNVP+~&Z{Kf9tb;cH(jgoP}v0iv8!C`>+3jV z9OPLUHjivW&A`B)0nN<>Z_Sy#?3@Xk%l#h72M6%d-c&vyhC>`xG&QFIAfl_I>-sIR zb>z9&uIMzmP-2y3+v#8wEpne|5(Zq9lp>4>L1f(J`EUd1S-uE3=vDdaYe|cns>~+&L`(o_wfq^4X z(I;}HXyQ(~{B8@xf)F3f%&e_{1I1Cf=Ol%a0XYJGAAFw>Kmk@mU3K-d^)LX(K(TW|069MELJ20R-*#eyZtD_p zyAR<$R`%Jcc_iwnFNo3!mD^hJU#$Q9gT?F8-Rf%Gb^`i z>JTFALoXi0l6g?3@YpUd*=~;80IX7NSWk?B09YyDVlD<%KmOJyP^R+4_)gSEZAy++mhpI1c5HJ8CDfkFlXvXEt(PoF+PcK_M&Dtksg zv8E5b_izAa)m!uoHTfDEE*DA#@p~;#6-p)b&`1U3NZ8`_1Ii^(4SW_ca8d-GqI)MT zP>OL7rJxrki>#^fvy^Q+PI3b{F%eNmY<}6Lc8#>q#zYuV zg=eTIHKWnq4WWtX@CLQGw-!AF`AA%?Vd^BplbWFBlDki|g>1=3x?ySn?Pv|y%gC1X zQyg8LIp$F>nERTrNhTjKp~0R`T)<#3jm3XWR`6aN34fyZ;OsI^-sm?h@_j0Y{r18C z7`ze5WM0G+r*c}+UeqofI9b%4!K65bvM&>ZDeh_70iOF1i9ominLcS3PWyBhv+KFV0_1Y_d`R>F9YX@^8xjw2Jn>gXO7rUw?mE zdbP9l-ycNt&=^Z!UOlBbO*U9~-q>5dY6sK(d89a^=V-@pmN@QMNqm>i@=gCPCE`Er zMh7G58S6ipeq81X!L%7`>04mcZz8cplb<`>M3*V|crY!`x~->Dz+P(WYM4Uprz;kg zzn7Diqr?8s)PinBlSqNZ=oiJ0{=OuFM>8;pMj_}x@Kum-uyabDJu`-t&FWiWuCB3h zyYIDqN;Ha#(n=u^>efCO?P&l(CPp|r<>cg~#(mW?|NZNH#TQF$08A5Tn4-fy`ez%E z8|{H2Jx|dHM9Me`wULg*>5cY)(Bp-&_5O`c;=+mXX}!^tR|u;#kH7K8OW!Ps_+)umXoc$ybivL{l;i!{Ppq&fH)O z`BKxX4}7^IZrjn(Z7-z)#SufPQv$=PM1bLx#p;Y?7Kp2IYUR}c*80$_^j&7qGx235 zB{V?mDLe1oYYZC6zy(t|AZR^J<_bYTyrAVax0x%;t=gO!A{r>{uxp`9~z=Rl@&jzk@ z5Up34j;VZGQ@M3Pj=o^RX2OWu7FQ+L*Yf?AE_zAJt53f}fYG6MO;J5twMXnXHNMF= z`Q`uHE2=y&^k}UZ^d|r7R9J}TDM5`p6Oa(Gj@H0=^FDfAj**_!g#W&`ig)0@@n`ou z++{zH9<*vX7hyh6ZO_Mn=8B1eJU?49C9sNZ=v^|7C8*ZTNoAy79>EPrp2BFE$}T~5 z!z}r6;mG&cPd~1HZDvXkVOhLxxUNmMK7Fobxi5KA@de?f=_PvgUhlHPsb~G3o;LqM zz<>+uY3Pvk@AaN!!ngB}Nk!9biGiWqV_Y@v&n*}KQI&vI<1%aKw;SMrKeJsc^vpei zk7cl}CYhEQka3xb`drZO>OB2+abl;r5zBXv+LN{%56b1#HB0?}3fY>tsV+k;D>U^6Ac2digEd zdsBr^KL!6ggf;~v!2PUOz`#BGkEdQvZTD!oo(X>7zgK4l_@Ck7Sdh2k*Q=|mn>|5X zguG*=&Ws8yMESyie^PT1l`s&?Y%gcntq(R^DnIf4J0RQu5<*P4nuZ3RyqX8zk(?TO z#ewtYV8te*sKv)ZE-PMu{;zb};CxGn@Ar`zT!STC;NY=LfgoE*{}>rd2X@@qov!#m5 zHLt=h>GXBa1bYR>Kl0hS_{vs;p;2`#?10grA5ero*U1o3Vl2$=Q!=gm_+hLjMoAO? zsjZE>xwv=>sO!9t;g>0dl`o0pyxwZCJ=>_9FSmrgd*(QuFNDvOr3i>N-seRnCBJ@s zi-T429PU&bM&VKQ+YlSuB+#7M=vi9+8A>QAkOHDU#GOVXY4gEFa(03+4(+pF-%Fck z?*xd0PP1q~n3TH5!91Pvf5uV9>OyJfx%&DC~E5S7XmB{?&Y>C z5-Dd`s1j^sYAR78-@4~>pwoxT!$mgs3Av9fMk8I`e`NXJJ5dX~Rnyc=V&;1d=)(IJ z{O_EGzQ9-bp3)rF+dWG{aF;HPtmAl5uM{es4~y$HaJ#>^*eO}qpL>PBQX zKrV@ulG7bx^Y8Eo&f-qT>p!mL{P}9i;)f*iT6u2AReKA z%xZwiWhp-gM5h>=jSOJFz^nZfr4b|kG0{Lz4Iz|8cA$hj7~l5vGep6T?(t=u`%&#` zi@fYxU@sjeal{+_mY@U9a#C7^(u)SCM_-Wp*WOU=C1B&CLf(38EG?n);Es%pOpUHI z`dl`>UoO(e6*LWbiw?WH*um)>?!3DkPNay^mSWiKe*|(&;r1K4sFlSPtQHH;?GeC$ z12}8`F*>i2-^<`LlHtu90+Fr3m;y)_Yd)9%?AngHQ=nD|xS>=}S8xBMF_jbubtl-r z57VxGG($m?tL)>#1}-f0LHox6DDC@gECcXMearX;Kx5ZW7}g0>0wYnMTaiX71s#@- zSAddrN5F$%yo7<-b8E|1*xn>?%w3$Q07(>n4k(^=rfn$JK=iV#8D)@GR2=>~G_=;) z$zwfig{GM&tZiYDw639|G1M%_;2f^aqzS}@NS9>G^!xdF0sxRS3>OZNNQbnl=t-uU z0hf-7p;6?yITKwL@82H*1S6ekk+xsL??(FdVbTYI*T%hO(oyMyaw|GIIwmI7+keZx ze!c7)hyrRG`kj>9v6U-xbF#`3+}QK$<1iAoninJl3ZhIdZ)o+tHC8--E_@&zm9yu= z-}}Ai3GvW$2oBY+HU#24C3$HX^@}*2tNIr>R8|6Lmyw4Yb7fh7e9HCkMpB=SFy zOqEin>}|bG?AiM` z{p0@O1gk$RImlYL+cH0jqDPAU^j5BSpN04F1DQsCZEYS3!{1*ndp)dJ_hnyp(7d@Yh{e*D0Hc6Kh4EFXYdUB)EG<)tQKNA*pEoMo9(>EVW zSW15K^<4BBswXl!^jvGFU2ZP%Tbksksqe#g_7oNS0esybK3}Lv+EeEYcuWJHZPQxN z`-fmdZ@WNPLc0_wuo?L15fd}5(o?O6?dZ>VY^i^Dmf`DsF%00l4O23zs^b8`1T^>g z-;CBXw5+m3boqcY^YP*KtRw^;=Few4Spp%l<1qiS4bVl2Q%B4Bt1weW(X-=Y|E2HD zguL#1Q=g(^wCguJd3agj4O5Ph=1bLm%$t;H8&)79Wz$Y??ZG!U$LrPN()MNUn3|WX z&I5|^Kv2wg{?Ykra4o)&I|RZgI*cVh_=Z{{5CB&^vAHk)b+D$b^aKSN8fGblQ!TYk zVsiLG?*N_umo2Y8t(1_EA-x`R?bXO?j0CYVpkq+*BL4pQ4eb2ej+-+PB*Iq(QLhOrdC0QFT=US33wXhvY(8Q@kJWnnQFPDe9YYhOuu_B$oMMq;=R2+^}aMB zkxEQXHeyaCsWbokz~J@AqJ44N(C^6^*KGy=F4lja4hR$=yp!y4scW2rl33v_`Jh?m zug1@m2&GSp+U6?)Z0|p_Q{%qmQ}+759~Cwnx$oR$_p=9`P59g#f85P~4s2l%k1nTq zJ8+&Tgq*G(^3MTQ1WL05pv}_BD#S8=m+evdPLB)wf7&n1zFjR8_kmbBF{yhhNp4)99AaB8iZ$q6{>4O(Q~fV(R# zHZAe_#beljy@b`cL$E6-sH)z9$M#|y6$7tG7785zGE^lmaw(vBk-@ZQ0bueroV1H) zOlY`FC=v^E$tRnD{5jfes--MIXBe?@aFn}pDg>^zni>I=`ZhZmh;uQ&epwMVC{aKc zc_Fv)^h7}oQ!g0-So5#WXq){v%5#eQ5B^b}HbdA}gc+|)>1m%W~n{OemE>XT!c zs}z2RqO+irW6x-!UT80MWL=pY>AfnwGl~H;K>&28CwJE+bKrs7Isxj!ZMF&kz4X z@ePHDuMDP8wx>V6Xm?X)x!7`RUY+Js`vuZRtUXSmOKW#c>FfIkxXQ}jD}+C!%WS65 z?&E-Q(}LwPrWg)%DEfnaI5tbn27=v7_9!XORizI zLc~!IZRdC{;>fyJ%65`ljaj(*a;oP{{K4W0gT<66XZ{JQX9ei*l(Qn@HII6Zf3y9kxR;xD6S)=1fae-=qQ zM=Nq~$`)vBX(@dNn75+YRLUU&Dxgr!{P`or4E&*W%{K3YykAb&27YUv&=Au(+JX@G zBhyD1?f^Zbfq<5Y2@XRpTp`HZ{1m30szSn`+fDunvk$0H;CHmq_`hU@_0!cp+NVR%x~3MLPa?~9#@*mtqxu@HZ=CDJ|EesX zbjhhOIGDE6DSTpgi$q3vCfeKq#yHvw;Pz7tyDl+9Tq8E{WBZbn1KiEl<(IW4sG55c(gj>Cg;ai zoH@!1%1?{&8zi0{A8#_-wwI*YP`?P|^K;nSoEvtQ48c5@cZTbmV@9a?x+##pX@awe zy7XwGC?{9BglmsUF4D3;Vn!s! zWvf3T-6NDcPvu4ApO`&7U3qyCkLa1XImj0WSs$E)Z%novCGA+wG-HmEkuh}Qq8L|Q z{81>JF9+Yoy9D8$x;-V9!2e`#UAoBZn;wk8G`ptO3)^|raDV#|E-x=bFF$}qn~(yK z&_Stq8D;RT51w2th#maKKT#g1J|V=5hLYlnd~G9_XVs+9o9}h* zi8tM{*i=EY1(sH^`)&qbTO96JdPFW%Dquq626QU%i0FXZb=WR1d;1Qa6{+-z}?)8GgXvfwH!w=5X)0Ye<#X1&Uh3PDugzHhN z8=AM$n1=LQqqr|Wv-N?FL^TPv+jf4M;Y(kSCL!N?;8Wf%DB6CH&1ww)|5$tLxT?0V zYy65Rp-4-IG@>-pozfjr0*ZumgMdhJXA`$|EbeAZHknTQomnitoB4(%zE{9LTvzv9$A4JIqWP;P?mqs* zA{Q*Ds?=N&A3XG;gCvO*ch#Arzp@+a2q`!OEF$OB9B;Gs& z_$&O%#*}!E4h<853ek`KPK2=BCryHIiQSFNj|a}POlhHui-aM2_ledh6*GfrWb$N| zp3R~cxt!=Q;=fua>azsE-nSwtnT4UyRdq07h`og2vGE`=lkv?SZ~88U&yU&@2t>ro zSL^#H8JCqt(Pmn&?tUJ6N0fNwy?uGAG0*C5fjJp_1oQhtR&{rD)Drx8_HfatG*h~70cs-I<GJsbD@U=JA;$ls~+terZX66w`z%fNb74yO+Iin_&yv{l=82Zk|D!< z!Je>0)jaUp9d;lhLVpxmqbzZaLLaf-vev4xROpy7!Ypv3ke!S1~Wng`T8# zYL|tekKWd=-~L+7e>ZY=Yw08&6Jg8d_B%{VrluJSZCxEN z3BgF0>v9s)bHiwym#)WYH-U9qR9Hm;1Ikoe)ee^)-j1cVy4RE9q$Ygwiy`fU3sjK@ zDPBczN<%Dcv6n@z>&CqiVbpY~)y(tby+{qeEk#a% ziV6rx@f zkX*5HSEi9^;DmY*s(eg$Kznv8I4lEwHzY!)fu;G8KV9VqxSx|%bE_aOSV3@k^~5i; z={}up^abQQ?9NFCaChI_F`n>meh#Gu0CzdaLrFBl?*FHUN@^MygkSmqj4|uCV-GZ6 z*thK(9=5m2M!Lr*R902F!+&n>7rdEubw44u048jPpzR1iZnBHJ*+L)3&(lPGbaU;@p?6kqj%L$sF+@j48!UD;`JF$=Rf%PP`SWk* z%a{{E$4XRKoYAfaF%ZI{AfXSctx8KvNvyR1`{Jgh zw^%7MfG#00h?Ve-KMW8%eJ)G9ysSzi+GKUC^3P`{Rc7k_C`k0c(6EDP%MywR!LqV= zAEDVGLC#%T0&SbabS)!1e`T)VvSMUpBww;uP0bMJFRNo28ufQYMNzjyF`%w*)%k6J z_MSD{tpBg1riU%#E=ZXP8YLH(pSYxRa!-uy?_Dp!cj57M$}xV% z#{ebb*Sn5Vl40wM4v&o7zOQkV;h)La^S-cJvRM|}yzNBe#UjBzWJUu?nYEvNKwEqaydVoIUYr|Jfmyl52!k<)3)pVk+&%+@sCv9tE?6|@2&oNX5K$AAgRk1 z_(&;J-iR+*G4t+K97}%)_R$^J7CHh$ZzOC@)z}=ZV-Ygnpyb7@-AYW4;e=TQD)i;0 zrEkf?9*_Ml@>SkKF%q;zj=x(1VIpuCePV(9Re|aV|5$eXz%d?oqX1D`Y0D~ZJ0;N3 zr==mlHOroG`_kxccJqCyLBV`6*L2#Up`lm9DNfG3{WtIKgXafKtwj6DD*I`nRTprs z0VoV8nP~NUU|yj$HyiglYYc^nRXc8u;?lhnDEX50>`v?JvtufeN8SD3V2Xsc`KYDv zVojLTdvd*56(E^g7v<+rdwOTnD(3nXMw-HqD%OjYUJ9GR@86}}TCZ<~hym7Kphrf; zNtB)ZIw<#`U4}{PP_a(W)C7(iSjXX#y6s@20ZUWnsz5RPBw~xz4ay z`uSgLA(W4`Ge-IwyWrU;QCTE%dGu zRn%;mxx`4itkrxZQt1ZZL~}uC*TPAkl9E!wa)W6+B2B-hg{MvY^=8%*R14@a!WR55 zTKooOcLD-2-u*fvkufna@LC&W911T5J^kQ6b|N&(piCSt}@3 z00!_GvT(g+=x$nBTMraGpeZjem$AbDsP-}t5g=FXdV>Hf1y*x>*kx~^$RI94FHdL6 z5p9?L@Dc)G|3TdY)@N*Z{@>gXmZAg4=0Dt!OhAtRcNe;^*JpmtoAItGl)Z!Z!j_n> z!MjH04)5PQhj?1I?R7@JJF8oaf&FgwgMoxXCv|N_2dhDD)GW8wQlCHgOZL_52R#SD zI?0GyHz_xT_Yvk4*xp~8Ms%j@B+h6OJ{W6?mzXqYP-z_fOBWHMrEh9q^CREqY#YTa056OjUL-=kBmgZzk=u&pmF(?+>ucf$Que`^qOqO| z7PtGR{tC{aNz|^nG;W{v^}O0AWOGl?W;uZ#aicISYP4z!i)=zv&y8=NMOBEzZ78j7 z@t^jVXTOluR8kNModk5u@`JIuaGaQ%YJuB!)&!%oHvTaDGCS+9Cj>)MdY^E`+}MG% zWv`D6pkur3n29H0{whaP+$L>NoK>$;`>J-RYwk$R(ziS!_I*ZKuQj7>b-CNwy6Kb? zmxr|J?6oKNM{05n%QE7(@?3U$zi5!CN^29*{r#09~IrdWDC&nSW2G^LT zSLMHmiW3q4#-EYEszd0AC8vkpqOmV<@$e<%@K;^Wqhwf1zM186av-Qs+s70e^oMFA zfz^a)i@eYnSNLZPw$~tXmX3x0d4-(|5g|Y{uWg8^>m%p?rYA{++okb$VUn(tmvhJN zu8dbap}R@-P!E=Xy95J0fP;L@pqq~b+%-(!6~)){RG@?u8LPbrI) zE&Q{8*G_W`+~b01?eCHSFl+)tfmHK1%>u|cK(s+kyY%XTAF=fEGIZF0=L4zAb3qOX zpe9K;%X8G#2Xkhqe@0#Xf4C9#9~MvAb2n;{KhOAcvp>&35qEY!BH&N|azjFXAy`#Y z6l5;_-72-IRgps1jz3JF-Klynm$ncbI{XTmEX3r*gbbZ!cy-CjxAeQ_S5qN$Yj2gh zzG0-MVU`uvabqCUrKzj9vQnqr9DU?Zc?6mbtef-S`h9bmQ_iZAsUFv_Ygl|0$S2a95J}Y!bk&8ZP-=r-U8l@CfAx(;v#GmX-hX@e@-#>rl zi=gAmLHXOU$ScwSHpWgq)&jfOnri{4+XSzVgS@;Evd8IwtjB#b6Emg>_()JDCgdXf zhG-w~+6%!UDl3uYJOBx)|0&`#gJeF;4 zX*EqH$GAZWvZ?JW*GM8J-0>KNNaXwfDx@Vx?|?cjXmf$r)ZVh0n0`a&6Xz&dLIgXP6G#-RAJPx+iy!uk+VK^-wh4U>a?uixb&Dw$;C)f#^5<{u{6uyD3SE+la7|+yuZEA`!6l|%rpna23R?_O|6|j-fHq0`@xpf zRZ+ZQR3Yfwzcc@7ap#;oa=w45dF;1n6PEnZ@0njxS~8Ne=C7J4!t%aPw{`+NWq+c`X7!JKren_jBVi1@H2<-dS@Z=0` z(E^{0;~DuirE}6cwOS?uEPman;CIAODXqgel;;!3`PC{k+9ovGD)ia>&V~rBJ`(MB z1%wIJWkm-px5`}ofRj~QTibL`7g%9ugLz6QW)`q4h?B1)q2jeOUB_?TR#t)J$R-At z(Odf}t~0~KZlFXOl4rAVKKn*?n|t&J2rPTtx2LMD34`N`4OwSPH3U2Ca}a4-QRPyr zLOa{rjldHczm`a3p_V2jE4w0uN>K8pNy?B`FX%sf;^sPzxt{VASY^7TEx^#xjQxVy zXk#r1jx;O1Z`TU!C+f-Mv3^`4a~o{%0kz}?Rt7@2t~OoF_cj6d0m&UauI~orS=IXO zkL+h_WjPrBp^<&-UAb$>VxD~f(XZiwcX3v7G7%Sd;fD&X17p`p4P8uQq^ztg5X{^p zF9A_3#^p6|C%K#%WTT=wS_bL~EP~f%Wtr#;yp)EZa=bHB7pfp3M_e7fuViRQv0)^A z>e}cs$_~{)5K-duq%%6MK$J>?l?-W*M!O6$!j=xI{DZL?F( zFuGejE-T6r`uywP#w#K;{H*Qm-5(%*pP9uw#N2ndMnN( zBl$$Pl5gsL2H69PeJ(1A5cA#~reIG2+ddZiM^DR6f`?(R0;nTAXb-bw^!(l%=Y&U( zhQK9K_L~Zj+o5@=&-5DMw8|AdRJxzWXZvQKTk#>U(hX`MbUk{4{p$*?eS-mNr!2Efc z>u)sDHB^n%wDFk+hbC=qo>HRb)Vs3kG1wMbv7}&EcmiB1fq)2TqONzwY5#ra*+wFM zZX2khlIMK9wZTykS%mPtX#Z>9_o6>;P!U(><24MoMp&0?4pySS_Plt=sfzd4RniJh zi#Z7+pS~nP7fttje3yDW+bEEC4evP(<^}{_%>$1m-NV-A_&=tv*D1s(eed1l%gWDo zp&SR!s#>~;pvxHN1YSx%8)YoGGdw7BUOsc%SlSj9>Z+ORjHam0g`I_uy$VbsUdO%W zn#RDPj`E!>f2=fey4MqR9l^qeUg&a1Y~II(Nv$)hIe)mbRc*nXnWox7jYTN55Zos$ zza<5**=^pt(_zXhiQYxFvdHasn8Y=t$mI^m%UA;_wJC3o6_5%8eDW=c3#1y?>LgX3 zbH4ylCCa`>l@SOJveKWjiyzX0#YGI6uzPoZma9ke6w4SwmZk_mf##k)BK#f|!$`ZiI1<5{Kn@1vh5K%MGgyAAvWVv1Jl zD|B6QWq15xzXYa}y0*``kPSImuZx?pe7Xp(eh3{Kb z7qXvDpB)w4e6B&-GG)Yuf&Ec@lrVq8y{VvUl8)(QUYWB7_lcCFoI%S%)R00eop+ky zt*7*)sW3VGOMq1$J{MJvwqeAu8F*d;`yb;Ao*r!27(e13Bfa&JZ!qE0e?-W(ij8G# zn57xg3FH(t3z1;`eE6S#yx0-uUT)@SZqDtq1Wp z-SFW+wycc>=q~a^9z2n{fB(LPMUE9cZWqBxj+>l<+;n5~bT-piUt^*Ch7?1&P}e{~ zf55M)DWiY56kYe8e*XdELd@@sfq?s_e+_jHK36h8Kemn4+42YdKY;^|idP9bHz%7+ z+ozPZePcVBX&%c+bf^39M@b91W3w<lZFK_w%W|jxfE*j2+Ngskc^qE6~P5-l|BbZwN7)J)FB=vQ- z>FCg{p!_46u7!fo>Y0x3YmB9pWjo*}F zvDup;pQakgtm5J=pzs3!2qIrjTTp&o&G^+=jH6VCHa#4K=6==13f5kWuIRw8FI*|e z$uoZdIwyxD;x1h8#wV@h7N?OjOFldLN^rbZ|A2mXy!48;^S(X!E*J*hDY^UyS|$ zqZCU-$}oqhDERELL^q-ZzeY{@w9LC?RD-(N*Ehn&3;r zk`Flxaig|oO>Krhmzr+|g%dihyy)b8={UDQ#%%Cq?Bbl*LW9QN=|!M;SLLS}{iP!C z8)dfQ9g3O*2!5_oU7qK~qal4$Il!M4V||B}F_2kI%jl@CoqCGy@} z->2&$$^b#d9P>XK-RH~XrYtunFM00R;re6$aj%#9WjQ=OA@#=cS`%Qv!912j+E}4y z+~Z|=ciTvYQovDyyJ!C`!#7x5yQ+=^2`N?ky3vDBORHB9aKBVZUG0PVt!TsEKm`>= z7@ZXKzj&4#v;GtYEVm5G^^fxplkjsI=6Zd8erI+f;@dZwO4LH+PWsP1(A`w&F!1WT z_hljVE$ABE!a@V>4_$#v;#b-Aqn~8AbS~3v{rhbwNky0QkO9m5I-xiIa1-sA%Y|O5 zqR6gKa<@Jrj!?A9J_QgS!3r-=njQbkN=WIhP5A7Mqw{CYGjE8xqL8iMjZ5a+x0F*PVvEUS4b;z)epW#sW1k7bz5AwctN zNsdrEf)bS6rMv=q8;omjVt~X43S2PJc+h0l1~cu9fw4v|Iz`Ct0l+DGrN&A$oV1L0 zRfb}m6p$%x1z1@dl-C?6H3hansk=bBK#+E0EuK|tZVZ;~DX7eSI&{?#J_B7^9Awg{ zgANF)_Cexml*(aJo-59fmXh+v>t_d?c*b2;Bz}Pe7xv2f1z!qQ`%_@=q7F*H`gwY| z_8r!LUkZ3UDl4b^<-OKRa`2-)AMWsDd#-m#G_hENJaQ^|875s$!LAv}aR{crjpAAj*nYUZ&CEHw9@S%_h~uVEBSU3Q~9&UjQ6g*Uon`BWRcQ3CRg#wAj zG5sPlhH#a){EP#4=K{a&lKMn8FZjY;3a1D?^E=RZJN9YHLLflH&Sqtlzjb=mx_ zfc0Qpo)So%fBYPvcg@DUKOm^P<2VZGcDoHK=YW!LUVfg+kBw4LSL6^Dy?aIZDpsR?<#ogAsIcatUwVnAA8wK8qrY z({PwkU*1K1=0@*C&TA`D54hnmRmsxH6V-8w@Jq#@GNZp|zqPJU_h1q!6(djAzfLW+E3^Lw6EEnUK1oaepSymWo#3*QYYh3y10{e%gKGNO1#06|abnvi<@pv{+ zHM19Ro6SBISpD$e^M4fQ5BU4S){7~aEGWu2)=w8g*xaDP0T=qlB_^JLeIp_N#ywbpHrthaB+rBr`*E2=$% zj>!I&^!V$W_t8@I+1XO@vNV52hoB;#`juF9{3jV1w&}MyW~%p29K^+uNjvAnWx(t} zSx~kn-DPBitqM2_be0kTDt`ii3WWYQ|DB+2w{NTcr`Zg*mkQ`w&VPUbfXuhv{%^|o zJad4GL*_+@m25ClG*fAt81`juXjj+IZzO1{UIgFeaz{iGSC7^nw)E8On@ETvQ2piY zZj6KKFe?Inq0p0?T*+Yl96zKT%b6*Id;@?<L=?-ctDSV~*EMDuX_re7nsk|LM%Wo#9Y`L^AQ*FFNAR-*3uL7yw$Zh@^`~a^uFhF7%CGG21rffmv{xa(JWDTJl@y(m91t?GAWfs&BC~}c-FnCb^2+KDo zuyN>8!!1ELTEy_P1Avjj9tGvC01{zGMhyNu(Q8DPvb!b4f=5hFPR=_k8{7>E!)Lb* zUC)PZgy><8InSsDCMK|tG<_E!2?P7RAGYh-d17>9qNy+U4-TLJeURs4joxnG^>>g^Fk(+LJhE-2W? z9c~XBwm;%*x{t-ckf$BqeDWGC-bSHt@swut>b@y!h2G8!e{yW>AtZsKZk_kn2XwOY zr4Nt=&vT8GdbE*v+dVi9OH{9`78+SzEpn%CMbQ1y@K|n`++G<(R3NtGqu2@YGY#=y z$F6ut2Rx%v%Z^*R{XteH{wx>cKGU#?(~0Tl=gV|nkLLulG7J8?9jZ%#t)SNJq@>sV zvNlWE?Z$k`onJMdh)?V<*C|C;bhCQLY)A=A5q22JlP?7O0Bt;RL2_81v zQ+O|xbmx~PhE4RT^gdTEAH9I}bS(i|e>8 ze2E|Jr~WiEYTITKydI($pyv=^#0qc8xhL_g_P~^8vN2us>_9e0fd};zBSPlw`ka-+ z$>4FE-{(zY=cE2y*nJqkUshErsaGJMBwBT%e(NNuTNWI~Ffqa9BVb>Ev`051;bzWg!i!nwZu@gQxqo^B`!{RJW04lwU8&c@`5 zYiFyh)>#7nbU)z}fo)VlD>4H6b==u0j?2n7dpkSgUhP$?3S$4KZ-w7I8T_PH7<|R_ z?XkCvDjl5g&d%T%7a|9MR9nFsMk61My}r6y05y?8rdh`VlzQPrYSPdq zqTj*9fhtPdQ$BjRlzwm0;ERT=HYo=&;4eaZj>9A zoCx`MsR}hN<9psY&J89dMpDbq13n9%Ed5*^3T3`G{t0(g^70(dSjP1ht(4%Il5>0D!7SG5v~6Rpg*z_ENgaZEcp@!Po2l{Eds5)T6}DG8%1U0s2->J^eX^ zh=i5WA%BnlB#SR;pFe;8UT6C8W?xSaU1;%dxn$`ADwj6@-=#bI`5qU(^6_MC+o|xF z`*2JX*cp8OvSIqPK5;uSJ;NB(7r&kB3H%E!7 z{GP9J@T0s6b5O&D+}8CRx1=7-(zvbrLkC-5*4^_H_0iTUM33B_+PcGso2)e6;Pau0 z+;ZN`jd|Cvb6R-0g~c?m!v-~2U9;Vghm2g<^EHXoLa0M_wk|A>^`j?8(5rusYK69a zH>}aa?QXMf9Ew)XJxsPYWvO$QTI#-A$ZBYvQ<#68ttoFWV?4_@OzcyGt?gEScDc~^ zvZh0cO&*_}bOTnQ@^C?T{EExKKyU zA=UY11PQy5LL-DwMvpqg0D{CXg996c6Pb&hOtSMw^6(4oG3`Q1&|d9(lMp41$lUh+ zdxq%NPyK*V>WsWOTTb0OG%^x*7xD-?Hi`QBr1;%xw&(-R;rMJcotUoQSlYw!e%fBm z)9rdHXpHNW))|lL`BxgeEX0fLN}eW)IjED9oy@Jh*c~#5$(!2wH4O~1-x@tEdS+uU z1^UTxZo3KI*p5GQJ|aW zXA7K;2#p*gFr%VN{Ie_&6$@kZkf%+V`T91ngk6E7qJXGrg#`0_S@u7RE}z(xpavLu z3%D^V!#tenrM8ni;Nh&s#@ZX^-?uO}!F9Q>=IbRMwc>X}*>se~MD3MeupfQP(|dR7 zdZ2wlVOhd@&EB623i^?K`La6A)b`U4%x5vs<6a+EI|%0akfg2{xO{C-6n^ru4_1Ar zUv&rV9gF!>C5Fq@csi*yw+&6+*D2*b!%sL6RT-XL)FjbJPE|K$*RJ!f!_#)d)6?4x zwkbuQ5j3eQoWMG|02kvPy$2ua_6LfESsA|_$HIG-g<{qngoK1Z))_8yc#D$w;y^%G zaDA&qo0TI2$+}yzlQ2Z|esH^Sx9N}uTc$_LwD8Vi+Y=k%krmIKLd^o}d{xD}+66J; z?}GDVq6&pW!tZl_8Rm$?W)|b$lFlD+o4>OYYlFMij#vB+&1(n7e-Yt*4?hT-ytsRN zd+FFF9EF+tBsN^?a~X+!B1EoeDi^36W)AJAoD_OXY~v{AYv$(4))x9-d7rKNZ9gR5 zXou((PrZAOtDX*DyI7s@_nnGT<437d{_PF&GEzOUh3H~J+i%Py(sfeo!dY1e^QZgi zw}R@O80oTR`1s-4TH>r5`L|s3bIE6NsJX5)MaOTIP0zif8OkJ&I2?Xu zu@}l|r4~>9s#N=6f@RpHYs$0mbbZRBSD|%V#O#)AI6C211?e^4mGBm%$j87GJ8O4g zA~q?>iIQ@?voyS)?3y!`I`Vy!_w4vtjvlA%<@1FqcIuhPygD8lP4~RB%l*x>tKoy! z`Wm?>6~%Mx_`^c$RCUe4-xIOB(>0|ju_4o5t=X~IgkL=oD%&nEndMXcmI{On3*V>4 zYBMtn&VDCi`7UED^VqqyL8S+0K@c~<2Kjunli|*>ImgUT^!n)Gw81=cHD5K`20K3$ zuE|d&-$ol{Zk%sl8m1Uq~y-_IO1#HG;bOiYtpBwk1dD0rq40qk%@{Pb03uM(4FqZ`iG|i^p~l4BRip^! zFyc%1TRjJayoWL+z1nSRm#-g%U!w2%SjP38G|xTjh503Lxz6SCCtJ*YtqIC;W}o6) zckpj`u-mmY)Qw5^tx!%?QyKfvcvcdRU_Fz8rNo@l9T{Tv>(k)5UU=EcLW0IISLA#WeEMobzBs@=_3q5Jo!vB{VXFF}`uCL>d!dpmP7> zg(tbRJJPaW(DZ>^ZI@BT!Zsab=K9|wjx7k?kt+)HJE8_GUA8F&E72!QT52pd%vmR2G(`hWcn@Zh zJQRm93+m{9xnj#uWDpP6mCTh%%IU?(nY`tmxRQ}}jdzlBRo(5n4#lORVw=l~qGY9a ze{##uzAe45z~XpaOiS}-Zu7dQA@;4Oydnz1tHt!VCc+$jB#Qm$gvGE%^7UYt7{9N2 zKaHNak%kikb%mYKbBgP(LuLP_aA+LwZJ9$r!v#y z+eh`Pw%ab$X_^UVSKo=vPSQQwOdm?CWj^Vg`b}6ELib%>Z@$9^W7tY5o|j6ZM_Z4l z=cH;dT6@KIv2lL^ohGzJ^vN^*yTiv^f_I1GKR@EEu)u{_o)Fg)p`GIL23fS?=EtMT z!up=xw}d2Qa*+7``g>ii$r=mXxp(ywcZaZl3jE?B4@4 z%;bkvK!J_)UhwFpTMP$ZbXBtAc?GcL_!?pw<0-^3Vo`I7Y37MvA66gX>%G+BdW1tK z7UQzp%=aODQhO!6Tsb1IqaEu)2dhEiHcorg>@T9L5e#^iW9a0Sj@EV(Ma~=_|1K}c zg9^9tv#e*&BW+nthuZ5q(O5G1PI}kdy8oMG1cF0SrWG>}gv@hrs|0IGM7k*3;6QKc zctzP~I4~5?I)rN(%8ksbslZLg<;~QAm~1uJ3=Nh5!b{MGJw+8297`pZtdbJd!;b0} zt^vwCiOUGV?9$WV|9J`a&GCq9SnTZ)?5$YVob9w{5vK4<{O9oZ(t>G0%b4z?E|x?k z>yB+B+&ULFXeQlXbq7|N@7^H++=J6VjH;gf_-0UXlfwWYrq9n%8X-NzTXBCQ-4Q^P z@Ir8C?77r^e`O>m3wn0H0&{0DZZg%>+=r4G045Q|ox=41idPDoRy*Emw+aS2Z65K9 zRW?7=d;jH*9FWk`B1CxL&1H8)DplEwx`4YxoyW$;1{g-3!Lh_$0fAM39M&1@efIr% zT(q|c$Y3GVnBNJ1MyqpSnu1kQ0G?m# zxwin-J$jegQKNu!mBswjgAA^Y(NGY8}ce@-k!o5`=|_a+G*^v}0J#Ew$#T*(R`7QgB`@yXg(ORGyQ$q|@G;4pXUsgX*GdINW)?n4hm z5QRGuKlkS-$0^`49zZ29DRX`dyaASvfpDT#(d@@te0Pie<>Uq?DmhH*@velU*MVW1 zhy4|Iq;j>H2estP=Sq;J2zt!a<51iKt9O($Wi~DEM|6KMD}(e6*fneCKRNWPcfmCZ zY9`qNu@61A(Kivr&D*J1{Bqlr2m+9s%mpc!fjsyX7pfSg$VMS;X_;Rh4xjHSkr-AT zKtzf@!O!xz_gQ&v26Szmo*lIYUwi#d8PK93wnPpOH@EQeSCYslh}2{OYl1f`t2Bmd zo0~+BvE){_e*w8Io1-)OK?oc=s`slE9!mp#?9(03_(wsAkfRZJyK$Zi7A#E<%)H|T$i(OG$z)SF#y z_}K9NJ*&95ssA~YiQXi>rT9J?FA3Q;_9lX?3+vqXs|KlKRpmy&?(QxKYG72uVGt!? zJSJ^8iSjj*?3QSP$w!lzaK&Q=6mj?AtPn3R0IGDh9T|uus}I2cpSOL!=L=$lh%8ux zouppOjtd`iI*sOip_I73Ds9ZQ9MT3Ben1}<1+r%Sq7Zm&+v{LU)7zIpBjRe+(i;3h zx3tRF%VT@0Cj2#%nXwqmA8`C?&3SU2GE6BHs#6i<;WC*OX^?a-raTKOa$1~QW4nDj z0{fb;_Zg@K2jmvh@us~%Feo%|UFDZCZkg~CO6HX5AFWrewVU*O%>ikX%9Ypf-1>?N zIH34^xB9!~w=q+LA7GG!;zqy$xbTW_maK%eo}L~U*g@6pqzRzN#m&Wz*uj$?%N+BZrB33ThukM>r zbCFlMKK|*wRziLCOzodH0O4HBcTpq0RF+dX)&eFJoCx8&HBkwYML6CM!}OYbq(al-p=97y zRFQFi)D--2TjPACotyxF1^+q}amH<(NYw?HXkNew1S_l=xaZn;=5@mJ*FQsdc3QHV zYHD03tDwa2(E7$pF>n$BURz741)Jm6*EbwZ+FF4dSIbJn1H7x+)E1q)FokyJv*q8< z=AO;aTIR=>jwQB7pi3`jT`2oF`*$UJ%DTv$9+P1sD*g zIf2x1W=8yoiIJHe!=6+&EQhJM7(a_aYUQJuzD?U60MHg+2J?W8O~G$hI97q|9>{^* zkKVZC)8QeU;Mn#axRj*6=8>!Dy-owqd#cm%bQ!OXJP{t5Do`^$%#{7n7K-as8Kf-p z7klB*5$jw;VO}1n$eS1)1k(eeBN}e{zqo?&sxfr!Bpkh$&v%pHz6XKTefhWML;8vo!34AM6AkI%mgGyb>v6$;(q%}aFh^$^nn$3I5=kOA1i^jvwZn0 z*cARA9eR(V`J4oo2ImB8G0VTrcHWJ9d4inKz(^QC52)uun-WBOj1mhPwvba%$TkyS z9a#ljtscnjFvQ!py#v#JpB=I3B4G&FSy@^6{1(Ia)4Q8FuF8(lWte85p%LKs5naz; zS=HmEB_at8Q^4n~R(NZ2WbTnnI_1;z5#agN^JG@d7_h@~&UF`#}G zo8{^4d>qjhGAfThvaBEfG#Wv=I?%g{6)2q(JTYmwdn9aRdZQ8#Xo`_7~$n zYTY&*sn!l&o#F6OmR+lJ>2y+7b>!L;Q%a@hty8&WqbDm0q?ez^;9iEaeGI1Cqc*mE zu&FGq4!~(AAf&AIYr85i3WkB;+8OHw$Ev`gHv=4La4h5vW|Y@nDxR#V5KxpkhKGoX z40u3w+0;Drz5@9zU^1l71P-&fU^gu@hazU(*RL>lJi%8K#3$3$UW6tz(@d>e+m~uw zP=4dQvCqW3?Fbeg@>x^S3x%1- zHjC?1cx`2oX74I0cjP?)f3{dGf8$?T!|=*DaEWP%x-(FF^NY^972AiwPT2_p z{%yNC|21)KLRJsEwwdL$QHi{C?@qUZH&F{6M}qeCpNkZ2uMM5@;Z#pRL{<+#JuWU;s43!gFNi= z|8YDipYHm_Os$eRUs1bqfH6+?FHe5y(>_|rz+0l7xulp}V)MnVr=W>vh@r^AUAI!9j(;ns;pee5Upv&rpc! zgG!@irx?hKozfTx-ed*9IWC0OavgBq@!BaZU3n57=;8)o^N^vFxc7AId4PVId9VV{ zOux+XFr;Nf9_)k4OPK+4hKFMFZ?^`dt*u$FnuGfeU9YD!VFD_1gS-is7jF~c3*ezQ zWHdKawExLzMEfN^3ZG!r9jpdGDU4SGwMqi^cPMeWWqXQw6On@fz)8OhtPrT|NdwK_ zqZ@Fl0f4q#tg>MxX~n5KfI3u-;D5aoEE2LV`*>yy=ho* z38Yt|P~8h7ZfPuk~#d>Cl-C>!qd-*M%$-3HzO z@>$p zT;Bn9dIBemIv0#&9-pePAFamZa{)TMb_z(znMyV4O!0?NqF<*$%3`me68uY2z=-G}^O z(#$hRbKy9C+-^fLpZLn}|;_@E=6RqehL&_n`rj+my^#l*OL&q!CytT1#n|-AYIo zaC(vQ$kLLIwKh`M@eIY`Ks=}0iUi*clo~Z0;7sUGIc7z5Jw16X{H&rPWgZPyA~@Rc z%H!J3AmQKV$iBki5A$DTCrH4Q#JI^UP(g-}SA+2Qi=DD;Dgjro6t3X-IMd4^SuBA{ zaI@6n zWj|emZApyfX&_=t6LM2zc;>X)p9KuHhso@N1L!J4L2k$tYfI6GkB_z{`Bf|rO}*d5 z$ES+9$ibC|V`ZQG&WA=BHxXN*y0=@d+===)HSkDotAYaHB3|(tUS8fukij~R4=u~% zxg&3>jz&aat5^=z9)N#lor>DR-BMFrG9lgu|KG3k*~K+c6W3lT%-Q3Hyh*v+2ZhrG z_~c+5v-38N8-!nHbCj^ZXQ(4yib3|x)RAPyZ;(}tDfc#T}rqa?i~ zP28^@2({p1FnYk;u>9LCabeHp?I)T+6TgT8TbjuY)Y z6#n>KKPun|%DC!&INNO#Wo??07|L@SQ366%WhFK7MU(alc<1BeV~DR2$)ds>{GaRU z441rJkSe21_ZlPwOdL*EeE|ORRShSM2J0GdcDJ^(>zJs8vg5Yy5P2-WkqTJ78gR|)XBHgivl#*#YJNzplyugSAoTLsp6NJZVa!2KDZtu5 zoO8RLyaq`xElSgCz=if^6o7{I+g9=h;{c`24ROg@&p=Z85(w54hif0MVSm(b4PM)- zt%WMT&&f`XpNZ_pbqU0V*R}Q#kFkoP=12$iPZKF zT=P?^6#(yC-+bDLPWPB`wRsx8ffvM?mLX+cYcjYZeDmIrA3@s=DYP*gB={Q-`uIO} z8I1WIOdqKEZ41He^+uk3SF4v7sg@A^^|H8>_eaVu_#o#@{PwvY$TaIsT7H6K_W?zJ zjuk3u{1sk!#Ni(;5Zuc@!8fdocJ_|?qH82Eg-!)?y5M)&URM8?G_@2uH}$9#caiQ` z%_#C(4rK?At}n5OI055`qJH&}XOe1qN0R+S)@YqX!&2nq#T?d#DbG}zpKDh3zhgts zW*tQTAFX|NRL+0gHyI7Imxf518rqYhE>Y1%8Y+rXT1q8NnzW@MG}P6PByDL)MM^Za zmx_k8hm^|my7=Aq{XFM9=RWs&&f}k)6W{B5eaGkXe!t$Y!5Mb-q=8O3zaSy-py_C$ z1JmCxz*r;KBg&{Xr5xjVq1FGqz%0^rbtlQ$72hg+b1oa#Cwu+=NyAV=9830~@+Y#o zGM*q!R4KUaT2Y(%&L{CWowcQQipe0E*IqSj=WtRMe#(c_pu-_U-&4KYu8kf<+mz_2 zNX@CtQ#zl+&Z7A5tu1EzQv~%Y4!SVPUO#wk)ck<3OK0M*z&`ihl6lP7Q&UqPkBqdp zx63JZcXz{SSI%Z(3{v%GRet%#j@iZUkTU~b=|^7nk4fX)9dgg1dGcPtihE<_*jec5 zz&ku=sMiY7ibX5TuuMru5v6@b`VMtNI%wPoPcDp!F?seJ9{odbzGzIRXb_UG0sx5q zUW`NDsx@eb2Wf)$c<(ZnCwR`=T>tTLY`0xcxi!_9ZP1`qwvJ%~M+1RyzOFWpruk^Q~JyyX=b&265~uhC6Z8HKv47E7bKc^7t=TwKfz`Y=qB?j!gyNrkhgs`{DcFH%m9ZXrKM@DaC&(6utl z4+n3^X7+yiBn6Kt?_W!y1tGhYc~%szkKNJyNkMyYqR5Hk3d1k~i5A{9v{5tF5RZc8 z+xKIk_oW{=P$$Owy}{{Kp8E&Zc_tUkIUstz0Y%K`H>xT;5wa1*xJ0{btKJ4<_`##- zWoYppWYfegq#P64K0y=rOq1f4ud*91%^}t_rP8_o<7IcO@&%m(;g-s>$@Lad{Zsh(bd zlOhm)R5Z~2?as%0aJW;~6rN-(o;1XtHDeKPJT^Y{%5zK>j4kJ%jvyx&$s3yL z-rQG({VmJn)ymA^8$iUE)gaY6;K=b~I^+N#Nb@zsS;IY+?}iEY7ZL6CQr@LECg(~) z)Kx3U9DJ_V&}r1LYasJhzB_!W3ch_}$QiX%a@%#ti9#!xtYvOWiE*fiv+L^?5PEv$ z_;Fx;pMgjQFQ$sm>QCsk5u;OW$0d8=?N4f^tMhY?k2_!3 zve8zd*a2D{Vyk8nPrFl*`4$J|#wqoMp?BG%{?TtT-*iK9^9vd39~&BWp-KbBen0=x z^K-8}z!y7nG{U6#>M(S?;^)fW>Sp!i_!3x;_(w6m+HBd1FTF^pck3MR@PRQYR=zg z4N1KzzvZjI;$&!kC!+BjY5Z#r3pjq1H?Jfd zQ-9X4pI5eLwYqSiEXAu9<;L>8UY=7!nKWv`yZUO=?JGGnBKr-cX#}RQF23=P;85W( z;2hgAVy3gTG-tlnH=OFWS*VLbi$OyT!Mqz+d@%lVxhJYf6+45jxca>>+@*GINlufi z6RR3%I1uRAQuCr2V^aZ3t2d{It`Avra&HdXLMxN?`|8!J?a$BuCX`S2EzVoPua5Sx zfdQNAwuL0R6I8p#3|$u=R8^sI|8khg)ZFm0MXY`E$PC-Bn_e-O!g(UKTBN2tHRb2x zv+BYvOT((#9^OMBl75&Ulo)4A9r`+*zDS7X?wS79?l|yIb%?12!ec>Thfr+p(hW$0~c~5oM{@^^f(d;gPRvt7Htz2#Y~De-1xop`NkK!P?-?H zI1w(4-a4lGPz1{391z%))4D$7Goq|ZYAQ}4-V+ldsQApOUx_j0I^>hkaF^fBcGKZ$ zKJA;tnT_%djtTO+U-y0TFVZ(Ih3(&5NC?!*BCf5;^xsvIsf*aF_E+=f<>oSUh;dl? z^R>rdwo(-tYkZBnh5tZYQ7eT6VRhv^p~RfMV^IXQZWf42YwZ@bF*+c`uAz_I7k zB~e?x${F1T^pqbZCIu&p6OMW>CPvTjrm#O*0BT87=vRm1(Rh~Aqg=swTm=7FAPSHy z`5l^AJ`8jg*vRt=f<}V+wb50<1dYx_&&nxf=FUWaN5$Zx1uv(|dSf%=y?Z*5_VL4O z51DaIo^_LWY0Knw^nSWVvDj{&Y%pGyk!-(x%B>%kP_uvB6%&zxU6a+P)oyQ`SLpJk zomt?QWWMLkGX>FU= zePLZQJ>&-$6VWFWd`QPb!z1rF0B!-N+mxK-II<$f<=#{JUSO7G-b%8oVa3Adh?Wrz zohHKEmlUaPv#_!CERMJ*^f^{UCd=nKjBd2Ewam4$*mrGGSXA`6vg7Wz z+25XpcXOO4m^amjdwg9}?6ltf_folWX)YCfo4yg_&?9R#WfDadjwM*!xbWlKGibKL zU5XvP`H1l9<}?bNOk|`!|ELNUNb0=OupZh-ipehi?n^{&CHnawP0A02lRfp}-I(m} zHT>WA^tb!iDcYD)cDez=qg}~0~c$O=$74Hnziov#Iv`8 z#j%WoWhk(e2{#4L&dj)SNQK#i#M)XUwx>(9oCNVW8ioWl{pV-5M2fX2Ix0XESLOQn zN=f12`0%>(FESMN6Yl>$wJnU}!Tn`|kFmZBV~G+B#JVw#K;?CklOt$5_sYkJUrfkR zLjyUoZ3r+#l}w0w4vNY?i`~hGQ`TQ@(;?KQ%R+202v!4E=c=?beLk5}B{QbftjYLS+AhWdeniz+5 z!$$OJw17qx+mptGZx8P>rV?lTe8THE4)u$X>~0y1`lQrt*r5?8g!5!Ic>*iX^z!mu z410MtoY$B>S?;lzQA-oI_h_U;f8LfJ6xM94nY;!-ro_{DDl~NxWxYL`fzso+t8U735qn zt?20L>gwy8bhdD6=Y(sItej6(fNsB$$WGTKhxjnX8~q_fIDhTo*m7vHCOuJUQnHTv zI&%GhQ4E37b2O6M|2l514D>;8%N#n+b582m`ct}04x|y%KS@3{1{2d-=mrTTCO{*| z+qRMeS4?nG>`99ot3RC(YPJ>|>nLh1gHSAxBIK2j^S+^HJUS-8p2%m^&sum}LR!ih zHY}%~=pc@=b9KwMOCJ;NE7--)T@*g(ORULw_C9?%kJx!Kl%P}hewG~;Ib+T2)#>4R zM5(o%fl@IiNkO!n*9M0)nxBfJzhNd>r_~BBaK#f@3Bsph;^Kywi^+MG?Hk=rd9VI# zFfFB_p<&%`cyp6Ha!9zexz5z9sh$91;Wo0gDjX|j-bV{WVz1S5-rfYLMY1?r&CJx$ zbIoJechf^z`@VNr}er5KN%T!IWt)Waz5vG`}-p{u} zSsD2t{*xgITn);k?IIcI%Ek=B_RkG|Ick!^6WftJ=G8P%$#+GQ`$(w9d#nk$C9g0= zhKdgvFUY_OCBs+)jgISz*Cyh}YMCWzrp{ksZqV@{p@W=|v;iN=gM^0eoarO}MM`@$iIrF`t&CHzalVYMZ*;VS+Hs0pgIm6^a?^tp*-l z0&MqBLpOO8@L1qB&!tI!&v&&W+2^>Mii_6ft++no!(ff&q(HWr;4muMXXgPY7Klmd z49=LVg5~u*JNs70Tj`1xceqgzepFQYr|v!7N=QkeBhk=!vA=K=4?DXnlZdWz=?e4p zm6)(9>a&u<;?s|~34=79z3H*b%R0mn8Ky1_8_B~*CW@=z3<_Zzn^)=)1yXX%8UyeH zYP_Y+>l!klAe}IBV631`PdTNmTjidwauB2|KET%Z;|Jgy`;{!a(9plogzf@H*KN*P zTA{Tx;n2EZH=^KfZ*9Guc^$ZTbQ6wr!Edw6=u9cX6)rG{`lnS-KjQR#Q8e~phe@em zs5d^AdItst{F#B==Qh_)ok&Ai3z4(Fk`hI2I|M~|XA5KC!Z)9Zj)lEuD3hXxx zwH&i*EW3xt=^?oZ_A3Hm@86FMSer=5#pskj#dmLw5aS8cw4MCIfE37_zrX(kOtLUC z%kS@}FXZ!1!9m|{204KbvzzTCfY<-8hi?*M96gShopdl4 zzp&xzA3pL#6F*`AaLr;^&!3WVnh!tf{_|@z3Ejm=Xc*U+Obh>Qe^am zPa08t6+&~6_Vdbe2)ZTHD! z4kl!ds2IQXqYyCK&A9ywJ4_77bj#pJR8AREe=cp(x2dUy_YJhea{ELq)&0!5NZ5ED zKPK=|P)2i|=4LvVb{|tQ1*XP=!b1MVZ%lP_93n}bXBS{5X$QN8Uq7Zl7du%GC#q`bdKzy<4V-eSQ5KKEzEfXyo zb0<1cbS3<_qM{-c*HpBRaz|Gw$TL2N@09hY8l~ z6=$u$CB^OsECHc0WH&LEGEJ%GO3+{1r0P8ki_A7Y7|k|$+VJ+wepk*!Fdqj&yTP|Z zHT&b(i4jVDKQfE;WqPAi$}K^+QNwyO9cK(DK*>DlvHBC|iRvR&d!+k?E%HBqJx&YT zDMch;L4!*U>ebPyb{)mjqb_!F z$DeP}Yj?wJW-WPs$K?D;<)hZWXSFQ8sTz;-4axP8w?;I4xSEl0^NmFyFay|f^o~;q zT9gw~Fru#29`9jmqo2k;S&I%z%(TR1w&kC>xj8b=@5FsU)#5IPx$0T_mxme;eG1y$ zQvQgVr|YN+R&-Z91+L#atk9Y%JiY&q^q$z8G|~#OU*VJr8~$vQ;ye_4oU2{#H_40J zy}xD|H=9;-Pg_(o!vOS5_lE0^l|ctKo6^$K zNG_FTeF2s+8375L$=kqtIZnZOBM;q5M2lvoIW_2_BMNOoTFqLq(yx40+<2f@l6U0Wd$R+_;HS7 zSDvMNMh-~akb~3K)*@x?mNmWKsOS2sf^0!bQ4zYSS1dHk%gbE~3YfqF6nu9u2f+BpWRHeFeVC%hg0;E%Aa;%OFAK_=X3@y5o_Y2zjQiK(cZ22%1rl7y z3Hzx2Tt4#mONd5pu|z@u=6m?u=)C+t)p?~yIgInb7Asp^^Nebr#k{e|c_LEt!{*D_ z_^Ojscn7z!%fM*Tj+o{zGY%`OnasYvAT5A1i+D!^^Vu%n9|+5sv(j6f{lX-mbBZ%| zH?BzPJ?vWxWI*-s8ZJRdLG&L`RT#kYuh_LCjQXqor9e^|-RJR-bq40&%r@1Ewmy0WIE zr1Y!87Y<1L?1-R~k^>pivURLk&Y_?Ao4OxXsaH5Bzume5zJYT9P!D;p@UiTo9UZ*=2A@v|z_c@__vMx2Ha6=SXU18)9wpIz7>3^ul!ym0 zY(1m(0WGV{(xy97XgFF63d)6qB9pJH9KH0Kc#AHY2yAkDt)Ph&@;l4Ce-#2iXSD~{ z9W^THFFzNibo@zm5%Va)k#px&5DEK6!0zRmffy~c*RCTik6Th~+$ATc&F*P-{o?CRO zr#Cf%&P+)sXTP$rzG>^D;sQ~Z=(~P9%$;vH(F$_@^ZNbOgAeQk#SS{on1M#`b4cl4 zn4*iIJW2QH0l+$Kj^U}N&l4(dT#UT|AOc)OCk08H1?%q33DTzSn!m&;L%v)=j%cSY z$h2sYK$sC-{EhtvbLVn|mN*ss`r{7*1An9Y>2|=`SJy?1baKVcmsz~W!vehG_gL;&SKT;R+)VilQp-Rr z#`u&3tW5M-6THod&FF>64t=2W)A1a-kg^QvMPli-l;0*h^@7gh#Ml;@?hwJvGzdFe zWF1vZ#5St?Q z$Z0j{CzBTlD%bvfyV%YpN~sNW9P89jO%hk{6nrO+*L-XrnD;P`E<}@T2HOnY4>1!H zc4U}*7!VWm31nU-zlSd+i&!%ct_*YMd>}>Xd?#6}@(KWu*74)Q`&DDr92~N0CAS!> zf#yM^^(@x~Mpa6FrOAaO{r`R>>h8Y)SnK}<03)&f@JgweQoe?AQC(cE)Y*qwY@<7F z=khi-5KHneGzK2y%y15QCSF|Wwc#%itXsWm+Z?&X3l+4$A7?ED@!K}cd>bY%ZJFkay+cV%^T;-SVWhwEEf z5+iwUTcDs5Hc34s4Q3-|%X?maA8*ex6=5tVGp01}J!mbfZ(moHwv3@wO&5(Y!47jB;qM$yJ$dc>pRp$9t0%0!owkuG^7xD5Q&e)tkHyTfuPZ!EsIHbS_ar>1OEO41d8om!f=E3-8N#|H4 z#VaYpAk0RUd8Evbz3FJ;?-0?iQ+GFe zgn9fC7#$2h`{1D#A@Q}Nn#GoFVaOD1&nBZLDeSRisa7ia0UyBX^yEZxkmnmCAFN^v zA9%puxO@6kjxusdgEpzEMl9rWU5!|H$TgRp1Q5gw92$I7@2OLHj?KLDmY>PPwQEx* zc#V-1(oA1J_%3Z73JQ&Gn!7EJfBiV)v!7OgdmL6*7yR|IbY!jh;N& zcq@`8_xL;B>$aD_LAHfW4U`v-ZS|PZP4&F~jZGTBDHi;i@%g&8XFwm&DisAne~s$9=Hu!f+im6F>4>--YwM#(HIs^-9@w9MR$MQ^H8`6Dn#H z&REtsR~j+T{P01ftEBC#Rq>)A!L;l;!`jDFJJ0Cpef@;gc#{6eD5W{`wa$xr`f(>o z85tS1f`-f?M0TO~g3F_AZG^rery~c(GkOHM%2mTJ00`7xsQTl4KyKUr+>`BZ49V)Z zR}~^}Y|o}-WY8?WDORlcC#bXV(Ef8GWW6|9z~w{rgzWthER0QXmVmYzp;QR=baI*{ zi?|%9THD$x1FbA9zK)C(78Kkzfz;HRyh|Ud=m=pc2>G{7Pr3$I*uc~b!GUU9^zp7wZ-w_4A$U)$0?6qG99f-acJu- zrcR>MUciBlS)}C`tVoBuO#5vO;cNM3Jm+PR-Qc+Q$rvz<=_D{K!|HLd8CmmB7i4Jv zFs3-;`ZS2MaoP2BuIRHYi6OnOU`j0`y>WJuLT|B*>yA-* zOYn3+hES6|(J#}H&HagmvWm#o(5pg|PcynVk-q@jIhBXf#Bqj_thBmaz110*wd7Hs zv7EHLInA5hzMUx+w*e2%|KVTr-#;i}^Nojo-!SNHJG%NJ6w;NTD@;NTD~&=BC@;4xdA zn7|A0POoGo;L1kGx4;7=3voqpIJn9v%o`(Q@EG0xg|-tM98TxMKlom|LQ^=neT?y(kE5q|~NIPr8 zyERENhwd6_``X9swOYj#zD8_C4KpQYzJyQF0$rG0P2Yo?$&Ad8^&Nx`A2?RRz7TG0 zZboM@`*Eyb=ypA>4Pko=(VU?z3senP*HG_M$rz{7Sv%ifq&+y_H-M<9T2R*dUUaD= zI^nRtI2GL83?L*CF!ZaF-q=LfH)!n}ZS##~RQ!|$$2~>+tvm1WN%+th{$~yYPRaYb zyxjbOXeI?Ex$8{ny}1TD@YJov%Wy2gg6p-Rq$hOa<16@&P_W1axH&m#c*b~L*~bz2 ze?u)HB3Fdyfr&e)yae3etYV16hs$mr6OA9Rlox87a6AkDis^vP$;haYYjg68@G!;a z7p-ft zzV`vBW_>(u_I5GhL|g;lYywbldkVb5*|on)1>N1I@Vc-<=c8QbE)IE5_80d=ybiX~ zEwXK=>$2*#f)wzo2^+l5%dl>*&!y9%8teMj2NTRT7u(LxT)n}gUv+j5k3@a%mL_g3 zrG+joj|kFPu`1g7V1oWV zp&llYug==t?RA^_-QDHt%?B}leo|7?^tL{Rc~m0nKig82rlYM!_E|YOl55|T%s!D3 zS4pR9mcQxGh1+xp-_#FEO(iFBl-Z{!)vJ*UN*&{0uigD+)<@Dp6;Y`jlq#5a^%TL* z!&53s*L1o>n>W`fT2CdF7ImSOCy~$NE0)LiiOETN$&vJ?ba^3BExkxwyeba=FYx9V z_CEHMk77S9QD=o!nScLW{5mY{xZOkYv6G|Ix^?`gPmijRc@5u(BjZ}1B=TSqa>f*)XCl0d@Plkrs-yS%n>>Gpo+dXZLmy(s?A zCMF9A_Pegf-#M}s8q*HE@8-XrqUz})^%lOVz(WnkS&kE*D=R8f(_*mif1L6nPN9mdM7vvYVlu+ObEj~SfFEO5d}N296D0-y#+qy;iMf;g4V@L!mWB==<(KW)6AphkOKguQ~S)yiQk_{5h`i|aJOOtP> zBb8sY#k(dp%niL2lYqPd5=tgQ)+`|<; zWJ{Z!6le$;bFiq0rQT|E#Xr79&eHXHBjGF-)c#HZ?s~q!bU`}ler|^rxVlbhrE35dipKvII)^^`t zZEOW>pjr4&kZ()lt^0>C>N|e$93u}2w;IT+edAMR?>8!xil*T-^On$~0V^nrG>{uJ zG+Fi~(fbO9$x}65c5fpK2k_&ixKm69UDiLi^hC^D>jX6)Qw=s66t7@E5#>BtMGg7; zY>`R@hXncz+I-?^@ZG(J<0%i#rA$0e2#c5aWNmDUK{wzx>OdlK+_*m9f9M(!Bu`BH zk}zv(9v(!;5s)~VPi;@}BI%L|z6wfZ;otymY2BS(U|995RqVs3-(J|0IOew(U2OR; z)5-KjKUvXFLa+^%&36t9x(psC#sP73tw)dWWpndrzMK92;TuUNN*PM~J@Z>Y zH<^Ns%QO;WL4l3OD8?7bVB>sUT}>v<6zarRv$+3hY$^Fs14$_Z-IbYSFp{>10)laU zZ!Tz#+{rM1&CXT}kNScqC#@!`g{7sXd8d+6=kz$D22%)bGkb>}6g?_!)Otk=fWdr=n{rUqI|cpPQLq zDU?qQ85215KS3xcwlU|Cx$(hOcCsjVxM+5F-Xs`sYQw5(YO!f)*j$*Oaf7Yb3RQD@ zBPzAnJ%h{lR=RhztAcQ;aQ4xDMx%z$NNrr4?_Yf+tFrhmL+go3XiEIllh2zKmY&w+ zy1ewkjj5T%-OPT-ZFiQz>E>EfTU+qmm2-V*pC3-R*leMyd;&++Ho3w5rh~;8*4jlV z{=(af-`_K6?brGsb{^F%LjYS~U-@UYwl4gRC@U))u@HoAIXIoz{k>o|^ERTD52^}r zJCQV+j&8%BK9jjqk#5P;zI=rO+8n+E}Te-qA0&-Q2fNc&Cf*$d&IoGOlXUEv_;J^?aTe8<<9> z+v}W9_fpOq?m*OrA$oerVr_loBI5UthE#K82cr?^PtijUv5M`IC4*A8RGo%WL=EO{ z@iU^iEe{O&q_#)18k~NI)eI!e^9=l0wZysUEtnOL3uX3<_9C+azXgeCxA)Pd{O9VL zn$U_xqyoXoDw=(Lu?Z8%#J$$3lwoPMb>)f-k_W$}`=i5Yh@NMbV8^w^dJlMKwMAfN z)Jz;@mT-;=gu6HPU3@EDGD|aAcv|;=obJEZJSpa6$>uz16;)Ll$<}DH;Lo4{CKdUE zl|F)EYHeu*YU9WXD2)I3G;`j=H3wx)gA2gug*M7k3XLx=^eHqre#~^bG`Vhq6*Y#YMGOEXfE^&y6hdGQZ0Tk_H?TDQ{6R2g4!kB5n_yi zHp!#!u@~^yLOlLw;t`oJJUV}KDhdh;Ua2ccHLfwzZUC|PHMNXXIPBtF-c17B9fj(B zDJg8HrOPrtOBJlCsbO+X6>_oOtS~C$8dT@v)7>5DWIj1pAok87SxQJ#HKp1}m`f#Z z(0)NI>eGz1Woc`>(Ckqau^FP89-HMYnFY&&gwuDUyf(yzKMii4qsLLJUkY zhU<3i`z*)vz4;>8H6Sri&!I#b78YVzMy2GqM`lU56?hNkX9!!j^~nGZ``vuI`b>6z_q)1U_7VD#4%CiB0_cx!XbL=d-Lae zi$q%hB@=S!#Kj~D`hN4LlZ_1NYNci0k@Q|JcdM6>T$~Ml?$i9ewJysi5L{2uEe4}3 z*ady_PA7t|989YCs-oYP?^?y;I3yJE@|NH{{Y%Dd=|_#z&=6W{d)=qIolMJSR5U?n z%lNah#E{)HhlX{wWNNg*lRsrFKAgDouV}4ehG$a(C!v3_BlKFmduB=7H40x=Nk-zz z^BSy%F}mA}C^JRgHJK=-c<~Lxczh{KD)TJZiIDluYHt)(>=RxMB7z7qQJb5Zd*)V8Kx1R^DM z&V6b0I^S!)JU-qSz7}QT8XF)HF^{-I#xNi70D!^PcCX_D=Dn^=j7Fr{&deH(q-kX4 zBiAz?mn&zIafj^_t6O=Np&8T&$sp&sdIu9Qa=gYP&=L*Yws}@oR?owg4-tt1ab?$ji$EvmcjI*snRNR*O3Q zXO($BcJoZIM&z)0cz6^QpF4L+X>M+AS=ruQ04kNJkHYu97cUj3{)EY1w=Pu^=aPr{_OU-b;wcpba?`qyI?u@pUrAi3b$6@E zLclsM;Ld4nQ?)@{Wy|Y&^X3Q{waw(Wk^s3S7dgk|qcexgBeRH_-QC?OCgp5t-m0(9 z1osjSEvXEe8o7HkH8hk``OrTYikEi?Y7AIe0rjCB4VfQ7<5j(D=}cD+jQaP-prG-u zUyVA0bD&!0!^t1E^&1@X)-RnBN3tY??Thl2(mZDl*Nb|OuWD;f$JYn{goOoCU`0d) z-#aX|!)px`-e2kh6+Er)1CCIaP5K@QXBFzeaxEN&I7S zPES=Eok9XeYC9MG3n{ANSais+=bk%&V*154U9LwN^E~fvF7Y!GndvqPXX})MoR{bsut{^<)YoId zbRLYxiSyHDwq{smZ1>g;at7$ieYeqt*EkYOIiZ%jpxabS<|=NXCTeH{@z@Td=CsBc_jTQ=9Pi(df1tdL51bv3V^GdT(2)p2PVJh*1ctNi2N1zM`(vfr9FSXYTu%l(}j{X=U$HvCCR9j~Y z9ZcZa9N-(4nO7R?@YV8I9vtA zKV8I&vCcWaxcCn!1%0VP&V}-Vh3RHHT74W+Xz`chQ!d++EHfYHzDA+N_{z}|%%c9) zAw#gPLn>#g>!xkGSldiBZG%*NddjYM)2_(Sz7vwS8iUJ8Hrw*>l*3DNdirSrh-aR08StIaO6^c1S3g zI5aFgs#Mt66CxsxtvNX+$pt5P_zKr(y47k6InuUsgK_VEeiE^n29(yu#s<(QQ&x7D zgQfb53!n;;Xg)>shkw^zfQNfYXK>1ixvq8_$~8WIA6VC?!RnKHFkHiW*>029DDE;S7Df)hfwyOh}Agum_N7>&Qv8(YB*Hc zVLxdV`czsXjwPM02)9Y>`T+fu4q(PWqH5d>sU}$JyFHAI4`+}!fhj(LH2;Pk|1qjk z_mxrb>3#kEUkVGOV<=Zj6{ydMu}7iJ|Lq=tn|%r+A;P>X5if{H<{%!~@Uy79ooIjE zTv5F_)L_K(ia@dazue32hT_@F4zA*ix5T4&QRcv36}-_5RgMY~9uvE-#I-}>ZH>OO zql%&w`NTBW#qxb%;FGo$73=LHR7_FvLJ-b*F5pHijR|3)eQT5 zRO_hdro<&h?XexVG=ZgPGl6dC4QJbp>rJNG<-2@3Me$s^NZxAoLqvx-^IqRmcrv-L zBR}k?;d@N0w|*g&xZ_O!Ws193;O<^3KzaJCTJau@xL4x#uHhMC{1CZS6OBLJCKxk9 zat-ET_Ki!(DJnJ}wWv+m8sOj+~&D|q!zG!W7Hz5#_+~BVgAa$@SiN%oX zYiLSEm@;gw$tBNbq2G{NqVEtyl;vxhiScMXC)LDcQhsS$gYfjIYRX(X%$_S6E!ton z!#3;+%krs22e!#|dxLs9C3>JH%L2BaRI29T;~;B31SS*J+SiMG)X!wqXMf&U;FV7-HZ{1@N&*TZGGzJ+Eg2;di4 zu+1!3y~On>{^K);-y>;&K9C$D?@HqCcE*qXk~K41UnnX9syn{W+0M_{^cWf^feKc; zPecVnlN?R7P6{Qj=P-9rt8q0Y?5LhpRRJjXEdaG#uYr~h$G&yStD$@Tt|)YqQZ{En zf^#|)>ycDkO6M&t>rPI6J+a07&C&61^_A8K6<#+??WKn~_vO-thvY31~+&hi+|s zs=FN~4!n;al#~>QT$ou>XrT6O(o?V6h!Ym^s;CO-=j$Rm;PVPVEM07c#X>01LqiYI z(E;fF=v-< z_};Dc#Z9Vfb!M)ufmUw%J-Mc(xw*2Ehl7KI6MA>B-03K9M707TF4D}pd89fMtau5} z7JW?Gi^v;CkaFXavylnsVurhUe|EUmkDq$V1stOK$Ok7US5hl90x7<>wiZA=ht*zO zC8Z$Yb_C%5Fn@l3c=&>Zn26u%XsyA+15`1YyKmtK>rl9G~)`9@=QHgH{HW;92k9U;wX`=-oqH@&V8Ha#w7 zmBX`P7rFbpl0q6{R|W%;vUsE8-Dcw6#_uN>S~$Y7r!(~#3818}kc@Q;g3~=5hb^g~ zhojbGh=4>@M{)a~EfckzjmpmkD|hrkcea}Z0=?jU5zyskY-@Brz-C_mmi$uT&YgUB zXt^CPbqU88mqVB>6<={)UTZ}KMW?$C>3%u&@`HP9_|X?eYcAKANb3k`@1jLFH_>lc zXJfY*#8Xe=X+Q(>ek5}?Mz%?r@f#j|*Hr_ISP~S<-G3FzhcmOR!%dA^Vo&<5rX#v1tnZ&{UjH9uRTsHX-iz<*egcwnM+lTI~xp|{C~PpwWjha zE;>qJ?@#7kZ!;tKNWri4VDo6zc-9OVjX;&sg=z#ueZl3v|GmbbBM9X8k*V9rK?PWe z%``xx#vNUu0gNNl10Ugl-QBX$G4AB#<#n%K0+AGJA_g4u=bJZshv)KOvGC@uOhEIM zQu52&;AE5e?b0I(FRF2O3vfMsZf>^j^0D8Y1}QebIb z1Aa9S688P-FZaTE^2ZO&-Cs;}tk7MP^K=ogr0eT14s&FAv%y#V4JKUo7ho-JC`5QN zXYf2f?u``?JI_Yao|{Q^7r=IADgl{|i;pi|tPqz`kNAW5eJQBGHAC3rsKH6;F?Veg zpk{zeYs)xeMT7^8^oN91!qhW_fvKoVG8U5#_e1&{L#cY*_J2;j2L&dxI_$z^&C{x9Jh32x*reghq#4Xn&x(;7|lP$0}*{N7(^ z1MIUhDk=jCP_sdk>pLLAGNVc!0VNmoPEUYPfW6o$+2tXvIpL;#ezkOBLhO05Io2(o z@F^IJgxj7vsQIbQbZXg`1^{S&HMtcir7OHt{9y3q++=PSae?jX3W&~Jlhej+74oU` z*ksQpr>C=1&v$o;d4jR2(g7d`X8SzU=k{u9cJ>MsEig;M49rH-`0eyn#{k2Mb6jZS zTBwJtFV(N1e9O1nK~y5t6D39>MJq74dGwg+F($%`Uici2Xq-VyYwM!Y;t3xgw3D;< zm&iidy^i+&F@=wjAw56+hx<8PPPewVXI1nfN?!%xbZ<>21R#INA$=hwxLHymkxE&a zB~}#$T0yB+!y|?eNqZIxDIL=70Eq+i;}55Rri5c7C&Pe3`Ivyfuz+&#+o3TL+R_BC z>yAlN%f=8%rP1h?*KNDhDzM9eZ~}gl^eFkJuBE_9)O2laP*2Y%#gzQ-iSK<%Znb{q z_%wT;ZqHpF6B9@YT26F_6UkG6tG!XGn`dSQB!+L&w_qO5beX`oW1v1ONR7{x=m*|A zlxS7106Z8)CHhd`YySKIqZ3t?5}U%te~?XOZ-7HC;Fr7_QV~JHZwn|QP~Sa|*3jo- z8XFs@kdb2Jf4s?_gzhLR%0^Lgu(5Ss zGB4DtvZu()m+Q5#Iwh{I7i%(G{HlF--x*h>Bbf5+U89OFn^R&=OUo@_-_KolE(|vG zrv_MlR&PyyQR593R8rTZs`~ltbKDJ;ymFYtGXkQ7gaqG<1Mv-RSw+R+m>gMt+c|-s zjk0VOV8&9mm16S%dcL!>!=ut#EtRM8D^(MI-7yGk&zLg()7`);{esWF<%B8 z!`yrWm;t^*32JVK*}b~m&F?$El$C)x)HL^I9ng0m1gT0U^^=3e+7{MHZ3? zj6LU}$;l~Xz(JRim9u6gm5@<5*qd(x6>%^m5(wkxg%t5k3X$Y75DJo{Bw#dug5a0v z*C_=#X9f2+gn(^kYI>JQ4KE*)u+;$P=Y-&8+o7JqWtU5oE z@f!PslOH;FUgQnhjTLbw)wAUxc&K>U~x@dG@-kzL` zp3}70P!VyxiKDRy%FR7_5xg(zzEs&FlbffQD4+^Xar^YodE<2iUspMjX%|vbdKYeh zgq$3PumK7Gx3^qehc763O@E#30$g-b2Fs)})bqQa0k(haWQxHjwO7E@8os9bE2IEK zsBOFI!1821OFY5|4c>mDEfSJHKgvZNR=PTaacd$Y;jTmm#`Z7|`*ZtamkoYQO>G(6 z2FBQc3;<9Cq8;$t`)8^>o@^L^QlIeh{_fkVj3Bo*$-Wu@qr`Hxw!dmE4~@|fakv~t zskPup_2;HP;Jp71Y_?^EPLuYR$pTj6;Oo|VgzRg%Yjm^kq%ekqAFWWVgKFKm1DDYm zgexmZ7@k*Hh_>$TJ&&M=ky^3NrjbcreQJ2x!=aA8jzuhhhn!8WO2ym@qzl!^UXRfh zuXB5h-=GKxiclnVD+;ZQ;=Ldfd}QPu31T1XTqECQ8|TK8n3U5qf&VwxAIl_pCMBpP zCD=B2X>ba4&{aJvdCc4Csshkr|RHh$p(&MmAlsl9x(qz5Z3fgQt8u#Ab zV%y@X!_lF>lQuB3tyW(<;l#_I~Ej1p%nB zWGyx|*!xsYuES14gIcpepumhJZw$h7t{eUu&dbv**AGBW7tgy&UKgzrp{klmVzWLOCKidr)(l92;OH>S*_ThL5J*3tLu zW;dBkl*ZBtYa%mduCEYyKl-lf`qDc3f&jVd z(NiK>8cbX-+MLh1xWU(UJzWoo$Yu{fvcUb+0_&ljTDbknSF;}mp&-Xix zO^i)A2JC|3GO$@vEQ{m(t_Gi6=J55hp4$n;5tv0)YP@TsC+Dul?cG-|bzN^}Ju<9n zM^V2X%`h=5?aue^&hu$tcqfjzsUY>1p{_=Yy@LHI^DbgWrN;AJI&ZX*5V0#ZpfE^f zo@HI;8at~X*yaS(hDnk4oMj2&tz@CI+T$#lgiLTiPtV>H5C=PkE1sXo_UFz9^FeML zE{cxMF9zi1IbUcQbwH#0533QH9;fGjDpd3{qUw;E+m-Zi4;RW)%`nR(4ZEs9Y|wzo zNtATXRwKOB`c@_JmreF>7Yi*J#&>pL7DrF}zmEivCs1&RsU>s&LkH-LpG!>zvQ^)U z!g>{5U48u)vp>@uLauwWr$_7ZNu7A7gu`#%pDoK}%=7}@y9g-Z?eXvONQjk{sLxHb zp!(a-#HWOY9wrs5P=ocdH#Q|lq0WbhPj-FYtp7$D+1K2GjG0kAefm`37R^g9&@6BP zN=^2Vdw`$c0S2d#IbTu@8DK8&Ob`Ax| z1z0NpR*2dkWJa7&e5;NsFhbwnaNKL*;1rzd+;*XadIJDRM>57k&yZJKEH85vnfX&z zAV>5Miu^0%Y$z-Lo*5yh4oG?B=H?S>!6GpuGm-`AP|`Ail+@Vw(JKkmUk&d3Vj%UosE z;U2zV?TR1tpT`xE^rwrOXXQkq(btnvA8!;T_%U>uWzl%}Q@sAC?7|l}UV>-fIPJVk zI-t!nO&HM%oOd9QpN(N3>8dx4?MQa3iq(bIlLZ9=&90&%sud922a^yu9Uqzow_F14 zWhesZaT2=G9vJTcV7$oCriDB_XudhsKwXTSf&j^O!G+_iTW8`x3e~`=!bckTB48X| zYW)oMHcm6AS{Xq(WXZ08KmA%c0yS;C+Tuoz%OVaYeQaAU3#c_Z*EJds(ER|N1=qk` z{69EuMO4+W{&E#~A>4iGN>7 zzYn@}vGQ+6_)l*D-&eni9wRQ3DlW7uiTC*Iee7;zA2r=bi1REe_}s(y-+e)iR=UPJ z!N2AfOP``dxQ_lM%m4T90BT~oum`PDLj>8YH*ajAPJDR!S2VHBbjR4lDmpr>vDqoi zU!z{eGWOH&_mv=`@bU5W? z&40mGOt7lL8>ZCG|oK^LUMLWStR09L;%l6(&RB zB>gn&oBE%2A&G~`1sob8F$fM}1ax>747Jzm@d!rnk+HM4629vvYARwQ!kWxn{Z67j@O&1!5*D?gn}%ho6OF(s9`n4l3Sq3p`k zp_GCzfh6~vCty=mPIh}wM<}k0&5HuMW@xLnvXa7eqFiJ1{M{Zi{tSn;MWl3w#)Oow zYe@nF=46E$#sNL;70gN+eQ1A#Fnnc4V*r(AFEJih0?pz5kvQ66?9yQHV08y^oz3U6 zsz-+AD~65*B1L30UBqqcot&Q8<8>4XWbE6>XtG2#y*j(DHYL(qH*)5|7|aR8UC5A3 zz01jYMU2T|mk+CIEh^dXXz?`p;xO@PS>0I64K}%2H@Uu8yG+FI*RL&m69nRAAW1?e z_lmLu<1=?^D_6>2$jZL{Dq!<|^Y?|bv;E>x76HPrcs8~b#tY{i^`@IIJA>wRVTpag zej5BwyB`%N;Qr2`4!n>$dntjo#S-_gv5>d~&!Vpf;H@wjF+BuAJUl#jCD71Kn5hEs zM6eV6k8>&X+gzZ#x+UP2f{49a8$8lWb3bl$kVgSa(6hxmv5wt>yy$&@2Xpki0vae#3{C-Q1HEnFak~4-rmBST3MkC0Z^eZ3`FmFG zT=|;1^MxZdh0}ClJ)F=$@0s|-Yc-!Ki=(3A)P=`vb&kT7nqKtwmYLosRC;TO8j%Ff z*Lm`vsUeutq+GOQM<&HrSDvYuaroFrl>iS11mpCF&{)Q90Y^6N*)E_by#3F?unrdq z*BfBM1$!47Is5d|-Q}6SfT*5|c}&+~vpt1>WK+$L3YWB~`r`Z#p(Mh3jwrX)IDHGo z$-<|&IC{6AQ8SfJ7Kc3_51yOOJ-1gl+g}uA7Q6(Z0bZ8IEbkLkJs}T2c^ezHfmA++ zZ23m5F3M|c5MW45O1s^fU?SmPTWIkDlGxy9j%yHvPzbZ_P=ba~)t?-+69pti&Y86> zbq^+tM&{=;g7<>U1tb87j@?+kGnr5y~lg> z?X4Mz?~EdZbVMXQ0V)$4E1Pn<(3JgZ58z8Y$}yMZZ)ckYX?Pq!oa7>v+hN6|=?=r3 z|5^B^+E@AF1W^i2p~*iav=mg)xW)SYQT~B(Go_Viy2i%N#?(i@0==CrVl~C$+yqx} zk3wE=FPt{*>33y)>XTV)Sr+J1m%OXWWnjF1A8{dJ(5ir82Z&D8LaX!7uPkZ>jJPEJ zBtS(J{tPTLt%tU)EF~=_FNMLY+Y?D4^p+R_sGqdl0)ix4ps|A;0t+|;gG9f7=ga^t zt}jiHZcXe@r}bzN$~y_UlcTJX*Ib_lD#DKIn6^{2b~ReO(JJUppN3*kuG1lHvdLwK zQ1;8_9s>^_$en3IFw$gRo3ovhlM}%1C2=w_?HQ;!SMV`Ui~%DB+%<7h47L=ND&T-n z1&Gl?bzPmPjg<#LI`PGtZm-qj;^Im;nZ?xi=vcG7rC3xMsCv9_E>we@Z+^TU{#f1? zdJsb=3)BsuN&XleJviA?d&57K>HT8ql%?>EL7%s1rkkw33dPuh|B(?EDbxPsa}t_2 zncmFxb8lCLV|U&ZBUgv(>O6aQ#oBREtfUeD922tD8p2?^U#V?OA;jRi{3^3PFu!bE zAH`{obdn-k;HdD4(Qize0gVLC%WFW?E&;mbM*6BE7evA7ObBDU# zNjwlt!c3)#@y~ntqu*JCS1}0VJHtLlH8t)M2-r2pAbcsvu zpd%v`tDG)m>F1MBF8X$9=%h39)9}~m%x$I9Dy{aaToy&}mo?!;mv}^KkK?#q;p1Ga zD=*mM5qu}#nNC(}$nS&N2x_0Xiej`B)!%nB!9e}b_cp&Dfw0z}pBtQ?B#dw-tD&>02cu4j=_xxm)rnxkHK9EBzfpUn-{;=Nb10R6Ogr6s-Qq4 zR3hiI1Qq9jmi&5-_SqZEcVpW(3zwKgpk_==&xWz~&o_;Yja6EoZi@$?0;5Y8s0{Jw zVczTpt<9FVS3pP0GQ%P*0D>Q&{B*KW>9Mh^huQ_-K1BhAc&X5Cq4{SKt=m4z_VG=3 z_(?=W|JK&ZQ+){hdS?iTjIiss-t>*-@Y?o)V#K777@d)EpI4>ExP=zx4bp_A_Peu= zPW#Lf>ond^%!mA}2IwioV{lK}K?_oZzH83PGI}8wR(DQ@Bn>SpD$*#?W1$PWxw&+j z$X5iil>5O!mVzTA^O3{$WEI~zozM7_=wdeYGKprCI#Z5}K$$R`Zca{&V(4d`1vA|!5%_LqLYW7|w$p7zIr zUk_N;6W%8UiWz&mufM(@>^&vpr%s^MM|WF-#|{YxVtRQ*6Qtf7#OfSYkax`d_NkPmfmWkgx)7yQcf1&^cZgx)iupN4B>!JWDV|e~a&N$2b?<_kBFMJw}pw%|@5L0h@LoY%WtvLzjXY?g1e)rOojD%UuE3 z6<_0@O&$}CGM!UEvy!$IsE^=7zmJSSf9p4$it(yoTZ%MinLI0xk^`Tt2sax{Fkxg^ zZS}**fr6G+R#+1E5`wVaiI_;7Q*JxkOaj{<%aJAiIXgQG^}UO5PLf15uLV|Q&z3SJ zFFg;76)<}!DL#Ws;;3R+v(W7F2PmK_g>|K+K%_mId0cru{+0KzgAePXn~dMH#FhH! zy-)sxdFrSLY13IeTR^&xm)a1sHsZ zcGWg;q}}eJjF`YC4Vvu`{ZyPL=(K^QL`aI7k*ELz`}^2Z!8rko8&UM|<^v{(MS5MG zuy}J$qE7HfS!0SqW|M`SErD$YQcLP@%0iH`<)NcBlp;Rfmq+W3;Y7-5P}oIZ42XJz zwZpF6NYF{7v~U2SGkmQApQ_XcpH18ektWWMg8J1UqTqCi2|0}CYFAm9kn7f4jxDX3 zMjX@0ew2XwxfIcNyLG@!RZ#%6Ngxv&sQ+x%($p)E6K&&&r8eDYZ!MpUrw5S3wX zbAx>kiKMSoL{zCxUP?{Ke3USM>yHQ`x5%uaSDBv*mA#Eu07_fCb9RrzO%x!&xCE&g zWpzzS>Vbg)pn9XqngF{}pgk^2vRkQJ*HHRYg`W@d=rFYAg50Fi@NGs)LY?cpkR@t0 zO1ei8s|83OhVQ9DLG&z~g>2htV@Eq>7{!XPJSg>v1G3`;p!U2RQY0lM195<#y04L)hLVLI|9+j=x*07HGmF3`6-LVzfI@?dglr)s@&sS0 z_iXpq*rjSFyH1*>$cLj zyrkm|eeu%1a_Ej8KL>ez>HBNcg01DwU?OXq(|9D51ymt)@3P__Wv?@YLE3)g=Ej?V za}wkEW2HcOSaitiY=;B%mPD|#1jqFILQ9=X6;t0j2=4*py)ZLM9ZL?z>EQf3Rm1`i zWj=IJf;ngMvLA4CkOe&bxcZ7J*HVWOiNY8@o{N*S2l7qxlXP)9oet$kM533Bf?(eG zPuJP)gSN4Cw4T!&`E4vfPJ*+0>tF_Ybp-@78Cb>C6*ifQ#BnUsS3Rwc^L=|4nuK9R zMP8QX<+X0~dZt8zC4vr7P(#_xFY0XPzZToQ2)f_m)%H6y((2(3F~ZJoFdO^~WNE`z z#C^n(=J0~;#WmzA%M)KM;VY+i`txAL11p9SM4X334JsYi*G`-h&Bv}z3vq=>C#imc zI76czBVRNwBJfGGnpv)XJ|Xa0=?VpSKF6fA-C(G2$gR+#Xpn0)8WCRyj}sGrZ)_p9yCqK_VjjC2$p2O}~|P!qtMX z=sHECHB80V?n$|Qz!8KNq4^Brd=neB&?$PkDFW_TK0Nyu2%v=w$cAJ-V73q`W-6Ko zG`LRpD9bw#Z6KH@F6u?#|JOI>X7tHkU!Nmu{5b)pW$oLaH8wwHUH;&49CQIY1GM_| zT&V81Rl8sQAi?o_V|*L{a8O*0I^{LL3MMC$Qfi`zMdZtd zxmuXlQ8dki{&;BUv_A0IGPrjUzRBt4!ogDeoqk%xIRc1$gFUN9*KYaV4+Ir-f4Hn zU%TMEHV=*lory+8R5AikaR=Nhtlqt&cy60oSCCylIyZ;)1JNgYuw2@|53pX4oOK?Y zSk;{OSX_Y8GnkF7baRSQhw0G1fr331g0LQ}Smgxi#rCc8k`g|_lgn@630yqY$vc$5 z77kiet@deoS$c@5kfTC{RRK^2AR^p2TsqZ#Yfhg$F>bzs1cbyJv$<$65Ed2|$|=zK z)he9;gdp;v$w-Rl<}x_Z7X9OSt36Ra?#=lJLf>AxAD?klcdo`Z&09%tBs~H9_&})1 z;quh8;sWG6&Puc&yg~;_DC{cGft`ls3xHn>e`pQ{m+l8cXaM+QV`c5IjIttzf@I58blqU z$a&un^7!V!+ZDJ?oa$wwpKElHFGFLs!N3HpsxO3Q<%p*7!GUGOv=~W^Ve^**Q|7W@ z|4oA<@@}kr$N-9T{)W<_@HB&cl+uICR6xdRtTW7nREe*ELi7Qg03fS-1f|mDy(_kvEtG`db`vssyfMmVf z{oSf;RJ68m4%+EUif2Q)%D-_^!$DEp*w`36J)N4GD#W5!aJcUMNS2x!(Vrtpw5i>BK8dXjz&Ry_C%iuTUHR57R*GO)~|hwuX* zc9YoUiibRRO66*gnW^be`V-XCpCEd1HJK{tbUe)=&``K$D7$JX=)M`vF4BlDd)a>J z1F+A}Dhr;S_UWAYS<6Vx{UMg^Mo3$$} z1GKw=iZ_X>6JV?H)e1j;z&>5Yo$1E!JGTn*)A@;c@r5LWdA1aDzO-g zRMr#^lQrNq5E#k~+9(Uq8FF|5Rk^&_ik(YBxBm?C1R>uL5m=GtO<@(8(7p&b-c|gb z0Ju1}^?`W2r`71&$F(&z=Zq;a(p?H~MuW$e!EVg=F}qi%e_mgoeLL>5r_qy3HCK@P zVK-9&;xt(M#9=%&;s99LhGzNvF4O;D6aSpOqMtb23}p7hkB_4=1R#A3w+7ZQ!yQg()Uc0#HlWz*NN}t`;S3dc>$%+t29O?h3|asE$J+; zon+9aqocEA_&F{vgsEZKG%Ive#Z0$0u~}>nGDJ8gFiLk}Im04@P%kQ=m<_GKnCS!+ zsYp3p3dIy`x3fOJ=ATno&kD@TyS%(49$L!zW+eezN^j4J$&+P^fo;X%jR*fFG5?#a z`R`h12%NDoJ1+t6Tf%a#sIwrdloK4-sNNXHI-P))aicCTBjeekXj8X&IQU;YibQ`@ z^w1LLoN}fxp!B=iuoFtf`z2GFRMIeoy^>c^sp||Lr#ku2)unUD;#PE~Yo;IZsw8Mf zI`YlDzT^&NS5byFtsLQ&oKn-{P>tf5fim+LuOF<8*8a1s+I|U&QVeFNlkvuq45|r= z-L^Gu{0X+D!`70^U!OjFiGzCkmyI_m#n*cE)2T>7ow+XzGvx=Ocb;);KgCk3)um|3 zCR>BZlpx1d$otyAEhJdUMsO|O&A?`>eCcLUp?&iFQOgT9dW|3G@Qq0t7Pm@f&tO{J zc{#58lh=&fWfZ%9qK&ThUm~XUX!Yx+D@8@NjlwY8-*L{jR(D7TY}zOxNRi^vz`}Nx z>Azr*s;4Ja z7vfRx%?iso*m$G?x(zm)0!<;iix%gwQCm$hpz@8!kkURP_1qDQ6jfq1AQ3Anwu z)N6l6)YtxCy0m>9ZMz#BJDdzT1_nZ5xlJ{lf1uXWwksSyS=-a6AqZV@rKztP7wwpB zXzgbc=(5KH<^{)rYk28(HljM* z4EcNTzn|ECeEnm_c#3?x2C+#ixR8O7kfc(kFZd4fbQ?KlujBQu3dW=z0(k;G0efVc zv71K9YmZkS?&kkQ>R7p`4Qh^04fH8izct2}2;qSr2tJbCdhc3{2YEj$`qtt+=>jqvQ89kHpn3=0oVL$^rmACDvPD zJT=lE&lpf@akNnD|Eq}Kp$Zjx{+$2q3^iR~v^@j)dJf1Db8#ulpwTR2{ACaPFN5%p z6_?Y-W8V%(g2CFN&K_#XOm&MrfQn86gk_ZVfIzGP**4>MMl@F*Ac7x(8Vd5>1YW;K zC`g#3KKx}AAawxVVm_3p+U$@sZ2sK&!d}|U>;n@kKxwV8YvOPQu+eArS!jGYYK7ne zex~qiP3VUo6uoqAUV&HS4u@z)mnVyR7I5d#xF{dw_09*`I3p(MA&g4GkHnZ9o#+m> zppl%1(V`PdKd*+9kSmxF9ndX`h{g>LDa1vo`-e{hL0ey5m__V4MY|MxR+;sGsC(K3g`L}uK;jM%cqt_`*0+HcBjZTB7n zq9T=G9a65ghGA!#OE6Lx&&p;&0T&@*FiQ6sbZNX@utrQ)hOgepoosQw>>3V*G5|i6}~;w`vop0 zMZ*rg2q(zvBJn=kIK`5x=HCd`KA`g(^NX6J#cMuks|n zl3-hs|3E^?DR{VnRc=+f7)z!hokF3EHOERR)V#wT-BQ+sq3<`CXQDOixKy<{3wcp3 z@4cnyt+kaVrjx-ZPm%n(We9+W(QO(xPW%TT=%3fkko3e;69hwm;ce`$PK#jmoZnWm zG~7An3Rt8hv_Hf_It+2eB8U1!t?S}1ukYH&**62{d~&#&0)JnCOrWBh6P8r34)ml? zX+b+FN=HXbFNwp1u^58fY=Q`A*3_$``{29aeC*86R|eCBtcC zPLgV;2Mc>5cigCN2%&A9-xSJO_A)-l+Kz z*&}O{PdT%fUe2(+oGrznfA&d%#YhM1@4S3X=Hmd|f3orao|kWxKkD>7h6(^Of!-Tw z(;+3E6lQoB66wYwXO!EU&?3Ha@#~$aN zG>UYI@~m$l$owuw!J3zYA1h^tn!*)Oz?C;?q^Ek}_wLGHN1ogLK)H=DGJo{ip9OHg z3=H7^>|YmFcgcNls6&@q8V4&YqNtG-iAG{Fv6Mv4@I6_yNVu}v(kgS>(s>l{wxaJ< zPJy>sFs!X%50_p3)GtCYh?d#Za{ZE8kae4s|Jsk+Vo{}7u3W)R*VEJM@mBfaT)5Ht z7~XqqACekB(WelP)M!h$;eVa#pC3u)(O}!dw|;`F5YUS~oZ}ZpU0L%ybWiq_s#n>Y z#W!92Z1W>39K)rQ#2<1$Mciu-taUGmuR%1V_jI9_@i%m~9Y12D7YB0YO6B;&AGbs+8;lB2oQmI(N?cUWR}2muk(i;%>@s94i<%0J%cTa zL_!mZ4Z$DQED>OtgY^A%bKfM7NMNj3ilG0*B>7W*cq;^lHE?i2aKh3U)A}T_0gF zv0Ns=sYI+bO9=)SBWeSJ(bWBJ+5tsU0u%|(%?9!tb&7S^a(*n_JH|C)Xll<-`R^|)tHv2^3ycKtq!~KKvjZK z4c@(n^-;INZ`&_VbUfB@f@n5)GS(-d>6f_E>+)P|JFAACdlg@kWN{^?vF~VHH*a&Q zFk-O4)R0h6xNG&Us6NjzkJ;%orEO^fPwaL^m3+fu`zxnBl~R&(9TGV|R$oo6-Iok_ zM!yw)zdwJMOV?#MI@M0^|Lu-Mim#}tsOS*UG0ri?BumSR>==<;6qohjI+y0ml;9nm zwvAYkl!F9Y+||)jRaEub(j!OnG^bMcA5C+6 zTVMNF&zhV|}$B9^cNlz+J=|Eo9ZfB3LXQ^L;P{#&E(l|Nzc zRuvmR|M!+)bR+^}@b9f5Xn?aI5ow z!#$H5HaQFr7w|LNYd5teR5)`H2k^vQPSKV)B}T_40C$$w{6D&=dqX`%2)$Pt(h+k)z`1;1B@I$0Z z&(re|m!Dbw;t9L!?(Q%DyAK`IOHRkB7I9=4ODfEKGHy-=Ke6i27r7NTvr7xq_Bpm) z|d z)xqq(T9&kd%a=K_%3hz?ELdXuh0#=d*#~FYV(Z`K{Q*gY`8pi>Ys{3&0e7QjF3GLu zAP%Sj2h4jd_OlL<^vOtZO- zpFl5lDLct!edN`>013JZ_-59eowA)8Uhlz5-@&!*SQIiqW;4u>Bsr%uq?iGJWsv$x8@nm*xw-_%T}1D1jJ|&_0)Wx*VmDYa(mi=m zU-2@`or(l8DeI#)w8~p2F8)K>gsgKUy9&K&4Aye`Z_TbQHi`Ky^~^0TL4oOtdd9@; zET8VV^2y{FZ^Cz7N!GU?BIxauJK8rHE_PujkhT8uW$a@u3pkZLEA3X_TYDM+J4!;e&v1q8(l|Q!}E1SW}3z*_| zI=D@8a&>QZf5!pTrz4|xj)%V28|Wb9Suas<%Zw5r(c&Iza4@KDW0R8rWFYpWhnSZ; zGcyx#i}?8XZmo=>q9PD&dcqS1`C3|OOAHR?w1_yBTemJ@pWG|R)MICzXS zmPwiG4|WdW#QXT^la%+5xfgA6Vq73< zGOL!~9<=;HopWuGyeae@ao%U5$nl(omkbGX>X~OmvL%X2lBWzT%nA)GjWI4H7@+Z4 zsYdU~)1aPRy(bquxii%q=qW1;dTJ81S^{m<9*hU{hG7Vtk0h~XYE_aGc-Jl!eXP%8 zRX4U?|9!!=1GXPX9o248*d#2-R3un4q3SVP>zWUkgSvcydM4i0pg`1DQCjL@IZ>E8 zf`PPvser{Dc-2%t++R7zCW6v-^P~M0co2^}rdQ$Cg2f_G9Gg)00vMm&izHQBA}^(A zgh&eM(J(u5+iQ0LOirONLloaLFaX+`-7bxE2azeLm6_f6UEB2T-Mh+4H>jDUp?*pe zcVBp^3J#`bP=JKo`y~*>KF=ewQ%)hPo}6z3;-jIy-nyf;#ys$M;fY(s9-w}ChnqEy zQ;3!R=U_;Rd^lc`!}sO31?C*wsi(THj1om38{wlKzVYmFsdw9vdmHevtH}bTx}9K@ z2y?gb1#{J;1x9uL+Z;q%@MLhsxAlj&G`}@2Ccb|!k&al+KDcyXJ{)^zK}p7sl@Qae zGj>&?(P zt>bD-LJ(W?;#)WLMCq+#3dM)TD0(PNQLJ40+e>m1)|&Naa#34gX!lRhKbp{8w?c* z4d8uJMX&knCJCZhd1&U>(9c);Nt2`)MGOyIgf+<6%bjUtwgu3u+0-n)2?R}AV8L+x zy^qlZ&T#*B6uU^;B8Jx1CDHtO^j{IEqeR!VCHn7q92GLJP0ml`_mwe-2Bn>ebV_W| zVZr~%Z2t(l@YUaaRXAzjsBe7qZZ>GG$&Q3+W|HNL9qMC33yLDgvT#aqZIbk2i^Jl( zq%vgE%LbhZFKq1<>jSl(S^a$&k=R4xyALb4oJFZDs_7)0GF_%Ob3bHGknVgT+SVjd zM&!!o(LXLCmT>x9ZozX-m@g-$AhSdb8#x{=JfiqXhz_Ty9iLX4^MQU83sZ)A?C_4k zwl>ZS1gH0BqH6US$GsVQ9R)4Mn$pmJ&N8bt10{QHDbMQ0!^jtW1%x=ovaz+TCOHGj zDW4Q&IHN_kgC>gVs?75_lS#u;EXRV*^zcXXX6zZ(rT!kNvnok4j-FdAQjz~`QwQ&# zLCgF5pmGojT>p$!)a?mTf8t;#OL6)R(Sla%Z9F83w;^52&-XRYT~;E;--Il* zT4giN@3a&#Hyt_tjm!7OHL!Dt|*}+6J8EL2ubamN8zmQVkBNJ2p{{9d2zkrV!$d&F#3w%JhTvBgf@4n2KI#1M0u@-%gxbLl5h$SVdY6-^u8 z5f*2&f|pt`KAyIq^UqKOowTI_n8v*c2>}D9kK65Zc9Fy)koN+}4@%5=pF@t!Y@MA0 zFBTM)9&l_?eqHLi0o!UoY=fDyWG#l#>6>PNnG9{>~PPW!{>naj*4&os}H<&K^ z)}iky$kVNmAfnqhC(y2&H2P4^c#gffgLE$cbNCaTC12kaYh?lV#LgXxWDIwA7nO^! z!m8iD*LNymGn}-jnabV6CT6gEbTM7)ubmArW4<)JQ~@%qnU?;Li=Y|aop0|@O?H~8 zXJ3rCC)O$U9=ySU*^5Cy<`%p>KIb#dYZ@4ggA|FH*MxI%0OOVObaNmRI){gB7a@RK z>V9%^NY~;W^*LBa@2_?}dD2#Ge}9@9rj+Qbft3o8szH!K5XbaDn9M$1fE`m@#HRWEFR;fFuwHa6@4 z8-&dz=G&h8&~0v zZxu+#Kp+P~F!8~mYv&Ue&Ijj~Pnv^0-alIO#I>>{TXXOVTdd46gU7oOXJS|m)T{zC5rHB!|)LEVnmKrVLW}bt9sWA>>Y%2d|*?J%+b`cxP)MJb^E55 z2cc}De+&}XE-6ZKl^39Ck*5WqLev6s3xBhjraF(~e&vC9ms~x$i;6>A;zMO!i33oc z9Q;0TBl@bS^}-x(Jssaty$EDqvBBGmgZ1P%I=8*0kHDD}Hk#Aonn(zwx0_jakf@(N z<-IEe=nw<~y_ZGNN(Rrdi6Qgr{egRn$nO<6umIidy+4OGo&Y{<0N8y4m)tJG)|OD* zK9I|P>Q88g)soF@bKp(K(*quZvYuL&AJ@9I(gZvwuR9Zo<7i7j2?i-cUmIefJ;J;( zQZ$@jkqQLpy>H%N>_GH&FFgv@Fw{Ub_KBR@r%DxYykX* z%mpYvxOLf3?IN)SB>9Y+`~XQ4+QIj@97hK{=WLz*GuS1`_VNCa^TWG$0pjB59&5aF zhh}x2n!-d(`#s_=0q=k#DX7z1NVtSeXYEoV(aWlp=+U%WVDzoi~96WU9BNm9&lNkyF; zL2FyweAsH(7|>M0Ycvz9cf}}RgB2QL9P7dq6Qz&8)XqW3GwqF1xd@sCQ@gN=?=!N)zd`-mUIGGzcS0G!rHR3lEx|c|gM8;Y4MTx$jc`4LLfBP(J#i0ywV_a`WHd-U$7?u}c>EXj|sjJrh}fu+Xs0hF8VbR1L9Jv|HuE zg3A|y=W_mlN#8Lt@;N)+ot!kv&>cNbdEB zaRxO_He)3vta|d1$Bx5!if%Ro-lIf@TJrMf8}1ivn4>nogVDj!1An|M+(-i~JUV(F z3vlILTBGC)R4{shlh2XFovYsy6wK$|OW|+_n6ysI=K>aT5E@jn$UgveEm69?gP$c(XL9(18RFzZVR-inIhiPd zhms1bpk`sWq~wms5R-6sbJKnfGkVSd5TMHJj|of1oldhndQS7Z6La-Fsrj>R_@9Cx z2h2+8L>vq&Jsu(uBATeZ9gI2!Nmm@HabkbA8X4kjgmx(;b2pcnRN+u6{kj)LcBTGx z-Q6926)6x%RY4TxuI#jQEmY^u#H%&fISVpCgT7f6-EbZo7k=ZCNEAD5&AnB z8oD;yxj4!9Qx*$rZfm}OhCBgQw^>qNM3$)RZL_)&M2eBh{@RtU{^jN#GzV1H^3-y9 z0ve-sz-cG35QHY7s4P9tIty6(__+{C6uoXOQKsjbRQ5p8Qz}mU$%SU9ZKF;8DMc41P%3LBXCQWJ^1IrSoyjX;fpwDBgNc+-y`M zexrPVpXC&2ASx>>fe}YWXsesx*uuE#&sdEvK7ZYjpMMZun-+Q3b(pFWW&IUUPT-H| zA6kk5*D26`Fr~kE0g$u~)7migZ1U_X+)=WdQ#CGc1an$F)cSf?R+i%{3|**P?RKMe zi!(hd=B~4m+FMi$P=s~IGbNUOah?bwJIF+36ke%GyMMhQo)OEPs$Y1n1CpL0(#?*) z5dCS|(ufyD2(qJ7X6`MmQEW>2b3x&j5<9@2IMtpOBbtG%&aG(fKg=gB-S?0o*3nSK^>|NaU^XOiS|#wx8kW_Nkp7toLd3-6nhuKh*}p*f9sip*h+4ov%A>iWZRwCmef?WajeH_feFxcFwomZur?i_RYk*GzFgq$4;xNs#@qRKHHC%rr!)~Dk8QXIG@FK z_HPe|7dY%iDkML_(lrf9ei6gXBfZ858bm%5obTsQ7a#fr?R8@D``2)Pi1B6IY<8S_ zPsyV%Gozioe(gbtVcp32svpN@sE}(MU~C<{Se)QDMEg+&Sd;Pl3 z#2n%Xd567=bKf{x$fZP1Q#(&bolsz4c83_%1^%+S@KIiU#$S#>FLc%bgKpV8JnA@zbz7#f3+ZQ&erDQKX=wFdL3K0p-CFcD1E1fo z3x*M_*D!^LrO2Soowe_Eyz-?E`~_sBfV2m$`b)tTa9EaW+hGa36&v6}p0-8j<8o|^ z;hIV2kFt&a)#u=Nx6k0MKv2VP92a2kUmke$(1#IRFmUjSI?wnVtdXj@Fd3W!&K^a~ zz#t|;Q#_vv(kr&&DypsZ2340!H*mw~0wRguF2d+W6G-N> z5eJL`2k~a?B^!&`2nFP4vfBa?lccWN5^@;T?KF^dmEFc69VN0VVj#t?W>e6Xh|5JN z(EoqpiwES}pzc7rL=A)AGrg1%OoFb9UB87^cdR$F7UJm+`ywp;9Ht@f7L1Oq-emvf zCakFPB_n>V>A)m+aX!ISWp#L}aoTI!2l+gR%JyN^Qs?>|DCg?-qM_mZNFt^#&0*04 z&mn%}KLq`=nrCvD;Syfo8A)M(m8uV^5)WHXxUXKFF*6GQ^c74e?>XDuC>d20H@|=X z{$`BmqvAne>p_!iQs*NaV%9c#3l6)ewDc1!)j_8f*95C$wBqU(asZy6l^P0)i9Z5% znYgjp>xK(B?b!5Z)PX`7Zg{7urWs?T>0gOawc4XQa(-t($1Zm@w!n%GIw?`}8ifVm zl+14A7sM7;WlMUhIng_qK^QM~lj$(nHjioHCA{x-4Gq(>9)mkw)%Za}@OjSpxi9?* z=mRXo%d@LDzdVvK2OJ(mM?SD@qr0UBWgrEKdr<;!fBppda&tTO$#VENP;-MQ3OqU> ztgFA7AQr`I`kny&fw3{&PfL?*SdJuS3$Q>g;{0x_EQXbY`fubavIuY<_%dHl92FaS#0R|o{!^;Br!Jwe z+JX7(o=GPT?_#42$gMMS;B^j5TG%8LBZ6n<+8A z*k=-ocA0Lrqu^8e{b`b(?u-ojjA@v&dtY)E+_Xj7d(F!)eCVz95_oejL7>ZWeaw|$ zk(+}p)9J0S3$_(CH}TCiC`$>wrY;h9e*o#0Q!idxmmhPo{p%35U0!T00JS32qYw?I zkbVfjtRbF^BB4Mu%;@=<9hu%&E~n_`v9#D`)+Da+j`Gm??DjJ)aVZ@ zTv+``HK_`4wyb79&otH5wdyMDbcw<31J6d^x6+)nZ573NZ7&n!ac@obJSMqIOUzvq z>OEifu~%jd7LJ04$-DPL?dYZ5tewoVKE_f*Gz31y#J>C7ZWyGylVIz=4l7VtLa25T z!uy%nSn^ByqTzWe&rkt!p$rQ`M++0U@nN)45W%h&5U4?B0hZd#^e!)~B_|-8jwXlr zn4uf`2(=(@e`WA{BabdHR*-f|`0DVNND?Bo$^v!QK$Zs{WM3zP=PjXO&JfzQ#rHJ9 z5EnRCTKz)pst^tjhdD-6{3e(My28@|7vU)!`YGTzGWhq7ggz!gf=s3lraHdG))fy8 z!hvTWV=-wcu?R1DKtd*2GlpsU!y|VPrE%D}gC9ZYXVCO~^`$mvjqUkDMDPY`9e}*S z0X2Ai2cI;7gu~f7WsL$5Z(ax)CEgQ5_HOf0QsUPjK_L={GBOf5al(0lnaU*M=M9eN zLR>}2t_sU(O$Nrsv96R(Cnx)>_ivZiX&Xxbkq(n6 zWEUV|66_)~Fr?imIQp%@i(f*bp|0+37h$k<96Wr$Qr61xIX@+&a-MAp7n~OHdbM>` zXfPwXqR^p_>gd@or7NT*4A~MAFlYFGoHj^AVZ?TTzJFUH?(*hZkb6LSBCIs|V_@2U zi8`eyGv!GR=^bRc3Es3Ow{Np9HgSHdKqr4HNQGQ~hn6w?U>gzw2Ck=;AFgXre~(T+ zES)}o{mP{qihULZz~jIRVX&!pt!rW=e+o1n1QMW_eEND=1H&GBrM=uOIU-!#5sF}j zU|I(*WSjBnXm7vOJ_h+7k30NVGmU{xw%LpK*M)_1rD?X|k%ph=J>wv}l#-Mt=GTFf zJf8I_^ecJQ)RIB7%XR%yGr}vb@CGRwiCrCBj+sNv1+UO`C=0@KY>0f-YcshvIUVj1 z?md>nut&PP3948&#XRqOoUc5e4a~q13_0Ule6T~JX++BZ#f~7Yuo?eLV$RgcBxKm? zQn(=1HBuVdjYXXq=&W}yDvh~?HIj(#!HD|~X_1VY-NwlMzL?n9qwQ~jD_dWoX6ZV| z$bV-R0@BoOGHRy8S7l|IWjJJjgGQ1-71LJUbvLWg7bJ$Q{iOTUiTe##K#H9vMk<%6 zp-r1S-sX$ZMW!wTI#BIwK>Wc$12Q4ulRh8P-UpF^nqg2gNZ;Q|t%dJ>veu|>@=ruhn$GiE$mT3VW$!xs0*;nt6cN2+BV z?d>(4cIH^*@A35{cAoXOvB4wDZ}y=UTsc6&F--m*B0RrNyjo%buZbJn$w?_Gz=lf3 zLdqFr=N3`z9WSAC3;EdCT1%SbTRrFMuAG=N^o51q_fDybzc78~;PvZ#{dz{TOD@>m z!NgW(SRrR}Opz~2L_a1Usjj7^ENYmM-RyH{H@XTdkckagyQj@WJ)oGZsLzq1nsJx* zKf`&;Xo=wu+1o%MPWP7kDs)v|I%ITofNml8etFIl5{fED?$Bg3*+&-(m?@fiSgG9~ zU!*^y?pb!U72ODRef4je9~*dT)3&*<@UWm3qQr+jw*n92m#WG46rmBJ3C#IrF?f25 zaEEA5U9%aG5mQ*qkrsQ$z+iEZyw=1@Uya0uQ&UraaDXxW(5i(Q*h+y)QBp}U3X_+Z zBYgj=wChd<(n-*wxIkY@0RYfTf`M z-A+G-HlGKSD=T3lx3~yD#W9tcFG~C(J;5bik;4>o${hEYe2nB!wzC|Us)~37R^z6S zK1o2uRf?H@&M(kh&Tz8{e9Is`kU##Zf1r!h!u`5LZ?~qR@X)Q@=%ONmON2TZTvb?Y zLt@rl9JaTw^X5H&{=AoX@IilzD~sI)74c|cK>?O-9CZ7*r+#=m*W~e1Y546iHQm;*C1O~ig3b5AJN0|5%)%RVKIPn zQ|WSseqNrwfVrU=*@vTW{B4B9M(B$c_MPFd#`R45kz>^W~>#hyq#gavOye3(uT*NfC&ntawguM9AP49 z(ui|rcYXaYuXPKxvmwHn_k&>SjcD03Mf!OO8(Cu6@wTra>rlsbo@!#SDxooOJ$1En zy?q$_6b(O!vJGF+AaWn=8l;B==?(gITA!7bL4l@?LSQ(EiO1^!TB-CJw@azudiW~w zRT=+s<9sU0iTu!5Su9yW%P9HeT0T!O4!BwsKo-Jxs+s3^s}cIa0w z{TN#w@Cz;-szwU(%fLzc937je#HjI7p^ToAhru&NJ*5N341RTWfl>+YAIz6as!KJB z)pd0tgTlaZN!fRAUy<{Y31!B?PhuuWYGPz6&b!c7b?rX5nI|n~?jkssVTm@8GqCRR zLct%hLt~e#l>C{;qEpO}jYX z$NnQXYYJ!9-TTfw$cn&s!oypvN)nPG?gZE)$M%!&RtHj3Qd;~3{c`E72wJ(mzj{ZcEAKBI zaAvE0QN1}HE9w*`ZdOzp-W^=Vw}Eb*Fc(Y|y{Nc)os-@S>jR7JC!qhKs|==;V)lCc zsf^?BRl!^t8IHQ$vrhaB-s7|%19L%;##`zh%x=`74HD9!CAf-p7~JE;7dqe^eEYhH z$Rr3|zkj`T7%j$X41A?O<{z|j6xc$*M_bnqHx1b;utx!CO!tnfu zO@?u+k)kl`TU}ykW);Sz8-0cq(Nryk!e9C#Ecqe2gVo8-X%dD<#ll)m!-lqXem6f?BB_d4jJd*2ntr%Ju$`IsMl97+3S$^Fdg<) z)DyM`mnsk6TrO=|b_dG)UeuN~U2irWE9|7%N$Jq5>7(- zt7!_;GO5uhqjt=CQj!a=zo$=3&rw=nPVw(yEOsi|Q8%az5f;%OH<_`&Dp-Nj`vqlB zU`*>3nx^p47n6GTc_Vi+9Ea|E_nu)D=hRb{8?cukCJeu_I~Xwqam5xjrd8|O z$nf8OUuiscz1pw4M8Wk&ie6n^B_2yRk#>sAc9 zZ&4bV_HJc#J-_EQ<-|Moc?Dwkb@S~QtRu(2)Z0d?E21Xgt=aEPo6I;SjHF<=@@0T- zE_hqzl<{k$szR%~(tpWF|DOR#|AMhy6@A~Knk&l?sTwZSdrnm~W{>srAG9 zIa&3f!lE7PAsSz8Bh%+)%v*eVckX;7Q@#E;D@(IEv^KBt-atVU(`Q2ol~K8O%sXO@ zOv#h7lJMt0;PU_QLHb|%<~=2et%Z*@coq83SI~Wr+)o>=-qCE$lu4CNVYY)g;O5Td z`e#o`!M=l!c&;L!agb938s6P2JRLo?4)#vkQ~-q1%~ z_u}MAh+7b5I{j2Fgj!!lX-dn5DDL6E@$OO>r%F}n0ap*lOSR%?nZFV6k8*2XBnxr6 zi9#|5hRio;@)8)iThrdg?`uv5Uz8|yRFj>r7(GXs;{Lj&A8Uj&4mss;1abf61vj)hX|bW1L^D%!1@wB%$CJ6ge|BJ$P0pWU z;tA}Y7k$k9S?&}@^7i=Kv!Rbyd!6}sN(ys)> z-=if^T-hGlId*xS&Uu?hArK4>t*mQy(X}RXa}Ko*oTqNm)my|VHcIsmADLFm*Li*R zbVuI~N(|D*21a6Lku0%YN%h3#cC5shatf2@eDxEPt`X(l|{tFaTPd0CutYr4(e3;N!#0D)bQ_X(4&3 zm>6Y$GWZTO@husZq^{^vr3bGiy8Nf#Ij>?M;dQ{)Kc5CV^EU2oJBtOaBmKi*9sRME z|L4|BdRmIduP;|=MbXGfSZHx@bX-0YiQ80k+|ZMce*KOzh*^5xgY&DSi#f%pFkS+N z;F0U30CJ<~P!Q)k|8Vq_Ip7@$$DiEP#+Y&e0Gw?V3EpQj$~%t+9Rz66;tBza9KDWT^5RCQP_&8`~?-YiTV1hy4(cHM7Md2~3g z|BZ?>qk>a~X|-Ky99>91aA9in*NdRc-tS>;S4CDZDcc`PgN0HA>}5~M`>Ms3;Yt3wY`at7~mXk@HC$-8>4ie#>h1DDl+ zpX;i5XbbtgYwW_F$5Espod%?-PcM+vy!C}b!{`R?+oSYDZjeEsy!AT9UID!Q>J6mf z^&cAW96%1xb@fe6%y-VBHZT+0k1h*y=+?wzMk`UG8E8sEH02R8J-d;#$ zj5|*wm8icyt$-!a;0q}U$gmwVq`ilR4?AG}Y>mu4=b4 z*qdUw0YM+DgX{EzGFI@$M1VJ@*P|YZ)+FVU+ec;JJo#A@k`+YwCWF8Fx;%f9`ihb< zdNP;`_l;xC6u()$$HCh0$jAsl#5NCXAn6&PU}OY|`Lt*P=-R}o4*8*MfOwvZJ-n^- z;6dHwmuqfRQ~={Q!X?X{6yy-rzhuAGLlXP zpL9a&$)W9MZw&>3ZaUZpqUIG5172`YUr^Rf0Y0K^!!VLLaxSDFnKj0S0N{`cEIbo< zNW`%#LM8Ic)`V)Ot+A?P>PZr}UMJndU>3UsJVveOrarvT7S8NN|cm3#hfRbE!`iZ;{fH1bvAEM-AO{VEIgIU1TW$u>=pg0q412UdiKke=z}F z42UpkU5+!ni;(Vx&?W~;yDvlorKe+{KFT5=A;S=s0^IpA!$_nBhFbRvOx!>L)69nY5X zrnnmojHfa+8YsJ6iL=SZB9~`^j}9mBScPP9^&8!JiY8 ze3W~rb!AHlQqb4?{jOb-{s)C_zpUgHh!;}EkRVmRHR*~T_1szaL;F8O{oq=&4W+ry8~-r~ zzB=O>^$(lyhyBNxrR%HZOUBSx>DoB8r%dp9+;W&j4B9sg-mwN<_UnBc!yr8TCB|d> zL}%q6<~`B|VDs0$@#UjL)%-k}ccwQjWLLey8mi?R$U7dJ+9q)-U*2d>n7W?g#jxp2 zL)pfH#@cMiGtyZo-KhN6!G_wkb}-b8;}mC?P3DqZ-`4(7z+m_MRC&eDUMEcbJLx~f z_Yb@kjAMl>)C`|hB}P329c2s&?Y^_>Yp=5PuCOwvbfhC>97ath-|D1%#F100u#*XR zgK0OsQ=M?Y*!tIrU!*bM@+`edV*Iag`v1FVb4-79sj%4YS2<;wlk-RkMMzU?r}yKl ziXUXQk<7YE5C}UcAPyq=Bd=gam4lBVOp+;L(7~$?#lQhUK`tT*1!~uSKM$PYld@x7VsLeS`jlhBOLc$V){k96EtkPb0g{Op4t9Tt@g`U!44x&ku>nWVI#QaO|+7 znTr@KFjjg0Ixu*(AU}_isbYgDulu?sc~WXBd$OOPWd}}0bU+~oM60)uKX~i)*O>v( z_yfPZPPKz$4oQuEq=vUJb^02J*CB3&tD%$=+Y9P-U}MAZZX(pS*Pi`{-6}9owr(<9 z?)VQM{p*qZ+Y$b=!+(ZS%!cL9DgHCWa3E(4S8)aZ8W%l)Uzfei!j=P*2UK=se^p3K6GhaFT3q)N!`{=E&jDq#fw#Yz0zQ2fi0 zEj(tpuGiD}q$qNdbhk&EfqThJbrh)&w9Y1?bbAZxbr6VxuhTkWn18B2axRgV|_WhC_2V4{nzjb#~C05_9tLJ=zV2Z7mAkRRO8lARF-~0cWMpo9lUN<`O9u| z;`ppT4U1VXRR~rX$!HwKF-?+^+ou|TE!|+0++nqyoYy!Ea$S~ku!U!hEEj=6Uaic9 z$6EhXo1~hJMR9#;?M%&3wIW*5vL`$;Ld@pYB zb4*OY^Dc@DaVlg@pAO$TJ3Sj%UPEw?U|PDzdOY?>pWxj{NLjgEJZ^f2v_;UevEt&1 zw1O}`+2s^zXq&U3DC5CgT>~NHx|>n`q$xwDzN(_LtY(R#n7)ScGjjji@+)2xAp{%d zn92`knt~Y0VnR%(x*nsMaI*~|xKHbn5o`OKeXg^w%_K6ox2mG^nB|zm5VoG$Hdc6+ z&v0t(IoI9muO?!kRy&JfS}TuuT}@v|}MxHE8uD|ABYkBU!lFdLZfJzJ`lEDF0esOEfNHej+>HJtPYo zHbH*yel<72hK#@cN#%3&<<>Nrn$&3(Z$=~i=UScjsIv^}#&tiAo4%}^73Xl52sx&+ zua2&)j(hNPnJe*0d$4|5cZZYYPM=jNh0pgjkB=4l_Fg)0h*6?GpZ9-I8t9M_cBx{k z*&V$%QpIZc(bVf1FLz`{dfSx#ar?vO1i~3Sm(puOJ+@x@gO5@UPxUAhqlxNoQP{eU zQ{M1dT{9UW{HXl`?h_fl1o(CqZErJ|be z4u^Q+6HQ;CiSX4sn#P;jKZhH;#0wTChOAIon0YkT zpE>9nUVkz}PYYw;K@OvfyclwExvR49N79h&U?}pc%NTA&e3|`vkxA9 ze)*(tapoQJD!Q^yOA#~OoWO}$+>1TkJIb+SYeqge?o?9G>Afg?K?a9+@fkZSGICdoVasHVk>;@7(u?%C z_)Hdymi)v-bZ8;#*6rOJRU7Yz5jlDM1Qs@f?GO1UH8IMh)x4feJ>|oVpmdoft9|uo zYT8Q4z~t5ys~R8LuP+-H#+9#h`M zb(emwJQ8DgT2DT1Mfxa3?|$`Xqt(2O1v{M?9#gN-9OH+xBIE40GSrY`5pwJLHw!i7 z$ZE^~%gAC&K`)a3-g7au&kS2oS2&bNg_*AHdrQm6{w$JwR!VUz~z z?w~1D=qAaWjJ&=J{0EYLGJg&Lm-YXje;(k%Y?w+(3EnP3jI)rZ!mfr6Bw(}Vwf5*Z zC<}X?Tp)&+UVvE?8kDrt)iM-amA;=rBKJXlupRqAQY9OC_9N!GtMlkSj4!p2W4iu! zX#WSQ6tdShjP!xQKifgRmri;98l|u-&;mj3gr=|Ch8 z5A?yJprAn7>+cY;a69K z{y#&?M)ToAt~QNNpI|JR=>7Cg!aA=*2_M|Rpv*gAcv}cC8!;x%-+)4>JZm_>zVE&B z^ZKY^iE&Kw70aw7Z^n^3ZeO3>0#-bxJTfbiccX~5Y*%PkK;D#3U5Th*ie zhW8@ivIFTHd;>PH4u+fsF8LKkX}8M)HS(`~`w?-2^*Z#jjvZgvdBm&j+0^O@-mK50 zZ}5w(8AN;9DSRiN;H{wIt(U~vyhf8#Oz$%JJmlkTRx-G?;nK+wOA(VWi&<#nhLKbTZtZf4hgxV_hQA{N!$D!~WdurlXm|n}6LAxKciYRwbR4&~g5lNw>1H zszczeHoKk!=)H~bq!LvyE?OZ4a7{=EJoiOKM1Y{VQ-+fU_YE9I!OH^BQuPfE211qx zGR#Z$C^`|3!gngZN_9RwK@4dtaAs?iWAxh**j1Ln857SzY_1m(tvHBHQ(|v*hEg#s> zJ9UFM`8@CGc``XQ7!4#mK?<{8ytpxG$;HnfczW<~h|fC-=kMEqgk&WPtSHo8scALu z=B|_BmxJ(7BqN$ys0vZd{SSm z%Bl=~t-K#A@XqC@NI1Tu$Q1alSQj)YG>TV=?#yg`6Aj0rgfQno>H|C!PayLI4<5)}sIHp%tqtWe z&mNzEJ`j?h?Zuj^8X79<^uVT~LHi%bRl?n}+O5&uDDWZ@F3CahQ(JhcvG^nJbTzXk zpK7~9yIM@h89Vau-*o@E^{VgLTj*2(sc3LNfY#4Q2Va1CKo$85&JV~<5IVBd9CX5S zIJLWY?ZH4?Y@*hs>o^T9S4>F6m{cS^Pd${CBiHGqM|Tb7iTY0!&J7(|O$|ai3u zPqRPx@M4Htm5Nk!Z68(47T+xMXp~r0d#cf zwXR6Iqm`)#dG|8pfI|lK1j1Rp=i;^p0?I=5%p0Qo&Y(^-1dkM>a-YKpLOQVQ zCZ-p2fm;mJk@lM#VCI{ErXw_+V(`}7%BweYq}dOtv(N`%j+1t|5E7R)^4^R<*>Y|} zPXmyvB@2rLJE>4DzU>>@p4XwBsWaKfPZ`}AHl7L|Z_9i$7uLsd8kcqJ^Q#*+N$K@Y zuNLY!X`{7aVi-B1@n&rGk5~_UTGe5FvxRk0R_-^A?z!9`o8cKaxIpe4*~vI?9;q>g zo1?6(Od7y{@aRQ+|N0KnfY7`{QBhI9`2V5qEr6>2*LP7A5k+C4NOuaNba#URh)6d` zNq4tOhX_*AN_TgtluD5cjFic_97P*G&ELUSQML7W<;X+EN(A!Ccv=^PLTSm z6&6UV4&87ca-l2lb}1Pc2quuNPr6$Xlv}uexGA(W%>#nN@oxzrc(CI%!FlCO@d12L+Ngxm0RrtnXC@8Hs@5FACA{9Ua6@p8u@hV zKv_wRdhxEqsdXXC){B?l#k&0>=+j~Z5O>+2k_5C?upT)97ns@!PuNq$n3!P2os*r- z>waYI;&L3%X$Fq%(D+-{YtY(+>%E&=MS;aE!9(@c3fuGDDb+aELw!31U)4AAeoFKL z)a>kV1;W%oG7q%M^*^cNVEF)7W_V5YRL3@;z+quw@JWPS_p*S?1K=`z!aD_lnzCuP zVS`EB*%LV7Civ3`ee(_V=RlN%{+DkoQ_j0|tw&H_*_2Ok zM0J9u-2#nt_cJpW=jOmwq^zjO8V+M1RLLjuIl$2gl(I=UNPB17fEEo>)90QjaoS%_)9#En&mW{irVsIRU3tjPG2W}S1&GgIN3AYz6)Mxy~^wu66Pj_%G3{+>X9)$PrqAStR!QP{oe84Q>d6Wus0haZE17vMuaAz2Z}*xqYKHuEn$jXQmO1NW8k zCSi?2iK{s_p`!IfsnA9ZlL&Hn;9Y&u1QBV{gimX2h|leF9S|5Vm7UUG*~@PW_^#~m zhPFs8t5Z%=%LVZ95An8rs@PS1W9R4GzQW*FQbSDJA=rYeg|+EV!UK;r1!qSyGGYJ6 zyg)2o1Rufgui%K5?s^oe=qod{n|~umHLlYCT|nYoid1fZ!4gu z%lcv1zbin33?SI}3pdaqY7c1240@QV8HA=<~19Sr_j zoWYsTR9t8Bc|??O!9^r}Ace6UP54L>I_a^Vf#`*Nls$-T1dP8bJ@!woU9xMxzST zLlXqQ_Rq!kzxZoZAy$nS7vPnbc4@a=^s5TzgM*OK6Rl?l9>Yq|B_8-=-b>qj^XNe1 zHT_LgI7kRa%TPb4{1TwjKW?mSyyrj$PHR7NQkXC6m$aWP@IL&;m|UHQF*fg|wfnLx z{Hd$e!^>`3$Kt}vhT@jFNSn`tUm~!XFZ=7Hv$nh*n%O?y43*@NGdaMGLNk`;Pi4yW zZ2)^WzE`IhLu@IUL5L{DfBxO~&dqipOGCMO=F*mo(LI}2FAky`*6k9f?ao$r1E(sQ z5F&3C>4;7*`zNP$QDR>ULLf(#>b9e&!IBFBgtP>`un7djwkcr`NWW?B zvbrsZK>moD2qI@`dLiW42C$4Aho&y-A%7$>3t8oj7JuYUxO1Jqk#$c1z!|*|6F5D{ zQjd^_67^TzMecV={>UHQ35CBweUBWujU))x&RTnRS&%723w;qeO@Uf=t z+50)U2r|Bx4F=MtYQIAqluEi*8M$IU#;X-6{r>o9tipNeOhgf@7GAsjHuE zzDZr&hEN!;AP}KAh6VuDu)i@7W`0-X(uLcEy^_0`h_nT$%AoiFl?r+^L_?nyp zdo&ZA@UpV#*%=v`D6hyyB_|`g7vNU4Eu6f`*o}IB53-n^Lx_?}jXTw~ooEVAz% ziSH8=8(-a&5(_EZ5{!rKP2|qUw#GKF04vzz2(7 zIggEQ{Cnob4_pQzbOgq>&y#CU-F11z+%04A$o0u!2TL8N0Kwxy^B;#+XX zdbU0PTIWspqR-89z$x$^YN}Q_T4-q{cAVb+g;JTGmv=k#gTN~pVBJ9*)-P^PSYAA- z;QZ6v9yAZ+me?M6JXHS$(DZ@UC72|=vnmLFA)lJ#!wG0zw(Cw$E$*!`>IC5=AW)fA zj`_`hY+mO9Umu_t0q^HiIP?lPKV{c(t_tj~)5c9!NPlyri$SUK;Scioyy4%4$UXrf z0J^+bYjCz%9Nk|P{Z!<6a^?d24$?50XHVkcYyvcC9>ea9-=fb@)34=~a+}D${L{_K9E`TTMj(5x2gUf&$p&^5I{F zwfvFs*B#3l_Dt>;bW0uif9@cx#7jG4V<3}3@UPjR-vVHYACIkwA_!&g?(FpJva_?p z1B~~tW=;Qb(cNlN04|fIjps#@pj%R-Go{M4+XAs51f!lm1W6h->wVC-hgK)sMBcB> zyI`X^4d*64lln`LDmk1Kj3Z((IRFf39U6HCmU@96Q(T~C2M9!xoT}vPUh3i%D_tuk z+=rRaSq;8?Xsd2`x4V}z35vj92?rh1*G^eO!))Q>E5T_hp}|2hcWa*d`$7O)-<*lz z`3|A@9jRm|Pnly_5wKtac+my?4h|fDeVwoI1_h&5khJmtoDoLKjr9Ss=YAXckSF82 zB4)Z<^ba1y^O)Y1QVw}5TBklXFs`Yo`3XQ8Xf>2v9sah?aw!;}4M8`^ zhYjYu@p1E3=TI_kB!Ir8JEYse_>Z9Re{C5JK|z#RD1azyg_9=(?mD+Fk}6UiKK}V2 zZy$6!=roNA(Q_ExTfPAhSazn$t*?^qcn`5>P%G09zk}RPe&*j7z|vS(;ojNlA!~}* zS7rQrBkPU;i1u`VUPH|0$a{fTH@@GQPv*6|UK)|~;AyfO@_Yr!kIr~OH)u$KY%?oqTqFM3TaefrE(!?(&6Ki zC&QUO&Q_-S%7rZcsL2jPew%Uua6G*|i^Vn?13ObwP=28s2bg%vKyEn{(9Lu%;_Ec@ zvnkDfu*!z>)a+_9GBUY89_BAz$>swiBWOPX*Jho1*K+AYE+W4)ChfWa-f99v)trVUGkz zL6JlMdq7zkh%-Q&*H4m#CAfsUnoB=^1o)CbjT;)0wz)@8ED6s-z+X!b_D_>@4^J#1 zxu9!Vrm-l8T!3J>PNSE>7QgKty}R$(*_m5&?IBvqVv>Nv1G69ZIOJe;n-Hqrsf&PS zp(JhPWsU9ZT4#lT?&FAnZeUm@1tC}w5c;JT@?FAl4+P^LVSt}nUh-GP_=1jLz1c8R zNJgw34Y+ZmUHP@f+KAM~3%?#Nv?l=KdgZo*4{nn|=w=0uve{Qqf47)#g0=f{T%5^A zkQ{^4f(j)NGzJHId;O@_;j<;-Ec^y@*x>>V^wgN_=9JRXT__>|4-XUCB0GJXaXNJyv! z9Q>KyPp36+doq5<+ckk|M{uGi#K*G~a_&Y@@vz1w=s$Y`pyj1bgh*1=5f!>A&_H8u7(#Wz6; z3qbfl1x3rvM8N$3`UT8*+Bzk$C|Ds~Ivp%DaUOxlkcH(1)}_$40E?|=oxLesAp{2$ z+t&1;0l{GTmZ3=f>CYbz9xz5PYA5q4X{b1XW))n)l>%-Dpn{P+OT~sPeMwPCVLe;w zJxViV>5)rjoduwWK>gQL4+Rm_UeQCYoZm<%edyIU*OA4=hwsk7Q(`>~rIKpTL3_M(Va5hwdu9n1<ax9-pD`tq4NKXJ zlnGLjblDU^l#TiM>&yL_Sv2n|pT;n&Bnt$-HwPr|%a<>)(lgeeNE0S{uPuz46e+J3 zY#^PW+kAF+o%)TZ%=MD8C*h6^BiA6||7>`TAk`+ObZq1##`{BrXk zH3w@1b|bmv5GW#(-0E_clf%NozO{xP>X+WC@CRFB_76^*FTFa#;zsxr)}-lg{e68A zgx_e0Fqf@o|L8VLGe8vsDRcAAh6$&c$9gkmY%UH=h;u}mGa zMmIO1V2T-QGzrOCAxMOd7Vyp?$HXF_ztRcUFIK4D#Zj()AjJBzIK(I?rERf51? zq1fD1573kpk(yUH{#v&P`lfBItx~sl2}V;#f2!oE7Fkn{=iS7i6B*xcr6xkhRSuE% zc%0xkaN^iRMfBvUgh(k8JRpk>|4WsA zWtt6(GRDt4t?8UtS7(|e`2)OV?gY0plt6oDX*#E_zztno_1m@IL~f;v&FVJGy$?W( z>-APG>Id1mX&U|KZ9GA{H-3tqHjzrOr}y$b6V@88J4$JOdt}bc9B#kua(BSL`py;P zwIkgh2J(STm(I{93=th9ucgpY@~WTiwl22e64td_^>-!^T6ZSo?G5r(g2O`5>eU~n zeQ?t#Ge41xqQDR(OT{8kq3Br}#C~%7cEnm=NeL9{oOrwpy?+>N96_ZEDu2I%qq|lck-l_hQWo4iA`h)V?SK$>D1wixz`{B~Pci619f9SvK1r2|Dy-pn_ z_fXxeidmiPJdOE^3${q{2=gd<{xzR>?;uIH0)^0!V5 z=(SKkBcE;E+kUhLSxuVN+1bnCrEWgW@~jC=1YIhR{`8~W37zfV6`6(SKS&rZ1P5dg zwHjAa@L}L=RpBwVPKauDSbA>H^u^{b4mux}C`Z_k&}efFM}TMV&JuocwepRU)Mp{{ zK!1>n|Lkl+EiIQI9XD?B!6~SiG#w6kFa-nth0 z0DuTz1H$CO)c84;KpGb6dHTc5It}J#X5ySe_VyIs&HG?TPq0D;ecrr0u6rg*O1MVH zKPrh=hb$)Rsv8=}#3&F=IHGmks4L*LWjwG2)uY(@^@&QvzQ29fuP!`4a;b(pE8_Lm z15c=V5RXpKmV1Qg^ZJCu-|6C%g~!%C(5d(g`Jj*o=ZAra*FJcHnYKo*Y1 z3&2Sr_elwqI870XmF42*o@!F#x6z07NTB|l^;cammpPBeN!hj_Ih+Xw6rDYW1M2{i zfaDnuIJZ@-kFl1wR7Jjj&+7U0S`{6E77NO(x6L0OcfVHAeo7Q}zwHzoT?gw%7SC^3 ztOB}eb=JL9A*&h{migoL#6msr@sVz#t)hNqm6ebw+@vOXunS$?9~ZmzQ~&~yQiK8~ z3XaFK)nQOgG!`3J43ChUJp$H=uMH`#+u2dEersD8@F{Lx|HN&jt*i`o^RrVj1G zF-U}5BN}A)f{PgKnaVyNeMJlPyZbzB$57VwWV}v*L<>N-Ezdu15gl}<8WZ5@qmJ5(sWdFw~+hM7NmjJLp`g-ynG8DI*r+Za@#&@H@2&1p1KFPAQOJk zwX^HGn$0Nh{3D8?hd*obFKzxLOhK(;TUt5}>=LL* zCG&e}yZeu>oYOH!Aq>Bd6giA>0Y_s*z^mi#{Hk9ZJL@l90W!E)Ifx9PLcbgHNaLNJ z1Nfsxyp*|5_oC#U{F^nb{;n=LdVHD-TaR}mmM118K{LW8|%NoUIO@8}8uQbJvNGZ1lh*WmBu?oGxnu^$uW^f!qg zi}Pw$&_h-Y_$p{Biyie8r#>VgU~#|`K54SQ_V#CYZl^^%-b%~$>v zJ^fqvWrOYh$^^d?#3Pz~R_S5#60>_b0D#9!YGy@jC+(heCIHgKl|8hz z)!HAkUAMj6K_KLIQiF&2H&z{Dy>vGHjK`U5`WfWVdSND?Ac6Tx_#cq$|D$2}|C1k{ z09oyhVb&($akg&$`W7fu(K!Wg~a>St5*TkVdNj8 z1&kt}DmrW4lM0v8gS*;m1RU=v8QV4GYo!7%EBEByjGMjL0{9x> zG)quX?dX)81w8ylq8aQ(FaY&?q}Cc1{gK7>;i&Y~jn?2Hwk6Ge<6k3{US2l%M$f_0>7Q`@rI&IWF*KpgsIH$v{)jx zy?szY4=9X;cjsVTBjkl`;rnk;GH~3S6a+)*_8Cwcf_lRgh*J6g9v@%R!O_e8`0*pm z!X`-Qd;`7|^ctkYg#^m!{Xi3Iub0AtTb0lAjHeFsDBD^n3{vOx)M-e*e991O=n2S7 zD%BNqxBUEXGtko`8}d{nT#N{mnTLlp@`nJLGDVz%mm^rPqf&{kdJ1Nsw7zViKAF5n?CM}I#7Yd+6>_@$k2D`%o%{vNB zN;M$h=*||~14tS8q|O0+X9HGB>%l$|ZLm$n8;A@_jCvST#L9DuJdzRaL z1Vx8EU>~RnC*W2v?HEGFo&k_KMZ94w_wf_HkO>-s1R=-f*C6?XGyFIcOAci9C#*pro&KXHA0s)wP5Hr@6smKVoT+R^bK zyFYU}pndQ?>bt($!wrbsQ$2?8aP?Xl0G-YIQe14)5lIWZh)qF%`s>_}Ulasmt0xJH zzQlR-Bc#p8~7BVs-BO^h^9=aAueEh@7BxlT%X2gLj8D5kEv=YE#=I0j3 z3JWYPEF?3d8Ly%$63TR3HrAi6SBU5!zSR-ON)X)MIg3DM z%WxZt?CTT0I7+ve=+Uqr5jG#^Fbx%G9k-FxihD66J0S~LzYVBr@Ss%dgQ4$0g^9E5uu)qsdp=chF=B65A~_*&#_Eg&zzmq;`IGF8^(xz zQ(R0yVReN>Ha9*FNN1K-Cj1;xs}JRp_&BMBy#RNVW@Pk>=ar~z1YDaCDjfcDiLGJ8 zPC%A)6DQsVuOP@`nAK|R0Y8UF@;YCMuAlyp{UJ9u_r83bzB_l8*Cm7nmHEsKss!#4 z3^d`lYk@vov%dB%7sG>yW@=leVzNbuxie6zx7g7_(aJN8a?Bc zfq*wUBrS?}o%|I>2epBHWlr`6=rPw!$Fe!BK$vuur0(S)MAqn7L<7Z&nNXoi20ge( zVIf5MT`Ef1c2XfE*``XBf3A3{=L$iebEJM7fXWaQT|x-Yb*NCphxBv<*(JWWa3m5Z z8=)Wi_`lY!GI?(l#_YB~3f0EV#>>ffC&;@1h(!r-F7h~UfodT!F)`{Hn3>o1r&_8jd!@G2fL=Iok($ZeJK)q=-Ro6Q)>ATr*+KsPc zzcgUF6U6|+|9v9k6%EZPy-yCue>Prvf-PLl{aVoJg!x;Zlyho=I>;&pV_j9{o-%wM;CBhAfY!(f8%`^z;DSu0Qy&>;XmK4^Yd#f{LC4xxqTJ2OToGPm zar4)KbzA%7i4mmCfUTuVhhIPX0ohA32nENL8$cs5pVQF3nTN+`iU4UTjfSlz|Fczt+=kfd!s{zM%5_)DUjmwh{8xK`t z8*gUYnY!-LH;p}+okIKlS7j$2dU)6Q%#XI>fNpxZeE%(?Rzf4?RR*s?dr#^R_sgqw z`2)4ZX=(bPwK-Aaq=LUp+hef}_FJzDv@IBSSC^B$$oMVC0Y>vWo{vEhexPVnZ$16> zt7Ne2;d1(1Z>5efXX=O(M4A=*g5mHPz@+Y&@V1bN1+4cT8g&ho%+oc(<739)pcSi$ z67FlFhj{1+G7^DT0SmWR56?Ng+<)h)G?y3x3!(UyVf`tB%%m)y-D$(=7JgD;PRa0f z(GL;(RxI`_eUcMt7t6h+#>18q9KEmWwdhv`PiGOb1pqk@o+)T+lMTo(J;KDq48~(t zPR=sss6JSk&^R^+F?_hkyDs>LftIIJ`aHD0qH?(KPHtZ#h0&ZeJEOL-;2 zQ^(^Aclf@B!fTm?HL>6M<>=&E6&4;_qBmf9fivw-pbacpDpf{;P%xz9u1uYsUKhuU zxx)g}xUG9qTyEhlVP5`e zMqTYpcWUTmUuc1Waa{nqvjbDMQ<&H<0NLo|jLY^@%}T!ARp|eZNB%qZ)p~^*oTdG_~x>%dmO=TW2=LQprJf z<;Q?ww!f64R@V9Mj(yC?}|8?nS$ z#o7vO)SyJ+%R19kFCyQ|QI$jF6W&FrLmMRQ5k!JR1OMd;l zQ~9l{$w#Hjv&CR$sW2kLvu7*XMi*AEdy{(WOf)qMwHZv+@ME-1(~XIU9efSl4nl~z z<cNTAFlj~(xET8i5dslHQ;(C{trAfIrwQOqC%?h*!%dN;QmxOqZmK+dzTgMq* zUW0LO{SYN^q0rV8aP*nJ?AsdX=}F;l9K*x}-IJOTd)e1r{7^N5z!W$;jgafk%*+7c z8K|!I%}!JEi;JtSL!@(18F4#YH^ZD6ny6^C#|&`Q57m!X=EO5`AD++2RY};>{E+6b ztX`?+S|IGuSa4HyFbq!GuJLN3$0~TZ7K}_x6ZLM;kdRYhcDUj9?lz%-bJ4b`aX8tK z%5+(J1`a0um5Uj}C@Dcq5u$L8VpIEm3d4O6hgb)Ql2cI|L@2~3L6_VV3Mmo_pnKeX4N&C3>{Or3LME3neSn3H`*xL1Fdu z0!52-scaG><0iVwbNRf}Fe9aPEbj~8fI8c`rENKla# zJ5WP=qF8&~%xsT)QVbLG$K!Gbhu0erg5c+Z2bVzhczRUIw05&tdSjR-`#dyh;6@Kf zx-1+DI+O&-@~JrlYwM6UcBwGeoJg4EO%~NWl^-A;I&E7aT$Qh%k5a!!-5Ns558@!Q zH-l_ehYE)^oZt$?xi2^H^790AN@N_SW?-9Ps9Y|kY5~2Vcf7mLG-zHUzU{auSI<4*0C)b2 zx}U@>DFA`FGQMUOEIS=OKaKhLaYd=3`vK3kUw8gkWvSyyd?Jxug^FbywX?+YN6P{pKYX1?4X*73TSk3pTE7mfq< zqN20YO#~_5=TpklJm2&Lh0u^1hH-FDlA`LwsIekrGmn+>T9x2PTTVq)eqehLJ}5cF zuzF`5JD2=Z_bk4{4)qnmhp(le5 zDYRZEV@>o_o#9V7kM=d49AJ4!cdS7I9piP1tYCvJgyLMhkik16p8BYvK!QYrgYZp_ zc0Qfe>9uQ%yGN2rX&(mpjhmW$;-3$`c`!hdR~bQ6GAZVoY&R<;}E>x^|;z18vl{|;e-<u@9S zUse^PGe;J0X!fU^`g85jvaotxt2D#1Z8%>eb6WmTkmx-~Efw@011=HYWXa93^xDev zLNnd*TOz-MgM)hESP2q>7%zWXo2OPPCGK~9<1CJSfAO|mhFYcPIiRkWHxE^CIrz+$ z2CDMD4L#a#7Wa4D7|$LvnZHY#8ul7ma>U{>tIBky}EJVTe6tz~x%!xjD1 zUO4~o5~>POBT-L3;^KMoTP591kW=nYog`L9NVw6B@(vA{eGc+Ll@2BP!kr)|akvD` zwehWQh#Xm!Rp^p}OxmF#XGPy(9|Um0f+uL{(+(OKYu+)^=~0^k9sQL7yb?lGEw44X#x(**H~^qu&8g9!qkSQ5g<$U zv^V5_miXYqB!`Jjlz*@>;RYvTC{g@fjzg0z;C~Ig%&(oJQOUOKXAC17luea-F}qku z#GE19Kc8Oor3uR&Oi)Q8qO7g!aOMS6bMf7G8IkiucIpL?lP9d_UCx^!ZSoT6f|ZNf}c zq^P0cmq`{t{E6BIB>@&xh~RVHN*Q8w(5i7)`w$@(;@BHVb9v#jAsT(j(HTN2tgXdi zy7Q_N2ZPV`a4FTr4APtU)*lCJ3g_`ET}k{-=dGCY)gK=oRq}_*=V&(!7^bPJ+3n|q zb)HD|0%KsmZgr6Ge`ipmKy6ka_glTAm&9b zbp2j1{BpU_om@DO)}H2_#eV@=?TSNocD6#NRq4VdS>~bFDy9&TxR75n`ZTo*3X1nu zga8VPh_ehC3JQe)4FUxPn=BF?1?2{!0~H13jsM&g6qK*xJ18h9)0F?=i_ zb9cHjP2oZjOkiNH*|(*2{655#LD|20K*&<|#NrJb_sIDl)1P*8*@-goZKtN0aVwL_ zLr=JFHI4~SHAsv}?T8Gq7|Ax;uyG~C(^9eLvgVA+Yq_1sHx#q-luWQbSk1NzZ~rLK z8CWW55L~*`?rJ9fs@X+#-erAv&-z}!ov{xM6}quaxp6>lOQE_Gss6p7`~V9_Wvisn zZdc=53n%Tq#eV7YRZ{6fCAcc}8-tE|!(r-HLbA^_LewZqhLlFVbQV)vx6PVt-sndK zJgTnXO|Yw&aU(cToU(MPyz%N*BzlRouMJxTU$d?SW}W5s{z%JyjDaRsQtL{kq%w_3 z*REz-@MMnW&-W{PmD@2Dzn>OUNx3M_Vb8k6%Z%#3sT{2myV*6M$W&u;?=Z-6E4%I9 zu*rAnN_|UKdD;^R{lTM(sH%z^ht2$E+f&1pg!j|EJ1WN}I(aKy9)vN`3A}xy1@)X zt0`-;4gQp^CnK-r>%;JT9*V-6v+15fQOAUZ_-5|P8~FeKcq#tBT)F@K%U`@m8tzK< z5UsB#LlMI0Ky5-Nh@)mQJu0~7jbMvx1N7NRTAt!hY%hLpPHHBj6Gj*I=-HDi-)CA@}q9(SOM6#SKJV=kK@SGhP&fxun6B z+hJK`*YGv%7T}@tggTAe#mf7?LU@#Ks?@$Goqe!HR*EqaT%2}c7_#0~PB#^OrM6YEdmT_qld;?ch?F4X*RzLab`< zcSCcj-m0tHjP;??G4;fn>a%MCs~;*5C?Y(<7OX?R&*+#J9Rt_aRm}=*yCVxeMsiFy zc9d88^-7rsyLH_A-CKDz*FCC!LW`pyWEQ2R7;Iw2XXx+nGf$-lnTD3y<%Qj1LqVxR zONIj)C45Y_ka^>M;AkxAdS-z<{wH!OXXEFG6$dV^BO27ST1teB>u9^Cnp(Yr?%({< z9ZDm*-zVHEP87_Sh-Ybe&93Z5Y+q*hSUI}3%*FgYtwnEt)#%;z4O2N`)Lg85nJucgCu2uX(bi~lKRNj?m3YZ!yiv?GNH#&GGd6VHkRvNlP7777 zBc!c(U@6}n^cnrnq~gpF?dU{hN=&6A3W|_67cIi9W;bCfglbY(S2=R=2)`*bTqw&S?zx;h^i zLf@g5Ug?HniUz>95LX*@CgpR2Jn8_oRg?EUay9@+txgU%Co<)sLcr&+fvmCslA}{) zJq>uBV=j4mLyAYOqs#n3WU2rtI~<_xA4E2*8r%zHKBasw_)V{D!J|z)RH<#RwX%7OGxnNv>J6ZHr_LJ~g+FaeCy+#ru)kVcBYy*`g>$e?IhU z#^;Xaeu)`8;roB>1Z*MWot}tCy)EW$OCxzY=EY<*;an?~KVx=xciTdUp}N}uc=VUk zbZlnYKLG5760&C)WXeItC-_2P8**B&%R{gAPE+;_7jbj_FrC@>8m;Q4;$~-~Ow`(U zCJY9O_8kgxzeacRzUwg&l6&y1gtKALVUdT;vd2mPfheYxEBqe=p#TVO=gnCIa!3R` zL7mvcvR&Wne18~#t4i|;K2Vf3eESxjr-J+1G?1<(bCn&|hw@c6C!u(9^u_ESEC0qP za$9#fsC^#vo0UN?&11z3NIwrM8C52~>@(hPxW^BDBVPn2U`_JcEy6fo^m}#rR)qca z2x1ZQ9R^AY3UIo>s9v9&cj2P-iV!Fnhnh2FI7mlzAhZJVvj9iW!8;1@Yom9x-{>=h z8Ygh9K#RPXo5CMXqr0+XB7gQaN+ykde-aSTu}Ng{tjiRMMDL(Zs0Xav#Bd$}JQ!9j zb@dZ426Fp$-wgl=AXf1_q zUEHAp2h=aD7l(P|Zl7qv^Y)RI!CEIPaNtAo6_}Wyj`((HWK8Hc>^knVt#43i%%A#9 z%H@6pJT_>;8X6ffiD@U;{h6A--O|~;Pn;?W3CVBYO&5w+01UK@Re~~fZC2J&Ybf!- zsC>o|c$uCWw1tNg@Rq;|s7JCXE3GP_^Ak#F)WVm2^FPU>tKdgQn~>HrN6 z=s$i&o34F3$8L)j&g}Xm=mr(r z^yp}4)I_eP?Spl2%vJ~Z9pFf4kc$$wTL21hTNp97$=093hU1JW6&(g+`YTKFv%$%U zd_Z*@J9#GN^?+(`eOSKxa<>IP=!UX>j~(sZ=$9^ny$wS+(VNLJnXkcJj?41w$h1GR zJBdA0_jd_YZy)5DOd*R|#6p^~2r@Q_L3Lq^;+@bZ4~j>O_bCfZr=0Zh4C-|lE_Yf- zRU-qqBC>1`DXW|vZSbDGOsJpqxZSJearoq=Qi9|TN=XZ}vk2HZ?%f$^#Ne}?`fyph zkVJN1n_{oA#%nGJ2Ui>Oi|djdvxie&Dr-T+H-L0qdoJXZarF{n#_dfAp z*MhjoAp9Q~qob(?(yOU~I(k$mMQI{?fp)p&Syd?*(KHRqQ#xKbVuDdL$f9q2dh)BR z&qEs9Vx9Y&Q(nt`Uw{Nt2uAESy9;k`;mdsz$Zq*29TpY!F-gedqv z#yn8R>|%hLOOe>Frc;57Yqi$)t<`+s2mkK}?Tk(;pO&7lQ`-(NnNVMN(~2rt;J~a> z{vcVWo9y|fEtLS5V=h$v28V}r0B*?1;d59SK(5@FXk2{!LhaH8xJ{4}Lx2$$He9Il zHesMA?icyW&;;|?y<61#j>Vp>T5Bdfs4IBSB#Na>8!A)UNon11Rt)G*@61Dqb(r;R z=O;594Gow2BLEqeHvq*O4u{3LvtwwqK)GzRH^Gr16TzZ%nY-G#fdn^=4*8unp^JPL zN&(0V8s-F~T)8aAv)ox=Pi^DS(R0wt(`zirQ@@Y(Qos4_2{FVfijHx>{mSFD!(&n} z1Hu4ONoK6^5{}J4ocmo#f~RBAj6>WnHe)Y|&+(bH1-vday9+g|)1<;l`Hjk|O#6SN zQLPJsOcW3>Ko96OI37ZaPcn~-t*2*$*o(opx8Q^+MUYne%w3toj+72lqz3?4*3Pcf z_bX(R;7VzFURws)Ayl&AU3fibzQfGjW3U{r``y#C1%xo@CxT5&9>fM0luG23g$pS3 zyblWcZMQ(5cN^NQ*Q#uQN%FutPqkPd*40b8}Cb4Tob%#V?3gvLGaKfJR=?Z)HpRyZy6O3@Fn_&LFmWXONORv<+Pes zq%vi%ErLFVoKtB<6+fyN9r;=RYJlW;Og(z#4&T8O>ny3j8@VM%oJ^19c(;X9k62~M zWX86~tn#?KLxM679#A}jzffgtifEG{o*nr%vN8GFD>N5tGpOA*ZGUp{FNKOyWh2sENBp);XP9#1hBhfpBl^<3AY)wHR76>hp}R`7H%htlFn<|*_7<} zKDoutSB z#QxK_o7o!8jstbx-CjG5N`34(B)a!l1V)g!1635l@Y7cwJ4aEdzt%cn?zke+eZ_W~ z+E_LwsT()cl7@xk5pH)w<+8%!2Ax-ujI^9C!+v~Pojok6I#8lqO`fwZuvs&-3>vUB zx8;g5@pxrr&}>!zJL{ZgD5^tyHmg@Hw6xA_>e{>ppoXT@E)?`M2zL?#R}MP4bBnVt z+5Or<&obe?IXj3#^tBxyb@|$y63(c&4)es2qSF*Vx;d2Ttb1oWSBo=loATs)_290i z`_D?iA^QN@doDwEq}qBfE@tuQemmrU`X90lj6#!BLOld?pGiG-8|4f>!nIw`C0)C8 z2sQ{cSl~jisY|YjMCLo02LxFSc+Nb&Ssedsaf4~wa{u@6Wt1O8+5a424(iFWi#Afa zfBh*DqqnjA@E5PqAg;arYkU6lA&}<^1x)n+zHdids#*Vx7jWK^IThV$x(^`$FU?7u z|AvmsmdvcpaxedB=e5tl$cOM8y-G3rZ<{ni9PnDUuzx(CcL>Byya12=|Mn$+Hjy>@ zd@yKkwp?hu1X5ODeZ~HHmq>VvMbBL}}F~boEY> zeERxTtkw}OuD^dt29~RcEe)cHT-f5~fB#->hXQ@y4h2wXq~Y1#3-kdb9zg+eCH+WoI4?0i2b;ATK<*g{|&Gb04NZ^P)cGyJna z67dL(Gr`VQ-%A<07nqlkk#}n)4zfWWZ@4hoBkv9l-7}=ajn-9^ad^iC2D{s&d;>|9 zIPDeW8fz1^!$Kw3qT+x?xZa0?4NHgZS@E}|T;b2qE`A^sR{{E`r?EnFkl-8$q3FW7 zKzPuMKzst91LMt)yg^U2YV3;_sF$92m$}Tt_{L zfWAvNa^$M<{>5*<6d|Z^Ur9^LVl%=NQvGe6hoNnS16KoJL6`V0?5LF*{bqNB9r6{r zXlqS|vhwnP%$n&DUA zeDv5Y3o#GT)8}DT>os%y(%XrPsgA{_(?HsA03Map$YF_3l}pWoD}GdzP_St$eQE#8;2JDsBfd z7GKyG0Ck4Nn^1 zr1pM0wsv>5R^d9q<1xuO{kffaAAF?yWMj_rew;e>x$AO?@6YuNkNI(?$@~AEr~Fap z*yijq^Ve%G-w?Vjvhw`ptVeA&uOEN=ys7_qu))uVKd;VzQ6UumH1DF~Nlld;)mg(Sj#(B@m}uiTGMr!Ck(IeP@A;F^MsJRd{5D~A1{wZyQZAn zIN4(L<{jI;x4ddOd$T6XuO{xCad0W?wY58Tx10^UAaGMIdagpmPnrH?{c6i7jdhb+ zz8*K5vF7W$xpSWj>b_fXd)fxhkGV%vWH+U|=3Fei_04PlDw(B6fR~}R5T4RZ{Q18A bzkTw|IX1v^nQj6{*%>@t{an^LB{Ts5f2`;V literal 0 HcmV?d00001 diff --git a/windows/plan/images/deploy-win-10-school-figure3.png b/windows/plan/images/deploy-win-10-school-figure3.png new file mode 100644 index 0000000000000000000000000000000000000000..1b39b5cc14258539da1a9d4b199d7ec60db6053b GIT binary patch literal 131013 zcmWh!WmFwK5MA8ep}2c-w}*RiDNga?P+W>T#jUtgv`{E+#ogUXad(Grznrt@{m9w8 zNj90ebMGYbgNiH~GBGj$0BG`ZQtAKzy#+ogh|mB4m64hl0(Kxd$?3TQ0DABL57dBT z*(U%%R<)6o{P4lr(aq7-+R=$ZUQ&|6$;Hvq=CcI=crIsaSZQh;;EUX?Uqcil0+SUT z)$tH1)FIJWuOAH)9EyTJXpYF#N2Ef_`nL7&>gk3a}Oe zDkrp~qygRc0IsFt9|2&I6?iYNV<`vJHUVAZm?%F1L{#9tT0|%#0P6#o3{q2j0wEay zuFR#5@C9=<<{lHcQW-ymn`s23zkWnybw<$9VIyN0mnUGx@n1mR!LrVk)BkHDo&T+QX=&%*zeR;VkdLOrI)1NKJ;q%+ zFP|U$g`e+kHaq^(eC0I!DhqqR*)w{rRQzrt5h=uMbvIu2xe4X%nRJHgkGxs4E)(vy z8n$zsRA$T-XE9YIB$2U?cKYqp-wl>07|{(Lpw?Ct$|r%f%+MU>R*@c4*RAXC9ROUm zI(E-8Ai@M%2X9Syyq$@?$mY=kftK=#&H!K}MZ=~!TrW0&2mn%fUzutpNUpmHS-Rlg zb;GT8qdc4NhCpck^gu8n$e#k=xtK6k20<9Y#%f8KOxS0|Nx8e!tizI=(Aj#lexr*x zVLX~5=5#Z(eMN$m7(~P|rCg4HGK<52 z(2^s)6mfwT2se;vNe~(YID?+U+GIJBzy4GcnMM62*<8j)93oSIGWp4kBQqX9FKg1J zfmkGlH-B&Phc(7>yr|^B`>uUL1g<}y-?R1iLhATgkdn+t>ZmGFfAkaAYFEOvM&6iD z)Oo;Sf0gb+;)V5qP?(ZQ$muHSsw~QtQM{w!##%<=LxKrW>!GJgDpPErYr%T>Lukgy z5w0u8LOqWikHe1X6CwGBj|MwZl9Rsq8?<~~k>)h^w9K@FI`sidc^0=EF?G_=@+Z5W z2m;A06wHI6|FZw}{^R;b@{jWJBXYKxxO36H#$N{YVOs^F9n2l>9e9g$P6@5TO!c+0 zd`&E#czsA!exrJgT6h@_w|l0*STMf4VsTYL$_%kJf%TnD&AwX;)>;agO4_8(^vHqi ze%e0FwFfF%7+&x|gcSo(79j$m6_E#FO}bJE(M&YafaZHXj-&Lw42%p%EnTKYCSSaS zVdNBr6uJ}=CU(v8ijs=;3KXp?tr5-maw84DY8fpqjqP%z+0-9e71KHN}ej^6 z>?lmiKCp73CTZ9!E?I1vVw$!UlF&RQTsS8aD}xbZ({Hd%vu)pR-(N@vPe)0osC=k= znyIebT*6o)q$H#?Fg7|?FgBmTlO@8jz`2*Tm$i_!(PX0Usn60_*7(~({^vja61~&L zHiuAs0li{fEq%j!nX2q6+WFS1)>5p}W|btBA35_@y|ovOLyhH4M72AM@GI4g_Kkj~ zR%QfNO?}n9r%CNeel32nFCqwN;Y;X0NcBnmT^n3*1+@j&GsnN5iuv_jryj6d=}ury zEOKo(;*2o-RqA^9~vI26DAht6roEz#gWG2F|{h`x*_!_l`6HKWyPT?P{XRg z!z5b4W-GkR*TUT**3V|CH#(=AttCeF)Oo2MwLP z^2d9wLrd|?*|1pzQ^l1cRQQw6B`}%F@MCB%aXe__kiB|Hd#tF~r+B9#79|as$W$)n zn3TN}j}zK>ylDEkidlA=L+H!DwJD(~tz`-3;AeiJu;&yJZ0870O!(#usi0I&YP34E z+O_;LQfU$T^R>?*x`~}E1!2gp{#zxS9xHMqq-0-HpJ9Os;ir{_j%DXqlUl5of2&WzRMhVmbOnm=gdpW>GpcJ|-llS)_Tb`KZZzI=%MGbm87%>XgK%?Uws^ZslX! z-HYf@$BGt|mhznCoW+y;Q~jM-b!5fCed?3FVU>!#^T`0rG|USEHG1Ph^Xweyw1}p9 z{5$7}YP2P+ycnpW)h{=d{tQeOWK?vOU_$j}6rzr^@dZXwK&e<8IZWw(W7 zUS`T(&r9J-bI4}-AZRAZ>T)6`J0;uCpY37Q zWTl|dXU}|m!xqEwtOe6;Yg+m(dQYfLXx!lPx7+20TStD6n%noqskfB9J69gyVkjjvs|dtKna&Clfsh^)0=c{|?q-Q8^9ulc*szl@Kx zE_u+OR<)_N8DEQ^NGwUNh0lq7d|h2UTMe-7^2ocIT9v(n4-KApO}L52kc5lRh#v_< z3p>i;7ZnirE9UZY@LVc6@o9oChv2o~b)=dApWXj{?r33rDt#(H?J_N?)84oE<*@6B zsAi?Vr=P52$dil1=vw>fq}yZFgY>L$14H$nFGT>uoApE8jmBi@QxZ{9(i<#H`qi^J z7wZa$Hz~~J)Rh6in-%~9g8|^-4g5U-0QdI*aA*Pmg6RN2;FxIKCj&rTpUX>0XnHOm z8+hqz4B(6L`9NSQ=p^3A z{Uai%QLE0@84Bl5Y#$yTtmX&UWc}OPkZ)cA2ESpkp{Nzb#|Q45EiXq_n>&SEEypul zgDFEy#FIm2nRTj?Z615`uJ7@pi#n^SCE+u?QlKa5+109CJq3r^xm<|}dPqwI+DwQ= z;}zniUP*6ZB1No=_**w73R_zC2t@ibbj=?(#4c*&wb% ze7hk~#ftyfdr@T@veihoD_wtFExvhta4=WGNxhxZ`ZWA%Y3y$xE}O#ldYyjO#sE+z zCtjN11W$jsi2_(qTX|&`yaaqgWHJO|>syuAmcKLnHONfnK4tUO5brmG>~d!WTaDVz`?+CLz*tI*B6} zfCYE}7OfM@y?>uRecCio$`D>!T;vxJ@H(2W!bRRe5Fmnvyt>}bsV)oysb4FD(c!kU2xuR8 zm@>yKSC*E3l{Y8Z*`dA z#qJ_n(9bkp#)Jn%95MkWp^Upy1M9P8QdC47X0X*YADhqtp#6qiU3ZX9Ig{INo<%hG zY>AFg1jtc>hgRA95^Sy1m4<@kT`nutxhqID`zPIi0%`*J# z*Ny$7qmdmKEJ#wbfvW0+$2AK$^E4JcY;0nE1B2Dc$y(pOC=Z(|3H^=nQZ{I)S3axT zD(>a4NjOREqMzu}-fQ#+JB5b7WmJq3ezbWD9q!noj zHAd~k9*3Hyrd!Z_P2|rnbGdt(`c@{~#A9=Pq3`+Du&tb;+G3fPn%LuC=)PQ)2L3BX zqzw62&d3Pjn}cuQ{E7Fws*NOh2rkquyjrl-{t}F#@I5AaX7Z{q zquvsn_qO18^iyP-ZNoNa*a?5s8s+iB)n0#pzsMc}%^YR2VNcV$D1vP=1%rNT_YT8m zgLR4&UV9OT)E`%W-tVKbix6y(mKTR(RwPh|U}kV8j!qNBcbA9%0_`8Cw1JaWM4*J# zHnz4q%2Nsu>?NjjYkfGnEdbw0@<;T*|YV!5t zh(uydO>Qo^19fX^nnR+)b!ouc3x)v}a;WDu1tTM)sAx`~nfn|qE+31bg|p9iu8NXU zWw}XQt_d0tLOricB|CY}1O@CKlEi(=60(20%96w?NLdaAKDeL&yRf_hg3M?#w=U0p zv$Nc9dPe*4M#3F=B_$<3+jNBA!p30(U2BXRX4#(5fi4qh;QL)>%)$xt(8Jx@v!4c1(1AZEe^4 zV-Z361E;&tw~2`f$9mzL4A;a{Oyb}=w}a`lzP@01G^)mOLr$khUiNSd^3#<)C_fc= zPomA@fb*UL({|4rhl!frbtkeStRKFUW$Pc~F@bp_3~wv`&!f;xye7u*$EN^0Oxv}P zku3=(7}&-UP`F1&!0aJi3B$2I2t;GobO+QN3S|UGHf?R}|m)FC`8re{gmSQw!`&fdFgH2q) z|69{cSXekBeE0ZY5w_&F#H_3zV8b>yGYeu~`Di8XA%o7RsHCK%rG=;F+j>Ej0(y~F zd_273sw#U^Q`3PxK5p)YZcRrthEIgOulI-Neh{!3yyxQD zc4;0O8iIp^lg0H8#%xJTaDH8F{@COgPa>4syY>8z$i~sJ({@Jznj&pPLqnsmu+Yxd zZs4Qd(#pz4XFz9L+q3d@xsePWK4}Q%!5I6G20kNe?##aZDbU;YnKh5)z9r=6C)8b3 z*Vbwug~r9@=Tl~@@V$Sp``gJ>OS%u!?}eA~fR2t1Bo(?%ocP~~=86rke&;`>RN9o| z;N+qb2{-`Ir!OB3E(O8jX7&i{VR7>V9mAh3m>KYn4xIUPP;;~z(*5a<_ z)EhZs!9|v?`|W*mcmYA3&8!UyNaT-;tfH24l?^5n<5Jh1!RRdnN; zN<_SjOcmN23$NFj_Ks%@tweVwr>0`Jtn`F3!QgavcZZN+5|&|aAIx34l3G|;oX84R z8+Wdoa{v1=-k!|qxZd_fw5qZa7ZG;&2KuW>*t5GHnQ@x=A}lj`m3RVn}_wJrt{VN@n7Ui3=y@Gl1i@Vi-q07 zHt2|L4i4(->c9j2<;xedI({y$E8Qd0jO=Vy>`1mqsiexPQrBimO3J7euGQ#v_akix z1Y%^AQ(R1&Hln5S5wxt$b#J^qCg#myUD$q^TQoi`C1p;?*%3dQw!GSsGXr$CZ#nO` zE@n!D-Q8DyYk7Nn)6&wi;E(k5^bAi=udW&>{;;=v{zfT@Y}97*o)Cv#<(<$MmfV4n z&wh$ZbVB)lw*Jk3gU^&K5xU?3tQR>|hv=?+E!NA2tDJ6zkM zOE_#B*(v;G$*PYE<{n<9>XCztAXDfHF^Q3?w} zNRz6x1^sy)$7k8OFFc%Ee6vrd?yFm&8a*=w03|(qL_oH4dT9Ld#x#@g@X8@9Al$s9 zQtXvt4+&_&_^>#Pms!|!-X--`8MRR3!hV_?WxA9Q-B2t4;Y;G7oL?;TZ9;v2&Q}(9qD>I5^G( zNIKr$Z4rHc(K_kni^{-;f&sIk26k2HoUl|?rwx4qH(oned_g0*Qp_?u0DdIm9z}EW z?T0lVPKPKUaANNcn*AO6-c2^co)&~Gz7%YfZHvpx=yZFRo~~ZPIkBIq+*5 zR}lrVXW%A*BErNBT|pR6Ogt@rDy>II5P~cF`Bjf7Sn0R2-SS0(mKl$x+j1g3Y7Omx|JY3oDUC7v?Ph z%Z3M+v;VaO8z}K@Mald1{s4_n5)~Nb_`KtRMwrNx+P^F1%3=NcZ({?P#7;_8al`Uh~j-k%DPFOrs)=HDy{8hP)W z0v={mz(3|;kGK`s{QPCvAWZ=1vaEl>UxpT+jJnaW#s&7%!UIhSArZY>pEo*Q>_U?_ zBJ*$^9UXzZTkUtA>?p%O_T>rhDeriJZ*Ja}^PsX9MD8|;EeY2P}ihs$Ac6gG7>}KWGwA&KxBk~0N`q)A=>F|vKRG=IvY6rxd)E7U? z@@d>wySTWJ@$x_cNWCDk_c&dZFIEr#GoH!kxE_Vaj8C(s_BmOhI4}X-GRLIzn1F;t z@!wDOk1e>e6=75T`n{Ntt*xzls8~&=cF&8ygF@~8FD*$L@iRC56n)zu;AK4#`V$2(2|-i)lQW4*n> zzb30X(X=7?@Bl{*JkSDVtAGsECFA?X8GsLL5+^_p0-peF(^X2|5GA@93$OQ(h(5Cm z&$fim#YO5iR#tm0H%F@9`KM@ccXxK+stn3Y>{rx{jiE!mueTZ1)YNA3rem* zJ53!wK$wl>xwxYP*49f`moTf3xQeo{r%<`l9vXO7x;PiK3v34hN!oQ#p-|nszrz6< zdvHJ(3y#ZOIY-MRWQU-S2n7X&lr(#anDKC#mfgplC{{*;`SO~4Z+z=Ve0V8+9FGS- zkCs5W26ggZ@=ewA1Dk_Y8MU6``GNgCp#VkYB}`Grpvd>z_r2w%qCPxZiIq?$hg|`_ zhie&%iJG};_A4zXSLqV~#arX~#rskoIYutAorr~vMOM?dQ& zFS!4~pkfov=Mj)p%>~cbmf%Kw=)6gBwHdN%(#BCV@rApW01(%23|LLZ#>Le%GCJKm zu(Yt?vAlD&DZApu?$ODm#CpWFABNDmo?n|PqZ<5(bb5NMEobzcDT#h~D70{(@4*@n zBH4yt2ki7v&5YY}W}AQ84p# zO@bZFvyv*tXiHFAQf+#tCNJqGHkLk&=5?!PbauHjB0?VUfno(rm2nbXcSpTu50Z?Q zx5Qcz+-sufGi*ddio2+oCQm8bo*Jg(0++&Gh{Xg)qHlT03$E-f7{)Ku$b6(7SyW_Y zWm)iX_FbtGA~tti9_q{o5Ql#M{#{D&&bw%E5`^z*XKv5Z4tDnTFWPwe^-6R?p64cG zCo90@>gxCJ$we&nPb2Jbq@*q(@3CzZpzK?4;$Ly_DEiBX$9qkAS zVV&(S!{EsOKv){{%*TMmCFjh`xPi;xpzc31ii(cjAHV!)%889jOiWBp9)ATR(JC7f zes{b?Lab>E3-Am1Bo;)(to#4jzJT!FQ9$5e;n6*cF!?794Gm#yKHG(9N5%FiACt`2 z=rBrJ7qz#qbxVXY3V57;PfH^hcU<~O+fJaNo$$qlKll2upt{3oM@-P`^560=JLh%B zhf7l%DY_)A^NH8jSJ)avI^hs?OmTbrlTZ|bpY`=8pY8QN-}WM4_)m|$bE%+Vj!|BinePv_Wf8XcYcp@T62rN%!>=V_t45A}kJ zY7&)_l9Q8DU481Sqr)35U97IGr2I5!lAfKNEyXfFH+OS+Y1Z7zMTqKbET!w`=jY?& z!<14{Q$tROc^;FH0RH(`@&L_b4qjef4&IWPgD;JZP_M6eDJdm%bPF}cXWIU`pN zE<`RfE9`}6yOswt?3`cCzv%uFr^72 ze}pn*hS#a6s0gc``8MRVt9B@2h8tLbXX7e|*qtltDpNcP@+OEz^G~X>5PyIF;l+vd z_4VP{3TnqXpWCv}VD>_PzwrE`HSBvoB@5emTh*jFEJuU=9V@yIT>RipB?pJo`=S^Z zMTOh54ff+h7k77y`Xz8;W4;|3K{{X#9#vzctRnv)BJ>1jWyMFQL3GwuU!OFxlbV_; zbG*3q_y6^tnVKSZI?z^D27{Z7On;l#)#}CE=idWf2~c4|(-#ob0gYfFo_ zr>AdLx*SzPy3(#LLI#~`4hwc9Cd9$P0c3SO+}t$VLXiM4O^%F2GI~1bwj?1UQqJbI zFy0u;&&eT!L{yhrS=tV}c+~v(ktOVPnX6OHFsz%NwJ^6ZbKpi#U)s#xwmJTZsrT)p zQYLuVthtw=;d{sDZ;R86hKZrxpRw2I%6|f@VtQ6y{EH2y7`zpF5~^I@(?QAU2d8$@ z^XxxX&GXK0Z{4zEkTcmE3#|-#42@)+^bJ%@b!))609b)JyfQ+_9QyKed>%i=bO+w+ zHTe!@sYC;tf5M0W-{w5*PZ&VnUv1J=)xPkZuY5KDh4l~Yh70yp*{Mz=9^Lbt^`HB* zPXJK%Xa$^q?`BgpphozuXV{*VPygFh|3ll`F8jx3XVJp@#OKxx7;&<_U&&3Wri8b{ zsK#a!DQ`q8qh1(mvuR)ywzks^3+NaaHC0ulW0T#~)4%K% zAd-^KIo&3IP~R@O-9IQQqF~XQ)GvWF5%EkyVoC}e@GEugSAq_amY71moW=LpFPT@+fy>o@s)+al*VNKj%*5sn zCp{m8V)iQ#g-Z1(h+jR7F2R*(FlDPHzvr12@q`f1;sA2Fdn6IIH9W7L+|?Y`pa{OX9F zvuXpKC?-NWB7*Ec>)?by5qIhh2dfE z)o?z6*IBcMg>l zL2Y+T`Zt3zHx=^cX_z}{I5J_84FsCEy7E^$foDsD65y9vpYWzY2-G9jm5Qm~#WDFL zK091o(tl!%U2K(l8rs?a8{K6tLebSJEf&$1>mEPc#2jJTzj_iPRjglVAc=bL{3rO7B z*f8QR?A?n|V_$&0dzoB9w~cX7;7T2ekAJgK7zK9ZJ5o}ped55i1R;cgW48k;>aW|S z(!D&`Z7_k^*=u{b0q9G2OSzs$<0(x~esY*0H8r45s7RQaF>jF!L#=CQ(9~)4KAD%e zQjI)|JN*JZBB70HshZQNI3CperPN`_=ZM4aY-DhHH1}3`{6cf&2QV8-G;A?TV#%s~ zdoy445oD8zh=|n7ui-?nq}6V3Z$WYkOv>`qNX*v5NvRBvMl9bcpk^HlZ){BDE;UBu z4siuuUtgh~w74Do1;g|1ZohW*2ZlIuv32qN{eQD+EAn#f^~|7*H>wALfq?bXR6OLVaoLA_Mc4GRryuQ?DUl*m+L~4ei&q@JMUea<|{Z8kD>6 z@jg50*FnYRnPgL6jpje09Z%@MfUZXO_2~Kg+vgY;|4%Q?;5w}b?&r+vy`B#3FL zN_ML4Kd+5Czo+VKA=U4~}PUlaUyYoK(brMtK+p( z(hE94H>jh75=W2ZKA(kYlL|r9prHV1<+_Ykf-Xd07-}65XE@l{+bGzkG<=F_Z_f|t z)be8gq%*s_ET#R^bB4&>6_naQP@c7^@cdK0CooiqF76#sTfI*FyC(NJe^O|(u%ZXl z0Its3vU+7zMI3&5`79Ee&RZV!Uw9`76E>T{Zc^$lm&-hM#E4i^>=bz(HAbT&RpynA zadqAqV!ysvk`nrqi7HX2jetzo?w=j$58B4~H>M))U`Zu^lc-Y6oN8`Z<|P1|1l47E zO8M*Ckgt?@(+b>;G+b^LgX#&WP%QnlPz?Ub4Kiym2{l0Vx|a<{uKRL8`ihC(FN za9v-G*KAEqDU*ioeMRLHeMJMdg5U(2n@?kDQf=-3tu+&;{p=l~?qPS!dArKQ{tEX4(eqW^zn3Brf#GAZb)1E_BZ~Z6oIUn8b z<0NVlGlEH>OeS>J*gs{Qu}we)K7{o@jf$mdmx%Ca0`1^9*zY+J&KpS5^(>ot`D|tn zjfeK-0V(?loLZ`FWmx>A|YU;xD-f#`o>}AkLH@JyZrnR8|om4Oo z@IGF=J3Y0VuO1s6U2XDk1cg*yhvf#_xr)CC7=O*oo9~gsOCu050zj^b3M1bC<%yn- z7LS0SHHO6M)2Ba6DZ7-sY`oN5!K@f)NcJ!+jBIT4qoK4(Lm;8m+L^pOYd={nB_m_o z@0p(Qdl$03hoTjosA#nokL_I>Az}JNxeHe&THy zzzxt0XEktyo2MX$o_us9jTGYaZ&Q5n9t%WJ|2g+ow%}*Bpf4&{k~a#=iqj18u!nF( z<>d$W7i>>=Q81Z0Y*<5AZ|_8ki;th0lQVt{%g>6v*6M2YSm{NT zz`(#jEoF)bo4t%gM*9pyj}RG<(}7+L{QeBRtLUmdHjCYZYk;VRdRvY z`f@5;G>~RU9*4f-ZBYs;@P5E=qe6($#|<9$#_Em{pnK{_@}U7@K4yNRL#^d>89{l& z1%h&tO$ErgkN|b0?#N9WY_-~6*<7iOGB^MM0pVx}EBgdq;H-HDeqpqwYhr?(hewO6 zMSA8s0*kt>tu1|E_mS6lignp5rI50l$@P%57_nI8LZgI6IXj|b3 z!hnk$+N0y~EE`X1epo$WTq|xU^H(dX#>sOCG&bVg=~jg_j`0ZLXIpK0!n z&)V3FW){iA%uP-J7_!b!1?*q0{;#aV9yjBfA zvndGsyp6OiX=sgCJ9+xeOQ@=_m^lTUei7}3XYYgyg9XlWj)ak{boiYNwz`}{VFvKf z-|6V%wDaPXYdB*vyELyX!9ve4Z^{+S>8*^OwYp93a__)w6R`PGS z0qQTu?yS2x9pgG2IV9Mis*g=At*v}IS?c9V^72GAC*1DV)@4;ytW68$_CW<@>FI>L zv2;r56bW)*-3tl#TC?lG%uGGpF><&L7U&-JcOnKIrgtVuYl?N-=vzdIGD~1GMa^aE zuRndVU`$Z}tTzL9N3(ylV%O>VZug_@1}GzNcVv9b?xm(m58x*KrpfeDm+>$!lJkyX z)=fMM0vR3|)=y#PVR^rhN`d$#Nif**#|j9KjOk2k=|B@i@Y!Y!kwBLlWFoW)DqylQ zGKbalr-KPzEDmrr#+@R<1|GCvWQXYJH2RLOHrKJNti#S%>eYiaM({la1ymY1NqjAC zHhnxO@dF*yN=7E2Bl(hKz!pGcu=Lvo=cztL!D4i)H(Su%#mQ+>P4&<1$uU>E{Lm0n zA`1)4@j^|mO6ASnoy891^=PXX+`XXYweLx&R<4P^)^6vx;Y8NruqGHpVS98)%yowL zEj@j(t@ta7ZlhUf{@3mxxGG)tc#4SUXWuFp(cGF}<)O`xnFcu;!PIXbSn-+hkP~Ta zGU*U|v>0FkNl8f=DojLBFvh~dqO2;pld5v|KIFPJ_&JRBU3Zt>|8P@rC1z!)V18(3Dx5JUmKogP&W)S5lG*x4OLMMa&i zwbr{v8MS|5Wn-%@Dv~PK1V>ZDmB945JCT$EZI&uxs4#5(0@kPa{I6Hr$|Zg-ub+>d z+7Zaqk6{)jbG$#_YDt@|ySF-J;{oX@$7P{Lv>y4lL z5#d1SbfKrB>4C$ed~aTSrU79jpM;PQ%p>RK=IXMBM@De4vH7dpyycz`1`L~rqo-QM zazxIWn?b6fCskHjnh_WIi-v>*)If?3c68f(44KH|Ka|;L>(dyiG}*y-I@h=@ngMe1 z@>5LgtgJg%58EU|ejps+=(uPo8_1Ny4~g9t^6+SM`l!1Is(WfypqLjks?@k@@$C5- z{r2S&MR^7-#HHCcJ3jtY0r~O@oW(~`)9E5hG|Qa|tm-ahqb${<{plas6OC&ecl$9Gt3JUMOmX<=q$Vq#)p z`82XtqBQmYVX?8X`P>{H9u8^=hN=*=0!=0h=3F61vc`8tAeke(4Oka7Dn-%oAIP{02W^aK&V{KcTZ~ubv+dKS{LhMk8^Z6uY zqwh-?TGHAoh`-%t>-~G-8_)lSq8Lwn_uA@#BTY#b_Vv6u)MD)%U#d3@g}iJj*aeFJ z8Lg}YX;cIZvJbd@e}2!BMd`U};L>6uqN1UKlmacbe3Qf4qMdUhO+2{#b_!7jY*yUw zw|FdbEX@9&L5f1LI7KZ;8JwRpFf-RT)tf*40ZS7|`904;>KE)DQwyRDdDD) zPlT25Jv((+skbt;XB8@9P8u>ZGoQ#2DAZ)iFtujl;NZw-P$<{De0Wx)mW?A4YAmQc zUb|a2$0(_-J@4ucZf*h7JZru!{R4gdIbb?=K~ZfML@4RxfBgnc*sAB zVXUdbnys&T?ISKK<`P9BzCpS{5fSm2b=6-Dx9~~5BNm)H?Zd|nx%7HMg=#c&ji3RY z3OjBkgF;h<2XZ4|bFr0rO)k7Z<{vNgSl^cG3zO}Yv0=~2cLA9zi@vzh31^;~n{C+^ zEqNP5MTMjY>%}Fnn@O@r#qVNgGiQ;)%vT(jP?#M4W(cGDq3JT~8%8=UvRdv0ShB3> zWQ%v^QmZ^?ic)_rVIn*WKD>T3eSxMqAfc8~L#Haxb;U9cz27bmkGMbOs{;x>>&>t( z&fRiaf{!OyN5z7n417B7o`&PGrYziT{alwEdbd^rGI|K0h3~oE)4#4vC%r~^`rRq9 zh-v$q{Oow3;33n|p0B9=dC8&7lw9;(a}YO5P(e>e&4@N>ZeDYNB9SRd=1&wdBNdnx zQknhwUYVq=R?$KX$6CcyQ?A9~a^m`NeA87_u2lCu7(E65;>BH@t+zjcs!WI5fx5Ib zT>Joupc{jHA_?#3O$R2DgM)*;@$6Q=r`vX)JBFyol z&Y@^d*$F*30NfY`y-W`;ndUpgDFp0B|E?ZjRo(d?dc+ghyxmjht$B%eZhdcyt>d)}iF5|_UP#!u2{aNk>C!!s zRGvYeGE!$kA~0qurKRbZB3%I0uBQyYNVgn6M^FTkL=cqPkleU4!Q$dZyoA)3uhMEz zdw%!bv!l1S<82y-T84(oPN7}#ri<7V5z{$x%AnyYlsSA7xEJ5*M4$oHr63Qy9U}MR z9$WwM5n14Te+cI}C^<<3r!f{b&?Bb>mP8-2F#b$u zJLrNORN)c>IkDu@^Q!kqd#)4vqfU|hgsDL?cWmPzIO(S1ZSSdN?f)s)&{c=k;CG-x z@eN2x^Yh>L$7XR8v$}?*IOtMEGQt7!bQS5SDYa^XeDI|HZ<)co{8hae^;r5H{T9E+ z90NMdDMMIvJdaU*>Fv+LFf0B>J8qqCNrLr1%GhyT@8=_}pn@WQZ42b7vCVPV`!fnQ~vl#mO5fKs5+CVYC zw|ELiQq`vqcpYcA}A`5W}@t*1<$d~t7k-ZAH zq|8=sk)f5UJEZ=hGSx`&TLpRpg_gN-E>kJ>i!SDZerq*vxRfE)tXf#fMHC@9RG+E@ zE*43yC!Qk_+hq|m;*IU6M)32W5c~d~$XIqRa0rB8DnJGwXe(lbzi+kzJI3o)=8+$! z$uy)xKHP@S4TH*qREY94-pK}v8_!dLP6s08QKzf#dSR|MyaH6E(B*#K*k)&8{qReG zGy}PZvb821wq^#Yr#b3}&~J`xkO;|A7|7uBo&{oGa0@kL;@q;_&07#6uC5{;p;C%s z7T+e!gMkM}r72k&oE^E$5br6N9cSG3dFf~47oTHY5-QH8ZRu&xwvjaUiA)~F%lO45 zWh7+e)1JE!iYU*~Y#~_*2{lOd@oFbauo8`L za48#>RPfUll*Z@EuP`m5fQ%5PHT;eHyoeNNi=Ygr} zqm)`{B%SQ;vgx$$F_aL)_0xGjtVnd6ITDh^GSTYxghV_C&RZPkoEG6^z^1ml7C;9) zKkj~;nj1}A5M`NxdGvE1B%Fjgb`$^t$Gg;)Ut;ENPz|kO_+Gj87hN+Rk;q3K=2!J% z@Xrt$pWShWT4xEw5Y-S#q}BiI%oC9h`R)}JZdlV7GG3ttO>|ImBY%y5FPe-5z^{|{ z2100P5(fWFN^VkDs#wfzFk#<56}LTlUMO$@aw$)B&r8*bpZ~u#O`|IVngdbofTm*?_Xl0Q&q^(BDha z9!|i=%Gmu%oe24G3rxHG%QQ_!1R?Xv@!{RfpQ*&GGMa z3w|gOM-&VSF%kE=SZq{OW+SPrV}9F3UfzEuXNEqgsdbyx5u+2ii1=p-a8Xe~L(M+@ zL?ku3I+#U;q{ThEZx0P%@6o67lTo9sKPmbLOHp7(oaV0t!g2BOh_Zkv)1~?H@)9hm zqfkJA>#))?j~ocaL}30AMi>!$7wqoyChYEs8_!;(E(c7uZ{`O;f#M*?@NmUfl)GMZ z{kPAwTWMq$YqnNGBPxp2F;rZAB#>4-3i3H4#}^ zTO;KQ8yuF|4w!DcF#d)~$(bPx222s3+h@;y7J6v$-yG`J%oh7NSI(g&ONn`wqJima z^V+n=2w!Z?4_vN{iCcktCui?w1nWD(A<&C4p3$Zh9YP zHbOfjDxv*^p-*;pcA#<$TC&PVcIk|Sj;^9o-Q=P$ozq`(O}J1`$mgKHXfN^sR)Y1I zVRyFU(2nf{2W%sS5b0o`t^1Mym)H>2W5eX|8seV3rI(JQVhWuL z|M^fJ$JAQchly3AzD^2xkKWTY@D?yw*AwnM^K*-sjPl|9fG)0JvCfq~exUcQbjq47i_e@?w{Uia0aSs(0&V4WG7XIx zP+r`=xfOy2rDQPW%tBPn6}7jqnA6cA0BV)bHtjZ!Rqb)#p^*rlAL_m%8yp-40xK(z zLE>FlM5NC)S)ksEFCQyIN%YIHZjCC>@bUWLo8=DoLYh`*I$6sNDxkUdn&dGqVdQTn zeZWJ}RHRV&(@V_8SEZXA8vySE)#|c*r(LLCjfp5T9>FCg^?Q4L(azFsysP`SvDa?D zw;){TdfK{&GkuNl9zvnDM0Fs)Ho+2nY$oO}-kL zvVX@DTu#B3p@I^QKe8q8fpn|-=AcnaDa3iep(>!UPElo zbP?#2Wj3==Q=8-a@?tex@(!iS$I!wT2L5ES{EQC+1%gQ_-C^@qFp~)#AxWAtyca{o z*GBB&XSFUlxp z`xnjOr`TKZm9ER4ZsrLN4~Mb6*w#|t_rLW>LC}qfMwa}1?!HH4AOqodY5)7FJ?tc+nZvAsrEU=BMI(1rdJvtkf-0xc-XFLHKe{ z(A(Kb%EfgHjDZmJcjvH>o1tpWUBb@IbME)DgPFug=sqQFcmr7)eURU5`YaIsLa*;{ zIVjzsh5wyoToWgGwaGk#r_@{URY!5+a(6U+rj(H1y&|Bk4R`!H021&vs=0Apkw%E+f41gwxu+TW+y_@IO*4BH-;;ybYw@p4!^`k?{ZLWj1A$d+O zo=-=rCMx?^p;9-Q3pGaHPF3ytj}LvcTXvet1R8hk3X1C9B40;n5=^2Wre1_HP)Ra7^Qptd- z+NX;{hEEXs@$NV?IkBJnRQ2R^O4;a^*pKFXhlJ)x1?7Mt+(hLgWvqsd*2h8pi^Apm z>Bc*g`}_Ox@$qs@Ow84mcW3ty5++)g*v668n_V^dSzCTGOV8O=&VIL0M=zTsLm`K@0z#xy74 z>awq-HB$A|6v?$Ar?zT`Im8YRl4Tg9O$A3)u#2y*!?6C|P+ttjd;)}4%}js8a9$I` zLTqn@9KP;X2J{MiFBA~VR~g-u9Dn?9!&naEnjJo=VyX@2pNG}AUWIJQg}rxxP9Z6* zPx1lD5wNMI))B9Ewzh4y&ks>}${zcXK!R8-HT?&(*hY4>_ zVS-8Nh(4TKmh|_cpdFO0^4BWbPq;@)<(|;HgIA`6J{4qs9%GFzh0&q6_`cn=$-h!2^YN55HEgtP6+P~4O5slT zmHA9UE?KGwOT4aksL20Z)~~kV6H&VVG@*=me0(bWSoV6QqT<5`};!(bY) zdsu?q_peo)c*w6|eb&}AQ7Lh-n45hzwyCM<`SCVg;Lz!KVY;Cq37^duxI7>b>zDcl z6;`Z3YKHaOL%2HVFVrSVugL@6wRN0*ZxfptcLZ^+E)R4bV>c%${Py1bE{)};;_&uW zYrQdSY;=W6tzT#SxngnIP(Hd^!-ludGOL^{-gU%|4#`E@`?j0T>t?TjvO!o#?ciBz zW@x`3SuDQlFT8@`6FsY> zq(#+h?9CcepE)hBbXn<}0-%)I+FBqp3+W%RnuTuLPsga&-W)Wrvho6`5OFZ|D#q=} zGN0?w-gNOS0iPh`>}`QyQ%qQD|yvvr9`$ZxSFKsa$s1+1Z?SD@!bVL#EZe z|LlT-oDFXqFdOd36~%$G`3&~WEMxj&wKLWU*|>QPP6CRb8!YS_-8RR(_42wp)vJ`g zBRhO(hvq4qznD@>!;}M6 z2$9#+)Kph5%+H@;@mevyGGI-X!T4*&@)!32wo1AfYOwV9eZBR22%R_zDz5q!ji1NU z@JG7O%Qf}&5(g;j@?O2<`Bk)+(!K;vi)Qz8dPWnlzghy>k^DU}ts$+&CO&R%qtIi7 zZQF(xXDhsabF5Gv*V&Q28=&-&5RsgCEFGUwT{A%iUj)CEYG+zPLjzRDu8t~Oopt5` zBBUhjK!rCHx-o#@XTl99w*LcnGIngzKN#T%UAvQ^C!?d#sin(85{8O5Cq&7J6GpaE z5P5Ul_f$|2`DA&luOsek$`tDo?54}h%jdzCNDHO`g1Uag85hh27!dL356|1-R&C!| z=u(j8*Pv?ojgGh{CU(zZy2S6LscC69FfF$6#{s&?Ej2Ygom!30$JB-^)r6q%a<_?Q zVX>d-_kypt0tTny;b9dO72u;pfn7kv|*mg7<%~%Fh)X3du-BwQy z^D&Y@YQ1+rm;*#8=?_$}aPV@q)xfpA*b&u_o!#Rh5deIAH#UpR$W{_CX=BtnP}x!} z1Y~q(qiM;jD^4n4aHS)FU;2)WKj9AN^5qM{CoJd<4#`+y0P#AFWD3cl2X{!AK0O?k zx3#rROiV$CRDC5;79a3AG6|8CJ2$?=8<3iN{DC$m-t%0Nx)+9@P|V1XFL(&|2*;e{8HMV59tC+=P61B_ zJjoEmR^-K+h7wFGtSuV^V&7u)PeZgef#}1e9zL0Uc|GadL)=g&?S(JiuaW68*5ZdxXYCW)q;gLNt?_w0#Uiuw z->eAS;UKF@3PcKw{zsSF+=8;ncU}j3lNZ?C*yI*lsu)@%u#S%wXG23nfWHg<2jo%$ z0s=xtk33vl^7G7IU^cY$a@zdh11{7S=K zBuva$N)b@TfxQthw*kUqTT?^HY>3%UKfomwb}BF(N+RtGva~5A`!T^$2?TMOz7JoO zhqr*2B`i)ApyQ?Sv^K=qQ!_K3r}H@_B||jhPV*a!B;|#L+@4!Mw*JRNYa#+&T*Y6k zJ+SSe`gv3QbI1rzy-9-l*3Qm@Udxw)@g$8Zt-3UEe<*)plHcRzi%ZKCr$hICuRwi# z@8RK6@{Un!WJ6X>%;P?7zFI8v)7!a=S-pjn6bt<1XrYqvkH5Z{Y;VKgo)*Zr&4f2u z%`%Q_@N3)r*zVz)pr(>df3P}Kg{VVA^rzR_@9!QYR}e&~skz-xGXx+NMZcE1yNxz_ zLSyPT8?9!4b%#K$MT>X!%VnH3Xb%vspSy#)Bb7)G1#yG;S2lP@efw7QcWxD0m*20= z;n`C|W1h0zc|BW9FPZ}6sZG-=5Snyd#m7_FZv zcsjM6-CZvak5J#oDY@GlbHD70d26Y+Zx!y_aT&p(&hNbuB{r;}pk5zWUq!ba&d-^2 zTkcvpn205Sstl~CJyns5I554VqoU!O`q;m|s>_ zmQyMK#H_&88z8*4dn%;16x&UTh4l6<(gYiulcVDauyq5@)WgFA4lZ~FutL1NnhOiw zjA~&6TlU=aI8x%``HdrSadBY4*xB9{^0*+Upa>SvDFQ+*Iyx&0%Y&=^oW%k(-;aiy zn~{+bDTm03gTsS^Qc`lGBmcr8BWp7`WkBK5l>AelkPro&3JI##+V3IY(W`CYlLQ|f zIEig_bwPjN?0i-J`j{CNg&HY2JvKHrHFY%G4qkpbI_am4PF^jo?crYUv9PYDmp3;y z42Aq&ljhX3ghBm#C(?icX3qw(3$S(}1LxgHDkp$w5Q9a42;tuhE|Z>aqc;y7Un-cC z-CN$ABqk{xu4%_ZZ0`v;^5{vNcUJl1t&Bz z!bna1BRt%QHQD=v-Rep!0x9?dm7{mSO&sv)Q=W;5HfjhUYJ)|dQd(O03DPrC5?m8U z6Jruol~e>=E{sh~^5*!u4J*rZT0M79bTE>&L0e{T1|i|$(U6p+rQnDk+-Aj#u(-Lw z!NCEl0q6k#C7k948FK?-*~%PgJ}WE=ioEG!)%8=B=6uTY>qB7LFUZaP`IY=~y*pAy z`s(U>pIuYi+gn|IZqeMkWE1#sqsTy{GaNdVg+IjO5(4rzC_jGu$WBks$%)fl z@d<=r5ONLylw&}@#qU*+pMPn3I8r=keqkZ%bvvC zFWP2A(@EEl9HdrjE;x8u*9PqZwyOIXTui@0^NyoZ27))oQEKJ7q06J}%*^)x;%LCE z)V~>8l`KjIZq`uWKU(zwxU&V$lb)mVXgD^u>I?xd&UfPC;xkiI(y5#>%6viJzx#&! z69%{j$uRYf1y<45Rn%YYN;HB?&qzRI@gv9kyOS(>UiT+kkSnF_GpcJrBK4^KXQ{jhERS_=Mu8Avg+zd zd)L5?K>1^0U)XVF;|(O2>5RAz+=!I74Js1pB$5(6z$cc#r1wI>0Mb)ZQ&Q@3yrj|d zK8nP6pmA{20<8tRn`?g*QFa+hvUDG_^+fL1VIL6hkW;86gP!M<1MUPvOj=DMNlpEA zFm$HyO)GW`TP*XUphU*iha!Aj_b|l!uA-`PpCKTX_qB!a8NmmP+_bh4b0PYXs%T5&?fh70F1iPn8W3+0!{w;|>g)3>{Wv@< zY$1*&vRZEny1{zEcc76%6) zjL(i-MMNPI^7V!%MM{@NLq$!vdbaR|lRqTL`}0SVJ?l(EIwCGk*-&xu^ zq}cXr8s9B1i^4_bF(^KsSLO<}%DM^;CrdntgotQpZb^J<%DzDMdq_$emz(8c{%OkkxOecUxM=_8_&=!yu-l~z z`T5$17ip-($2WpfCMJeP%x(n zEDl71j-sDFeF9v7mXuV19I*@v3UB(z@5y^_Uk8WEm>9*kzMlYxENg44YikSiL(er9 zAaSIMl@&A_1g&0HHz&utyZzgaIoUaCZaUfe@$vC5xJ=@rqH6;>4Zqa=P`g1uS&)c< zjSWMvNHVkUle*U8L<~ly%N{V_KR-RMws>^!UJ^>1@GnM!Dp#b;KaE1VwZ9&KZYU{r zi;)a3fv}8%f`Wid&qUWfo3ZwhXay@$927}VSY!+6uJS^g2-nApv*vTmN=8PY;k^h8 zJM+2)EkiJLClHtw$feF4J@#*_s;cz%^#m=oXlQCm=E;M(0F;}W+8R)#H#asj1$|P0 zfLKO$#Nt>pe&_fbs7^pZ2aiVlJvjK>gMZ$3Sv&#{uq~j#3Fj!DKUJosy$4`!;*Q$$ zlmmDC_VzCz#9wMqP*UpFXO%!E2DesOc6OIBGua10z{deux$?ohQ)+7Jp7|mKCp2MV%=&frUclU{l5>Z;D5K`bGZgY#bNr*K<89uqyEZL4tHlqoX74LkXCWz)hh=i;iz>f>b>#-Nt%Uo@u1vLY4iOLIPd_ zMK8X86$#4QB~~-34>JaEa7^LsJD5UIAV>ckA&}>J2zrZtp3dG{+){S08QCUXV;my< zU-G7wZV#Ek>Sqqs!Z~^^PK{GZPoE_6)(Y>RSLUkIP!Rj659u*VaWOFmEZV%sd#{}8 z)YkKEehI-DIm_H^$e_94w;dg&FGGibIcLH@H6vN&*sQ<&YfPW6HBs@w&fKc;;W1(e zCS*;Qu^gx4Qqx-hyjl&P2T~!p=AmHgsmVeJ$$&9uL{m6oG;925{ZO>^!iH+y7JukT zQ`TK2s;iro5^@Hgi6#aifychMK)Q?b;edR?0gQ$KtXQm!1Rw;G^A|B@L34{C9^C9~bu)9jphvqe$;) z>1f0eD*p}s`8S{T2ef>3{@s0}8?kI46NqDaJN`&>ybsYRf!P%N)1ekNgh3)~js>k3 z1kj%Jq$GDBVq;CVwzTBc(Uyb>cw=m4cDmZ0DUt=EKFrQHdTkgIRy9Hc(H-5~z^MKs zEQ~C60NC9_LqpljMy4hwKXQ{I0kSAa-r1QQl3P%Ki-SXek6&9fV`@eb26%Xo8WAkg zd58#v0fHYteiJ3LS#FB|Erw}5SMi@FmLBJA<_9J)NT8v?L!6wP#Kd~btaHf8$-#uj zA3SHd|L4b#ACjm)zvP1KNFW*r#E%S6<1ngJhx|6;q$ML0`PB#S4@@=R;L%(ij5xWu zxhW~%K!TuaRz!@}I-ne{9?lC(^QfEo!3=x7(fbwxLC?5e;Iv=sV6}Z_o}gsQtM(E= z4)`rS>RDYYy>Iq(M+^l9dEx^-d#FEFU;FsP>HNg`(qpKBzt4SH9iy>K%kFS_(YIZJ z77YYWmQVYb`LZV^C4s92?^onb;w8AZmIW^+6z0WmHB$nHI?#bYhW=S1L&o-vAr*CX zIL-ZkqmhB6numv{WvyH$r?wubs=>soK#F$ut9EI)HW1 z#@d>IH4qG2MMX5}vU+m~VwvgOL8F`JAR7h{dKoJ1=Hq0b7zN@O2B0src(A3*_A^UU zV`*w>Y5geXTHy#4SIW~b93-`jLI zvz5-Uz)tBT?Papg9{%*MMjE{o-?h=-(2A`J!~%a;WbT z^s$H}=+jgF&yNRcj>=)E0>i#7Bx8LuowAgFS@nr=zHw{|iH!t689emVXsf8+e1GGn zCTPMFTbF}?SKTP!FRGgHOLFq{u6BSlmV(h+ixu`B9;)Lat5k2h-RaD^GM?jLF&H{& zreRnoOa1GlqT(NFy~+7;LAe!8vd&Wt7Imc;rMX+=(7guR%ahL%QL6jzII>vbk`Is} zf8|Y}AkfT{uD(#CT=esvTP=#nC{`@HvLBpm_*3LG8Z0iVESl@5*wPzfhDLO;m9xg( zs^8QoVs@c6k6q*qE{4ZOn4&J?DJk1W;3)k|GRkrM>{jGfo^$jbApji$A(btFs+_X< z$8XZ#HYcjC#EkbNB7)y>>x=f16QpZ(wOt}QBOoB)ew7mK(7NFkzNiA5yXgxI^fpS$ zKf-#FUPXvI&fcd5YIl=LoB45<2Sw|l(YGx$gNfZ&NZ58}h)i4jFaAbu*OtUM1sX1g zZgP-R-(u%xDtm=?mF10VXOEEVj6Yx+!3p;mNy|*2*NAyF0OBDqx}a}F5xxERHD-J( z21!f!uiGq-B5k+LEk(d4jUK|#^m?L|YUTaHq>C~vWJyntOBz@&8Rl>yva&}>P-8{f zY!L2?&x;AIkJm4CpW{dTN~?wz1XyTO|EwLUSP?+{S$ndh_Z~r<>7%W;Qjlh zTC2p({%&9}Q#mVUHTm~m=)+8{RehNb-)3Kz5%G{&M?lEF0L&6Z7}rUI0z((YujJFj z_~$kbGpdqh%yBPaqdc8?K7+(mX9Ot!!DdzQLs%1-=9-d2M2Nwxt+V+RHbi(N=TSQE zN{SC-3VCzE*gEl#s;&U#j)tY>0Z<47U0JKyXxnW<^eJ|iaW1ro$tXYdR>4{&+6>l^ zUm_UI$8#h+JUszPJ~%$EkTZ^l{2hEw^*oyWBI}H%u1L`m8t#lhkGJz?zAZ=3PW6@) zZg9t^u{x>gQl=kx5+>wC5hCC7uyS1Ig@i~XG6LSaKrVAY4wocWgAo6G)h%>DQtfm( ziMyhdp5zP8l)7eVT}S+C1B%d=pwpQy^=U_1>K6YR>;z@wwYrYSwo|UBeEzL3??cb; z&&i{5jA`}OJo4Ky=pxjWB@k0-!kgu$RD`VlK~G8SE}Qzv2r6-1*%>mdNr!ocAbF0} z(Dxz;mB+$eyQmo|gkOHK-_3%^iYv&^FMll2o2sq0!)lEPQ5GZ64^Ge^o!&cJQ)31Y z4D)+75$X;dN_13HbdkN6fWzjvjqmIr;V(LoYl1B9*0B4xlex>NaL`yQN6sd?h%>9d z{FqQ#&3p5^nU`h@e9K7r@t%x`jf2ox>)g;h>S{;J*n`j)xPQBd)=>cA zM7-Hr^!=Y}^&okdW=6^&bk7x!{Y-@A{rc@w?;~&>q{R_Pm446pIw(;EjYU!jWS$p| zvsL-+&)(e%-MB2K-&xw7G@f!HC`5p^{&ux@LZxJ0s zY}o|uUP}5jR~P}M_;fi1D-IFA{K1FDA9CP*YbaB{X@Njtcih4YOXn-{^e^K^|O^#&G6R9R3^yi$uGo6BwiJmZ#c`KmGY@|fINGQ~o#*!DKNXGqLJ*cwR`Nv#d zI=2@!lb2zp&5E}X{epPX4&xqb|0=1P)~}Cd++4kyqlZv3=9~}1=;pNbFy`bsv4muW z`agtEKtU1OZa>g_zSJ4Eio@-gR}qUX_uzD=1a`LIe~kQ5DOZK!$0Q&?EhA7n91;n^PaE%`EJHMrpM@v2|n!*qGXADBGCGI@U-H$x53&@PaHv(87E2x zRv`MyIm{zXlA>6_q($w*1U@ZhP^wlX1JOg%r(Ik`1=s*$YfwFj-+k+pXND5^8UrBq z_iC1-u6%sWPk8S|3IUZHPpk4!p_Gh2nX@Nkk7*>+=}lgvc?>+G#;gDomXwwrqQY~l zsI8^=8e=lATB^wb`qIJ>p|G&2gA4SHisC>HIHe7K_cIc9_BfIsZ*dtxx|&E}7i(^8 zF;M^{nVsj&&an~p#6Tx1sch-LPsZy-9}!@qq9lb8AP6xkX4_=h_V|tItqmOk3)UPu zzX5>P2vp4X7u!tQ4QBuj0pKh4J{PCmQlshg8+G|MW_u^!Fp?nG(-n~SS*G0xyn?!K zEr0TUQiUBy6W9jYWLjqhREs@I`Ht5+jsmLJFepIK7^aH)eHW>gQ1^Upjuq5 z;!*w<39{$pG-X+LCwm@B4^cyY(qj%WssVRi z96Lbsu)=$3;}2XuK|zAJ^GcVDDH$_Tr2X3#!wAcZp)h!L8|}9eSGG^#tbG<$dhiDn zzA|}AYYU9j$FyoQ*Bq-=dX5uHxoUY;#=li6x4@;jf3r;bm6eC5QM1+(uu?R7Z7tVA zmy0K{ZO4N9*Q1jY6Rt;dzY-Hcz^?~<vXwOaLyMOYz-k*y3 zqdw0@6wwk~s{ByC+6ldV-|yk&#fGfZ=(r88*MB##Q2XXwLcx6(i`mHg81i=_fG7iI z86X^a5-0Y4umaR7z}ywEdYOj+`LsgakfaDdn)58$2!2|mR1hJ)31XX(mifuQn&t13 zk*(U0rt7><8RcVVBcaNDJ`>qBkS3^2aCLR5xwP{2K8(mJE$&ItzRY1DaQU7L)$>c% zR+hX1`;lRenftd+bpo$ynoymBi7A=n&Jl^j;pK^QeIf4GZH1 z_wZm9=sz%!f={Ujn5FIQE99v`1Q{wKVyDh_JBHjqYrRmY7|40FK_M22Xli*Q9m;o7 zxGJydl7I8VN388l|4Y*e?dxuODO>)i`dw73kHjp>KhMcsMBKW!#l```=B8Kwif<5=9=EtL1gTVS7{m8v@y|KK>5~ z*3l;V8iWwoP-$qsxrXWoewSnmWMqkdTIZI{lCLoz?^;}J{u)c!@*693*lV}`wG6u7 z0X+1;aF}cHa4=nbA82@}N5SvBS*Y-FmM9t|>d=suGLtbzZutbG8WFHi&CeRvsq ziUXRzyF2$%)o^r0+IT?1o}8ShW@v74PNuPTI(?G7nTOAJ8Xg=`lZXtawHh1FKqHWD zpZ?)_BzQhW)_yrs>UNFtH~c2u*><06vzZGk!3xV)#?Q}gejGQo?3q((b0!-4P=_f}V}T&ke2dtDsYa(=kgkkPFHbJCt+Dhi z%*68LX3-Ah2yodhQ73T`I#|c6ehXX*(s^?mF2sD;9RJQWrkyyzu(ClRM_e+`ajC&U zbtcVZ9ysi2ZEQ+u(qdyVefKeRx#aoJv2w;6tmj!%^2Nx0jhjo$%I@%0ijtjQT*Q1K zNA5-l?n1<*1WQiK=F~x}N9kwU0^MQBl9oRzv-1wSn8Oy)KO+(R@f!_~jWdN>7lDH(hupaw&+fi=%kR9*iQlz@hQzTy2Z~)gyGW?{L5^*Fs^PIPx3%H2A3o@HN#iAe^lo+ zT3(`-uWg8d!U)g4+mayOC--aY!Bm+}p?`Dp<5Hv3eLKpVZ?Xl00|TT8*)^UK+Kh>k zdEi-leNkSYjT(A2k-iI1_O+K#c&!llq$tO9#JYIoq)(e-50$CA| zqzxJ{j`^DR3nXCUt_>`h(;{vt%V$6 zGVkvX0gy}^Kj+4wIR{91oK-DWE&cp>bIS0ZknnM{MB{j|_HeP@?j=NN#F(KyM#ppF ze7)jqlp%Wcq#!q+s%&1+XMIY5T?Vk-nI`jeYGqFpiC@TW9}O0x&~YLDN|zx+{2xl= z5HCK{0$m(9H9#R=+}3kC1?rZcPFEMmQ^yS$w|ZWC=9GZ%9T3d`B?fl~@awx-A$iul zHcPm;IWygonog|RF$*2+1hzrW+I@%ZC{pmV7l-LKL!m!EmZz{&^j=u4n+eUjhxHoX zpZ60Z1~!1$en8S)zy*&N)4C)#J=F7{5`2F7xB+zk-t;zrWz0Ja^9v*iiV64qPUlcI$HKMro*=PS4O!Ss2vMLS zv!WOlvI_qIBRtoTU;%*&8vd?ihVkLZn!|Ov4ga%mQ%tho8P_D!YTCb%rCU4*C*HSm zoz{o`_;bvocwXJT2`(lt@s$SGYt1_i@x-+S(}yybLBePhc>gxko`27YT2u5e5C-F( z??$r+Z#ZH7T^R`V5YWnJxBVdKco)O>ZxgAGxZ9uk>fzdLXOkKy#^e6e_w;UneGPD~ zig_dzsR}vc-$JQaO3_P`7CeJ1=Ggeu6N>rDo9$J!^25mP@j{>Pv^n%U88WZ09(L7J z^18*`Embu{-@N>VSVIYPBN*7&9ENxHR#Rr1`7!{&ilvfyKnpv~JM1rC<>@b%a&>e} zVKbBM4Z}|5v>^aYc(tiami%94c4he{0d(OL;Jy!@GV4<0%Ck>liu)@f>NGl`#C|)4I1+M`a^f$z3-z>`^qu#aw9zC zgoDm!m2RuqQ>7Z}U#&G?i&BoNtK{2`oFzww6pnCY9jM=4q==UDWIY*VgmG@>OHHYz zcRAw0FCQLVFMA|uC)5E0X*iERRugi+7!IR5%)i!H&0gw~p(DsZ<EEm?XmdGU{c~LA zRPg-`hn6qhQr#9x3OaGS_w*n9$$X7!-`j`l!}gb()KZc0DzWe~o#vO1?#U*N$;MCb z`vuFDW|b7DRh~>$wz)TIxv9IE0Z|Vkl*vS>{SJ^mp#us^CYAGf&4T9Mh}a5Ai|wYf zg-U!8ByLD0GOB?4U=7&{+QBnt+}Z%@=YW0%v*WL|Q(;XYm(@sMz`9|=V91wM`Vs2- zvEZH!3g(6gQ5jv~J@U)3ZHV3Lk$N(oEB9z>5OvC!;wty(Wekdp*V%-#Xzj8BsS!GU z{;nQl44s_>=7=7tjJ6%2VH4_pMiA8SfYqCjS(j8z&e)&45dWWRNzv%yBe;k4y-L+pRZ;JGx>%)wSK+*(0_<1AjXO75lU-eyUA;GW;;nVV#P4hC^^#T} zIQr-3PjvpMs;1+gE4xTEOEJ7GWlBp-O~^xIflTie<*H!{LRM<2`midm$bvKq?9$_n#z% z>3%SIjDG!R%`#KEV*Iag+F-Z-l)tLWnDyxOxGYk8-b@<3d!m&u>Uha>4BiSX;q%pQ z<%&hfC@9NKCQ_Z(P^Q%$AQ}UkPPL~?0aj)mZ1A+w=EK*`+@sf`2pjboK>_POp)C^= z(@Xc+xQUHf-y6xB+PkLJx>X*g;qTkYK9n=){=%m6X6n)UTyz4iS+!zzmlJnA);syieU!#tibHCua;IC<60+M-Yp^SaZ2*1j9gJDm=- zP{Pdi#MPx-B;jeb|Bvib=%iTb|S`mtO)}Bk)2`JnMywnzJGoL}KOQ|;S9L6LE(+6rOhi%pe zkAhuRtt7s6{#GoSn3$|q{xcMToM4cqqkR-FNo8i1r??NqeX#=nCzXtO(r+ z)C{3aAD2`d&*K8!y}VxUHltNDvga3YZ**{Zl9F(56-xJaF=vF7izKuOsBCH`Dk@_~ zgXngKbXHf6+bgqny_I&lut13Uz$xF9HvSIWgX@cptaub&#caW+Ka^r_|86oot>peSdkn)k zc#lx5Do2{~642@A=au;tAT)u#csQKK^-GMiy*>36J4dQ?dx^#+Kd0-)>kCLuZOf5}et3A`w4Rd(Mg3%Y(3-Ovc{0yw_hVL;dvDSY)Hv*u~{8$8Ot%t}MfRJn9Pf!}_9>9X(;Y+7aY8g~}X z5|#fs0x)F)haZxF%zdym{a~1A_Wk9K50|}u@k}Y7%U%b33wMz3-8#IWX9LKdYj!&s zO63|gXE!u56oUKqj78e-0Px?Rnc0*3Bk4lK@7`6~9IE)pXK)CLv#-pGKi&(6si*HfAqOrUw}4BcUQRa9znIR;Ll zQr&W)4>$=Rz9>W);!lE5sybMnkT78Uv;~1MYtaK*UtPW;KMq<#BpLxOn9l)hrd44g z_zwBaXJg~7!^=aE3Z2NP;kbKaQzYFth%Pe;KC4&shmYbB9hQL{dBzqqEnuUP^jaLM zAKf9SMmauYK*@+g#Crug;yJ8dxTtX)nAex!jRQg+%r4fo@U#!cTyw83`->+()@sj_Z&fbE|tR{xDTjH=$a+&c4P$HG8R;B6p~wxa#^Xb+d!E$I1C^*%qRF_Mo|WP1XMapc#rm#YyV4I&S%Dbr$`te;*fOt@d>t?A zdwaCSEaKR1ZmYlBZWve3x*S~`F`4Y@g{Bg)J2xNHsOuR%I3#GJ*=07#aJ~`_DwoJR z+*PcPX6JZa?fD+gFhp&#vatc~q1t{Odg+qc{peDao<{?J*HiArH`gcgjHS|u7|Yp< zhqJT2&ua9f=H%nVB`dKF@vI8sAJa{;QweQOM~HBSfa`5wUk!7vfpqjC24plT559Ov z#;eh+C{w1?eEGUmSIKYmhcC;HdT|5xxy**%lA3hH6x9+gx3o!B0h~&jBh^JqC=877 zRPEle=3sg2qN0pkt#$3?QV~iyqs;W{rs>w1?YF9-G26|IBK$$$rUd5Zk#Lh33tT1@ zH1lffp4inoOFYtnY3#bzt25+qg!p%9xx|JEM@L7XH<1R(TDP#tW=p4x3;S2eg)1ESJygi#@m~lz7&85S|R2C z-P+os*R1*SpyufoDQ?7!Crb9KwbjSBuNswzcdAtDHuf1Yvnrn?2w;uCsJW^GhB8`} zKYzC!mq?|kG6HFEfY3>`M4j~47cjJgZD3aGqIAiA{Uiqhya9khVsm&5`@R3xIaV!! zc36L^uW{q9j#o!G6E_+Ia62MCSCXJR?~eONg`}SiRqcF(0W?f(A4k7Hz%I@I(dF^9 z|ILKFybmz0uaBdO%&7$+4!*yYCzZdO8N}njRp;r4!H&GhKUB~+`#yWdkbfj2yTIiB z7;8GlwC;D5>U_LXotxV;#BbDz`f|0eB&d}qp40i}3E}`g-`6WGpwg{2#mFJ`i9Zdb zg8X#(Em!Z;%lYfzD2|i&ux`ZN*HYy%YV*ETXPSyi8j%Z17>#%%;YJ0jU)Kpr*z1qm z;4~M6v33a^&A%(sw1nmrF;klw>*DqG@v~C0D+lb_yBeG0DglX6F;V(@^VgNzSP}$Z zt}Y-Lw(dadn3+*M$Jugh0AliWNhSV*&hzgXh zdW?6D5&G{D1oDQUy`O6{c}n|RtcRxS_i(YPmROKkm-1vhH@0RwopM10P5%bMofP+U zdDl*TyT|o9=Py7uhcieK@$0vA4HR3|1KbE-$;GngJo{5m=nHM>&{l zmeWInRHCG4G&>e9|BMoORzrb-g8Y8@#UdC!Q_?0=;{f+bA72i#r#lG)X}Yo&f##k) zU~KgJS|V6&`)o)ObnDX2q;p|8JIT2K#-2U=4NpgfHap`&p1daBK() zq3L!U5Aqu;Bvl-P&e?8unL}q@5Jhn);3{3|k50hh$qsQgU)3eY0LnwyMc8PcHuTWS z`uhIBi(dwKJ0Zlr2#AOlt7YlJBx~GdI*WDO7eBy01v{mM(+Bl37Djlc%MaH;??%Mu z{8vtx4kJ{v-qPh_il*cgkQ7N>=&%ZH-uGM&M4qj_$4xFY0|Tq5ct4q_`5hZul=`E9 zytV7lzan3s`4#NXnwIv|l$kwk+0CQ_GM*O>REm2H&ky0ldN%}Hy-w$wXZ!lzq@LTX zxg+hg|2@1k2Z(v?;VeMc8+Q`*F4VrXpo%HLJlx7jNp*Af0KVu6Io=QpC;RxZRA@1p%?uTv_bSz{t@C>? zI7UkValUM?c!v=&@|$mf-uX}J0rm$gp~3s_n!fo4pnCBBKRE+3pq}1b4t%>DPoQjH z8Nw$_P}uu?z_zOL9nRnHh9bP7M!OFBa_9t z_^tOJjQ!XPg8WreV_sOo#D#rJSU6_lCbq6kDIo_QQi6xX(tpf9vXo}sviU5VS002jvh!aK!<_uicxZxl>IBu>>V`p3ky%GM4lN< zAPItfLgJAzcMD^qGdF&zP5U!Ni%C;W5}EWRts$L3SXk(%iLVMIc`G;UgHM(GGjU8f zABP7_1-*QHeMA0n_QSgyJn9Q3`Ri?b$kRabvs|AuQ4#F=LtH|WC!L(B@^NP-ReDYXseDl)psG zCoZ)A`i#Qm;2@ZYz&=6&kxs=hu5kfYJr~(I8Y2H zv7jM%Cy(Mc*&8comI|V-{j{7q#n|hdQ3@IfX+wAf=4wZEx~>$>O{wOJMj>QG91rFX z6PzPuoV_hImbcIRnBQJz3(e#4s~Pe>o21%`RTgk;;Wgg9_mqZtBqO?3YWSm}alc3Q z;aYcuf6}fk;oEcY=%O5WN{FGp8|(}vD;3BRSs_Ie@o`d6z(GJ55Tj0$@h~aa{|_XP z{?Bu3rVR-mY4&(vW6SXa#e0L`1r`ECbou=owe)7`Gb zh-BGs_C-aiqkgr$3*1-4*1~%$Dl_{ekn~OetLg z6B9ZTVxTwwPy)>7x(8yf|3%Vy2U6MpZ~P{q5D6hOGg;Z$WM_qB%id&VkH_93n+Qcn zvNy>JA!LtZgk%%P_IvmJ`J+FcJaW#t@6Y`n*Y&zAh!Onuk9y5|rP`3brS^%Flj%u1 z7^B}mPQ}K;!n%4Dl9GwAc30K)Z$#KvH>fK{D!6SN?LG=8R3n!V7ZR#tbh83eoR^+M zrgka(e?-!l|IKSiT)n3LfrmtqnUR^(u;!y`sUD;)Bq}JGNA81w5YD{GJc~Yv3%h<5 zGl;HhG;o)nB$VwDLKmX_Ne^(yd;2r>U@~EPLQ$&SXx@_;mCOc9UUd_*V4`9xwIa)h zD=Q?9%owt7#9ddw)@Iffb1cmG>$SJ24p24$(yAS&!bp7W@(vua;P3q?+N#5T;ljrx zE`A~H=^39bb_El2PX7oxoNK$gW?gX{^it(I>^_HErLgV<%;lWE(1QoN!^?gBFo^&8 z;fdnkpV12o>AJeNy5gU)&h58!S#yVkhu?Q_@PXD&Iwiy`JJBiCap~u4*GE9fO>On_mSvCOGXneu(*&g7$=QWN&(y!76N6@S}&dvP$sGS4P=X0ag)o% zQ(CAjz})zXBud;5D`>HHwK6TO@8(VD=lsgvB41{G(4P!j#T_?v2npkfZ3~u6O!#eo zewI`JX?t);EduE45x5T%Kj2HVf~}7|*|ztc;`S(R2sEhS7;m2qW^1eBA7kaR+QJNF-p_tN{y`FEa)U;c^=9;RwS%3CnqHH6*qtdx`*m(gOf{><>C?_$a$e|JA~OMZao z>sXR8)(g^heBerXolxtjlFipM+P}F^Q1F=@F7m%H zL)F*xgrfzBA?isUJ;rf4E=w!@At51Pwt>GvU7Q2H1ST^2HGnsBG2ab;vbP6oq6cOt zZn-<>Hum7l^gipjhJzD+j&sA)+gn)VwkunygUCzh5d>LTzh&I!Wl=mXrvk8&8--1mYYmV~iA_LBMTn=#N}}|B7;0w|vwU^dUoKv` zUmeJY-OlA`r2}5w-=w`G~ilhRC!STIXE}~`&Bx3o@3veSGKz&OUy@`Eg1}P zbFi>f)Y6iSrR{#uRA!~f_z*+N=gB9*c+4u;bN+M&o^WB8sfH#)T{b9|Q$QVhK$Ew6g z43TyT3XDX!GN$E$dG-zt#x1^U%WF1PPC1E*Fvx-W&Embs6$EIS=xx;a9enRMoGgOl z)_gEfj_!nSfM2@D+*DVamE-HDU?2o>D z^dU6jzT~&=Jl1Ci(~n;1*mLeQ4zge)C%$wyJ&yJYEGfFUTh~J&udxXXzeCpVSfda+ z1z0#k4*h?U5I!Pv_oft)(t93${?Xa~{?1OO2lo_9hU}+X{2=&QJ1!9L-`jJIRzKDc zy!})iKlPaNP~uxw>K2atE8i!Td1Dk9O)0|iK0xyq@@mqaEK-KOuXoucxGj(#))4lywCDkE^|Q>3T+9B$YQ z<%Ra0&PCtEdQxfGPswi!7d@VeK6?tJ-NDL!mCL9@)JHDy-F%s4g$_Gz?wKXvm+#`H zSag~`z}z`JeCg)GwzT^1Yje}V&aO}YpTAU$V-r+7z^@?q7*XW&zpqRP3ZAqV$b=7D zLt_}uE}$zivaq~nyhnVUB0~;$S*>pVPFx{ z*$5L83#!?Ji-)J;QTPoelHd0p;s$Z2E91B8XjZ)SgXK%I|Bu$Pck>K7Qk<##Tjj9% z1+=d*;g1Tc)Z~OV`d@$kC_N!jOg!WL{Jb1Q(3>;O`nl>!_n!@nw6{Zq*&qtl*9{NR z&kACX*pl}&!?NCFot>QpW%AuS>R1tqTM~+u11sD5pFh3pxKc!+a$O@Tk}6id+1wrBrrAg8NIFyZaKRhPbTm1$iGAH9m6PD(^(0VHdGdRHEo~YWC{y5wG*&G4J}uI#2CYcaXusC) z2abG{k3BYcO*=?)xp3-@ z2{Bx1TpXSL0L{(N&@MF->GjS*iF2*tWH8+eVE(5vS+UJIS*w=Q;&1ks0*ckmO;mM(?p?CMtOxnzWg>u>cwp9*Ng{k&Xdx!I+X7k?q1VKE7MBVAr&MRu}yN`5vm zF=~X5vL8YUN+SzJ11@~KT4^}`i6Q3(0SI(PyZRIt(f*UJQG_k~1pFW6Jb$wW zznrtpD!M6~kX8uQYy7?#e$OGJH}CKLUMo<-UxHlE9bZr7GTvHS9<6)Apszpekp$QDO+auv zp;|z~SnW7k%t+=)AM$c*Dmgpl(7nC^rdj2_xCgToEO*cqoP8A zPO&lBh%UhJV~SP7`yN-Qb+nW}qmAq{LyTEKaAm;u9^&c`YLaFn(aKLCWiR9E{{ zj-AXHCP^bJ{V?6&nzMLy^&up40-g?zEni<>qntqfohMo8>Gk%hmISD?skJ;koVF4dkcl>9>*w*-aK&!Gl4vd*PKn2T8>hIsyD!fIbe_+}@R%F=NFNjJ~=bZ&! zhN9L_@M#*()pjKotSxoNGlaC9A5N<&sVm*C))RyGBxp#tTxSN>Sa8^1^dTxx;NUUW zF)6x0&%|#x_V?i6Tr!~W1CGqug^!EIum{TDE*8i6@5F=Vp@~9|ZQ@=ta$4Get*@a* zVm>X;)IA9o!8C5z;C3(4ha6FsTUua{_dP%RcoST#m9U($eOgijz6?g++LG~4oh*#_ z6rvLud)@K0YJJ~+OFR!$*1O9qqd7ACRWgXvBPs>RqlT<3sPt zYdL^VNVqDr)g1bCa`OBHZ48N{*Pe!1OhU{k^aJC)UnK@J$IAjPp;1iy@EzV0xmXG_ z3tpf@t{%v;297bTp1Ge37Z496{hIKEb zN=C`HZEP~c;f_{S9cYz!dh?7V*r?UNJ#3pr*%SShBfF!c10FcnLceMjs_kdyl5(+k zQv-a_KAp!n;QYYH491C0Gj&7eJk81~Vty;iilTDaa`MJNuY-$uj0D`yZdzJN%FOT_ zKgH>&oQoZ@J_9S<69ze*5oMdAqDJ%{ZbhNfd9C7-WpA?^C}<>=N+)Dw6a!#P zk0VDtc(7wX{z+g@l^uEu(gih1-uDhbB@OjE=iGlM5WT9F^H8%~IuyVhAQm37?I*+Q zT-@3^_u^**Zl8yU@k7^GOc)RvF@2+IvSKf!`Lh|VY{ zn342zP=N`Af49`i*ZRXU<3|6Jg8(-Pvn z?lEUeW`pph4|SPqC|9@_K-UbEI5Qg`94u*84zY9a?fg4v`Br}Y+DZTM-O|;_C>uT> z@_+Ru9SNqiuK-=#64c%@ccEb?j_k1JBgXod{-taTYDu~X@a}=^=V=#?*jB^O%O6TpDVS*z6~6;pQJ!>sdPb7#{FD$(zP!J? zqZkP?3k4|kph3_n(vlPN(<@aXt?c}Y+S#10t!1X^K;=O*wtMXwsGQ%9@7w%<+SjN| z@b>{_Y?z5|<>dG6sISghI_xX^c0^chCI8-w%2<%MB`83n2A2hsX?b*sosv?NQQ0%L zy}%m^PU^k~ED?4vsT$U-gg$f#ny>f%n*9`Kp>_dA^S3kH`) zO+-`y(<6TrSAaiEhww3A*9|0GmJ4?~XljLT3?zNU9*pttkz@Bjfw0DKu6 z(;6F#{>Qc&i*6I(i6Rqi5=sWJj!ceVZG?1Y;@se1Kl2Yj9x1@*10zp0$5 zx>?i~OBji+H#awdR}x|%&VBvh4=_{;{gd+C=jG)W69aL&f3r8R+_YOB4Xq!@!NtV~ zpK&Xs%7bDD8es3>|15MnoR90*E^eMPD<(1?p8x{{%C(c@lM`T!9v{~?HtsV6K~4oy zk`d{SP$dX}IcR348~2E+`!oC5 z2(z!nUarD$-}Ln8Xmw0$YYu$1ww6k_Ns#hXR1A*{Yb3sgC8(0M)7wD}P4fPNM_gft zpPp{8v`{oOOQmi{xqaIrDD)w`4D${zXgV#(vzd|}5iS+Df4>hH%6Ai>fyh-?NHA{; zvHv$n{Td2_Yj~$X1^IMpO8bMl6mu#bYj3an^|7NHXT@02oqIg|Pfg6sw&&^I!fpKx zC3+Qad$x8PhAEt!oKVre_*{!V+;#SFWl+?B`;IZubTaO>1v&H^*24Plc{2M!i4FfG zBhf38r>w!hAmDf0VSe|A>uU}f93?3@c!P1Ag{0KF8v6vZIU=!T-Dm!~? zVSzqH0s0`>Cz$`eeT$XZzXBBmIGXqS%?q{uRn~I3|JrG?+vA6VWYM7oHqo7l+1Z@Q zO4L-;R~hdSMH;DvdK`UAh={<2S;lozHX)IRUQmH}da9E!5l1tb?iNA|nM5+DQ%duL5pQoC>-lI<)PY#ZLJTN3Io1AvAZ_f>0rJ!z^YIdVTAiQ9DRKChc z)L!|j6|G63=LxxmxWN9CLa+Z2BqM}Dg1u#a%p7ZKt|iao^{J+s;z&<)X!P z^(jRs#@6Q^8-DFox^~)lUi5$=B!oe2q$_-hi^06-me7D_xy=ub5TZ99K30${i~Y50 zBA|D(TYg)*W-Zs6yDI3&+rcsG}NK_e966b`l{&E3de^bL{;SvdA$1BaVT{Qux1R<{vupeB_de#A?oI(Q-+rP zY2xdJ>8uAkX@(v*rI$AwC{TZ0BTNIf1KWIy<~^hMUrk{B{|0K`*y<6Aj4RqRBIwU~ zjV}(~34eD6W(5D^l8Y~w=Y9-Br(rKrQVdy;FHr+;*i>|`AgE`>3D|Fk$x)uR|C!q- zu)X$k{E5C5=2yEwhMZ}&4&dFA?CP@V&biI@(y!^r!AeN1TJ!7lU`}J<(uqicG_7}p zPYXvtoOUUvkzI6`q1XQHE}hjc#&a*V<}NyeP6N7zehIC|}pa-FQz!H7oL0@oO{7u5n8NcbA!&U`sDr#8eU$j*JBPVbE;^ys2pWEkguk zTP&%pZ@%uD_M7jfJnX0YX!hg1s3V#yUmMnSQ-5)q-}^yxm~I&;GV=1B-9j%~K9&#Y zJHIy1If;?LEhd*MfdosfLBIQ0Ob50UgX2_EFd4P)MhM(O?^t=*A58ZasaVHd2^`@P zonb;gapcjMpFJJr_9-$q3wnZPTc*?dsc-`s3|QaCcXPS)LXe18|J`eyTIJxb+LlDf zDStBG{_>3&3vDaG>sjt{nEZ@@eV97&vH2N2dw10ImgkAxzD(eiB?H9e{haHODZ0l0 zzSaaA2~TZT8S@JMnjjVucjKdvF5Y92(In`~^%eV2V+R=r@nTzYA|lc6`-PCV?ufM_ z!#$*pG%|}LJ+K1d5w17yQ^sX2Ld)|5BU)ct?sGs_1`KO+jKw6ktB=l-i9_t z;H`_5F~wey`ZdJ0v7BX1z+yH+3|6a$aC8Cd&c5*OBxBh?QCg9 zSav-wXy%vaxUk9<@4=aw+5GM)Kf~e^>YShGbob=T?`BmIqj!{%5ChIDNOTWtqJnO8 zI!WYz7Jr#}>7*SQ`T|I8hVOK^P+&a&nfcD;8bbcP3YT1ook=KzJ_Hj}*;@=xItqzY zHXmD~SRC!a0HLog=j#jt?*!!my%@_3hO5#=I#@_V`R{%{49Q4FVtR`oYY#Q78GH^j z#-9IRz>42+us0z8$IcgdpJnJd-r zG6(Yh#=n~$8;FH`CMO_EA=U`dVKeQ=z7>pMxzv;EMF02R{BBe^Io4f@Me^Vw@?!_zquFWvr4}Uk>BHCO7ffe*Dx!zSYA+yc0mgnXBip%eOdhr%Xt*jA zXF^_YAP%DvQ$@@Fj@6(JhcUdj_-q;I1_amtnZ!;sg4?*wzrBK`)nfVJ?M{$HfD8zk zhbGms^7!DY3!lofVy&L>@n?l2Fw7k2?HozF6atHmkl#s_4trcw6j&F%{hB%ZDu7%D zt)C1ofF#dPn_k23ea#<$W>I;N{`TZWtstiJWIbgfqCuxI_3h~JIe7u7ivV#2Q+XSR ztrDPKq5f#tsQq3;EZ{=)-o3T$LK3OpdoC0==w&7*@9*ar!uLXdfP<{>gI$73?bs6r zOj&s!fQgS86huWC(?aE(>*^q%VnGr1U#p%G9T9jXB}+zu;+CSWE&n~W4LV>*V}y~o zuDUwUH%gcy7(HxApZxmbE)gyvlqW13N;i$L`xgbzq}vjv=`8VdT^0`!(3IaG>qQi^lV=Jvaw~Z{us48-R4ZS zy0sNo8t!$+cj`-kBMoz$fA+O`fe)_g&zHX#OjGV>inv}iAQhj|kj|7`^z7{p9_))I zii(K%7VwTPu7+d$Z4|F;c^B`^+GK$ME*_X&mS`53%e|zP zlV{^s@Y9#Y+eSr&q=~%vF|h)|?H|U$u!sTyhru1YUaNR;yBx3P+>7$QI6IbjGaB%v z!X73&unmAA&4(xXpJ%zZEw*OrL8`jE43mRK_2JB`rFvp7)->souKLiJT6m%4LfKlLQKd@wKLPwzIB_PL*S*KpD~K-TJSw$-875&Y~YdQf4q0U@~b>r9VOWJ>r{KW{dzpketAt%`I3zWpe+xLD1+9o1gbDM~f*$SdmjFPevT^kAcR z)@9H;q?T!vK)=>OrBTq9^4$ctI06M-r?gk@gF*mtZmyKq1>gh)? zC8+zp4cxnYF|Tl6;K2$;o77}s+FB~tEBEd#&stPEm+@u33?cH|8I#W31PQFBN46jK zw~BebJyw(OZ&=$LKj*Y)IyU%hYuy25tf zlNZOSv{O8sno6UwgquyBcbz81J@*~$@6If@J>QC7{+%-&Zj? z>aA?=q1dnf>0Xh;M7a(mkb`N+Wd&DYegto;KwO0V`1T#QW(onPo0m`3l$ladckzNfJ<7{!lH;E0KQexW#YTlipE5J=Cw6w$ zG?q8?sC(h~)GNuS^msqBs+|Jdo6Z|*B!}NgV@Ya|BnJ13+l(~Ww2KOEv#KaIna7YqH=^FE3K(OuJjhF`f8n}^Z2U%yc;Y+tYjM3z|G z#!x;EvU3CHQ-u|&XgR@tndj;oCcx3V3sWFOkurU$Wf8Hl&FFhg?Fplm7*bEF!mTC- zMn+pJ3{_dvE*1|0=*0J|nQOQY)wwT8yW#^%>*_qWW{yFQlFzDCG76T622V~G;W}F% z2{X7CE~16r48YbM*v^^#av5Z$#+P0YAH9;3 z4C=M)=j$2fiWKK}`TQw&XSgHw$>)1-FKjBAyPey^syr_dn-T4bf>KsN{(J5BvvM4FKJU&hu$wrxBa%56rO)!ckQeTkB7MWT&GK(V zXtKTT1-mX3e>}I|_$bCg=unUBw9l*%s%IxU%@j~IrDp7W{IHvKRL5($>=7FyFe-C- z2W1XV;Q#)UYCW$xO@3wsHIE-;A<|Y%_K^185DRKW(H^zchD?bC{E7IOO~BhIL#lko zYc|?>0)R8MZH0tcRa-Q^CzumN!aM%0o0sbmL?J`3==>Iad-0I#BgvQ7a)ZQ56zV~4#esYeE= zjx&U43kF!o%)TW|EXAeoC|}G*(RciH(ahbuMQb4Q&1j~s`!;Sa!+LmKV~?DZLV(@y zK5j0*T_GCrwCVQ`Q6C#0>9{_08emQz66PLzs6O1f`oJ(F%)3reHCeYr-wdF&Fy<~| z(yX+2-=OyFoxncl35st$nX#qi@p7Ytr0+-&+a-!H3g&rc|w*IqKcEQHuhmyCq z3N6`tn4XH^J4|%4A$wCAcXGekjEp{Hz}|QF8TP@>b|i3(@>gF~CGC5n}^d)Og$b>-KmH5M@|;hG&x=^9^)UyZmF`o)>o z!|^w7MG{d?dk{%m8${FKS`cJaQ`1+~jL_ZbwG&!k2_cep?!TSW)Ja0sO#q3D?O}t? zC12*VDhMOPFC&&U#m`;8iii(!eahY$ntZZf+(LXm36V^=i&Rdi5Fi@WBnX=W&s9Y7 z)vRg2S~z;p=8|&6a^nMfP*vR_Mg41$jDpOS694g-ZTu!~^Fdzr<*SHNa(oZAY3OIR z@wO?d zhrAFe5wqwKB@zGo`07=J?xpJ$B#H=Q!mFfOTA#` zXZ-r?996$vh#JYTWfo{rBYNU^{UyYQs}6u!6=sJW@MnwmxAa+toxfiIgYR&u^F z6kec;?N|Sc%!jXp#Q&oBm7pcaMkl?%B+Dev5>EXqFc@2zL+Mf(C5LnQG)4!;w z?{3K0CqMAd!_peouq4w^wXEdQFlKWMr{J6%Bgl@jk+au}w_H|&8Io(9e&nmWnHL>1 zb^kTw8D5@Yt+H2Y&Rs7q=-qfB#H^ZSU9D$Zv&>2o<$*HX+}@7Y@6?|#TvD|v zJdG|74@qk!W1Z#Cn_!AL_6iZp9o6D8^Ic&|=c^_(MC`2b zcT^^{RvbPE`PlAwl_p<7l(4qUhkKVw`^nZb=-p-GvM8qG?QtuSH|RKSJEHy4*b zubgV^4Ig;>?Eb~3adgB*0yPqlcOAmpKcte-Lk0Ux?T@!AZT>MuMDP$e%#ne5?xukrPzLhzd z{rF4SpUICR?&2D>PCRN8m0pit-jpW2h{Xxv-};D!`)M2#v36H~#kM$o??TGm_Xc?| z|4{iBAM#~zO};xc^yEDhfMsmSJlL>S>x~Da?#SM9w`WsVa8R=FA<|6 zUo)#3FK%g|wcURaqlN!-L6k-d5^_FHC(Y;{h(C1jE-cks6F2?d^aLxAxgt3c`_BLl10BHvnLd5u=Bh50s;ylHLH?xCC zui;J7k7OqKCeRRX;m3bzGjfu>rzgLG^UUdbe+8?@6Z5BGEcaBjN-56v!jtoH243|! z6Hi*bEHaq)?DmnAbem&7({g8?O~gNjiPDY zpoHvMqTGOuS4kVUZ6jIpRP9FWeG)hxpH%)oT_bzd>*4{62@`G*qauhOAdM5`#sRKH zf-Ft(c4Y943IAFekWgrgeaD5R?cciV5RnQx?ZJIgQc^h5K{}T6&~@dJ@#ew9*=PNz z#Z8JpyMG7plbs%xoTSv$E0PfX1RL<|EZsYxQ9JlE%1e&F-LyY2?bNE0NO&uTm%NXd z^Ud#B3#?DSt+1(*{9Gnm{2+wnp%f8|YL8(u%W zXzp}MpHNt+UmYOK#>Ot#9H+p;$@vKw4KQV^ncjr<^}nrhoy_fZ(xVr%O!#CZF(toN zS1Z}=YNz{pd#z8#gl&a4_xWef4_?kme94?2aNib4ZG2s@lV#eM)7XT3+BAHy)f`-F z)M?^>oR2cLS0GJJSCIDomH#j&r?0?Kyu-$BXD#e1i8S(Ua1fYjl zxpwWL+i!KKxM_b2pgbERCw15$P`snNF!xnYFS%y4e1EjaT!-jBL3R2 zx0=7{tAF1-X~=(ChiCC_c$2(k4)^$`=Xj13ZUwq!r&m}I!rXs4pdSBH%$JWr5F;`l z-|f@JR8D#+|Go!UQb{Q(AaEB1VWgDPYx#&gXGapMM{PfOU`5Obzg4eDE7m(l)2Mk} zRn9yl&|*U5;H7U%#-#OTM<{wNMB(R9Lc#<0D>^GQCX`jr`)oTh#iLSDyLOGUs!x)J ztbKn>`+EJ}prOV_$*#W|vW74Y5Ek3o*c7!r{}So*IXuWqp|`J3F|lfTyZj1S3C)R( zW-OoM5*F{{xr$pi=zc!$!nW(_^iwUf@MsKF$jbJmZ&vvc)Y*4O7Kd!p*JDTibStet z#PyrEkA{UrD@RM;bhrsfE52Lq2hUkv8gZf892SlNvULXiCdd@>SWW&AbUVLnY=%#L zPz*go-7J6)ot}qmsWw9hBXQ50R_4H$v=yiQhXt;8teg}XoNi$#6&;^l&C#5mTPL1= zh55=SO#WzY#o$$9KB_bgA|R@UX5)>_u3)2|3a5*lT&JF!l_ut1e*LboCCQqS{++t$ zPWCES6LGTFfyRNFi;D}mQ(S>iNk~YTVsZceeb|4)pSmeei?qO{zrWJo=(2p>k^bL9 z41pW%U!-4=mdD0{koBO%%YL5K%L$uBxrDR=-1Ly3uu{Fg`=7E0!MUC7%*bM(?(S(u z5}|;g8#Ws{&o1yNW`tge`yS?{F=GUpMOvyzt7fT~$YA6e@gePZQ1a+cJkx5T zU|!R=8;^xOA53jFG}e+p9EWq3(tGb8(@6^EllAu!7GgsJAPaYMu37)RMlzu17#R^n z){t=H1ywkaE!YWCQ^&#V0c*RVYP)AMs_?lwN2aBb7mloLZx2?~cFWuEOH93G{8Bpb zt>aw?C^ySCfB)xs(e8orL61(Xv&~lxc)AXNM#qxNKnjDzc&2<4Gg7*hqjtLZX_qtvaD6%{ z1bBEpKc@cBB40PMQ5AN0L$wp6A z9}dP{4y({#kwoa8?9jH%Sow#h)4l5Gf5bsL`Q5Q)uELOZ^WBF4BVO5@L%Yu@=$*qB z{YN0D2EPIG>mry=5PD}CH#N2@CBx0gLKY3E5y*Vr65tJGRBSfN$;z4mmq=Obh4w^LDfd`lYFPYCY-ubF4|BM0yt`e6y=1&J z-fC;T%<3|iOw0Q%@3XRgxK5(W9w+_?=Wrc#mg6bQDFLGVrP}&>dc|67 zAlQ$e?g@}p7eD#SiqK`BpT)Byk~fyDy735|reAai-}bP1x;HP8E3&JY@T09pdmyv* zd3&vmhgj9G)B(J$G>Vv0bG4b*x({HFbL0AT%s>!XCNg>rN@*^B4WfBt)GYsp_iIXh zt;uUCBDZ*M9NoX?G0cYJfit6#^i0KRKe#K;kjrNcqUqbM-_`mo?$>bo zp1--*Iqs%=r{~+lfejJ0my*O~IB(|MyyW9UQAvZ7XgOr(HRV;mbcd-{I^kQx4BMVn zGHlWwXIHZ=j#+9Pp%bYCg?M!5Fv#ZN+MAg%XxnT(S4h`maHHBPCad~6V%WQj&giAr z{?LJ(ofr7vKGX$eCTPlK5*gdM;i>IccgLK(Q0s1)|0J7KuFUXdwIk!Wr*4&7WnVzI zOjY^A_((_3=K`7imX*#_&vbP`9%y*kIZ~*aY+H>M$EJU``*&lwo>x1Zl8hwfAD9ge z+yn1s2rZ6}R|Acm!mr`V)_IOHEE>}9Z!|yWmEN5Ho4T!X>^ZRKP?>W_&>@CvVbW?P z!L^&yNYS%IO=$8c)DTB$4(s`Fz}9Zp4RqGKA)E?v$MN0g3z3)Z*Qx5oYJ2K$U*H@6 z?aAOc&^pVC7YOOKMy!Pv=LP;$Ga{ewv58q&O6< z|LmFJ?;RA5yzSF|)Tz71bZJdCMSxR0^^6L77415hCVU!6R*Jg4GdhoAJg+Vk@J;O= zO%T=f`vOC_3vkhaFC!r#fq;^am5ZxZuQc8xD%F4!WKpYLa}a#(?F|lwgIt!dk4B&Q zne)FM`g_pnBR&VSX*#N`QqQbEkWtsm_^ceH+t z9xl3)f9l8QKSMKp>|{)S^dLe^0l~GW+@BMqJ?D0axao4^)jsE^Y*wW^2%;(P*DT>* zMxyK&=3j%R?kwkt(5bcCPVZ=r?weDNo=vOzSY=ZvTrquJ+2E3kjRi$y)i>q z*R6|%yycC!y6Ax8sYA4mElW&_7m6M4a&4o9IVaBW$6kNP_W{2@H)%|x1WQr7^{W=! z+bT8X#Ih>7W47fTo!yn9YBxhBP0Q2ze{*ulfIBw`7Z=}tGOu&fRV|E=b`F|#I4RFz zOU9?-R6Dx5N2cv6a=FJ(i zq_WJekr+OYqZYqIF^vSH&Dv2{u=w#sSy|na$8*>{bN6wO8Wj<}L*3hD>$itlMKL7v z{wy6~J?{y1uuCaTN08HJ9`;R39e2W8Xi@_6Ozpeb-fm^*kUEy#WaNJNJPWJs;eX|t zf{XH47!f!xCO%MBZ(Ll#8ORcwu5(^O0s<207)^JnbM7SQWTmE}(Wrp#t}X$mv5mOY zVQW6F)-xXDx0~?m9=F2sU-DQ|L?H9bANu*tZM4N~{laObOS`|}*#UpC9aF_q-$r+l zip=Y?`W${+2NAV3$(}{UC-TyZbvSw`1O6NR6&tf!F?6^KV>^_;;f*ZSueCHcXHD(} zPp`i4CW!4|u?vhcFcp9rS&$qb^v{jm@8i#QDF6H-B*{AQ^8SWgLqsLKt|0h1m6*s> zj9)PJkg*60htbJWc9IxRpr8k%U#rWp#-O$Y=N1N%&_>Y6msp!IUqrBdqrr9CQT!{z zpQX_8QAVH33}emwB3HW~G4&Fp1_l>f#h?9GL&aQt2Irdp%vu<@t=EhBWjmE`M_V|Z z{>`bRlUqYAP#59P2oKn<-@{Nuo5Y?W&)bv4In>`KVt)|%7^|V7X=y>e@@*);J?sWZ zfUAEfHihf&qG3yPgUWimrc{}^5p5A_@`j~eEb;@+PPRFZMZFY@jvTJ&<*g)(&ZXNi z=cqgPts^b91POFBDmsWQ__+Xjpj$eIbN#JW zmuq{=uy;Q_HAEft_R#k<@hP4Cbr^|69AnQaKDa3+#qZs?K;`k96*gDQpjgadv7lYT zFD~9x%{H ze^Wo`y1>V>(5YAJy0S3|hLy<9#Z#JeP!zmMn_v^DX;@z{zlkjV;BDF7?yX1R1;kK` z97c1sSWi{0fw(v{?wX=YVU7RfVzfIJ1|yU9w~IAyNT>p#V~TDIb2&cJ9GWZ-I*IoRpBLtPLb6GujE0esW4TW8bP2DnGOF?ZUu;4g)nniHpbak66?EYV5>esffp4v=< zch_%@s}BP>3AXvsB@csFw(sAUIGKy^TCeS=ypT1uSSWL9s`uW%?2=(IQm$QnbGoZF zW=2F3@&jxL;B_annEfDTm2YytVsJCg{s${_$LrR5B@GP?>kM(1U*B4}I#y~|o{kM{ z8qT6G5-Q}+vmk?|O6vT?-ye;t8((smuwp~Q8loCJg3 zYi5-!)m7?vs9oV+`v^Gx9`g(_pTi}Nvv0=gT5ioQn;rsmJ_H*)yJ$|Q@hd@$og|19 zG2LQm&Dx#RDyMH}yU%))6g3C8Pfyf44_r|f58X`*y>Dw=9*Okp^yBfD{2VuC+fw(; zZ?~pAU3$BE+Oo4S;4yBDo$by!(c=95&aF7V^V>FpT&Mp1c20vrXFfB=`j?`OR_DFJ zx5Y13e#BhW?OTaAuHkRiU9x_nex9(&Kok6y8~@Qr)yP^?QQ@QEhb*nMKmFbvayrYG zj4BbyxW}(7)TQ{YZ7q>$=S}9}H0V7`=0e!h`4Qyf`!(TJ1_vwlJ~&Bgp4xxBfBpuv zOQ8J_DAmU~I=#fX+Sw-bYi~V4J5q+nX-*UXq-$%F(2*M(8;7^IIcISj|7SuDv^rR< zo*o~A5eFWEjrH|n19`??=zR@WkPg-FZjTdAq;&9=n>P_68qPlkuzXCu`X|fX!1}C; zd{}zg>gp}m5Ggeq>M*q7)AK;WqOicWzE`aUG6U%8Y!KYSQ}(T8pL0?lPno579^~y& zce%r6CNlr)wo~g*A|%iqp`!`J!W3db25(Z`UgHW_N(C>3;p0>DoyVoFgeyV*k5QsX zl9O*o7`;=+7tch-hjERH>bS!?NxE7KbX$vp!c;e+^6YEEQQ3!QDY{j8L;UZ#5Ry$j zdbIkdnQXlVyW!f~e-ZAwQS%$WsC~k(NCrQ5LQ{leJik1G3#%p7>FA&-s)wUe;c z&u*UykqE9g$A{nR@vKyhN#-(C?Y?(KiXn*P!SRQbma@&@uN`=+g9VeD*@D=qGs3?9 zA9L2ehT^@S^`PRn%n=D_XIq;pS~snEp! zsPerFls+1f3^plKJ$jw4dsM$1Y`Qe)|0X47;0VReV~OfJPw{QElJ8B4#NhhAXhg8l zd^CSSDn|34R6MN&IA3^^@!HejAxBUDU)~3>wgd1Fg#E>3GmO6k^D%Q`UwurL@}OG8 zK*|-s=(Iy;+P(&=OpGhoxa*lTB92nAB}NUgnPJG8 zriV%Cl=eA?@}sv;#U1o7c|S0Yg*+vg?%<0=0w*R!%>8#F>~H!k#f+8e83q_wP&y%q zjdC3c0$EE*H$fi$MCI~$R<2YJFW^Xa4DC~uQqRdsB703WYCR)}2t3(T-Lw4V6X#qe z3#9(Y+Z$T9o-Zk<1lj2}&lz*#LZvB_%~0>`jL1$b9mOt>+kpSn24y^2bhU_t(Mv;eY0ty-ER&7wuQcEVenk z-~Ady`BYq~Sa4+y${uz(R!-eS28BztMT)hHsJibZD}|XPDJ?&`5W4xW^5ABWwK?G) zN7zoS2-A3^4doNGEY6o_K4FBDb2Xu$JL0*6PU0wINF+KRll~&J);j@WOF_rKZLuQi zoZF`qwQjyLt8?uE_E(WCYK$*CDGM@g0TQ8UvWRG3dp=PT*eaipEU&HIbGz6s|BX!# z9BQWgAt-n^U!Ht8h*w?mu{*2G(3<1iY6sd;&0V`HBj9RU#_kfU--TvOe9W!K25;TV2m!ZP^M%9XsGCC?cHaS`E&44vuN>b7{ zbDrEQ-?)|GsS44MuUd_ME5NV#Vbm6UJ770|FP#9{phMOn1b2Y~5fvSEVHd>n^0)mN zmUv|lJRYFK2Z|nCE5(Hk^|RBzggya&m{Ad=DJPeLT_Ob7?ZAkrtgMWVj^4++F2lz$ zk^3j$YWQ->O}A3*`>B2K!tDj_4DLh1r+2fsn3!RNIXqejs6{8t%YRo*X_OvHp?7`B zOj$?t!$*q*Eq7wlA}j-_W?aPABBuJy4m$`x3XD|5vkZ}ltskI8#m-u$E*w>*x!H%%#5+I3LZceLw=QIy#d&R-%X@<#&FO8ZAgB>blGU_J;LrxIpn3JM>4 z-om?v_J)eNqS&F+stu3-gg~37d!0530fD4~^2?cePzm1%=;BmBVDIGQ1Qv(hCPv93 zr9WUdr@!=&epzWB5;Rgq)02&gD4%3XQe(Y+Yiw^sK;Q!UYo%=QyZmUEc{uUfQZ30F z4wLUxE42%yC7<_~NAh0H>rA4H_tbt!Pg{ITMAZFZQPk-(rpQc#a|V}Z{iwO8Ssy;w zAM@W8=?C(hCCG$I``FspW7m0zBB9F?O(hZi7A&T~p+aAB9`rTAC@3hHBKM$!18d>M z#{#tRr0v7-a6O{)h2sM(^(|Q4@1D4=mrbC>MKp7pu(*^zr70t$2^mZR zYLG{@bJ?M>uTL48R1hP|q1OFnIW1=z{wQ)hnlUry2NPI3>l=}X4^0Jf9VY#QopA{H zqZ$3}&PYw2$mpr_WOHBszsw9R)QA<4i|K6gXUF}mesy(ZJnkjdDk#@%^eth|~$LDs#Z+%sXf*5<1Bt}V;5K|fJPJ@F1 z6j>vQ=A_5SNN0QKm2u<@4{5H+givdTeGT=3ntm)~5e43TKc`KnOR_Gxl_r89 zyB}0Kyg`#0*|Zej@Vn!=WlHzpLJjYhDNlhi!DC|L$HdI)xs8q5MWgYt@oT+54&0i+ zr^b{6OfbM61vt~Lt}1ozD4Cl=SBa^q(h9NVxD!*oML?Z2k7LM}C9czsBwSjc;ODP zwRqn(r{RImCYB1s4;I;LJ*phgdhMv;V*0u}P-z704~y12l0LtCa_5Ry>D?_8qm%Q6 zdl7`}jw_>we(gnq?;7m7e_h6&`dN{b3T zcAilk>^*jx88u!R*xR92dH?BshUfXIwe4JZBZvLfKNaiJQm@yWYL*$cD8HS(eOPJ| z{`+B!2qz0xU~T4E>%_BNaL+2&EJ4F%;rHH}27??xy~(I=%E80s6i}lUjk18c^V6pn z^6}tPyg6NkR#xe(B9BD91+qI({%*O4=rDd&s~$*yW-OL?ptwY;M1!uUbU0c|%=fy>(MQCKJEJHK54_%l(!Qa3#A+NW!c!?T&eWT_2iF~m9TLZ zqRqiA9wCU}XhTVX#=A{$$V&tB-E8M;)}zGQ5r^286CJ z+NH(t47MGaj?lAXkU*j&58>MZc8*Ggu*EpPXEKQxFMTSIw_&iJGEdF1+N zV9?E9V8d^ufj&r2Zku1L3ez>5A!lCmRMb$EztxeG|TvB zqOCh`*zb3f#oBd>D3QT0vucb7uI#sGVJ$k@eNDRRP!GjZ26Rj-2Lwmf9YnH3)D%4o zfd!H7i5<$ff#EuT;fip1cX49favGRL2ZUvh?O8_E(u=uhYQ#4-u&Ii|ECz~$(S&1$ zhc9!;-6eLLjdAwMPLIn&aYg7Ww>1n4l>YoFz@-C_%yx;cfc4eIjmc1aESW#}tu+*> zf=iM=D9%B$p|b7<%yM7uI}MaBZ)o~|xW!udLqgk6=uTBG34!ood4 zl(futO#idM^J({*Z~tz7Of9K_8-|X=`R8xMqykf3M!%)LG4gSH*n28j$3WocnU+_Y zy8GTrA2o>-TR%HLWuVs{g15;z-$wS9D0g3EP?8}#P{ znn~*pDksl(IklpMk{gQi^VPrF4E@w|ZmK*;Bdxiv-CA(GHeOMEu>9m$zCv&t=lN*b zYoSMoDL$kK2Dgxwv#pQxlA_z2hNv_x&TET>P7a!y)G>NDLBtC}Exe~+uvd(#_i z_vBhHRpOM~)t^SrL}L+TQ0 zx_1(|zl$Rwp1qlw7I51|^vqeE%(uHfb<`5AT6d1z-QP>=yrX^b)grX@7NSJ&Z0#~~ z^BRv}vi>}G`|SMd#*xtc_W?Jvi%Tu_Tatfk%Fa(|bL5nWzjb7?vaTzwEGUh!);ZXX z>3c_I*h_hQmVW0sN}AF0SkPLNn~iOQ*eAP%q}zkY=BuTR6_=}AeV+=^jQ0CA z>9)4(e?O`*c%50s#>A6q9vIG{(TH}Am9?C3zMCEpJWem!TUS`%zJmx>5v6p$OjcD? zowVNwl#0l+PT%b}D&Jb=_fp>q*tfU0%dM4JYtd?WV>328)*_%)m(#V^q0Lh=!; z1J)O;_ps=1|9HYyInd@^OoX2Fhh?CpO`T-W^7Z+*V**{rX#%Zqz1_WoxF!9@RZ*!V z_DRBTne&PKDed!pEHYozSkCmzuY%Iv3nTt0)2Sd3R4RtU`3M9-(vM!m+C7%ttKC?~ zU8mmLNT`Sa+Erm6l`S)b{$|{CRW$Zs8UH~%^D%OZKI+S-zk7C25QVDAK{_XfFIQ*d zq%0wbQS_G2UkRjg^Op&kDUp(rnD@W)J;g+PDDnNJBf~zaN>l1$S_u)QZg2z!%1NWD zmfL*WU0*Wr&-u5qG6qgI(BxGSil#ukv%0YSnis41y8XC9*cXq{K-iT|oeyDhX*!i} zk?=|!@y!$&(M7&@ctD0?c)ZkSinw>n;7y^d8J}4upYYcWK1S4lL#=Zi+A4-8FE3X} zk||@XiH{Yd(i*UsjS+u(f5^u7?NC!|&f!^hwjjPayT5wWyH5THMM0*E;UXj877A(Y znT?NSq!{>yoy{4O@gaY!XJeCY9XU!!n*xneaD|=&haQ#Kmqr{Za?AtXvUz{ zd@Z&BiVh{9!$lGcK}zs#1XwROIIds8_O`>{@}^sE;H`VT_FvPl%f=W1VmVS-9_hba z>40y7frggCV@vVdmo}$YN$G21^PL&{sMkIADSY&A<&y8}k(}@SQ}}Fs4O&g;aYTR# zQD5Q^pVP%nh#p9S_}mVH+vgK`amrL+@)a1-h5VgG4#tuDOOj^z<-{sw1`=d32sliS zx8`0&5(#5=gt11x#i!xr&2>MvD%DO}sD)hflzvs@Z91R_lZ5-U&#PB&q#YbMfC;7Z ztcKIvulG(3mkUusPCP_4$`9Mw9@9vJeRiu(IzhI1p2D>JmrwkDmQ&TtkO@zQ;*Z%2 zj{P5vG;$Q_6M6$)$zgT?c$hKnU?5iuNOcStoz5}8RAEqYap93IK6U`UH2|0kuIXgK zu#W)zw)UhQQ{-t96Bk!}R({Q#mpj=0F~p&2ZM>&rU`Ph5%rHVMHD%?CD(ABD6oD?s z@_Rz`V0^3~?&fx~GY`ydtvw7ZB!ikMXoDNF;R9d?9pUYdBsli3tF5P&&yJSOt9Y52 z9}+%9`=NA`2%wz`i^(Lnk7d@MR6xdKTWcP2<>qz4F8$=Z?C@Tq+cVYa9e}V z4tPb4>SYEy7GAXTzr~iw^tGsC`ha+$@Cyukz*H(OIobS+`c@*wEqiO&=QT^37u1l1 z0a`+iCt;$KV+D~XhYWy);Do~OvfREW!K6M%sIDe z-*+)PBm`qTPyP0M+AQup=WqGdzRGGEBHi(sIMJ5m{Wjede@ea;#J8~hgw)xl1UV1x zGaN^7mPULs?Ufg8scc#gO%@MsqWL;LaM`YSbYfv0SA&kQCn)FetdLcz4(FMudDGKk4Gu_o>^n?nHhiM z9Q#}CF)t(q?}=JjR1xhB1mgJ3iXCg&lSfZ*M)mtt|CIPqU^|L_=8jeOP8}zwdFt_J z?{Qma8lHEsH+5yicG9}g@>c|6!m{U;H^1e1&%bfRl<+gLL z#rbqd9q!pF znw$5w-dhQo?|Y?a9HV}7)~dO#zRs35UwgjNuK4Ck?ow};{0EI!mBqTRAmcsRL+=jUzpF%qf#9=_8Bp>hU2fJ_3k13gP69oyFk;2VNLudMDKCk#>yxu(}YIL zM3r)TGAF5}XT#^6&+gTm{}|3k^bFH#u5%MYB`vGx>NCTJEx%%1H~h)jQBJmOqksX# z3tT{;s?d%-X6i*KH=ni@Rq7F@topNi5=DICRXAvw4lJHOnHUKHlKMa>3nD zU2~&&auuidSdZvA{|h3Dy?oKHtIsUI=eP8Z;1RVdqFpFFKIOchs}tvwnA z43<0)2+i9F{a#ID(-~=}rVxb0t#5@an`HK0xyqsI3mL%^ZzIEu(nlumErGF%-^Dt?e6;^0B8?={Tud-`cO|w;G#*bQ-Ec{TVh_Pr{{;v{D-5CHQB4dqYLh34)`roI**po9rx$fPL@Y=Ru2Darhf^~ zn+0_}?v1VXONt=~8!ue`^^C@8dPOMGnivT&q0yjAy2r9jUS=m}_~uQV~YLs}*nm*s8Jw-xK%B?YclF^4!x6brz)%f^PSdiJr@%a)vHSMJUc?tkQv zz~TDKge5?V+{`4IIfAobNj9rEBsAJlVF|HCAo5|;_gR13!;a5HcTLVOAaH)L+FoJV z;Izp>0EF2ZQa{WrvwHCVL=pyH=4$IXlBtKFmrmpZ^Ez6;RvX|SEcd4*#Kjqzn83>F zOC}z@$Rk^z9O&;4+zNZ5ydl$E*|bpRz*Z1J;(>!fnO4mfhS0?))grAb^UnRo_W3`q z5a|LiedGcI1H(-;MT4`oCF27)(r(E?UM9r94CTp@0&hb@qo;yN*Ipcx!hY0VBs|IPBn_$N3`?!!>L7quh2lFw z{ylLY4GnAyCfe?zQDI4pt~^cJxM6h82jKlraRj$SSGhsE?i21UE96);<+mnAI*l&7 z@t0G-y^k~oNCdKZFa+T`a#4NB(200#Y7)i4jo(hRZbxg-sX1*$ zCY^p)Y5q|hY90#97dL|NQa?;6Y6ff7^qLlGz!9^0!tyxr1ngWbI0$yDBj79W5eQ$h zD79G%M9+--)Ka+T_~?Pu1ca1xz!ASt18v{$76P-{qa!{3Zv|rL$N?P6HJ2Yv}u5K zI(KgIyO!ihrdSp*yB*elKh!$>%|ec=DgAJdingE`88CnFUw3r>AkWxs+i<+m${8sD zFHn`ApFi*+sa4g4wh%Rv2}<{kv?b#HV_HMX3wIlNT)+Qmh;VaP!2Ji01Q@HW`Zu~2 zm=s`{1Q+@L^pODyiqP7TpmER<+sICI2l|N)pPIdxJ3xv?!j#*WAxB(Q-xGUOTTM#O zf7`(V2XmwF-|L+bp1X^0{1!0DkhsxMu9<%D1@%J?`)}$8(p{Md{8Gfse1L|JC-wE&rb%0nC8^ zpN~vGOufCwE^n}akFHMg5i#Abmy{-Mv5e`H;M+#HWk7;L*q%ZZOmUyqef_sNif~fE z!Xt3CjxFsB45*>-e9+ij>9VhJ2l0W!wpaCiZ29L;0Yw-2&644lulw%Uu=P&v?_0cx z!Iqh>(4v&VVrswRJ5%<1RZlLYfqwv-5c%{D@{30`*8D$iA#Pc`Lel4K<);&%SoBQE z_o1+wJC9p>B>&RCEL(LH$(=4L!dEi)XTyZ^G=7uDCn^I?e6B~!^B4e)swtSsaj!k6-Q)7)#{^z{WE18-Fc4HS5^jPCA!3(JX2 zQK}DjI^7Kot{#^7zV#%mZS9Z7ny22vIi)*tZ}Z(7C%a!;&x3kmo|Z;7;mcRgjNj+C z)6FQH9%`<2*X{#9<-wyWbIZ$a@x)hOYr7xbH8}BK%^asmB$!{!*2grgL_wF%r^FM; zq9sQA@y6Iy&e~?rXK+uj8PZLXDY~?V^O^|}9Vg;$ulVcx-@#b$8eV?=>kx}|E0B** zju#-TN_8eVDYI)2Y81>4ISkiqV%KR&6276?zXubJUx?E^pmz!@o|3Y@lS&`u`i8!+ ztM9kU4fd+xQj*hs(0~5l&lNdr&X{bsj-#yhiFks6%RrQ@#^_ze5ex^TqC2}tioYFD z#r!|PuZ}QxF%h*%$dErv2=ugke(+iX3Vq`HpP7BBlNU~^;3INjt#SaS!5dp#4`Z^qc?xwGh%Isz< zngKxx0{k>J3508Zb-1KkgZ3!m{*NSntvoid27R;s>R-J%k=wE=ecKzWXGUhxCx85B zMPEg{D=pPvOh}%ndVSFA?wUe`Az!AK%DH%}k)Wtq?6H|I%2+VTq_!27-S9xC(v(|1 z6~?EO5V0d6#eOMww~55$V!A+4H0Oi|W`A&3shuv1DJai}Y%iyOrgNsqhth-uoLB7z z9MNjXb6HKRYin;zT0D?RWXpt}1F+i#+u5RWU7)Q7Hm%=({?z?q7$CkF{RH054V~|e zuL$BG{DYkNrfwy7HDl+&jKSqbWHK_Zg@vI}aKpb6Wd8ML?IGUZB*Su+hx*60LhV^q z<$4cxigqo?*-xb9$K6UA>P7_ znO48TRcyy?B8GOU&o&R>{r|y-71LE26A5zLv>%xBq{+@(L&mEiUB}^f^qVcUpu4?& zp{T6cZs|L4d;#c0d-MT{0yZ+TZ*i57LU6%)JbJST^K8{aKMo*J=jv@O>o5)U;?&{r<2CSNWN_W6nf9cLP zwPp@e6ym?%_=#jDa=p`3`FcnKIw-4&ihwLSgv(N#8bAM*keW~KDzJ7*Z@yhmm5A1)rAjHAHVdCh0&zQYQ}EFaMQHrD z%HV$E^Q8nm?WCt#P`Rm4!oe;Gydlt{2m>(Pa(yf4>FEK}sB8!dN>S9%Rrsi9byuRS z29I^oI^74{huY`MCpJN31=hci8(yW52+fFhS~bZfsz4M7G^p5TJSLUU z^)`ocK`vqL;k8rl`eQ1(2kje^b}&n^p~Oau!gj8(jC7e-iT! zI=q`{1HLb#Ozw)?F{s6H-4dnVzcH9Csh7o!d$j<@x7c=dH8sxfVyU1_0+|Mo`Dgh% z8>k@AFCgpT_IWcOp@k+IJ?C{i1KAZ@H6 z4^bz=!>iefk(;bGQN(qD=qDf+6y+ug)HX6N9E(E%|a~W3<%NVqz~( z&dWk0CpANNAZsu)Fl|hH?rzBlvgiJp`us62!CI)b zYJLHIvgGC^q8jBZfC-N1=tA<)$c6mwIRQ5AocnF9%EVUFQwjI zse$kKoaV7W5@J>vnRsS$`{MGB4t^V?M=lm9LHreHT;1L7=453Vf{}hH|33eKnh}Z1 zdP$A;0pDN?$sJckBx-W@p_v&0CZ@hPKj_SueWc^(Z;XGXi;9Z&FfIdTztyo04R{!;}y}2fV#0Y!U z5yGNsGJ1HJWTpXLHE2II)8O3abS=1b;zE2HG+r_j$D#;(7RryIH{B4Pm*dd70GtZ& zMTYOMS`i2T>E7&N(}Z(ANRScRU#?P!mi)X6z{^$9AIMo~I$eW* z-(-S8*P;F|KEZ=P5L$G-d_7iBwX?G%l|YwVy6vmK%kK>esU+pe3NbX7e?`nTwu*VQsY1g!#}Jw3(e@ zcu>Y~|6t1-H5afyvXqyX*BR5D#5hCh?(78KSm;;qG)WV(u9?#6>iRt_#Y0P*S6*(@ z_iw0FTL}D(L9IHfrdJa2qH5<`2Q5utP(Xps&J2FwbH_6WdHqj}@gC8T*Hold=Ct%3 zW)S!Irx(8yVsjly!uPw}Kvb>KtzjlTF}A~28_WT7hSUiIdis9Y zjc-N}a@q|guxl~F4N_8mUS5#onu6TK28XSU(4WA}15Sks*y}gDd|arVEbm)=W&*)e z+9Ao$9#Ag6=pPt>>nw|CgBjPa&sK|XAR{daUfNDU3zFsx{Fgf{@&W{H4PDQMmuz{6 z3e-x&2?QqN*mq#AKzkjC^^lJe9gTII>~(HSl#rfYx_jV2o$TjwH64H!yz-7q3)T*4 zY3X+zD3dkT+lt!sl%hqWKbH1RIyzV&3hTs;tzpKCntCY!PxnLb(y_q!+o#lejrpoY zKnp`dMb#eqgiOsTpp&Cm_pc#M$UB`%0wQE$W0kMzF@Dr#R%7Ec~4mCBW?v1%!T-<1;4xbu2SF$wRhd31${4Oa;W5GJp zF9^LVJi^iFThv1B*I&vFGgdWIFiS`&teo}0y?O~%?DF12?dP?hK9LCt=`rE1K$0{L z&Zvt4JOxD-y{+kj7^%qgQ8!qJC_df@m0dUm+&)xr%l4aSU;5NBnLuQh^l*l$v=PY#iL1tNDY)lsDoE_JM$6AAug~`7AfSA8DMy(hpe^6J zh$emkqQhuC#G~JuYih2r=)C3RRRUY|oZMXKAtc1c*B6a~6evgWzF57dq?MgrMP`K} zL(DG!%`yV>#C;@~RQQ3>XrT&v&_eU;<&~8(Fr>u4)-2b5&v?h1;-e{;56U^nSD$H8 zrmryLhK-stGcrC)>4)2TRaqxp1fJXQ2cRWSDG{w$z`@4$!2mx=dKvPC~xj??G+o)bRDmYE%`@wd^@XJ3&hQ3#yn;WNB9pd9-7nfEj{g1Y$ zUPn`jDZmnsLLQ=CtXKdT5|m*zWo487{b05|)w|v|QHdbKex;@g49Ei;-?oZk$hIMf zfYUlu5mq%8j=W8}1N$B@i$LBY5q-mF0#WwO#-5PylHnmL3Z@j*)zuY*(P#Rgg?SBo z%S^jyiK@Ffhh0G1z`#KJOj>q6;8e-Ez>buN2D%dqJ&TjA$Tu14TL}MD*}Mr$7SIx^ zGZ`5ff%Y#p7EA$@sOr40z2-M5Q2eDCROsS#)6<{UO?P*{E>H$0CrE5F1l)1S7ae$B zBw{6{UL2r?4$|m2zx8if|5dPH*n4rj&t|S5599nMM-G@JxKaVF`ZW{9T+p#(OObX8 zYB#T{U}B6HR}aiI(}dQH%yU}WpcU67>G+Qy-(y1l6o(AN044O&hr+4?j_Yu3OE@^t z`+$E~P*L02U=%VkG1&1E!LNZ_caz>u>95R;i`LG@Ap>g^ZWv4|GOd7s0HW^uvY72` zSRwwoX34pb8VeX=Pfvkfi=dc7fS4G~XLj&57wgT=$;->m9)HL6c|zNajc3CN6sOKS zeYj!$=8il>{36&As97{0#ZzTXTwUv0^46*s+k#4?{Miu5+Gq^2soF5_qtUjXv?)Wof<~Xop~XysoknZy+k%oi6QRk1IUT@ zUm^z*IXAc3;3Xt4ATZ5?vgneeA>B#0%zC6St~pDjY%BpA4?xH|Iw&iFncrMqJ~(d^ zOZWh{asnDs#OPt8YvofQl#MYk{TOV74{=*yYi8Jxa_1OueeI+|CCbWrc##m94W{RchK9OcUSI|) z7R^6UNkm(_tY5xWXbcvI>ne`=*=DVX%<~z=SnZ zckbK)f{4+pClb*H^Yf5cMJ*)s?3t4Im!1ks6$4BWky(Oy?gW-QeAjgEaO+*_b`Doyd@N|tK_>Mlr!GWbsBPl5-Cx=SHj;On$ zn2pyD^R~ZwJhXr4{PY>qSMK&aw(5TS^!`9N7P3GcVCsaVqTd z=6D5$xJQobU9?n-c-U`^jj@ngDLbA*E}E|fU1(v2#39KOnGqCna0oMpvd$QW81C`L zg#GtFtv(;xSHDhd-nzPC!G(OX@*SI)p+rS>NU<=eQb+NHxxBz*un2y`!Hm+8GW!Q zp=2~*Mh%swDbg#`1%@wILz*owv#JFE-*C184R)z+Q>aV&f@@}`@{B9AW4c4=LbK^W z>i_4DzK~E$aJ}OlKVN@|-#5I~zi`%Ue;ujbw+wvK8E1LFto(022-rD5l+OF4Yu@Hx z?~mc(kuu#T2LESwoAL$!Xf{PaC`LjLif_JNS$bZL^Gta;NFBa?dr_zTlPx^xRZK=g zLQIT3nNW*kk?OGy!S>eHY_3cS^qikR=~}f>PL_VIR+ejGY;0rIzzVCVtB{#{5&LV}IGxU|%1mnu#LNX$rF9QYRGs}zz5xX;!kL#+>?|}y9C*{vgG50o_x7!JZ;u2{VaUqe1?5rMI9q=T zh@-P=Qjj{E)lQ1n7*!vaqvZU`uN?d|L_NO*r$h=t|Z%A!g{L#h@IM!*6O z5TP$NVfP75evD+mhM#`$srXOQ9Ur_G;x;x#R%UJ*WG#)fZaZ(p{woU2=>sIE@e7%E1g0NbpKdSXqKoT<3@ix)nB z-Y8)kv8Ozaj%LxWl~-5J9$A&9d3@{B?!g1tP(0I`|8^}bt*;Z}JQ~W8!V5HjZAe&H zSXNh8Q*&~(n5n40YoA|C0WKA04uoIaMY;zCD}AiwBN-)*2p2(S=FOAc1?rp}>dsCh zH-UkDphZu0=RpQ%saniSiUQ3|U0S+)qy6Ov-Oo3i(qx^PX=%YRL_naaxLDeT1C}0B zQ&XsV%QE!fDZs-aFBidl38zFu!@qE54wI6El((7r50X^r1TqfN;p^)-)`c|Q*WjZ4 z^g%mYc&q+RW58`w)7;!#g>#657!wnd1b2C1osa+v3lpC%PW-=6La2ht+1UljGiz&s z1`F$AG}8R)5)L*tm7~GV`TdTWnVHUa9PlvVNXHOP1e4+{Y37w^urP=nFr1I`^Yga^ z+-&%*E7c_>rNHob$qt->uqCi+?yo^SQ5CNaJoWW)b&Loaetzv7#Ya>UO20(q9#Bgt zQs7E;80IKG!N&eos>2t#fFB4=Ygj%Z?WM7mnU;jde);=HN+=5yhK7izYK}2bP*71R zzzPZF%pk7`l9S}=z!4;w%dG8iv)5KzOe~<&@@W4UFQoHVnk2mR+J%)2F>D+XlG%LW zI}v#%E-tkYGI$lBf$+&P3(d`eWb&JB>)&ii3Z@b(Bje+)6r{@OVGI4|TVrW_;NJp^ zHXPy$c6U(F(7;HE7DXhuoZo{J5@$kQ=H~*x0M=VuZ3&6{G9$XWx-bL>Xq7u5J^Xlk zDsT57JTlU1tTZj7%o^Hum`GyL7;1^H>*$uP{O;Er25636^* z$yvtzsi)ry>8Yp|XI~%vn{9f1yv2Dk(sHrayWpt{n_#`;`tpxwatg{S$oo}ey7opC zOd|j0%3{7r6tXAg-SZ_Q`I}UhvzT(zI?5x2Y%P!}lIwe0hre0?sa$}SKC}z9HQ0m| zeqCLj-#A}Ykv7(z9A10<1Q=n@h*hX-i2*gh5YVYoqNKPuFjc1)mVXsRvS}y}9#!|0 z&aq3a&XkJ67}9+qm;6p~JWm{$--mujo|;D3%YuO9lfnUB`+v zotWCXdkab25U)&cZl68-=W7%ohvL0b<3r3&D6I0B1oEU>MdzY(EfjBJQoe_{0r#Ie-2+sG!`vV z*H%jnvDJ9N2z&X!+jU6jdT*WR z$|Y1mR~JOL;%bq_%@JJ?A$4UxWeV*mH4+!K3dR}Va`lU$8@DjqxX@74D$PrL=Oc27 zVVH?HLJ(OR)1y3kX=}8JC5(A3_?ZU)*De*Hc6^1L@5%3Vn-ryGT+Q%I4pv73bO#!? zo6q}7xw`bzbrfc`>sC_+rm9cK!+Cicg^|E{VOlfTHE0PzAjsY|z zMlH%;aV^!4){#jV1YWf~>2ga9v4sGD6zgVs2A1EZ9Q*?-OG`PJj(!s!cgL;F8d1nU z4*`wX1dytHgZ4=_j@}An;Go(3@yW;_l^MBvdO9J?8Nj2b>)bG?4tZ0ZPc8oq!qXX@ zjr^-;HOmwy39C%2er;h@?Bg~4=A9#2E%9k$h=;cC3ZEQT01=hxoSvt$5_ZreQuu%FA6+36+V7E9*^{)l7L{L-FinViF?1N%mt69iy*=~N4vSvV4(|27gw2W zQIDo%7~k|PTbI-JLkbF161PQc@{%be;GFEyXqDD!iJo6&4sxp?3{opld_vdU>Zj-2 z$`O8R>73UTbn;EbzmL?8h;6ciqKCn+Sg+;kSAmjLJk#lMf=-qBXaL%n(It=~@L06R zVZr?T7&{#tdxYk|zMqA~(n$lV8D-^Pm1TwT8~Yktr8nZ{xs0uID8TZ>@Ob=lji3!DKb>r3DbV~_^B z4nF>wA+)`@N$l3*zu@~RmEX3ld#pyd>it1-&JF6qT2^V{XS4D%gF8hUAajp@mqc6V zB!aekZySy_bu=cD^yEK8Cr@U%+CzmrNhj^$(fI1~eTk6Jnx&!y(YRL#TN^1???`(Zwa!c~@leUD+5>F|_n3fWG>@7lC<(oHe zEWWhFB#y&&r-qJO{Q~kTm6^2@qgDuB~2him45FxWqzNsimrZ zfx#s7S*lV~30Ngm;Y_ap%0#Cg%HXg{J|Yw{FplJ+(F3F$mR(p?>;Ik8NpJT^aFMTJesQD2YIN8Fy=>kyz%hY$>QE2iev@>^t)f8$+*TWZkwyR; zEgD^O;2jwrmVWgn0`JuhkM@S^nnQhRDp7%Qa!ibpvbuUDHG7gYd^Jn6xq5sPe5X3o z@AbncRSVcef_B*eMuP;f^yDerzcIiIr+t0WZp)&l=SSs80Po0Vh^ zbRR`B@vgYCZkn=RDL6bSASH;Q- zj8cwz(C+!o+ezN^UU`06)c_*&>%?O)wl@L9#;`Nx0Px4pzi3wngdI9;(Am_qBtg%m z-Ihosn5w6*m?>z4zMwAT9e{p-M-W6TgY$|NLmXU^VnJ;0+nfJEZ3G0cUwMgTMr89U ziyQe_g<7m!9{-Nfk`egSFL(XIjmHatMU z21j~(0js{pgUot@a#=g9Hz1sfsT_vEa z4NX~DZRS-342%GLH5YFTFZBY7HwU2+!VuXnNkc5nkh4erLOs;1(>;!F^d$dx1wU34H7I)8Zq zF%Xxz9u2*}|0>z;S>> zruXgB5M_oevp7j3t`vB{FW*FvwtJRb zd_?FU#XI&JA%VGfsckO@Zab(QI1fa!w71COB=7dZl_x1DXJpKMm5A93MQzg6gASdd z;@_-KFu1U>ai20-6c=4pcJ?vITo|+(Z=*-D;CJh08H!4_%b?s#tKi0 z$_^gQ4SX9B^!jMD2%NoOT?VAnyoyGzk;h}44X=ovoBJ3h>4;U$@gz3PH0!QfMRnK4l`l?DKuS#GL=!h2wD6!J0{95dKc`oUbFu`xAw6>81M zCjta0Z6GNq{{4qfMx~JwMzWZg7*uP})!{0NTXD@?S5}d^csEMrAvMAwrT}efY!zKy zmY5z)5m*G~=DeXXnVFdx_(L+UefLF@`!tLv&9vB=(o6r16!YFBY z2u!T1$4K)IyhTiu$}upubY&!$e6B9x=nR10CVJ4Qp>0{(^NvK#B{!|N8mcaHn#I4L zmT*y0Ql3v%6&EwLUSpH|StFh-JWfXlW5VqM@Bx1u0M2;>1As)9c+wXfG~X4drliCu zwFvux5D<^pv=XM*)TWa=+?cGD6?g`L-2r$rd;6tqy(hyQh{2|g_0Iwr6hlv_W$?oX z04)d0%b`H%*hl#WmKE{w%gZZDNJC(cgST=QmYAYZ^BMrs?cvY5xt+l#+1SXRz7l}E z8sE0V&l=1`{he6`WO+ay2nvA4aA06SARxBsE5zupCBU4)AX7GPedu!#Bjrm#A-BC@ zz=PF6Tv{4*so=STRfG9op3*a!`=eCjV8$9vcH7U_!_&i8RJ2`0q^-RTnoG|k7hH79 z#w?_yD$8`j!owXr(VJnMPi%@H(*ht4A!_SeqYj?fe_r{KODN{&f_F^$;2_)>)EvHV z2_w1`OSo8BqY(c_i^gL1zw#d)+`VgZZD%o(*QKO0{!k-fJXpO9`FZyTn^ux1>nlzx z_@RTHI9KQxXg4H_(fw4|vphF7HO&iU^B(K+aER4eaLi|B!m8TpxCWU>p`C_F%94uM z|79!x`|<_~RKVWdn$nkeoU3?&b&|Q>OL1QWW#-lkK)yg&54tE=NQy?2p&^oz06kwX zAms>e_&3YBsH?xw*Y^Q@FBpY8N0I5{AjKn@XgEtq^z@t`ZL`wR(T%KHIyGps9RD(% zthPXALB0T7R|OB6?uEb@00y#EO#<|-mY0o;X|~C zkf#evaKTHFXy{tXKqp*Q@<-22r_eYiB#W-9!5th|!iJ&QqFI95RSid%6iy3h{{Xil zr_}}!N%-MpmdP8fVCtoOsT3O&^crC0j0`>SQ4$dm@wdVg8}X6XbUWLPq21r#3kB2T zAH9&;BMGwT{jkVTyCww{6(#sE9J{Cv9QtsjKxPZW3M>qvjSu^#uz?YlgsFO>HvqCN z-ZS-%U{g0}22oA5wI_CxKjwnamsVDQ;L$L{lF-XZAOnn#j8io?|3=&B!z?T!4)(#w zqv20ujY)#<+!KsCoyVnVFOOM8N#*5-Ydndc8CMdg#UmWh9`0`srmqWach7SRg#RAy z@Qg&p#@=l8bQ@?u{lP4codd)u)PTG^lb0`F(gqr&$_5%i;RCA^ytKheOrq5_S`tCK zw*Uq~zX_H#-W#bdHx);0E**LB&IeiS8#ol&ty^0p0J9Pj_5wGZ?Vev|Ma5GxvKO$b znshbn$w zLam!tf&(3fiN^0$hl&T_LL{OPTT@dLoV&`WG6EQ7jrAN@c91~5_UO_4$_gG97JL9U zy5BE3@7}#vZ8-sle$@AMd!eCVc^UFjWCU{Y3R2Ehp-K#kAasp{pfxkNeAuvKo2y#I{g@_@5R7rf9lJC%edmV{W(AD;6Ni zS#02{cd}lm$99=InV^O9>r$S5cV}GH$=13V0>_@FnX@rNXw@;{g#VtOZ2*Ln{5w2L zZeGiH=A7$Ig7fE>b&9w4xk}LszObugCJ~e-LaAKJ*ssO9Tp~@JAjuDK6s^SM-ECzg z#ie*FFpIEPBv(zdGX-F}(^N_m7~&y;cmxoP1hws7K>Jc%_j+ z<1t%hm3k|Oh4Aa1_UtCNUySk_wx|TbIj=frv-X;o$qIU&j^@1FDt7HD*&ToB5E0(? z&v;lQbP+yQkEd?En8(?)xP_=tZM|DiViGlXeJGgk!Psm!cTT(Ru>bCBNrdU@zZD^V zul3ZPPqIxKd>Dvx44n*%X;Xvge1S3ZovUV5ZpDY}G4-|^#D;HO?&IFuPt+*ZOW-jfMM(1q%I=z= zBgPpKh&~a`x9)W~RNDgHh29y$SgxmvKEm5SAI5MNjtp*k2g&;SJ2cAKydM0fr|L27 zK&71OVKn0`$>mvm;pVUq_sEkmQFOpD#pTaV7iZy_kkbPT+r6wEm8FlP>kF**)pp!A z1Wyp@ODKqkP14jarU$I=HHr&S) zNFLnVUyR!0KmEgk0bGXvO*XJB(T0yVYrXH62G;Mt_xQF4typ-T+Gzm+mPcT0Y;La1 zHt+OUz)rIaLX;8sY~~d^5-F<|k5!MFwAX4c_0LOfgGd|MK5HFe6*68{CUELn3F$Do z`^1zyNoN*xDW8+_a@R>dik#zNc-&AT=gFb6Gqxc(wzHtax8wAA>LSefDw5*9Lm9c| zbtanir8rZ)mXl(gUeUn4dzWK(mv*8N-G8J1{*4~d6T)M^Tx`N1nQd(p!azhvS9{x5 zBOzo*i>9i32(=6wx4+sbP`SxBe2uh&TNv>BFsrF}S5Ynny?S;vzQ6REfYoT}Bd6c&R6?WCE@1;Ii6o4w?QHnjy81AoAJ=1~FZLcY*^7%Ad0z{W_*S`45x)-xG2@Hg z3H{(OzWDw2sO+_u`mP^tpp$tvGd;ms+Y6t@*3W8rdXh|>&vh6sl=v(@TFCX5UiT0Z zHegifor|e>drZD(F$!2ymWVnw35;d(%lUL(k0#9-Tm7>-*=4n{wD+EaL>7Wuf5ispLtTqmN4ze zdp@1dR+o?Mjp@N2EUk^>HI}0;vJ=r-u9$JemGPlZ$OaK8)$k?^$r>WloSjyrv=nO?9gNVVr^*uQ#v zSjx)Bv=@LeH>%w+Bi+2ETaHbPn)qb-0LtB@2)%uL(?Z&0)?ZDwL4Oa~2&3+3q1y`y z(=_CPo%879aq2x6Y0upbm!{A5GG_Kj!7W&GoA&Oe;@-Q{*`jaWB!+)5xWf!g!KuFX z3>-~CJ2L&~&h{Obl)cg`b~eMuL9<`QEabp$itg=gLP!DdpyvwsW^ zSH|*7!i^Zx8C}t`xzjZ50SQc~SG&kpSGZA(y|_!4YgvG%(K+4s4 zL&;5vz!=Xhd)CKV3w=%CnRYrGsG8n9chxzUsE#q$WKZe4JZS;n$V{tAGP029k8xM- zM?d2JSVX6%M=q(3MmClsh$(_L5v19RX&)c<5U=A7)u0#ole9Z)@6~BW5oCyP@iV?@ zb5lPQlYahjA-WAyWYtSt?NPyNQixDw=ZrVq7(e*N{SOXOkkZ9Cv&Y)mR(JEq1$QQO z&5at`({Tw3W_`hr`*5U`lJkn+FhnGidkz@I5qHylj)(%8X(8B1R1ld+#QxeR2Z?Z} zIxYIySfhDPv2YA~EiALQI4?}dD)IV0CQt-ErSK|*6{m5Qwk`YhM7hJ0U08%|TOo>F zy$J;#%D0i0BtG9wRZ$+^kQp;bzIuGuM*9?#aYa~pC6k`uJM8&rSX9ww>ceI}zC6uv zFxb?BzK217=X{WNj!1Ug^UVIU?xCBCgPmHTwPoST<~8QP@+i~eWMs@1iSQpaa9in1 zb}sT$YxiU%1wD1YX^DPlYv6j-0#G1U$Vi2JP36O9u7RWRt0&g4=%p81*RVw5*^kxI z;|_FrR<^bE!$~5oRH2>Qh?%#G1nkLm2&%98@%%Hw4KR{Ov+>cK$aX0ZFJWGZ>?DuH zqLBsO1VxA)PU-MfTA%*5Yq8N`Etx<*R@H6Ozknc%AaWb?;{h(s$VkiXwv&E|lyhjK zwGiTa+?M+_%8yUD*WcpikQsVNgz4Jkz8y7adVKCi<}Iz8-WXzeRto%nRJR@fRuoZ; z{XoqrR~7YdfjE0Z>;2teXjvnj)Zl?rh*J`;d~yvsnVHFtY5$whL4Ct1-5O&O?PR~S zuwTk8jJtxeQK?sO{W{MNX90+IM~5^>={}<~EsYt7ju@QF=Z*Dg?w5v-8NC0Gx$*TEkhKm;Ktp`-z*g+i;_Il?0}IDSDA8T zMwrq>Q%@#_qez(=56+NDEm(ya#y=0ktYR)G3=Xni?f*%RZ0d;87^~B&0@F7~Di>p? zQhSIGgAW}k*S~81?OU2SI@)LmWF-}s5Do%5hc*?q)hc9}Z%vUULM35ySbq#zz0?wc z{gjhcXc#6*tZ0bDg@BBO+0A8zmZsDn_zfLep+Ut;2N8=2oHP`MCCYV4=qa!ns8O8W(s+EP8sFK4e1Q51+_!A7m&zu?t0F@m-yFC!~>875zvS|A(xH>{@s z;uD@a=tE!unw-8buq6ine+TDJEzubzgn1a{bwuqB{(k-6T|H5#Ku!blctENFQj;wR zHQ(O{v&v)8GTHU{e2*x@L}v9|?Q*OKD9_Q9Bj=#`1jN}uY#H@giWse5;3bf<1Mya1 zsw7>gAwDqtrwX~Hfy@a2h2I^|MdrZX0#peQnghJl6P+CMom&x|tv`S=kP%E-7Zdco zXS;Pb%QN_hfR3v~zfF%CsC?7Y(|r!-J_swgrd^)`CI73_t1DAYwd^rqL4Zp}UMEKj zHUhqc&eCxzDk^Sn?w0|6l#+qpb(n$N3XGJooMF-heY__*GBp&^Y=ABUgvx?u@4wNF z{n=p?9eLoFBpVQ9FQy0%bs%k=`D~c?7~(r*$_uWU$P44E0hl-Dsuh9$8~}QR1TS)* zFRf%8P?!KpJ-h6`>3Uw?k{wiy>?fFIW2S8n3=I5>e2Mtlz_RRljwlxj+xwh$w>CR|A%vD z9BS|bITlN5^@t(&wy;$m^uIv&2K)%|X~#mq#)dH`XI)lSmJiQxiuIGcAWGO;Q;lUQ z+xzMTU8Z{);hH{UED`#DLFNt4hXjz=xW!l`{lhnTus2(WeNuF&v7eY50rKzc%s!eD z^c5;D-?;!GFw$7e9<0H8%v3{IW~iQmN*_eTW?Xw>v5JwQc@;cB-9)+&;8~s&_=qLR z=vy^Ew+0?lT`8_5y73bCjZ{*^;4a~4O0?|HN8%~l ze76#S4p})_?Yh>>2*N-DAKrK(;B>+R&pvc(ICUSGA@J}(o{!rx1zjkBlD~#9YF6f` zEhW{n5}UXHb{GZ(Fv=aH{0IZT138VOWA&^RF)!{hDoEY{iU6R=23PpK&-mJ&1ThPI z0WlLayQks_BN^5e&+hiil(EGo9Kk}wPB3)n7Ki`Ud;#E6dm?~q6kJn~0`p4;C|C?8 zo827ZO@IlO5EIkxKIcQcNkBkAljE)kMj(g}0xCa?0?PVD=RD0V5A1U^%}V(b~--3xARErJOFA3#9~n@^f;A!Afy#MniJLF8)c}o&6C#a z(TI310Qupn-xq%K6zDweK>FZ!O1d1&0Ky8F;I1*C2f?He*NG}Mc!v(#^$sAZ!2k&N zr5)nh9o%qb@qfIAB(0LtNm$@VP5}S}p!fxiK{k~2<754NIU?{V@I`V&1_!T_mIwm_*|o4p zFZ4utvS72=cVU%cE#Osz6m!0@)A^ID9!1*urk!1hq{d#?l2TNK!^L5dZIArr7`fkvSLGC4u3dR392{nX9G;fxyPj zv9(Kg>7-XHzKbg+T;X{N%np`L5W8<1jkr#-?`iP8lM!rNF2rjY@bB91fc6LJp{ef5%9gQ7E}{!4KN7zp_Z*0#I1oD}BL z3TYrQTd^sIyHubql#4Bin~tFDYsbGA8EPdSeBaK|GPdRmNT)XXP_n1pl8KR~_g$Wz z`j(vhEmxmbG-g{Xf``TA#cGU?*M>>xEpn0Iz0LG19!7Rb_8iCA?_1V1P-!d(q|nFx z!ymhwulSm_KwtYMTL`@*7REPxlE{Bq@Jlr^BCvP9LbY7+hk+*xd;_1kJ=ND&S~i-V zk6XOAnb+)15bEKnY`YaO0KL>p`%Rpr+t%@isM*em1V}yHQIlJ0!pa_+mAj~|)hQXU zj{vflx`6;9^sD*q-eYlrmJ?mxI^blON#-&HZM8$b3@K%e@vk2S%wCzup)6xcbKi<~Bcyh}ZqV!Z|Jx0kRSzn&NQV zzng6)Pb^5R{Mi(K!3Qyu29kbBdckh1isMiE6Xpp29tz!-n4K@!DNWathVm+&i^ZHv z(74<6MC(Fttt^OqK37xt=2B`}$opx*C^%it@0NKM&gzMhKQD<6>m!>DEqsbtc6vXf z)4_$$;@Mo3#AuTQTN1{>nW6|w*X4#gXgM)m&rq%>E(GPz^rO+V0itr)u zRGHm4v%N}E3`5ghu`Z9){IAHi56(U62Q)0ecdua?2daqPw>ZNr**Z7B3smABLmA_dPV)(p7^6b4fdgh(k zAr!)&?2=yNt@&=9-|6wGR6-3E1#xiPBDc7;ziEHQMIdQ%>FF*a#E5^U#rDXIH!Dsm zb8ggTYa8L&eGDCv(OdiTT+oLLs#Dc~lQKJgAC_v@lFS3=dtEvPwQ7sDH2yZWa1qd= znJa*{w(WI|;m1U`HXto_6__uNihbYO&0Z@ z{n#$>u4(a7bOk8B7?B8RRBsU=)lzUSD$#s28jMNAkBfp@A>H3bje6>qLUOvwdHtcRO^vyYklV~XDXRms3l9v+_cxC?)CD+0IS!i4-pw9H}@@2 zjes)z-?|(kTE_u-ErS1b%dKN#f&qAAK@JRveKE%0nqor4b?87)u8$^{qJ)Kr?+Y=g zmR8|P621uI_wvg+x@+~6y=?Ig!srb5AN5gOo%S|xD7qvLvsa>S6zJm=;C1_Rqbm3t zP20zKcSr81HocoE{Ge3}Z!9k^As`S-I=Xe);)vH}S6z92rZ261lsJC#>Ug=%X+IuF zWs~yw`S_MR9jt)V8-xU?73G>InP`HbMKII*{@r%(Zyz`j94s~g2cZ*CKC!gkWQk$uev%b2DJ!5%yVjEP!ezj3{PxZL8yMfdmPerou>|h#D5R-MG9x0~JoDi((;&l>S zc>PThdU+zlU2AYy_$Y?bjc^T?)N(wpqq8122Hs(ExYoZusUI>%pl$A)KW7#R0S0|) zUkg?Dq`Qf!#RLLjQ13i7Sn_6R^D#XqB)f`o@|2g7>IcAIkSkyTg$jOd_XYA~9xkqh zQ-TT&E9k%1GT8mW7lDQnI3+JP`eJ}XcOJ;j?vLA!*Vh9Oa73K2hwXevtA2allo%vx zuT#4N`fsa%z-P^wR5cC$D(*bGu^d53dw!96fZ^Bh}OV%b*YC16wU z*hd4wR&ZviyF1G5lR$1eq%>tP% zA*+N3ote$*^MC3X6udLC^)M|Z^=dsRRTZdJiv^cS;yt4X#(%#QV_t!1vX?If{-%Rj zI>0Lb%Z>#-4}V{_YYMP8l3hH9xN#cicpGdL)-_X3-+LfUg^psS>pkfq)NVQM)C=SO z?KTrzcD77;(7(TE$^^(A-fR5XjZ2|6!KM!m6%G^8B6x{?uOQ_!xA@z&i&a3opqz;c<+b7x)-@4C+5EfHEN zKIch!jG7FL`8W zl7qt;4AVgp9uSuJ148p_EUYYGjK!4(j{*c(UVj_*8Qs6QK|v%N1d^v0?Uh!*Tn*AW zoSdA%2~Sm3)!7+WOcAVH03Sf);!@Xpe}xShc^v?9x81UBRhy3br&7%eP_B_heuCfl ztO$M+5Nw+OB#Wvl4q2dyrU)XLD8>sjv+cf^WsBw3$JaOb)uMYG+iazINeqM8Di#&V z`G1yRw$1)6Deh>P(nFi76un1BS6ySLwP+DmVspb(A8Y&7kA2#L4nIsS#4xmZA4{DN z%_pU#y)#Sx@;k5WzMgM%3Yp{Dx=ogQJ-g<$mbu0DIa2&t`tlc!O%_J6tK{Tyt zEo(n}XP|<+M>iYj(SSe#DtMsKg!R>6bbGwy1ilfViONx;>w3pG0@qGd)ghpEcA~}^ zsfVnuOt(`=->PrP=d)mY$}XlHo(e}5Ght8F{VrCA%-I&p;}%mmgVM!gMif#`LjvBu z(W;Q>LjT~_S-T0#u&cp}mhjorT{H8Z$n2#iJ zr3b6UAsk5@$|zRS-znMB&yqSz1+y$=X1Gr)FoD|)Rp%%xR1EUVXU;Rt?Z5qRFD=`A zL*<|8t*`e$yu{JXuh-u&-^J-l+xc+PoXV<0^$o?9G5P>JBr1XX=UV&XUMD({I^;?M-dTVRcmg7pexXj4b)FpVnmk^Pt=dbvg z5=I3ww`*b{_npQfgAG1I#|H~O)>h+Ya0f{xbku>;^VhqGWeIirugDr1=Ebir4jMVq zG3>2J{3Egd`q-^@c#^rV-_))~^dA194&3k*>^q7mrpSk&GbQibxHQ)-CW>n{|S{^ldL_RIhzy-HryxXg*Bw!%hIP)}9 zJcfo2Ei9A774_d0@ewl1+6WS+8%X<3@aMGy-lAH6IPqP{2k z>=pGhAM0^frxkDR1el7f)rO-&#KKlB<<+tAaHcRs&U}38WQ)`&rc(+_OXY5#QX~0; zhZd6^&KEVpI^3;ldecl`&8gm*uXu(S(lHqN; z&kkga;B9BUR(7Bt^tW|j;7cfHN1{#C0&1nd^g#<119fqMI}X=FQT8cbKQKhT(QOX~ zKgPm@MZY4;+1UG9*Tngzg|3E=g`b<7spz*z;Yf*lfk(TvcIYcII>8nqc#Mnj%Iu)d z&B?CLF72VaY+sD%3Io@!DVEl{bx$`Fr?t5s5$-ZtPMY$6X5mYkA|DQ}+019Bm11J- z9dqtRB*{{#t-0)|F16e(?CsSGe!M<%*Fp6E9vk}?n2=!L?xF}e0SaKU#Yh{&HQSGg zp%!$%8IZ$99^oi1ib zZ{3@_iJ=7RO=Ho#c+1YLlP*~Qc6$rfUtTRIfww8=tV}c2y*9}^_WQcB*2Mvbi%+g~ zlbH7XiwlCrJu6f)N)K7>I)NDP@DDmZBjHpXNifKf+pm?XDuUfF@=zR3hhdC-7(YDl z%pD!_Q|atRJyHhL#S=6%>A5?)oeIhqkJO_)f0TEeR%<4|auwXVI}T5j*uI?p$~;j2 z1pPP|`KpDV2Rae6f%?${{$f_k(SePQH_u58?wcxou2Qbj0EE=`_q17&ja&YOYKcc{ z&5Z&sSzrze)M^^~l<7EexlHA~Lq+)Drc;rKVZW>EVS1C-OmIb#9=E+F2&FiBkbS!J zAwa&CM~m@jt~!2*j*N6DGmBkdBSBSx_l&lGgd&YtC;ml&v~%xGZqfyoZ?}3EsJBbc zOCgd~5Q;~>IlGgG2Pg6VC;W+Kvukv@*U`0iafmp+8}Y~ER$EX>agjd_-HIKh5J=`Z zS|0ceZj3geHWP`l3!UexOUqt!(Q`$59Jjy&J*vm;X2<>YaoIjXgIs=-=dHbs4RhKt zBEK6Ko`Aa}7H?h0dat&i1qu89Xkbuw4dm?3faU6_(aTpqisWp0@jdSjvHbf|!T!2O z!J@ce+{I1?Bs7qJNDQGYOS_yss#dAddI?#XaQbpGsX9gX|$o{i+c<8Xvi zh)!!g1u*yQr8u=Rs;h)~~QYI_P5 z>d~mutCV&^4QBphaVWf5`YsI_rFEWV6IGVL?8+X-lihLX=pbzg2idy!5sgxEQ{Sg1{K>yFTDu zJoS{=q2o*J=3W?mzAjfNPeM^6|3Q~S-hTx*Y{+^JraXB1#|q@OxJ6>0vF+be+2Y1i zgsV_zK@g$ut6-U;CB?82Q-B!J9`@f%W)(gZGo-uLZRV93N1|pV1VgLvyR_&hfc z_vczxrCb#mWk|~G=Pmq1CF;BFi$mPhK8vQkFcbR3!%kV(u)Z&=v|5ykw3O@+j3o<> zpPHetp}5k<_OIX|e3k~91tb zSV@S@lUC)n*kUkb)t?wu|A@g_)>e{64~WLLCu$Pohm>q^hb2;kYtS3eLi|1?GpQZ* zxcs2UR{F~JhN)PH79#RZqcnOVWz1?5-Viy#Fi7g|+NK_L;=>iIP0J2J8*QJ@a z1Sw~0-C+P0^7idp5SXEnKOcxun0=y&F7iw5*n_svd?JrRJRJK487HUN?{A#;_V#-V zb));2fcPC676zCSx{ZzV1@h%Ypa$gvRF5`5c6%8BBlP`KPFc&9`|(l>ys&FL z-tFrbnZ?C`R(>cE`4%%oR4Uj0WF_JLazEJP^}m8KQya6Ww7Qd2Ay)M8Amdj+L|Wi? zAY257F%?x+Ek-rS3fGZlsl%5fQ+#nsEOYiGa1yf{%}6+*75#U#m-owM_qxpR-OX=K z8h+Z`TifFF88#z%wvg$46YSa4T(!GmmP+dzu6x|f?&Pv#hEUhCb@|(7w?rLJTs$>d zx5DKYmM`Mh{s;P=No9}i>inMY*CcYTcKX3#73cm(4NTIq4a2`_Q;9a@nRd$=J-}@0 z=TH3Xv714T-1>%wTFdFBfdS+Zw7@iYt`WvNmOAB=6^c3%-ov4pR(?+E1CmV$M8WQI z`?yv2xYDt^>7L_f$f4Gr;K}+#%N8;@4&>x6G|S&#iov%Nz_1n-hxbDVxG}plQB9~` z#^pyP$0(tEF8MRUQo?#B^et7LU!6Ay5p?8+`{_B7xRDT9>;DKV@-mEcnK@r%?9TDiBAhMFQBJsItz4i;9<0zO{>oc(%d~dzPL7Y#YQEk5;G=; ztjMT-_`pN1Oz7ZHNSoL*HaQ{7fK{K9>d;%td%$rrKlza$v^rAD(!4=4$JtTo9i+MR zoxX(mTb%ju7_z8f9S1wa*w z)Jn>Y5JYx54AM0(($VN(k*}6Yg4@`}_&omPSwQ}9R~qbQEk-z(y86Z9-x9jqf7qTv zBUy0o&-9PBHVPoue{81Y0<jEr|KTAF2U0lq?<9ujTs7%oX?R(reJ$5XxlMF;6$a|yq^HfM7$qARwe z7;9ibxUWlffAK}}dwOzHn3}TS!sKMPVvi{Ft)Rz|84W{Ts92w==G-M$_d>M*@ zKPVy$HEHbP65wKRW@&Z_Te8H#sn{HBtZ;3U?-RVmdP`v8Ia0Qov+Q8;g3ll0-=WCe zQNz`;JC6@P z9v6itwO$&LqoIFi2iYFM{uSFMzq|Bzq_=mz=^2xE*6+3Y5H%V)Y2c_);E4OE4|fIx z3e#@|Q*Jr-ToQEO6@1`mxIf3g9Ez>#mj0-+tvL{hJD#PQ>FX6tmZ13 z=s4)G7LPFX^r7a}Qj*~F&sxKFLW-sl1A)Cwt1`X{$Cals!So#lux`V)Yqk&0&C%0} zZ>+2s-#QIk38;}w_gFuEsH=vDfxZmIf%qc&cf(FUe?1}n`KsFv!b+n)T{vFE%lWjm zOp|3`dv0?mz;kxqV=|u_%$;&)e_8Rn)0@7BgO?CWWr|zM`Tc~^H*p&k_9BI&b?iw{ zXDe!Vx?OYl72ilB=k8X9E5T*&rssK_r$ZeiH@)TNc{Xy^5IZavWoX6Cca#nJ9`sE2 z!Ubb4W1eY;nQJ*NVr|}TEX}Du{YloUb#7G3b90#C`|&9pK5Vq=73jGK?tRUrp}({0 zA7VBW7Rim(m@6525@_5S<8UIo+X*V_ed4O;et*fjluvds*y#+KmQ|6jKldN4eUKOs z7VjD|7Ohf{FDydD`JVjMK#o15abTM8OeE00c4SM zX0RP~?_V$FB@#QH`hC78Y+t47C!I;;?s#yqEV^v|8;Zvn#Uf?mdr*W%4~r*n zXQOvh;YqV}ZL~3&Z$!Q+WmZINzE5&A9k|?eAv)BlD{K5_seJ?2F1$1x}0IQVl;%ZC=qD zex)y7eUh0nNvI^vI!ctI9q-g$%4}7l$_&)rV~eLj5o?*8Tha^(J0n%0S=HbT9G#dR z)vPQ|*at{G1*-OKjN?2!iZ_N!1)TpDXUHk5zBuF>o*T5p24^h7{g;~s zrieTehdp^iw0Q;rD%79Hj%V5@*q|8JDUHDomivRbp`pAvQm6>i)Yil@EiCdc! zKqvqAcaFT2uX9IUo((#@yQzT>cA!OKw_)F(Kc8e}CwBql&IC6M z9`ckNAYrwr2+X5JMMc@!MhXhw0SKe&q{H3Cqs1dQ!7nQZ>kV9IG81lSjq3a}yL6B7>h_JAToi$Z%Xp@=oh&vkm$yvi}*{}q?~=-~JMqxhz9XRFY^`AWykEGH}b zA$bU$L!FMS)4J{uTkKi?$JW##|3U3H((g^;-w@svFi$`6zq4{`D-}+J%YlHpo6-`&ZfBodl?Z8>9CE)k~?LBaVKT!fcos_h6 z0AaTJQ91&p1&*~j_v3tB<6oD0x2aPz!Sw1oS1lXV=knFS?e0jwmgVJlC5eX!le-da zZXSE3QV5%E>EkJxO0!2LvuwSNciR}rg>6e5~{Jx z9k0(qqOAYj0F^qRi2|7kip&XNqM#u42OemVKLOPlH^8r4OWNY2_Opre{dL1 zP@lI-J;ST$&2n|pkJH5>^HFp+FAB6|F&6ZRMm871og^oXHR`R?@{*> zS_wyRc@&=LN4Via>H7QkFC`UKP;fA~KJeZGIv!Aj(8l%m)-gn--Vz~>V#mZf&kke@ z2pkFT%m$iKi=hAh!miik9I@^8)gWBlNKz8mbKTlEcPQ!aFVeTdQ%-Ihq=YwjHug*x znodVzkpd3SO6_d(iCr~$0bPkW^R-&>QBi+Wx%U-=wtdP|8IlkqIHMso=m3`#jzx(Q zv*|B{eQ~L8pGws%ZIov3WoD|Ma7ak~>AWxhh$UcWAv`Lv%TE9O3%s7ddt0HQqoNY~ z^XHAmwdu#_JfsFKYGodtdPQH|Zy5hJ(>+#TZ3WKNcPL_trd6}Xto(-88h(?Qhn7%u z^NpMwi0|7cQ|r(%T7`=?n+QbFoXg|u*}S@sH-#612_stRN9UC{nZ3CR*e9^7@DSgX z1i__;v)*Z+A9c{huS9}GBUR;m-Fyo!6vbJS3((%caqLwmpJ9Sa(k%43~$Z8g!n{qgbDK;`7*Bv{0NK^|D~YF9V;MwGDu9a@92wyJ94 z3p)_Rf&RXulap$JN-gu`f0F=yJ-!i#w=UVQ{P_BRs)p97DbEd0v?foFjOf9(#~(lK zI(|otTM8 z_&iCN{<|Otop9NPNl6&PHO;5lLwRLAhItf)Xn|A&Xt1`GRe@EVh6W^5RsvBAbFY>vu>8gtQXf<1)FbZ0YXhm0yb>-$UmOa+@cQ#i}L(j!~_Bpy_YJkc;#m zLF8{46byp^06NbPvT6Kj?sT9Pm+aDmUB$P5NtRw6s}nP=MuS_AG+cujXW1bft%6|l zBggYQ)=!-ZpKrYOcJ%2t(6vi2z@Hx?o{jm!4fdo08 z{>$C))inZqlO&|w)8LS%&5R%@zGQCZ4B3b&v?)om`&Hm}@(};kEix-+cdzG|TmMn= zd>(DmWZWVC*p~>&`lpYbRpAZ_>DMmINAv-qIr@TLMr+L3`Puyx#g8Y~xM(E^Q{ixg zf~ilkDOHOl(&M&Y?M?DsaJ_Dl&UYi0k0Uu5%pD?@ktq#F>*wNDmmYHp3i(`#e~;6z$^2Kr%d4UoJI1_82bX~ zXc4ljh7p)q`S>0{ zYX>kDTwQ0}$L8j4kHhf3=&N(kU5S{p4!njS9?X0=IW|QV&uUV@NY@=gf@QF)F{4F- zpv=xbe+kc|vXH>L9FopzXR|1HfB73ecU&PY#@znI9(eJKV&l0iAP~n7TWjQd!%;L! z+?sOCM3bgw31lDjh5-S-5f2zf4bwzKpz#s{qn+geCxHN~?r}oLnS(jBiT!cCOtV)$^nI z*GQ{{(_=U_~n^D0tgDcJa(F8mV#N zOyPX=R$1Rd?#^@EvZ?Yf`uu9N2CBb=@v)}mlJ%=;x#HWKE*8V$B`tB+KguasjzON+ zR7GYN)@wQU)~kP1gB>FLbsjVtl@a}cZyJMu0MJ6XBV#^M0*9`}MBdO4-fuk3o+m9w zjv>gnN9;S8mA;>9S7D93O}~CVZ+HD1+WKHQrJ}Ar|C9)xhS*rgsC+h9=m$a>#)U6` zVWk*<^le5rp@ddmYM!3|$6}P70F2t%S+|vTKVWHf6(I{eq($#Z@_7<+OrzfDM!VeG zGd$cnce5eJmEpWqe_GO+O z=V@O0_EG%h(CHD9$M_Q09beeMZR4fOM+%CY^tRiLm1Aw@y~P%GbRq?aYfN9myfloJ zX8%`B=uxARLKmF{f5wdaAA0OikktwJt^hPpG+C%X>wb0chM4&2#nt-k0D^#yz?3lu z^YhBIX{NQ6kpl?m_<~I9PYUR$;Pu3of#HW&bnrNjayZ!_(WZ9g^W3TAc-Y<;lpH0o ztzE-C?xQ=xpHPM&`ADeT9mzPkMa0xxBVTN@e{9f6$Sb4D^p-b01qWHizHue}ezwc%|w z=3hEot;4%DI+SidSs{pq>~Q8~_nR=l{la2v-r{MqFnFn&>?qiTLH!}^i|44|DD-ec z@p>2p)n4i$8gEax@H#>N2M zyLMR(JY&?B4f_ch-BO$qjkY7dzq!K*3!{o;y&RrRgHfux^TPAI?YL0)q%SOSxn&Cx zjZR2VS5Od|s8*qu1?)yCsZLX?z%&KkP_RqBca3uTmf9sPXnk0g#$&0!T+?z$o4Iwe ztzTf;Jnhh1B;8}y{2I|pb*r^T@EgtXn`4-GG!hcs*JU<{kh`pzqU~W@n36IkZFjA$ z$!hDi>0q&07>I^F^YQG}VH)<@qexDrk_pS#wjz|SN&b27yGs#x1xmv|GwO|^TtauP zab`DLM7%W@im*RROSSCATD05rR!dnSk8yGOIUfk-%L1f3$D@1(ncpk5Yx3OTo=#<}SpL6031f8AE`HBmu)-=F{8Hfp-iNN|4|(oWMP zbXartY1$Ab z*hc1c)oW6Cv9`_M4E#_rT30u1U7~9jgN0-el)JfP!LOPu38dsZtG(X!)t8Tfs=N4z)RKV(De^5wOThh16G5BlT$YV zgg^UD5Qd?4Kr0Xu137VX^TOwMGt>(Ji^EajXN{7kR^;U1aDH-vh=^ETS67yc&gkv7 znIP@C1x=o|^zZE+(Z9c(OrKbC{%Zw&@A>%ioT7eXxlMrA!c3gYH9&XO{S(A1R}vb&Si!|u+*O9?@I4x=d3g^}f! zZMfVvpNHF3d?$|}l)-}gX}S3W0qbWMWDeA*$MS1r?}b~X}I(=0sn@A4MX+uELUBx5ez zy?_P8(eVOMpEcq^RS&q>&f+V@__phPktLXbk+rvH5g|SS78r2P-8?)5Q;D|mDjx#$ zpPvGSfF9rGNjZOF(X97XvE~}#>DfI4%@WVm9}UmbX_f@5x%9rG6#RP2*SNA1|IvkJ z(w=7MM|yuK$^h5RWKk3`H~9}K%d#VQ$V?kFT`!+d&;a)8R%}E~8~~@@zkd%_FtBU? zM`52ylKGMZwiZAtx)Rj{JkVTF<7>n-fsKHf8H6K+9$o^(;g26bKml7zd=@oq{cr~# zrY*BL>+=VFpwZL%ASZKBxizKM=I=uQQIgMP$i#iF?6YFNZE;U8&C2H06(qxPoQIuV zpG}L5lc_c7dY9)938X#KOSDQLGx!1*v?y+N*k!Zz4jboe4iEJAw4TG9%(>~PZwZsB zZFZ9#x$g!WoNS1wBea{hhU5?k?|0N9n%E8ddJxTOx}a1&MGS2^6&az@Tn*ZP57%?q zJZ}4rmVZRW_jk^@*ez&TH7L%jVt4CClw8|OOb*?RsJPxn$u?C!Glp9UeRNy%V~?N? zNBHwi{xc2?k;g3r!gc-S&D5rSVFwaKEr2dVLS^058M3m|&B~8Zi-xKO>#I#cM>nOZ ziMBGe*q$h}N+DkNm);z55}qR~_F-hNr42Alzcdx+(j9-SZg^%SqQuIaRu9 z2tYtF#qZ~ncD?f_T{!o}9H?*pS<;o{ZA3*{9y`ZxI2!wg;{F54RiAu-II&)n>yb;J zQb~BLrR59Rd95#qWWaWY+o-ktK@8K7Be|fr+)ld>G0N>Le;_e=HegWjdtChnLkBtf zWYAIonIRwmft|oQDh67*%M8+3C@V{zGnEQ-baesn?1eC3Jr4{H8sq0FW{ZPP8HfY% z*g#)&+^YRCoceH8u-tUU3kP9!D(Yj_|Sms-Emkn5(6+q&V{KmB*zGk<3tWxI5 z6tQM>(%d8JD!$hY6Z#S9capuny0ZICyxf}WN?}ATnhcQomTJ#nyS@F1B%8P(@rL|v zlg1XV+X-$cM-1E_8te4YHlKNp?K>#1_K4hGv(--0QpA$|qu{8Oy8m`UV65S6is___*zMiY}@ok;c zkZY0)ZF_fjtXXVKF0zlDJ)&AKdC@$l#2gzUX#y`4Tyc(|lYD2=yE0^;cT}2|cb-Uv zI%oUV)-;r%&fgkMsp!XAe@Xip1cD3KouExStOld)NUEYi+eyHXF>brQHKGKUGmbLy zMLZ-dg5UMVR@TYsA1M5DMt*RxS~mFf*6N%g#ALrsKpz~AsToNgG+6x`x3349u9qb;XX%CBFc#*ha^G2*drQeuU+oLKbX2M99 z^E9%YHfA6(n2(n>bnPEYf5yU<&uUb;exzZ9D8Ji~8@TvDWGUEenV!_u)bjH4)m2q7 zMTkFZAwnSYBS^04UE|i=i*9M9*zA?jJZa(jFw| z>ND$mA1!dtvopQzb#rwc)Gu!z7}z)9jEjk>a-S>&L-7V3G!W}mU@{O7LatmKTzc1E z^A9;=r^?lVl-Ym|(wII-1~|%suwKyHvbxVHfqFVQT?QfJ0SY@fuw`dc$W8#rSwvVE zh~mSKZ2gE1>Vh2r2o&q?hVkp*x;$h#m6d0}UkO$W+^}4~HlKlCzdTeodBRS- zWQO*PHc7MWN)~8>Uw*b|s7JUap600}6dOBYZmq?IB_T-%9ns%CJ>%?52?NRO=2%2T zk5QTY;Tl>onD=(U90Sb+b*R^$i{HXz>^S%w()NFA!q)Hq@>i+gz-F?L6cOZF0TTV& z-Zv3FCnqN~Q!@aF2YS3_GU-o<*1(e#xo!oMi)-S!HF~XGhcdDA+yBjF`by?+qPGI( zt5M5o_?2sAK~SfrB|Lfq#fdAy#t6bW&QVns>)3yfz?t zy&kll9v(dBmD8F)?ZyuMu;(;s8c7~5TA*ZUOujmN_2$PX;~Fg%-Nuc>!^7iamV^O7 z#OJi0y8skb{t|D8Up61Ie$!B<2sre}6H_?5fc%{si9hMa#zu;O7Y`lx?C@}@ zSQzdQ1-T0Sq^`aU%(pL)`R8}pf9=w2E}>;Tzx?13#@W3#`*F076V*zzx_f#+1u;*k z0>n5maCGuKZtr%lnEDS@Y!f7M_(ldc&;9{b@$f{x>6JwRT>N6wbqiWmuOCKd5~t0xCZ#l7-CP2t0M)c*8cgx`f>^EW*!IJ;5}qIp*rmloX4hYNE3Nh#}X#Y^Pr z<*PXQ5b32`rerlrvErvJ_084PVDycm`AW;BnJKbHu%Z{R)9LNG!Gw|qI^^av*xq+ddyC|;WbJBbDz zEI4Tkr>3v(wM(DvNZch-TsaxmOWKm5z49rr5G&c!V`ZL^mfwHygTMZ8Xq_MJxZ z`P0iX>EbF7)32)~3fRj46bxzSpfUugQeoka#qn2Sm=3b<^9!cUrXqFQ-bP4D0pT`J zor$wxdbGuP%WE$HGW$Q$-ZHAnHhlZsfKnDEAT1)&DBUPZOLvzvNJ%$>N{e(0NOw0V zA=2HcfOJUro|EVQ&RX-%tTi8I_Ij3I(EWoJ zu)0zDIVgeDGBT8ul3EtNxpItW-{{UHGYtB^o!R>8Nh@?jrs8CtNRv^kvg$EDr7Z)lHfDo+N!0Vi+k8RD@5Hw98!>Q6x9hHmcb zhQIu-s!tvx)DKTPO~b!!SZVajC%LRGtXbXi$voMODX#k2okdyr`pVe6!{1qNo$c6u z`Z9j}iz3^Quv2ZB)kuzYymOOX%b$OxmmhAsRA#CREmh0qjTNdla%QblP?oKczHj>| zm%1O^Z@OauT88p`oXT@8{;7D{V@vFcIG^ehKck zQW6D`viA1$3mlqHCq1@ye>;rwd2b2L68Y=h`nk2L!OpN4-&q-m=;4-Gy+4+EXjh$S=z9@R6BEr{+#Pcng?2*C*h$+Gk@f+s^+5fTBuH{cI6a3(jVVUrv3+Cd*;vfIgshD8bl7-SR#r^4#wOa^Gd<6b z0Qw12hW|ziNCl&+kB|JQczAg$%?8uK`~Y5o{{}>0NP<+?O9*buiKhKtN59tn_dR2F zcq|#e)5-2{{Ooe-tlLdIZ#F6L5plucjVo&263bQTHF6nk0PQ=68ZQ(JnG}aH71AA&Wk(_-Kg1W>(>a5$!vnDt*f?^4>QEO*O;`hb5fv zeWprv>(8>%Hw_VpmVGvNeqE#Q{rGc6R%j$Ac`#idLEMTn34Y2-a8NLis^XH9VY?y6#Z}OH=C^VR-8rRfIcQ?=^YMxKf8;hF zxUL$(&Ps?tP|5@Y49dvXb5in;0n}(GYGh}Eu8bd)UEc6eA1Z94>EDKC(vVc z_%U^nxcXU_#RgedUZ7TN9nxjwE*ySnf4o3H9oBq*o$TxnBfIR~JKuzytY-=&JC2y! zy+Q_WfA_5n%6>hrBr#BOe}k+k>CkJ($r6aqXwze_eHH^ich%&8Cz6d&!^~)*lg0j zb#z638rW^l+oY#LeH3|^f?V+nH*_j^@G3B+R9cu%XQuXvF*CA4Es3pM6#g zD^taainzJZDxU90*PBkbWTI+Z@!oNFql7!wv9_U*a_6JWR>@o4YV@5%bkE2dLl>XneO|(-T@Vxv*Ak?q}t2bG&j#6AAV@ zciE$;LVlcY*l5Vp8X?)@Cmm~={fSF;_I~%b+8K+EPDR999B^Db z&S+Vh+x{SIa*wj2qM-jtDr^@C*@6J$O*LW&Elel_U7PESMS#lc1mqJ~u=B0NSplT8*4*AfDb+h0vTzHn&_ zZ7rK)>Fb)BXZ53kv-Ho74&Wusm~l+CboAyDUTKt1s^S1vlr5f#jSW)OVqnV-H>Zel zkLlQ2bhE$>+jt>YOAg7*g{qcMiLIWbK~%?$v@!9Y_#%KthVyOmkYeruia6Ui?PX@N z<=w|M{lZN-9|gaEo@D>S%F3_&GU_w(ylEdRTlObSL!E6ROXD ztTf7c-9dg|8A7!C8xp-W>qphtCYErT5Y_ZoSCbT#()ZB?wpt)U{ z-n_BbR8-T`RqmLC_+%F36{pF-&uYCkRUIle+fmNtUUxdX63rn4PcEm`fi&2g$T~`y zEICMEyX)%icH~Qj_(W#rQ8Nx`om6qsl9Q8L_qJ9#7Et>?ShfKnwu=i4{oqlxF{2Bm z*v11xWu9*wuZ#bsw&n9ON< zUp47dYUvd>zjvgW)sbLbs?$7kX1H&|*;>`(S{}JG&n>Q+k#^V?utj?B{GIoFvEF_) zQM>1AZPCBcOtiWKGc(>X3%&L-*&uf&3hDeAzSlZzRpLtcpjXe0d!Fos@ zM-f9<`iKSf`}4PjVdiNg`V4d!y9mTrpU8Yx%Q%=z~I*#HIEs8R>H(51AUWKp|Cn4Hkc z_WDaD?TB$SXC4sy`g(!%W>ChHKB(*Q#Oc}M+ z-#T|!+fXlkMH?GTPn85ojkxhu7b8E<1p6A4<+YHa>oA z?&0anN&1eH_HG+?wDv3f6w@UstUFZdxA_`>NSR@OqWVNYQaQxM7^y!xx+)XZqs!cU zTJnWkWqcQ}QiLV_rh`hfFFv>uvmBKrtyoLPqBaV+Z)s-P)s?^Y!Rgc1v8I+PYz#r6 zRu3KJV=M%xJO|=;A#Fwkz9k16$#eZ)F`du|e935wO24=eRUF1BJQAN0^kfa3PUT~% zmyS}RqU}Yg-a^3ahnRumW9Q>t`Co6U=tJ&HWkQ@-@GG`jZ3v6}c1?7T?Y73)YW}-e zQBe^I#&JQ1tcG-vLe*go>!-xvY$k-Wcb-wU>>V_;f3zp3P74#^8&#}qafi3E3d})2 zm!6W(qH|J!Az1z3CPF<%(CuIqXh7DDig49f^_o16KNb@(<4JxqTu)`5ClKX{F)k!a z+m5@HGQcsLqwokuO(`p(Vn%Q@n69=7kM&1l#u!^GSwfWPvDArOPuc+t=6qX3QGdx%f6e51;FYwAz z`B!R&LL>XlAN80O*Wl5vvd!LqcU6Pixl)D=EB6F!+>cDPTz(wMX_2N_I~h&8nE*Di zcs#N9FNpG{3+_WwY>Xuwst81}{PeZj!qVxc+ur+8J*^^p6ul>)r>pyxgQT&saaLQ$ z^#$}q;3ungAr|`!fW~VS9`(@mH+HSF;XW!G=KC$haW4!9y5PhSn8B!ml_7@pG!-`U zbG^M_Ot-$K^p`>B0u*6wZLg+B=)-Lfhb$`Lb6!8GHef{U27Y0?waOJNQ3c5Hg?xit zWkLc%!uy1(u=zy6rBjWGjec+kJy2OnDav}`ePL7mDWyK?UpY*~OcHB1A&*saqw7cn zX>n^Jp+db#GovA~0~|q*bu7UMd`)FZov!ADB?Q)osRlh#+8A$XQO;QlfW8>))>m(1m+l zx45{dh=rM%nUS>^6fFSbXJ#(U%d6w%94kZ~zfc?`M;ee4S-4v)uCC^Qen=`)v(O19 zf7R9F5bzNy2J!*rJS|GrDOv1~D znd|&9`=f6;CJXgp_0!=uLjW;?Cx*hMU|;ZZfvaddVYwuAL>;d?{gO8&F>P?^SDtAL zPR2J4FTTgWZp zkv7f2y)oB2sg-Z%kyD_p)$eBY<8oQ;x^=2%HHd8cw+QKmfRg_rm3eRISeoja&UDoy z@z56CpE+F93U9x3zJXq?`@eRgjEoF;idxn`gRv*P%4b_3dSzN$43gE%I6!p>0eghO zP)a~9^j6>DU-I(Tv>VqY&8xO8%HK0dzcjLP8Hr@A*2GYr_x$-ax6={dap7erX(N2+ z4&q5RuQR6&oi^u0-QwZj9k=3M-6Ovx-!bA0A3~+dCbG%dq`2t=V)MF9_6_$zMq2KF zHM|mQGuq*IN3|GKk1BQM<@z1Bt418QGjBP(XKsFNOKk1^8Yw!xzNt6AcDC*-+nnir zE>h@8m4Ghwx;42{qA%u!=lncn?7YX-59^(GcN!Ghb>kj9ecIXSRqQx0*lglxtDuN5 z{afQaWSy@)sm7d%vd~r^CKz+x=zMySBu1Sp#dveU0^2L@5C7=7)M-cP_R&?vE9zP` z?nl&^4ZGaa43>2X3D?@F^>z58Y;O-J@YB1pFbI_9MSQ;|!-E*DP?evDXJUFXchn+4 zyGSvAt3nf$&k%MR*+~r9&84{wna=yebl~C-@|E=TwIF{kU z({JaDvGAutzFoscaT1w864|y;VnluZ{P5O41Gf0Od$~s$RP5~j!Mu}IyGB2l z_8!me$SiY`1?YH#Ap4O9 zUkREz-eWLoFjPG*u$sk$QPp&%B@r>POZd#J-4XwgNh(XIMWe}U_LaQQa$y_fax~Vw z^Ql+=x0no)+OAv8@%2J`k>!HQhM#MAqoQL-d=R)_VqbCb32$pHYehN*J`f{2`h8l? zPJ+4{P2c?5=5o&&Js>08eOOmVTg5xv?%CrVq~Xt!)AQH%hC^H%mwnFl^KX+br$YjR zS^Pbm-kF=?5^TAyEK3U4^`056e4|Cw&fnQ8?G!NS>~FOfznxIJ{4PS%aJ07JsJH0x zqUM~cyR!GVyX|R|XKI*t@i3_qrPuuOhGeh6{c0|SnTvj|VCi@GTnD>0jP-8m6f!4e z2baUN&1J`-(&jOh&h_L{!gWWDkJj~eRxlq~!M~a@O+D^739w=fyOLW+s`FHJ}tN{vKp%`|xzH@7_HJPfPU1G4?@CmS!lCkW?@7JG{eMDarLz(Ho_1J0mGq_O)QY`+H>EWyy8V zU5(966rmFxG5Y3b#|NNX7I?3gqcoA6ZOibpu*}i$R{P}1DfyABeMy$qta1NR-&d1X zFm7?N^0BTrTjlkSH5;`8l2a#_gS|e(57AvSZvA=}Q)tvj^>HU;tX|;R@6h{0UX0Ff0`BQtDJ^j;kzCDe-TxgNX{33!eN(qa zujp%1a$~@^84sV1=D4$7R{`?~i2_w*s+<;G5cVA`ur2<;r?`xb?07FAvh12-5LdeR zv+?9lF#3Cg<*sPpd#cXH%}jDR-00s2MK+wM+#P@6)N0FOmKL_qMMzlDH#anRT-G^) zMxrWpzQF^kHt<}ywFljoGcUtBXfTc9e|j5sSa_Xyd*6;7l%7`?I$v3SBxkiHxL<6` zO+tgO)==fr7qo1S;Z0t>IqXy4Utlw)(=3CYAArhFLj3cErA_0zLY(j9-_^f7&}#bx z{9cJSiu}BmT{5U<7zlYy)rjnIK66CWEbVPUeSzI}EeCgw>S7n8t+29cLLJSg>-XR5 zJpVNy8H&*Vr)O%tV|rOA?($?ff8IkF89-|JQ`?Q-qweyfcLQflDE}SA?wGG|F;BSG z6#HJJP?Lq0l);r3jTQZ;Q;W8*o-dt$I{&$AgHcMidZ-udcELHV!eO^?{5Vms(b)NO znKbFo1Fg@OFIq;q$q}z6W!t)jt8`y{*Z5&kF-k{fDuy$C*j}l`{ALMp8s&;<3gM?5t#O~UYRP7pDUmW{=ujsTjdZjGDs*YA^ z_+MojFKL`oZN*r7s;b_^9wC>IP>$(segF6h))5O5EO)j z4#|h}iM#eeg#2T-Y}V;9Y^~VOkK@LVIjX9iv9_Kbyt_Qb7w53mM?6<7J{K2mFS;{f zmOWO-Gr>)E{&8{qqfzxiIT|7rrCb*ahf>f>pm-xO?YW~%wT8-RAY1k4Qub-OubT^- z51FH!`gCH8pTsjVnI>&A?7d-?mltLkE zGwIa#acB>8ceB59>eIrQNbf}>yV2F8>%wkx-)Eu{mZov+^u-jN$4u&3^Uh^5^+%6N zqq_b2JDcRme(uec(gL=xm7M7j5)~;zcTkh81OdM%;2!0xt7cwL+md0d0m#dUQ&jLxk?dyE zmE&46jyENQg2PlKYyZ}~P#fXfbyMekG&aL*H(Z&O$q2TU1sL70AE*C4+A^Bn#V z=%22ONQPv)r9gc9S~A3I+DKprsp)xgZf#Xt2h;Y&vzz{I3Fu>CF$or>jhy7OpLEOE znJiz)eDS_%zN*)-v?qn#bfUzdioPA$bey(UIq&iQ{HEZ*U@&7i*a`QSB03I1BV1Ba z5*SGftfb4UX&VT%j*!Y^>XuD?mI2UCrtT@XjQP!07Q*1_x07Y=$8Vu5+W2C>ug1yA zDILRNJ(zw|RH0SRy%6H_xY{GOj6qRB%JsHQFyQKbn8tI=w3Q_5yAQS8YP`j8F-v6z zf7+9E+re2lJtq@lXLTziipN49aQgSSCq1Y1p)?-j-J_L3!hLu*v)8`mxk! zH`6Or#i&+@cjE;Uq4!?rlTJxVf1L7mKmME7;LbE8U&=~yQt}hoBw`Yhv*Jqyx}Y+_ zc{@8NCp#xD;@cn)sw(i8pnu>)@(u`fd_kOm`Uom{IA%3g1_8sLEBA-Ok%;w56gUk1OC6jjAEh@Pz zMsi?`O&DwpPuKI~t$N(DgVk=ZbCUN7xARK4a0;*IRE!b)cA;2hg;Il% z{tI{H#N;#tLwTJ1z<|rZ-SNbMtlEB*fs&GPM(IC4;8JNB2W`p6>)a%h-?=I1jaAQz~mMI>@?_0KwB=H!MCpy6<|HLC^Dy(I?l z`9!8S`?;%yjedsQCFlRcfdAiH7>L3C{h#<7TFSkUj$2Tm4P1`g$S2G8r{uZmSy?}O zdkX>Q;CqKuDpL_r64$$Y|9wukvh#5l%Bw8 zUG;8Fk%`0qs`%V@X-UuP>J&OPCglKNzp~WA>@EXCRDXZ*$}QG|t!biREcmC^nNUH* z9IX<4uV#r@Q~^6vgvsrzrW|#|#NXamn6nJ5tUJ>-&7q;8ThrA$K)$8eE#BMT&nVUf z;c|UUyoQpFju${ff0m=igyh=~VsRE~K+_8hxO&qnt?s&jMJi` zJedk|Vwvqgl4KWKo@<^sD1Tq56>b*-ac9a3Z`j6geSg>%KbQ3c0R=@$M1GUSYJXNUP6RnLyr#cI14Nh<4PuP(@zD5F*=aN9j<&7(Z6KvZOHn7WEptzXSgq zT4LNlVPF2iY6B?euBd7TMn-5KYK&PJyQVC=J_L&aEv*~!$`hi=Abt+cfsv8;DZ6l4 z!E52@Zc~({#dL9MWHA~`dM^`39er}vr3H)Ux6nE5qH$5Kyt-baI6H{iNG;DVx4smv z&|*JnbU+|((A^UEsXxz4sf*Ifs&KwV)+qR7qesqC2>E8#978?# z=Zn4N{?Rd!eYhuozWAH>zqN`{Y_S64YacIXVu|AovF+#CSbvh50JTnRhga#o$L4bR z6FKdkf%l?ooA!H)b`CNi8Qz6%g`(g2#V4M4H(&zcnz2c9 zu*mwnGxEvh)wvDa8t|Z>srd)3YQ3h5?p&p8av_hU{r+ZX%neVJUQd$^4O_lR;v<3Z zeQp(lz(H&Vf_;7>%>I1Yx3Fk00l6Q()`TW(GjO7`V|-a8b82l(>D((vcJFu%LtFx~ zBy@`7_nWImwfXmF$H?oPS*(cH(H7WWm`fD83I|8NJPdewevdNL1b;5*Ozi7}qJo+s zC9*yH`D60J$D!i=BxPor+~PhadOZR&Z@a_KSsW8*y14M;UT?UV|Ldld5c4>`ilabb z^BLIc2)azTDzmg-F_)Ruoxv?HF#gUze|%vbH2-_BSU1^rK?H-@Q-tR8Airw(TV`7A zwh?Y&ilVu)qh6EmoVyf)OWkW2f0|dxB;RGmdTSp~SK7xOPhE5>Rp<|?4FuYF^Dph< zJUy$j8MN-*Gw?z@WbL4o*8R8Nx%b<~AN`b{udVKecmVp00(M$PQ(_t^&t-B>{N%fd zX@0Kiw=9)0(eF-dxA>JXKIS3*%IJ)2jiJ4F_fLUz_xoU`kkZ|SN>j&E+X92RaB z^;i6wH*>-{(Lz2%$P*ysu~ixgnH#qvg(X5LmTfmyIwfyX`+V2wH+f!!#FC>+ldxea zL^%;x%t+6=ax-B-e6I~;o+neddZ8sBc!R2?m%DM$LcTmBdtSa*t@GbYlBwXb*ijn} zX{su{J@4vB`3k-BzB^RTBe{QgQRKFGaA9Vt)$DZ%X$fGS1v6)FJo|WWZ?FDG`F^+6%fxKWsufNmMXertup(Gyhgb@`C?Ug zZLL3`e@$AdP!W1`4Cy}X1hK@%VMipnpHOi^mPOG^Gcq)#lo0y4EKK7LGoiR2DrP!| zHC|lK=CqLJ2U!rCI``^4*~C+KkTF-tyibE&DOULHHJ{XC0Ral8iKnq^d{~Bg5N3n= z+QMeReLd~5^F+%u&-tr@a_aJsXtSiGO%=syPcj=i=4ZjsDXhf|$$T6w#*X1Hu_>6u zi8shxy%0U^=Hf+oasETDzNXU*QKEc5%J+SC@@>SY+`O+}?DqzwP%v$3wjA*1G?f(P z%`?rhG1DH~^8@hHdT{NXNksA%zSbQTKEVinUIyZYUQU(eWlqA}uE8G)jP-WKorw%x zj20neGD@iZjAXN9oc2X|6B3rn46xTN9JD`Ht&LP=2J#HNZS+P#((_LvgOaM&1hqVY zApy&6b1xa2jWzC46HD!P^;Fru91Qt6sdSFi8yzpys|F1nMpA2GS)TpAbK<`Je$%Om z3|J^&WT@+X8Cq6W7H~@#DsJvr&1DGf8nHO6o-aDz>s}^e)g=ggb$xKoI2M`%2u+cB}@pH6ikXIjvMi+OQ zQY%^p7h_boGBusU-C65I6hemP_UFjO%}aawTKl(ms_svQ>itpr9eh!k1~+E}M&E^3+5_ z8cpYB{^lIz!p6xDucV{yhH+o{MVONba)voK2|seS{r9eB(bTDENULjhba8BJy4LkV zhlc^|USo@t!#YY8L+#=k(;bKody`-d3)im|FO?495wp^tNJ&WOv^`UMJ&NJAe{*$l zbKa}|Ezr$C&{(a>jD~)jM8M@~>r(>J#^X6Za8(9@yK;1+xY>6_;5w}!cRKy=X5d*f zmp->gssT^T;`{ig1}*+r_!LLQCcSPe-+j@bn@8)-~(;o70NUc8F+p~Z(Cp476=wOTS(0>5AxOOc5VpZd3 znU$5*CJcoc85mxr*S~R_e(*}c`N5qwJ8gA!byz>paW18yymKUeiX2sa>^=UT?0?w7 zb@gBkhv@W-oSa`(R%Ogzi9>(F!2sIykQ*dE$_k@82Jp|nb8;H9s5C59r@?!C9fbQt ziz(&^YId7>T~ML@NPiM34JeRijdEIgdPye2@h&dc6r#Xap67?|YnibW!wk!qv+*IN z4btox!Uq=UqG^rr%|BMHV z!fBD-w_5>l2U8s;(`$Oj6Y=a}NIQc5q-?IT;x)hnkCO5pqRPj9T+79GB|wXWnm!?I zZJJ_gn1dO!Ww|?6M_U^(9T14C&ZG+=>#zVIpZ*_;u-oe^S2HZX-Cu=&Ib;?~gRbc+ z95#aeslt@__>W?{>4O*;7=l7W8#~^6w3JpTK8_W;OUCcvvh%e$+p+WXbhv$fJA}*P zO*MDT#FX-%KYvw31v7~Ybz>hk=vj!-HbKj@|<$))wqMeK{>IgS989q`08GgaiYOk)e?<+XU<+z z;dF!4DQK!*HHHG|Bo%Ha>>r|excDK^yO>e2;W*=&(HydTW^!5un?Nn@(fZ!eMSE%p zR_vTpN93MLxYs_ii>P)o_Z30!@=A`ljV7n5S*#nVH&$gE<};8VtgtY@)%8Z-aSWjSjGc45?dl60wISy3Urlk}ep#;q?y1zT_ z6EaR$^vI9vuD2Z*zvc0A7pHX0m_K`V%Wq=6VT7iyKJE8Gyp^WO%F;Yd%TB7%@7MPq zNAsa&;4LTDYElikoM8mqtdsO9{ME(2M*swxXQERBv}t!{2@o+YOEpWDj|r*#v@(9_ zQxfs|WIm-G+gz4rD~H@@CdKBz)-U5W9R?@w)7sv#oc;CET=fz;#9HDrq_Klc= z#q41wa8sCl{K^$EXOC!c5FHdx@5Yn~Bv}7YsOcK$!yc8H)bRNwd&Tqa%DFU!7h%=L zH@HlO(|el(kF|rtuFfLqQ!8hW-!76qe$CLGSdqxNT>Y4JCQfthV2LX|Ou zJC$2HCupc|*qQmVMttEg?}DN*sLLc#(X<#bUWNUG@QPLe}3E3)RN@+=#{gc^(My|m0Gb;v2KjY z%Le0-5Oo=sYF%>apC3j^FD;!o?;#LGLKY(n$&G(!iXU-o$&OggS3*x?w%#%HAm%+t z1h}VkW*^ng-n!mI@V0e0hUx`%E5B2b5-XX1SPMK75g3uu0LZ~ z4iiGwW_vDA`~$s-w{^6wh2qGp8md;>qSw#w=dDNIVP6w$-s)pW!$3wHMi?ya(y|4u z)w--uN~(Ay7wf{q;l{NTg$+Q<{^>dAA@gYn%n8E)cb|Vte>Hy39eN1*VX&StcmA1i zTd21bCY>lt(XW`RH^B*f#f|p4aOYNx@L6%rd}Sk&kaeSpJ8FH(lO6JxReGT0; zLt(2^jNgc_CHr?)Em&As-v_l)9_Eaf*hQ8s6ur#8R6$ehQ*V|&$D+KwkB%@l%P8@2 ztId6YNE)2r$djHo2z_hC$64t|ZCcIj%FDn;-Jo$U^H@16aCFV5bZnJR&b{2o$P{5V zF@%aHOhTlhcZcfM26Lfdu!d~S=|4Qz_W16brsHGP zJ!0eE?fB;(YPCaQ6DeQsrK&7c!HLC7*3$neS$v9GZW{am8f|3fUcI4@=~qvH;qr(dX6;g z?|HH#7lj49>4XO_O{Sku>g|j5dblU)?H(I>VnuXf53yX8*@@>i#w+Ub9~`DgAADtP zN*sH%JC?0O#u{mwgfyByL)GKOWi;|m^88k?KhrIIr^v=eu;S}rUe7pRMTHt;J5kl; zAI|;6T$#t|b)H224mA&NAmkMl%e*e#$|srd0&k@M#u!^14UF|5cNAL2LWkPGjjQ!7}=8t1x@!P>+}R<(Chb5>KG>Hu=U zhX@43Er5G4;Wh0G9B}j6+LpYgEq5fV-SYeOD@o$-_B{;ljnkigl^sFqD)Q4#zHB;k zHn+qfHTK`n?2oq&(%o-F`S>6pBxgE=9z@`P9ry{n;70=|uc|g?g>PgpBJX_%93u)G zT}La-mBJRi&eooQK1?+qZV=cnuiYv&4<4gRaIz>m9Cea+%gt5YDa}{CjWmm^;8gkW z;e(rt%K%5OT@pwF*-dU2x%dra*xlYfw6|qt!T|K!Qu{CMRJNkAIy7q9f>FH|j#8-ZKlG=!WkiPpSGQ0AJSD0B7`Cf#Bh*;&DJD zK*0$8hcliSD5|fkBDy7eS70O8J8n1up$(#PfWpB@5Cn${j2ky>$+E{cWN0IGi=lZ; z)}g^fSPFveU{UG_=uI(1Geocdl`x4hmZ1e6ojObt8XFp(CR6!e2MAs1DdtuHlFE9j zA{TN1BqgCHlyY;cv!=ZdfFhFh1QA$A4&?X-=JGsQ9hV<(v*7V6>YN!hWB z?Vm#U0tbQNPkjx}yH%lS9ZU!zcxEUFv5eA!g4fx@DypggFwr85=zL>QsmTxx;slVD zL;Q`Ysq^u&7f#-F2Msj9NjlmHDq&We(L5FKcNaIES)?|3F5C0Q+=IUTfKrA$ori}< z3E6-*d`_DO_c_gnXdw9!s`uii3pQ?UHR^~0z2>Hz9J8fg5f)^HAK+{A$8q~Y7X+%Y z&B5{&kkM^!ZWd`bHNXnK9*mF)GeleTrwF2F*uhbX$DQpz>g8%@E~tZ``ycnrNZH~L z9Env{a|QXiwT^fqnToFKOPz4+<#qTAHX?(-G)>?CBBtt6p&2Qpoj<;zW8o8(>R6>2NzI|+B6=H5kdI#+FD>h_fb@ewfysUpy;2OTUKn`~?th_o$G7N!z|Q+_ zb@#`67()0_Vfu%V3O9ib3Q=Oe+$HFJb?TE5Odmw;_Y}UI%v5g*G6Mg4gdp2yIQ;TR z-)|zr9IXNi$QvS%WyrtNFq|z%8Qi|tzLF~J^1K#Aay<#p7NP7%Y73L4T_2P%A07bk z@KgIA7M;2VUZ(=xV(;(5Fnwf;@6mr+pjo>IJ{^#6<(-!JrB*5~LcoA60||oJZfVX#jZWS_%c7Su>R7Gfpv@sS>Y7sPW;H_cV(N z*5pI~E3s=1B#30d4Rmm+XU>)Q^5x4XvI*am8I-<6ju&V|#>5;U`)yeXgPpDBbyYNY z-Fk?%>#_d}2|TdvF>xs0-Gy#&eSLk$&$a^HMm|uY7pFulByUD{9{AODpuoAK$!jbQCs~Xh%+vEp6 z*C=%V6h&A z{}X%ozcLX2TlD`E!UI3@-O~d7#V-i&=g_OO2 zg_{I_RKSl;z(K^FG=!77S-k4+55?YAI?#Ld zR{MgEDH!=W?8R!W_#)ANAN_y-wEftyoUbD3aFlkb8i{GBKL^omYFtGf;n||9^XwI8 zI1-b5qYnD1OTT(*{1>ys2mq_X&wJ$4-YQCo;QpR_5rBBvTE9gmyuKasV3{5d6BAj5 zW`>Q1?dH|WcM~z->@c_OLjGyn^DF+>P^Sb<(hxFgv6Rz0x{15)-|8`ye*QNWP>-hiu=jC-?p?o3^nn8-*@Ieh~f&3Uj z&mJ^oF@o<7szwU_I5WqqwQAOcbw&N9vFz072p=4}XZBd4gty#x91?saUU9zra>5^^ zks^;kkD2I>H@7C^8;LZEp!TOo1tPRl+el3gaRMr~4}ykJ%OOwQetw#v*8lAmW8_>7 z3VX@7=xPrIXVa`cE^+u?koQI1iVoK|d$5nH62rV5_b(RwX`A*cFK0E~jDQp@=oB0t z<850LQi=Us>7J(Etfnza!}OqmfwL*D&c|t05bGmx*v0=MRrXH*b$#^uW&Y<}+|2pz zAs)MW5TrvcS%sNj6pNO+(&7ldP8LP*l-U%>9U~s=bfjKhzdbXmuV?ProTbBa5#a&P zz~?|LzGRWzakBkB^b%9hAPM2gy|NuV>bv>F5Zf1B_6z=^$INK@%EAUL3Zy8nidD8_ z?RZxq5>LqmZ~KuJ_jkb=r4IogaNIP7_!O@u2iX>TSA>q6vJ=MJ&2^tVsXgIc;}3?} zuK0t3mOmNG!S`a(9FE;_OR!nFRFS+bq}|vL4@TOFv_9-Gh4el1{Z!{3-Tnn_(X);# zXTRSW9{=wyzs<#_d;d%A_q>rF^K8fIUD9|bt~A!egU!`OUK_cFyTt2947X5qXuLy@ zjw`4jB*^Gpg%&f!v<3`x` zC=cHy4EDWv=ymsrKq~;DR|{LpBJWdzRm&&kN1kWK?&)0-Bm9Po|;n$shA8 z;w$mbeVTuszq9=6q1#LkD-?lnK@EHyQy^uTO2rw2E`rPk<|jC7p)!D?qjPSK;?}pL zd?pmHPr2Je&)1H$L*{FVaJS9<5k6^OBl0UE@(F@b(===R_5=`^em>Pd!t=Y*4b<7U z9FUx)5AXgzZ;t<$hur^uGf~WxbM{-QKGrf>*yt|#bfyQllE&# z(UEdt>qigu|K4DfBf!%XQ3~JLS45b|4rpK@40150FgWC;=pVaD1;;8O2xXs^=}$+8 zABMX462r9pE5UqI-adOE>cS1f61)%Snf|CQ4FMTOH($V;r03R^h6q0V8liv^rii}7 zhzkRxKW}2}CdMviunE688a-qX@xeie&?UGP+@C$CZ1Xq!kvhV3;GY{XPkY3Kbk|lm5RgSDC4$Ci<=wim zOiS`NzF6frn;4jdQHj<9Jj2bw&42ziD!A1ihNfcox2>U9lp#+!`%RHPvMiNHGf{~; zh7V?^yk?&tcbw@8axGs)80L zNBIen8d+Cb`wToH27InyTArAjYs$*X8eJ&3k#rDm1Q!e>PfM&)!xV} zKy_=O`FFk{5%y|;z-X!wS<-L7lkV<5hsy<_Ds}yZ|5c45l_5CP(Nd(G79(K&)SR(0 zG5HHb8aO)H^wPof4U|oQE2%sY1CbU8(mdANKmE4{9*)&^&5?&3)ga&m%l!B9Btuyp^M=Ya zE-tR)fcbxZqkhsCI1vBbZkSuhDEJWQ;Q7i75fbk#Be7(Lp+#Ids_C#FTA{h6#QO5T zicX$+k*BY{eHn%&!Jj_mwD9nkwH9Z$Lrt}Z1hBD0)(#?a?X$(s>Gl$G7?Q4_L*LyY{{c#$9$ix3% zsa}*i2gyIS0yb6ZnEm`+pE}cTh*_2GVg&{+W7{_`=UTOk=wTqFYPB;5%|_Ozk{S0U zQ)Iv@w8#^bZWZtn(?BD}w2(F?DoWxxQ?=$~NY86MMpOOV^Vpul^1yTiWG~SZU|$91- zE}Bs-C@ADH@NY9jG>BSAi+>v01l=2VMOqj1 zGZi}ryjdwu%=r5aOD`OE^}#Xtns)#AI2=5o3TAXF+1pl_50{ON0af#>tIJ}l!o0r9 zT2N3B`UQoB3E`?d(CL8tubv7MPInwM-+=H22Oq~A++|IZzrP=ezZNqBQ(>aG7#}ac zG!35Cd*3ZBffnb7{xmc+uii(C-skudN zyoVWJRH-hT!WaEH4zze^sHo|hl@KqcL`UGbs+>-j2dpPJdxEGFIx{d7ELJN{QKrp6 z?vz6s!sfB?)h9@!q9Xv>Orcg~o?bD9>ZY6v5}b>$i`CTCjs2Ne1Yy^=Z#3_J*jh#s zcbCCAU6qcYlIIBi_H2DLU(WO7nMsuU9L^Kk$MjKMpML$yl1Y@ZVR~@r{dcCPrw3+M zfblndlKtt^C)hd%9oOma_3y*re1%mTMtlc*dqEbHY*bWVRjaJH5}~y;JTwg58Q|Bv zdgY&;ZK{JsM;N>etCWaE8|DTOcL}AEot<57w0i_R=Gy@NylEA$JjEo?08BYpUXJ+* zMR|Ea;o)*pucNx({O(N<6%!j%q9X5SvJ4L@OE$Rp%VjEDf+ znI6D3W)c)Y)cFbbkws%alSz~*Ziij2xj7MwF2S?c=T2KKA}`x34>pnTDWIs3`xG84 zMI)2I6&mu%*8W|AL$5TTxZqX>?PH;46?`Lkg+2h*@&u|id^Tt!swybJ1uC2R6(A=D z$-MF9ru+N*tt6ZllMSxccP8@bScM%Rn|C+hDE zFL0n^O~P%is3o^uR$dMf^4F2H3F!%3=6IuJnb6x-$;R%m;sR4YtTP@yUQV0284!%B z@&%WW5s?x(L+bhTt<*`}R*HW%#>l&``I4ePKeDMMv8 zc+llmi%AYVSZ{4_uVuaj_XTXE0RS;&WgDt>#Vkw3;S6!ztbom{ur@Ugwq@l4mG?iW zfVq;g3LV91Y6@#srrE!Lb@aj&iUzn*TwEyBk9R#eku0GhA^krSLuj=g88EXjB)>_` zd+-U?sh5XO^^;a#!51R~17-$>Wak9~Cnu-toqZi8`2{ajAWYpdHZHa7_%~2wG}rcB zc5(f9cF5$vJ_x-K$wi`HYV`GViZD|HB@TBGy~57ko~V8QeE$RK_3z+AfM!1CgFKc- z4b){l%zdjK)kCu|?p$fQx1gzFm70UYB8UsXK?n=J)VaF6K9V&CL;207z^=cFj4b%{ z$@%Hi@Q8@@&Gme<*~pln@89uOoi7=4!0i>7@4^BV0JGIVL?CCH)oc#dpy4kgdi%AC zWmBF%J>1^`tw?oEji`MONjQ!B%(q2lMClq4IeHbCEnbS zkdP4MXzXv20H2Ibk$#!b%KGv;A8l=8GVya@ z8%Iya0{aqF0nZNhpG?NFQv?>URM@WvK!9c zo~BAXyu2h}5oW^@a_y63mk{{Us@mDPsz#_@qoFyyvbB}mfA2Cahls>u7-neq=+S@v z0?Cgu-|~brkZO*!@?3fU-m2?OTl)_uH+Khm=6_R*hP)?&iC;k15EK;DTZTqxT%(7q z=s4Ah+~F_ncwy0YvAi6T@%^rUvB#bCcQ`e#kG4u(ju$Xdthym8x;0pA2EA90B|IDm zIcoNg9oM}N67#?hEqlXTnj^^MbwaOBc+SHz>v3HV)-BW(?hJ7k#k}tI`5|E*o{tqm zcQiG-Aq@bCSXD9m(G39llW!PVird8BG_y?uRS!|mBrO(|SIpqOI^!i-1kOF)Bc zlR(7~^-F zJ)wzyxxBJc{5W;#b>70csXsk)8?frIJ|IjAWPf=FoHR%g&^VC-^8&oQ!1rseC<5Z2T21D`tQ&_&$1Kw*1;k} zFyOfQ=@Yop!TkUdEBICw<(gn(1ULAT@?*aMt=35}D$a>%1M3h-0iTq+ySodeM3^uV z!WnOh4oqa)7#v@>s7F=a<@vRbz-L6~TKcqoGV;xRhKv|vE61^X8~g_mtB(cd6dWfx zZoRa(32E@>p{VFeiNj*!Qy+p^51h1ry;liD-Ks|pyhvyyPi&65ZD~1kSdG@aOufKkCc^^1X5Jt^S##sxz|I-qPU(Om1KS({bFKhXYtlI*(-@& ztPc5nX1rMtmLMVf7I+d$Nqzk<9$l=iariR6xl zxQ@V|ovq^j<8q3M(Q)W=!e*#rth@3qC<48(Le9DR=uy>`t#?t z8`q$WKfYHBoZx9GW28LlY+d$KuX9bE}ur-Qj*(D_o(+tA7eY!gSf59ue5xypDCK`GqyE4 zoxYZ~GnR}Re+J6G=QA~O@A7wJUJfv zxGSIXYilzz1I#etITv(AXh@nl*n?os$%NPqeo@g$X0l7%?`)W>yPtC^-p8Xm%!RJD z39Xvu=C;s*i3=Y-0d@6i_z#L=ed;T}{)k1bGgUJy$9-gU@$e8mZ#bilen3O5_apQv zl7TYV8k@sINuwauwf9UWdVtW~4?~ao!Nq|BcxmwL8E|v0(dUDIo7&oeG)^l|^H=nj z40`z^umw**DI|5T@Wi36#4GFKT^}>VD=TOsDRgxsn@vA5Y0x*99*|% zir&Qq1vH2lC^TeE?>rIRetTH~ttNk9`nK_HSA=&wN;x-|`PkKgCtO(*23hGQ+~Le* z2_eZ$P;HrTerKR@7mD^bmjKnU!GMuQK|uj)bf^jRj%i$RM0Lm9RJgkw)YBss_?#%# zRuXXQ`LtIwj*c=It;P%epCfgtIX1F58*GT*y}y+1OQULd*U^{f#x;1#S)Tnmk%i4k z2|2OJ%3S?{f2hI)6NggH`e=i-0f!2%IAu(dT2l;4nO=e5Ozur5ksfKn*hmyqqr-%- zQ>fuNV=1)Wi$$GHt9nTki~9l7f)LArfTCfNt|;|frU-!KKKB=Xr0#uLSzaF18v)2| zOc)tMhAOV#)AI7F8X&fIb$N*Vj0JxyOp>myf*&ze9>4y);nKd;YLhirS}sdimM3~J z2AL!K49v|P92{)y!S`34>wFd}EQ=AoWa~Sk*xwVpc%M#;G&?rD_PGs~q-n>mNELM+ zfrvw4lHMQx$iH{#6~@J)OkR6RjSdWimQk&y{*VMQP84J%DMDVW&}4@Qxf0*1&u58A zDxB+9LJ40cI*}Ty;pZ0@9ju@Hv$lPun4QI^lJ!~%WxDc(Pnm>!hBe&cR|bi5^MRoa zqavDFp;0x8XpL3eqnKFvVo#9jq9g6@>kBp)3v!BfcKTgxkHkqEI>Lq4dsSOVSeOPM zp~#uVBSFihpsAhUB$hV3eo_t3%*>LSn(E{24e!Ad4tw%^m_A=l?zQtwFKP}LUXvw8 z>*%`unO|)TU447vH9G}3fM69nz^=$#NSQWhU`|A>w65;b6^(4NS0~QNY6lF6 zFg}WE(kH%26tVc302&jl3B+48b2(qzuML>1aVC^3U46%0psl33x*Brz;bB5{_eYen zQUf^RXwqxi5#L%~TK6}nbXEN0mxSDI|0o)ZYMm#ukbw>5DTPvo8B&>zr^&{O>*1xXy#qfq>)x~a&F+ewdO@-h^{SNSTwb$%zPmTQj`B>Fa@o_vq<52hF zUaS5L53CQ)%Ejhp>GvMhce9ti#m$70%TLl$TZ_@FG5rn)>rA2;y+Wpvs)NG~oO6kvpikG}K{^9w&a4w6dqM|~gqJs)L!glG))3Y7Rqtd!E!PgXE$;*coO2@yorw& z21|VKYo(S>)T399V@}07QB#qgBsnEfjXa^{@Q?qC@sp*=ekYYk{nNp6@)E8T90os> zz7yk6VR1p6g(ZA>;hcH7Ik`M9ueS+d+gLrxT&a?v{nCn&Jd#(ci%P2NDN-R0-Q?*j z)6j)mlL{bGw~@cNU4#P|GAB2R$dhY;!9WcFu2Lq}x#3(UNfw#L5+Ov62LFG6+k8-0 zx7UZH|J~mZr-!sZvl!LEyFZApEzDf#Tr_x)olySp1k2aPGl<{_LKvS?&5m`J3jA!< zgDc^&xJye)AFC+nUxbqvrdFo4J{@7f_;^6%@m&&kZEZTO7}#*R%#nBQD9i20pFuE& zK(^hHBEqY?@$f{*Y1ZgJEA-UjHa9z@b7D}KxQSxM9>MTk*%%CYNDK#oS`E*WfoM)5 zk8{&cYCbLZ=gTbt9*UC+nrMYgJL*7odfoEtRFkp~boFe*vzS5(bL04Mrh;(ao}Csu z)8u@`tfl>pFn2i(Ic~*R!1J>-dvzg>xN?V+Bg|AQZeqn#C?(;}xen483k^~W_G>UD z3{v7IfsdjbVo`K41&kpm<%X{5wH>i^?$d$eU*3)_ZFt)g6mN^E;i1vxYHLZMjnbVg zrPnr$v~s5qIOl!8qlDIYtFH7n!#^4sHn?!H7UCCQWuAsXY~bCO1?OSC!7`hNXFI&# z`HZE1uN@;~!{k-W=|sk)_eyaVn2fQdwH@n_Oo~9_j)uUGwc4DykV46*%gQ}~y_#eC zspSXIy1K+-ea_g=mrfZox*`MFf7N!nFlIU5kiSV?G~m;t%&nFtCa62T0qQ~M+8#SP ztZZoTUru|VnZV*$D~LSvVYxOPb~yNOHFw+hP>uR={)7O>b{Acu`_=Fj4Z^tBpuCGc)4qWZT@oISY)UT6mUC9J|IfE@hZdVtvO? z23KOOvE?b1X)GWueV}x)y-~1zZq3WLo`l;l$$}#plw8(9iqRIBkcy6{X#zZ9`n05F zQ^74P>Czy3$LhygB#fEONZf~eEtG*Y$^sKb6pvycO)}9>de1~o({!rF=HWv^_yu0~fj;FD zYL0hTDJ`O5gcVVP{sIL#llXbk(iiRUS2+nB^QXu zv^j6j5kQOh`peY-s2W9b1E;@?EpuydKfxlIcsP6&AS)P+Vi9!!jn>s#J29jo)c5xs znUUsiU})A87t0roe|U>(Ct5V?)pmr;^O%vNN6e9N(>q|}FcpndhRhLvvTH5yt20tf zljqGOj|VMEnYDeKllaVDEt2SI;Jq6GZR-+e)UkuPTT&p1d zLQ7Y?L-EV9HS>8TDPS2Bd+*rh-z~ML2)xBYqP_TpuZ=QPPMb?TUBFMu;Qj?qLkK{w znODP2h8#s7z*s<8w|_bcnlst8C)hdz6m|PH<_0`mUEh{>CzO3WJoHPT64~}jvPkAP zTHM;xzHpa=BCE2J0ZGOyntxcCnWqVL^l>R2VS$0mZ@|d^ z0D`lYCybQn3}y5CQe5opRH!Az>JKfW+Nsf6dU_tXOCE0zjtUilIB|An8r6K!B6{d` zl&7w6`!yF?1Sc`0U|zy+h-B-~Qkg^DPft|x!~V;?fNKe3=N?5uMLjXGs^)d{J61Hl z!EdgJCCB{0k?EV)!n;51YixV_V|o#4&-Q;z?<7a>tZ(rz^|*BHY;-YL{J~Y+))=aT zdQW~}gT4?#%@yS5ab8Ah!)GhapRNf>I$h4_+A8?)zJ?j_6yUH^Gx_`rYU`GBS2DlK z{3MZG8`duL{!&EQ)uVc;=FInQlmwcOYLfRPrA~j>Ui0n zUEUVdTe1{h{lcVvs@6m^kCa$YZC6xoe)+%8Sh8O5FK}zA>dUrh zqqA24`V8*#Ft#OSdf(0$*BoDqMm#zB!kOloht^dj?i>to#j9rsTivJRCkzgPwjx~# zMQ%&4tIJ|?YJUVv*7MOg zZQZ6wR4aI@9t83r5FsZ0g^yVvk<+JYC@ppQK_~ma=QJTy+vxmAw=Y`u&=b_dpAu!n zqS*AUHo-kyrK&}OnbQA%i`_i=8Ns1yZ&MzC|9rMq^T`(K|DM9&--61~+>ak)P_yYi ziz_?N#%@y$R$QVcZ#X(w>cWbs3~VGkiqDw^1$nZOUsYb7?Xq%S97=lmD+y$NpN9QZ zHFbP_4~WsSi|Ib|$D8MAK6F1|Q&WK}&#fq)ghu@7Bnk^iGGP>*p7Xry{D1u2wll70&Gi2mWt$o<<0}{p+2EuO*-x zD?9iE%Ec8=Dc0x@`%!xeVou1Vxj9MGmNZ~#;1YCxeWO032SV2YX3MPg z_0@=>XJO{f9Sg_bZDO^<8F@F!;_*Oq$R)w6-;ak+Yk9K%(#+KaYs!bmBaDu2%}P)= z@wLTWX}#I27~I|0{d{G9uwt@fit)tPWW`CaS`>^xDF?D!huj`gwi#dkY|9o!T;JTR zaC1e`ou+Q0K!$?5s9KxWd-GI^fY)cgtS=UBCLUo}M9$irrX_jKP7#N4Ms9i50p$ah z(S}7^)=DpS@6A+?j`a0)_r14ajv@lu^4Pt)Q1Tw~``thKuTM_ZEY;6(7syBaJ%eUR zWB)epWa!`kF5a-B&0Mr{n)C!oiCu4>OSs0(o1QplddvfzL|j3M661D@ezjJ;jr3zW zZMz8#Z#soI+9pP9CtQTBt;*0>XiAqu&kV_6S$TOg-RaMw*P>1szs^A^C)upeCfG-j zkm~Ac?i#32%LbhZ@V=s~IYXK>pPvuJiP=UFeR7eSyZa_&4qHA#u}aW%1E^{Gbo617 zG1l_#-BW7#PaR*Sheg6|u)v5xiU=r9kE`@$fI}q-#1##c4WYt;G3RvY)yeLOHwXlB z@M}xG{^#2Wo;V%)_jxrnnVB4{(Q8r-PUGJcxYKAU$wQMBmAT>pe*q^Zds|0tg{j!Rc~3N?7kxA2b>V~ciPXB2AJpzrP$fn*w{S@Z#E?h4(5L2nKiZq z*-Vp4HaxNiIy!cFA7>U8Hg=u?Je+A9W5Re!PJV!f#4r~B)W)6n43he}yylMB?ZKoz zmN4{9z^g^^XldvD?Pl;Vc+ohXrD@mp#QMoF_}mueUeg5_t!MSAi!|$5P312=Zr_IHGQ^|yfx_0Vg&Op0!Wa{&CR?5NSvT5Agl%tq5RiXIDVWf z-|3)e@0x~|&#_6RbqxXl_r9A$R+nRc_%R8flz|@I25mbe-)ndz1~e0+195jw2G)A7{3Msi%wJG9;lp4J05sV15d{6i8~Q0;8{V?f7*|+ zy8f_Y-a1Ab=2c3rAZZ&lk7DK3_5&$DvEqF-NhK1gkeXq3;>H;&Py4x@(ZlJdp zM%JGW6o3L7Qo%C}0Vg@;mzIjaVmmKyZTDHJWmmeOSxciiPOt9i-Me?;(4sH0#3qY^ zTtQPop~-rM3So?SV5K)O1(Ja3no<`R20ncO%k>$Og=LXPP+D%dxdASOcn;LuEI!A= z(z5zRaa({=-1@(~qMK;+XTCi$?URVFI5vNvX=}_|;~ck0!0}iX+SrZe5jI%3F#SNJ zu~fU(d0Ey*e4bfhU<0%dunYgK?Lf736Kr6GF0}SV5$A`?=i7b1t>)R8?0|(UrYAQZfmh2y=^ztSK3?{)@khuUu)etv!K& zz-RxvOqsqJ0}nV&T$?s1VX!v4?f~yL_p=h5M16k#ZC#t{?CAW-eB)-ZeN9e9MQ!aP z+8}7BPoih|kbCvmqYXxpK~M_B3H$WtGvRZ{LLQa`^MnIY4LLouK?qy6|LFXAuQdXm z4)oxt4-_1K4nfoJ`&BL~AtsJb#f4_74Ie(-dw=zjSQO5*7*a#W$NdBS{j5LTxdYh& zdt=UxS`L+}^S+~BgHNsOfWl_@7~Xlkroy8 z@U*|Kty^AE;l3AjsRX5#CSU?%Og{bm2%+#oVj?^!dIgXcIJ87C0p{xIwgJ`wAh~+1 ztBY2H<|3c=*Me7Df0xP)1nSH987^LgFLgjTC_^cC zVnulADSc#D)Fs9I@xxf|H-fav8!gFlpD*{{Mw+9uu-#UNrpW4n!1>}!a7 z&{(7OUXrHiV?n`)Cg!Sg55UEiov&l#-$>V%bgH!tKhP{TX@VKXQAS^!z|8Jym{PWq zm4$)=aJ~UV*t+-}^{q1*wO5iagD%wy=3zk8F=K3rA(0)95p$mSezezcblm<{c^Clo zp0>KQh-Et{zCu*{O6*hFU#jretxu&o9=Zqhn!KTOEciHBZT}F;9*79xFrezfG@N-D z2cYZg>np%0<NlAp=Z+p);+iI_u#MP?w^UUEB%VLzK~H(L3TgCxw^iw=`dPb zm6Kx$%Y1wY?{!}Tpy6Sq{lijAHE6^$F&Phgbx|!Hef3H~_aq~E(`V>DJ64C+*B=g9 zWdOzJiUgV<4s|sg3!@=H{*@M&IHxndwa4bWuBo6o>Pd|311-bBJH`-A`U_`5yPzX% zXKmU)wK2WPb;KH74ah}B#Z5*ERirG)JED~|neU;Q3xJ~5b1S#O2C{GOA11IdIq3(` zLT=y)AGV>0-~andxTxMgk((F0|M1~M1q%zGyQiW|WQrIzNGZmh!Y;yL*VQfe!gCQS zAX^2ckyc^|r!uhpBb^Hby09R23crSooLQ6DJJcKzIHJYmBnU8MG915s4L zyz8X8*vx`qbR{peV)|{5hlaL&nDjaRdTzi+!N2T?#gg^@lLo zOh3uq!DeWAXBzfM=)s$f@~Y1-u-*_}aASF93ZMMjAy_ z$X29zg>Vx}$Ibw?r7FAjBX!Wn7M`J{Ws{VP)+HMvtg1dmj*RqRLJWb9I@N24w_mu6Y|^JK__{s z<2Dx_eXNSr)gvTJ^1E7Pd=!Y8+1abSym^jxD5W0aic(xzY3|R8g}`s$A|fKP zWjAwjpFH;UHPfbR5`eLB*THQ?_g|tJfhIB%(sAE|1D^JwzP>~ylvp~Ot`3U2l9Zo; zK`(nh`mnwp95OR6J;&#$5y=`$_;AkTPgDcyM6&DS=*sx=Dl0wU6vN}GF2ti3#G-O+ zPzvQ}(aN$45VRu?RGQsrXxRL=O{7>eBrNV7J5LaDEXH5lb6nW^^XqO&$nI|L8_B)B zz3XjRJol0;2o)k~w$|3xwzl#LO3{{W*46cp(Sc)dg2fR0VRC9xJj#r)8DqI~?>aYY zG?24!Aev1D!?XC>deAh8UyydgYhWxRC2K@5^o6HXz2yRo-O7bR1%U89k`rYX#?j{l zs0jn?q1H?|=iS|1ce}CCp5OWR&UdW=nVIux&fE6kLm0vSvQ}zLGlSSSIJn¥Gmf z4xVbNn8`_HAQ=Mdnh(AX*b9W1pl{v;A91&>^}!?ykSq{FOc+DDfA{td4KcBXe6R;_ zBNQD@6mv5A6^}sR1>p3tq+*8&1W3fe?ME4~w=@$BBJAM0rC-fJ&NeVYQ`94lEvdt0Eya1+ACouz+q4*vSp+ly*@3esy(GCBdh{*AceS!W1%^oFMxi0`AO;TKst zFi`)ozh4H}e+(=NoTT8lLUgMFP10n&jsCd+AIcuyX6v!Aa@g@OiqTY44 zpuC49tTAFvL$jYm?I#d~W!Bf1=CuiR01|yvdvG(#1f}3rXV`Fzf0N!e7Ka}RUE@g` zo>GPx{PfgX)Gtmvrz5TK_^SAXQTj7qUSYkTij55vj>>UBv*4VY1Y(?@cr4xT`tkbs zLcf?;e{F9gyK&Rmj^LaIcm_1SKv;ky56ZsGo_4;r-DmZ;*#E3}0?3L8reKesiqcf*LHX&e9Z?rvy%xt#5px85QQY?DF7R#ko*=k<$bkE(0U0{Q7L(Elx zI2iQ;Dd#IMZ>Fscq}#&6!Twqo)ch2IlV9LRtnHCS5y=9ky`n70ZbQ-l;H(@+I#Gje zXsmDk`mf(3cx_1XwYAN#TsWXRc|qS!?wST!9SE|;lP>A%py#6mpE@%YGLy+!4^`MO z0$!3YzqCR{JDhYy89Kj@>Ge!&1J0BLg>C_0$>Lkz*xurei^d z8W8W-iuGa5LQLQxqJV$wcBLJox(%~=1^8Gf$-UCKoqiKHfHwLYCEsZ5=(rTpCF^Ko zGwzknPN5w4E3LJJ@9_XcOPKcE(WX+RcpDsWu~GIUI$pjpLUIneO1rJf$2ML+lAr0PS`N0L6kOz7;-#Va#riKk)oq+9Fh351;t+neH|% zX%q=HApG$0vOq9F;@7}W`$zvKJ!LVqc8$*#%)KP8d>NZ|L2}0`y^S*Kp!gs5y=11Z)4*O3Z73Jx_qYxJoq zW+i-*{j0d%;o_||T1n1b8j~WXo9cysbDdgnkn_41SE_d_% ziw?VUQsjOU8rsGy?S|=>cS=f1wZF_v0eYsuOx72p`08Y_zG@N*bBvh@#l~E)cd4HjS^1N!5srP9i{oz}FUtlaDj^&`Y+#pd_la2fE3XT<;>Ap1M5EQGFvJBs&%$a6Xc=m?s=Y zW!#ze&8Zcg4e1^pHqg@>80x#i6(7gP8<#N1YbY4_m3)JfUj5{YZ)Goh@Xzy@e(Rp% zgZkrn-nf3!u%sYxpT7k5{bVI3={JlBB|2*IoM%U3b7rBgrsKM=N)>9M5T=+NhZ?H5 z6pgbdus%b?07`6Pkx`0+ZoH)>0B>Kln6{d0sdB~c#oXyeQy=rouzS&JXo7s5_p-V3 zvZwI+!I|D0FOptqvY%3OI2rJKY^jnDlC%FK;I(yh&;W{XQ2EVN7xGZ9Y8w{m(FW0T z9b_{38^O!ppOf{jpH#Zice>MRnyUCaE~fDQO#*6kaxZHKjkTW@TWkuS@xFQn(Q}bj z4mASHf`P~+NNtwF6-At7ViG@Y{qnj3`q7k>Q-ukVQQ33V`8*+obfn`O-r`XznQ(JM zISt8dH%y;b4bOV5ikesv3$KImL{FHpOxXw$<_DQXcHNVkeeS19+x@Q7Af7Kg-g%0| zmDq>mD98QvlA)(OM{4q#tIHYic))`%-;F{7kQP$~NhdEf#8NW*Xqay^lC}j^~mH1d0Vl8059Y=W!47M;YH@pna zZ4{B(UF5~&d@|#yrmyvmx09R^PJC22XS6mY>B(C5*C7E!PenyV_XqvZQ3F^)ytK}B zNs7!|P-MKWj-n$Sj-Nk+I<>k5d<1}v&^N_jy9_Ffr!*6BCnHyzi7`ANen$hBt{})7 zjmzr3BlPK7c;Os2=My$3H}^Q$8svm!UI_QytFXY3-ge?^6KGGrMXBb(_v#zD82p`u zGW0-(t*PXAnjGz!;9A2Xl1vM%l0v3fl?gVakoVZ8kh7cTX}!{f`MVEY07!y({H|T$ zi;F_L+1=)x9O0(mIfFAjt$F7~Ob%!%c)|k%2T9I&G{p8eBg3;iqq3QRuf=9DhTLWX z3Pcli^_UI+Mcl}uebqIsqM~BPL|#x1`n0wZR9kf+OSQx696n{pt|3Z2{*6|PV^{nO zPMV@c#(#fYj$aQ|%sw``X^zX{;fjZ^&KmtH?wu_*XU^yPyR1oa;3@a}_z2{*LgiI6?5#=t#99rN5YuT zcL*Sx*h_)obw&c?3lhH8U+8~oQ1+m&FH7yx-TIiyMGj&bIJBDdO`vhoxo`!>6HYik z9=Oz-iR7lIhItHTyJa?a^Ut$~yR++E4mXvGeW{oY>#%Y8f(V0}_5~1(5=xu`8ST;n z{$8LrG__{-VhPE?Bu#pz=kQSD>I@xu=vO_Zz(8++2<aW$WAP%Us!O(`frnLWYWJ$EoC!@pmy{UGpi|Spg>;v&1xA#1_1sIV%zAPaDf%|c&%voCRh>}xwZCTw;-`0>gFVaTh%3J!I z$NF}8e^xsKBW>-qq1_D#{npu(lv5~H~cs&;fhQmlBQc>k{C$OmISkZ=4*3G`|8Y7 zWcnlZTDTTqE`S8#33;;; zM|zt!sFvhfHFO0101+Q(49|gziPPW-n)=08=P2Ul-&V>%Jz6Q&v-}jGF5y#(#<_ep zWrP+PkgkKU738=Dd(?MU?c2UN|0b?%KdaXei&!u2nxhGA!VC@FokEzWvG4mqsld;8 z?Rh{_=pD^F@h6nybQI1hfXEMDVjT`_&bXMLhT{Y#X&g>NEo)cfy-4vWd~feMn8g74 z@+xcQ?O$r-DY3;t2zh9Q9Z>b+h-==Oj;p)RfCC!BVD6TDW>Ld~a9=*n;Y4Q6TpX%3 zoO3a_QIPV! zct&+k$%-k2;aK^RnBs+Yq;wH~muc_nJh36n8qjsHvP)cLM119LI6Pc3vVNk!X1ei; zA!0)l@qEicYJ4>CY!TwMgQU-k%FvUyZ^;D7cbQ0E6)WDUCR5S-t3Dy4FMRl^G>Q!> zNc{G4{^=tbugU4HOE_))qdeRsnaZfm0j||3K|c5#YF3@(_xR#m;HmQ*45ZGeu&Gyf9b+h)piJ_TvHzH$nxMU- zR_lK(`(P4AAgr-J)}-3js1;&SVI_1?Q|B4L&)QdJNh2)u;}DWjO3W47PP)3zhRC6m zwNR~}^S`e7aB9&9_hd%hFV&!T``r5V7HV}ar8yvmxC7}xFd5koQfoYAo4}8INZj~c z7c5x_Y_k%(;oHy142%!F?MI!{K-prW{XvdGIoyWX5|VL&COv zR$aL-Hx3_f+3&4Tu6)!=;lkaZyZ@g`L*4mvr!&P zZ9c0lwhlw|)lRJx;pyHj&B=$xA(c}`qKCVmyhUs$w)cNvY21YQzwD*Y-S5as=#x$L z=)kTQ3v(qc-)|046b$7&TP}KO^u%E*wXikg@z^33nb6#4A_s>Zy%)OHn$22}@ku)& z9pnh7&nABQFYf=^-d%`fe_B%NQc@b-dUK72n8Vk0F_Kvq{Ukxs)c+JmQvJ?vH`?BMGn)`<916BuH_3qu0)6YD+NARq6QX=ht5Qvtu2xA0-QE|I;=oOpq z;`k?oz9}Kkb-Y7e_mOw>bYG~$v#qp+x`tE=guufGM=QzG2im6)h~m`_qob*DtV*SQ zJtqYMu{$OE*!SoHLxaKY)a5NZsjV=786CevY5Tc+GEphU-+g=i@g2fNWBa(rM1R+f zzU1o{Z`x7S>kpq}h%|0h71J@$Si)M+k>z|9Xn_GVe#(mnC`t#e8Nxb}cX4m>iigbJ8s6dhNp=Ct*_326`?LG+`&FlX6|FW3 zJ&Z=Y1#=jX9z7)uN0aN)wm08LAMUpHSvdVZojzLOV0k}kyC~y`OTc@oyyb#kU;6eB z*(F*3T$mzvxE4y35muYl2qmcufN`k+Hzi|MzZPKfj+{0p+9dgFU7bys5r3mucNB>7 z$!SlgB3pc;AH{GX#WI6vtyk)zU1>;As=nAX(M8}!0PtTw|V zcM}=JI9a81rSrnwjKi%uk4~@2)g3FTeUrHW<#!yN9MT-mIX*@49}Jaa_>VR-3b3$s zrMn*OX#COJ%AjMEn&hZj8EZHi>FD4!@}1-t&8V?|<~fXCL9-&RpGF|Q76+IZGb$hu z#zcQVVcUN7qnlf@Z2Qwj{0HM77$Q|R=KyB8RYCFSpv%4O?+eTiy?_EkxIH^|o z5m_w0^-x&_1zcC~s6A?5Rb*`E$NK-f`mHm%Z+2Qu@!zc{qs5!$Tf7|KrL(8`47_{3 z*NJD}BZTPkVqafXxu4F$_56!Z$Emzsq5EPR+hHdjjn+*Zh&*JWr=$iR&RbI%`y>Gf2zFgxRLiCvVIT10zd-;J9Ia+Ju z8KWZ#+N41-RMUL*`&p({HUz8pe}A*xKYhaZ3ZXKwaPFs}cfTh;;_G}7p=_dH!@hzJ zDO)V|==G$);rW`v+<>bxUbhe5W<9o4$d`co_Le;T;@Ip*fcneUJ1{u8#rZ~tGdbFA3;Kb2e*XTr$R zhzBluX`B72{!+=>Cv67lZD%c)kcLK(1wFOCh1*_ltinkf_}TfZ6)ddDj=8VCKU$Q^ z_xR+$xlZO$-+x|s#QlA_@8LAze${;WjRE=_O_aD8*=mo)EF5pc1mRubi0*q`>6U?N zn*kQR^rv%d{i3!;s}jX4Ya8XhBpX_1I-2k19{Kux6+Rpwzz;pCX0i4-n-X8>S>kOq z*>8Vga!yZr_*KZuQ%=W(Fc_abKWuaTMiNn)da(_6^jhDg^xV8 zGrAo`e{Uz$s~2{?FZHV!|7hQDH1?;)d%ei7=J06rX-j$KexBCTOW|#?Z~u8@-!-?g zgxB=n8+DTmR+IimjU97`OF5x@zED=4nj*d4-$U1jPYS5IHhMc-W+x@k8F?qDXjBo z{WuTFZu@*-aYGT=*Y3EZDvR~}RGDGo?!uiWmIf?(smuNfRcF2TQ)f-%u0NWkyM-83 zhfk1=l~Ji_m+j?@2G;{r;HHoG<`-MG!7{5PizL~nc+QXwOH%RL8C-)=UtCXj&!iIZ z_3*#c+IEX2#yzQm%?C33(tOk5x;J%Fla9QG_I<{@wzLoeGLDBk(e`7I_;(ytJMbZp zDu3|&)n*0WU;79~d#w?lO8r;dd4p&jd_B8Me3lw)X4B@D4z1pkas;vXi97rZj(*m2 zlEdx*H;Z@NB{*C;9H((%-GA06t<4?1{4{W>_d_mm_v_^OB}2mmz-{q8ozD)3Qh7E* z%E5;y(i}f_e*#l9w!|jr)mXYP^GacEtlD-qO|l>S_j*$w93939zFOqJJ65<`PAC#T zEUDBTT-kNJPyU?JlPAV^waai+WVS(g(E2K@cLzP9rw9GwGANbAhHS{`$XLY;Hg#{=8J7HN?}?YL{_KA?f*p?@2_h-<4oaNnuN1jwZw-0d^*Jg= z9xjl-_MDCiTVo}Jr6&>Yv86?hQ+HkHkX}plTQ|4c+pD}!`kZ+6$?8_ok;dpW$)Kd+ z;T+Y`vxy<@MX3{zeLUJ7y!-gYq1V=!UkOjNxfDIZO13_i?puY`{f5m9M_HeRFzs67 z_UlWc-^Upk_j4M_yQ+MzqjQfAvrlh1D)!$mJDi&;EiZa$Hf-Nc~jel?OJrLw~94riu@QQ`_#wr=jx(za~bZQJS60e(ieMqWX% zj(VIS<@)oqS?5kADUsJf{K$uUY-9HMbiK_`$*Xk7;LodPKV7mvbL zrxbn<9sLXS9ta(XT-)EiL?%~YHbTPfslM$)|7~$~uZyTCTgD<+wfa7zgKg!2ffHsF zTCaE-eQ_`8W*ibQTrXOr$kb-d?CnwTyb>zc%+cw0YS9IZ4nL`E>o@ zQL}u2uWd-lBd340RZr0l2ma)gqi*Bi%g&`W6 z*Y}!KUMv~9{JXqIHucnhJC&v7p-54!E>+qVn}N}H_1e`H=waO0XX*0mJ@F2_NNcwz z^8CICup!>Ai}Y4(*+gY;_9Ygy+}O`A5&5LlhWjlz*&^zFhYIm)5A1zBEE;t1EMc1) z^?tb{a|mh@_tgcKp0&lUeWeHSE1tFP&1MUFE(&Lt$n`%vHHuHG>N|Hw&LLhd+1c%X z*@|du&XC5_-0HG&EXo`99VeNdKb&*hs&AJbHU55w#JzAIuds)#P}nV@DyezQ;mD#@axE&0?4WF>E_mR`&4r(nG!OUR_7U zJs(N`N(ux;=0$tQ`GHNvCv+n;9nKWSdp>6$IgL*1xijYcuJGHr)cj^cqI3BcVKvmk z%4nlCrG{OH9=|)Yy1rE;J{$W4!Bb$1!*1rYjcf=8eI^>Nmf!VzIyQ_#Xcziz7T~&A zeOt~RZdXwZNI6aEoBYDW1f$?l zH#@Z?+x~j@>h}-3S3eXDg9WE0xZm!pE6bYl*#Lp!Ojf0#QdZxQx?Bw88O z9U7B&)&E)S1DRG$u^wyfa(y|Op3K20-E?A_^WswftL6C6PNpSiX~4osCFk58`?~qP zd;iIKOPgWmuHo_%hSMB~!9NLSPf0vi^t*&Rp-%GBBv`_C~yl=PiF;l~i>4EYJt!4v27i;Glf zqJEs$ut8U#NVo+Nh+lN4U!lAuLFEm;Vv;_VGG%*Vc+y)|tVaay!cpf|i=!t6KE(RF zEpVf~SrZbO+YW?H*u}@jc&LB5M5wgv=SwdQrq$v9qF-eweVaQtHB5qS;*CI6| z6xpk}nQ9o@L@A^hS+nm9zwg}N?>B#XojJ~V&NI(*p6C1id_IS3I=l`d!Mci{PSHk1 z;PpFouz+AGnq1~vceyk#$jb5DwJIa8uf%2JYtcDvYWRki9;QNJkkI`(Cri^^C>!y2Tzb-4kwr69m-Td=r)oROSPVA#e~sUr zZX7-PaswX|3T4+ZX(Jn}n>#dRr*O|Kp0^A9dT1@hixkH56d4v_^cD4SJdxwvnW@I@ z{?rrF$PMq)`m8?LnAh`!b>mwhq;=+#X+yoRHQ~^WQQC-c-&N6rz7vAFJeXEc3h z=Za%5Z?{!saf==rU}rI{;6g5yAb$+=IKqKc?>o6up0*7ZUq8ZQ@&_vvdDW=&;C{Vj zhsdryHLM}x1cjsUzR>T*wL5%@_M9b90$;M*iACbLtWrCFvdTn+0tK}CZi$$PB5rRo zJX79e-D%1n$OjAOsT0eXreJrY+g06D5ktLs#*K3d#5RqAg_I2ph83kGWn<8%HSD?5 zN+BDTSW+M7VoxQ}1wkf58L!D=KY^C}*P@rcBs)Iti>Fuk%`3Y4w8vs@mx^67v*(aN z3d=G>UKQA9eMcDOUc%JnybE_MW+$Ir4`qI&#S0zNn>@JasuQ%y$l6?|@B3ipQ4M?NTq3#G$R!#E76Uij zxlejr*KS{p+=G>^( z)n5FHtDSOapGilTv54(?g2-D<0n0m4*y;85mnOG3Z{zD-8bby?MDDkCYFO)kKzP`8 z^qFwWl<<_XHVR2gGgEhnpw0~xsW%T-D2O31W-d(YP6?hOtqy-jq(T^nY(F-ZKaDO- zaE+K2Iyl!-8_U00*(ght^{e}AwK2L%dU#vHwQMs0O|1|hU!%GVMs2D6%CQwOEnU<# z!0$z{W};Djw-gL|53W2|{JlaEmd?Yyhkqb$O31GHIOFnZu#zsLSmpf9f!yZGz|R_2huE*>nV!&+o=YE+45k2FOOGh(G ze4t#DsYGZj&lXDPs9^TS2q43aYbA!A-;a!R8~@RD^;nASSt@}q9irp0$2GFIj)}SI zCycJhys|N} zvO@w_NoQ7D_gF=}%iSEU8f*{!YbYo@aH6&DA$ON`kudLMbP~Jq;XDZrcR0f9s`G6 z7Gv+hus{Eo*S!{S{f;+O9|XFhtZaWWl&-w&SuECL949Egw{qvl0Fn9V;|$#XBN2N3_)w%9UW)D_2c{Z)=D)K zkU_@bYle%D1OdH5)w0wUL4l|ta-9D3ty@O1N^dIM*D+qpZlGLh`~bn8IB(evCL%Z) z@(V7OctS_DpH3(2jJtw=7=!|F#l8tB@TgsnaB30-+ao;0fkV`tNgX#Cgd3d=pgro= z5jQu%gT8}}e1M4ryXP#61=IkM15hYI%^sXYCvxbZwbKO8QONT&S{p6N&zH|1xkEK| zIc{s)t#gNAs<9Wvsjmu5Vj2TMf`Psnr=PO|CFq}&K(>TXUk3CT;ftRylys`(#2^Tm zE5yXaL`K$^l_{P0i8W%{kU_jsjmrT%iT3H!+-elJ2|HTU0*f{p$-QP_Vc|3nTZ|9S z=RJ3-4Pvb=V$;rvnTtSLU#HJYKt#&R+pGPUl|oS^RrerP=fMNn?TOqbFZ^U-Y8VI8 zEE*uSL!~zC%^S7lrLckP-V;4UpI8agFMWM|bUG7DyFgU+`lgr0fJ%E}Vxk(=0sJ>U zLFffde@8iM@7=oPX;9Vh{ZzX1!S zTo83OQ)$85+1c6GSJgzstWn}mLe80w3u8~5v8v7ouOOPa!OW>7V!_p`AyVVW76_!k zycq6LD(RqQmizsA+97rhGwCa&+%?HV1Fipv7d~Ub&VvI(Gc~GNt(pM&fUeB#1n;fz zS-O+4m%a#+TKFpI)ic$4PcDHXA2cQV&ydSlbdrdN6v&!_VeKd^NqxO&?UZIR5VM81 zCv-A^nFH~FBG2}hiYC7bg8G}Q@5XG-4*DPRowXy(^Tx*>-le*Gx3YFyy+c9 zWZ>t@RUrz6-Wkch>MZ#B4RM@3>*mDPg0yI%fT5iWS<<*tN7YFS2>INVmUE7Vn?;wm z!yEwDQ2Buf9D_}H54(XnwsCU~1-yRxberidiwZfVT0u&Hb*6wQ)E+k1>zkV^N$RJ& z&Tq6GpJ{U~u$6k)R5RJ&9omRaFGCbAU*b_*SdAJznB)#}O7c6StLXQ`b|r;{ZoB%` zw6)=Yed<`BO;@d*nYLC&F&JO1q% z6($y(0N`ZO($b`1_U~~&*g<=FnV{q-vtU$k=GLxTMN8khIO``GU)dhOBR3YbW9nXa zcrWYrjGZH4{X@^+;6&)pSB~7h8-LXnhE!9WdMUm80&&Np-_Vp{s6HB{zY4sPp;UhK`Oi;z!hhZnimPjd#7lmD{sTav zjllqKxXR3Ot^(`5C_#|au1`0++S(?T-KY2T0DUVYelM|lJ6B>NY*9|sWu<8GJ+|t4 z+-$J?s}EDXz=7OSyr^ePj|&kx7)KqSyar7EE? zJV!>ZcTg!(ya${y&l|sPi2T%{oWX`_F7r0JOoIfTx0ovF9NYo=t%Ac%gV@ zG~BbG{eqJd8pYjFf90FJar6cobBbqeQ1xAj?x} zr?u_ko04=nN|DNbw2-%_X9C$hQ>pVSFl_5lP2HytfoC#~N5R`G79Io1j0GT7Y_mo|w=LsxYKCLG}H<=oi2th+G zE^IB#SY4V9U)LU$68Sw}{s=%ToH8`j6l0gaX&=5Y$erC>-|GYv4 zTil0_ANRq#(!PC==((B1m%%PkMhT)R*0#{%uVBsqog*M2@2z>)RhgCH`3nC{^o0gD zly9%FuJ{ONo{I9a5>^=HkB7mA{oeJU*;L*4jq7g=^-lua8ypKCYUizb?=JQ*3zzQ0 b+~PxCXg@KsTX%=0EP|XcKYfH`>K6AO>o^}n literal 0 HcmV?d00001 diff --git a/windows/plan/images/deploy-win-10-school-figure4.png b/windows/plan/images/deploy-win-10-school-figure4.png new file mode 100644 index 0000000000000000000000000000000000000000..09552a448a0b36bcca641eb5dedf09114b02f691 GIT binary patch literal 18525 zcmb5V1z256uqL_*8VC?H!QCMcTtgtZY#f5SyIXJ)+}+(RxI+@$T{rHwA-I!SJWzgVC!y{L0-<$1|HAay78`*;;%AZ~LdtGB z(2T<&_p#EEHth1jM4D1rtv!k{^a?C!^ssKQa6yLfNhHV*jiV?tBzSsEL7! zL5L~_d5uXe?y@tEd_0kl{!54;tXt8)pxBTs4hzL{7|ct?4nu&rne%d-@}|wQ-L~R! zwsfe{tK|NCGpF66LZ$3oS*Ays#aw}7UURZ>t973>Y+Y08G_wvEeT4(ucL z93K6oV{{F9_*oNCl=Yo~Wk?nGT)ja^4ih)DYlkFF{g1J9A)kiTd=59? z)HDS#>WL%HNqH}auKFp^vjlx~5U?+G8n9?0bz5Cz5jNHeQXLj_I`?HtTZ(>WBJG`zmAN^f+c=#JvOwpF_tJV(f7AlG14W&3EZ7-_VEOT zQENAZKXNYAWN>?@V=1z{Yl?s}2SVs8&vAKt{&9g7z{2g$kcrJ(dkSh*#IHn#Wic zO1+73;YP^fiIWFqW;C8!C<4D4qmrrTsth*gRX3iytG$ zc(W5`XAl8i*|RhMWjXu&{?)FhI+>bcV#U?X&}@DW+mIM1h1<`In$ztDu1szZPRQnst%{E15o zzg49!;@s_FyVd@*_X4fRggqA3-c3kkN-@fEmFQk$s@-jl?HQ_E=bv48{PNS9W=|op`ByTrTO{j@|Wt`+RhOYv*~N12DGv$=a4b4Sj0Z&v^Q6juEIN$ z5{zF=WAey`3O$Dv?v2B=>HB;#+*5J)qXci}%o9gig)=Mj#gI-)O>ir`O`(2>$Ga1? zan1`8fWmlO3?(r;3J+3KwokDim&z3yYwGG|*<@;=q!)JHAGcVx6b2U*P)SnNx}NM6 z#+(i{*xf_lF&U@WQ=B#N3J^_u?#Fs00LNoBbMT_d!kQj5>OH=GVAmf@Fh_I-q`Z+VvQjS`~B_8 z2WX65KDtCW2aT}1HvI0ZdmSRRRty4z`4?5AIv15!B2*NM^^SU;L9{O1G_GhWOLa-b8t?(W7*K2)9Mdv=y+(~DNbh>!Gx?D!W}0XkgXWr0{tD+bzDVL zDHZKJ&;O7_I19b(*SY#e-+}HWAs*iFdaJ(}V$jpxuOj3uam1NnYw3^tzSo+ua*^`P z`_0FdY=}k3enT7s%~X#{nh1Q$$diK=+U_gPpcA;aixhkT&4gxQxs5?LT@eqrOj1P4 zg|-+U8)q<`G^w)L^v?J3QPKvrwOOeNuG|IpE4gzZ7B5>W9NN6D`W}8D95!a%=M!)7 z?loY}S8sB9tAD8d{(a5ndbh(K9qWDNm_$08Y@_Jtp;#=w=(?=7v<0QSYGcL+uSHMN zuAjF{Ts$smo=?#U#>OK=sT&<$_l3!E{;kl(ddq1B#sMkcdjy-XB3~Oe-PirIDygf` zr}%tqDksR{PuMW`wZG(8`fN1o#^eV-{t(el@b}D&7cn0gsfT>HNm%ly?c({j(y9%G z*I`&0tJVF{a0(kM3wkcWPyW^s9Q*ngc5yBmy1J{7L-!O)JTlU`jC^-YSFnxY&Vn^- zw%uVc`{kT5wLkTi^&G#m)R)aeU03rYJM7mGGwry&k3P8e6qC6IHp{&!8kUw%#6HL4 z$_A|?Uh=_PXFNZ#$E}-LgEEZR`}Y0rX}lMHinzs5^q9mJQ@CRnMl8>Q#;xn&mQ|(4 zt;26)f_<2bT5m$RXv9uf z$(~W@Oi&D;V{^We3sO-9-qROCmJS=x(%H-(8%k*c;6g(8kbG!5xd+?MOlOmvP9tcT zAI@-?vqY!P9O_(-6BT(OjUlIO6wHLF@+*O6RKFqNNB0r_yfMtYquMwQ1eYmy#g-Cn zR79HZ&@NHPz`Yq!1-=M*{5 zq_r7W<|HtC2&DZG$7YjnE>pdAW4qRj@6w^p zVOdhl62C9}LmiNgsB%h=W+a9cj>k?~GGwWP@ zoosSRu}!V$r^=6PhP$);L(-l-*4L=FL|&A=xOrS z%9bTsle1;V8eiZ(RF!vqjrXy#0{2VJ+yhZEy$Ku(O+Ms8mwA1S54{A|A0k!^;oT|h z?nkA7g;-N_#INM8Y{Mm^Oj>7Z6;{L{5ujkpwL$7+nB?DYEEo1%vi@oni{_fN4vJf~ zmE9<MR_NK{({ITBTM@t9zQi`UNi=bwhQN zh2cL|fk~)wCRWNhtyzu1fytZE1nz`@K*4^dSN^Nb=8)t=KvE9Z+Tq)Hc6fU`cxvSm z7|$q1W&QWJK^6L>Q`TQX%x8$c>rkpWcwa3SD~sG}IXr57f|J3L;3)2Q8}#efwh< zc3j$+>G7+e0HLJ}Ylc6Dr#pTeSNE(`E|3tcKIbeR+Vf@C)dCTnWtZEt?S6DVat&j} zlGkk|mXZ;0Qb!H*A1G$$=A!0LXmTN#C3=lKXHd>Yafc0=5@n>NPaeb)VXZDI-yyhf zTor<f)iB0h9Z1d7q zM0QHc@wJ&kOMBtk+kRTlJkFyvvF!3#8DQ&uhlZETwK83wFZSXb+R&pJDM_!V7*w#v z8_ug(!`SRZaEaSV=y1Gog=c%9q1ff{n=R^GdLH?;oIP%qF{OB8`zaSm5zaC~W6X-j zCK29f4kQF&b3@+8@|QM5$8F=fb-lT5|2S5}RIYE_}ihR^vx zIdWM{lvf*M;{XPH(|1e>{uYOahpg#7jS~Y4gr1S9K@qRsu7F+68XgSN;C6oc{mmALsc+q$g$=ChYyb32`}N#c_joOxqaZril zg;FhVw^V0IPzFcEG3OKZ$9N|OWxp$zG_Uwo!r<{lFl%d`-vxQW0v!Kmp+$)G4h0=i zt!wUb%rWPnSR>Al3%&u&m!n+6*MiphhiAHj8%W|lJQye~6@)hehMY}{Z@Nw`j|W!2 zyfXOXknwrk8sUUHZB}iNzU+nd5$6Zr_yCN1b2^Ciq#Sjh3js8b9^z{EA8Ya7CCOy2 z*H{myzP5;Yz$yRc-`z@h`RYNX7=e7;`VtF}Q5I4sE-f{2EhTRDYin+JT8=}g64$nnn>RNNvhGhXsiFajbURa3b_bK)+1Td3wa4i+yleyQCT%5VvgVMhc-kH*I^rD6#YuM%IiI(lKd zeO{&sgOTXrBJfGzNTs%y{k6R(6IJO!B{A2=WYkZ*Upyy}!ln2YL3tYG05aH}Ef_E3 zjuKE}Oj_GKXk_dir&BdWWc)&2(g@ahr&%wgP*N+-j)#{m^!8`e-WkEp#)!$`TUWZW zS5UJZqVMT=90Y1>`u7JUY?OcOs6eGbwhhWtz&mJ&L$=yC8*VVu`|{x&On;8pecyD7k{^hgEp% zc6-;$4nJX=ytjWqYMo`rX(U(Lm;DtAJJmSoRS0H`ENMaupEAerFT&|=m~Z_;19lsb z9)Bc#8=)SHLG`GtTjf|~rZJFBGvPeQ^gL--L-;u2xA0;MgXz7*wAHM1;K*Bn-#y7e zbT3aalTwR%ZxpI3>$UY1Nd9(T09#uRpIqUj*U$i}EzmHWtS zad;M2uR-LSmt_K3mVJydcMb`bV-iWTl$`qjKPj%V>Kx^=p#jC;=2YvIglPB6ep(=X z-DGJxSWD6Ons#K}Uxl{coqK2K9jzTmzx_|0S|2}bLk|gb?|(^W-2_kFjUHc`supm+ z_}k-x`(X)9U45^V7>e)0;)~&4D=RBP9tSr7iuoMHfA)K4r!Zdh2DKqOJTgi4W(;8DSy7 z8*Y}C4s~2xexv(&b>VUOSg!pPYU|!vVa}gc{meE4;=dzpNgJ^eomKO^2LE9k)@phh zE;TKs96*ApXNO$2qIGyrjewus54vLXf2k*MKsK2A>Qp;xso{}#>nbXk21+rpFIGGb zUgAj&dwb7nH_^MBekm7oRIm7W)U|uX00aDE_>x^EA%BF z!3Z-O?b?7MaK=UtE7<{bB&qYHvX!=Q0(=n@L~<31>k8et%9~!ag0me7 z3kyN{OwMnMO<=_Bmpfw85f+C`Lf>?!;d+ww2c6D%9XGU%QkvMW)V#>r#^!0OPp}X! zMc!1A<1BfIY=Q1(df5uDuaPm$S-)u)Au%zLk|D)Hl(T~wGBjO!=GQIaHiUzdm2ZDH zVe6CDXW+7IA57xlNQ9Z*P|Zqa8=)&GWVZsD zrc}(dw30f+VGmntHyTXH^`_f7GUX#2U@Pb`7K*`61o#X#ZG~<_m<%1%BH|%B9iH;O zqlXt06k%bxKdcIr0vBkFPVsygmHogoZA{d8O^>|fC|NL-CrobTW<|XThJFiDMM$;A zLJj3FV`3n184VLLG_98U`uf{jl5}qohgEr1-V^i_{D*N$K>KSLCjFkxfhsSs%mIU1 zL|L0M_WRYXw7_v5U%Va3;!ERF^w5BkXWE3d1LEaJrse5X7ixEgtU-@!n$CLodJU6w zeOA_iS0od*3MSuNWYV)uk|iPj&&HVn!E?A=n9Ij;;XbqE*4UluCVs$p82m^IC>MZ zANA!NLWDL^Xc86W!KuVaq2|}ff?wxM4e1BL)+T_fO;959!WaCBI8P>StBx9)&E|LU zojz_4n|!0;^LX*hsLQ!5X;lBLiCd8Hu$#Jb3kuWU9Yhr4sh)*9j7?ud{7C)+O>BQ6 zrnaN$MeR(SN3!g@aoPG9m5>~s?f4r`7CO&?_Y+nw;|A&GV`{P`18HAW{+S>**qUAK zpU&2`m*a`1@0@=lywNhsla;T`u%otB8nsFnJaRQ>mLpj0*3=3EBpSqZ>gK=#`DkVM zin`IVy0v(km}=nNvNrSjCz>&cEuHSbJt9EquiJUvGE+vENJ%yKE08koY5z zJt9kyk63|xd0y1Q$iHSG0KvzYHSAUizh>vcU?G6RA$wsGkWDUP#Hwj}{Sn>6i*&_pfi8ag67hjqp$N?AxTwHQD9*7E*bMQjv=SFtn8d zU>VrUOeR}cM<_WuM(UUec;%$$-j{$)i$>NL8cHG$JF2C-Mf0sq5M)ly^+@^3sM*YO zgl}CkU;3z9?U+>#V!kg}IC{8N9L9AjeLI|x8fYC@iUBz$Kqzo2PskjiQ^=f}?ff!c z_L{*Ip>=;8Go_RAz%A}|?Lyt++6z>pUF)!=Ldlnn3E>TM6N6jTbtK9fa-s#!d@D{= zY!XEr{TllU;C@QZzQR7{2{XqUg4mgHYfu|LkJ4B`{s^td&xk`K2C3vRdGI>9-6#Up zpiQ^83CA{CFg@QG+%STWXt3`BX)zK8i)MJoT~w5y=aVcmR&3l@im0jT7u+}Pp`2m# z-s95KT~@0fT2%9KZFzR~D?9%@v019MHHU_d-WnNzntEngES8Prq42}e zh}|+=8S6Ue8%`Hy=Bn7G1a_+_G0vLrNKr7Cq=~pSi{&PW`CQ_^tsrNx@WX0$`N>HB zdck0e2b$xVc~0LwXpLOof^TkY{qelFw$$`<)Z4*Ehap;P1kpvDHfXGox~j+MOnM1T zPUXjM1#>#{KTJYn_IIY?YoFPPY0XyS8h9$$AlKtWq8I)zZ2rF*NSTTXVi5=YztE5A zE|5sbWX}u;GzC)xBM+y<3;p#KCH4i#h;)lR;|hTX8oUDnDf&)W~IZDGxS6RHwqN2?y=NnxHse0BfnJP;>AvEb=P+faz2a@==AC5pmd zKfX+6mZemgPw6V46& zaV324h(DwSO=p#ZrPXY!npu+JT`vVu?C{NAkrfp@IAl}?PksB+C0+#KGVhSFo%EZ! zajg}q8WL@XNwXMda}B!KBE~qZ(3_y78kO~$@G<5u|P*j~W9HsZkJ%vr*!9Uq# zd4{bs3iUp|M=ftHx&-)tRC0ET&S$VJ;9&|je9fddb$}E! zVA552?KBvCr=$?Umhg5Om{$pH+D{DXj${{@`mlei`N9Y$@w1~pr0IK)CjU8$>nnM6 zn*e#}ji~f6ZSY=7`A(9EM5ZEFnVv5C>=U_sAu~@R9%(bI9h!& z7u~oR9*y1>_)B%(ylZdBwm0=HI}CTkghH@j7CCcljn9I4-dJg1$CvzSzxQrQ@w`Wb z2QK`W8CM%&%(=Gsu<5;K=w?v`d`zJNi}8m2cIkvfVIDusD?nh!ewe&^TnuOYM@#zR zJaH%?@lG9YL%c2Vf>E2``ZLQoVw1)=+!g<=Boe_@Z|>IJ$q{xe3boR=7!u>L+8>af z<;L_?fAuNQTK1RPB^2HG4uTo*lx^#ivr~4PlQm=}V&gZJ{`Qgf4d|b`mCli^yd)2p zL=N~xuzy~Okqvp%g*?UFi@qq@&#J}yJBk6gMrMT73ly#RjXI1`1+A_09dA6>zsyLJ zJNc-J+mPya&HH6WxE-4qG`|t~7GJ*yidEFYug8P=|IVb=?G#F9v@+}8nLJy&V=H6! z+Mv*=VuG%ESbqxb`b#&B;-ur|SC#E!@@{qUUoZRTi)T{SE+1|-37CCuYcn$x>j1d0 zKNMsajZB zT5>XpD^KNx9xc>fonNHXIh^H(&uW>inxpBF4-uCEDBzU&w{RYu3TOPZpwV$7Zk)VlNI5Ut%hxyL(DN@@x!6P=T9+-Nk25y9;hzK%)EsJOXF^U5e%oYjumTMI&!^ z%kspdq!PD*=&`n(ox9@dhk0!+P_eEq-xj|E7+(Cy%iX%mjOBcq5r zsnUHqGp+JI5vn0cS5;W6qq8eAy8D^9aXSQ=8xYPcF_+swK(E#igWED>{9~KT?~%H5;^_?sB>zis$2S;BZlly7O66 zv#e>VhTlQMxyb!`&h7iQQT7L!gSxK}+ahi1C~3Z%ggBa{#Kb+@E4Ic^KBiecv}+Rv zyh>ugG?tc4p%L**P@Gjf?h7?X%51Ug;B*6-6el>+Fl!#!Uvlj|x_s6-A3CXm^qZB}@$a_t-mlmWL=O zGJ{9Q`_+K+26s`(>)N?x^W$6zc;<`NxVj52c-2vJ!5UlEGgiqjgfp*dxFfVgIP!K) zmi#v-3#9jPl3Vy9)+*eO5VTp2-vn2i4t?c~*!kwtOZOY4YZy(&nissJ0Xq(kql)@H zt7)qst7bh%TmLC#W!>27v!(CUMZgSBvqYipHM9Bv_CZ~>?UDO#hU;Ec*@<~# zW0f*8lzkwy>xj8)=EKA9Pf1-H3~|!eOPdY`f@zbWB8YQEony4m^X@q{i2lae=fn&Z~qFvGAAqfioTsHzH9lsRv>Cr|K} z6OAwBwjRrHRUFADF|9vyi)`0p<&_O`?eITAPzMges-Z8%Nxnp%8-JeQFPe$8$S7(~ z-H%cbta%2bt# z?3~Cddok&v`AVss2Nc~WJGByj-@koGLH9vVVdwI2Zkbf=9N5B(FvX*k`}m4T7;Ksg zjd(orAJJymi^%C64L_}X-N9^$@3|$m)7XzcVP8Bdj_kOm53}&{QN=BaDK>FJ6j_g~ zqEk|+%g8551$+a#RdZ!Bj}sMK`%P!cyeaPTl(AjWPy-y#Z@qvwp%gfEB!GU}_H=is z{1alp8p_qpE8OQ@^RVf5E_)u>d9TkTO2oETwra{NBB2F21KLCcxk} zUqp7E_(G7JuyK~^Ai9Q;*Ouh26`qfF;4>RwSa;a}&P&<O4_!PSD`h;4nr*VM0!NQrTGA1efd0UAU;=y+)ceOA zJiEdJXE8Rc!F*70=nw2?hW)3$VHdn5=uR(jItn$JJiX$O|+$pp1 z*^K}hPneKUs0x)P?=wB+9`m-xp2@dG2}pp-!E?(V7vu_l*(G-W_Ki-qh$Ma|&Zn`c z@mrjN+gxQj?pE3=f*HvepEnCJz~z~%h85_A`#ECn_jyvJ zumJUWCca31gH%Vfp7*QfS2R}k8o#HoOvMaSfvpq-P;eWH%;8lN`SC1_|4Z-tf2r5K z+^Fm?_ci1ZLckQ69tR~P{)N8*d!coQ6EBoH1p=MF00V)-a}){sFAp0TF6)aC|KJ`! z&0i}AuCW85s2x54fN-PwhrUh+LT}n-^Q$rxVY#Tn`id!zkY_Z*%x-=`V7!2wuHD|s zl_nlt2s(a~%sES7^^4}@kT?vRr+M;#4+@|gPh&nj>&C)V2S2W;k1}ZN@TnS>x$?XH zpwz+5+t=y6?<;EC<$Rhu-fhqN|MV+iT#wu+GIud8+M1C9JEl%M@VQ%jMdq1rYIS%j|aEAsSAhMx}Vc!$q9&5cXaA874E5Cq# zqsp4u#!zp=)Jny&5uIpSLJQ;k;IBqkV9vG;RVnIHs@`9QC7!77teq-Qug@r;&tlWX z=W(f&gAS>7{PKLQVp?Dt3xVpcz)Or4-%lo))$uH7TRWi-)eeTte?{JgxKlqEhYYKz zr}mn+S+OVY)j4{#tM36GZzUbuy9(w5hgz~siilnVcLFbU4`|hgyNvGCP;g{1>0U-W~jqav3;ziV4;IWfQ?9_O1Mb^ zhfT;*uuc8A82J@x$@a|o4<6;XhW5QSd+^bh#7gsYlR1f9Uu_NiaQjqk6X7a+aI2V1 zwI&LKz5Ht7s>+iTUHVQ~`VM=^Hon)YVd_*Yq^_}H@$iJdg)#3f#ri;0%r_U*S8g%O6{3{3 zBA!t(vRe!AwZ#bF`w7RY30&Rex~X*HmR%m(%G}(DkS7Q96y2ahyHyJ7QxiMS)kosX z{1p9jOXu%j2ZCLM#BQmT9-VByJ6l=QX&oflSF>8<+9bN?>LDOuba7eb%^l^<=6Rsw>1L6aX%(6 zvb~Z+T7PKsK-a5d;&5sV#yk{xzpWH>bsmevCJt7X-7N@w?Mv~f4r-3i*?Q-tGhR`# zhEnD$ZmPB1BRj=3oJ}LeQ|X8jZH(&axHwe;SH3G3?x9akj)(s0&%z$p%N?gy$+{<& zHL=qqrLrpArRB;U+%*K(_aIs?4z4fks5_@96z#j`-8TNtw}wY4YF1`W9YB9jmv|$? z%snzEf?yfD)1-n!x6rJt^Iz=|5*R>c|M&9;m@WCXDV;x45o)V`q-HjuuJ}OSxxBcr z0`wPubOZ40`|G7>J;Y^+vo)UyC}!Ke1|T&Mdr)1m%T2$2(UIt+DxvxT@Cu|9hdV<# z$EqD8p2!One@y3#ax_17#kNZRqRUa_~1AuUDk|!+l$hpKCe%Undblg=dt@zF-y?y-wXS zz4StGJj<@90S3wpSWD4yDa=x07v;}s=%Qtir04E=12i}(s$eG5ZQ3A<8 z6DJG8$^d1PSlk&!;(9P$Yy)+83@aMYlm(XOsd8t#NV*pWD4CEll@9a>Nneqhm)$C$ zCcTFNWjhT2apeecE)gse?a9+>agsDK26r#{b8|h*9{4I)I+DAxk~u8JPbeW%T(j4@ zBC7!E!_S~_r?zB|HK*anCYt!lM1OpRsKwgCtQ!h_+k{900!f)Zb(WbIEGc7_St-aO zh}qK;mQ%i1_^D8gDW*ba3`_Y2k?EeIX_u)nEbYlM-PTbe*9E*v2t3W4Y%T&zdzX+|gM^CD~iI z_eF#QDAz{g&TJvRm%hqX4=e`y(ZfA^)V7{PNeH$8zM7B$M zoMk+26|L&KQtf7k?Q@W?`R(nPB)Z0mT(Mu}K0>=2#f-%h=Oi7<*!vg_N;HO9Gp@+@$jDVx7g=_6g`x9d(n0E%RbUv zl9q7)f1BfD!IH<2#Y@6g?-P#0NEUHO-pbG(QDcQ#fP6IqiV?&pGi>(Pq6ue|eP42j z+;ZX#%7k+@;IgG+X|~RVWtJ|4@U|h0e9q%kOs4+JbWmc}*?T^!h@sv^G?_;r`xi15hE`UYSikyLLgV~0^Fzc_&vL^2zmQX5--4eseDIO6g*QB~bzU>Yd<)EdDjKt!~n{ zSfPIu$xrGONTY1NYe)3CZmxMSdPSdVIc*ozt(tW!@3tc-D7phazSb8}l; zo9$``5ueRaE&y`rG}#G>jsBQ95j+x2E%x?0?AvRDK3`4{Z2ygd$Akl@zAt*N#!yaw zovZCw*yp%|i~XrdEmk@O=ySfga_Z}UYgp#6u`zR3183s2Qrf^ZnuD*+PWzJ-QT#^{ zzjz(CSTcS~wj%-a=u7@l*^&%EZq8mzZfsNn83I!FCIB8u*lysyH=YAzER^ItuP1Dn zT#d49w(kIjKom&JSdgw~>}T-#;)v-kjv!Y9L*A5-=ZjmPb>nvF%#2D3aWR>trKJh; z>-|}tP!|TLVTLINLXrBb@72{gpYRK4T9zq@7QeN--R|W@Nu|ImR3HIa0cTgtJo`Y3 zK%%6-hW@*05f3(+1f2QTGa4^43ihKvVbJa;)v9wlY<*9IE1;V5FHYpE!#Z_gxD6Ra zGA_+l9bXTgOSmw$Nh)<_E95qN3SNY|w$? ziBbOkM!N#eAa5}f2u|5d$gWaxay4W_A}of6h9(!L9Il@pb3`I+i$&lZ6Ror#|>eok4T%S@d2jDJ1zBizc`dZM=(fGA-< zD+i$w#bSiQD=@j*!DEKQtC0#_^7uSG0R6U&Cy?{n#=Q@F{s=Vt{Cei2aSmH;{!~r7 zrzZeI>i|FMJd(Wj8{DWZkYjWCR9ak-`XxY54T0a8K!b!ZeMVmGyf{v}N=iTtW&(6$ zrLg>qabGB)hQlkM#`oXd@j4G~Y`kOkbaNm&j0!OinR1AFu~8n zdK|Bg7OG>0=}tT^cKd@)I>lqcH^!e=l#j>yo0HB50=i@vk^0yFic%tWe$F-9pI44|V`RRz$(` zn*-NbooA5Mq^sQ^v>rgb7x^UBTXU4^fDGr2ZDyZY6a}o14ZMu=cCI$sh+e;9&T5ko z3&O7F6dT>neUl0TS2>{h|b%lH+9*~ zhfzMRW#y;C$~>j*rw7iqT*xZwt9Kjpq9XhJL$kAq9dq_4E9$y)h=m9W)&{ap@Mi(K z+Ft+&I3mKa>4iF|>BY-jdAl=mRb}ih@3WImkHZL8qjc`#K5Yq#3|?m`q}K%pTP05n=rS?PVV9>h9hAf%iYZ>Bti*_G>-L^8x% zUcx~GCY(ErzB*83Aq%#^I@}Pwg_&CFv~)aP>CAF04A@x8^8Wn^57ZoEsSJS}R#a6D z#WMmxFHI!LYNKtIni7zpvhH_(Qbe@TMyxFikmu5A{~-D*Y$Ky==IF%ASy7G;o5X&M0U74Fwn?(6y*14w_2ROXq;ueE*2B&zvSkLMrcP?3KOQ_;-d?; zpxS89zX6U_6hW*X#RHE&!BIX`CVDF8Mekhc(jjh6GbrhzAh@%w7Q65x@o)8h3PN)) zaGY3N#Fr!I3%1zauyN6ood|#i%4~V5*d(e16?5u%9=A{0=v#H}HSJy5HwIVG|hjI zBuvH2!sjl&U2ga3gwWDK6R2PInc*1eC_wiD&>aG>C)>zXPZ)IFk4*&~1B&Fb3T5|z zn>$V(;zGyOC*Dc^xgRcaCJQ`|?JosnFJAhH)YGpm4~gf3mzI{|4PJk|hXQtGr6u)I zER9;czP(+YB#;m-C_VcTd==eWIw4M_A#A0b)+1bf&God7?i0N+9X3-g;JUK!UCzPf zD@y;p##TDm0>|%4!sHz3q)Ia0{a~7oKEb0Rkn_@vg<|Betzkd`IP>vCizu4K61;)o z0y8Y8lZr2rFtou}Dt3!;EDpInW>)?oxG-l&5_r6r(#pSG3qaqS9x2-&u%-bLvaUlv z*WKEGttKs1L0)v07k9h2p)D;aDB#H)+CVmHTWSZ*RccHBS*O%iS{+8%8P%%%*rGdq z;XcpR@pO67SLyTTezkS5+99Y|l1tHqzeQZRjL|6+*Yj#tgX!HdU`gGG-u}sfHJrS~yj>muH+83a#p_yo6mVPzEBTJ?E|*QyZ1qlTru(7ax_ens(A$t;Z-JxN-V3zVh-1XnCAk-8cX$I zoaW{pn9o9#P)^H8*O5;nZ&N9Am(NoCc*g5NK9Q5~BxIxbcX({$-bRsG7z4#hHwa%G z)pd2bNWwy$Jj%@=c@g^WTrmMp>e=PD2SPHsImp+)ZT|a600cNlsjz=}`M(P#vb7bg z#}6+&+QCI!(XU{Q4_>hW*IyF0DT4al8<4z_@V@nlJ9=HRS)V} zbi*}lrE>ltOZ2OGb}Bg(n6L+h6&R>hdv=VA%@;XD#No4%o`oQ(9M(;NGnZRExYeCr zYFv(ooC3mr35>8J*kZy=Wd58!&QgkF0E4cekX~2>w&1y|)?-|lh#)lPTrN1APe=J9 z>yd-s#RYkYum6dGQUiGYG>~;uy}Bx2!U&9)$HDnRI|D^`!>%mrQ-h(GdB~?w7}2xX zdUmg#V<%ZMY`NT=uI@JpSdkxciVM#kO{|8)5c0Pq`$X#J+jxL3fk?^>Ax1tYAdK!J zcfv`5DX~scd~jpO*!wvKOD)D-ZXL#}r5SQXCQX??PI&j;I8=c{ZJZ$7K&y@lGK}QI zY96OL_1YoK^wob7K0e{h#Q+w``*YvX-4}15P8>Y_#HitsHR6a@fpj&n?=T3L%Pi%2 zNOE9*Ja@BHT<9N8_U`8MgA3W)EC~o$LHBey`$&?{~j0IkG5wsqrjxhbRW%C zjz~$wr-sl;2HJrK<{_f_g}Lxome9BKj@Y`Bxv5Nb$!%sgA=cyBWuhW zfZMJS>2DzY|9koT&yl!qO75as=iLm+3lM$R1aLl<1_-lW25V*oI1^oNb**&=fpCmi ze()`Plun_3h7dqAa0;jZn)5fV2mKBA0l4dVP@sQ?1bj+nEY)su*}N@#4JY(kSrjAK z0(g-BBtlv$1U#T(016B|aEQR=;sX_?U;jT9l&MOAJ2?6-mEEtv`N@SY=uYrR{-nh* z7WAjAf_@uoTKmkQP{?Z1cA+6a;Svynsl8A=sK8}7eRXGQ1! z1oIiqulOihEM{-duR!qd*=O2%3uHghdWfdRO1kAizQ1|Bm z9;VOJPzd?Pl9b%FLQZH}-Qw@Jw&&+KrK`tKnl~fk;)bOehqiGKM{}XWqo$!K(&I~_ zTW@Ea^nPz86lRu{^g;pea6cbNc>9izzx+1ObB(ZIL`+hD-e^+U$}S<*Bv-4beNus` zRBIz$9XcIle8h-Jo#90xH^?kK!BZ7qn9{y*M_aKN?+t8|p~3ul8nk^P*e?lUWSK0L z3E*=?3PkJot}Gnr1eBn@#v9Sg~Pw49aTDa+P$XL` zTca#;1wi7iygJ@JWsy85vC1aAsf)c>)b((0&5xNbNp(`im}A7WI5%4R3>JR>K&Y} zFFi*b!|#4*XuIo3Li6X>^N705`t%7T=bI6w(&{=H*aIZ*F;);u22I4+svykioyQ5U{te@V>6&%^{sGgd>@Qs?S>P42YC1cP7+QGs4n2EXUJ0G}nXSG?lL zm9o51Ar6s%3su^1a%RmTeShO2jXyw8D84LC9{ z)~NnG78eG*Cp8n+w@phr;#oi{-wF}^KdvvJ!sg}CEm!+L>*blUX!TZRe>@{!uY8m;EbA@1X8_xR)eMvuK5^Mvl#hY{O!KD#q;-W z>2sacX=a-HbzGm@r2F2?4nC9qW))xRrFD_vAK0F2+5Y!DJ!xOhvr1Fj>e4dDNF{-* z&lGMgthW9&E&G|p@;xbcL@SeauWSkK7`I)YS_gl4~&&kt{&SyCveP>RzYr5&Cq_-zsF6DU4Js~3eN`0MVV1?aZ zU?_0=G*A4h|MOr=(BdeAqfeG{7zvw8So5FB@O#7a=8kRE=IPezo4JJ^m}VTibUGu= z;no%JCn2fgQ`DIPbM1Zs=VWSszlaKc%DPtN?CT|GXPiBJTex-2jAzdS_ucw!u_(-E zW=YTd+Pg$k?RvkDpSH>Ty3-r8O%JbHw&h;b zp=Kl3`lzs*W-}(lSeM0wTBh3Ft@`l#${p6F;3RUoJ8n&kp3S7BGQ(pVzhzvHF!{Qi zBUtg?`E3)Q%-tP&Ye}vB?1L)CpZ7V3n(gk?+Q%N``F8f3MS^*uDreh7T$jxVvJbek z&cJ5=HtomZ(}Pk%Z_fUT5&Fy|Q3` z!$Mx`w52n@y?)X(2~@s6o|??lthHjt1m>serBOU*wSWU3O$uu-Hd?Y=^}{IdiAk_{ hYmAb|$9n(sr>;G> zqW4~+o?G&~&w1DSzO~Me^JCUMd+%%StGB%)bhMsOkTQ{iKp+ZL6-6)zgzpagpSX$- z0^!|*>3IVKJa_Pu$DmRy^D;2FVk5694+2%hke!+n0%H;v6+>VL<>$*EUb}OlB?xp^ zR#j16-`jLOz0Z04+erIi*)pmo?O@O}k_G=$64he@ZvMTyPa8>IvK_otq+pW>4$YR; z|Jt_E>Vwy??(mRWhga^U#d9{D;7^kJb@vEGDOVh`hhD{d#O10n)oJRZ12dBsXI#Wj zD`5OyUL9wFf=P??bsRR$C%581o6pYN|9EgPJ}yC-X7GHx(Ztwn;CH0*XS9ErQiSrZ z`I8IQ1t__f^KWO9h&4W9{zA^U#=NqMks0NjJYMNFOez&CT-?-iyt>hQnSIlVPxa`o z-gM=$ZdK!Ytb>cK{VbbIWU8%onNxB*i=T!C?#cdD{b4x~yByp{w%@0$x&@7zISYO# z?X3QXXPf?S+uoOL>QqAfq{O_U+g4V1zS>bWd#}@B3y!v{V)Sx-{Zgyb(V5f(uA>U7 zw3B0XyYAFEtS8HHHhSG7#(v>4tuG7|Nc_}~%4^8T$e2~fwF%CIegp;{yhSQ(t{)#W zy=rW1EZRhkV1NJiiJs%yoP>*<1x{r)_P+S3=(fIoJnu>Ksh=-ZQ}jTd(WvHm=rMe- zfy~!CQn?Cs4sI6MZTo(3a07Y&f#Zu8YBEs*eo~A?o2X?l4g6Ci`Q(^rI=3j(v2XA6 zCSq|q6=r7b>Ff|QYS45IXOx6&_vG|}c3O-!W<)+@I&S}P?!2rn-L=ZAW(i#uSRA7E zf;xPvv4{SC`5GR70ggV$M`9I_BMZFP@$|xn_E5$b{l+yfRO{ij4P7WBN!cTKAC%`&F%;(iO&4@X32GXq8WPc5)E(Ya?jd~!r{x3jD{4IUa$RtfUt1;mS=K|y`etPC;iUBe1C)2W|vb^#2w>noPl-TgC-(=>J43SMbE_6er1pE zyD->6o$?!yJv&)6j+31;a2yPhR5HV@i(FX1<*Cz4#3#TSx(Z}pT2l0h2Zm5lQgS3k z#BEQTnE3naia1{5@KX6!f!xl_R@9iKn#6%SCJl}a44@ts^h18=01s@MPgv_4-Ulk2 zQS=RxfK2TR@>agzE(kL|x}hZk$E~phrAMwih`=$lQajkieqq+j6mRy-fU$TdEt(hkG(zcOB?8(#uU~KDYg9>*^v^s%0u9Em~J=TVJUl zV4n0{hU6ioi zpe?B$m4;FMjlk%0c3IzZ5}L(u zQxf#*Peyn`baeE>0(O04L(M3LSul*a_DuW*1GItvVt5ChXeYz8YSXYVRm>U1k?k^| zg*KU;weWss{K+$b;kO7~WlV7jNbYU_l28eYeb28G>RIfL5RQsG{voO@tIiR7?hlV zEWfg9DKNUoJM>KkGzX*GodP{dkU;PF7J>wtyN*yP9c!b8Q3gBwDHR;A4Y<~KorhB% zqk=<5P~l2-%DG;yr)kh@DlU7o5~T)T(oC~0IzxM?ByvtX9sD}X9OX_! zjCRm;nH+ryM{yOKq!*d}0=AKU9K|ghtdCI>1j;=spDSEZu4#&YGC8^ti(0ukCQlgs zp&|RqD9%e?AmaE*>%NhiZnWLwlZBcw)@u2NAp*3+{O|S&FAnPvIEu$6lR4FnQzKRg z?Lg-`x>MHtJ1;_=0*%ZpDJ{J#8-0H0H3=V$5lprnju2Wixm&>JBSdO z?(V{Kn8e+)*GB_tcoP;0OUz8C{PY5vK|hu~cEp@4a;Q&-zNpq9zu*_zEn@pPMfuim zH|N3O(~S!gtSUwgLZ)a3ivdapQOs?>_96+**b)wZJ1A*9T`)XK!O3oNY_!)uW-D<_ zBn&X#T{pY1>r1_HOOlr+cThrRpExc~jSJVm&_e z!acv(Uu;FcvHQ^%bXI9;*X0P^jdZ3=BPmp8rbmAH_ANIk+$Q!&Tfc5y?SR>A=FiZz zW)+LYdXLe~<&MMiFkk%!=h3Uj^ZRHvMDW*{8FNF;)aqjDQB42VN!!5m?VqslaN1Y1 z5#Y(~4+*`!n)Wf^(2@tFqXsevl#v!DA@JE_CJoHJ8l;_iprvsWseA+Y?xP`-;KoLo zMGlL?*dGze`|zmvUHK2B!GMl!hkb>78zKoXse4=u&M!WZYDDOc;Zk%pYd8<@w#gDA zieD4coxlv5h-k? zCyh?(RpJ1((5l2D)6uihFm4+Pg_n3A*uG96+$!hozg&v^2LciLOo3S_TwMCUa}A4A0jReC~E z?DTMNDZ;WY{+qX4BB!WGeQ4H-o!dOA?<;ew=&b^fjym;R%8jR`T6c**A+80J#Iix9 z?AmWbLHXU+HY5c*B8eX8htmxwfdt8CN|}%B%iWK=LU@Uvav@j136V8>cJ^$;rd1QG zMFl<`XoLA_w5Z#B#9ZVd0YS^VK9f7cNh+THoNs>d6n7^=_AitRiz5S--ta-s--hpi z{&K$EqSa7S)2>=d4q~9;Y*_8=>@?Bg8J7fIBXQ&G%e@wp3NB8Y9j8ldam3D%^{d44 zHaCi~urgRGWl6I^AL-H?GPU04kw$Bk790>w9!+7v1lxE zc)DXawd`PODPVJK0kuqf?l%AA;`CIHI~uRfmm=Cf{pe84Ea=k#nh(3?a=JEKX$b=8 z7T;m1Y;JCDYWlXRWeS7+92toVWdLH26zRj6s*B%6>)Am;i%tdjgdG@*>5j#a=ze5b z6HmnU_szrJ)n4xV0yQcXH*emA-+eVZ``l1&_Kl8PLNII<6z$Klbnm*cv2i>rLQg{BMaSTi;;Ha0dffk9P*Vjb>5DMzwj!EB=1B2A2pEL^{Z4KidT zCpoa^K8@hStHZJd9erlqd3e0NT~WvSd1h-%r%SEv&DMFs#dcX)Q{p%W8d|SeD9a$rF=5}(%F=Muw=Vj!M)nE~X@rAV zLSVDNK2axTMFY?-NK&n=>Dc}?gk;Em*`|Q=@z}vY=D9vK_uwaCm?zt?^mko$A+%aK zY@OA&Ok7-inlI6VRAiGJnoh#}n@Lay`Q_Iy{0MUi@4Q-PSiQ$}Hr^r4xgR_;Z(-Wn+Nu>_Lrb!w0i0ae8)oD(N*^)~6}7ecs!~4qXtYs9YI!?bKS~C9 z-2K{?C1)nlna%<&J^kVsV`=s4Eli%BCV`hEN>L$5RVp!O@oc3NJ#0T&E@#9u`6Gy~ zx<6F)^FyOrYI@g{&Pe^lMLJ=(C~eP2kRCaI);5d-)T+u2ROj2vF>n7Xq|&jjYi(zg zM`1?E8g%CgjxblUi23RVA$AeHIZ`5g08BsT(Wu4|rx%zftLh;4QD@Xd5} z+BjsK=M}(-2j25`fS$1Ylq)q2yF>NY8UJxIf}0&U2bZ}JioZCm%VB1I>mtYf!FIQM zL2@j0_#l6f5n&e7OCuREFMcT%8Boi^Uq3d@Qj~3k3wuBG^swX?09nVn+TjATV7-|*$3lrM_Lz?cqm7hS+aBKQ zTB+(d4`bg0nSBO_Ck9JPHoZQTSADV#6c{1%f;7QKU_~T+!KiC>PeqY>ASS;1`TP($ z!rGS~wUQ-gU74%VkFq2>*1zR;Yx7|p7+qntwfN>@wsAB zuIHM*KvClB4dM%4`D}*};QmTbh6fUqy+q;7%3wtJ%t#Ii(kJLUX%R0Vlw){|9GS6i zdjIpQ%^voO5uuz5roOsKIb;?nV`$AxOy(`&F6hx{a(y9zy6HE^I!*6$h#z-MFgD@k zVC-H$utOb;GAx3Ekp@y5X=QHZygzT38tiA@FyDIpmXaHL!~?bUlq><47P+mNYvkhK zQf~+Z2WpM-gu(9MdNf*b`|K=03)nVxI~+o1&RRRXA-xuBB5LHD7?c8$qRPp6gZDuf zhPpw?XvEpMoKdzhbx`Qe%i49l*iK(<3Hw43Y43V6KLYCExMPQtt?Tu1A_3`;Ly>Ul zZGRjk+{%_NxI!o%vYuf4=O38$CuIq)Axpp34#f6)$ll0msQA+;ULrB83kZgyWF|9* zRudezZ8L5@KZa|1HE``ysTcuZNPRsXMV>P408d&Zu}%hv+S za~jPF&_tSrs*?i_|h*T-#Fn^|CJd;5Ee`(yCN{nn&ZKj>*uZj#&ml0K*jM6@l+O z-R`(>3+U6B5cA#L0(1IOQpCxdB}xIg54K|2GcC^F_jn`*N-;^ z7*jtBl|veQ{IRk(Dl{ipo60jVU-{ZN%38148ifjf^s~m*Ti%^jWw8jxQg2IeiPVT< z@P5!r^D}E$AYFNm0Ux^KW*8w$w&g^;74>U{KdeCTh2tZ_H;E^P@1u;aqzo!4BWWW> zc+e{kzT0yO-bom|%0Zp{I$mpcJ`NAuISqXuh5gHMSelKp8 zLkhP&dUT<0k^JZAp$u(N{-%p`=j5%+E0@bIu#({qnCE{TJD4hy_LK>O3HlYUPYQ==(0kEVY-k-gaO21+swl^C1Z!8taozcl%H?{so4 z-*a+uQuQV8>FcXvqNk_l=nnP$+TG2U^RyFZ>CpG>zs_wjx-}JIWMX1 z&;aX&4?C`ph>J+57=kV(XwUKv(r%98;^Hc4xx96ONP2CI&vZ?^c<=r%@+MnPDORwb zXfR~=8Cp#R;!}Q5NOgZ%UWY50e#Wx;z%eZaV6}xF1(Xyt68Q?A_d4)}LFg3Xp_Q|f z!)52?p{}+ZVX*4rv%6@X3Xi8qg-(PhOAmfNs%}DkW})|H^_H94e3v%ANqxumf2fn= z#H5&&qPP2GPaKH{nO>~+qYzT)Tp3j=?f+oRDmLoX%gl-jTF!gVfww{_B6d3>J1s43 zZGGLd!9)}%<+Y*Gy7jM6cuEXN!LgK1(r8JkcebblCooNq(ggm$>%}NwJqaHz>7etL zCcdM0X6EA^T^b;<=rd*fOVvE49;lgUx#VwBp|G@sCHqTD9rxUWg3R1R23eDy-u_o; z2L1MF4#TDL$d(YM^jJknG3QCa=kfREnj=zJbLs_5{gf)ff+Fjey5%XPqhgWHQl1(g zPxPQ(h!B-hF)Z@mJEft%`7#Gg3BCbBg&I|qm&--*M=*HoEUS0~1Vptp`W@zeW0+P& z0A_q@(_DKDG_XnI_o@{&V=FO2p#rV3pJ$~fJs3K!a_tY}g zz5*}o`8?njL8q-=w*ul1&u2HJz<1QnPFkMb$g0LZFCPBne{v2zakkXhv?%mpt?i$d zNR{4l7ahs>g~Jz8i*95s1WcM-v|Tw`O2fbek(5L_=$lF^BHs6&Fft0m+p$NJMO z3nyJtQZgr@hWNg+yj+x<@W;XVuHOhtHu=iyHhJ>u(&7283kPl9>&uBInJhm-pHZ^d zd7kYYmzys?dY@$wOOtfv)mrJo%LfU^>XNt2&_L5~eBaV+q4Z(G5BnTW_qS163JP)7 z*Ot*tGA4>2sO&{k_G%^)NhO^hGt_}=^eXei&))eRML;1oNj6IQ{51re&3lOk`@sHAgb6IBW4jttnaY$DfUHiXt$WYA1& zeZ1Z#5TN|`lIJ*a`sLIs{>%vTG0<#XLoRiHH%EfBlGOi_jKl zmSyk^2>9I|7*cy?al&;16ZUh88ckwZ|5Q`4Pcz2VKz zyyr7fQYTHUXj1E_A_rVk_+-Uq)ri-Oc($#lc=$#9i-`Kk)G$a$FB-#iD^;0cy&{O{ zjy3J}HvcC_-X(@%asZQtF%nI<@d1(X?uj0F?Wda7fV~Nj=z8}s#jiiu-OInA(u^0T zsHm{(C$4U+(E^D0MvMxz{7drxNR0oTO`*u12}szdzc{NS5b zEKePi)Kqm}U~?v94rBw&>Npp#l-vq@mB!}$dHY?4Z+iI20t)~vQs4^>Llk^Vd-#9` z7=Dm8a34bN$|1Ceir*5%Xx5CWh&Ukp?>d&r?)dE7=CL21t3_M|UQ#56jfB{&dPzh8 z67?fUOejQOGf^oRIW9r2a~S^yKV=%k-MzciZ;NqBuRx5c6Mb>W=gdaxaYu<_2SwWL z0gei35$;1R36I+??vVB!Wt&>#$Yu=QI4@s;z7=>zr~GD6L!Be2$%r$+V>E>?H$NAk zPCpbt#6MuDE@ud-E&?!vz6Splj*zKMui&8f<>jQnr401nZ%^91x?KApLL|jom(z+h zGct-Ff8iArG{qnKXTk8Bo5;@(8yg#?dWqLXMMb@ffIfMIcB=Kv2snZNx$Dq%g*vXX z&X}e|f=fvUcR$^z8Z|d}HFpY#`utU$KE3}->~cw0Pft!^m&mMko*TROwL#AzTf-_P zd9|>VID;Y$)g@a;6KfJ_AK>*Xn4zI+lnUpuI|0A7RPwQoacppM;o9-X_1D)Q>0js) zs=CT};U#F9CJ>bZ&~gkXxMz~u^9==x*s)TjG=wJqir>59Urd>%s&8)@6bu$24T0FB z+VQIs+a(ca1(4h$xZm7&`OKyf--@;0hzFPNE-o%=p0BJFnylu`dAjpQY^|HeZ~ngS zLy(l~l2#L8{s~>~hO%jN!R#%DcpdVQ26m|qU2EkjkSFtudqO{6jl_vWB&%l9P*?OP zqPp(s6dKG)BVJeG>s%4%1%;_fh>&YWmh^}sZH4yg6!qMN(>)~$5rz&`#l`VQp<0{{ z&)onzvaSN+*@?AP`S@P9M-*c#1QUH9BeCKOUmv*CT97REF3^j4!~E1>=+DJ5aa!WK#mE(5_##G zx&L>H1WWqItApcbW|Tiq_TPV%8x#F55KLZS#VNk(x7p}rtZ=;(KWhVE{~iq^m%e4~ z_rhF%wA;{9eqoyb^Ox!_kRAQ=h>ve9@pQbVOF)U?^Y%PURb}4?vd`&VAIWw;R5cjL zr5-L;JzJ`+y1U5vAKYD!{hrZw6DmLro+_(+NfWuR_S7zv+uGkF^sO>VjNl)Bbtnxf zZ+IF+8JH-ctkUW120S2ZvHL$>d^|6QRjXYRb!kqqME__AWcNR&3h^$ESGonvrhYH| z=9;{~*4*<4UQJlbWX`@il=-_~C=}^l{SPvwbJxT4^FC8)$tg?TUdD5enUl=(({{7< z=Iu@ArX)Hm{C{M5x|o?6q{fwXn0ZRo&i#bEy-${(H5MS{kDYAA4%A$13P1w~PbO<_ z3EUS0h+-fEq@Rx+;cCykIG%rGa?~{IPe8!;m}qTW`|L!@Sqj&GxxE6=4_j(jSQsxf zPzbm&(9TMkcmYl7k!PVly)5N{ho?%@;`?teDS6h_VkmFue=uSLErpGYj>dZ+BxGbJ z#>YKi?mx?$nv_@LMDkY3>|Oqa&~oX-Buy( z?nVJuKFqgnsW#p_3kpVY@y*`9fhCor2&oFK6vV3O|A1+0X?4inGW!Hy zUuoIJiVv5Wc?}6adX%};1u$q2B#6XU>m`bq9t8HuErIc=srQxH%q%SNA4gYnwc{#5 zfT%^TU`e~$nwT8f!3$zoJ{-U*JE2v1MTL2pzpJY}=|h(xo*w}gH(g?2p@HrC=n(`I zru?ivAUT{N4CcQzji){qa%sjSGY_?}!&rER(ROyNtASkMR0u9d|ASVH!qF zqsLI<-BKAKww2zw-u=D3LB>QWL1tFg?lzh$SR>B6YbDG}3RV@jfqer#z z`(AK3aIeWs92E}qBppI5&tY3(Pgs{P)|5`HTwaA#MFYwKweUI`i^R;&E$;0B1%B@~ z7A@B#g-~z!$|iQUv!AXVbUxb`=(-PdvYck8!%#Cd!`ss(v-m*t*$UTn1R9Zh+qZ-) z(H;<>Y-itJX=`r&opQPlkQYtnCN4R}A$8h~V72-wnC1xsoC%a67>W93CJ}gcyib}Q zlXTfT@4X#1{k=P|8!ZscGF|dHZl(lFp7iMQ{xx0 zSi_5>uuVy=WUjrY!}XYqpwJrydd7w(k}gA6>12Q?shsFUo@30C~IZw-DwW&3Y>_Svq_j) z12C7D_9hfWdRLs|2&~Lay%eyLk*LwKS04ot%l>!-Hc>it?hrw~>5{Db@2X_?2lbe_ zpCPY!PC416cjbm57QRK@Tv+Pu>r;OLNbUM`2^*ISMCZlcjYe_aBiX{r%DsS#~R9O{lyn;fxMFb zeB_(U`ltan=(mg3u`AXH$Q7|PmjPqyY{Lr$Sq0oKcJHeAq#Tzy7(_H9UGA|AZnZmO z6n6j;T?a`Top;B`NV0Iw?H&=T?PU>V|8yw;NgCZ8;OnOxFG`U}WR+;yjLsJ`4WN_f zwNeVHQhsKW?h;%Dxi0R2Swb_VST}GD4Bl9sSml)>_QHaDDs zuj0|;Ulj)Uf~0_DM+)v@iz^>i-%i$$lBz7v8v5u;#-La7!;>27G))L@jJr|YwMJ3- z>j#zQh!AM!Pql$@9hxz>L0kc`QCY zBPd&DP)Dab#n)F!{?*H_tk6rZ1d?w;uaJF|XvIndL^U}={j=ffpY;5#N6Mi%tdf{# z{8tA%w=$zAqyc;_CauHTk#GyJG7uX@T2=njoG4NGv7>j_l_>@-vZ_`*CCPu1PXiGY zbV38qopmhs2V+L03PaEC0d#|E>i7m*U|6V=8gEWY2h)8dTK^ z)S*WX0zyE!9Za3JpA#eNyHZqe1SJYi{sq_?I{^svj79b|h-W=Ahu+q_11N++s!Cdl JrH`M5{vVjn{nY>f literal 0 HcmV?d00001 diff --git a/windows/plan/images/deploy-win-10-school-figure6.png b/windows/plan/images/deploy-win-10-school-figure6.png new file mode 100644 index 0000000000000000000000000000000000000000..09552a448a0b36bcca641eb5dedf09114b02f691 GIT binary patch literal 18525 zcmb5V1z256uqL_*8VC?H!QCMcTtgtZY#f5SyIXJ)+}+(RxI+@$T{rHwA-I!SJWzgVC!y{L0-<$1|HAay78`*;;%AZ~LdtGB z(2T<&_p#EEHth1jM4D1rtv!k{^a?C!^ssKQa6yLfNhHV*jiV?tBzSsEL7! zL5L~_d5uXe?y@tEd_0kl{!54;tXt8)pxBTs4hzL{7|ct?4nu&rne%d-@}|wQ-L~R! zwsfe{tK|NCGpF66LZ$3oS*Ays#aw}7UURZ>t973>Y+Y08G_wvEeT4(ucL z93K6oV{{F9_*oNCl=Yo~Wk?nGT)ja^4ih)DYlkFF{g1J9A)kiTd=59? z)HDS#>WL%HNqH}auKFp^vjlx~5U?+G8n9?0bz5Cz5jNHeQXLj_I`?HtTZ(>WBJG`zmAN^f+c=#JvOwpF_tJV(f7AlG14W&3EZ7-_VEOT zQENAZKXNYAWN>?@V=1z{Yl?s}2SVs8&vAKt{&9g7z{2g$kcrJ(dkSh*#IHn#Wic zO1+73;YP^fiIWFqW;C8!C<4D4qmrrTsth*gRX3iytG$ zc(W5`XAl8i*|RhMWjXu&{?)FhI+>bcV#U?X&}@DW+mIM1h1<`In$ztDu1szZPRQnst%{E15o zzg49!;@s_FyVd@*_X4fRggqA3-c3kkN-@fEmFQk$s@-jl?HQ_E=bv48{PNS9W=|op`ByTrTO{j@|Wt`+RhOYv*~N12DGv$=a4b4Sj0Z&v^Q6juEIN$ z5{zF=WAey`3O$Dv?v2B=>HB;#+*5J)qXci}%o9gig)=Mj#gI-)O>ir`O`(2>$Ga1? zan1`8fWmlO3?(r;3J+3KwokDim&z3yYwGG|*<@;=q!)JHAGcVx6b2U*P)SnNx}NM6 z#+(i{*xf_lF&U@WQ=B#N3J^_u?#Fs00LNoBbMT_d!kQj5>OH=GVAmf@Fh_I-q`Z+VvQjS`~B_8 z2WX65KDtCW2aT}1HvI0ZdmSRRRty4z`4?5AIv15!B2*NM^^SU;L9{O1G_GhWOLa-b8t?(W7*K2)9Mdv=y+(~DNbh>!Gx?D!W}0XkgXWr0{tD+bzDVL zDHZKJ&;O7_I19b(*SY#e-+}HWAs*iFdaJ(}V$jpxuOj3uam1NnYw3^tzSo+ua*^`P z`_0FdY=}k3enT7s%~X#{nh1Q$$diK=+U_gPpcA;aixhkT&4gxQxs5?LT@eqrOj1P4 zg|-+U8)q<`G^w)L^v?J3QPKvrwOOeNuG|IpE4gzZ7B5>W9NN6D`W}8D95!a%=M!)7 z?loY}S8sB9tAD8d{(a5ndbh(K9qWDNm_$08Y@_Jtp;#=w=(?=7v<0QSYGcL+uSHMN zuAjF{Ts$smo=?#U#>OK=sT&<$_l3!E{;kl(ddq1B#sMkcdjy-XB3~Oe-PirIDygf` zr}%tqDksR{PuMW`wZG(8`fN1o#^eV-{t(el@b}D&7cn0gsfT>HNm%ly?c({j(y9%G z*I`&0tJVF{a0(kM3wkcWPyW^s9Q*ngc5yBmy1J{7L-!O)JTlU`jC^-YSFnxY&Vn^- zw%uVc`{kT5wLkTi^&G#m)R)aeU03rYJM7mGGwry&k3P8e6qC6IHp{&!8kUw%#6HL4 z$_A|?Uh=_PXFNZ#$E}-LgEEZR`}Y0rX}lMHinzs5^q9mJQ@CRnMl8>Q#;xn&mQ|(4 zt;26)f_<2bT5m$RXv9uf z$(~W@Oi&D;V{^We3sO-9-qROCmJS=x(%H-(8%k*c;6g(8kbG!5xd+?MOlOmvP9tcT zAI@-?vqY!P9O_(-6BT(OjUlIO6wHLF@+*O6RKFqNNB0r_yfMtYquMwQ1eYmy#g-Cn zR79HZ&@NHPz`Yq!1-=M*{5 zq_r7W<|HtC2&DZG$7YjnE>pdAW4qRj@6w^p zVOdhl62C9}LmiNgsB%h=W+a9cj>k?~GGwWP@ zoosSRu}!V$r^=6PhP$);L(-l-*4L=FL|&A=xOrS z%9bTsle1;V8eiZ(RF!vqjrXy#0{2VJ+yhZEy$Ku(O+Ms8mwA1S54{A|A0k!^;oT|h z?nkA7g;-N_#INM8Y{Mm^Oj>7Z6;{L{5ujkpwL$7+nB?DYEEo1%vi@oni{_fN4vJf~ zmE9<MR_NK{({ITBTM@t9zQi`UNi=bwhQN zh2cL|fk~)wCRWNhtyzu1fytZE1nz`@K*4^dSN^Nb=8)t=KvE9Z+Tq)Hc6fU`cxvSm z7|$q1W&QWJK^6L>Q`TQX%x8$c>rkpWcwa3SD~sG}IXr57f|J3L;3)2Q8}#efwh< zc3j$+>G7+e0HLJ}Ylc6Dr#pTeSNE(`E|3tcKIbeR+Vf@C)dCTnWtZEt?S6DVat&j} zlGkk|mXZ;0Qb!H*A1G$$=A!0LXmTN#C3=lKXHd>Yafc0=5@n>NPaeb)VXZDI-yyhf zTor<f)iB0h9Z1d7q zM0QHc@wJ&kOMBtk+kRTlJkFyvvF!3#8DQ&uhlZETwK83wFZSXb+R&pJDM_!V7*w#v z8_ug(!`SRZaEaSV=y1Gog=c%9q1ff{n=R^GdLH?;oIP%qF{OB8`zaSm5zaC~W6X-j zCK29f4kQF&b3@+8@|QM5$8F=fb-lT5|2S5}RIYE_}ihR^vx zIdWM{lvf*M;{XPH(|1e>{uYOahpg#7jS~Y4gr1S9K@qRsu7F+68XgSN;C6oc{mmALsc+q$g$=ChYyb32`}N#c_joOxqaZril zg;FhVw^V0IPzFcEG3OKZ$9N|OWxp$zG_Uwo!r<{lFl%d`-vxQW0v!Kmp+$)G4h0=i zt!wUb%rWPnSR>Al3%&u&m!n+6*MiphhiAHj8%W|lJQye~6@)hehMY}{Z@Nw`j|W!2 zyfXOXknwrk8sUUHZB}iNzU+nd5$6Zr_yCN1b2^Ciq#Sjh3js8b9^z{EA8Ya7CCOy2 z*H{myzP5;Yz$yRc-`z@h`RYNX7=e7;`VtF}Q5I4sE-f{2EhTRDYin+JT8=}g64$nnn>RNNvhGhXsiFajbURa3b_bK)+1Td3wa4i+yleyQCT%5VvgVMhc-kH*I^rD6#YuM%IiI(lKd zeO{&sgOTXrBJfGzNTs%y{k6R(6IJO!B{A2=WYkZ*Upyy}!ln2YL3tYG05aH}Ef_E3 zjuKE}Oj_GKXk_dir&BdWWc)&2(g@ahr&%wgP*N+-j)#{m^!8`e-WkEp#)!$`TUWZW zS5UJZqVMT=90Y1>`u7JUY?OcOs6eGbwhhWtz&mJ&L$=yC8*VVu`|{x&On;8pecyD7k{^hgEp% zc6-;$4nJX=ytjWqYMo`rX(U(Lm;DtAJJmSoRS0H`ENMaupEAerFT&|=m~Z_;19lsb z9)Bc#8=)SHLG`GtTjf|~rZJFBGvPeQ^gL--L-;u2xA0;MgXz7*wAHM1;K*Bn-#y7e zbT3aalTwR%ZxpI3>$UY1Nd9(T09#uRpIqUj*U$i}EzmHWtS zad;M2uR-LSmt_K3mVJydcMb`bV-iWTl$`qjKPj%V>Kx^=p#jC;=2YvIglPB6ep(=X z-DGJxSWD6Ons#K}Uxl{coqK2K9jzTmzx_|0S|2}bLk|gb?|(^W-2_kFjUHc`supm+ z_}k-x`(X)9U45^V7>e)0;)~&4D=RBP9tSr7iuoMHfA)K4r!Zdh2DKqOJTgi4W(;8DSy7 z8*Y}C4s~2xexv(&b>VUOSg!pPYU|!vVa}gc{meE4;=dzpNgJ^eomKO^2LE9k)@phh zE;TKs96*ApXNO$2qIGyrjewus54vLXf2k*MKsK2A>Qp;xso{}#>nbXk21+rpFIGGb zUgAj&dwb7nH_^MBekm7oRIm7W)U|uX00aDE_>x^EA%BF z!3Z-O?b?7MaK=UtE7<{bB&qYHvX!=Q0(=n@L~<31>k8et%9~!ag0me7 z3kyN{OwMnMO<=_Bmpfw85f+C`Lf>?!;d+ww2c6D%9XGU%QkvMW)V#>r#^!0OPp}X! zMc!1A<1BfIY=Q1(df5uDuaPm$S-)u)Au%zLk|D)Hl(T~wGBjO!=GQIaHiUzdm2ZDH zVe6CDXW+7IA57xlNQ9Z*P|Zqa8=)&GWVZsD zrc}(dw30f+VGmntHyTXH^`_f7GUX#2U@Pb`7K*`61o#X#ZG~<_m<%1%BH|%B9iH;O zqlXt06k%bxKdcIr0vBkFPVsygmHogoZA{d8O^>|fC|NL-CrobTW<|XThJFiDMM$;A zLJj3FV`3n184VLLG_98U`uf{jl5}qohgEr1-V^i_{D*N$K>KSLCjFkxfhsSs%mIU1 zL|L0M_WRYXw7_v5U%Va3;!ERF^w5BkXWE3d1LEaJrse5X7ixEgtU-@!n$CLodJU6w zeOA_iS0od*3MSuNWYV)uk|iPj&&HVn!E?A=n9Ij;;XbqE*4UluCVs$p82m^IC>MZ zANA!NLWDL^Xc86W!KuVaq2|}ff?wxM4e1BL)+T_fO;959!WaCBI8P>StBx9)&E|LU zojz_4n|!0;^LX*hsLQ!5X;lBLiCd8Hu$#Jb3kuWU9Yhr4sh)*9j7?ud{7C)+O>BQ6 zrnaN$MeR(SN3!g@aoPG9m5>~s?f4r`7CO&?_Y+nw;|A&GV`{P`18HAW{+S>**qUAK zpU&2`m*a`1@0@=lywNhsla;T`u%otB8nsFnJaRQ>mLpj0*3=3EBpSqZ>gK=#`DkVM zin`IVy0v(km}=nNvNrSjCz>&cEuHSbJt9EquiJUvGE+vENJ%yKE08koY5z zJt9kyk63|xd0y1Q$iHSG0KvzYHSAUizh>vcU?G6RA$wsGkWDUP#Hwj}{Sn>6i*&_pfi8ag67hjqp$N?AxTwHQD9*7E*bMQjv=SFtn8d zU>VrUOeR}cM<_WuM(UUec;%$$-j{$)i$>NL8cHG$JF2C-Mf0sq5M)ly^+@^3sM*YO zgl}CkU;3z9?U+>#V!kg}IC{8N9L9AjeLI|x8fYC@iUBz$Kqzo2PskjiQ^=f}?ff!c z_L{*Ip>=;8Go_RAz%A}|?Lyt++6z>pUF)!=Ldlnn3E>TM6N6jTbtK9fa-s#!d@D{= zY!XEr{TllU;C@QZzQR7{2{XqUg4mgHYfu|LkJ4B`{s^td&xk`K2C3vRdGI>9-6#Up zpiQ^83CA{CFg@QG+%STWXt3`BX)zK8i)MJoT~w5y=aVcmR&3l@im0jT7u+}Pp`2m# z-s95KT~@0fT2%9KZFzR~D?9%@v019MHHU_d-WnNzntEngES8Prq42}e zh}|+=8S6Ue8%`Hy=Bn7G1a_+_G0vLrNKr7Cq=~pSi{&PW`CQ_^tsrNx@WX0$`N>HB zdck0e2b$xVc~0LwXpLOof^TkY{qelFw$$`<)Z4*Ehap;P1kpvDHfXGox~j+MOnM1T zPUXjM1#>#{KTJYn_IIY?YoFPPY0XyS8h9$$AlKtWq8I)zZ2rF*NSTTXVi5=YztE5A zE|5sbWX}u;GzC)xBM+y<3;p#KCH4i#h;)lR;|hTX8oUDnDf&)W~IZDGxS6RHwqN2?y=NnxHse0BfnJP;>AvEb=P+faz2a@==AC5pmd zKfX+6mZemgPw6V46& zaV324h(DwSO=p#ZrPXY!npu+JT`vVu?C{NAkrfp@IAl}?PksB+C0+#KGVhSFo%EZ! zajg}q8WL@XNwXMda}B!KBE~qZ(3_y78kO~$@G<5u|P*j~W9HsZkJ%vr*!9Uq# zd4{bs3iUp|M=ftHx&-)tRC0ET&S$VJ;9&|je9fddb$}E! zVA552?KBvCr=$?Umhg5Om{$pH+D{DXj${{@`mlei`N9Y$@w1~pr0IK)CjU8$>nnM6 zn*e#}ji~f6ZSY=7`A(9EM5ZEFnVv5C>=U_sAu~@R9%(bI9h!& z7u~oR9*y1>_)B%(ylZdBwm0=HI}CTkghH@j7CCcljn9I4-dJg1$CvzSzxQrQ@w`Wb z2QK`W8CM%&%(=Gsu<5;K=w?v`d`zJNi}8m2cIkvfVIDusD?nh!ewe&^TnuOYM@#zR zJaH%?@lG9YL%c2Vf>E2``ZLQoVw1)=+!g<=Boe_@Z|>IJ$q{xe3boR=7!u>L+8>af z<;L_?fAuNQTK1RPB^2HG4uTo*lx^#ivr~4PlQm=}V&gZJ{`Qgf4d|b`mCli^yd)2p zL=N~xuzy~Okqvp%g*?UFi@qq@&#J}yJBk6gMrMT73ly#RjXI1`1+A_09dA6>zsyLJ zJNc-J+mPya&HH6WxE-4qG`|t~7GJ*yidEFYug8P=|IVb=?G#F9v@+}8nLJy&V=H6! z+Mv*=VuG%ESbqxb`b#&B;-ur|SC#E!@@{qUUoZRTi)T{SE+1|-37CCuYcn$x>j1d0 zKNMsajZB zT5>XpD^KNx9xc>fonNHXIh^H(&uW>inxpBF4-uCEDBzU&w{RYu3TOPZpwV$7Zk)VlNI5Ut%hxyL(DN@@x!6P=T9+-Nk25y9;hzK%)EsJOXF^U5e%oYjumTMI&!^ z%kspdq!PD*=&`n(ox9@dhk0!+P_eEq-xj|E7+(Cy%iX%mjOBcq5r zsnUHqGp+JI5vn0cS5;W6qq8eAy8D^9aXSQ=8xYPcF_+swK(E#igWED>{9~KT?~%H5;^_?sB>zis$2S;BZlly7O66 zv#e>VhTlQMxyb!`&h7iQQT7L!gSxK}+ahi1C~3Z%ggBa{#Kb+@E4Ic^KBiecv}+Rv zyh>ugG?tc4p%L**P@Gjf?h7?X%51Ug;B*6-6el>+Fl!#!Uvlj|x_s6-A3CXm^qZB}@$a_t-mlmWL=O zGJ{9Q`_+K+26s`(>)N?x^W$6zc;<`NxVj52c-2vJ!5UlEGgiqjgfp*dxFfVgIP!K) zmi#v-3#9jPl3Vy9)+*eO5VTp2-vn2i4t?c~*!kwtOZOY4YZy(&nissJ0Xq(kql)@H zt7)qst7bh%TmLC#W!>27v!(CUMZgSBvqYipHM9Bv_CZ~>?UDO#hU;Ec*@<~# zW0f*8lzkwy>xj8)=EKA9Pf1-H3~|!eOPdY`f@zbWB8YQEony4m^X@q{i2lae=fn&Z~qFvGAAqfioTsHzH9lsRv>Cr|K} z6OAwBwjRrHRUFADF|9vyi)`0p<&_O`?eITAPzMges-Z8%Nxnp%8-JeQFPe$8$S7(~ z-H%cbta%2bt# z?3~Cddok&v`AVss2Nc~WJGByj-@koGLH9vVVdwI2Zkbf=9N5B(FvX*k`}m4T7;Ksg zjd(orAJJymi^%C64L_}X-N9^$@3|$m)7XzcVP8Bdj_kOm53}&{QN=BaDK>FJ6j_g~ zqEk|+%g8551$+a#RdZ!Bj}sMK`%P!cyeaPTl(AjWPy-y#Z@qvwp%gfEB!GU}_H=is z{1alp8p_qpE8OQ@^RVf5E_)u>d9TkTO2oETwra{NBB2F21KLCcxk} zUqp7E_(G7JuyK~^Ai9Q;*Ouh26`qfF;4>RwSa;a}&P&<O4_!PSD`h;4nr*VM0!NQrTGA1efd0UAU;=y+)ceOA zJiEdJXE8Rc!F*70=nw2?hW)3$VHdn5=uR(jItn$JJiX$O|+$pp1 z*^K}hPneKUs0x)P?=wB+9`m-xp2@dG2}pp-!E?(V7vu_l*(G-W_Ki-qh$Ma|&Zn`c z@mrjN+gxQj?pE3=f*HvepEnCJz~z~%h85_A`#ECn_jyvJ zumJUWCca31gH%Vfp7*QfS2R}k8o#HoOvMaSfvpq-P;eWH%;8lN`SC1_|4Z-tf2r5K z+^Fm?_ci1ZLckQ69tR~P{)N8*d!coQ6EBoH1p=MF00V)-a}){sFAp0TF6)aC|KJ`! z&0i}AuCW85s2x54fN-PwhrUh+LT}n-^Q$rxVY#Tn`id!zkY_Z*%x-=`V7!2wuHD|s zl_nlt2s(a~%sES7^^4}@kT?vRr+M;#4+@|gPh&nj>&C)V2S2W;k1}ZN@TnS>x$?XH zpwz+5+t=y6?<;EC<$Rhu-fhqN|MV+iT#wu+GIud8+M1C9JEl%M@VQ%jMdq1rYIS%j|aEAsSAhMx}Vc!$q9&5cXaA874E5Cq# zqsp4u#!zp=)Jny&5uIpSLJQ;k;IBqkV9vG;RVnIHs@`9QC7!77teq-Qug@r;&tlWX z=W(f&gAS>7{PKLQVp?Dt3xVpcz)Or4-%lo))$uH7TRWi-)eeTte?{JgxKlqEhYYKz zr}mn+S+OVY)j4{#tM36GZzUbuy9(w5hgz~siilnVcLFbU4`|hgyNvGCP;g{1>0U-W~jqav3;ziV4;IWfQ?9_O1Mb^ zhfT;*uuc8A82J@x$@a|o4<6;XhW5QSd+^bh#7gsYlR1f9Uu_NiaQjqk6X7a+aI2V1 zwI&LKz5Ht7s>+iTUHVQ~`VM=^Hon)YVd_*Yq^_}H@$iJdg)#3f#ri;0%r_U*S8g%O6{3{3 zBA!t(vRe!AwZ#bF`w7RY30&Rex~X*HmR%m(%G}(DkS7Q96y2ahyHyJ7QxiMS)kosX z{1p9jOXu%j2ZCLM#BQmT9-VByJ6l=QX&oflSF>8<+9bN?>LDOuba7eb%^l^<=6Rsw>1L6aX%(6 zvb~Z+T7PKsK-a5d;&5sV#yk{xzpWH>bsmevCJt7X-7N@w?Mv~f4r-3i*?Q-tGhR`# zhEnD$ZmPB1BRj=3oJ}LeQ|X8jZH(&axHwe;SH3G3?x9akj)(s0&%z$p%N?gy$+{<& zHL=qqrLrpArRB;U+%*K(_aIs?4z4fks5_@96z#j`-8TNtw}wY4YF1`W9YB9jmv|$? z%snzEf?yfD)1-n!x6rJt^Iz=|5*R>c|M&9;m@WCXDV;x45o)V`q-HjuuJ}OSxxBcr z0`wPubOZ40`|G7>J;Y^+vo)UyC}!Ke1|T&Mdr)1m%T2$2(UIt+DxvxT@Cu|9hdV<# z$EqD8p2!One@y3#ax_17#kNZRqRUa_~1AuUDk|!+l$hpKCe%Undblg=dt@zF-y?y-wXS zz4StGJj<@90S3wpSWD4yDa=x07v;}s=%Qtir04E=12i}(s$eG5ZQ3A<8 z6DJG8$^d1PSlk&!;(9P$Yy)+83@aMYlm(XOsd8t#NV*pWD4CEll@9a>Nneqhm)$C$ zCcTFNWjhT2apeecE)gse?a9+>agsDK26r#{b8|h*9{4I)I+DAxk~u8JPbeW%T(j4@ zBC7!E!_S~_r?zB|HK*anCYt!lM1OpRsKwgCtQ!h_+k{900!f)Zb(WbIEGc7_St-aO zh}qK;mQ%i1_^D8gDW*ba3`_Y2k?EeIX_u)nEbYlM-PTbe*9E*v2t3W4Y%T&zdzX+|gM^CD~iI z_eF#QDAz{g&TJvRm%hqX4=e`y(ZfA^)V7{PNeH$8zM7B$M zoMk+26|L&KQtf7k?Q@W?`R(nPB)Z0mT(Mu}K0>=2#f-%h=Oi7<*!vg_N;HO9Gp@+@$jDVx7g=_6g`x9d(n0E%RbUv zl9q7)f1BfD!IH<2#Y@6g?-P#0NEUHO-pbG(QDcQ#fP6IqiV?&pGi>(Pq6ue|eP42j z+;ZX#%7k+@;IgG+X|~RVWtJ|4@U|h0e9q%kOs4+JbWmc}*?T^!h@sv^G?_;r`xi15hE`UYSikyLLgV~0^Fzc_&vL^2zmQX5--4eseDIO6g*QB~bzU>Yd<)EdDjKt!~n{ zSfPIu$xrGONTY1NYe)3CZmxMSdPSdVIc*ozt(tW!@3tc-D7phazSb8}l; zo9$``5ueRaE&y`rG}#G>jsBQ95j+x2E%x?0?AvRDK3`4{Z2ygd$Akl@zAt*N#!yaw zovZCw*yp%|i~XrdEmk@O=ySfga_Z}UYgp#6u`zR3183s2Qrf^ZnuD*+PWzJ-QT#^{ zzjz(CSTcS~wj%-a=u7@l*^&%EZq8mzZfsNn83I!FCIB8u*lysyH=YAzER^ItuP1Dn zT#d49w(kIjKom&JSdgw~>}T-#;)v-kjv!Y9L*A5-=ZjmPb>nvF%#2D3aWR>trKJh; z>-|}tP!|TLVTLINLXrBb@72{gpYRK4T9zq@7QeN--R|W@Nu|ImR3HIa0cTgtJo`Y3 zK%%6-hW@*05f3(+1f2QTGa4^43ihKvVbJa;)v9wlY<*9IE1;V5FHYpE!#Z_gxD6Ra zGA_+l9bXTgOSmw$Nh)<_E95qN3SNY|w$? ziBbOkM!N#eAa5}f2u|5d$gWaxay4W_A}of6h9(!L9Il@pb3`I+i$&lZ6Ror#|>eok4T%S@d2jDJ1zBizc`dZM=(fGA-< zD+i$w#bSiQD=@j*!DEKQtC0#_^7uSG0R6U&Cy?{n#=Q@F{s=Vt{Cei2aSmH;{!~r7 zrzZeI>i|FMJd(Wj8{DWZkYjWCR9ak-`XxY54T0a8K!b!ZeMVmGyf{v}N=iTtW&(6$ zrLg>qabGB)hQlkM#`oXd@j4G~Y`kOkbaNm&j0!OinR1AFu~8n zdK|Bg7OG>0=}tT^cKd@)I>lqcH^!e=l#j>yo0HB50=i@vk^0yFic%tWe$F-9pI44|V`RRz$(` zn*-NbooA5Mq^sQ^v>rgb7x^UBTXU4^fDGr2ZDyZY6a}o14ZMu=cCI$sh+e;9&T5ko z3&O7F6dT>neUl0TS2>{h|b%lH+9*~ zhfzMRW#y;C$~>j*rw7iqT*xZwt9Kjpq9XhJL$kAq9dq_4E9$y)h=m9W)&{ap@Mi(K z+Ft+&I3mKa>4iF|>BY-jdAl=mRb}ih@3WImkHZL8qjc`#K5Yq#3|?m`q}K%pTP05n=rS?PVV9>h9hAf%iYZ>Bti*_G>-L^8x% zUcx~GCY(ErzB*83Aq%#^I@}Pwg_&CFv~)aP>CAF04A@x8^8Wn^57ZoEsSJS}R#a6D z#WMmxFHI!LYNKtIni7zpvhH_(Qbe@TMyxFikmu5A{~-D*Y$Ky==IF%ASy7G;o5X&M0U74Fwn?(6y*14w_2ROXq;ueE*2B&zvSkLMrcP?3KOQ_;-d?; zpxS89zX6U_6hW*X#RHE&!BIX`CVDF8Mekhc(jjh6GbrhzAh@%w7Q65x@o)8h3PN)) zaGY3N#Fr!I3%1zauyN6ood|#i%4~V5*d(e16?5u%9=A{0=v#H}HSJy5HwIVG|hjI zBuvH2!sjl&U2ga3gwWDK6R2PInc*1eC_wiD&>aG>C)>zXPZ)IFk4*&~1B&Fb3T5|z zn>$V(;zGyOC*Dc^xgRcaCJQ`|?JosnFJAhH)YGpm4~gf3mzI{|4PJk|hXQtGr6u)I zER9;czP(+YB#;m-C_VcTd==eWIw4M_A#A0b)+1bf&God7?i0N+9X3-g;JUK!UCzPf zD@y;p##TDm0>|%4!sHz3q)Ia0{a~7oKEb0Rkn_@vg<|Betzkd`IP>vCizu4K61;)o z0y8Y8lZr2rFtou}Dt3!;EDpInW>)?oxG-l&5_r6r(#pSG3qaqS9x2-&u%-bLvaUlv z*WKEGttKs1L0)v07k9h2p)D;aDB#H)+CVmHTWSZ*RccHBS*O%iS{+8%8P%%%*rGdq z;XcpR@pO67SLyTTezkS5+99Y|l1tHqzeQZRjL|6+*Yj#tgX!HdU`gGG-u}sfHJrS~yj>muH+83a#p_yo6mVPzEBTJ?E|*QyZ1qlTru(7ax_ens(A$t;Z-JxN-V3zVh-1XnCAk-8cX$I zoaW{pn9o9#P)^H8*O5;nZ&N9Am(NoCc*g5NK9Q5~BxIxbcX({$-bRsG7z4#hHwa%G z)pd2bNWwy$Jj%@=c@g^WTrmMp>e=PD2SPHsImp+)ZT|a600cNlsjz=}`M(P#vb7bg z#}6+&+QCI!(XU{Q4_>hW*IyF0DT4al8<4z_@V@nlJ9=HRS)V} zbi*}lrE>ltOZ2OGb}Bg(n6L+h6&R>hdv=VA%@;XD#No4%o`oQ(9M(;NGnZRExYeCr zYFv(ooC3mr35>8J*kZy=Wd58!&QgkF0E4cekX~2>w&1y|)?-|lh#)lPTrN1APe=J9 z>yd-s#RYkYum6dGQUiGYG>~;uy}Bx2!U&9)$HDnRI|D^`!>%mrQ-h(GdB~?w7}2xX zdUmg#V<%ZMY`NT=uI@JpSdkxciVM#kO{|8)5c0Pq`$X#J+jxL3fk?^>Ax1tYAdK!J zcfv`5DX~scd~jpO*!wvKOD)D-ZXL#}r5SQXCQX??PI&j;I8=c{ZJZ$7K&y@lGK}QI zY96OL_1YoK^wob7K0e{h#Q+w``*YvX-4}15P8>Y_#HitsHR6a@fpj&n?=T3L%Pi%2 zNOE9*Ja@BHT<9N8_U`8MgA3W)EC~o$LHBey`$&?{~j0IkG5wsqrjxhbRW%C zjz~$wr-sl;2HJrK<{_f_g}Lxome9BKj@Y`Bxv5Nb$!%sgA=cyBWuhW zfZMJS>2DzY|9koT&yl!qO75as=iLm+3lM$R1aLl<1_-lW25V*oI1^oNb**&=fpCmi ze()`Plun_3h7dqAa0;jZn)5fV2mKBA0l4dVP@sQ?1bj+nEY)su*}N@#4JY(kSrjAK z0(g-BBtlv$1U#T(016B|aEQR=;sX_?U;jT9l&MOAJ2?6-mEEtv`N@SY=uYrR{-nh* z7WAjAf_@uoTKmkQP{?Z1cA+6a;Svynsl8A=sK8}7eRXGQ1! z1oIiqulOihEM{-duR!qd*=O2%3uHghdWfdRO1kAizQ1|Bm z9;VOJPzd?Pl9b%FLQZH}-Qw@Jw&&+KrK`tKnl~fk;)bOehqiGKM{}XWqo$!K(&I~_ zTW@Ea^nPz86lRu{^g;pea6cbNc>9izzx+1ObB(ZIL`+hD-e^+U$}S<*Bv-4beNus` zRBIz$9XcIle8h-Jo#90xH^?kK!BZ7qn9{y*M_aKN?+t8|p~3ul8nk^P*e?lUWSK0L z3E*=?3PkJot}Gnr1eBn@#v9Sg~Pw49aTDa+P$XL` zTca#;1wi7iygJ@JWsy85vC1aAsf)c>)b((0&5xNbNp(`im}A7WI5%4R3>JR>K&Y} zFFi*b!|#4*XuIo3Li6X>^N705`t%7T=bI6w(&{=H*aIZ*F;);u22I4+svykioyQ5U{te@V>6&%^{sGgd>@Qs?S>P42YC1cP7+QGs4n2EXUJ0G}nXSG?lL zm9o51Ar6s%3su^1a%RmTeShO2jXyw8D84LC9{ z)~NnG78eG*Cp8n+w@phr;#oi{-wF}^KdvvJ!sg}CEm!+L>*blUX!TZRe>@{!uY8m;EbA@1X8_xR)eMvuK5^Mvl#hY{O!KD#q;-W z>2sacX=a-HbzGm@r2F2?4nC9qW))xRrFD_vAK0F2+5Y!DJ!xOhvr1Fj>e4dDNF{-* z&lGMgthW9&E&G|p@;xbcL@SeauWSkK7`I)YS_gl4~&&kt{&SyCveP>RzYr5&Cq_-zsF6DU4Js~3eN`0MVV1?aZ zU?_0=G*A4h|MOr=(BdeAqfeG{7zvw8So5FB@O#7a=8kRE=IPezo4JJ^m}VTibUGu= z;no%JCn2fgQ`DIPbM1Zs=VWSszlaKc%DPtN?CT|GXPiBJTex-2jAzdS_ucw!u_(-E zW=YTd+Pg$k?RvkDpSH>Ty3-r8O%JbHw&h;b zp=Kl3`lzs*W-}(lSeM0wTBh3Ft@`l#${p6F;3RUoJ8n&kp3S7BGQ(pVzhzvHF!{Qi zBUtg?`E3)Q%-tP&Ye}vB?1L)CpZ7V3n(gk?+Q%N``F8f3MS^*uDreh7T$jxVvJbek z&cJ5=HtomZ(}Pk%Z_fUT5&Fy|Q3` z!$Mx`w52n@y?)X(2~@s6o|??lthHjt1m>serBOU*wSWU3O$uu-Hd?Y=^}{IdiAk_{ hYmAb|$9n(sr>;G>3k{2(q{Yg0r~0yA#~q-Q5-mA-KDQ;2PW)cPF^JdvLyepQ^v=->Q|V zJ9}rkx~IGEIp;>JC`qHE5TZaqL7~gaNT@+U!DvH4LH8iRKt3Zj>Z&0F&~9qdVo=qS z#K({WI4e;_Q7EXoIMi1Yc*rrbvy6@#6x64_|GlAyoJ!51pgw-dN{DKB8=mDLis0zv zek^ykcdo9se?+YEG_*IcM-X`2{JW75J+}^5GnhJO`JQkBNuW6qSyuuQT~Hb+?+&j5GrC{_4uOrbVqX z;*$;BAx0Hi@5Apculyp|7+34@mg4|+ z^tf^36@tw4bP;27b2z;NZ#uX@?9TB*wk%9d#4x$;Q{z6vLHgq&w&|Yo&-PyLfwEqi zHL#>sv0(Aa$Pf;pZkI(m1m)~r4iY(V&=~!2N*EVkaAeC7xoVw=%aHb8By`j%-w2>( z^~lJGBXWw%c5ghBmt{3mh!0$Wk{N47weN3o86#WUl}kqF*w=QK)Se9cT7$o%2fUw>Y@7dKYS9)D8xhhh*3W5j`*+YEKTy?8q7jo@M(_r@OwVzWF zM`U^MpEItdV=DI>yR{EP7VebN`?+s(DVj~BdnV%YqIU}joF`S3H1U*m@i7>ltdA$2 zc7N%Q2Ri&T+yv!Pj9!gRv-MN?NJOJkxp#HVjDx3YYxBt&Ip#Mv$@IJ^DyIotYyFqt zx{nB89336Cjgfl@Ohc+CCl?nr89OjF@6kFtJL`Hr2eZ%T6xY>ZDesF-R1jk*-jE{) zj7|vjK@;YxaT>yRGnsdstjUQo>mO^=;gRGQRqQ9a)*ZpQ!354B_^`iO@b|UaP*bvf z`bHPWK%pQSpGkOEGboX^?1xuLL~?in%NC*spY(tgUmapTl9O`!;P zkbZy1)uzE|Z8GkSiHbBPp7t{P*%#Hr#$2pBz@{<0_B26ayS#&i*A5mOZ0tmc_UEbHmt=}Xi;qiiT))_p9nu!-*4)U0GIWcO=gKBLWj`qivMsMr$*?%}? zl`|;T@?B<-JUt!eVM+CV?VF2NGcbr{Vw?XPX~eJhhu~nLLd%^n$;?cAueX}DYf)`u z$f1@gJEb@rE<+(TF}Z*8N>O{%!1p0Ewa#81(eck z?CdYkDv^xPEqumX;*3yqq~)PkFUG9sKUD=)wT+)9uhP0D&H>$!OJL)IZqHz~jH6@f zN7&8lw6ocXC!M|0o^IY0Hwib(JrbAw=(@t+XaM~;FVoZ0S2(Lzk2@jK02F?x!|30@ z&wQv(9s2L=`iu<+kuXQ9_Z$Ta9o*YY+1r;)SBX@EbBJZ<$-5LGbL}OUk~KbfBo+&KIum z5tX06wcY3KpYVfCs;;MS>S_){GE@D`m0bE=A76f3-`<6lmC-_V+%qD3ea8h(^-+Xl zNUOE}sMj-gYr>RTtHuylwFAdh^y}^pkm+}P7=phc3v3Ke-|`LlWC7z}f(JFf?X(6x z#)Pa(?l)8nreMiz3Xp;&iw+t+NQpu`dBoT~|D(DRLze0@UW>U+*;U9A>J)Y_Js5BE z%tHA0;LiD;3{qjY&u=4G!p#ng3RT*T#4FdMuXx&P2Ia1tALH1W@#2$dvt7`Mi2q)F z$f!)Ep_=rqXw|7x?THKT8ZX`lwyg-Ykyj8r+KX=&~TI&oK;&1c- zgm3dmgoAo{4qIt0`TO=wef*KC!`P@iBVszWta2%0L0w7-%xRIEOG2d_1;eRD=o1?b zk63bP1s)Z*=!bQs-gGM(RXSBVyoNfwnj>N=Ibu-rEofGc5sd8^V}sLDa$C#O?2iUP zR;6Bp$34q`3Vy1%4!j+56vGzy*EmzVL(Q~rU{-V!O`;k(C88gRla}O|h=>HAj0T_Q zF~^l7y!YMhk1qdVhr4;<&RnQ%&+as{I{HNq)eQr)vP4+-(7rTdz{Wpw*IM=RFRP@m zHCKIG7JKO!c`&Q=Ii3b&R+1Ei!(aY&iT}6{-Ez!7Vl>Z3QF8MPIPiJY!c0zSvRv9EwH${VI{itJs8u1f3iHR0|XMDHTbJ6^85P0XazB zaB`oRs)I6$h}^upAM2=`Coug~?4=xl!Exej`sIdR$Ac(5(&A(C?6iMYD>H>pTuI9o zkL0rArAhmpJ)2yW`SnMatgxTw`#W4kd<;@JDAHu2ZINrydnL=H_B`SmV7Kq~8A`D4 z`{?(b#2pLXK18kGo%;r;`Bq3DJw+IkDl*!%EG(FXUDbvS_k)?~U)}U_rh=80iz1t8 zr`f5JMv97xoFkUbQOfAe^qSInZvcdwGoKQSm5}|!6KWmiW@N1{t8~~ zhPj%So7Kv7?&Ydw1a5g0N19DH0I7>y%}cLx0bS|nIU}b~cW9h{IOaL$x7Q>FB#0bt-$b9>)lbPh?@KffRv9R}?Z#zgU1qu17`Wf*Gnh zBwKt`YqOKjv&nNCd_s$d%*&flK?b~+M0x2ye%JT5ALWezFYv`7_Z|t45!Op^a&$7j z-M7pl=!WpJ0Tb8#byg={ob4Ij^YFx;>$*1n;#6n`04zljTfEe$&axUdL4c2ja`jN5w(mC520ZF1!JYpVFWxT}x~o;0gSRa+ zAGwX0MICQzKIaHo3=~C_X=WjEZoC@{FLV<$nbkrR9d02w%du--FS>xxvzL617ONGj zQvoZUNr`qrX8sEI2!9=9GE+g<7M(Ko{;tv^5-Vfq_a^YBp7FRxgj6PtAjVtq%e&QI z+bbN>ErPz=I(Ymp`)lL3SIKaYq@)BnRQH*AL}6m{;uK1j&~v07P|f}C9ho$+e(tI7 z_-4R_lx(BbdqeqD-<8I7Z(epiX)vBm6_<14u2^^j4eZWWUh($wU}0s|>=uwV^wtSK z#f?X7N0;?bC#f#WoL!JyOqCwmA@Hh{yPZ{E+U{-*b^JKkMQe{=r=k(zE#=Gi-YBW5 zsi=sq?+r=gj{}Q_j4FJj#KanEYHF(ANbvD_YJ-HS0-tNTDP$D6)dC4gGOS;t+rOvn z6}YK(N z!hDQfW)S$pW<{$rx|-mXGO5zTf{hBb?PKlb5qyZ|kTpF8_)0~!#R}ULt~BJY(@&7< zRe-LqlQYLGU{D*KMn)`#fi-a|S-#+zwAd1pSz(Yol(KA^l?$k#JJ_t@WQLJI3JN zOO=v3f2$UEyc6-#B=%`#7y|QA4HBmfai1jiaQ}~%#LrD`s|K5={w-R84fc3qjzo%= z((z1sO(MQgZQ&2G_B?G&o9V5?MfcQoY8zb#sDgbHepR3B5d6&_S^BkZ$2PZe`#-_+ zBXu#Jpj8o8ZKb(I)EIUqrify+6@;v_^$e5+DYd5@SYq+@%P?k?=Q>Y1Hyv&eZTwPH zR4fD^acdqN9Pm=gfbaWTR*#>U{%jDtLosw6EgWqZ$Q}syx$$$a;(l?lu24?Nmfv3H zztH9jPD!MIl7^Lz`0Cma&c0`5az_opq)rNq%TYF_dsp2(R*1BNG!Sb5(R+3L~s z3LY<>AuVjP7Wn#$WKqCmGrU<}F15gGqDp^j|okD07kP<$n;Fqc3FPo4DE0q zJ)nj5M*8*|Gc@^!Vt`|_<7Dl5ZpoQ63QFV|X0ZZ88-l2{q6=Wcbm+_N$mZ)muh5{k zk)F&C;~Ju&$cB(Sig%ZOS2J7N?~v;E5ooz`h&5){%{Fk#`bcndH@=1+aea|v!uXH@ zucdW2b$)tq9=ZPZqIkZE);S(#lL&CM?04t4Vi9VR);r?23~p8 zK0=iBw} z5P);=WW{Q?g@qE9ti?KHxR$7u3+i+Uq(Q#`28*d+k|a3Ubc{6FMS2{ATZyFbK1EA} zN;8n^G*=1(5D*b}Dc}mcIMwH7utLt(`t|E}!Tm^^ zOTqPF0ku&CJdxtWDJ2!v-oZhH7rwqge8EPC5BBC?Ujz?|hhLzSM%-6j!}{dJ%;#Y> z9g7o(T|Ek#>cyiu%*wP6V}Ot@4K%kp5C;$I;MEj(c6OGWnvm;t08SxiF57TkMHdib zp@9rz1Hz14kX?SF#vze}I9ng>-6<8Jqj`Ek({%G7%14$cywW9~#iTNSj`3wWUz@pX z#_C@j9b%;(dYjdOvx!VJ`f5>_5^+Z{Uipb?={0oW7lVuupos~Cpt<5ssOzWnB73hV z0O+?7h_~b4%f&MB*Cd|@>vKcljFUc7b~UAV3I`lXs1r_srF*?;0I<=bFaT%LuoJaA z#$pt7M5&>BvNI5KMc!D~$Q$s?A;H>*aFG}5?e)iNs=oHwXsOx-&V3daY}e(?^sYQt zmRl~M(58ZL?g_I|ICuOx@iQh13kNSeg!4c^Y8sG zCg>?HyC>-8m8&l+oKe1h1p!^NM6{xT*7IYhx^j~L1ToyLr|(vv|5j*G)M9dQa?*Tk zC2x;$VKNq7$iMtmU24Wbj2gP2H%6DjdGz7eKPz)rrhETq+2jW42HL>(9}K!qkiolz#!ub*RiuZ?R|S; zO-e`&e0Fadsn=Qr*?zNKBWoK=88hj7GLuP>H3@q&LrOzpNL3D)WzzjJx*ls-sx4Eb z3maFfwOAwi`&VCZ%G9DVdMLFaz2h8*Lvd_IB`<)Uj^31v)tRWvUa1F!qBWx$7|!&) z`>KlSABIgt0hxdor^k^wI^qWN%M3aZY?Pz(Z!VTU-nXq?b;2 z$Xu@4_MOiA8u&9L6dGT`r58zw)vESV2TvK&$aIoh* zJUz135EY_$pLrdMfdM|{Q|2)-kL`iG!Yc~-4J5nY1LI0IO4iwi82z_gIK7EPb@7pI z_BY=vAL~BPl2I_f-v4v``$1=VX~cCiQ`2OfULs%~WNu(!fWClGr2gm?+SJsy>Mms zv6T)yS&>zdXS?Tb9=R_h|4e4;hJ8PW;>3@rFk}*P_*~1R$wqpCb`xYZH9&XY>HVLb z;Rp_MU%3+mdsW?-H{4Ny;kLARxkQz=k9$&OX)Aphc!3v^mGT#bl{}4QEWcd1#uP>3 z$n=pW$A*Vh_+7;G6)GXfPhs22N?BQ1;^)uAfKP+RHk)L|Q{+(rO=E>B1Y1r>xQ5)p ztCwYAC*DQMSE^->!>vwCtMQ~2x8x2!Z#R>eYME(i+#24EWTJ(G@%&}H{LQ3v4x)Z3 z3xEHLGX<99sC;7r0tX!*+S=M~Zd@5V_D1s45V*=!z41{V#|H-B1I@?;T0GAQHN1I% z`tYWHW_1L+EjsN!6jFhKf$kbOYhz3Q{$XQdH=CJiZi1GoD5>e?eyK%9Ms5Q-qQ1K7 zTVs5iA_Qdj3jth z40;0a;Q>4}b&b&xV;?FOtN2!Q(!^U7CgZ042Q}@v%>krsM*sR`B~a_FS)D<&h4zZR z57^%w5)>3*xxIdf*uiZ&a;Vz@7JoWe%AU7kEz9C^cwTL$At4hC??=`hYJ$Xg>A=vy zfP}Q0o&%GU*7KTHyENY@j=RQ>T?Szk&5QmU|L9cuQSDDiokqNy+ z@EUt+gTtzGL@q8awMzb`u0}7N5PYnUj3n}?HU39Ua=^1xh8JMjEKpKEy-(t2KzZqY z>RbFzB)f`34pn)~{tiC ze|13;%SB63vy-XkG`+^v<#Hkn3%Pti>0_8+xW0^ z2q$3mhzM_C7Cr+bWsLBp^>y@au-H*nfGQRiLRg(2qA!auS;uG3SEDaO)zRMjfj0w-`Cq1pP7FkYh+}e;c*_ zqkm#(C`|4Rj3p{T%#K5uvm_lp6D>iGr?RuR&|QapB^rz!7&Hc6ao-kR_(CZ5t(;*x z6?SE>rgE+i^v^VRq1P=qPT}VAPK|37vh#ir55L3--b&=EA6@y7OD~( z{F+20gHBm_8_1e`%{dP9&)wZyUf+khRW|P>d&Y8^Rs(q$Xm1`zWo6W!|Hq3;ZW z>}GvWQ98`I_QKpL#!tjT?~!UyeWW_5>>YH`wZhgy^=ZlTV?WtUa1t`}^EJYlRM?}s zQdp5+EztqQaQ=N60vXn7+*35MS;_3wBQo1nb*37xcW;Ihgx49kC&aijrEB2WYL~D8EgN#)B5fA0* zd4%%%j%j;#y<#$THAcWkyb9~7$P=9%U^?@4weXwFk}f+Kbh@Fr28up55OU;|XW5_X zV9Da85)|;~nabM_h(Guz%rP7TVdYq2GlRY_9 zgdlI7S#XZBW2lhUGVF&Lzw|$Z=q1~uL4LufPY=R#NVwI0l=>|fvCi9V&8_+}wHHgl zK#gzTJiNS|Y;1fUuL?>_tyO3KkQNigq3?^KfL!-cE-N47y=`yA=g~(ZT(|9+fk*Cb zp`l<9Du9E7LnN)Jh{)D`J9Za5mNt_B#uI}yHwfvup?wH0Cd$fjm1pzQ3aAuJOz0R@ zZi}6$1%FH}EfEMvNsU+{AkUI@PQy=w^z`)7U%wU>7bAuM$gxscemy7m;5K&(eP1&( zGl3ffkt$e>Dyzj`sDc6|9;kY3F%v?6sZXasqoZ?{!UZL3Q~^vPvRfn!&LPA+EcdZJ zd=_u5(-RZu7!*i$G`_Fy?Pg)0gF<@3V_}Ne5DO9sNYEJ{)~p$CcP|JsyFO`- z$lC@I+L;Gyz9y#PMOQ^&;o^cK7il0j#%$QpBYuU`x!-?gU(8?rDdruz@XsC*4z~fG zMJT5bI2+%rX;GoSMKK!?DT$qW^e-33&L^IHznr@5nhH{6y{!Z4-}Sw(wnPOukQ=yxu1lQ*Z7C&V7Y#9fKa|^mK9$sFi z0v)TWIw5`Shr)%uF_t7|>O*Jo_`fwqc>+FcLPDf@Dy|7@T>(U-!(*if%}6I=_7P-1 zWn~KIwyQ~8u}{#O41`|{Bv#NjE*p`c)<6KDp^AoDa!OKTQ{6$!)pP9W(ov~X0{dn- zjgPp+Ph(AIfMxe6mw*M5VP$3cUd!~~DKAq~7}Ode9j|f^E~dJP{Tvvtf~ZoY*HGjb zBr`~XJqA_-QOR13eP%u$egAOs;gI%rYyqhfWDdut%1TQ`aNH>PGFv#z6V>~8RU%Ht zPEXHk2Dh$3Gjp>ck$6&zowiqGuvxC2>#l>yBvi-M|GvVR#7-YD3;5A2e3^?>)#hnI z9r)V64e+O?21c|xdwZu3fey5$HPLMKgggp=#r*J=+&4Y`yF02bP8@l{E`>=oJpeD7 zS-%sCWe#TUJT0_P8MnxSij*JbDdR!NDXDkCe~Ztq0PJy~HE*_D_6I$V+)I9A=M$C@ zW#aqOd;2L-(io+xXn>DAWi8h8ce^!-wa+oi?5fA=F^ojsyedqt7rDET`gcaSH4vmj zEwNHeNl7Vq4Q<6_$O$Fk^N;GJz7fEGgL<_|r!*_XLg6*!z8(P@c}~Ze1<2epi}Iu~ z=O=aJtxE^R&>U4;0=LBY>~T%~RxsT z(ACkIH~=qe-#vmFpn(2I?V|cEjAz$$A1TWWNiEdSIcdtLmLx-XUIm$Lnb{rLe}4Qa zNu@sErQLGw@YW|FX>!`$8_IWk1*UrSf)+fEtVK{M1Zucxe-p)#%P8Gi`!Dy5AqeSU zUVtGiU4xsYwhMxPghj{_@jqgK5ZaYA*(W5|v7r|q#hQksfc~)qQoNlY%4%{h99Ly# zW@R{&gTr;^=zr1(rxkQDcCdbk`b(QDiSU4d<%PZpnxz-rHD^0gSONtfd>D}A!-6>P zXYFg|m(bzRvKfpi8ct=!ciY4TSurD!YmY%x>-W`sec0|$X*d(Q1Mq4Z1v4=eX+74MP2GAwcpg78~1 zM5j>&gJ=k|+!5qjmCQ6WG+wck?$mbO!k5Kt>hFEyJY%=}^Q*XPAaQZ=HTpgLm;trF zDns9n4r9qFuVfxt4{+mEf`52Q6*p7CEr0nllL}2QcHDXZZ=qyK6sjTA1&ZfauK>)4 zq6LMXV(eI&n1nEIh=dDD#-LL`|J7gbTn`9C#r~3HWFCq#xYr%_pH)K`>b5$x~iiV;9af5%ZhcY92vr{d>o+f-;x8qZ!1y zqqB#27_C$qW_=14z|B(onb_84)6<;gpP_LMqE{Mx71n()`*JPY1vrb_NlZs$yAhCn`vyp483WZfYz8pV{A$>J!57jR`aD)l&it+4q?OE$@*?#@q=EmJok2&hA(t zXB~^lA|o>}F!*1e*?R+EC~ExPZFBw&$+xaiJM*1}jlp{aJo@!mxNrCT&I|ZXj*i48 zB^jUpN#ewH|H*FotBN(fN9e%EqpOw%>60(bXZ64QKj+V%w~3g0$tZG$Kx&DJ=;-Kw z!@`zdvST2j?~kRTJRokLIs+;_#4HB9YpJT8_~CB6jd!x+J5-2|7Ik2cl6YtsajT*X z#-nw|#FrEo-_4Ra$nCqBNJ}HWJ~w2v`;l*pq0NKNTsBqn%|jwBgR45Vhwq*?30&GS zsgPzUL#+XZNX87~2>+c%92&X-)^i;Pd7FQ(bfP&JTPD|!Vx0gL6sQ~YYod>XA~8t7 zXFcz4nrT3iwQjPr>E5s}VDO_ayS5ErG-Zr4;Wr=CaN3yHT**of1)svuCh4?}dz2E( zl@h%zi;9ruB*_HDzO(dGy_7*IKS`yaL6l&^ki9Xm zIDg8PPnm{^I!SqiC)AF58Psy+d*~t1Pu=3Ci_B1Jwt~&jVz#1|dlWlamhm%~h-9v4 zE^XtiEjn_^UA66Mn#yhlM9xXdZ{_%tIhUjfHG|WdOR=s^FO$FLb*1r-H`;_~b7sLU z?eSU}i6uktKPewI=83Y7)4S7zu=f-dDMMxqwcmKZGYa+HfO{fEEcEPG$eegECt`Rf zwMWRBQ!Ks}z7N|wNzFjeXEwMmzE{69Tu-jp;S2}@mKy@~htnEQ!2?~)`ZFCWe>Co% zrriYU2bZ>hudDMJXAf&F-?v&@TOC{I74S!z(3ISs+$c5&zzV!q$jPt)!L1WC@} z8?9L*2Z|~E4~n#A&sYEe6cgSz5F)kdIeowfgc;4 zFaOT_{^wU?^_hSdUESKJ$?4oKq#Ut~^hV}$73dXNdmkMx0C?SRN6LlJrue()vO~(% ztTK^NFnb((avYhKnudPVI;17ov~0Y(zwXUkXXST0_>r4S>LsVGjbAxvN|lw{X7bgu z7`x0uRhr9b^L?3H&8VZfwKnfzWN|`J8R+i@{s?;C4HAA`2r_9mAmpX&FrsD5Lft>F zN5I@$4MQwLs=_vzmnbZnrOOL?e3PF2X{BVmJWuvL0+nF{`3QMnptJK%g3*c1RVm z3sfK+X;+d~?k*9)$@z89iRxk}a@W_O>trkU=F*;*T|15kzpET*dg(#u-RLutGPa!{ zn>qoqr~_Wa~vp`O=pA|n8nn;Kg^`wbn&9SpHsy7Zge=6Eenu8tPTUHJ<2H8$<@v4UPZcq=rrXV(Aq zH3?rV3YJ)4W5dk&r6$Jdf79Q|F>&rhfB| zp|-FH2?ct4vBco#87hc_CpIR_E5WPM>;O*~4W2-!d;;0Z( zi5V}D7Au5j%%_D*Q|o*MbRlnvNh2b*s99K8Ty3@4TQxre!(R~k5r?3<(|`tStXvT| ztg5Py@VhNnH*YP{9CsdCI`x3m`VP21h?T}JmixhWIE0^X_C~P114C_{)>@z!*!-8v zd*~*EGcq%U0$(3Z)MjNlIhDQ~h*^RV)jpQ$h>?+7RopHaXR+~3Y4mUkEBsy=-0qX! zb7_=G*lUxeh642r7jseJ;o^Xu{YJ%qZf2B{>dXG2Fb|Qzf3~lCmfl- zg#OruMXvZ*Cqu3LRFG3pzuy5HRRcldY70r2ODL!zsPF+IwDuO$jZ%xsrC}IEs>jz| z9fg0}hWY(QU6}<8x~+u)z6Jq|f{r!SmIY6tTyNW0%+l>1{~KBZCZpC|%Spf7ek=<7 zcKQ)i7T75uW5bwfSHVDwq9-b z?YmNdCO@+bduwxs579hz%eTTjckG%@o{BxWKIJRDRv=gUgsk4Vd(=rfff~~Q^@!~{ zFb(@4R1-tM;!kCdNNB*bx1XP{w=p#hLq%CZ2(uqiWdv&E_i2|iR=ykTt7&^ij~}h_<(t^cTe~+;`mN-Qr^L;TvP?7{KeBQj=*ZsE3?LG{bTvh$J^S%tQyNeC`lj*|Y z=sV;|z33eF9{dqFb7v~hgW3{*SQuPI2k=z;9YMIqtHcruuYfH<#ymk_C_?nSqeB3A z??4nCL>zHZJ=w9K$RunV458V>3Rgu@{tU-^k(x0n0klv~xnAr-ZQbToYQ(02faDS& zP{9wk1CEvU=!x)Oir$E*bOc5G{Cd3$JV6_O=(iutHk~hN6csbJWrdDv?>^Z|yYZL( zR?Y*d5zhza;&n_?uqtJloHHk%0v4qFrX!Y(-8E>EMW6FsNG_9`8Fs{|!;~Z=<1Oo! z)agvHljBEl*g#T6`6k|u-lQ)$1}PKI9u&zk>gwtgzFQy6myw@J-@-GXgjH;>(wYj`S|0b-pjPKhBQ&{sO5q9G-1 zZO`C(tJ|Tro|G;IN4ygk7I3Fhrf49*edrgbUVx-`|Y}!@L)*nK7CYhw$o%0_x)v zE;)X(SvzD2zj90%_;vil3)LtMxcMg^XNx-1i>l4}`2E#@hmVh*nmVGU4oY(#L^U`s za*)qH*`lq@0p!wD(7?$p^ziV|(a{l;{z)!_{+wS>RMfkuQh+wSDeO(8)cv{`t<3%Q z6c6L~^V4Gxul6w_9kW479QMs`IWK&6gHrFa^u`oixIyYoo-o{dU$WbEAC!Q>7q*%{>GxuJm@7LJY^TGv;iUro0Ohc-6992MOk z|2_I2J=71{blhMSO0NsJH4xKE_~x-P7BOH0}U9#8o!bY8xfTUcC< z4vy}4?~C?d^<|jxC31a-zo2tFl|^%y>$4)$Cocu0&hMdTnBI#MHR$bosglg{NRpg= zc1A!6-RW`p`nBatx~K`Xk(1I!Au8+E@%PA7T;~)&hP;g!0MRrSRmehM{0%%rJHXe+ zF7s~A8bGSq#e?Rab=?HVa`IC;#wS=qxag((gFH2c|Fs#+gd;B;aT>)$HyFG>QF zi6kqN5VvXHUz9@k%X9v}-kF=C+R62ec4sv0Hks(*OlK1*sli*>VRN>)j~=`){mt*> z1{C3PmLvk0uZZ3M0oPI<6y%ztzg<0w@ymg<;i#&blb~@5j^BTj$c(#z*_ycSE8VDp zjhm||-CFW9I~LoWWr%E%&z2mkcGTQvsy|My%Pg6}AX_+vEHrf>&+3v0CTiK|=G>8yUIFt(m=`xE3n?gUT zz7WX43&*RuxuwDu9_NcIbFpFKwc+<7+Nh^%-MI9C$yY65J~zBrr6+4K5@7bn6)yTj zq{$xM<3ZKft=&AK!Hp9J6DXmx>$ANE`ChICCa0u)GY}@`_e2xE7@*95xf50}s#eFI z_WPcPkYxj;(vDMbGg-z=+*DrTV{t?RRLk#1K)_-S$H$gw`ES8~4&xoqSkMcRYpPup zozb|5i?_v?Tv;yc6{u#*6|S%0tt!+AoA3u>1km<227%QysqfT_5GhXj_5ClvYYIU$ z@r%9)QDCc6JuX|WaDPA*k7b)%hSNpH;DkOsL~aU?Y6iqvI*uk0JP>=xw7$E|$<4c5 z163hw+MPGT?Y3b4Xkhr+o6wUI3M+Dn&jJ6|9v`*-?I=Wvl*q~^5Y4xhH4JtzkT=Vj zsI4^^%CC&;BpCmE#4X4=Go~sGaayBVINYFO#N(Kxk9P8)#Q*ZJPsQ%&%q-{#T~ zaU<51t7icVxG83gDQMqs%iCCMq4>^zI@>~_-vW%y;@ktb&^QRtg-=+nRZ;-xgAPCh zMn=`H(e9QBk!EZA%DMHlmPzoPWuX+hC}a28W_iZhu8i%&Tn;k|yOxsrN4u#F{~2Kw zX{?f}SMZsx&FaOVmbX~E6_#PfczZ+_+mSthWnawm2^*sU^^d?%FzNOl%HyP2$>{45 zv;q)R&w!WS*P^3GzbCtlk8rUq>*KZ?K|5Lb|Gf17IqbimmYJx?i)>+GVGv4eaB$Go z)fKXof{@}fGc!x>T5zX?V&Qfq5Ih6|cU9^PQW&$~KRrE(iHT)L!yzw{gd_c>RiIWE z7w;Rh!@?HLNKe;qb1!RdZfFLYM%0%&vYGE`qHN~o&b(!jU%FqNAe`F-XTJa=6l`d)&Lv?Zb6}=58}xd2k4zpg3lPgn3+bC%);t!rO09=49BmCsi)o0VhQ) za=IL;!>}<*MeE&Ce#9Y?Hp+!`s#+9KL~6UR89Dxg9^F2-C9&w2$@Xv+$dGFd_4kK6 z1p$1$P*44!;}J<41y`E&j8%4+wcYn#=gFh`eq*q^lA`Clx(W=Njyq#i(K|teUaqC+ zOyjBkQ+|x#XhIK*c@0dxjBiiAXXVs({^m>07z3NxshIttg2bx|^64HYChF>Q%f5S< zl`s&iiD_@XX=?6Z0gntODr?|r>5kTPt=-#@Mv!}xS@@Ay^vY!pc93$U+Nh?8&j@Zg z&CvfTOSGa@1i{Pe>|OUJ8Pzw7n8c!inTzWD$1jOTkVtOa$3KXf$Vh17XVe5uy@(BL z5WFro?(gpUDd8$UL5!r~<6GI-AdMRjURD)0sTq%dynTE(n(cpQvHksnSz9unhY-+w zG-8L8iVAU9NK=!i?a7}6qracv;o+UwQW<))#G{sVip!RrRCwlM3#;6Y;6kiBg|87^E0KH%2t{^ ze4u}h0M{v#p{6DtCg#@O9-OJRVzqv2Vrr_CwUc5<3=5-xf|{I~oUWXh8q5#&Lt+|~ zZitS3X%wFkFJ>fLsNso!WQlxWUpsVT@l-R?5yL${PpCtwl>M0zPESsRg?UbrmJ$>Y zYZ`G##sLw4f$DZ;;|u>(W-E4eqUx8x&4thTdb3M&qa#6V965sZqR zORA|Q>V==5pNoOT(&bDldU`|{a{veyI2QJxu}ZVQQ~cjlw9L7DJ|(-Xd;@uhIdB6n zVlQl{2Q_{9RYtIJPBa`+m5LPN%aFv{g9dnu?BJ9GV715VWTa{GN`Fn|wQzV#dcQoJ z_xDRMIWQrS33_q>fk0L|EIcN)@IOclw}~bKv&k-V!qwkpPyO)!(Z5;vYnYGzfyT!y zrsXUP$mihOSv*fWx&!Zaaw_NH4GOiavWQ5<&mdx9B_v?@Ze1P-kBv?IXu-`%G!)W( zVf?~YQi;7F?r7@IPZDq*K(nLSKLJ;1oql^2Xzo65=MG~K&IutZ2z(fBkk1@d6@I9! zrzAnbL+>oswklmniKMsOZGDFN%Q$6gLRH_kK+S1E(R75CaED7DHh)sZwXAQNMtmyG3G&(ijfi7XlXhOD|Q;@=G*OsjoD?w zYUNpV0*zZw!t*#oVDx;n<&ZoDc^G8-LQR&AyX#Oa6z!~`UD228i$#w!&h~oBj@=k( zLPNv*z#oo+y7oRZq!Og~_&C0|n!XBKIcs<_U8lzCVhGC#`V;zF(D-i4CE23PKVs_I zy`KZ6P_YR*Ev*hu$$}jLTY8+|1yDO3O#-=!iv709>SpQCCNN;gH%}`i`9rZP;X}_S zo4-^ZjeX)Q7NTj#^ky`wm1Ga*Fp31^6ixLRkf!Wnysyc`wbUyi{juD1m+z0@q$j*Y|1;@y2a(1PBG$k;Zy;~1aJ z2x-&M(5QV-Rw0)Tr>3S}L+L-8-WI2%6xfIM-43(6Fx)V_c$lh~76|8Bw03fV#WfM_ zu<}M|`YZ+JTpdy_?Cj{s29t`ny4JpfZX2c3!z0HMna=ioLtL zyZ$?yGGBUWdTC^&vpc(0s zPg}^I5L8}&Zo|z6j&f;TnVLN9V4CEPPsk0m{ugrxA1=j+?<7%I)l*}mD|Uy>`|ivavJG&95p+Wkk6tSM0M{E5 zRLQtUc}K8BW-}X6h%Ton-rkbuJ<3t5nVFG5%Z8yJYjvvQ%jDfk#$>9>829_=JD72A z!b57WQj@F5Pn!Isi+5Aqt|4(1&*os!lAesS?Jq%#>607m4EHZTg1QQ)z zo#D^S`Yq(}3V(?#YsKW{#~>R9ksGlw_wlyR$GCpsAj}`@kLycg4KnFvbvWMbMYO+c zWlU$296SWC2PLW=o}b|1

LDV7d!Zb=BgsQDB;&>xC;j@f0t3fpnLQ$->2z9y?m! zQe*e~MjbuDt~Wy)o zim2TpWx>*G1moRd7_C>rd%pw2FJ0@zKsxIVkAr9BZ)E2^Aq6{}0$a`DxW`y)=NTr; z=#DB$5P!~Bc_^cfftigBL%y8A#WThzljc#f3w|Dc(cvm~a;3## z8OLN9l+SG;unO4LRa;|SWS0|fP$9)~UH0R8TB`PT6Kh%T?;qeH3}eB^LkM&4Q;(<> zij@oFnw@e*x8TNiNZR6i^9# znGCvBN1v^^s+sbX^?lgm@xPiWx#W1&Bh#taI6CSmV{Sa{J6vbf)Z6*z`)?+;bU`?% za^?|4g)^I1$$e%L0 zvoc#N9Kxh>E-a|n!Y}D{&_UA4XLstD!Spd>c(5G_eL9wrTg~VJ>llEtptQ$U zH`Ng&wfCp)t2ip=x7wHcJ)(JD30eq+qN%y4VuS&0Wo6|b#vOsV-Hs47eM9kqtmlHY z@uP)~l7W(e=7qY%*YumTuhWR%7q@vBKfqnYIJFoPQ`PnLHAK$pqN>Ux$)u>L9cxCT z@vX+F`{$);0_GS0zv)Kd?8lJTWssK8#x@>Bd&6_GC<4+-mdtCZ}(2qWMkWIY^yOF+qUgA$tI1_*luiFjcu#3Z9S*|=eKV+XLDxeGxNoTIoUyb zhZ;`@${qG3Qek`hi>WCEzS`;SP-Jp3*%g+xE2CuEHU3Sog zxYGC9X*JoWU)=N@c=+(xCNx^xF4juE4$fDl7Y7wSk;P+#9H~UB_Rh@IDDeqo_D&0H zz6E$N{mJv73&VkdKmUQ&)JPVo4`TSF5zjwk8i0 zHSrhpDLpxPqGnEh`eH<3RDG+_UjsvVQB5t2soX4zom8q;GNaL+-yg*!UR}sD&qD`p zy33DWq1Fj!V6S8!h;J??tiq&53HaPLM%xrj)WZ8m-KbR=43p6Gs;4e19?5zeHhuR@ri_?38@_eD$W6QB@}YkZ zYi|I_aj1TQ3c0bz3RNxZztPcQmK9esB}cTct^J(=NRN;1xbvzh8XM^6848>QlFW_q z0aFD8rCw6&MSA)65Lc$H*)Dt#XVaUjvqv++ zE!ircWr$)(?za;Kme*Y%TL?Ap;SERh8K4_7-RY}6*DX=B{<4DkC`Fss;HQ7WTOmYR zML`{Y_L!jqY8o~m%Xr>=`_%z=`REiB5!>Io_2N~xenMo#V*xrVcE*SjdKuVOwc!ow zC%)iGZ+LRDJD!@uRttN$5eye?yGh>X^fS3RuFJvPR~e4Tb$hy_d|70CPT@2jQPz+& znLDw4cs`u#i5aiuSWW&meL3wE%H+(&n*FCsT!IN248j_h_MdB$I{_;&{-TYKr%8l8 zq2%dgKokZ?n2m?Vnr>??zo6DB6;YKns7uL?AYMVl=`|9Qp-}z?$I}m6+y%-(-X(xe_QAakCD$^KX zT>xE}$Ied+`HX&7n@GzS{4dhB{#4ar9|Sx|eG>1DMDNV&wa!s7-3^VRk84634X`B< za}yV74l7-p>A|~VX&#(W=|1g?7lFIusO0?LCe3RTN&cw(jmUR02S-vJCXnf0EHSv0 z2rU2g|Jd>GVioZ&dpwLdU%GPkl1chL@-@&TRaZ*r(6d#1v2&%yxNV{W-#i%10f|Gs zS;Re`rKhZ%Ur-!6{t3GJcTk}N=GCiFKq{a2y{wiJs%UNhVjaEV1g4+kV8mrN%Rzb;e~%tG<~zl;l$KET2ha{QkTiK-{B^h}gU4?F^3aztdyzjfJREr^0 z?*H5ZAlRuVnx$dR4;1BG=A!AeH^Qy|a1V9KTjYA~h1O1n;T=eVLFTD=0!VyAK z2|c;WjtY7{zP0yj)BEuD?zCTj|9Y70^s0k%x^E695BBz!S65@AqcpWN0OGBsrB&~j zZOwRf@L1Z5#TPiD&k-Pv+7X4+xv~oN_0=_!A5`PL&lPAhCnKYE zc3QqgT?xzF;yfqg^$4Ccq$!{y7lBO@;rqkGtxx|=X)7uMvYd)8A|9T?5tv#U*GR01(qzGA^?Y! z`{KYrbRNqrNJ^$MnPdw#T$3o}Tx2zvdr6TxOTc0#|(NzI5q(=-)3-p!||+C6!^uOlfo>D)YJ*vGyJkl&*>b z{(U`I#S>TS|Gqhi#41DorO*g%C!uP4k6-J?ndD)_E2d+5KGMW{KE<(sQgnj8V_p8( zz)QbkORp$k0gti?XiVZ4XsC`JD8Mp39y<8Xjw5xgQG6xezbrl+$;v-#@LNP{GoB>+ zet7i!u3t2rVRw1H$>~q)A^L~d!-~xtdAlZGLch}|H8rjVSw>#o-qx0$j&7GBObF58 z<=%D)?+~pw1wq9B-zLRe#4ftPM(;R%>K4zA)6-ay}9_+yC<*%EVqt<%=hNC75&*o45=_JCHM zZEl{~(FxDKPj<0mr&9hB6o?*@_LaJ%^VnAT!|#Mssa3>ew=q8KSNPM{Kt8y-prTVU z^$SEuY8s!!!yFeK%_8$W#;>Sv^%d=wSCq zSyb0ojn@%EN_vEmI^YG#sr_bupP8B2;Q)qE0DhjZxn|4G`*N#?o0S!m!@YgUgo+(n zTyk}8{+5X!K!jy!rhqoiEp`UCpmA|fpGvK(rFR#@$K@eDgiWsUQO=4|CHmnSf? z^vLUAeG2aQTZ(EW?&6j7AA>vN%pWqAg%km5PUf3_lY%=XwnYk*R+Y` z`GvvGq{Kg7AN{i*p1!F$>GDo|K}o#sDB!qk==;M)go( zN7i59Y`ddMnC$44#(tgld)zDdlX%B|%XlxgPN$(k+~!VZa*v)Kk6y&yMood}RyE@S zRfePjqL85|94*Li%?APsG4OM=WW6oRKe7R+Ay?hWCT$~2LdC)ld1|)aPzIU~>{|37 zr=yQgm`wo8MQx?%V}aY_b6HjZMFVta3rGT+3=5Ber=Dv{lNE6*6Meh)-wU2dfFUR~ zsq#;>LcT)aGNRHf5fRgcaAFy1sHdo;CTNr_#Rrr$!EpiW4+dtU91Ue8coBqcdVWQ{ zdZhULQ^vDP@WZR-i9`|KHv*Y7Bbe13nU(c+;pxF&LiT&y&B4`eqPZez0zw5Q)6k`? z#31h8lu+J#ljnqgTE{Vg_Ti6iFesVe1JVD8#d6tcIkeKVa~l{c95eHwZ(mKMCzPU| z_&&z=(c|w2+v_G>>cF*0PB?#M&iHebl@H$R8{P;VjVI^DzZ*3z*8_xh*`XWcp!x(jBzJa?0 zvTyYF>sA=Q*8$ZvZ7Zc;yV||}f!=o8)?j)>b@qaP>HS>Gvokv77kMLPMMcMzKcdPa z#)z!!?7k8q#9MGAy~{X65*UwV`Xps9gq|B24jBWHj6^nv+4n29978Vqb*HySe$n(i>VI=uHjrkU)7A&;KyH%3tj zU%1()vf#8hwOm$OZqiPgkcC!{sk7uGknl6jx38+=o9!w^A=09gGiJa<{Gwljg|6>h z_)ThyH6b{J#Pb}(=zjLRixk(=&bp<`<*%nADk`huf*AC26q;k;`!*7dCmQPD_8j9E z8l5(uZCmE@#GC}qeXJwbGB>zoPSNO1%dsghH}ZK$dRpuNQS&!+%3q>2d(UF|+2dGK zQ&aD?%PP$}5f=L-sk_9U&}&^G`q3Y;*F?k&}0TH45K3>WwIb1p*?D2x2`Og9m2xnBIw2o6|x{xV(118yenk~gbWU! zI${n;OcStRqqF#(%N|2|)0!B8AtMfD!E%L6YS(Zdu4KKVf)~Sv`na>}+N;m!)Z7IU z*{|YG~JZ1-F3PKdT{{CHk7xuN0etM|xYEwg-{TA8gUW4r0F&G)= z*x7vWSe>`mSc?%J`tpXP8H+#}k`x?@ER6%S5|*BQZK^MS4M%h>a_A@LUPGpz36|0u zy2QsiD;ZG+AY-4kya%0f`};@GZ)Wyj(nkTWC9`>6-HEa1pheRRZy348bDlz2+5E5p zn$dRly~&LLst#BFgawz$b?K~W_X};mk3wS~xt>hrznF?bSTX%`cdh3y0vH`VUj3bq z0|)coQ zwwnqFS1Gnl`1$f&No(IQBq-l;zRmq0=5*a1<3pIgh>Pus?HIWa6QDBvd?l2xfuX)e zh!~sotT%+8dnve6xHX6U;Jld4lUJ%NBOs{vBJ znDy5b*x3{dLf)2+P!QJ17}U|#kt9c*>ocT&4ctvjO9MK0fN7XhPD=~-Jtj)WepPiA z)SHAL`cK@0rP+uJ-}<{7d$-^_1sBdU0M;?Un05i@Rf{2B3r1wVxS~g!l9;r_#Pq%y z-uF*pfNpAU8|9HMP`oY_1idAsm5fgP<5(8S)F_?0KHgrmo6fBv6D6`95B4kc{crm; zn8=dv)R z;RsVR?`V3#)=5S7%_XNCAr9Ta$~;~J4megU@!2Mu^McmAIvx@dn*|OaspiuBB6|T@ zp;}U5USz94@0_fxED0;tMl?GRN@p&hm$TX%*;6S~fwq{1QXLTW5LRWUVfnQRFaivy zb=;U0r`y~~u!L*s>vutulZ);a79c?2ArWn0eDs<7eV>Pi$1(Wz;zcvZD^tMK<=F_2 zP*=NL1|>SNrI~`0Eb^B~8)MQs+oi~=;BaZtdL5sfp1s6?w>_>Nqi8Jb-TI5$nQQL7 z07siPA+aYD5l;L@E^G|zPK>|sphosYub760LbnMEG&B|<@Pp7SBK6_8m92$;i*2`R zhm|)93Il2nH5p~)__DGU0LwL`=HNprpPgAd-8%}SM)uP`*fmK1oJ&HYpb;#KDpczK zJZ5uE0J)R2949ZZOuDb~N3<3=$8LrPKad?O3Vs zBapgV_}Gn?mnF4(-%;;+mt4c#99%K*#ga&l12*k>;z10ZRHO%KiG;(kR> zZthsp!JJo^;ISh4tnNf`p#tU^&;vX@z3p^EU^vZ}h}j|)^nC`vTkNE?Y~G(|^z#<0 zN94B@VwR>$S(7T?!lhTiKU2l7se*EDscv$8HoI+gHy1BKNlVts1pd-z0&1@|n;mc! zKBS;^hf#SSSYi7_1QOwA0{RanKEBLa6TG@MLUa3T{SgF8;bzwE6Q8roToD);n9px- ze@_*Cd$t06C&u76{hpQ#ND~s{xJz@o7r*%dh&v!T&e%TQ`qf()(n}@LirmphIPG&L zVmzHPWFinn%-q4O7Ny4Vog?h+kj)U=Cxk$QiWHycx)Xh&Z?AKi*=2xo6UG3oG(+-H;y=|P~MXhtHVlIqQfmhZchKJgDx;a?U(n=9X zOi1Vz7NMd{vMeaU2pK4#R{h%2Frmz1L_!w<1-HXvY*ztsLP2$U<5K_7nT;?3+h%pK zG7D_>JT|=aC=Ig=55Ne_KJswzjwB8DW}g?{{gu+u z;LwszmeJs7~ zULJKEX)y#zBAl@!Eltcy81xLE5bERO;~|~vgW#kHYr67KE@K>oAwg2bwdtT&BOG^e zCTA8$BL8EoAbrGKpbcdpR4yvotbuaU8VO!frA#TvJF}>XMx3ev?Y-EtgF3aRXw!UF zbapyCpO~sMvHrTo=?T{J#mqa)iA=mlGQgx{H* zGeKv%Yww-RyJV+94e{n{66560tiI>984A(neW2;+py49D33^FMMSCllUf8b;cFDy( zyAa{^t;0D!?{2kL9{eeRwR(~r0d&^C`lvXrg|;n=|K4 zvk0BIQr;PAj_6z+@~DhxS?CGc{5Wza%785^K+5h+h|sB0yqH?x{WkAMBBeqEVdQ;pb@4d ztvR#NHwvleu~+{^94nAX3*I(*UGgh}njrCSET==ppN4Hk2NZvyES%C!mR-jWyanGC z``xmZDfa<@B@GD2ZBQh=>_9&59z_w(L~4{J6bzFjtEacIifZUO`8WlcSv}8&no5#W z1k6VI^BUXO7FYT&79Y=TBO#|AWfK^4i=n>1+U zA@R{iA}Wb(SY`rX-ejlrtKks0?E*bW)8`0JFrKlpS5$x@0grjYUe;j|m zGxYlqQE}ttCz*Dk!bM*y8Gn}`#{3gf`Ga;AZc~cDo1`_Nj+5>S1mLz=Jzq`Wq~@Xh zkLqXu*p6WWyhysV#cEcqynYMgWJLHjF2I;mS*B&i6Lqn2+*5ps0Ah<%s*(!)B=BdO za7Rkhy)lFI4+P8U%cneI8jyjyo3xC>x^ew?=V_)vE}5E4ABJi;nGgI);fCp3Y}=~$ zR>0=0S`5EW~_|cbwbv!43 z&UI~Q$0%dax^|ZDk$n;Ko>09cmnc)zTHHf%*8ZkIH7i$lx0{2{aCHA{KnmtlkISNw zr1c6=pOSW8IY5RLI%lJA?(9lwnv#i1E-6Lk=eZgZ^Kn?;rof<}iZ5w%2!p{W_eoL6 z+ka)BSQ(klI(i)CS3EGst!L9QF)gh-T+!_fwaSIoV-WOc`^wBuq0&%sQe%UQQWlx>3lr{QUcWxm!62e{2?@|0CfE+~#Uc*=HGZnc`WaAqV$<0hlm_!^lb(8{kb=j0t7 z1b*Cciw)IGw#Xr`(hor)qH0Gu$6YOI(Ov{n;E@RTVjB5uOrbXFh=;~9^={OnkdjAM zH`)CEUGVRFkoV~SzM>ZcLqbB9eIn_-`!7)%=rGndHmU(mk_rk_v$M|5&fag&?D50q zENFpuUr2fz5TnGMU0f0p5>(XH<>ln;tgNg66n}EE%lD7?m-1{xY^ zlvGp)LvdsP=Zl}8-($vQWp!03kA;N=0Rh1SwZ{wC{woyB%!(Qs&3SncF_RNOryPk$ zAR|3J0^o&W{NthKe06lZ%FRu6_PZ%+ZN){0>xzns^7QmFF<3fZ-1JpV|O9JG49y3nP z2NMKhVqyT|!~sMU%Hq;e77mW2U%!;p)C4@QcQ2WM4vDnG{uoXyDItl*X8<)GWlEI= zd~Av<3JVG%qoZezTzq=M6?Jsz7#U;!$BU(ehx&ZYPfJ^Nb>+xssmkT|>fz@n0B|8! zf#>0XHS+fM7I{(@7XEuYU*>U4gNldez1{nTPx!JCc>B^hz#VFVij2(pY^4FPiQweq z+<{X|URlv%XJ^NZ2p)v_KaOk+z~7USk{SxWd|b_MYtz=$^u##MhJ*`1-llN`M&;@G zgkgKH!$poNB`qC(sMabD3=kLKS;D}=Mn^_&U9oouK_d}s`)ThPLI5R4B@{qMPEAeq zFd4rDNQn*i79O0y+x+G8d&QlxP^=N0T6an9^L-3d?Ex&|M@C>{ zklQJMpWrHz%lx~F5S10rNAe&bbCl0q6pt2TANBr~sag4lT2e5h8H>d*$sCBv%$)4c zA^kiXo~F3--J|E#RXXAl4Qp;SJAU5Mk6F>k)!3DT-QqGbH3?1l=adP#XJ2_U|AUm4uiV`k_*g$G z#yoKO3D3WcdrC@y@_0&X#D7X;u$L^-r(}L#Li8-ItX!Cy>i*w9mJtyNDlexaOr5|d zEl}T!e#$Vd3an zLux2ogY%BQJ|D-p$bt0|C8BR6`u6hNVn|$#b(S;&;~#>S5JzILjgW~ zECg24T=XB*b)Aq_F1J}6*GLc|n=n%&mz+4|j;Q_jOU=RPLG&^sH*J@2PlVP+2|k<9 z2;SMh_0)`_5tUyj<0^J73oRlL`$t2KD!ws#1%!y$d|kL6n-uMJJ^}7G z0(QV(l)$F{NO}{4r3(oG0miim-^AxkabF+jzmIC+TU9uLA7V<6u^XMuJ((LBjg1^Y z^#yFte`myBY&<+cU{A!1L0DI(b6>mh#8FUDq3Nr%>;BsTg@uK6iIR&DzzK6BKn7An z|Hqq7N&>QxhpQniQYtD5K)v+8?Sk$?V_fZAUWe!#wJ|^M3cv^r9BagLDkKq<0yX|8 z|A^Da*KMpuH1?~eEi{yAK7>}+swo?TJ+`WEOG-n|ThWZPw0(K@1PVET3P1&P#nrP4 z9N)E9-A@fYjVI#SA=p6>UGS_=q+`miEA)CwN)V=9wCa`Z>r!7d=`byj(3_n;)1uPB z3WGh`1bx!b5RJB_x!K3}ND|I$uojB{F=)$wJuZjC}A-9UdBz1o+HtZEb*!-WAP1 z$Dzvdl9Ha7AOleod3E>Ew{+7)@7O`GQ`U_?5L9UPi4YbGOZOoUN5 z;ROb>PzWQZ*M`?NMBU-cvKFHklFMcCn3~!aR#fmSg8?PRAbL#y;NZ@cJL)y|xEP7v zNBjxagE&&Xyl=(gI+G}076@}90VL$%mV8F6qpM6$M@mOZbN%s(U=Jx~g5P@Pf=qSR$)upAdGk|*uFE8)rdD(%gvCEIs-wBX=@?|1TZO37T&M-+) zmi^NJy-`|5=3=ue217zbSU5a9Tt`QTypX&_?C|g~v;_S$bSiFI@tq9xJu;>z&v9g= zQ}?t~`W_^ydo=jX&S$+uUIcL2`2in0OpL3$0U^udYGf36vcfuyhNi+}?Xz`<@q$g0 z^(cNjSHRuo$@weE)I7o<4P<*}L!zUn7|lM$=lhJF_iul@_6CPCvG!82?baU0&Tt7fXStPeU zc4{&s!MpO3ywk$9Ww0H2#7MWWF|g?l;X2y6tewq_AAP3<$O@^r2YGD%CGBR+)0hk?;~@u zZd{d|texFN@t;>J+Wv~ExR@AeeF=f!S8t}Fz;urH4 zOD>|45a0CrHA<))IfG5$NXtSK<@;R|2j+n+pY#Uz3Er8F6Ng!KAp7UB9n8SSf2i$Z zt@?u=n;>VWt}rpVwd$a$ zLMe%>LM}86p$sz65Qq3xI7J%_Tq@D8_6d!z*WBaRHFRa1r*g|Inc(QFBKgfT#^N8P zuZ28W9b^0(Qx?uy!3`2fxTRdSjs%tax>R-D5{F-rI=^(;R`( z3c>`8SZ=vSr=(3SS}9m=L12xN#d1{ZDZVq$$GtXBku%26{4-N+RrVeZ1^21JSUgTh zGpWAQBv9vq+IWm?;l%QNx_TUW`CAo;v!bBu&x$ZGaE1^;sMMl0Zn(%KQQ~D473+2G zNR%?sLd$n+PtHqzOr=CGA?+z6=jYt17;$lt1_y%{dVfHj7ON0QSxd56q}&)YTkuKCGqW4$9~-o#J<*6~$p@VYVoUWTTn zsU0`G`x@v|F86r3EfN|61{-LSh9Vz(5X;zoF*5TUMqNdMYAJdSAB}=>OPSX8*kFfX z=#ybU$@|{ti%)XOpR4XFiC`o zVy1e8W}t~BOA8X$lamP1#8buBd*a3#i%0U(7iG zN{Vlxu?C1)3y5$jCNPJ;FYf3C2{sF`6=@xKw7)UxvNc=5r2ehv*~W)TyKUXyJKP0X z?P@~0DZLdGB_A+ZQp*QUhrqvBTiew$3WFi*u3AmecbmpbihVt_)GRY+XmYY^PFC_H zm{KW)J->JkJ*dbR12RR^NZd5saOv;;kA9;ID}4nd#!+` z+vllyh54Dj1B&}!sX5HrKfiud(>_LEe5k8Uo=DP*Bv3W<`DyCLScgRLVBXd`YGqCh zEQADCOOHy|@EB@o;YRegdfrgd^(H`#z=Pl=C1sl}98r4lzXZ~YgZn0u`Io+{MdW>i z8-FDc4h$ByuIKD>Sf=&TJWn-bF^-Yv*4k$StS!cx)q4*zZ?F?{{j0WwZ`(emMh{BKNlD8E*&MMQ}7y3P;wafA3_Lyoh( zJiS`mHb_K#c_s!|Mixdni+7hZQ)F*_x5)gP7Wv^JE!!|78?EjW1g|0Z_}i!@_4n!y zS4$RsAkw5V)d>_;(J7vwg1a;<*-=S#E>wy_#5;>aooZ=`B(x{8H@l)I`VNmUUki9H z@mxIb5KW;6qDPHq>P}rBEhM$-e7lK-n(T@L{7LZ|tjtq?$C^8Mb zReI`2v=A8E*$GI~4AP5f#BTr&M<~Oy>1*}wa^p;MNwEM9UeTjZh*MBzeq}W&9==W>Ca|fjo?HxH$ zLFbX3Y2I%$k}xUa9=O0E7`!f!KID&n(Iu*>@y*v8`gJ*`dTtb zNayZD4?COVl!OFy_lw^R^NA#lK7=o;1BpNGH7w&v+ihdQrpOurXG|?;(lcMXo~X2p zU-zZ(lWpy+t&lFWGCYGdU-cQtn{p^r3AevD`SZRU&*U$xioK2DIAvzrz}S8>s9OL5*kwHh?Vz?xuH|a8C%GKZuk-drDtb$9P84A z#7#n;^Te}zPxYFuk8?0jo#h9L#Mq%s42bkN`@6f}?uY1wi_!FAJYY!6eR1PsHzBAI zCWZN@7xT{9PvtHf=!9&$a?SKSDuT<52RC4c6GQoE(owwRmwd za<5^Of&pb+Pe}u42FGW9{^LDA;ZrsbR2?5RT?6jL#9Ef;==x1s@=t3iEWe*;H?+{p z28M(yA;n50^FGG`;+hcRser{!ommW}X5M1iWyfXc)XD%ZP^$kWl?4Oz6l4TAxE)Lq zlV2GtTaJ4>T3T8(r8LOx$n;OHm}z95FDJVC;& z`Y_4l6zC9REA;vbxF1%842D>F4ZrQ&#xvikXXTnsRISTEPFz~E@W;PFkLuvQknLHL zg6R-pQ;Ef7)nos2S~1|FzC$>a`BIGFR1^e=kHW*kpP!yXeg==T-8dhRQ;-ArdwP2@ z6%4k?51VMQxikv4N$akTN8E9YJJwUBRov%ci07lVm7OIVZZF~IGZe3mXa0t zn7_qlX0Ff9#sgY40Qpx?_+j6!a(#0XL&&eCs2HI8sw#42wwFy``!2bJx0+pX{cbcq z$*@-{J}>mW$}^Tn*6cQN+Rs_wr@D9iz5YITpUEw);0Dh>byb2`O**0rNHNRkz(yQh z0_#fx77Z=!)lg}-5s82O(CZTOgQ!WOlPHCu3`e4NB9YF-j^bPbj``a-r9OG{wfCe_ zy`{^26Z+qHd+Og|m)|1+(SZjo>1(`c(p3--pWG!B8-l`AG8$j&-^Lc+sT8x1i z@M`ky-gzYxVzpVWc96W5;XVe*T%4(?Ni^shN6XFtV*2p+w@P|9~LyYsv zN5M9jhZkPpVfkU#!L5@vEqJOMvyMx#aNP_ z=Xm)kbK$My5k^eH#i+5m4)zqqTB9jatkGrzeZIRil)JmjzN(Y`H&LiyLR4igdQii64RUX|34;6GDj#-|ezM@^J~;XzjB3 zQ{GeCCQWa6&;?@M|2@XGy(Aa3&A`y;Z>M|EBK1X-hMWTtcwV4-9_(G4pX9Sz7n z&TJ2f^+*3H4#V%LdZVuk>M`3_v@(#>CjE*CEGqL|)_#DA7i~^aR#H;O=_S$QQ6-Xd zneb)h3Dw)Uz{I;D&?AG13FQ|gL*J^Yo-?82SKJ2hUXrZ-=;&%5HH)7pERRD6pQ598 zk|rd?HhXMC&;gD}!G(bJ;D7J4|GXVJ^a1OKO=?VXVG=_UP3~n*W@g8lJ=E=9Y+v-> z{!jPU?HBvB!T{R`u*6_VEiWj53{>HD{9BNQ+f+hByR*tj2%L=QaHu4{Pyp(HM4vLB zS)3_FO20bTQHLRs3rb5$;$UVbVWe_jm_wh48;06EMIZ)dx`r6#`jfl1ukYJ&__1v- z%D)TFyw{A^h-v7^6VlUVa0x@ImzV37o^fz+>?$kg=MPiVWq{@)Z@-f0(&i>34UKd@ zy%AKRD*|P&2sD!Ldkoe1r)xlD?KUx|qMngq5MNpd8}|SIo{Nczn2PG5GE6~S>-n-L z2%thAGy>O;5U48!y6Sa$#Py2_`E~vdf!a+vJFAP%V~0M`0$=%F1rP+}!@uhXtX*^v z&ENwXoKdmnRpZ+VvJlzMfJYNYq&pMC#jy!y%0P-$TGzbv-5em43t`d8zs451y zcE0W7**Ov}b?E~JR?^kg^Qa7S&lrXa4oNPl^#JQbu>vLQ&zH4B7E=}jweM)1H%(sS+oT{g#wYbA4;K(y-ESTgR!?mm=rf?LeQFc7S3$OLG6! zaF$!w9XBaFDSSWf`m#Vu10++X1(yVy3|f@C)WfHYDA6i`l?e_H<|&>PH`hW32+7cB zxm(+P9UYI=M0Nk|sUk)rBIa~=b{5K#wEBsq$c!X@P5e}nQ88#ew8n?yL#jwgqDg7F zX%j=`_+KhHUEp|CgMMFp^N&bGH(EU!!fF2bn7|;3bZELSsT8;JauDOey72@S+V!Hh z{m24~6rB4A`_(E1q6H2v#~tXaivV4yxKEK*ljZMF;(jQ5?GJ1a4{hU?j6 zOG;E7GU3w|7glTyAE5`lm^2UEn^H9Nkj7uH9lM9MeQo?;Q3XpIeY#Uf`M(h1`PHih z0zON^ggLj~WiM(gpFT(_@M-Xw^nD=|DiP1%gYgMt^p*c7f8!FA`e%fL|0BcJZuM2me+FpiJS^``-NyT8HW(*OOZY_w&F-QYxn0|&`BGW0K(mkH+Yh-7Q9E=d9)}W5 z!X4GHXMan6$4x{F)OfQOox3u{GBd|meg0@)N4e`z+4cCgT~h2c3*mw;2ej-*KiPgN zjWGBbj&wEN!3_*98|W-&WMt?tz(!n0NW%gbl2p~!T_J2>%Q?Cf{C=V;`bD)~uU>Tm z5t0&eFLt`UNOiA?0d49oy}Z{zX2QKFeDq@b{X0F!U9rSk(CBn3KXORpcWxM*WH;J` zh>KIJiv=kQe;$w>VIr&zJ)@ zN9pA^gmJ&qIMdQrIaW>l-K)~WBWZQ)a}f~U`UScyAsk`p*KCq~*}i0wUW|)z$r5$0 zdMDe*!}s6=zzi%czaU8wSF07BjNDgk23l3hLe+}9a~De;On@@{MHtL#SdC3eL3+J+ z4ajcc!T!lu5S{;?vla!*8#}Z9RGd`w_VV+RQ{qW>B(A=#n=+Fusj9-_QjYXI)D!kZ z){@DHFdc@8e~uqJ9?ycWF?XcU0K6QMdvQ@nf>|uGIN<|!4-g7L%6*N^ctVvwlLuyF zkJFN5Ffs)qpXPN2=)xxy3x~s7eDtdS1`qIrMZOnyhBV2KN#B@{(vcZ4g#W|w3NJ%QWh?Qkeb;O_Be(@D zS1k{1@l*Y|8-mTJ!&fdCOwO-qTx8Rq^OFfV6ptdXo2(L;wb=F8FOqp7`Ti}7{nuVa z*!&35%)aM=)O9kptUrm30ghT1hxLLhQd$jC?i-f>*46$Fy)W^Ux0TSaMg!2a6;el;oBb~~fM7>Iaet11iHV4Wba3vN zMsTD)6NY6CeUl$g1C<4--0l4)K=MFqf`Ae?mW_S@Lm_9Thtd{_Unv$F#@eDaAPIHZG{ zn}M({PdYdyHZxO==Hm`JnL+w_uV6lTy@>47HY{ zP1>92SP7^6B3tmLI@j;E!?k=}*8V888e>Z?ShS0FA|IeS$h_I{jAe_T^Z7}BMdF8oJ@sZAMQC(Xh{RmU@ zVMy=xVnU;C_Hm862Wbh`7tM8~?0n-^vFs%srMTxs-9vosaVhgm*k?d5=`>US{H`eo zm|BtBHZ{ef$uUtT&?FR$7Q`eH^#Ppx@p+gxhT}PPN*!4|;n>@X3wy!GJFJPP%zRzL zB4OzjGK4d@QZ7{?PBocVnle>sQp0?zpLueet==ITF+is|4f+5V^&d0h$Zm!sJtGBPs2gB#~)R@~*g zw6xdbB?)?JB^S5Q+~gt_Yykk1BL66^sGzs$*K@?p5&4b~b$isd;sN+NI4VvLX&=IC z0?6mmVa$er0I^Kgd^cdFHGXac>6rW+6zhuNxkX9YYqOtnIoJkVU#rUF3oUfq_0a|? z3g7kEg81fU^;&!w@LRo6i`hXRec0j|bA#=^9K4H7AA^6dRyM-qi+#dOrb1dj;Wc(E z&~`O!xV`V#T+Ep8{oFXLk03XMb86v3SC3D=z9Wg5`#G<1b<^TObJY6dl^P_(;`&+_H(>4UPMhsDT=Fx= zfb{h2?4Q5sr>v2I+1c5bm4@wY!{(pFrMZ>wrW3G}4EXPzWSTsDaAwjW==n?H3#spGSj|aV+DGSpCw`uSWuJ;KFkB62 z7dlqttK2bHhwA$Lv6roRLr9L`L5hlb0TG1=ZI6-#-K=BHSLlVI^fha(G7C(yxK38U zyl?h?M;10ysA&#@I`%!*0wx?9$hti8;WafkdwY5XLUKZ(Q~&`O6jH9C1icc!Ia%PU zfb4yM&FIw)R>2cnG7i$Cw-D1aCaMd1zvU}e-=SE01|V(92wPK6z!@nxhLDz?-uwFU zM@lgb)`)pI6sKPB368aLFd`_2g)R^&U|Olj{gX61`lfY%nxkx}#VbuL7(_P$&3Uk- zmUPEO=7Ziqt@Zu{Vt0hVQfx;Thm74aNV1rfohmRe3<#WR!99L- zQmyA_{hg%POMJW9Z(eKnN~9%Mv^`v%)Z0BLU+a0SZa>}lKd}emXi?X49oZUHw76;Z zkrVFOF)}gP?``|~xXlLZ%4~66avas=2T~AA?$%+evnjozk6Dj54U{bi#7cGfXpcFd zu~P;74`IGH+~+-L81((xEKe73@XT;+_{Ch{I549f5EC?ro|7L8P4lO>w=gH?H9}S# zoG5wm8PN3KoGf)&1yyze|1-^w$3-5^;MRo{+Rntn>k;#@*v~002&wWp6T1vlL3)r+ ztf>}pk_EqQ<-~9m>yvBt{pXC{pznzF@x~ebs2KZ5xP^LsO_oFrjr#NZJ2HsGL01+$ z5YUKm%#QR_h3)9_gTlX@TbKFn?(R7c5wlNkV5UH}Iz!NR{&F~#=diZQQ3n1#ZaFR+ zT&+QwM28uzpyRsu{zhLMF)5jGA|xoY%k*x)gu|P~}u5z?d>ia613+I3NHpD7V@v=W+M*GruKFcAXH&ixfnX3taUN*yHA^Q4YwMUtDT7R z(Ai4U>$kA)P7O!!kLY4Tr(C+at-3H*Of&eo-@Vf9h8qIMk5G#mCh9blDdg*RAH~yb zK1r`7!4y31t9hO>QrHF5TX948=EV*kWjQ!!$e}C#j+)}i^5Z_)+Z_eTuJ?Tv}1X{f1{kHEXZXJ0n18fYE%TF^e%c^N8G9VIYluI=4$4Zh|L8?Lmntg4 zE9=8~#Bp_XRd$l$11ugM54n{e!kb~a{z_%g@3JNfXlr=xMpsU_uNpV3dY!?2${>^BGOPm#g z{E<4pft}L@B|0i0Csf$p(#pa@G|Ow_DdX@bpKms*uNM2_^2FHKE9=@0gy{Fqid^-i z+~nPM+`ua{FE0-WgUP6aX=d(aaUI zLJxv$In;uY2D!05_R)Hn+Ap#6zUBMqC|@WqnTvI#!VE`HX=HZQAr8SN=!dFf=U8Jz zLP2qBbAs7~yV3IWClp$yf4e&@~HLm)EXYUtH!>TqQ9Zs2=Hl%SIp5*4CC$W@~6jI&*CP$p)zbYwn$# zT=;TK1Uv##?JpPjiN7WG!XD!NENBE%_p5dw)!~`&t*D0)A;9goH8icNit4$KvZx(nR9W!V{xLs8*n~mci=Ol>;y_7w zH4{+)@&cn*{wkj*0ag@FV{PNt*gqHW5VB6wSK_;yyKiyu5t4+d65&nXHx{g(`Ojb- zsXp$G=bctEEAR2qh&DoiuRI{^2CUOS&ui->CMGnp3CAellBv5jyv7#EEfs&h##L$L z%IaNGee|(L2_#%7M2L)S2buXeG;|i2VEsCE+QOG_gZ2`-4-4=3+#S z^CL|PNjUm0kC&I1CQDLZVPxEv=Wbu4 zeq#rf$@9C}Z=a4;_`eo2rG>;5)Mrq4I$pa}{kQ65T|1uQP4e)` z0AE*SVjk;lJIX&VZTiL_fRSiEiuU^TCT_d1-<{m^^}-7I#s)t!+s~gr$5m87dE`H@ zmJgq*1F*2kitmMsbX4LPX~EW2FC;9n%8j8=U0EFFt1*p_*Ys^-dL2+UEQ{HWbm3$+PyfoA2YP0 zHrOQIof%RfT7KcgaM9PTXlMXJdmcbaPmQ>|K5u9f4DMO?lu-FY#l&>-x5ix4o7Bvs z3(2OlCehV4&jRiknDw;X5txzk13Zct6ch_OIzXjl7NnegIgN&ApDfd&7Q+WE#*`1n z#`bW*X_SBzg8KHcRYP<0qS7cN_j_17qL4HZ2`#*CSX81mSbV4rna#Hh6Vu~4s)cRk zeqvS=b`qd!oaF;N`p7`1IAqi#6Yddsp73aC9b+-)MK9PQ7ym4+t*zxZH#74)Ud%<} ztg5N=O@`B@_(y5LG}6*a4QP9&73<;|1{-XWRJ}hv^IN2Cc})hYz-&&U5h_i?4HbUv z!{vQ_0sZJcb8wqaXOIt$EO7ixs56giz?lZ{4yeCRqAru_f}L)gC!cqp676jpB*4a$g z2?HWXiZe-&g|Hu)One42qg-S(Lf<5UW8p{+W_GucM&BC5fyVxukXIC)nJn`a!}?DP ze>Fh%R3r0~8Z1K~7cLp15quIv1bf$`#}U@rD~KA*j{l)cG(_IR$XBPq(Mr9cZ{W!@ zu4VjUioOPF=0KEqetI5gF`#k(FI<8I-Ha<5^49#xrR;Ea$NBn>(d+)JDQ%3KTJt3A z#}4VRGl+Z#2||l&wnI}#8QUKW34M< z^+*gO1tzW458DrJcZAfLG4>c^3hkE`=)9ETjTk10)lBTV{S;ekXa5Krh_NITu(08^ z>|Qs7LNTERt(~}K{D`%UDt zp0dG4Mjq=wnHwPPy6^o)IbY`fXunQmSn@_Tga1>5XA%Umy7v_`cZ2bD%Ju+SaYa9y zgiTiID3s*k3|ghAKK&Ka+OIl#H3_h@5?gxI^T@M^i9pS|Kmgn^?=+CMrf`;o)a0CSs%N!_0IZ=6=1anx70 z|9H66fyRD})rLW0{ViB6wR4k25SyH_J9v-xQaMC@QNsJFr3o@l%+@0c;)q|czbp!v z0c?DCQ}1ocAH$5mz&j;#v43+pJwpY(n%YNSVcRz4$8jpauW+X=coZK{?6AkG?m3sW zFpz&J|L~15k+YO#llb7;QX8MMHwVl66IC0moKePX1=nFih%-QWEAH>d89Z5WEJ&~b z0!eiZL(jO#z2Tka9k=s5(xy@te+O(%O-LSw&? zBrzomsro=GeGiEy6aALlXy`pl0ab*HwpS9d^t@K6khc8t=jCyw>DFe6U9Fu;Z*CWU|hxn5Uxgy|@@! z8ZznGOw>w!QBx`GCo~i3XQ;ikwzm!4`)`Mwp`>4^0$%PMXJgx!&HMDtzW~lb7aZ!B z$Ow@q6BJBr^l?z|(V+F8_vq=8D}U!uGtt9^*sx}4L#G>Z$hx{x{#-{cY8WS&!t#}6 zFy-osp;r>ks80+N88NIxqXIwjD2gC|(C?DtpbCEU7J@ zzk6IOIurca8KP%K2wvNtFW{5pq$AdI@(77piMP3Tog&>DGuZOh_Tf7E=s%;nQ%dJK zH3fyUmGa`yZsoID)$~bzz%Ss%d~5SDSz+)UPe5*;?b4%Y@uALBV9xj0qM;#9tA2Q` z**G-Yq7)mY)RSpFIk-W0i=5WHVfMD>Vh480IUNDQn4g<@FSp#>W(8iS_R#2p%|j+P=dAP24+Ykl>VorW$IwTn_0EYCObjcx6~0*RM@ z5VAc$+yV)hRcqBm%!9Rs(zk$@GTU4}^leD;MtsAOlb%x4z;Zy=MBZy*;JEN$+ugdd z;E5L3|CcIE558VQpFS=VX@B^7*t&x?_mNPodjsrEiuowisCBC5wmZtv{l$*#pse;c zbUgiebc+U>kF}*Hjstq$J83%4)oOdUj(VdXplOpaoqu!c!gES@4W|JB!fk(iXecbd zoSyXk!hdw> zqKlib7&>iywUB6T&(&d-TxY^Tn78^7`=u+B1-j{WtAQ-uZQYz4Q#JFGFV0}KT0+Yo zWVN((6#sQX9Fmt>?rE9vb{M_jOQG9ICU;bFmx7}OyT0B&^H~b%_|;L;y`)b>5vM(c zLahy!lkFc`-$3I!QZFq^MFZe+Wuonz$_xM8f)8dLY%Cs?gATG*nQa3#zdA zzIqYIlc9rB0v`wH$pLvM#HNtmbT?xLRmD?63%2n4loIWeue$1Ke3bezDb#mmcMr)FCv=v~!9vR6Ff z5s%?D|2RQf^YZ-Eay)psLrYdPs#DdTM_A9}JRg>toU#wVFBZ_Y!HAzjjKDNCT}m*E)UV z<#I`JDfU(^BBLQUH#12HCxJ(2`R|YWrSjt9Y%#culzwX?OLxs2j>&@(rk+CAG9$6@ z)3R{o58{+8WJW%pMAgKg9?}E*3>Of}r@nWV8Vnb0}=)!m1)VF9!?vTJ&TNsBn8s@ib5JtDPOC!9{{3HKT`mBx=QL$~-0 zWI|(&32V7OVArkv%pA!IFqhEttR7yTEr-6nPZRPQJ-2-7rnhf>Tl+3-%2Vyci|0_` zI^}-cwhuj+>Unvs{ztt&O(fOhQ^m_?IUps77 zRUk7NwDALo_jD&Po;f_U8K$V*og2@aTc%SjB^Ql_P<&SgmN;2G)(aP~T07L!J+eKw{(5MwzC2kUbYKq7DE%@NQb7NHk6KAL z(2qNKJec*^{(eCSosVGXQ-a^4&Be#muKD@&(;)rf{Iy#= zeqwu_kB42KkkI0{v{?!*ES!jx)OMZ-My= zHW`Fgkde`z_gzm92)e8v7667OC{9);sI9H!&dGf<4rG1bzTwbRbi#xQU@`W&-?-P+ zce}M2C61og*h%y=a7|6~l$E-apjwTOUb(pPtL1RB#G!c%X=^YQrf<2+?C7pingXN3GBeWzYgNNM@K~1cmpii zplH0f5{*?@%hIy{-q2J&Y)%3P9fueX&(YB_0Nd~)JDb!d48rR2QA4UP7*h`|n#nGM z*L83l_sHPajAjveKJm&u57rUW(SsCgs?YAtim>gd`eqHoe7E^a4b)}bh5L(Mhwvfl z31c9_O@_{c|BX7TDpiqBD~-4WdnNop%}moDK2rp;PH@*M>O;DD%T@!5MNjE1@j&yT`u?so;**{^;A#dqgqo||5a*x?Zg z{VYg|B(3*GajB9>*{Il92_KVY;hn9nB68GhgsdG0T&-F$O$% zI<*9Up@yE(&3LSAD7@U74E3eahgu$Egh_nueyQK;a||}B-AY>$^?o@mqa!lH4t?u$ z^@qz0zUOj{s_KtU8#@1|%Z;7(hYO*u8V&FM1Rl+b9+e4!pmzV-yMFyMzAovfCp8kg zc?R>WDAM=md{@H3y?iL_B6XlH*lqT6E-h%%v4v`IF%Te6uxt9TyM)*MAa_R}nHNNRsZR5-4JZBh=<$ZO z(Q~lKbIRnv-2uPBrF&8uYQgVJh)?k8@+Rys2)jVPCN@$gV){zE6%QGw^WH8+OA?1h zlm=Jj#|JoX@52CORC}KXQ_~HOVZ-E@KESIK4s*b(vOd_}hCL`MEYz>AZSj9;i;q`P zHe5}eEUGH4E=TdzQ#|l~+EEG_Q)Jv^SOV?Sj*svW8Zy6{4Zd#8Ci5IGYCRAMZZ@2z z5&I#9biTae7fB2qxX6XxGHCZVCob2eW&0%m*LNELLXpx#Zrpmyd~w8&iil1&rGLEC zidYo8r0(EsXqs_OeX5kUXz!k77UB6oOtbUlrOiuxlXyuZ@qKF^1ECSFq5SZ4TBmr>DChD3lM z%-k9ffD7_z0VUCTCb#MzK2R#TO=xbo0H@g3b5YEaHfc7t-)-a%iZV$B*aa)5X2Kv^ zrSLifC+>%H@rxbOwU{ea#t)g314#KF*1PQ84sUmj)t^xPp3>g4mMbxq_|<3}!eCk| z@n2Nf^3_MC6N`m1qt}yT!C`lhv^_I=eO9DiT7J0FFz+l0nBeV?D02o$JifkMyZbwya|Ij@QrZxkk72|5_fFqf5)4o5)DVrAE5!p_ zXMJgDsSB)ThPa$uWFqn>*c*i&C#9_ilrLzzCnxPrTZ2``ePi;fA|1oSrNtKGi6`yv z6CPAxu9bK8_*4b-->Z@*D13K&C__b$spFq>CqDSH-16Wnax1k_L-AA!D`UhLw-{08 zjn$9~GeSeL_qO(2O7M9(jP$RedMY8Sy6J;Rk3yK2g=f}r$4(ysNz}yk_bY4|Z9;5} zb;giDB3=(byaI`2pAs%=Mfs~^J)C6)bSJ~o2HNz5`^0?Nf?q!nzjG8@wd_j|#51Vk z5F1Fjc6Kg^Twh;rb@huMI73XX0<-Q_iE&6FSC&&7+bs)jk7RX zU8yKxv1H=gcw6aBe_uD)EcVGiS2IGBuYf3)>D5?{aupi2&>|@^n>`AZ=o*ETHWlCD zMO;cszZ%*WXU_m}?@%W%c8+1y>M)DhE2_@nw<9UGcMsj8H8-Cjl_8D=DUql)h11R=Sx6*-4B)XeO59R->=H4 zG-1*RaxQ7-D5`~pTICAaQZ4n94o8E-Bg93jw^E~!p}xYq^VpQ=7oa?Js8QpYMs=#r&1BDfE^>eU zO1+t)N6KW-WP~dh8I7MkF|DfL?CDGvTUKxCN2q6{BqB|6ry!XwmkPBO6+A{6p_J(l z)gRV`6WCG@@#R^3^Hm+)q`!I zG3^dPrcIRCNjeU16T@Sl@&gsN3!>bbSx6dzQie&e;2SPRhL9C~{F4&WID|vYZ=J+u zX8C_G|B!lX(iu<*v6Ym*E&0q!$)L`lu{qEXK&XmRzk{jnWA*R@>W4!usSsM4V+Kp+ zpk%8yQ8#=a)Y@>4ye4udQ>ebMAEP=IjM0&mt&PH~uRpX3Jgd$=2}=r*iGJ-4hE_pG zSH^FMi1^~wn8!glz*8eKoNcxXEC!E`kpCJYvuSl{IaqtudJYdeziKR6gGJuod{Gw% zEMbP|eGw_n)PI^(hUlZ{o(+(v==6OtiSu_|s`-O?J|K^gN%Vxwsd(OPZkoQeiA7txf8*j&zD7u#irNnagsDyK9Dv?}1O6Q| z|6p4?&g3LehMOrLueYl1+^_+pihq_5>G5qS*Wvp8r_2$oQyjqxx2&jB0V0nXaFIOA zGm#;9P)ksVe?2&}{XBjhvwy%kyG1gLcdNVZ>5cU8!2ouZ=%T@h)GO)?6)?65(<&N7 zCzksiy)$BQVJMP6YOdGila8-dV~T~#A$OpK3k>tA#ddN9W6dLsdVh+w~enOjX zYBpVc*E^6m`zNAASAIY(hS{EjUpf&x&mHxcjZL*#QVk-N*@-F0j->rXa`gOilmVxU zrI2~^w|Sx28<@phXD&7WdDwj97nI2|9QnMNj-{ONIXj$OCZ1FVi;_kL3tIfONIa?5 z0MAbPBpNJL-_6Qo7x!jQwvg6rN}VV9)IU{66^mP7Hxf;;)&%t z|G8s)NoU&UCkgCJB?ooX(U>_Ose%;I&2fBe}&x{4WSFB z&tsFnk%fIU$XF$uk!W)f#w#a%P^<85k-;Ca_WJ&(FUyC#UXP51XFZXrZ8rWRnFE0W z!>xU@S}#dPdzUx)%J<9Ylpf6xF7an^q-OVZ+K02)Z$B10n)?>jnilclSrGf>?PuMy ze9rY?f^@ESRi!bnv7UeZ@}fx2yFS9Pfj&_WKv}^Fp+P)-*f^y1+^Z|YH;Ik}^#ST7z<}eG#}O5p z(4+cE))wMNoEMf8oU@=pr38f*_zqpNy5Fud>Az>?|NYVMWb%O10WHOFT+z9lQw>eF z4CaV-oxICGk$2lomXU%unujoC9>W^%TF?+`A14}R#Qk#+0}9j+U2X4ex^Bpxp(;|$ zp7bN3Q`>3YYl3P>3AT}vo)|v5;7-2C7YcX=^fcW@&@nb4?VaCMATZu7bBGJ=D)(_v zkDs}nmDcw!zi1V#t6Tn<=;zZ2R;2QwK5c-kNVZ|uu6nCBs&34Rw@`|1nf$8%o*9A| zi!^@QbY^zuly>)Ur+V8?#+5THB6I85!4@nA{|@@)y{5VkjK_E|E7r2S{_3J??Iz9{ z=J~e}g)iZ&JJ^gJoFnrz&-aFwAzhw3l>S892BR7!A)2;i>5M!r(OKH5huQ5R0_V~sFr8^=I|rWS5u|caQjbdhNg}OrFGxmJ;QMRUVxs%X&LNO zq7otN_QUl)Ge*#3IxX_Vy&F~1%5j#itPq~$!xYLf|C+ed9+KRt!<%{SxebKF<+=`r z30XWs18?xoXTl6%3zbksAdEI&`b2dorEgpOXsY;v_qzg-t{pO2F>reku%#Zc>72$%<#HsgR#^R6zp`leU5pP#GEOfSY( z_&?tS;z1o|ZSy9S-*9p;V(eU6}#sB4tN;e2=Z-aGe7)Zx% zt6ko0%j+D)(4btFHAaQ18rYL^Yk|9TCf@yn{%n!?f`sOe0DOK25HrWSLbImj1fff2 zz>~S#Pep0Q&gC}JmfT(96?7<-I`Vv;@0Enqv(Cc(Y1g)78(sd;Svt0$xSwtm5C_&- zkm<*YzRg-@EBVku_g)>}vrnnm8Fra3*kAFKxOwf#3>t;hhkSi}run2;84h7q$@-NmOW$V5(7qQ_>M^Tw!KPXm?603mJR2%5cE5QU_P>Ig6fHGUfA{H zK14r#{_Mjuzm`R@N}TuI)*HcX8VIv$HG{Y?}BU~otf+In0xduaUMC{f2{-|rBe&la4}D79Q5b)G4tXw8`|ObxSk z8MN;4C!Y3qUccEwcNXN{UXSSxtyBc8fNPK1Du2D5 zF9Ux*UL`xEu2lYKEHka^5y@JW|DPrC|9ABN*Yz|KTNL_Dl~wVFeSk|kJ#{cJFc@VA z>?ok?5GP09KHnfi3)etq6@^~!5zZTzm6cswS^^HsQ&UsGA{8hT0da3DL>bh~3Y!w6 z^-WE&Gcc6a)g=KwiL(eP+5rmq%})x#e50eICv#QCVBh!}AK&D2=cKQ%4=g+agnCRZ~*~&_@feFA)&|51@lYyBtrJTLGhT z>}{*xlNV^Hx%mzti3kb23DAV^hoFaVB_t)mEa#P%KLc}2zcINW$-H+|Q~;?43kSEe zy^Vr|B(I&b=;^cxnYe~&bM zU7w$won2DWY(%muf_Mea-D8F!p?P1v41(H)4#B$%G)Q;nzn=I8J0A!N-=$)Sec%78 z5>8}!_YP*}rgOV=bUH{`p1j*i2fHdX( z{r&Mm!|43{uZoITk}txf!NQW^!iKhOz<1!`<^%vIhXx1fXlXlQ<&qhJSP;M`KhuJt zX={5=H}?ySwqCPa0B&wkD5P5#yxg+YoQ<2PXdoDGz=;BBNbVKzGikG135rEh;^K$P ztqT(q81vze%Fu5*pzz4nkKTNj0+#Xric>>E486zB`8-au)6)LA$O!ckAk@O>>FQ!( zVFCEOCIimDwt=2%Ia@V0f`fz0;&GM~75%hOZwtf;pdr+X>6O*h2uMg^6t<*%Cu!fm z53!w{oIE%@+=L@TgO~(|b77yhFD~jLB1Qr(Udhj&fL7nz-Cf(zaADq_B&;?!GxJeR z?E;LE4QCqYjh3r_f6g*aIv;qwf%39R~t>bCVHLos!iCjW*vWBYa`PrFgRaXcFTE)M)VGmI*1C~yn zU{Z2&a*iQvhLLXz7pQii0DGkFo*pK>UzgYX|EXH3GF4^78VAvrDbsxUN|uEp`8Tcv<)=BQ33@ zpup775LjQ2qUwPHB7DT@wzb+ zk*cI|7#nOk_hf&yznQ!ra+)=o#&MV%^3no4y#4M7Ot8QKw(Gy{e*bS~Uzu514UUW` z%F6DK=SdCuD5dkvNw`n0JyLdleHIY7AeJhA*L`SdI$xsfuk{=9mmwi}pm8~tLEl>G z)sf6?W5?(eT-$JqRAOHn(d^?FEFZtYArtwh8rqGcuR7Pm*Sub5m}bb|u+5#KGVwba zOZ!}=b9-(pi>OF-ytKLhT+#ed2#fd38cHoPg^f&MUQim1G2+yaPfyD3eQ@5xdglM! zLwT1HU!Jk9R2~Pm3mzUGXXlHV8N7uM;g)y*85Mw;1uI*4WTeV{;WE7#vP*!GW*Cz!{X~m_=O?ibls4{9>?7zlhrPsVbs#v{(=jM*- z-I(mLjmFcNp^_lUJ}(=6y&i?^B#k-NY5dh(@vUuHV~c<+ zjhol9h}UudRhr@s+*!89R@C03uKbx`wou zP#&6#jsyCk{-9H$+a-55KGC%O8#8@FNk{1Fc1=x zgXH#jsbz2!DIR9;@OPUfQp*UMjiGfLW0YY_kC79Sm?@!UOGv}Jo1(fV>c+$?9vSgp zninqT6oj%hr%~y-%53LGc|hQcqzsI)ggUC%9a3CFqL`($7m+0;v3gXD2erScWb~!t z7cDww@>eCE{Z7X7H$Lx18H6&J5vFDnNN_x%qYy~gx8yf%$xumQusM~(AR=ltA0<{& zQhH{8bH*7Eg?8oz>=OYK66~SbbVZ{!#qZyQbs3>vG1nNs4Vd{boA-fBPdob^8!a@x ziOZy3Er~?09~PM(HS4=8@9okN);DuDjO1Sn}@l%Jt}Mb?BIxKSKkKBD5< zTvNWbRzq+{-s(stG))X2eMqSOoBo4kp`ihAt1T>OgdhPPX<*m$XnidQ zwuA}bjWaRvv%GvetQ;C82o|OLxY(2mTFrK=-!NFPCLRkYKw2 zQhTM%7XY!rPVuPRt@`;Q0P%Rf4zZj}QcCJB2hyzr%PQJU@W#VPQ!@qZr@G0k$*35QGoUi|M>&z{tgch#}3vIK^6w&t*FSza>~my6B6Fc zqJeWqw+=jbjnF*anuCPPph=j8VaR3B`o^`W%W*~=2NE~Ox& zV~SA>9OG+l1{==i?Cjrjb8qSHH~M0M-(ZE^+hZ9B~hiz#@`hBsjuK*wzQ~;cxp94%VEG(>` zprDqP7C06^{FJPmdrELF180o( z$8*G#6>vJ}>g)uT5h@#R15$>NC@xV?U(Sk1ZVmynabr?h$~h2&qATqMfr*wBOi;y2*9cp+FLZ zFh5fE`#2Y8EhjqZ*VyN$?RsvWMKIan`(U|jcvu-s{%qS16DCDNtX!6qE}C4Jp9d@* zLeaMN`N(dd)}u7Pg^5|dp50ep;uLc5 z#R!w?qg@b?-KLhdl-5PNT3a7LV$&B1YbMRYC{Y3yWTa&+2xq{~LGbqN?;UX75XR7r zBp?eAZrt`&_#ltP+T?yh972Anz|pNEW^ggL6zTbqk6h6Q@6)B_>3~8*&XY#sl0t^| zv0)Ab`psFc<}ieakVsnXQR?6d`3h%;p&K5DnaGwyILl>F8(yLf?vH8dl^0O*}8d@>Ebfcl_Xm&bActM(qM$^iyn$Eb_rYzlxSFvNd4;6-qQa zFDolMKfh#d&GISE(5F!d)4Tx|lC*)Ip6|?h=_y-hZ7q8TT8N=j9Q169$+t%LM(!O

    -
  • It contains one or more admin devices.
    • -
  • It contains two or more classrooms.
    • -
  • Each classroom contains one teacher device.
    • -
  • The classrooms connect to each other through multiple subnets.
    • -
  • All devices in each classroom connect to a single subnet.
    • -
  • All devices have high-speed, persistent connections to each other and to the Internet.
    • -
  • All teachers and students have access to Windows Store or Windows Store for Business.
    • -
  • All devices receive software updates from Intune (or another device management system).
    • -
  • You install a 64-bit version of Windows 10 on the admin device.
    • -
  • You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device.
    • -
  • You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device.
    • -
  • You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 1 on the admin device.
    -**Note**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 1. -
    • -
  • The devices use Azure AD in Office 365 Education for identity management.
    • -
  • If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/).
    • -
  • Use [Intune](http://technet.microsoft.com/library/jj676587.aspx), [compliance settings in Office 365](https://support.office.com/en-us/article/Manage-mobile-devices-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy](http://technet.microsoft.com/en-us/library/cc725828%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396) in AD DS to manage devices.
    • -
  • Each device supports a one-student-per-device or multiple-students-per-device scenario.
    • -
  • The devices can be a mixture of different make, model, and processor architecture (32 bit or 64 bit) or be identical.
    • -
  • To initiate Windows 10 deployment, use a USB flash drive, DVD-ROM or CD-ROM, or Pre-Boot Execution Environment Boot (PXE Boot).
    • -
  • The devices can be a mixture of different Windows 10 editions, such as Windows 10 Home, Windows 10 Pro, and Windows 10 Education.
    • -
+- It contains one or more admin devices. +- It contains two or more classrooms. +- Each classroom contains one teacher device. +- The classrooms connect to each other through multiple subnets. +- All devices in each classroom connect to a single subnet. +- All devices have high-speed, persistent connections to each other and to the Internet. +- All teachers and students have access to Windows Store or Windows Store for Business. +- All devices receive software updates from Intune (or another device management system). +- You install a 64-bit version of Windows 10 on the admin device. +- You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. +- You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. +- You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device.

**Note**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. +- The devices use Azure AD in Office 365 Education for identity management. +- If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/). +- Use [Intune](http://technet.microsoft.com/library/jj676587.aspx), [compliance settings in Office 365](https://support.office.com/en-us/article/Manage-mobile-devices-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy](http://technet.microsoft.com/en-us/library/cc725828%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396) in AD DS to manage devices. +- Each device supports a one-student-per-device or multiple-students-per-device scenario. +- The devices can be a mixture of different make, model, and processor architecture (32 bit or 64 bit) or be identical. +- To initiate Windows 10 deployment, use a USB flash drive, DVD-ROM or CD-ROM, or Pre-Boot Execution Environment Boot (PXE Boot). +- The devices can be a mixture of different Windows 10 editions, such as Windows 10 Home, Windows 10 Pro, and Windows 10 Education. Office 365 Education allows: @@ -169,30 +165,38 @@ As a first step in deploying your classroom, create an Office 365 Education subs Complete the following steps to select the appropriate Office 365 Education license plan for your school: -1. Determine the number of faculty members and students who will use the classroom. - - Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan. - -2. Determine the faculty members and students who need to install Office applications on devices (if any). - - Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans. +

    +
  1. Determine the number of faculty members and students who will use the classroom.
    Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan. +
    2. +
  2. Determine the faculty members and students who need to install Office applications on devices (if any).
    Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans.
    3. *Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans* + +++++ + + + + + + + + + + -| Plan | Advantages | Disadvantages | -| ---------------|:------------- | :--------------| -| Standard |
    • Less expensive than Office 365 ProPlus
    • Can be run from any device
    • No installation necessary
    |
    • Must have an Internet connection to use it
    • Does not support all the features found in Office 365 ProPlus
    | -| Office ProPlus |
    • Only requires an Internet connection every 30 days (for activation)
    • Supports full set of Office features
    |
    • Requires installation
    • Can be installed on only five devices per user (there is no limit to the number of devices on which you can run Office apps online)
    | + +
    PlanAdvantagesDisadvantages
    Standard
    • Less expensive than Office 365 ProPlus
    • Can be run from any device
    • No installation necessary
    • Must have an Internet connection to use it
    • Does not support all the features found in Office 365 ProPlus
    Office ProPlus
    • Only requires an Internet connection every 30 days (for activation)
    • Supports full set of Office features
    • Requires installation
    • Can be installed on only five devices per user (there is no limit to the number of devices on which you can run Office apps online)
    The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. -3. Determine whether students or faculty need Azure Rights Management. - - You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management](https://technet.microsoft.com/library/jj585024.aspx). - -4. Record the Office 365 Education license plans needed for the classroom in Table 2. +
  3. Determine whether students or faculty need Azure Rights Management.
    You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management](https://technet.microsoft.com/library/jj585024.aspx).
    4. +
  4. Record the Office 365 Education license plans needed for the classroom in Table 2.
*Table 2. Office 365 Education license plans needed for the classroom* @@ -202,7 +206,7 @@ The best user experience is to run Office 365 ProPlus or use native Office apps | | Office 365 Education for faculty | | | Azure Rights Management for students | | | Azure Rights Management for faculty | - +

You will use the Office 365 Education license plan information you record in Table 2 in the [Create user accounts in Office 365](#create-user-accounts-in-office-365) section of this guide. ### Create a new Office 365 Education subscription @@ -213,17 +217,19 @@ To create a new Office 365 Education subscription for use in the classroom, use #### To create a new Office 365 subscription -1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar. - **Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window in one of the following: +1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar. + + **Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window in one of the following: - Microsoft Edge by opening the Microsoft Edge app, either pressing Ctrl+Shift+P or clicking or tapping **More actions**, and then clicking or tapping **New InPrivate window**. - Internet Explorer 11 by opening Internet Explorer 11, either pressing Ctrl+Shift+P or clicking or tapping **Settings**, clicking or tapping **Safety**, and then clicking or tapping **InPrivate Browsing**. + 2. On the **Get started** page, type your school email address in the **Enter your school email address** box, and then click **Sign up**. You will receive an email in your school email account. 3. Click the hyperlink in the email in your school email account. 4. On the **One last thing** page, complete your user information, and then click **Start**. The wizard creates your new Office 365 Education subscription, and you are automatically signed in as the administrative user you specified when you created the subscription. ### Add domains and subdomains -Now that you have created your new Office 365 Education subscription, add the domains and subdomains that your institution uses. For example, if your institution has `contoso.edu` as the primary domain name but you have subdomains for students or faculty (such as `students.contoso.edu` and `faculty.contoso.edu`), then you need to add the subdomains. +Now that you have created your new Office 365 Education subscription, add the domains and subdomains that your institution uses. For example, if your institution has contoso.edu as the primary domain name but you have subdomains for students or faculty (such as students.contoso.edu and faculty.contoso.edu), then you need to add the subdomains. #### To add additional domains and subdomains @@ -240,10 +246,10 @@ To make it easier for faculty and students to join your Office 365 Education sub **Note**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries require opt-in steps to add new users to existing Office 365 tenants. Check your country requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. -Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of `user@contoso.edu`, then Office 365 automatically performs one of the following tasks: +Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks: -- If an Office 365 tenant with that domain name (`contoso.edu`) exists, Office 365 automatically adds the user to that tenant. -- If an Office 365 tenant with that domain name (`contoso.edu`) does not exists, Office 365 automatically creates a new Office 365 tenant with that domain name and adds the user to it. +- If an Office 365 tenant with that domain name (contoso.edu) exists, Office 365 automatically adds the user to that tenant. +- If an Office 365 tenant with that domain name (contoso.edu) does not exists, Office 365 automatically creates a new Office 365 tenant with that domain name and adds the user to it. You will always want faculty and students to join the Office 365 tenant that you created. Ensure that you perform the steps in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) and [Add domains and subdomains](#add-domains-and-subdomains) sections before allowing other faculty and students to join Office 365. @@ -258,7 +264,7 @@ All new Office 365 Education subscriptions have automatic tenant join enabled by |------- |----------------------------| | Enable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $true`| | Disable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $false`| - +

**Note**  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. ### Disable automatic licensing @@ -275,7 +281,7 @@ Although all new Office 365 Education subscriptions have automatic licensing ena | -------| --------------------------| | Enable |`Set-MsolCompanySettings -AllowAdHocSubscriptions $true`| |Disable | `Set-MsolCompanySettings -AllowAdHocSubscriptions $false`| - +

### Enable Azure AD Premium When you create your Office 365 subscription, you create an Office 365 tenant that includes an Azure AD directory. Azure AD is the centralized repository for all your student and faculty accounts in Office 365, Intune, and other Azure AD–integrated apps. Azure AD is available in Free, Basic, and Premium editions. Azure AD Free, which is included in Office 365 Education, has fewer features than Azure AD Basic, which in turn has fewer features than Azure AD Premium. @@ -378,7 +384,7 @@ In this synchronization model (illustrated in Figure 6), you run Azure AD Connec 1. Configure your environment to meet the prerequisites for installing Azure AD Connect by performing the steps in [Prerequisites for Azure AD Connect](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect-prerequisites/). 2. On the VM or physical device that will run Azure AD Connect, sign in with a domain administrator account. 3. Install Azure AD Connect by performing the steps in [Install Azure AD Connect](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/#install-azure-ad-connect). -4. Configure Azure AD Connect features based on your institution’s requirements by performing the steps in [Configure features](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/#configure-features). +4. Configure Azure AD Connect features based on your institution’s requirements by performing the steps in [Configure features](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/#configure-sync-features). Now that you have used on premises Azure AD Connect to deploy AD DS and Azure AD synchronization, you’re ready to verify that Azure AD Connect is synchronizing AD DS user and group accounts with Azure AD. @@ -474,7 +480,7 @@ Assign SharePoint Online resource permissions to Office 365 security groups, not **Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. -For information about creating security groups, see Create and manage Office 365 groups in Admin Center Preview. +For information about creating security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). You can add and remove users from security groups at any time. @@ -533,16 +539,17 @@ After you create the Windows Store for Business portal, configure it by using th *Table 7. Menu selections to configure Windows Store for Business settings* -| Method | What you can do in this menu | +| Menu selection | What you can do in this menu | |---------------| -------------------| |Account information|Displays information about your Windows Store for Business account (no settings can be changed). You make changes to this information in Office 365 or the Azure Portal. For more information, see [Update Windows Store for Business account settings](https://technet.microsoft.com/itpro/windows/manage/update-windows-store-for-business-account-settings).| |Device Guard signing|Allows you to upload and sign Device Guard catalog and policy files. For more information about Device Guard, see [Device Guard deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide).| |LOB publishers| Allows you to add line-of-business (LOB) publishers that can then publish apps to your private store. LOB publishers are usually internal developers or software vendors that are working with your institution. For more information, see [Working with line-of-business apps](https://technet.microsoft.com/itpro/windows/manage/working-with-line-of-business-apps).| |Management tools| Allows you to add tools that you can use to distribute (deploy) apps in your private store. For more information, see [Distribute apps with a management tool](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-with-management-tool).| -|Offline licensing|Allows you to show (or not show) offline licensed apps to people shopping in your private store. For more information, see [Licensing model: online and offline licenses](https://technet.microsoft.com/itpro/windows/manage/apps-in-windows-store-for-business#licensing_model).| +|Offline licensing|Allows you to show (or not show) offline licensed apps to people shopping in your private store. For more information, see [Licensing model: online and offline licenses](https://technet.microsoft.com/itpro/windows/manage/apps-in-windows-store-for-business#licensing-model).| |Permissions|Allows you to grant other users in your organization the ability to buy, manage, and administer your Windows Store for Business portal. You can also remove permissions you have previously granted. For more information, see [Roles and permissions in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business).| |Private store|Allows you to change the organization name used in your Windows Store for Business portal. When you create your portal, the private store uses the organization name that you used to create your Office 365 subscription. For more information, see [Distribute apps using your private store](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-from-your-private-store).| + ### Find, acquire, and distribute apps in the portal Now that you have created your Windows Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this by using the Inventory page in Windows Store for Business. @@ -614,7 +621,7 @@ The MDT deployment process is highly automated, requiring minimal information to -Windows Deployment Services +Windows Deployment Services This method:

  • Uses diskless booting to initiate MDT deployment.
    • @@ -628,7 +635,7 @@ Select this method when you want to deploy Windows over-the-network and perform -Bootable media +Bootable media This method:
    • Initiates MDT deployment by booting from local media, including from USB drives, DVD-ROM, or CD-ROM.
      • @@ -641,7 +648,7 @@ Select this method when you want to deploy Windows over-the-network and are will -MDT deployment media +MDT deployment media This method:
      • Initiates MDT deployment by booting from a local USB hard disk.
        • @@ -652,11 +659,9 @@ Select this method when you want to deploy Windows over-the-network and are will Select this method when you want to perform local deployments and are willing to boot the target device from a local USB hard disk. The advantage of this method is that local deployments are faster than over-the-network deployments. The disadvantage of this method is that each time you change the deployment share, you must regenerate the MDT deployment media and update the USB hard disk. - - ### Summary At the end of this section, you should know the Windows 10 editions and processor architecture that you want to deploy (and will import later in the process). You also determined whether you want to use thin or thick images. Finally, you selected the method for initiating your LTI deployment. Now, you can prepare for Windows 10 deployment. @@ -684,13 +689,12 @@ The first step in preparation for Windows 10 deployment is to configure—that i -1. Import operating systems -Import the operating systems that you selected in the [Select operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#ImportanOperatingSystemintotheDeploymentWorkbench). - +1. Import operating systems +Import the operating systems that you selected in the [Select operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#ImportanOperatingSystemintotheDeploymentWorkbench). -2. Import device drives +2. Import device drives Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.

        Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#ImportDeviceDriversintotheDeploymentWorkbench). @@ -699,7 +703,7 @@ Import device drivers for each device in your institution. For more information -3. Create MDT applications for Windows Store apps +3. Create MDT applications for Windows Store apps Create an MDT application for each Windows Store app you want to deploy. You can deploy Windows Store apps by using *sideloading*, which allows you to use the **Add-AppxPackage** Windows PowerShell cmdlet to deploy the .appx files associated with the app (called *provisioned apps*). Use this method to deploy up to 24 apps to Windows 10.

        Prior to sideloading the .appx files, obtain the Windows Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Windows Store, you will need to obtain the .appx files from the app software vendor directly. If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Windows Store or Windows Store for Business.

        @@ -708,7 +712,7 @@ If you have Intune, you can deploy Windows Store apps after you deploy Windows 1 In addition, you must prepare your environment for sideloading (deploying) Windows Store apps. For more information about how to:
          -
        • Prepare your environment for sideloading, see [Try it out: sideload Windows Store apps](https://technet.microsoft.com/en-us/itpro/windows/deploy/sideload-apps-in-windows-10).
          • +
        • Prepare your environment for sideloading, see [Sideload LOB apps in Windows 10](https://technet.microsoft.com/en-us/itpro/windows/deploy/sideload-apps-in-windows-10).
        • Create an MDT application, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench).
        @@ -717,7 +721,7 @@ In addition, you must prepare your environment for sideloading (deploying) Windo -4. Create MDT applications for Windows desktop apps +4. Create MDT applications for Windows desktop apps You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.

        @@ -733,11 +737,11 @@ For more information about how to create an MDT application for Window desktop a -5. Create task sequences. +5. Create task sequences. You must create a separate task sequences for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in Step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education; (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education; or (3) if you want to run deployments and upgrades for both 32 bit and 64 bit versions of Windows 10. To do so, you must create task sequences that will: -
          -
        • Deploy Windows 10 Education 64-bit to devices.
          • + +
          • Deploy Windows 10 Education 64-bit to devices.
          • Deploy Windows 10 Education 32-bit to devices.
          • Upgrade existing devices to Windows 10 Education 64-bit.
          • Upgrade existing devices to Windows 10 Education 32-bit.
            • @@ -749,15 +753,12 @@ Again, you will create the task sequences based on the operating systems that yo -6. Update the deployment share. +6. Update the deployment share. Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32 bit and 64 bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.

            -For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#UpdateaDeploymentShareintheDeploymentWorkbench). - - +For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#UpdateaDeploymentShareintheDeploymentWorkbench). - @@ -768,6 +769,7 @@ You can use Windows Deployment Services in conjunction with MDT to automatically #### To configure Windows Deployment Services for MDT 1. Set up and configure Windows Deployment Services.

            Windows Deployment Services is a server role available in all Windows Server editions. You can enable the Windows Deployment Services server role on a new server or on any server running Windows Server in your institution. For more information about how to perform this step, see the following resources: + - [Windows Deployment Services overview](https://technet.microsoft.com/library/hh831764.aspx) - The Windows Deployment Services Help file, included in Windows Deployment Services - [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/en-us/library/jj648426.aspx) @@ -788,7 +790,7 @@ If you have only one device to configure, manually configuring that one device i For a school, there are many ways to manage devices. Table 10 lists the methods that this guide describes and recommends. Use the information in Table 10 to determine which combination of management methods is right for your institution. -Table 10. School management methods +*Table 10. School management methods* @@ -863,9 +865,10 @@ The disadvantages of this method are: ### Select Microsoft-recommended settings + Microsoft has several recommended settings for educational institutions. Table 11 lists them, provides a brief description of why you need to configure them, and recommends methods for configuring the settings. Review the settings in Table 11 and evaluate their relevancy to your institution. Use the information to help you determine whether you need to configure the setting and which method you will use to do so. At the end, you will have a list of settings that you want to apply to the Windows 10 devices and know which management method you will use to configure the settings. -Table 11. Recommended settings for educational institutions +*Table 11. Recommended settings for educational institutions*
            @@ -973,9 +976,10 @@ Table 11. Recommended settings for educational institutions
            + ### Configure settings by using Group Policy -Now, you’re ready to configure settings by using Group Policy. The steps in this section assume that you have an AD DS infrastructure. You will configure the Group Policy settings you select here in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) settings. +Now, you’re ready to configure settings by using Group Policy. The steps in this section assume that you have an AD DS infrastructure. You will configure the Group Policy settings you select in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) section. For more information about Group Policy, see [Group Policy Planning and Deployment Guide](https://technet.microsoft.com/en-us/library/cc754948.aspx). @@ -1018,13 +1022,14 @@ Prior to deployment of Windows 10, ensure that you complete the tasks listed in *Table 12. Deployment preparation checklist* -|Task | | +|Task | | | ---| --- | | |The target devices have sufficient system resources to run Windows 10. | | | Identify the necessary devices drivers, and import them to the MDT deployment share.| | | Create an MDT application for each Windows Store and Windows desktop app.| | | Notify the students and faculty about the deployment.| + ### Perform the deployment Use the Deployment Wizard to deploy Windows 10. The LTI deployment process is almost fully automated: You provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. @@ -1087,7 +1092,7 @@ Table 13 lists the school and individual classroom maintenance tasks, the resour -+@@ -1120,7 +1125,7 @@ For more information about completing this task when you have: +For more information about completing this task, see [Turn Windows Defender on or off](http://windows.microsoft.com/en-us/windows-10/how-to-protect-your-windows-10-pc#v1h=tab01) and [Updating Windows Defender](http://windows.microsoft.com/en-us/windows-10/how-to-protect-your-windows-10-pc#v1h=tab03). From d4d1c78056deae4a8643f3d355f5edc15ec0fcae Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 5 May 2016 09:41:12 -0700 Subject: [PATCH 19/38] changed name of network exhaust file --- windows/manage/TOC.md | 2 +- ...istory-for-manage-and-update-windows-10.md | 2 +- ...-devices-to-stop-data-flow-to-microsoft.md | 1272 ++++++++++++++++ ...onnect-your-organization-from-microsoft.md | 1274 +---------------- windows/manage/lock-down-windows-10.md | 2 +- 5 files changed, 1277 insertions(+), 1275 deletions(-) create mode 100644 windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index 983de4d62e..7da90bbb2a 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -17,7 +17,7 @@ #### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) #### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md) -### [Configure Windows 10 devices to stop data flow to Microsoft](disconnect-your-organization-from-microsoft.md) +### [Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md) ### [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) ### [Configure access to Windows Store](stop-employees-from-using-the-windows-store.md) ### [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index 8767cf30ff..c4e625e08f 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -34,7 +34,7 @@ New or changed topic | Description | - + diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md new file mode 100644 index 0000000000..a6acc2dea8 --- /dev/null +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -0,0 +1,1272 @@ +--- +title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) +description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. +ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 +keywords: privacy, stop data flow to Microsoft +ms.prod: W10 +ms.mktglfcycl: manage +ms.sitesec: library +--- + +# Configure Windows 10 devices to stop data flow to Microsoft + +**Applies to** + +- Windows10 + +If youre looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). + +Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. + +If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. + +Some of the network connections discussed in this article can be managed in Windows10 Mobile, Windows10 Mobile Enterprise, and the July release of Windows 10. However, you must use Windows10 Enterprise,version 1511 or Windows10 Education,version 1511 to manage them all. + +In Windows10 Enterprise,version 1511 or Windows10 Education,version 1511, you can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. + +We are always working on improving Windows10 for our customers. We invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows10 work better for your organization. + +Here's what's covered in this article: + +- [Info management settings](#bkmk-othersettings) + + - [1. Cortana](#bkmk-cortana) + + - [1.1 Cortana Group Policies](#bkmk-cortana-gp) + + - [1.2 Cortana MDM policies](#bkmk-cortana-mdm) + + - [1.3 Cortana Windows Provisioning](#bkmk-cortana-prov) + + - [2. Date & Time](#bkmk-datetime) + + - [3. Device metadata retrieval](#bkmk-devinst) + + - [4. Font streaming](#font-streaming) + + - [5. Insider Preview builds](#bkmk-previewbuilds) + + - [6. Internet Explorer](#bkmk-ie) + + - [6.1 Internet Explorer Group Policies](#bkmk-ie-gp) + + - [6.2 ActiveX control blocking](#bkmk-ie-activex) + + - [7. Live Tiles](#live-tiles) + + - [8. Mail synchronization](#bkmk-mailsync) + + - [9. Microsoft Edge](#bkmk-edge) + + - [9.1 Microsoft Edge Group Policies](#bkmk-edgegp) + + - [9.2 Microsoft Edge MDM policies](#bkmk-edge-mdm) + + - [9.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov) + + - [10. Network Connection Status Indicator](#bkmk-ncsi) + + - [11. Offline maps](#bkmk-offlinemaps) + + - [12. OneDrive](#bkmk-onedrive) + + - [13. Preinstalled apps](#bkmk-preinstalledapps) + + - [14. Settings > Privacy](#bkmk-settingssection) + + - [14.1 General](#bkmk-priv-general) + + - [14.2 Location](#bkmk-priv-location) + + - [14.3 Camera](#bkmk-priv-camera) + + - [14.4 Microphone](#bkmk-priv-microphone) + + - [14.5 Speech, inking, & typing](#bkmk-priv-speech) + + - [14.6 Account info](#bkmk-priv-accounts) + + - [14.7 Contacts](#bkmk-priv-contacts) + + - [14.8 Calendar](#bkmk-priv-calendar) + + - [14.9 Call history](#bkmk-priv-callhistory) + + - [14.10 Email](#bkmk-priv-email) + + - [14.11 Messaging](#bkmk-priv-messaging) + + - [14.12 Radios](#bkmk-priv-radios) + + - [14.13 Other devices](#bkmk-priv-other-devices) + + - [14.14 Feedback & diagnostics](#bkmk-priv-feedback) + + - [14.15 Background apps](#bkmk-priv-background) + + - [15. Software Protection Platform](#bkmk-spp) + + - [16. Sync your settings](#bkmk-syncsettings) + + - [17. Teredo](#bkmk-teredo) + + - [18. Wi-Fi Sense](#bkmk-wifisense) + + - [19. Windows Defender](#bkmk-defender) + + - [20. Windows Media Player](#bkmk-wmp) + + - [21. Windows spotlight](#bkmk-spotlight) + + - [22. Windows Store](#bkmk-windowsstore) + + - [23. Windows Update Delivery Optimization](#bkmk-updates) + + - [23.1 Settings > Update & security](#bkmk-wudo-ui) + + - [23.2 Delivery Optimization Group Policies](#bkmk-wudo-gp) + + - [23.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm) + + - [23.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov) + + - [24. Windows Update](#bkmk-wu) + +## What's new in Windows10, version 1511 + + +Here's a list of changes that were made to this article for Windows10, version 1511: + +- Added the following new sections: + + - [Mail synchronization](#bkmk-mailsync) + + - [Offline maps](#bkmk-offlinemaps) + + - [Windows spotlight](#bkmk-spotlight) + + - [Windows Store](#bkmk-windowsstore) + +- Added the following Group Policies: + + - Open a new tab with an empty tab + + - Configure corporate Home pages + + - Let Windows apps access location + + - Let Windows apps access the camera + + - Let Windows apps access the microphone + + - Let Windows apps access account information + + - Let Windows apps access contacts + + - Let Windows apps access the calendar + + - Let Windows apps access messaging + + - Let Windows apps control radios + + - Let Windows apps access trusted devices + + - Do not show feedback notifications + + - Turn off Automatic Download and Update of Map Data + + - Force a specific default lock screen image + +- Added the AllowLinguisticDataCollection MDM policy. + +- Added steps in the [Cortana](#bkmk-cortana) section on how to disable outbound traffic using Windows Firewall. + +- Added steps in the [Live tiles](#bkmk-livetiles) section on how to remove the Money and Sports apps. + +- Changed the Windows Update section to apply system-wide settings, and not just per user. + +## Info management settings + + +This section lists the components that make network connections to Microsoft services automatically. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. + +The settings in this section assume you are using Windows10, version 1511 (currently available in the Current Branch and Current Branch for Business). They will also be included in the next update for the Long Term Servicing Branch. + +- [1. Cortana](#bkmk-cortana) + +- [2. Date & Time](#bkmk-datetime) + +- [3. Device metadata retrieval](#bkmk-devinst) + +- [4. Font streaming](#font-streaming) + +- [5. Insider Preview builds](#bkmk-previewbuilds) + +- [6. Internet Explorer](#bkmk-ie) + +- [7. Live Tiles](#live-tiles) + +- [8. Mail synchronization](#bkmk-mailsync) + +- [9. Microsoft Edge](#bkmk-edge) + +- [10. Network Connection Status Indicator](#bkmk-ncsi) + +- [11. Offline maps](#bkmk-offlinemaps) + +- [12. OneDrive](#bkmk-onedrive) + +- [13. Preinstalled apps](#bkmk-preinstalledapps) + +- [14. Settings > Privacy](#bkmk-settingssection) + +- [15. Software Protection Platform](#bkmk-spp) + +- [16. Sync your settings](#bkmk-syncsettings) + +- [17. Teredo](#bkmk-teredo) + +- [18. Wi-Fi Sense](#bkmk-wifisense) + +- [19. Windows Defender](#bkmk-defender) + +- [20. Windows Media Player](#bkmk-wmp) + +- [21. Windows spotlight](#bkmk-spotlight) + +- [22. Windows Store](#bkmk-windowsstore) + +- [23. Windows Update](#bkmk-wu) + +- [24. Windows Update Delivery Optimization](#bkmk-updates) + +See the following table for a summary of the management settings. For more info, see its corresponding section. + +![Management settings table](images/settings-table.png) + +### 1. Cortana + +Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730683). + +### 1.1 Cortana Group Policies + +Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**. + +| Policy | Description | +|------------------------------------------------------|---------------------------------------------------------------------------------------| +| Allow Cortana | Choose whether to let Cortana install and run on the device. | +| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results. | +| Do not allow web search | Choose whether to search the web from Windows Desktop Search.
            Default: Disabled| +| Don't search the web or display web results in Search| Choose whether to search the web from Cortana. | +| Set what information is shared in Search | Control what information is shared with Bing in Search. | + +When you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. + +1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. + +2. Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts. + +3. On the **Rule Type** page, click **Program**, and then click **Next**. + +4. On the **Program** page, click **This program path**, type **%windir%\\systemapps\\Microsoft.Windows.Cortana\_cw5n1h2txyewy\\SearchUI.exe**, and then click **Next**. + +5. On the **Action** page, click **Block the connection**, and then click **Next**. + +6. On the **Profile** page, ensure that the **Domain**, **Private**, and **Public** check boxes are selected, and then click **Next**. + +7. On the **Name** page, type a name for the rule, such as **Cortana firewall configuration**, and then click **Finish.** + +8. Right-click the new rule, click **Properties**, and then click **Protocols and Ports**. + +9. Configure the **Protocols and Ports** page with the following info, and then click **OK**. + + - For **Protocol type**, choose **TCP**. + + - For **Local port**, choose **All Ports**. + + - For **Remote port**, choose **All ports**. + +**Note** +If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. You should use a network traffic analyzer, such as WireShark or Message Analyzer. + +### 1.2 Cortana MDM policies + +The following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Experience/AllowCortana | Choose whether to let Cortana install and run on the device. | +| Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results.
            Default: Allowed| + +### 1.3 Cortana Windows Provisioning + +To use Windows Imaging and Configuration Designer (ICD) to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies** to find **Experience** > **AllowCortana** and **Search** > **AllowSearchToUseLocation**. + +### 2. Date & Time + +You can prevent Windows from setting the time automatically. + +- To turn off the feature in the UI: **Settings** > **Time & language** > **Date & time** > **Set time automatically** + + -or- + +- Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters** with a value of **NoSync**. + +### 3. Device metadata retrieval + +To prevent Windows from retrieving device metadata from the Internet, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. + +### 4. Font streaming + +Starting with Windows 10, fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. + +To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. + +**Note** +This may change in future versions of Windows. + +### 5. Insider Preview builds + +To turn off Insider Preview builds if you're running a released version of Windows10. If you're running a preview version of Windows10, you must roll back to a released version before you can turn off Insider Preview builds. + +- Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Stop Insider builds**. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. + + -or- + +- Apply the System/AllowBuildPreview MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: + + - **0**. Users cannot make their devices available for downloading and installing preview software. + + - **1**. Users can make their devices available for downloading and installing preview software. + + - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. + + -or- + +- Create a provisioning package: **Runtime settings** > **Policies** > **System** > **AllowBuildPreview**, where: + + - **0**. Users cannot make their devices available for downloading and installing preview software. + + - **1**. Users can make their devices available for downloading and installing preview software. + + - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. + +### 6. Internet Explorer + +Use Group Policy to manage settings for Internet Explorer. + +### 6.1 Internet Explorer Group Policies + +Find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
            Default: Enabled
            You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.| +| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the address bar.
            Default: Enabled| +| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.
            Default: Disabled
            You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| +| Disable Periodic Check for Internet Explorer software updates| Choose whether Internet Explorer periodically checks for a new version.
            Default: Enabled | +| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
            Default: Disabled| + +### 6.2 ActiveX control blocking + +ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). + +For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx). + +### 7. Live Tiles + +To turn off Live Tiles: + +- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage** + +### 8. Mail synchronization + +To turn off mail synchronization for Microsoft Accounts that are configured on a device: + +- In **Settings** > **Accounts** > **Your email and accounts**, remove any connected Microsoft Accounts. + + -or- + +- Remove any Microsoft Accounts from the Mail app. + + -or- + +- Apply the Accounts/AllowMicrosoftAccountConnection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. This does not apply to Microsoft Accounts that have already been configured on the device. + +To turn off the Windows Mail app: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application** + +### 9. Microsoft Edge + +Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730682). + +### 9.1 Microsoft Edge Group Policies + +Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. + +**Note** +The Microsoft Edge Group Policy names were changed in Windows10, version 1511. The table below reflects those changes. + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Turn off autofill | Choose whether employees can use autofill on websites.
            Default: Enabled | +| Allow employees to send Do Not Track headers | Choose whether employees can send Do Not Track headers.
            Default: Disabled | +| Turn off password manager | Choose whether employees can save passwords locally on their devices.
            Default: Enabled | +| Turn off address bar search suggestions | Choose whether the address bar shows search suggestions.
            Default: Enabled | +| Turn off the SmartScreen Filter | Choose whether SmartScreen is turned on or off.
            Default: Enabled | +| Open a new tab with an empty tab | Choose whether a new tab page appears.
            Default: Enabled | +| Configure corporate Home pages | Choose the corporate Home page for domain-joined devices.
            Set this to **about:blank** | + +### 9.2 Microsoft Edge MDM policies + +The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Browser/AllowAutoFill | Choose whether employees can use autofill on websites.
            Default: Allowed | +| Browser/AllowDoNotTrack | Choose whether employees can send Do Not Track headers.
            Default: Not allowed | +| Browser/AllowPasswordManager | Choose whether employees can save passwords locally on their devices.
            Default: Allowed | +| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions..
            Default: Allowed | +| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
            Default: Allowed | + +### 9.3 Microsoft Edge Windows Provisioning + +Use Windows ICD to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies**. + +For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx). + +### 10. Network Connection Status Indicator + +Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftncsi.com to determine if the device can communicate with the Internet. For more info about NCIS, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). + +You can turn off NCSI through Group Policy: + +- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** + +### 11. Offline maps + +You can turn off the ability to download and update offline maps. + +- In the UI: **Settings** > **System** > **Offline maps** > **Automatically update maps** + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** + +### 12. OneDrive + +To turn off OneDrive in your organization: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage** + +### 13. Preinstalled apps + +Some preinstalled apps get content before they are opened to ensure a great experience. You can remove these using the steps in this section. + +To remove the News app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingNews | Remove-AppxPackage** + +To remove the Weather app: + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingWeather"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingWeather | Remove-AppxPackage** + +To remove the Money app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingFinance"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingFinance | Remove-AppxPackage** + +To remove the Sports app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingSports"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingSports | Remove-AppxPackage** + +To remove the Twitter app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "\*.Twitter"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage \*.Twitter | Remove-AppxPackage** + +To remove the XBOX app: + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.XboxApp"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.XboxApp | Remove-AppxPackage** + +To remove the Sway app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.Office.Sway"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.Sway | Remove-AppxPackage** + +To remove the OneNote app: + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.Office.OneNote"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.OneNote | Remove-AppxPackage** + +To remove the Get Office app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.MicrosoftOfficeHub"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftOfficeHub | Remove-AppxPackage** + +To remove the Get Skype app: + +- Right-click the Sports app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.SkypeApp"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage** + +### 14. Settings > Privacy + +Use Settings > Privacy to configure some settings that may be important to your organization. Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. + +- [14.1 General](#bkmk-general) + +- [14.2 Location](#bkmk-priv-location) + +- [14.3 Camera](#bkmk-priv-camera) + +- [14.4 Microphone](#bkmk-priv-microphone) + +- [14.5 Speech, inking, & typing](#bkmk-priv-speech) + +- [14.6 Account info](#bkmk-priv-accounts) + +- [14.7 Contacts](#bkmk-priv-contacts) + +- [14.8 Calendar](#bkmk-priv-calendar) + +- [14.9 Call history](#bkmk-priv-callhistory) + +- [14.10 Email](#bkmk-priv-email) + +- [14.11 Messaging](#bkmk-priv-messaging) + +- [14.12 Radios](#bkmk-priv-radios) + +- [14.13 Other devices](#bkmk-priv-other-devices) + +- [14.14 Feedback & diagnostics](#bkmk-priv-feedback) + +- [14.15 Background apps](#bkmk-priv-background) + +### 14.1 General + +**General** includes options that don't fall into other areas. + +To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: + +**Note** +When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. + + + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. + + -or- + +- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo**, with a value of 0 (zero). + +To turn off **Turn on SmartScreen Filter to check web content (URLs) that Windows Store apps use**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Turn off the SmartScreen Filter**. + + Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. + + -or- + +- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. + + -or- + +- Create a provisioning package, using: + + - For Internet Explorer: **Runtime settings** > **Policies** > **Browser** > **AllowSmartScreen** + + - For Microsoft Edge: **Runtime settings** > **Policies** > **MicrosoftEdge** > **AllowSmartScreen** + + -or- + +- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation**, with a value of 0 (zero). + +To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: + +**Note** +If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. + + + +- Turn off the feature in the UI. + + -or- + +- Apply the TextInput/AllowLinguisticDataCollection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: + + - **0**. Not allowed + + - **1**. Allowed (default) + +To turn off **Let websites provide locally relevant content by accessing my language list**: + +- Turn off the feature in the UI. + + -or- + +- Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1. + +### 14.2 Location + +In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location. + +To turn off **Location for this device**: + +- Click the **Change** button in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. + + -or- + +- Apply the System/AllowLocation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Turned off and the employee can't turn it back on. + + - **1**. Turned on, but lets the employee choose whether to use it. (default) + + - **2**. Turned on and the employee can't turn it off. + + **Note** + You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). + + -or- + +- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowLocation**, where + + - **No**. Turns off location service. + + - **Yes**. Turns on location service. (default) + +To turn off **Location**: + +- Turn off the feature in the UI. + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** + + - Set the **Select a setting** box to **Force Deny**. + + -or- + +To turn off **Location history**: + +- Erase the history using the **Clear** button in the UI. + +To turn off **Choose apps that can use your location**: + +- Turn off each app using the UI. + +### 14.3 Camera + +In the **Camera** area, you can choose which apps can access a device's camera. + +To turn off **Let apps use my camera**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the camera** + + - Set the **Select a setting** box to **Force Deny**. + + -or- + +- Apply the Camera/AllowCamera MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Apps can't use the camera. + + - **1**. Apps can use the camera. + + **Note** + You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). + + -or- + +- Create a provisioning package with use Windows ICD, using **Runtime settings** > **Policies** > **Camera** > **AllowCamera**, where: + + - **0**. Apps can't use the camera. + + - **1**. Apps can use the camera. + +To turn off **Choose apps that can use your camera**: + +- Turn off the feature in the UI for each app. + +### 14.4 Microphone + +In the **Microphone** area, you can choose which apps can access a device's microphone. + +To turn off **Let apps use my microphone**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the microphone** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can use your microphone**: + +- Turn off the feature in the UI for each app. + +### 14.5 Speech, inking, & typing + +In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. + +**Note** +For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. + + + +To turn off the functionality: + +- Click the **Stop getting to know me** button, and then click **Turn off**. + + -or- + +- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Regional and Language Options** > **Handwriting personalization** > **Turn off automatic learning** + + -or- + +- Create a REG\_DWORD registry setting called **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Personalization\\Settings**, with a value of 0 (zero). + + -and- + + Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero). + +### 14.6 Account info + +In the **Account Info** area, you can choose which apps can access your name, picture, and other account info. + +To turn off **Let apps access my name, picture, and other account info**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access account information** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose the apps that can access your account info**: + +- Turn off the feature in the UI for each app. + +### 14.7 Contacts + +In the **Contacts** area, you can choose which apps can access an employee's contacts list. + +To turn off **Choose apps that can access contacts**: + +- Turn off the feature in the UI for each app. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.8 Calendar + +In the **Calendar** area, you can choose which apps have access to an employee's calendar. + +To turn off **Let apps access my calendar**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the calendar** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can access calendar**: + +- Turn off the feature in the UI for each app. + +### 14.9 Call history + +In the **Call history** area, you can choose which apps have access to an employee's call history. + +To turn off **Let apps access my call history**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access call history** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.10 Email + +In the **Email** area, you can choose which apps have can access and send email. + +To turn off **Let apps access and send email**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access email** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.11 Messaging + +In the **Messaging** area, you can choose which apps can read or send messages. + +To turn off **Let apps read or send messages (text or MMS)**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access messaging** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can read or send messages**: + +- Turn off the feature in the UI for each app. + +### 14.12 Radios + +In the **Radios** area, you can choose which apps can turn a device's radio on or off. + +To turn off **Let apps control radios**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps control radios** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can control radios**: + +- Turn off the feature in the UI for each app. + +### 14.13 Other devices + +In the **Other Devices** area, you can choose whether devices that aren't paired to PCs, such as an Xbox One, can share and sync info. + +To turn off **Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone**: + +- Turn off the feature in the UI. + +To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access trusted devices** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.14 Feedback & diagnostics + +In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. + +To change how frequently **Windows should ask for my feedback**: + +**Note** +Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device. + + + +- To change from **Automatically (Recommended)**, use the drop-down list in the UI. + + -or- + +- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Do not show feedback notifications** + + -or- + +- Create the registry keys (REG\_DWORD type): + + - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\PeriodInNanoSeconds + + - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\NumberOfSIUFInPeriod + + Based on these settings: + + | Setting | PeriodInNanoSeconds | NumberOfSIUFInPeriod | + |---------------|-----------------------------|-----------------------------| + | Automatically | Delete the registry setting | Delete the registry setting | + | Never | 0 | 0 | + | Always | 100000000 | Delete the registry setting | + | Once a day | 864000000000 | 1 | + | Once a week | 6048000000000 | 1 | + + + +To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**: + +- To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. + + **Note** + You can't use the UI to change the telemetry level to **Security**. + + + + -or- + +- Apply the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** + + -or- + +- Apply the System/AllowTelemetry MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Maps to the **Security** level. + + - **1**. Maps to the **Basic** level. + + - **2**. Maps to the **Enhanced** level. + + - **3**. Maps to the **Full** level. + + -or- + +- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowTelemetry**, where: + + - **0**. Maps to the **Security** level. + + - **1**. Maps to the **Basic** level. + + - **2**. Maps to the **Enhanced** level. + + - **3**. Maps to the **Full** level. + +### 14.15 Background apps + +In the **Background Apps** area, you can choose which apps can run in the background. + +To turn off **Let apps run in the background**: + +- Turn off the feature in the UI for each app. + +### 15. Software Protection Platform + +Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by applying the following Group Policy: + +**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Activation** + +The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. + +### 16. Sync your settings + +You can control if your settings are synchronized: + +- In the UI: **Settings** > **Accounts** > **Sync your settings** + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync** + + -or- + +- Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. + + -or- + +- Create a provisioning package, using **Runtime settings** > **Policies** > **Experience** > **AllowSyncMySettings**, where + + - **No**. Settings are not synchronized. + + - **Yes**. Settings are synchronized. (default) + +To turn off Messaging cloud sync: + +- Create a REG\_DWORD registry setting called **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging**, with a value of 0 (zero). + +### 17. Teredo + +You can disable Teredo by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](http://technet.microsoft.com/library/cc722030.aspx). + +- From an elevated command prompt, run **netsh interface teredo set state disabled** + +### 18. Wi-Fi Sense + +Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them. + +To turn off **Connect to suggested open hotspots** and **Connect to networks shared by my contacts**: + +- Turn off the feature in the UI. + + -or- + +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **WLAN Service** > **WLAN Settings** > **Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services**. + + -or- + +- Create a new REG\_DWORD registry setting called **AutoConnectAllowedOEM** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config**, with a value of 0 (zero). + + -or- + +- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620909). + + -or- + +- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620910). + +When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. + +### 19. Windows Defender + +You can opt of the Microsoft Antimalware Protection Service. + +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Join Microsoft MAPS** + + -or- + +- Apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + + -or- + +- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to 0 (zero). + +You can stop sending file samples back to Microsoft. + +- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**. + + -or- + +- Apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Always prompt. + + - **1**. (default) Send safe samples automatically. + + - **2**. Never send. + + - **3**. Send all samples automatically. + + -or- + +- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SubmitSamplesConsent** to 0 (zero) to always prompt or 2 to never send. + +You can stop downloading definition updates: + +- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. + + -and- + +- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. + +You can also use the registry to turn off Malicious Software Reporting Tool telemetry by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1. + +### 20. Windows Media Player + +To remove Windows Media Player: + +- From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**. + + -or- + +- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** + +### 21. Windows spotlight + +Windows spotlight provides different background images and text on the lock screen. You can control it by using the user interface or through Group Policy. + +- Configure the following in **Settings**: + + - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Show me tips, tricks, and more on the lock screen**. + + - **Personalization** > **Start** > **Occasionally show suggestions in Start**. + + - **System** > **Notifications & actions** > **Show me tips about Windows**. + + -or- + +- Apply the Group Policies: + + - **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**. + - Add a location in the **Path to local lock screen image** box. + + - Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box. + + **Note**This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. + + + + - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows Tips**. + + - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**. + +For more info, see [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md). + +### 22. Windows Store + +You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**. + +### 23. Windows Update Delivery Optimization + +Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. + +By default, PCs running Windows10 Enterprise and Windows10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. + +Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization. + +### 23.1 Settings > Update & security + +You can set up Delivery Optimization from the **Settings** UI. + +- Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. + +### 23.2 Delivery Optimization Group Policies + +You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. + +| Policy | Description | +|---------------------------|-----------------------------------------------------------------------------------------------------| +| Download Mode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

            • None. Turns off Delivery Optimization.

            • Group. Gets or sends updates and apps to PCs on the same local network domain.

            • Internet. Gets or sends updates and apps to PCs on the Internet.

            • LAN. Gets or sends updates and apps to PCs on the same NAT only.

            | +| Group ID | Lets you provide a Group ID that limits which PCs can share apps and updates.
            ** Note** This ID must be a GUID.| +| Max Cache Age | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
            The default value is 259200 seconds (3 days).| +| Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
            The default value is 20, which represents 20% of the disk.| +| Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
            The default value is 0, which means unlimited possible bandwidth.| + +### 23.3 Delivery Optimization MDM policies + +The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + +| Policy | Description | +|---------------------------|-----------------------------------------------------------------------------------------------------| +| DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

            • 0. Turns off Delivery Optimization.

            • 1. Gets or sends updates and apps to PCs on the same NAT only.

            • 2. Gets or sends updates and apps to PCs on the same local network domain.

            • 3. Gets or sends updates and apps to PCs on the Internet.

            | +| DeliveryOptimization/DOGroupID | Lets you provide a Group ID that limits which PCs can share apps and updates.
            ** Note** This ID must be a GUID.| +| DeliveryOptimization/DOMaxCacheAge | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
            The default value is 259200 seconds (3 days).| +| DeliveryOptimization/DOMaxCacheSize | Lets you specify the maximum cache size as a percentage of disk size.
            The default value is 20, which represents 20% of the disk.| +| DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
            The default value is 0, which means unlimited possible bandwidth.| + + +### 23.4 Delivery Optimization Windows Provisioning + +If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies + +Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization. + +1. Open Windows ICD, and then click **New provisioning package**. + +2. In the **Name** box, type a name for the provisioning package, and then click **Next.** + +3. Click the **Common to all Windows editions** option, click **Next**, and then click **Finish**. + +4. Go to **Runtime settings** > **Policies** > **DeliveryOptimization** to configure the policies. + +For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730684). + +### 24. Windows Update + +You can turn off Windows Update by setting the following registry entries: + +- Add a REG\_DWORD value called **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. + + -and- + +- Add a REG\_DWORD value called **DisableWindowsUpdateAccess** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. + +You can turn off automatic updates by doing one of the following. This is not recommended. + +- Add a REG\_DWORD value called **AutoDownload** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5. + + -or- + +- Apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Notify the user before downloading the update. + + - **1**. Auto install the update and then notify the user to schedule a device restart. + + - **2** (default). Auto install and restart. + + - **3**. Auto install and restart at a specified time. + + - **4**. Auto install and restart without end-user control. + + - **5**. Turn off automatic updates. + +To learn more, see [Device update management](http://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](http://technet.microsoft.com/library/cc720539.aspx). diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index 03d1063632..a0541ec7b9 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1,1273 +1,3 @@ --- -title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) -description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. -ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 -keywords: privacy, disconnect from Microsoft -ms.prod: W10 -ms.mktglfcycl: manage -ms.sitesec: library -author: brianlic-msft ---- - -# Configure Windows 10 devices to stop data flow to Microsoft - -**Applies to** - -- Windows 10 - -If you’re looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). - -Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. - -If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. - -Some of the network connections discussed in this article can be managed in Windows 10 Mobile, Windows 10 Mobile Enterprise, and the July release of Windows 10. However, you must use Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511 to manage them all. - -In Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511, you can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. - -We are always working on improving Windows 10 for our customers. We invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows 10 work better for your organization. - -Here's what's covered in this article: - -- [Info management settings](#bkmk-othersettings) - - - [1. Cortana](#bkmk-cortana) - - - [1.1 Cortana Group Policies](#bkmk-cortana-gp) - - - [1.2 Cortana MDM policies](#bkmk-cortana-mdm) - - - [1.3 Cortana Windows Provisioning](#bkmk-cortana-prov) - - - [2. Date & Time](#bkmk-datetime) - - - [3. Device metadata retrieval](#bkmk-devinst) - - - [4. Font streaming](#font-streaming) - - - [5. Insider Preview builds](#bkmk-previewbuilds) - - - [6. Internet Explorer](#bkmk-ie) - - - [6.1 Internet Explorer Group Policies](#bkmk-ie-gp) - - - [6.2 ActiveX control blocking](#bkmk-ie-activex) - - - [7. Live Tiles](#live-tiles) - - - [8. Mail synchronization](#bkmk-mailsync) - - - [9. Microsoft Edge](#bkmk-edge) - - - [9.1 Microsoft Edge Group Policies](#bkmk-edgegp) - - - [9.2 Microsoft Edge MDM policies](#bkmk-edge-mdm) - - - [9.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov) - - - [10. Network Connection Status Indicator](#bkmk-ncsi) - - - [11. Offline maps](#bkmk-offlinemaps) - - - [12. OneDrive](#bkmk-onedrive) - - - [13. Preinstalled apps](#bkmk-preinstalledapps) - - - [14. Settings > Privacy](#bkmk-settingssection) - - - [14.1 General](#bkmk-priv-general) - - - [14.2 Location](#bkmk-priv-location) - - - [14.3 Camera](#bkmk-priv-camera) - - - [14.4 Microphone](#bkmk-priv-microphone) - - - [14.5 Speech, inking, & typing](#bkmk-priv-speech) - - - [14.6 Account info](#bkmk-priv-accounts) - - - [14.7 Contacts](#bkmk-priv-contacts) - - - [14.8 Calendar](#bkmk-priv-calendar) - - - [14.9 Call history](#bkmk-priv-callhistory) - - - [14.10 Email](#bkmk-priv-email) - - - [14.11 Messaging](#bkmk-priv-messaging) - - - [14.12 Radios](#bkmk-priv-radios) - - - [14.13 Other devices](#bkmk-priv-other-devices) - - - [14.14 Feedback & diagnostics](#bkmk-priv-feedback) - - - [14.15 Background apps](#bkmk-priv-background) - - - [15. Software Protection Platform](#bkmk-spp) - - - [16. Sync your settings](#bkmk-syncsettings) - - - [17. Teredo](#bkmk-teredo) - - - [18. Wi-Fi Sense](#bkmk-wifisense) - - - [19. Windows Defender](#bkmk-defender) - - - [20. Windows Media Player](#bkmk-wmp) - - - [21. Windows spotlight](#bkmk-spotlight) - - - [22. Windows Store](#bkmk-windowsstore) - - - [23. Windows Update Delivery Optimization](#bkmk-updates) - - - [23.1 Settings > Update & security](#bkmk-wudo-ui) - - - [23.2 Delivery Optimization Group Policies](#bkmk-wudo-gp) - - - [23.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm) - - - [23.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov) - - - [24. Windows Update](#bkmk-wu) - -## What's new in Windows 10, version 1511 - - -Here's a list of changes that were made to this article for Windows 10, version 1511: - -- Added the following new sections: - - - [Mail synchronization](#bkmk-mailsync) - - - [Offline maps](#bkmk-offlinemaps) - - - [Windows spotlight](#bkmk-spotlight) - - - [Windows Store](#bkmk-windowsstore) - -- Added the following Group Policies: - - - Open a new tab with an empty tab - - - Configure corporate Home pages - - - Let Windows apps access location - - - Let Windows apps access the camera - - - Let Windows apps access the microphone - - - Let Windows apps access account information - - - Let Windows apps access contacts - - - Let Windows apps access the calendar - - - Let Windows apps access messaging - - - Let Windows apps control radios - - - Let Windows apps access trusted devices - - - Do not show feedback notifications - - - Turn off Automatic Download and Update of Map Data - - - Force a specific default lock screen image - -- Added the AllowLinguisticDataCollection MDM policy. - -- Added steps in the [Cortana](#bkmk-cortana) section on how to disable outbound traffic using Windows Firewall. - -- Added steps in the [Live tiles](#bkmk-livetiles) section on how to remove the Money and Sports apps. - -- Changed the Windows Update section to apply system-wide settings, and not just per user. - -## Info management settings - - -This section lists the components that make network connections to Microsoft services automatically. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. - -The settings in this section assume you are using Windows 10, version 1511 (currently available in the Current Branch and Current Branch for Business). They will also be included in the next update for the Long Term Servicing Branch. - -- [1. Cortana](#bkmk-cortana) - -- [2. Date & Time](#bkmk-datetime) - -- [3. Device metadata retrieval](#bkmk-devinst) - -- [4. Font streaming](#font-streaming) - -- [5. Insider Preview builds](#bkmk-previewbuilds) - -- [6. Internet Explorer](#bkmk-ie) - -- [7. Live Tiles](#live-tiles) - -- [8. Mail synchronization](#bkmk-mailsync) - -- [9. Microsoft Edge](#bkmk-edge) - -- [10. Network Connection Status Indicator](#bkmk-ncsi) - -- [11. Offline maps](#bkmk-offlinemaps) - -- [12. OneDrive](#bkmk-onedrive) - -- [13. Preinstalled apps](#bkmk-preinstalledapps) - -- [14. Settings > Privacy](#bkmk-settingssection) - -- [15. Software Protection Platform](#bkmk-spp) - -- [16. Sync your settings](#bkmk-syncsettings) - -- [17. Teredo](#bkmk-teredo) - -- [18. Wi-Fi Sense](#bkmk-wifisense) - -- [19. Windows Defender](#bkmk-defender) - -- [20. Windows Media Player](#bkmk-wmp) - -- [21. Windows spotlight](#bkmk-spotlight) - -- [22. Windows Store](#bkmk-windowsstore) - -- [23. Windows Update](#bkmk-wu) - -- [24. Windows Update Delivery Optimization](#bkmk-updates) - -See the following table for a summary of the management settings. For more info, see its corresponding section. - -![Management settings table](images/settings-table.png) - -### 1. Cortana - -Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730683). - -### 1.1 Cortana Group Policies - -Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**. - -| Policy | Description | -|------------------------------------------------------|---------------------------------------------------------------------------------------| -| Allow Cortana | Choose whether to let Cortana install and run on the device. | -| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results. | -| Do not allow web search | Choose whether to search the web from Windows Desktop Search.
            Default: Disabled| -| Don't search the web or display web results in Search| Choose whether to search the web from Cortana. | -| Set what information is shared in Search | Control what information is shared with Bing in Search. | - -When you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. - -1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. - -2. Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts. - -3. On the **Rule Type** page, click **Program**, and then click **Next**. - -4. On the **Program** page, click **This program path**, type **%windir%\\systemapps\\Microsoft.Windows.Cortana\_cw5n1h2txyewy\\SearchUI.exe**, and then click **Next**. - -5. On the **Action** page, click **Block the connection**, and then click **Next**. - -6. On the **Profile** page, ensure that the **Domain**, **Private**, and **Public** check boxes are selected, and then click **Next**. - -7. On the **Name** page, type a name for the rule, such as **Cortana firewall configuration**, and then click **Finish.** - -8. Right-click the new rule, click **Properties**, and then click **Protocols and Ports**. - -9. Configure the **Protocols and Ports** page with the following info, and then click **OK**. - - - For **Protocol type**, choose **TCP**. - - - For **Local port**, choose **All Ports**. - - - For **Remote port**, choose **All ports**. - -**Note**   -If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. You should use a network traffic analyzer, such as WireShark or Message Analyzer. - -### 1.2 Cortana MDM policies - -The following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - -| Policy | Description | -|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Experience/AllowCortana | Choose whether to let Cortana install and run on the device. | -| Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results.
            Default: Allowed| - -### 1.3 Cortana Windows Provisioning - -To use Windows Imaging and Configuration Designer (ICD) to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies** to find **Experience** > **AllowCortana** and **Search** > **AllowSearchToUseLocation**. - -### 2. Date & Time - -You can prevent Windows from setting the time automatically. - -- To turn off the feature in the UI: **Settings** > **Time & language** > **Date & time** > **Set time automatically** - - -or- - -- Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters** with a value of **NoSync**. - -### 3. Device metadata retrieval - -To prevent Windows from retrieving device metadata from the Internet, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. - -### 4. Font streaming - -Starting with Windows 10, fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. - -To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. - -**Note**   -This may change in future versions of Windows. - -### 5. Insider Preview builds - -To turn off Insider Preview builds if you're running a released version of Windows 10. If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. - -- Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Stop Insider builds**. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. - - -or- - -- Apply the System/AllowBuildPreview MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: - - - **0**. Users cannot make their devices available for downloading and installing preview software. - - - **1**. Users can make their devices available for downloading and installing preview software. - - - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. - - -or- - -- Create a provisioning package: **Runtime settings** > **Policies** > **System** > **AllowBuildPreview**, where: - - - **0**. Users cannot make their devices available for downloading and installing preview software. - - - **1**. Users can make their devices available for downloading and installing preview software. - - - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. - -### 6. Internet Explorer - -Use Group Policy to manage settings for Internet Explorer. - -### 6.1 Internet Explorer Group Policies - -Find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. - -| Policy | Description | -|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
            Default: Enabled
            You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.| -| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the address bar.
            Default: Enabled| -| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.
            Default: Disabled
            You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| -| Disable Periodic Check for Internet Explorer software updates| Choose whether Internet Explorer periodically checks for a new version.
            Default: Enabled | -| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
            Default: Disabled| - -### 6.2 ActiveX control blocking - -ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). - -For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx). - -### 7. Live Tiles - -To turn off Live Tiles: - -- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage** - -### 8. Mail synchronization - -To turn off mail synchronization for Microsoft Accounts that are configured on a device: - -- In **Settings** > **Accounts** > **Your email and accounts**, remove any connected Microsoft Accounts. - - -or- - -- Remove any Microsoft Accounts from the Mail app. - - -or- - -- Apply the Accounts/AllowMicrosoftAccountConnection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. This does not apply to Microsoft Accounts that have already been configured on the device. - -To turn off the Windows Mail app: - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application** - -### 9. Microsoft Edge - -Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730682). - -### 9.1 Microsoft Edge Group Policies - -Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. - -**Note**   -The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. - -| Policy | Description | -|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Turn off autofill | Choose whether employees can use autofill on websites.
            Default: Enabled | -| Allow employees to send Do Not Track headers | Choose whether employees can send Do Not Track headers.
            Default: Disabled | -| Turn off password manager | Choose whether employees can save passwords locally on their devices.
            Default: Enabled | -| Turn off address bar search suggestions | Choose whether the address bar shows search suggestions.
            Default: Enabled | -| Turn off the SmartScreen Filter | Choose whether SmartScreen is turned on or off.
            Default: Enabled | -| Open a new tab with an empty tab | Choose whether a new tab page appears.
            Default: Enabled | -| Configure corporate Home pages | Choose the corporate Home page for domain-joined devices.
            Set this to **about:blank** | - -### 9.2 Microsoft Edge MDM policies - -The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - -| Policy | Description | -|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Browser/AllowAutoFill | Choose whether employees can use autofill on websites.
            Default: Allowed | -| Browser/AllowDoNotTrack | Choose whether employees can send Do Not Track headers.
            Default: Not allowed | -| Browser/AllowPasswordManager | Choose whether employees can save passwords locally on their devices.
            Default: Allowed | -| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions..
            Default: Allowed | -| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
            Default: Allowed | - -### 9.3 Microsoft Edge Windows Provisioning - -Use Windows ICD to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies**. - -For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx). - -### 10. Network Connection Status Indicator - -Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftncsi.com to determine if the device can communicate with the Internet. For more info about NCIS, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). - -You can turn off NCSI through Group Policy: - -- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** - -### 11. Offline maps - -You can turn off the ability to download and update offline maps. - -- In the UI: **Settings** > **System** > **Offline maps** > **Automatically update maps** - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** - -### 12. OneDrive - -To turn off OneDrive in your organization: - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage** - -### 13. Preinstalled apps - -Some preinstalled apps get content before they are opened to ensure a great experience. You can remove these using the steps in this section. - -To remove the News app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingNews | Remove-AppxPackage** - -To remove the Weather app: - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingWeather"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingWeather | Remove-AppxPackage** - -To remove the Money app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingFinance"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingFinance | Remove-AppxPackage** - -To remove the Sports app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingSports"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingSports | Remove-AppxPackage** - -To remove the Twitter app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "\*.Twitter"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage \*.Twitter | Remove-AppxPackage** - -To remove the XBOX app: - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.XboxApp"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.XboxApp | Remove-AppxPackage** - -To remove the Sway app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.Office.Sway"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.Sway | Remove-AppxPackage** - -To remove the OneNote app: - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.Office.OneNote"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.OneNote | Remove-AppxPackage** - -To remove the Get Office app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.MicrosoftOfficeHub"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftOfficeHub | Remove-AppxPackage** - -To remove the Get Skype app: - -- Right-click the Sports app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.SkypeApp"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage** - -### 14. Settings > Privacy - -Use Settings > Privacy to configure some settings that may be important to your organization. Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. - -- [14.1 General](#bkmk-general) - -- [14.2 Location](#bkmk-priv-location) - -- [14.3 Camera](#bkmk-priv-camera) - -- [14.4 Microphone](#bkmk-priv-microphone) - -- [14.5 Speech, inking, & typing](#bkmk-priv-speech) - -- [14.6 Account info](#bkmk-priv-accounts) - -- [14.7 Contacts](#bkmk-priv-contacts) - -- [14.8 Calendar](#bkmk-priv-calendar) - -- [14.9 Call history](#bkmk-priv-callhistory) - -- [14.10 Email](#bkmk-priv-email) - -- [14.11 Messaging](#bkmk-priv-messaging) - -- [14.12 Radios](#bkmk-priv-radios) - -- [14.13 Other devices](#bkmk-priv-other-devices) - -- [14.14 Feedback & diagnostics](#bkmk-priv-feedback) - -- [14.15 Background apps](#bkmk-priv-background) - -### 14.1 General - -**General** includes options that don't fall into other areas. - -To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: - -**Note**   -When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. - -  - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. - - -or- - -- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo**, with a value of 0 (zero). - -To turn off **Turn on SmartScreen Filter to check web content (URLs) that Windows Store apps use**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Turn off the SmartScreen Filter**. - - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. - - -or- - -- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. - - -or- - -- Create a provisioning package, using: - - - For Internet Explorer: **Runtime settings** > **Policies** > **Browser** > **AllowSmartScreen** - - - For Microsoft Edge: **Runtime settings** > **Policies** > **MicrosoftEdge** > **AllowSmartScreen** - - -or- - -- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation**, with a value of 0 (zero). - -To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: - -**Note**   -If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. - -  - -- Turn off the feature in the UI. - - -or- - -- Apply the TextInput/AllowLinguisticDataCollection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: - - - **0**. Not allowed - - - **1**. Allowed (default) - -To turn off **Let websites provide locally relevant content by accessing my language list**: - -- Turn off the feature in the UI. - - -or- - -- Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1. - -### 14.2 Location - -In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location. - -To turn off **Location for this device**: - -- Click the **Change** button in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. - - -or- - -- Apply the System/AllowLocation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - - **0**. Turned off and the employee can't turn it back on. - - - **1**. Turned on, but lets the employee choose whether to use it. (default) - - - **2**. Turned on and the employee can't turn it off. - - **Note**   - You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). - - -or- - -- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowLocation**, where - - - **No**. Turns off location service. - - - **Yes**. Turns on location service. (default) - -To turn off **Location**: - -- Turn off the feature in the UI. - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** - - - Set the **Select a setting** box to **Force Deny**. - - -or- - -To turn off **Location history**: - -- Erase the history using the **Clear** button in the UI. - -To turn off **Choose apps that can use your location**: - -- Turn off each app using the UI. - -### 14.3 Camera - -In the **Camera** area, you can choose which apps can access a device's camera. - -To turn off **Let apps use my camera**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the camera** - - - Set the **Select a setting** box to **Force Deny**. - - -or- - -- Apply the Camera/AllowCamera MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - - **0**. Apps can't use the camera. - - - **1**. Apps can use the camera. - - **Note**   - You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). - - -or- - -- Create a provisioning package with use Windows ICD, using **Runtime settings** > **Policies** > **Camera** > **AllowCamera**, where: - - - **0**. Apps can't use the camera. - - - **1**. Apps can use the camera. - -To turn off **Choose apps that can use your camera**: - -- Turn off the feature in the UI for each app. - -### 14.4 Microphone - -In the **Microphone** area, you can choose which apps can access a device's microphone. - -To turn off **Let apps use my microphone**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the microphone** - - - Set the **Select a setting** box to **Force Deny**. - -To turn off **Choose apps that can use your microphone**: - -- Turn off the feature in the UI for each app. - -### 14.5 Speech, inking, & typing - -In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. - -**Note**   -For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. - -  - -To turn off the functionality: - -- Click the **Stop getting to know me** button, and then click **Turn off**. - - -or- - -- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Regional and Language Options** > **Handwriting personalization** > **Turn off automatic learning** - - -or- - -- Create a REG\_DWORD registry setting called **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Personalization\\Settings**, with a value of 0 (zero). - - -and- - - Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero). - -### 14.6 Account info - -In the **Account Info** area, you can choose which apps can access your name, picture, and other account info. - -To turn off **Let apps access my name, picture, and other account info**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access account information** - - - Set the **Select a setting** box to **Force Deny**. - -To turn off **Choose the apps that can access your account info**: - -- Turn off the feature in the UI for each app. - -### 14.7 Contacts - -In the **Contacts** area, you can choose which apps can access an employee's contacts list. - -To turn off **Choose apps that can access contacts**: - -- Turn off the feature in the UI for each app. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** - - - Set the **Select a setting** box to **Force Deny**. - -### 14.8 Calendar - -In the **Calendar** area, you can choose which apps have access to an employee's calendar. - -To turn off **Let apps access my calendar**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the calendar** - - - Set the **Select a setting** box to **Force Deny**. - -To turn off **Choose apps that can access calendar**: - -- Turn off the feature in the UI for each app. - -### 14.9 Call history - -In the **Call history** area, you can choose which apps have access to an employee's call history. - -To turn off **Let apps access my call history**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access call history** - - - Set the **Select a setting** box to **Force Deny**. - -### 14.10 Email - -In the **Email** area, you can choose which apps have can access and send email. - -To turn off **Let apps access and send email**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access email** - - - Set the **Select a setting** box to **Force Deny**. - -### 14.11 Messaging - -In the **Messaging** area, you can choose which apps can read or send messages. - -To turn off **Let apps read or send messages (text or MMS)**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access messaging** - - - Set the **Select a setting** box to **Force Deny**. - -To turn off **Choose apps that can read or send messages**: - -- Turn off the feature in the UI for each app. - -### 14.12 Radios - -In the **Radios** area, you can choose which apps can turn a device's radio on or off. - -To turn off **Let apps control radios**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps control radios** - - - Set the **Select a setting** box to **Force Deny**. - -To turn off **Choose apps that can control radios**: - -- Turn off the feature in the UI for each app. - -### 14.13 Other devices - -In the **Other Devices** area, you can choose whether devices that aren't paired to PCs, such as an Xbox One, can share and sync info. - -To turn off **Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone**: - -- Turn off the feature in the UI. - -To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access trusted devices** - - - Set the **Select a setting** box to **Force Deny**. - -### 14.14 Feedback & diagnostics - -In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. - -To change how frequently **Windows should ask for my feedback**: - -**Note**   -Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device. - -  - -- To change from **Automatically (Recommended)**, use the drop-down list in the UI. - - -or- - -- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Do not show feedback notifications** - - -or- - -- Create the registry keys (REG\_DWORD type): - - - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\PeriodInNanoSeconds - - - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\NumberOfSIUFInPeriod - - Based on these settings: - - | Setting | PeriodInNanoSeconds | NumberOfSIUFInPeriod | - |---------------|-----------------------------|-----------------------------| - | Automatically | Delete the registry setting | Delete the registry setting | - | Never | 0 | 0 | - | Always | 100000000 | Delete the registry setting | - | Once a day | 864000000000 | 1 | - | Once a week | 6048000000000 | 1 | - -   - -To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**: - -- To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. - - **Note**   - You can't use the UI to change the telemetry level to **Security**. - -   - - -or- - -- Apply the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** - - -or- - -- Apply the System/AllowTelemetry MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - - **0**. Maps to the **Security** level. - - - **1**. Maps to the **Basic** level. - - - **2**. Maps to the **Enhanced** level. - - - **3**. Maps to the **Full** level. - - -or- - -- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowTelemetry**, where: - - - **0**. Maps to the **Security** level. - - - **1**. Maps to the **Basic** level. - - - **2**. Maps to the **Enhanced** level. - - - **3**. Maps to the **Full** level. - -### 14.15 Background apps - -In the **Background Apps** area, you can choose which apps can run in the background. - -To turn off **Let apps run in the background**: - -- Turn off the feature in the UI for each app. - -### 15. Software Protection Platform - -Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by applying the following Group Policy: - -**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Activation** - -The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. - -### 16. Sync your settings - -You can control if your settings are synchronized: - -- In the UI: **Settings** > **Accounts** > **Sync your settings** - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync** - - -or- - -- Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. - - -or- - -- Create a provisioning package, using **Runtime settings** > **Policies** > **Experience** > **AllowSyncMySettings**, where - - - **No**. Settings are not synchronized. - - - **Yes**. Settings are synchronized. (default) - -To turn off Messaging cloud sync: - -- Create a REG\_DWORD registry setting called **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging**, with a value of 0 (zero). - -### 17. Teredo - -You can disable Teredo by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](http://technet.microsoft.com/library/cc722030.aspx). - -- From an elevated command prompt, run **netsh interface teredo set state disabled** - -### 18. Wi-Fi Sense - -Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them. - -To turn off **Connect to suggested open hotspots** and **Connect to networks shared by my contacts**: - -- Turn off the feature in the UI. - - -or- - -- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **WLAN Service** > **WLAN Settings** > **Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services**. - - -or- - -- Create a new REG\_DWORD registry setting called **AutoConnectAllowedOEM** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config**, with a value of 0 (zero). - - -or- - -- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620909). - - -or- - -- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620910). - -When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. - -### 19. Windows Defender - -You can opt of the Microsoft Antimalware Protection Service. - -- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Join Microsoft MAPS** - - -or- - -- Apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - - -or- - -- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to 0 (zero). - -You can stop sending file samples back to Microsoft. - -- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**. - - -or- - -- Apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - - **0**. Always prompt. - - - **1**. (default) Send safe samples automatically. - - - **2**. Never send. - - - **3**. Send all samples automatically. - - -or- - -- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SubmitSamplesConsent** to 0 (zero) to always prompt or 2 to never send. - -You can stop downloading definition updates: - -- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. - - -and- - -- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. - -You can also use the registry to turn off Malicious Software Reporting Tool telemetry by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1. - -### 20. Windows Media Player - -To remove Windows Media Player: - -- From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**. - - -or- - -- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** - -### 21. Windows spotlight - -Windows spotlight provides different background images and text on the lock screen. You can control it by using the user interface or through Group Policy. - -- Configure the following in **Settings**: - - - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Show me tips, tricks, and more on the lock screen**. - - - **Personalization** > **Start** > **Occasionally show suggestions in Start**. - - - **System** > **Notifications & actions** > **Show me tips about Windows**. - - -or- - -- Apply the Group Policies: - - - **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**. - - Add a location in the **Path to local lock screen image** box. - - - Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box. - - **Note**  This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. - -   - - - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows Tips**. - - - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**. - -For more info, see [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md). - -### 22. Windows Store - -You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**. - -### 23. Windows Update Delivery Optimization - -Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. - -By default, PCs running Windows 10 Enterprise and Windows 10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. - -Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization. - -### 23.1 Settings > Update & security - -You can set up Delivery Optimization from the **Settings** UI. - -- Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. - -### 23.2 Delivery Optimization Group Policies - -You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. - -| Policy | Description | -|---------------------------|-----------------------------------------------------------------------------------------------------| -| Download Mode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

            • None. Turns off Delivery Optimization.

            • Group. Gets or sends updates and apps to PCs on the same local network domain.

            • Internet. Gets or sends updates and apps to PCs on the Internet.

            • LAN. Gets or sends updates and apps to PCs on the same NAT only.

            | -| Group ID | Lets you provide a Group ID that limits which PCs can share apps and updates.
            ** Note** This ID must be a GUID.| -| Max Cache Age | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
            The default value is 259200 seconds (3 days).| -| Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
            The default value is 20, which represents 20% of the disk.| -| Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
            The default value is 0, which means unlimited possible bandwidth.| - -### 23.3 Delivery Optimization MDM policies - -The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - -| Policy | Description | -|---------------------------|-----------------------------------------------------------------------------------------------------| -| DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

            • 0. Turns off Delivery Optimization.

            • 1. Gets or sends updates and apps to PCs on the same NAT only.

            • 2. Gets or sends updates and apps to PCs on the same local network domain.

            • 3. Gets or sends updates and apps to PCs on the Internet.

            | -| DeliveryOptimization/DOGroupID | Lets you provide a Group ID that limits which PCs can share apps and updates.
            ** Note** This ID must be a GUID.| -| DeliveryOptimization/DOMaxCacheAge | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
            The default value is 259200 seconds (3 days).| -| DeliveryOptimization/DOMaxCacheSize | Lets you specify the maximum cache size as a percentage of disk size.
            The default value is 20, which represents 20% of the disk.| -| DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
            The default value is 0, which means unlimited possible bandwidth.| - - -### 23.4 Delivery Optimization Windows Provisioning - -If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies - -Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization. - -1. Open Windows ICD, and then click **New provisioning package**. - -2. In the **Name** box, type a name for the provisioning package, and then click **Next.** - -3. Click the **Common to all Windows editions** option, click **Next**, and then click **Finish**. - -4. Go to **Runtime settings** > **Policies** > **DeliveryOptimization** to configure the policies. - -For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730684). - -### 24. Windows Update - -You can turn off Windows Update by setting the following registry entries: - -- Add a REG\_DWORD value called **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. - - -and- - -- Add a REG\_DWORD value called **DisableWindowsUpdateAccess** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. - -You can turn off automatic updates by doing one of the following. This is not recommended. - -- Add a REG\_DWORD value called **AutoDownload** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5. - - -or- - -- Apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - - **0**. Notify the user before downloading the update. - - - **1**. Auto install the update and then notify the user to schedule a device restart. - - - **2** (default). Auto install and restart. - - - **3**. Auto install and restart at a specified time. - - - **4**. Auto install and restart without end-user control. - - - **5**. Turn off automatic updates. - -To learn more, see [Device update management](http://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](http://technet.microsoft.com/library/cc720539.aspx). +redirect_url : https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft +--- \ No newline at end of file diff --git a/windows/manage/lock-down-windows-10.md b/windows/manage/lock-down-windows-10.md index af69f6baec..6371799d7f 100644 --- a/windows/manage/lock-down-windows-10.md +++ b/windows/manage/lock-down-windows-10.md @@ -47,7 +47,7 @@ Enterprises often need to manage how people use corporate devices. Windows 10 p - + From 1899f042612227c002536a5014fc736000783100 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 5 May 2016 09:41:54 -0700 Subject: [PATCH 20/38] saving change --- .../manage/change-history-for-manage-and-update-windows-10.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index c4e625e08f..f06acaf4e2 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -18,6 +18,8 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in New or changed topic | Description | ---|---| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Corrected script for setting a custom shell using Shell Launcher | +| [Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md) | Added section on how to turn off Live Tiles | +| [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) | New telemetry content | ## April 2016 @@ -34,7 +36,7 @@ New or changed topic | Description | - + From 193d3449170349a48fa68358c5b032f6d84eff1a Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 5 May 2016 09:49:55 -0700 Subject: [PATCH 21/38] adding title metadata to redirect topic --- windows/manage/disconnect-your-organization-from-microsoft.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index a0541ec7b9..3ea43acac6 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1,3 +1,4 @@ --- +title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) redirect_url : https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft --- \ No newline at end of file From 2f8551e95a94a38bcffd8b86468978de8253aa5d Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 5 May 2016 09:59:52 -0700 Subject: [PATCH 22/38] testing redirection with relative link --- windows/manage/disconnect-your-organization-from-microsoft.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index 3ea43acac6..3a557caccf 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1,4 +1,4 @@ --- title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) -redirect_url : https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft +redirect_url : /itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft --- \ No newline at end of file From 24eab840c888611dd6a22cb3c3c968e84500dc67 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 5 May 2016 10:04:47 -0700 Subject: [PATCH 23/38] redirecting to stage for now --- windows/manage/disconnect-your-organization-from-microsoft.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index 3a557caccf..4fa578cae0 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1,4 +1,4 @@ --- title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) -redirect_url : /itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft +redirect_url: http://tnstage.redmond.corp.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft --- \ No newline at end of file From fae79be41137ab5708e13b1bbd046800465f3f44 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 5 May 2016 10:10:28 -0700 Subject: [PATCH 24/38] removing weird character --- ...-devices-to-stop-data-flow-to-microsoft.md | 58 +++++++++---------- 1 file changed, 29 insertions(+), 29 deletions(-) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index a6acc2dea8..101be67674 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -12,19 +12,19 @@ ms.sitesec: library **Applies to** -- Windows10 +- Windows 10 -If youre looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). +If you're looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. -Some of the network connections discussed in this article can be managed in Windows10 Mobile, Windows10 Mobile Enterprise, and the July release of Windows 10. However, you must use Windows10 Enterprise,version 1511 or Windows10 Education,version 1511 to manage them all. +Some of the network connections discussed in this article can be managed in Windows 10 Mobile, Windows 10 Mobile Enterprise, and the July release of Windows 10. However, you must use Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511 to manage them all. -In Windows10 Enterprise,version 1511 or Windows10 Education,version 1511, you can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. +In Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511, you can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. -We are always working on improving Windows10 for our customers. We invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows10 work better for your organization. +We are always working on improving Windows 10 for our customers. We invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows 10 work better for your organization. Here's what's covered in this article: @@ -132,10 +132,10 @@ Here's what's covered in this article: - [24. Windows Update](#bkmk-wu) -## What's new in Windows10, version 1511 +## What's new in Windows 10, version 1511 -Here's a list of changes that were made to this article for Windows10, version 1511: +Here's a list of changes that were made to this article for Windows 10, version 1511: - Added the following new sections: @@ -190,7 +190,7 @@ Here's a list of changes that were made to this article for Windows This section lists the components that make network connections to Microsoft services automatically. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. -The settings in this section assume you are using Windows10, version 1511 (currently available in the Current Branch and Current Branch for Business). They will also be included in the next update for the Long Term Servicing Branch. +The settings in this section assume you are using Windows 10, version 1511 (currently available in the Current Branch and Current Branch for Business). They will also be included in the next update for the Long Term Servicing Branch. - [1. Cortana](#bkmk-cortana) @@ -286,7 +286,7 @@ When you enable the **Don't search the web or display web results in Search** Gr - For **Remote port**, choose **All ports**. -**Note** +**Note** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. You should use a network traffic analyzer, such as WireShark or Message Analyzer. ### 1.2 Cortana MDM policies @@ -322,12 +322,12 @@ Starting with Windows 10, fonts that are included in Windows but that are not st To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. -**Note** +**Note** This may change in future versions of Windows. ### 5. Insider Preview builds -To turn off Insider Preview builds if you're running a released version of Windows10. If you're running a preview version of Windows10, you must roll back to a released version before you can turn off Insider Preview builds. +To turn off Insider Preview builds if you're running a released version of Windows 10. If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. - Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Stop Insider builds**. @@ -409,8 +409,8 @@ Use either Group Policy or MDM policies to manage settings for Microsoft Edge. F Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. -**Note** -The Microsoft Edge Group Policy names were changed in Windows10, version 1511. The table below reflects those changes. +**Note** +The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| @@ -616,10 +616,10 @@ Use Settings > Privacy to configure some settings that may be important to yo To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: -**Note** +**Note** When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. - + - Turn off the feature in the UI. @@ -659,10 +659,10 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Window To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: -**Note** +**Note** If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. - + - Turn off the feature in the UI. @@ -704,7 +704,7 @@ To turn off **Location for this device**: - **2**. Turned on and the employee can't turn it off. - **Note** + **Note** You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). -or- @@ -755,7 +755,7 @@ To turn off **Let apps use my camera**: - **1**. Apps can use the camera. - **Note** + **Note** You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). -or- @@ -792,10 +792,10 @@ To turn off **Choose apps that can use your microphone**: In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. -**Note** +**Note** For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. - + To turn off the functionality: @@ -951,10 +951,10 @@ In the **Feedback & Diagnostics** area, you can choose how often you're asked fo To change how frequently **Windows should ask for my feedback**: -**Note** +**Note** Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device. - + - To change from **Automatically (Recommended)**, use the drop-down list in the UI. @@ -980,16 +980,16 @@ Feedback frequency only applies to user-generated feedback, not diagnostic and u | Once a day | 864000000000 | 1 | | Once a week | 6048000000000 | 1 | - + To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**: - To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. - **Note** + **Note** You can't use the UI to change the telemetry level to **Security**. - + -or- @@ -1168,9 +1168,9 @@ Windows spotlight provides different background images and text on the lock scre - Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box. - **Note**This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. + **Note** This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. - + - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows Tips**. @@ -1188,7 +1188,7 @@ You can turn off the ability to launch apps from the Windows Store that were pre Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. -By default, PCs running Windows10 Enterprise and Windows10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. +By default, PCs running Windows 10 Enterprise and Windows 10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization. From 7eb93c96c346b2d10489616b7d81c047563842cf Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 5 May 2016 10:22:00 -0700 Subject: [PATCH 25/38] fixing tables --- ...istory-for-manage-and-update-windows-10.md | 159 +++--------------- 1 file changed, 28 insertions(+), 131 deletions(-) diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index f06acaf4e2..81182141c2 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -10,147 +10,54 @@ author: jdeckerMS # Change history for Manage and update Windows 10 - This topic lists new and updated topics in the [Manage and update Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). ## May 2016 -New or changed topic | Description | ----|---| -[Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Corrected script for setting a custom shell using Shell Launcher | +| New or changed topic | Description | +| ---|---| +| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Corrected script for setting a custom shell using Shell Launcher | | [Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md) | Added section on how to turn off Live Tiles | | [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) | New telemetry content | + ## April 2016 - -
            Verify that Windows Defender is active and current with malware signatures.

            -For more information about completing this task, see [Turn Windows Defender on or off](http://windows.microsoft.com/en-us/windows-10/how-to-protect-your-windows-10-pc#v1h=tab02) and [Updating Windows Defender](http://windows.microsoft.com/en-us/windows-10/how-to-protect-your-windows-10-pc#v1h=tab03).             		X X X

            Added screenshots of Control Panel and the administrative tools folder.
            [Configure telemetry and other settings in your organization](disconnect-your-organization-from-microsoft.md)[Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md)

            Added the font streaming section.

            Use this article to make informed decisions about how you can configure Windows telemetry in your organization.

            [Disconnect your organization from Microsoft](disconnect-your-organization-from-microsoft.md)

            [Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md)

            Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro.

            Added screenshots of Control Panel and the administrative tools folder.
            [Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md)[Configure telemetry and other settings in your organization](disconnect-your-organization-from-microsoft.md)

            Added the font streaming section.
            - - - - - - - - - - - - - - - - - - - - -
            New or changed topicDescription
            [Administrative tools in Windows 10](administrative-tools-in-windows-10.md)

            Added screenshots of Control Panel and the administrative tools folder.

            [Configure telemetry and other settings in your organization](disconnect-your-organization-from-microsoft.md)

            Added the font streaming section.

            [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md)

            Made corrections to script and instructions for Shell Launcher.

            - -  +| New or changed topic | Description | +| ---|---| +| [Administrative tools in Windows 10](administrative-tools-in-windows-10.md) | Added screenshots of Control Panel and the administrative tools folder. | +| [Configure telemetry and other settings in your organization](disconnect-your-organization-from-microsoft.md) | Added the font streaming section. | +| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Made corrections to script and instructions for Shell Launcher. | ## March 2016 - - - - - - - - - - - - - - - - - - - - - - - -
            New or changed topicDescription
            [Application development for Windows as a service](application-development-for-windows-as-a-service.md)New
            [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md)

            New

            [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md)

            Updated to include the new Preview feature, Cortana and Microsoft Dynamics CRM integration.

            - -  +| New or changed topic | Description | +| ---|---| +| [Application development for Windows as a service](application-development-for-windows-as-a-service.md) | New | +| [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) | New | +| [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) | Updated to include the new Preview feature, Cortana and Microsoft Dynamics CRM integration. | ## February 2016 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            New or changed topicDescription
            [Configure telemetry and other settings in your organization](disconnect-your-organization-from-microsoft.md)

            Added call history and email to the Settings > Privacy section.

            -

            Added the Turn off Windows Mail application Group Policy to the Mail synchronization section.

            [Customize and export Start layout](customize-and-export-start-layout.md)Added a note to clarify that partial Start layout is only supported in Windows 10, version 1511 and later
            [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)Added instructions for replacing markup characters with escape characters in Start layout XML
            [Introduction to configuration service providers (CSPs) for IT pros](how-it-pros-can-use-configuration-service-providers.md)New
            [Windows 10 Mobile and MDM](windows-10-mobile-and-mdm.md)New
            [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md)Added information on servicing options for Windows 10 Mobile, Windows 10 Mobile Enterprise, and Windows 10 IoT Core (IoT Core).
            - +| New or changed topic | Description | +| ---|---| +| [Configure telemetry and other settings in your organization](disconnect-your-organization-from-microsoft.md) | Added call history and email to the Settings > Privacy section.
            Added the Turn off Windows Mail application Group Policy to the Mail synchronization section. | +| [Customize and export Start layout](customize-and-export-start-layout.md) | Added a note to clarify that partial Start layout is only supported in Windows 10, version 1511 and later | +| [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | Added instructions for replacing markup characters with escape characters in Start layout XML | +| [Introduction to configuration service providers (CSPs) for IT pros](how-it-pros-can-use-configuration-service-providers.md) | New | +| [Windows 10 Mobile and MDM](windows-10-mobile-and-mdm.md) | New | +| [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md) | Added information on servicing options for Windows 10 Mobile, Windows 10 Mobile Enterprise, and Windows 10 IoT Core (IoT Core). |   ## December 2015 - - - - - - - - - - - - - - - - - - - - - - - -
            New or changed topicDescription
            [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md)New
            [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md)New
            [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
            - -  +| New or changed topic | Description | +| ---|---| +| [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) | New | +| [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) | New | +|[Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | New | ## November 2015 - | New or changed topic | Description | |--------------------------------------------------------------------------------------------------------------------------------------------------|-------------| | [Administrative Tools in Windows 10](administrative-tools-in-windows-10.md) | New | @@ -168,11 +75,8 @@ New or changed topic | Description | | [Configure telemetry and other settings in your organization](disconnect-your-organization-from-microsoft.md) | Updated | | [New policies for Windows 10](new-policies-for-windows-10.md) | Updated | -  - ## Related topics - [Change history for What's new in Windows 10](../whats-new/change-history-for-what-s-new-in-windows-10.md) [Change history for Plan for Windows 10 deployment](../plan/change-history-for-plan-for-windows-10-deployment.md) @@ -181,11 +85,4 @@ New or changed topic | Description | [Change history for Keep Windows 10 secure](../keep-secure/change-history-for-keep-windows-10-secure.md) -  - -  - - - - - +  \ No newline at end of file From a5ab889b2d2da39fa56eb79d4936b250ad5f87af Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 5 May 2016 10:25:55 -0700 Subject: [PATCH 26/38] fixing internal TOC ordering --- ...gure-windows-10-devices-to-stop-data-flow-to-microsoft.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index 101be67674..2ffeb3b2d2 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -236,9 +236,10 @@ The settings in this section assume you are using Windows 10, version 1511 (curr - [22. Windows Store](#bkmk-windowsstore) -- [23. Windows Update](#bkmk-wu) +- [23. Windows Update Delivery Optimization](#bkmk-updates) + +- [24. Windows Update](#bkmk-wu) -- [24. Windows Update Delivery Optimization](#bkmk-updates) See the following table for a summary of the management settings. For more info, see its corresponding section. From d9e3d1e33f8c7f497a43b9bf20250758992d3e6d Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 5 May 2016 10:34:18 -0700 Subject: [PATCH 27/38] edits --- windows/plan/deploy-windows-10-in-a-school.md | 42 +++++++++---------- 1 file changed, 20 insertions(+), 22 deletions(-) diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index b5678c5efa..37e465c8c3 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -49,7 +49,9 @@ This school configuration has the following characteristics: - You install a 64-bit version of Windows 10 on the admin device. - You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. - You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. -- You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device.

            **Note**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. +- You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device. + + **Note**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. - The devices use Azure AD in Office 365 Education for identity management. - If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/). - Use [Intune](http://technet.microsoft.com/library/jj676587.aspx), [compliance settings in Office 365](https://support.office.com/en-us/article/Manage-mobile-devices-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy](http://technet.microsoft.com/en-us/library/cc725828%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396) in AD DS to manage devices. @@ -169,7 +171,7 @@ Complete the following steps to select the appropriate Office 365 Education lice

          • Determine the number of faculty members and students who will use the classroom.
            Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan.
          • Determine the faculty members and students who need to install Office applications on devices (if any).
            Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans.
            • - +

            *Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans* @@ -192,9 +194,9 @@ Complete the following steps to select the appropriate Office 365 Education lice - +

            The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. - +

          • Determine whether students or faculty need Azure Rights Management.
            You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management](https://technet.microsoft.com/library/jj585024.aspx).
          • Record the Office 365 Education license plans needed for the classroom in Table 2.
            • @@ -427,7 +429,7 @@ Several methods are available to bulk-import user accounts into AD DS domains. T |Ldifde.exe |This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| |VBScript | This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx) and [ADSI Scriptomatic](https://technet.microsoft.com/en-us/scriptcenter/dd939958.aspx).| |Windows PowerShell| This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| - +

            ### Create a source file that contains the user and group accounts After you have selected your user and group account bulk import method, you’re ready to create the source file that contains the user and group account. You’ll use the source file as the input to the import process. The source file format depends on the method you selected. Table 6 lists the source file format for the bulk import methods. @@ -439,7 +441,7 @@ After you have selected your user and group account bulk import method, you’re |Ldifde.exe|Ldifde.exe requires a specific format for the source file. Use Ldifde.exe to export existing user and group accounts so that you can see the format. For examples of the format that Ldifde.exe requires, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| |VBScript | VBScript can use any .csv file format to create a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in comma-separated values (CSV) format, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx).| | Windows PowerShell| Windows PowerShell can use any .csv file format you want to create as a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in CSV format, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| - +

            ### Import the user accounts into AD DS With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method. @@ -548,8 +550,7 @@ After you create the Windows Store for Business portal, configure it by using th |Offline licensing|Allows you to show (or not show) offline licensed apps to people shopping in your private store. For more information, see [Licensing model: online and offline licenses](https://technet.microsoft.com/itpro/windows/manage/apps-in-windows-store-for-business#licensing-model).| |Permissions|Allows you to grant other users in your organization the ability to buy, manage, and administer your Windows Store for Business portal. You can also remove permissions you have previously granted. For more information, see [Roles and permissions in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business).| |Private store|Allows you to change the organization name used in your Windows Store for Business portal. When you create your portal, the private store uses the organization name that you used to create your Office 365 subscription. For more information, see [Distribute apps using your private store](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-from-your-private-store).| - - +

            ### Find, acquire, and distribute apps in the portal Now that you have created your Windows Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this by using the Inventory page in Windows Store for Business. @@ -622,7 +623,7 @@ The MDT deployment process is highly automated, requiring minimal information to Windows Deployment Services -This method: +This method:

            • Uses diskless booting to initiate MDT deployment.
            • Works only with devices that support PXE boot.
              • @@ -636,7 +637,7 @@ Select this method when you want to deploy Windows over-the-network and perform Bootable media -This method: +This method:

              • Initiates MDT deployment by booting from local media, including from USB drives, DVD-ROM, or CD-ROM.
              • Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
                • @@ -649,7 +650,7 @@ Select this method when you want to deploy Windows over-the-network and are will MDT deployment media -This method: +This method:

                • Initiates MDT deployment by booting from a local USB hard disk.
                • Deploys Windows 10 from local media, which consumes less network bandwidth than over-the-network methods.
                  • @@ -678,7 +679,7 @@ The first step in preparation for Windows 10 deployment is to configure—that i -+ @@ -710,7 +711,7 @@ Prior to sideloading the .appx files, obtain the Windows Store .appx files that If you have Intune, you can deploy Windows Store apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows Store apps, and you can use it for ongoing management of Windows Store apps. This is the preferred method of deploying and managing Windows Store apps.

                  -In addition, you must prepare your environment for sideloading (deploying) Windows Store apps. For more information about how to: +In addition, you must prepare your environment for sideloading (deploying) Windows Store apps. For more information about how to:

                  • Prepare your environment for sideloading, see [Sideload LOB apps in Windows 10](https://technet.microsoft.com/en-us/itpro/windows/deploy/sideload-apps-in-windows-10).
                  • Create an MDT application, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench).
                    • @@ -794,7 +795,7 @@ For a school, there are many ways to manage devices. Table 10 lists the methods
                  -+ @@ -865,14 +866,13 @@ The disadvantages of this method are: ### Select Microsoft-recommended settings - Microsoft has several recommended settings for educational institutions. Table 11 lists them, provides a brief description of why you need to configure them, and recommends methods for configuring the settings. Review the settings in Table 11 and evaluate their relevancy to your institution. Use the information to help you determine whether you need to configure the setting and which method you will use to do so. At the end, you will have a list of settings that you want to apply to the Windows 10 devices and know which management method you will use to configure the settings. *Table 11. Recommended settings for educational institutions*
                  -+ @@ -974,8 +974,7 @@ Microsoft has several recommended settings for educational institutions. Table 1 -
                  - +

                  ### Configure settings by using Group Policy @@ -1028,8 +1027,7 @@ Prior to deployment of Windows 10, ensure that you complete the tasks listed in | | Identify the necessary devices drivers, and import them to the MDT deployment share.| | | Create an MDT application for each Windows Store and Windows desktop app.| | | Notify the students and faculty about the deployment.| - - +

                  ### Perform the deployment Use the Deployment Wizard to deploy Windows 10. The LTI deployment process is almost fully automated: You provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. @@ -1054,7 +1052,7 @@ After you have deployed Windows 10, the devices are almost ready for use. First, 1. Review the printer manufacturer’s instructions for installing the printer drivers. 2. On the admin device, download the printer drivers. 3. Copy the printer drivers to a USB drive. -4. On a device, use the same account you used to set up Windows 10 in the [Prepare the device](#prepare-the-device) section to sign in to the device. +4. On a device, use the same account you used to set up Windows 10 in the [Perform the deployment](#perform-the-deployment) section to sign in to the device. 5. Insert the USB drive in the device. 6. Follow the printer manufacturer’s instructions to install the printer drivers from the USB drive. 7. Verify that the printer drivers were installed correctly by printing a test page. @@ -1242,7 +1240,7 @@ Follow the same steps described in the [Deploy Windows 10 to devices](#deploy-wi - +

                  ### Summary Now, you have identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your school configuration should match the typical school configuration that you saw in the [Plan a typical school configuration](#plan-a-typical-school-configuration) section. By performing these maintenance tasks you help ensure that your school stays secure and is configured as you specified. From 0a581eedc0efb8f6a762148b721e1f34b13c572f Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 5 May 2016 10:59:18 -0700 Subject: [PATCH 28/38] edit --- windows/plan/deploy-windows-10-in-a-school.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index 37e465c8c3..fe2230c2e6 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -171,7 +171,7 @@ Complete the following steps to select the appropriate Office 365 Education lice

                • Determine the number of faculty members and students who will use the classroom.
                  Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan.
                • Determine the faculty members and students who need to install Office applications on devices (if any).
                  Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans.
                  • -

                  +
                  *Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans* @@ -196,7 +196,7 @@ Complete the following steps to select the appropriate Office 365 Education lice

                  The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. -

                  +
                • Determine whether students or faculty need Azure Rights Management.
                  You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management](https://technet.microsoft.com/library/jj585024.aspx).
                • Record the Office 365 Education license plans needed for the classroom in Table 2.
                  • @@ -741,7 +741,7 @@ For more information about how to create an MDT application for Window desktop a 5. Create task sequences. You must create a separate task sequences for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in Step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education; (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education; or (3) if you want to run deployments and upgrades for both 32 bit and 64 bit versions of Windows 10. To do so, you must create task sequences that will: - +

                  • Deploy Windows 10 Education 64-bit to devices.
                  • Deploy Windows 10 Education 32-bit to devices.
                  • Upgrade existing devices to Windows 10 Education 64-bit.
                    • @@ -862,7 +862,7 @@ The disadvantages of this method are: - +

                    ### Select Microsoft-recommended settings From 95448231a25b2862e240720551528ef064731424 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 5 May 2016 11:00:51 -0700 Subject: [PATCH 29/38] fix tagging --- windows/plan/deploy-windows-10-in-a-school.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index fe2230c2e6..38f7d771e7 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -1,8 +1,7 @@ --- title: Deploy Windows 10 in a school (Windows 10) description: Learn how to integrate your school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD). Deploy Windows 10 and apps to new devices or upgrade existing devices to Windows 10. Manage faculty, students, and devices by using Microsoft Intune and Group Policy. -ms.assetid: -keywords: ["configure", "tools", "device", "school"] +keywords: configure, tools, device, school ms.prod: w10 ms.mktglfcycl: plan ms.pgtyp: edu From 86a24b939192ac96b16a41566adaa895b84176c3 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 5 May 2016 11:24:52 -0700 Subject: [PATCH 30/38] add school document to TOC --- windows/plan/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/plan/TOC.md b/windows/plan/TOC.md index 51db604bd5..a188d6d0a1 100644 --- a/windows/plan/TOC.md +++ b/windows/plan/TOC.md @@ -9,6 +9,7 @@ ### [Integration with management solutions](integration-with-management-solutions-.md) ## [Guidance for education environments](windows-10-guidance-for-education-environments.md) ### [Chromebook migration guide](chromebook-migration-guide.md) +### [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Windows To Go: feature overview](windows-to-go-overview.md) ### [Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) ### [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) From 409c06957045f9341b4afe31d7f5f6fe3d48aac0 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 5 May 2016 11:27:42 -0700 Subject: [PATCH 31/38] add school deployment document to change history --- .../plan/change-history-for-plan-for-windows-10-deployment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/plan/change-history-for-plan-for-windows-10-deployment.md b/windows/plan/change-history-for-plan-for-windows-10-deployment.md index 82a16df6da..2fd0dc5f6a 100644 --- a/windows/plan/change-history-for-plan-for-windows-10-deployment.md +++ b/windows/plan/change-history-for-plan-for-windows-10-deployment.md @@ -19,7 +19,7 @@ This topic lists new and updated topics in the [Plan for Windows 10 deployment]( | New or changed topic | Description | |--------------------------------------------------------------------------------------------------------------------------------------------------|-------------| | [Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) (multiple topics) | New | - +| [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | New|   ## November 2015 From e6f2b902f57456e548c6ed257b82d2ef78b1b083 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 5 May 2016 11:33:01 -0700 Subject: [PATCH 32/38] fix date --- .../change-history-for-plan-for-windows-10-deployment.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/windows/plan/change-history-for-plan-for-windows-10-deployment.md b/windows/plan/change-history-for-plan-for-windows-10-deployment.md index 2fd0dc5f6a..7d8965c6d6 100644 --- a/windows/plan/change-history-for-plan-for-windows-10-deployment.md +++ b/windows/plan/change-history-for-plan-for-windows-10-deployment.md @@ -13,13 +13,19 @@ author: TrudyHa This topic lists new and updated topics in the [Plan for Windows 10 deployment](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## May 2016 + + +| New or changed topic | Description | +|--------------------------------------------------------------------------------------------------------------------------------------------------|-------------| +| [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | New| + ## December 2015 | New or changed topic | Description | |--------------------------------------------------------------------------------------------------------------------------------------------------|-------------| | [Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) (multiple topics) | New | -| [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | New|   ## November 2015 From 6db8bac6f4e9c19f5530813448fd12a0db8dc293 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 5 May 2016 11:44:22 -0700 Subject: [PATCH 33/38] fix table --- windows/plan/deploy-windows-10-in-a-school.md | 30 +++++++++++++------ 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index 38f7d771e7..fc672815c3 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -197,18 +197,30 @@ Complete the following steps to select the appropriate Office 365 Education lice The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device.

                  • Determine whether students or faculty need Azure Rights Management.
                    You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management](https://technet.microsoft.com/library/jj585024.aspx).
                    • -
                  • Record the Office 365 Education license plans needed for the classroom in Table 2.
                    • +
                  • Record the Office 365 Education license plans needed for the classroom in Table 2.

                    *Table 2. Office 365 Education license plans needed for the classroom* -|Quantity | Plan | -| ---| ----------- | -| | Office 365 Education for students | -| | Office 365 Education for faculty | -| | Azure Rights Management for students | -| | Azure Rights Management for faculty | -

                    -You will use the Office 365 Education license plan information you record in Table 2 in the [Create user accounts in Office 365](#create-user-accounts-in-office-365) section of this guide. + ++++ + + + + + + + + + + + + +
                    QuantityPlan
                    Office 365 Education for students
                    Office 365 Education for faculty
                    Azure Rights Management for students
                    Azure Rights Management for faculty
                    + +You will use the Office 365 Education license plan information you record in Table 2 in the [Create user accounts in Office 365](#create-user-accounts-in-office-365) section of this guide.

                    • ### Create a new Office 365 Education subscription From 15d1d445e3687ad1cb3a72ac003970ec800d0a10 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 5 May 2016 11:53:32 -0700 Subject: [PATCH 34/38] spacing --- windows/plan/deploy-windows-10-in-a-school.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index fc672815c3..6186582b4e 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -219,7 +219,7 @@ The best user experience is to run Office 365 ProPlus or use native Office apps Azure Rights Management for faculty - +
                    You will use the Office 365 Education license plan information you record in Table 2 in the [Create user accounts in Office 365](#create-user-accounts-in-office-365) section of this guide. ### Create a new Office 365 Education subscription From 8b2143182a951f9e098925ea430460e3df7eafc9 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 5 May 2016 12:04:42 -0700 Subject: [PATCH 35/38] spacing --- windows/plan/deploy-windows-10-in-a-school.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index 6186582b4e..fcecd37545 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -169,7 +169,7 @@ Complete the following steps to select the appropriate Office 365 Education lice
                    1. Determine the number of faculty members and students who will use the classroom.
                      Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan.
                      2. -
                    2. Determine the faculty members and students who need to install Office applications on devices (if any).
                      Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans.
                      3. +
                    3. Determine the faculty members and students who need to install Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans.

                      4. *Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans* @@ -193,7 +193,7 @@ Complete the following steps to select the appropriate Office 365 Education lice -

                      +
                      The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device.
                    4. Determine whether students or faculty need Azure Rights Management.
                      You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management](https://technet.microsoft.com/library/jj585024.aspx).
                      5. From f6c46c080b59462a5ccb47b18d45376907acc43a Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 5 May 2016 12:23:07 -0700 Subject: [PATCH 36/38] spacing --- windows/plan/deploy-windows-10-in-a-school.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index fcecd37545..2c9039447a 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -172,8 +172,7 @@ Complete the following steps to select the appropriate Office 365 Education lice
                    5. Determine the faculty members and students who need to install Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans.

                      6. *Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans* - - +
                      @@ -200,7 +199,7 @@ The best user experience is to run Office 365 ProPlus or use native Office apps
                    6. Record the Office 365 Education license plans needed for the classroom in Table 2.

                      *Table 2. Office 365 Education license plans needed for the classroom* - +
                      7. From 58e162fb061bbae894b3aa31f9a1a5175f944ea2 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 6 May 2016 10:12:33 -0700 Subject: [PATCH 37/38] removed broken link to old Live Tiles section --- ...nfigure-windows-10-devices-to-stop-data-flow-to-microsoft.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index 2ffeb3b2d2..df77f2d6aa 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -181,8 +181,6 @@ Here's a list of changes that were made to this article for Windows 10, version - Added steps in the [Cortana](#bkmk-cortana) section on how to disable outbound traffic using Windows Firewall. -- Added steps in the [Live tiles](#bkmk-livetiles) section on how to remove the Money and Sports apps. - - Changed the Windows Update section to apply system-wide settings, and not just per user. ## Info management settings From 08af3f0215683d634c83f7865949659db5fb09ce Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 6 May 2016 13:47:44 -0700 Subject: [PATCH 38/38] changed redirect to live server --- windows/manage/disconnect-your-organization-from-microsoft.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index 4fa578cae0..2adc6e5005 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1,4 +1,4 @@ --- title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) -redirect_url: http://tnstage.redmond.corp.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft +redirect_url: http://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft --- \ No newline at end of file

t0GQbtmxgo zMn;KFut-7wWKd&PvohT5A?NaqEOFqrw70O=`P&Y(Wbuz5sTmp3qi@J5D3aMl!4k#d z$g=nbCeSqEO9Ys>41Ey1jn=KR`>sIZsclXBUsh7& zqdU6X4x_u1q+tDv5<+b&%=mEL=<0+OUHsWY4v*oN`_NNhMr&S1&_-P|&k@^~PHC~u zKP55OhCXg~WbrW8;Hq4}GVy#_xFli!awzEcO1MN8#ev-oqGas{b+Y{4&H96giim=q z!bT;mw7P=2z6f#FJBqL+e03ESm09J!9XeY2H5vU}^a(hfELc9hQv~@vN@sI}M0s|h zXs1et=J*d{JFGOescmlcMNIn0k$!;t7Ki56b(PTC_Y_qaA5valIDby8%UL6Mg6(wT z=OQb6zR{guS>krw<|i{PV4Tu~@tyS~ovWd~37-(pRfzV^(ad%f8dIlW-J6VzD~Ozg z`km01h*RgP%LwU`qa5UKlHR--wNCKiQA4u+kIej==XY#w8gGax`?`Cns09?m5gi&_ z-I|kEx`%vf-%(8MA4=Rvsk=}`&g-S2A3OHEn0e@`I;{t-ddFg1c&;cLI)>6!liWWn z`k-NErF`|d35{%SUU(`}pkQZAWc`rpDD?YIR+?cL*bbaEr)mGaR}~tZ{V3=$$}(!E z^!526piijx-v55T0IQcnjY{PK^{k#v6AOFO0`r!ejsB%7E2G3;S0F$rjPonO+R;8q zR$5XLmdybgn%3uNpP`gurOV1H0orCAAcyGOssLmg7UK>UKhg zF=HYXb93A0*-i2Wy5i$D(nrBIOW$#N_J)ihQ#R@c0=hxD$VfR^xi67ce4!BxjCIYs zIYmj${-36u9|{`^mM#T%T-eGSqlPkUd~vocHh>W+E01mG@Jx|WCNAUclFVS(p{(4{ zAVMb9N{dIwNUu zR-bz+kICTEA-L98IX7jfXll)}iu*>~Xz(mbWxgv+v%~WvG`Z9|{b6tKO(HiEYy15H z9<0q}Fl?f5L)NHtu*GTuJOPR*8eJFRSe#)K-yDYiO!MW~S>%>%$Hyi;)uLm71(}g& zABxrk;YJ^ zHm!L>uuX|iFb(N8hq_&?k(J*AdMlc_#iF$u(izHODLD}9Gq%c_A!b4G58hjrp8WX4;k|@jw`$;3Tz;ulA+Y{ik~kpufD2(y?ZaJg=axT zEZ{bE8_Xhj6TXekAMqP<))xkN9zgQHZyk0G>h%gxi3w;%8zd?DIZ3%;4yW3Zd34uaGlrsV-m)zbw49zh0-|T}02S(Y7IJbn5t{h#R zDz8o>==KW}d-2y>kMzxqhQ72o^;})o6spi{WxR7-zQ9|< z3Y$DtB3@OZh?Ym#zJpBXx6t zzk8?%35|yXrWGtTpH6!-Ooqvf!$#ugiydD(GuI6k2d~WK^QyY0%nwS23NHM5zadK} zrtEDTl92jt{~SNB()-ZfQ0!J^Cgx7HB1IxB0U8@`MEJ*v>z1QV$#CDFuDLa&%ah|> z^bB>bK7qZ)KY#4zw0FUr#8F>uv<#6`{dmv!yJvuxyCB*=*w^&z_0A!`{Z6e>;)U=& zgUmTwLv{1IcYA(V)RrtwG|CybKMPH3DXzCX|4agr<5}QAok`9!gN@TtqQ%L@Ht`y& z+=FKcD-Wk?(tUQmb#2jOPFBfXQgaBA55-}B>yAgqmX&BvE&2@AZF81ebH;QOp3y>$ z^aEnKppw;q+GR}X@Xvq|N7%%HPcGZ2^5`0Z9iI3BuN`HYsr7|bQv?HZ}9GkW*Ztud>u8WbP}=b{S0mhvcL34P$fvw zM3HbLVRiWrJlnHjN?>@R&PE=`5OHm7ZTT_j!}>Lmf7`r|xvH*gM$e2TFf#rbo0q6( zVMY?)VLF*M@yVAl{j3pFV-apEotJmU;NuMc^cnla&{nCEjrvI~y3-tHM$&k4hHeF{ znHySRrEGv^ve)Rs3QB7D$wLQIEJDpu@n^Dm^ZLo*V&nHa?NX2vT*k!}N_zNgVpeqUAQ9k$EA`_8@WdVL~WJjg`TrRW3%3rkA^%*?OQ%MIEYp-wT{#3|B46%K8!e^!*0L9N<9j70@BaWf2h7??}x ztkA%;8};QV#9Y?ZyQ4-iUB)HPlGnE5q%3p)ot=X4%+7Fex+4jJutatgYJG$IHCo{u zo6aW&jH>p!svKg2r2F2POnB~a`Ts-JJ4WZ#yz#J2u`4>Uk%5{^|Q%4#NGP5_OkOZ+Rv@US8~Ifcr4XqipeT$&u;$ex8>J) z48GOac?s^+#S&!JMV>^oNN$_yc~$x-`>|$c6M^wkJw*8J1SmoYIs{F3o%LDoATjFmnitc?g3$naVJQ z$}r)BH+B1>Tp4Geo{BxAbOcn$KkeTgDA8%&kTY!?}q7B~A| zS=Vi9P{O8&vU76mO_yvJh%X_P_vLoM?G+Cn2tn*E3GO-dzQ1g4dAQT6ntFE~UvF@N zq5*R^m;bqdy*%w_GSa!nqS>%#)ea2Z+cpmZs=sPuo zsUqV-8;>Uj)c^;s)qI0u1LqaHvheRMU^6`N4|F%LdYKH54>ds_6MTB4jak*v8!wIy zkfFD5Lu()Q)Gv3*VDxmzwUlxbDBv00`|mSHuY!8?E@OujifT{0j#ZdhfXO!yx^_9X z`EQe0jZ^I`XZevqo(6}8!Xyt4ixC_gvXeekA3(w2MsHbHp(Ew6IXT$3pW^Z*NJvOZ zIJ&Fm&D_r9w9?!j!bVE0EN#oB8jto34^ZM}{O`o~r^R1jb8H`9g7P@n>uYQ4P1jns zw=6+ab>*NiS^SfdL1}3FYA2VLIE9tfb#~#5!Z0M)y6X016?T6LLR%RaJ{!ZcO^k)k z-f~82448IAMj;IqBl>e=FO@%;1<@OkkJb5@|ElQM50>ZX1fs2)2TP}h1NBptFzeOc zF7mKA8|qwoL`UuSz6p*(pZwMy*O%6eNk0=6@8}JS+8WaEvC-x1g!XaCJZ$&sxjl*b zsrUKmnpt(@Jx``J5<_QIDN|QfTnDDQmUzqkx*vp>AMNeLjaZfcvzdE}_Mb@ASb6E= z_>ngobADoNg7ZgF&|gg`he5;5x-6}nuiUgsV>NdByITRPeA9ZAm#XT*>YN;LO>*y4 zSYztf1zXCwIX0nSZU^5C#`-Q86CJ0G%%p!TNaAcCu%j1`tmY-@VHebA$;bFPUH)B) z8rJ2V|6zs5n6;SPzc+}I?B|$z)TG;?_|c^7zVAD?8_2v&4hx>tFR}_he$A(#p@8ux z^0(L4H}!7{$4&)2_#5+6np28Xio=S-va`2=#a$PJ64h|9>Qvit8n-;Sk*9PA^HptJ zyFG43a!b}_Kd2?6#_b9rJhFX&jE8n|t!sLcu}Sf!}vc^<)Ij{Vl*)P@s$^< zcr^Dr%mR|L-~rJV-lNDzHn-9W<4f>UZJK7Gg8Gj%Hu z7dKY3UYz{tW$;Yklo*CgK73HP{u_E_n9So(ST(Os(Jd0rLNCrHyR~Q?9hyNd_~|B& zbblNG8!8OBmC#q2!~sJwXaOo(N?4MA9-fg>qcc{{$^N_gF=G8HlrZxDaC;h~&vLaP~5ywUN}S0KU$De9=iKkrIPIbO&8{p)dStXb0?1aKVw z0`}kwDU8D)+E8;yPr|m|1`+A3)AnkGe0)?0O!DY4WYdqwz{;z2lFSr&f zW{Pj#(%bfnbu{gXXQ!k!DFf~#r&IN%_A44Z4Z9QxdNcDX?Ia6$A)%rc5C!5^U zJpsLE%uq&eWoZfYsev9V5Opb=!SlOA9J(G#41<7RZGC-xWd#o9_4W1g0oox`OK~z( zSy>Sf=H&fCl1xcVbh}+tsMJkrxh$JHwb!B(j~2)9Cd03YxN~J`a;8glv!;5{RD4_0 z!Dj-`Q=aEwH!>C#&)-Yf3fTSyufpGYt`C}GN z%rN}Jb7Qx>lEEx!f|mgy4k;bVZSRtOfg#6q(KroBztTV5i03PymPNtSy@g6kxXNX; zN0>H-hk|aFdwZ_p)zTSgsm^3*r%_rFnO7HZ5paFqE_q)p_t)iLP0h{UR!%d}NzAo~{RlGiq{xkcKYnlnfuR0$TD z9blv=uFfw{ug=a+&vS4M89P8qT|n|=JhaB8Y|Jid#-%zAtj&-1A4wS^miYv_>p2icp>8#?ca8JXfmOtodOe6iBf%igD3@B$z&~)-tpDoo%A!cgY1k>%|}o zSc#T)BZ_cwRu&0qG(ffKVjT>MkiT?xdxj0_F`c$hZvNK;2MH$(?xR_mLD$`o&pqQr zb9-dZfp&uS%|lj?Zc{F@ijk=XKYYwRgE@%O-JJf=n9RAV3v~V3nuCy=e$K#3w-EU) zbxc-Pil?}Y!QpT+jjSH`Y@=bKzdtyW7oe)(wH`-5x3+{MyGMSzgL{Q?!Jiij*3*iu zlnt7>L!7rl_9uxD3*kX37Ad{RA`Z}Sp^37Og!K@rPG%l-uIHF1rT-5z$wd)MutU@@ zh|h+M5Z3ZB+9{}mW#=wPV--x!!0BV7soTvuOrTNuzDcX^!X}J_ApzWUEUdLr#_8kE zI!nkI&tbn39B7@ZD5zlyZd_Bnfe~1BLD!Ah!wdKJfPk0}@V0QB2fktkAC% zlT8Bkjm8rh%bdM4A0ORSFff3b%LnyYYgc{<#xlBHG#PGtg&Yh=hZGjKlT$$#=e7TA+*hO-|C1EfR70!_4Zs{pwO03i^QR1mK3td>B$d5@l6aa7G_m_od8)n9`BE(PTK!> zsSz6#6mc2+)V)qyt@V4^O>3iy29?>JHd~Nk zYojD#i?wvgOyJDeRNu5Im9H3*s!FTx#kRCHacpQ6NvA|h?D5+?{Z)j0o?hmrnjha5 zgYYkgF}!z9R5Uaqeou4{>c4TqLY0Zs~5Z!7cmXkPrYi;z4E#0R%Vzr-(Fm(6CDJ zPn_N z=G=cv11%=S`15SC28c4#pzGrPG(~;Kkyy#|Onh1hvIYjzK&;bG+pcMkzwwFb++Je( zfg#cOva+&}sksKxT1P-WU5Zs8m=M=GEI5O$U!y%)plA=R&_1xSR##VtpfEvUU|<03 zGp-aiTm}aAI}_}!+1bBf|YYSrK7P zv%82HPbzaCv|C?N0&UBDY&x`rZ$@DYeS!_?h4{;lNCVY^E9f7NWzW78uG}kf#-|Sz zFBtQwrlNKm2XDvD@9mwY>RP%Q8n^R>{@MO1&A9HU5|8uL&>iey8(2Y2fUSeShSfr; zR?efEISLcT;)E0LNU1`1gVOEF;at5?Mt-+KRBP;U@x>K7XG z=nvs#WR_u6W?xE2QZopa{#&b?*R_QcTTBFz7bL;9Wb5&sWreHG;0<-mur$plI1DPs z4}Gn)Ia$nz+dEX?cQk7vkgEh*mC06#cMlFa5X7MKc&mJGK{hu(qY8*%?5K~)U859N zU?e0eWC(I*=TX8$g%2vm)E0-(uxg)V9IIY3H>2`f6Zf{Dz{kVt@o^4br^?xE_p!bM ztc6Dab~E}yCes}`Nxa6D-<0`i3V#{mjz)c+(XHDFC9RbnStc4h@jget!R4CKB@v6l zh$gHvoUB9o@qS=eZ?{(U_9FQ1va-~oL3VO`w|loGij%c@*2CZ82GGK8oHnolB#u~@ z8=sN0B;K98dhg;sZ_&-O3;k*Vc7ai7La`MBrc8{C{@|mY@%c$}Eb>)o80_MOj7*!7 zYz}5#>O!(5e#*nGXom5fLljU7lB0W`ppu^yW&)7YIc5M0mu6OP2A8Fi70VlKEV_Be2v5uTl4!= zg7@91g2G5;b!tHap&Lk1ohYY4r{~HNa-N}HaA-=^=->)!=e0RZ=D8 z`+h7&xfgqs9{d>~zD$#UksM>Jt7W@zXs*fst7f}47)Qsu@iw5=jCjRB@P^iX-hxRM zcu&Lze#WS6ZfogZ8v4@^kZ1!Cq?XpoBiH>|Gy>QsM;4)@{dlsmzipb8wC9p7! zO<-RaN-&k~Ob`p@DL@!MoYN}1TUTY|+4S*EKl7%)d7a?3T$-zP{kb6eqA3X5XZxdXYa+*-j@Reu zJeH?8m+%R3SlLu>V-1?)RSIqw>)~O)Way8Qa`U*(7IQo(o6+?WkV{yFUl|Mcnw-YQ z#$sT&GH>#vQMb2W?$7J$>Vtm_Vord_KBtU(z?J86I9`^G;=qj@9Md=8<&6vZ?sE_A z+%hII)81uZWJP*ms@5_O1NF;zIb2u-&qp&dLCOhJ00&~VNpE_YuCA@&bf0^OfBQK) zMa;?P{=IgE{CkaA*obvxOX2HPrht-z_o9H&tr|yzz;aK&#KPol;HYojPE;1bPVc!n zQytO!{S*oNAf~;C`Z9!y)($~HKuZT(BYy;y@ucTD;mdQy$Gum4r=hpIyP{fE!PEOM z(2E$1be>!HrI_o*&(^hu4XNYc{qd@TcwCal%-q0U9H*P&VJV6AnVFsKQ+U5^L&Hh7 z(y|gGmSiP3R&H*Z$NRx%fM*1}y$7=xwj-VKMSI($nY&&VVi=*aiqe|C*kd;dxjGGY znycK}cdaH;vOq4+=4K$=Js=RB7D!H#kdlJM^}lv>1e~P+rxP#N3&=B_A1$uut4%&F zB_(w2hb{os59|u^#xUYLC)2}q{D?riK!qw`8R+NdhxYR{VFM4kgnj?-WBo)2&uN@a zhdm z^zJ?X?@NTbrzTqkK87PJ{`qqQYbq%v5lYAhEjc|s4bWqM|7<=#C?IBHVx)8(@6IlD zz7LR42mcw+@yNw=g7m*tV45CbZ)ix$!ZJNNO3%m`HRNrOx%k5x+!Ti-X$crkvx$s3 zMkyT~0=Cm)S~>_ajh^VF!$WCV*>hW4m}o+j-#_{Av9Ylmx3~PXN&y&gry1$-_y0y% zgNh8FfZ*=xN&-N*5Z=(b4&nvpexg3HPpxNg}7!dfc1C_+gBioTj4dEux8OCYD)i(!J$KncTV% zpoW+_qU)l$sK^pNnyF60#t}KHYof`;QzGz#9P@XVZ(lwz=c`or*Ku|7FL?_G5a8{l zZ|<%X6cl+}Zx4m1xm{)SSsaGA<@p!1|bCdabKA+!6xY) z{wS0xgQdrsww$%#!}k3W{P__3*sX<=0{NW(n6OldUDz-f!5(WCumIk39m@!`Np9ZU z+^lQ{pGW_yx5L+hu~F@`^pN0S;>?u>TY#!R9!6GLV>bR@CyD_IFulTHVF?KdAJrOk zIR>HiVD!EI%>4dQW5zTb*^UQA ziv&GAyfB<;!OuFn*OzGz4(^&c2+BMbD~-t!}m03z~_WyX?TsG0`Fr9@5D=jJe5= z(BFw#xt}^&RCnFwUW~O{a(_3yi+8wgc-Uq5QmsLO(}mt8xvZI_KSnQ;Xtq+H>Jm#E zd0A`3+TK~7w{xNsjD&&y^DiDF*2zMnH)jV|wUyebu6XtvCix6$^noURKEj%n-UqT~ z_TulYdH?Y{Wj}$_W8KGFrWdxQ3yJx`Kq??-uV0jH+YcnvXXCMv2iFJ4_4 zWoMV==Mg4g$?qME=hW5B4NWQBZVK6JP*D|}pPT3`bo|)I2Gr?%`ndA%V|m+l+TrbO zOE|NLX6zvn_5hz z(@jFgSHy;N{0oSO3U~=vm`?dA7OGCCAILqCv9!F1O(~5ncF*X|2O?*D zj^>j2y9}Kyg7SQ9TWb@;2WX2%tFPw+5+bWwjb~&a#AgS=Z+9J<_iE zzNii*gswZU|0?~{jTpH(&c~w~oBK)lwEkC?#*&h)SVF2x!KlN)ph}UiP!KDSFrL{) z3tTAXVR({%5t_+UCY>%+y6WuWkmTgNggQ;tA9nFzwv;xCzAFZNaCs$hxpx()x!RWulJOT>h@QR})qT zyHsVn=4+P87NwlEPkm#;NZ+jh2^k<~;P{UKQx4NC!elnaa^77J9UvF0BMtssb_q}p zK>9Y?-jeR!=1=tee7Oppn$ifbX{M6u4ZCH*ROj?}nO)4jO(h4DS-#UC5tChdY2hWR z3MQ_{OlP=`Rop351{IA??G0f~b3wYEpY&F4vP&OQg8rGWFLG&Ws_abNLQ_D6eJI;t zj9peqvL;un>aZs(Si#cir1ESmyCNqfMbZh)30r1=61&XJf1Y319-dlN8mGiiiHxj- zqTDUdVJWii>{wRi;Fx+$i5@Z}JyG>3&+hGsMNu$zUd|Y~(0b58grCgVY0(++G#6u5 z3cC0Bf3MdG{dSvi*meMNoGBykaP&Pq=_$n|3F#rkNu#&S9JEOtv`H@{G`rTd*@+pf zjUqXQu2`T>6)rlW+<#CEdDK(fXF0mvmnBWeC4i&4gm>h?M|26(UKSn2`zLteGi-c& zdy_CHpur7d`A;Nk+VV=pl1lYgrH35lQXsP>lwZ_Z)?TILPelhRW>Bb5*S-T~{~!i3 zPPm}TFa7_HY>>%-;^cMjZaHsd$zguXalC%o(R45E3vP(=Il%%rN1->AIsAdmNu~vn zcd8htVn*kprTuuy06COG==1Z%puqNIvsxWLE52ZZZ>{gkXeuo%j$vM-o6u4etQ;w< zG=-F5BDGw&Oyvs}bY~s+7uHDip5 z%LzE3#(Mr2VNaN(ltD6=FE_wrp1b*I8vi2FdgZv76DaU&rS+qR@$ph|Y5>!u_=wD; z^`iFL%LY{ zW!I%czP@|-+~-M;keDnDYyQW>lovxb<6bZlFW3_kMm1!}KT&m)waz5g+65=FG+(*Q z8KtRmP|jiW0W9d!20FzOe`?_qZZKf;2VxfzV-?<`A zuTIGj#CwZ-bBpsjAzbjB6K{sXMgO-@Vo=&KflaSftX2VtAPQ?PV$z59{rn`G@pxP4 zk?bse*d%3Q;4G{(tZI@`(hEx zKryAEpT-1(86s*lLv0P49toK!)av}dd97v}SQMGV@%!umjhB(UOnZocBU)>sk5jXs zbBVHkEaL_8$Q#w#;w3qxZ2zh(0mkMaZrMz<6QX5`C5yknXL}EaBsDy;0#bKy^Ru<{ zc@#uB={oVX`b1p1K2H=-eoF}`Na!*q5; zpVq^9zm4CauR<)juI9z`uW45niH~84D`TM?nt11A4_hDJBy<+Ix?YrO;qI0>7d50|2>Xxeqm~oTgJy@!VnV>lJfgJ z&kj$c(uRI}c?kaUN6EY$x@G&FslqvY6JFs-N^<6idS-e=f z%|wtZyY`|3R1IHdc`!ZD%-h^7MtQYhz@_9f_vF#k)b#XJ=Mz9M#^3f!1tTwh?kq>1 zq_Uvd3RYj&*498{rS|uf7*9&r4N2+0)^aqE&R^DLRgFN1J&gHVnJ!0~01r27bhlTV zObrJJyeWUbRGv&0mIpUjvR#7vKmSnqP zvW+&vdp5sQ$L*-IZKDVE?N=WvqoxOC!dXK?R0sSx_bo)X9f^zmNzaPa)MMcSJb8VA@D)+?5$V)xg}s3 zk?#5TF?$4%GuD(4&l|_xMkeUOp5_!J-k(B}(Fb6E8)_E^J#GJI1`{cT56k*)USMHv zU!jEZM$9P8NO^oGcr!~ErB z=4e`)C=BDH`KYQ^-G6ZG+by<8;4U+@%!q#Ron5>S(yvx{ZGln=dc&=4d!80IBkG{Zc&-p4lAUxb{wkJEk{IwGesGxjfdB~F+M7FDNycSAJcGs zGr713y)dgEn4Fvp*eB=Zi5@Ig*=RKYMT(4zI+Vx)5e*Fu(Bf%v*agp%%S1&-6Y+XF zKa}eLf$INBns?IB(FjGxrTqnu1601*K=QDJn;MqPr?g2JNY*Lr)_3IoQKlv@|F0y6 zjEn*z`9=h#f{Kns*!=kGet{g;?g4A^XnsB=SNi4!pm(#du#j?e1nCh43d%}M@;QRP zDvD`(sv>_DuU-Tw-p^N@;-sV#sHar}{o`(9$Ch(}S^e9WHs-pyjCtOkZalL11VqyZ(=d;om zz47aU!0bLRkn6Ch(8^LWd}s*Aiw#wx_s=X`wjhYfX-C4 z5VBLzmXB}p5<2zWR70lSn%y>$-qpS!nZ7-?XfJ8H7(o>+^AN4%qt&vtCbLS{|E_I} z5F{`4&%C6hL^PrZG8--uHE-`LBDh~QSZ&=D2fS?YJr1mFI{sk#N`QhswxUIU{#;jS zogT$#HkeBG@SQ0C)k49L&d(=Hu>R6#mRal`AC0)@F7aNgw%*y__i~%{u)db>$Q>|p zD&x#^{owYH;@Q}@5M>lOm7t7O#E^NmT5_@ruZ;jRf%hNSf}_tx!N(IwFAby$x7V;f zXL~{PLGDWN?_cq4^LoREM5be_IY{w8CIQL0|Ydea+2$dFH%= zye{(EEx?I`B)6deiV~>rBw2tyYj6-+h7mxP?NC3b$AMo%a%!qxhwoeW(+%zLFeWBu zJfJ(FWxpGW+ku3%*VVbYylnK=kW*8OS|Bj}oFauNq#XD?w_9S4JK!e}&Zxp-kCsKg z?)Q@mdK#4SNhNl371*9ClQ2eQIq%^DN@yIyjn(@hj1btLqSr&eZ$N0#cNj7E<6X(Z zU;yYfK$U^Bq_ANqi@0@80zdJ8h7&cz7FXV)& zCEy_wTy-l1RULqdhdN*Xk%Vgf14!FIRzp`$Cn7+SDO9#JHKj~*ac{izQD`I%=+xkb zwn`QoB(0t2oMn%0T`h1J9oi}np3WDdRgz~=f=bnF;T0Pw%sEqe;?}SzDzZ4zcyf7r zjWsI>)})1%(rl&zhgpqdjg3nW$7t<;;YLzQ zfQ6*WhNujvLU_ZaCS?S6w9@drYeUI3de8KIMf)Wo(TIgHw-$-Oy{N&CZ~W(+{BHC1 zA&XKkSpWH0G(7PDP|c?L5Ir}a+#+R}`L-HeIX%+FPMLKft%hIjK#y7hYy@I9v`Y}X*4x9axJdl;o$&V z)mHM3!;cY`?pXDKxD>tCn?01An}>y2K_eKho~EHhbb;CM6UuE0e--NvwVS^$0aI6L zBgckBC7$yLi1qQ5X>0FOuHloGV5wS16{K&;gMuKR+gd#w-Dhetn}z82y8|?Xy7X3y zUSVRg)yJ5ZVy2Szo1LMg`mer&iuRPxxU^CuS|Rh51zph5c-ZEJCE}u@b@lZ?;dE^^ zUtU?+y4WTEpo2q)h0sPo(iYIs(E$|AG046@mi@YXIWGL@BS*2%(s7S6ym3fxWn|%F zC3lpk!6Vt;pTne*b6Jn*5mS47DGVL-ryi%E0wa-MVOHUM|NDtVh>nH^m~TWzMD%77 zJv=-B@@l+O1T*uHAvdj_bHmfumBEmx=vb~PE2n*V38xJ!JsT@8pYi=7p zbUWx8O1gM^=H*-0=GdmJLn27&Cb#9}b&-xM+ocSn6nzxE@#qu1bxuPf9=63=?Ol)a zT>q-w_7#u#n-(J4UzWf7qI)f64@=5S4U;s7^bkn6PXB!p`@o#viIm2RX7hN!>iIY9 zYwHu!{gol$KP!^+0TV<`auHK_L$iPDFTAor3kFDAC~yH0_B|}xnTPodR177c(aYl? zGSHe?>Lhz;&;q44e;zdh0_!-GiRx`Z$WkU8lTpm2(L%iY9QUT_dQJB(vR+82_d7tJ zQHEl0DWuKK`xQX_8lEoRP#5GdB6QBkh;_FujQ10Z1cT%}pSKqkY`gw)29Iy9hq86s$-HF#*%(}AYsCULP-lsK!tAPgG zCb0uUI};ZZZQknXB@V*}sX%E&8J3XjLJ4$YqNOcv%gJe|Kw5rY z;{$wkQc_a^j~^1ziGYQ^9ha-y%Qf)9qLFQ z+u!lmRUk_FK2Rx4yoiG9s*7jG<*y=9PPMAV2T`|D*60b1@kXl67Bnl8Ms_?J7W5{5 z)ZIDDpv~hURDBWPR8^gvD!YgKGAdz)&lw zc&u#BX9-j=eA+!_$2QXDdMFrL14uD>Oje`r=9sMu? zi@j?3q`^)9`SaK#ERkLK?;m(wgg@A8Fmj_NSo(JkUt~P#w9aSD``g>Vz(Bx&tkXLb zhFj$R3;96`Xw|kt1z)jk^Uk4*W(|uq`?7(sQ6s=XDzyH-=#JcF8Zyx*{IDTB*tn2u3 zAHyv|z;J#PbN}Hfmi+}3&Q^b5&$+Mnit)?F#>Zui4sWk)=G43D5Pwc|=U$~4VI%(f z)4G?sUMf;Yoa#+c;Nt1;)spKCU;2}b`G^kH)!1Ff*TbxvDtRM&^PP0gU+r(#aY&Wu zsIoY9=_*zAe~3CpMz%)My-r!&nM_B6Whi^*+}NX25{bWeG&l29(jkT@sjAk;plrL~ zD}%7cGXXoYkoo@_8XlHd&HTZ>Ws&v(Hm@w*3+M)9y+{SmnXPxSIrw{A*>JRHwY%1`+G1|i{1OfruN(u`Sm_JURZ?MU zazZ-wppACG>kIH!W-V+4dz{eH+MfqhYq~qg5atcbtqS>@G zd>?*(=#X&F$FDYBz;wODGq$zWRndUK(Cf|-M}~&!0?T?1@CF*HQS^p^#Ffl``l$Gb z@0NtzU9^- z+|*J4bu9lVlrL{+WaxUn_!R-nIIw~s9B+%>Z=x$%-{V|c)zs9%;R;CI2CPm1^R><% z#Z11c>RNbM_|l59$msBynYli@xbb0wa!ht%+?II}*BghIL)=nUDLJ9A4{o@Un{y$g za2R~dbY+aQT|*-alf0@OUJa#aFVQCw%9eKbiw?m@(YaCjT<5gaB$qx3tzQp?z?CD) zzkIH45)-kEg8B53v!jtSLJ?=xm#7Ts{dkwtdZ`kGTi#V|!g##;2ll1{`Pf%4=J3BkT1$%Ni;26e|--vA5jrQit7v5pX zpF+wxa0e4R3}2G?46L;k6~SEQ+X|@>TwGr3z7P6=tk7lt_H1=;WDr_w)FedJqRg(3 zV?6uLheaTdf4yYj;_U9}xnlmW_KK`{7T_dBMC-x+-5iZ!Pd3Eu?CB_xz^fhfz|TCR)u(N_bcS}FS?F#= z##p_$H~xpn`?||b&~~HF=ViRjE1q5_?)l#(TV5kAQEiy5H8gkm9%w*JVQ8I>jqkQO z{`dV;?{ACN$Rdbj~t(}yn)S7LuQL`wVxe%Szz}h*PQrr2?V5pOj4v(*Kq0~3 z-feY5cf?lWGq_m&I{n`F`A8RUV^%C;KI7eCz0-WB4C0_;>2`=JGi|&O ze}{#2Lg$ayhYmZa!YevcTlv{MQ$*26<4L6C8|eMH62v?ol9qyFT=CFH)UG-u;00>h zu>$N8aYzj7jEyf(szFa!=UY9iHD*ou`E)T=%nRNAsVT#GGtzW)SQqTifS02VP=NT#PDzs@>ahEBihIKfqP`x%fqjx zvcTqsa6OjDJ-0BeuB4+9-IgPPo!RM+^Y<#Fzd2=j`5XrF9z9m-(6)Rpue8|egmlyH zzIv&)YW;p)fhCTU7B^^eWoAVXl5)sE24(rUl5qYPzt0+f4mpo6QZ4K1;7_G~4l{@x zLed1l*AEy2)9c7f&W^46>veZ+2Dm$1h^{?8YU=Oyj<9%<-^!nttnW8F{{wIY0W~fb z##yUdb`wX(>-#b-dxvl0_Vdg-+K+EvB%lwzX%qUfOWpKqC9N;dzuu%n4 zRxo=Z=BRNs_FV#dwrcC^yRTFfl~+6Lh~`1+%Fd$xBGCXEwC(>0-%cZ>{fK^5n6FmZzam8N2<*{Mg-Z~7CHB@rW z^=y{`>+&pG{T~Y)az6#%b^|a;@9vt~A|fu!{KgC#6qd(pGh&Mq{*)#Jc9iRso0lr| z(rw$YbiclO+t{1|js$ZH6-S7pkRd%=lylLBV&*Zn_yFs|+o$~~G~)6spvxdedJ;a}bn2mq@6z)$00AZhzv4Uq8ROf5at4=e|AffcZd<7RV?6 zNAG2FsKYqXIF_FKw1|2l2?b{;3S}fEffXO63PYZJj(y>Cj75zFe^Cb6BkF7G|MMXE zMfSUm`94z0CQv2ARLe#_`tq$HhbSqe+{0>N8G$>qn;)hD88%7WSnWwAS{Z8Ji_qZw zVDVfL#61KHcepO>|MRrVTnFu4=k~!Oz9+57GjL0XiP`9dVo~SJ_f3uXwdd)QQvlmP z&3Vu{Y0FnHq1L4+*DUb#+Pp`H!&5V7{sdz`O~@>PLCChi&n{fGcy|j2Lz&S&Z7-Cq z4_#M6$-$2W{Zx>fz}ACO8) z+eL)8hk~k_K<@9qK1u(0L^=mzq@e?QwAT+8?Xa09pi@I=!u0(n!FM(OE!4bwNE=*$ zubmnU*iB#vf4kb4!2FK@QLfFM7a$`oK2~y-78lX3iRlbkN;ctgKYCR^87~>*fbNSw zw+9%2JUk)L)82A>qUZGSl=*ar2<}USfb$g6O_a)#@{VJ z$^N4df)5y1^T*SU2@FlXa~VtQkTg3?L=5M0i!a*?E6^0=j|W>paMIWY>T69lTRfnS zt-N?(X4eJu?A=biq_w1BSYenHn`~a(t)Gb8lDwa)094&7VNK1(>gtIxIdw|PMTBY2 z*gEVj@F0`;#k-4w8`0ZL!*snLfD)hT=H0W3tc@g&T>`{^K%aiShC2V6|J=H;^-`4m(TBbOWS`>8C~zWu9NNSO$LFK&V1$ z>apk~R4JBjjk2Z!gX;g0J{-_7oHeGzrpoKrJXavrOa8Dy4=dGzWrfPn+t1vsuy4Mn zY$Cwi5xY9LNv~rRfeg)#fFQcJmjw7OVdgdFHrAGcD=TVhM?hgez+=4@fVS700_Jk;sI8d0Z!xzy3F9ZVy$0$Z{{yWtt+OY2CGWoj&gO{rrqU}M60Weho$`+5#P|QNv#$(_Blz}B2<`+69^4_gLxAA! z?(Xig!2$#i?hq_E1oz4tUr;kn&_H#G!8gQlD%&8^5QHb>9xMz8;QjO9tT zg>%Xw-oy9hkIZ5)A(&HSc`7C3I@G0$g{hyV^J?+!w}P=`Wn__w@++dpWT~Z5?tv08 zp!j|6Ce=>zFK(rj(x2X6u5CWY5)qGCbXI7!^B}U0AoB1M?Gu16us#6FebM#xwFxRN zE^O+&p$Q2PL{m*It#Ud>@w)c}V7-4Z9>NdAyYR3~8ye5!09@#s#1c@sN4K-)<>kG* zfAID3Ws$<1y`Q0mgM<5|0wgh5K&q5JqyL4;wxp5u+~S7?fCAe21Dic zL#TcX@e`Ld=Me4QrByYuc_hf^|x_|TRpBah>Za)>4d{mKLN>>GbUT>TEco!{UA)5fudXu&j{ z9XvbO>NewF3H5hSO#FCW>U(R_OgkbiOCh_YI}99HBDqXdB1ysy*xSJUgkseLMYdU4B#d#BGre^AkQ z9yzM?iE<};?n@5-tL5bInfoyp?N-%wrxAKY4ocbKarWOz1zy@m9{SX=hm0-CP3wn# z4YQkNU%f$XwM$jLTIz8b=>KNaU=XEj+{ahOsFdYk$BVEuSdkL9RU+q4l!mgDmoE4o`_m)YyH=r9Kw zBWXcHB)2S7wk1Waq&ZZ~&4w#gO6JzUUQthH69M00#8cp6Tx6H2fP&(5ql1X#m9E6) zYjfX(l8oZQ++3dkdON15rm_-l$KLaF0x*ZT>#=BZwF0%aRo}Y!ZnecapPaCVum6yV z-oqh7crI5OIKU2-7g11qOe8clEvcsV$(dfhxlfsGA_A%{1M1fuZnmiuWf|vt7&R zq)Ll=T~u7vf1i?+5pX`W|9YV$zzo$mZ>^p}Jh>Ir0Nt%hh0oR3)bq1o$O)u2FT#v> z_Yx8+*Nv5Z)MOSc4}RiW?*>6WQtDfMBj`=vNk6ANmq?U|GCJ1ZY z(YWMzV4=ow)JnO|_u`K9;W1W}YAwI*M~}J0A4A=}JryEgg9>yoFV=qnc^jQ*@^!)F ze4wjYzIJ+TlbP8H1&SC0JY@Df!ntbd1m52Jelwo_jApK@?O#Cbmomp&uEPhXnyF)P zOT32x&qud6fAw^9viK>lU!17g$>!Nx)&@SUlZZSU6E20(`i}z#n6#jpfA#HBI>yzN zC4ED3&6E`6iwkd7;eX+ds1LChp;zNj9XROY`jC|Zs7@d5bNl?9AfjbNyTpm|cGjce zSM7auv!tB4Cf(xhWHo)U)9anzX;`WV0>Nk-n>KjUQ}0yZ_57qt2G0L>$Otp!KJR$< zyn&W^9!7RXcT-am3@7gGO)TMu4-n<(EBk1z(SyEwIb?!s%r;%rW_yuGOjYqoS=q1n z+sON$RwqGA`9!m`IVOHvw~v#SF&9=QS5&RGqxLf$%N!kTd~3tzLIjlf*aQ|R2yqdI z4<)f9BJI`q+>bg^5<@C7I&6=3Trm$XBcK2AqGH^+7n4%)@L?qS8&2Lmp=aB3msZ#Q zEVeLqrMx}E;TA)3aRGY9S65d#xEFWlX3om(BK$x_GXl*tG_{o_64?CaOv#qt3aFQ> zwatT~`qR707vZ^khELf=o>{w|wxcF}jzt2h%Q8jmYN$rK)kkjL21)*nX~3U%^;?^G z^c7PJPP`Eoe6S>d*irXrxQ;^%Hct{nZV_L{dcNr8K-1q1zGE0}e<<8~Fkwbnyz*pe zIXu;|F@(?blwB6iS48sEb1S@@KFI~0_oo^;rm`W@4+MXR_I=&)YunK;_={)@)-}b9U;UdY4TUgTH$n1$vB`~8}Sj4lu=G{c%4X+-hTF4PW^?sW= zz=z>2#RqLrpean` zSvAeW4oBDHOmBNCA6F)xI5hf<%QWNzd6K8|@pho$|LtONd68 zKn?E;6*nvaT{{07z0vkEyr~9|3xEp+PM1m@33Y}*lH-Tt?(@$tsdYMLy?yO}3TRTH z^XM)JzuU7NAh?|B8ju*uqh@zkv-s(tN)gB9-w-Rx+%@iQ+KoY?ZG)mF`@QpC46^5g z*XMn*mxtlh@3A~6Tdj7@Gz+?iQfYON5}_aax$)k&RJLX($Mzb@oSgHZ<=>ZQ>1sjA zcZ+~&-+K`Qah_MJ>?ktxt7vE7Fyp9gn1|J4L8d=IGQY5)Y!>r7-K_GSJ~D2GA(PZ6 z!}>s50Itv1xCbq(8^g5WiV&?IE^Wj44w3S54eRlI%o~WSV;* zlXRjf_3>_SJRGX9DP#!qK1!Wm=fV6+X4!n1LVTJ9+dPyt%RT(0t)A)qSrn10)vwH} zQv-%+h&^Epso#U!8lu4Iq4W@`tAE7$-rw>__J?~A6|t?=X@KUAI3vVilN1e8U(Cf! z5!9)$Sn$>BXVS)uNDU-Y?fg!LE6t+oh$ut=vR<+BW;x({_%r+Y+4MG(ND*{*Z4J_; z)|#W%4MOhvFod`d2OJkIm?Z&-$3(4JWE|N}i>MwZk&A-i%b%C$c;*eTU5a^O5k_QG z6u@3Y0<2U8_;ZZPCqk8P`%H6(pq(29AKm(xi<#%H2FY+ydoF9_cB|^krEZ>e4tzyC zYK{iLn=c20*{a*N;YD5@w-dDATTRy0PrukCojWGHu2xmhGy6$D9C-ykUWV1AP?04Y z{6tvGb+y3-!?%5TX*Q6M)74df7~OonNsVe^pyk!Kz2(^F2oHR+E~(FItO%WB&3#$5 ztlJGrCmSUlxvHD_Q8SWLh?<08Yd?=sP8u|7BWqGqURz)B<4%d}>7?t$C(8B<=^E6 z9cHT>=2v*m9DqMs@!nt9X!ta}KNjXmj3xjB*pnGeK|-dFS7{3qCwn$e!(qlX1WE%r zzZOcjDMzI>%&^C5jY3vh~{Z)ZL?MTmxwG7QRg4NlOlYdsgSYMfLD{4wX{C_{paI z`#O}dOc(^_IL_5cxy#Qq_RtC^>d-f2z$lW54Cc;IY2HL(N!H&XZ3kS63o16v+ zJzXQoq*D09_9dZ+Kn3kd4Wc#b0w!UiadU17*DV5@BE9Yr1> zP4aIPpeg=1!4N>JUOJ*LBUZVY*imKdQ5pgL++GhY0?+I)cW!u&UF%GKX^jdxs6|O{ zFZ()UbP{m29?(c1ASO9P2r_kIXmi+aL73VYm;HV*{q)r3xjZ-@6xpLXaPf?Gg@)=B zgk(Au@k~A_vgAY2{F5ZpKH`)5v?ibJo=MSD*Z|ttv(7QHRq5@<<0!3>|K&Q*rau4+ zL5Q|DU8!lFOfPfcYZlj>oMRPYY;k|k4n0Su%o^$Pd`SBh_+f+6 z%48sYN2|4(ZjKHSpd*yOM>)U%Pa5J5A#Q4GbI#luyWB9NAo0aj1YTTauTX!MtA?BPI()F?CvjkjNVsY`?w{HO>Bmeq;7h!}@cn8kn5qL6!9_hk}+d-it7f3OM~*NlgO&TX|e{d&O)S_|ZNKCM1_vPSZ#CxGKHP zzb&fRR$D)sPwk8D_EC!@r0U7}2)N7`<2$+ir} z%*SED@||d}#W^q3t45xt`bJb!H!1#1Mm_kmLBHeas>9YsVG1ZbwoiS*la8gY<#YkU zTPuv0od~7pn!HPrmafv$(psrI4H5Kkwi(swxph?oO{0{{V;xONhBKzF;@nrnq&YQ% zr0lmx`noEbnwyIo8_S#Ps`Kp9xa~%4(*_3d>9N#u0lJ#AlvjU~`iX6r%Z~_iTu7&B zkqpov4&t0E(pnlahMw@OHkv+AOFtRa%u!3<##mAqn4r*&5h6bMXO{>~^I|`qNM8yqATzeUR0YrU( z-!9PTAW#G9YW_vHv`_AG4)9Mta{^7HJDaO(=^g1+20a`1osxG4| zI=d!&vCB03A|%YPW%}PwN5&YG2e8`ZV^D>EM{9;?9%>)5OQpQkgK1l7@`8%3v{_BE zioE*2ZU{+drsl>qVRgemH@o7j=*EVIBA)xByc^H(Q((r0heVa6N}7K~^qck%42VVi z?GA}Y>I>Rrsj3nZYG2Lzz~s9*`w9OY8j=JYoCT^6SNT?S#=g*&AvZBz2Q@7PH}LNI zH~f5iKT9?{$}8fwMUc58jzS>{p0rCODr>gspV*ZN+)Y=*ixUbG?~?US=GT2ovVRT^ z-y2F`lmNj{@(s4~aT!1GuI-oOZ4x>&z80$qVJmHN1_ zo4H=tA8{}cQe9=jcu;pc=X%0l%zm6^2DEByGCB?8dl>!z^cQf>@XvgKZA-}I$n)K6 zZ=0C3hFs}lsT8`zZ@$aT?OZ=QoHc2Ed3*B6$nRpXPX`~L!Z1I5YG*^JtMc`Zj*AIO z)X~!m0gK8DT1C9!w=%&Z!v~D=Qj(J9=0b(2Ll&$Kv7@*0@+iYGLMRRE>+Br*A3@5x ziP`m?_Zv(x6wQ2mXia@Oxgsn$qWel#Qw8etM)wbR3QN1Ry z^~noYjp`7Hg`lGBc!fO~X1lu50iB|pe5k!D1AioE`->%Zn=QMyiH?p1No5!Y>(J|o z+q7BLi;~@n)Kn_d9srGL?f!{v=Fr&QB(=ZLTRf4&8BUq|e8ak0v3+p7u`MSh@*;ok zs$=74WtCoX$~rPAl>44H)IGH~TzK|kFe_Sy6m|OXG4A2T8>2j9b$}rw7et$1c^@{{ zu>Dfp3Oo7^bT7*KGcZl>#LGH7TJ|$rY7*2>ep_6FjOlGS8zNv+wl+i_YzEM2$px2_XQ@1xQKjiycgna@$O+;&MH;ngE|8NMGkG1 z^&WLCEo{W46TttE0?x;$y#c`n9Nw6s3CKB($$DQQ0{+l2q~PclKB|4@bPRQCz~thN zNAHg&fHDma_rVZc;+lj}I^q9oz{%yt z20diHCi6Yl_}PEDUYK47y-v_1NKhtFpuV1ix}Jyme@A~>@b3M)U%5%zIXjl$SZt*3 z2P$!~77dh;==bnA=V*fRTx%JqVXxCT;H|^y#3{(jPfHi9H=&8#%glmZ$P?r(Dhj&* z8&&q6>o6d2>*>d5>dmdKtS!tguJC;8n)^fS$S^uN3h2A^<`7&?Xs+x!dr7HH(ls{m z+5_Gb;&M>BmoM4;3$xS9LV~h@-8sY9DC1bQwT+V_LDo;U7IiTxJ*!2!uu&RpUw*yMJ6vzinF0&fhtn;<&k zN<<#e2&NQlDzB`ZpPdiG^k-Q*oISSR@O@iQFl*2yLFF&0IuGTNPtt6%8-qO7;t z@%gEDF9zqc?BT&YPvK43QTVPY1XOtZLIAnNt>#ifi`(FMbPu;NCa5k@-04ueaP>P$ z97GtYI&!>k`yp|bdc z)i4QbTWb~oG9I7wJHm;dI3NF2aTfJw(dP{j1>%8o-eCX<5T8uafu$eF$`XO0W!B`h z`E3`NK>JKg&P2U#Ut0jM{=~$D_bg^wTH4>!Q&IwgZly&)6EGsLqA;|}{jFT6di+y- zv$woFYBIxGT&|>p5010rBEHe_awl2UTQGz2{EeffqvkGdOl7V=!fe~E(|V;lTN^Ub z_t*5xReY;19Lc)+{=Nj6lB;V5sJCjxlFg#V9CX(Q-B_g%M&Du~eJm^T$5duX@Wc;a*t*aWF_mTiH?)-mcZ@UJ@S20I7wT(G!b_n+ z=h?S)4-t_e6I1`E3&^NUO+t1j0U(|7)#b^vP{_w3|%uyK%UO-;zrgIL-PDHRZ*CXK+ zZ`7@XzG~lMtD^9GD;@CJ?-`pp%4irK7TjI64|GegeV(UyW*0`M#9i-CsyJJ16arTiwR@UU+iI`k$c zO=4nyq`*vJ{)9wCB*!NJpzM^RZerdCt{;{{{4Ek1T38*45n10#ehr;WC{+_n(@3c- zyj7!74c{@)s}t!U1<=@u3RWQSc0Kr0 zvKsAJ#FhAlJ*Ip23IhL&%-gHP2N@PKvj23%$bPz6bE@~i*Z6Kn;I&qcqdl8bCnv!0 zCS;OJ|DxTU`-Hna!$2aRV>yP+$}{jB^cb@PKZL^{HJWyaBK&gh_oFdA40eeA;QL7I ziK-&KyrkOq4!li74DBy-Xur#!a6KbQ`MnA%Dwz6L_oD{_tMO=3`^hCffbL2rA=R{; zDmGE1Rwk5!R5b7d-_XR{-~XA9__7Unx7xb_)@VP2gU=wBOfqsZ-CVqBkMPw}Kr&1% zuc%lo?BhDoBL?gWRWRVWuu-n|+6WYyZW=I*qMqE*VKSqKhllgTB{t;(YPPr%6;;_{ zIpYF@ue;CJdFB}7LZut6~;QnRR zOxCuw+jXVh@m+5>`*5jcE{RK^df(s9YSz+^kgN!em%bZ+jBF*ZjLl2+SNm7`*Y_JI zFe2PEr`Z(cQ?XRh!wR(h|Ljz~KfMjQjT^R96x5k-Wpu~Y;EiM56;hXHC$gSWUo_BJ((%f{*)J4H`&!{-hFr3!YnpUDHTg1gdB?q!e3NzaNyFI zKLb!tgaAI~**}0hk(#xN9ER@GC+B;pXtfBCRdR3nqECQ<6Y#fh-%6Bn|B=M3tnl&i zy#V>&=;(N(O(i9J^*jjBbDa9M7+;;xwc_RxLH;4nN`dnSk;AHee_5YmLk`fh7I8-h zlAsUv3)+5F$vulA{!KnSd8YX3!b2a90=-wwZ>`A0|4bN&JW-k5^E!R_u3Xf$efqA= z-n6DRc0lhp3*C!Ls?QpSR?B4PqxY=kIFSvB4~CM=>FeniUMM`Bx-yfcpT$(d^QPl^ zJ&EgsYe^5>W_uu^S3CcPDws?pH^M#nxhq#GRNcc(M#v|2WwrC=5?`Pu8FO*2MP(Sw zo|Xvq1-o#*-8EcRSYIN~kiN&iy*|ex%&|2K zigwN}rJjGdy%+G}+aze8RRqV}M|+D0H4 zuF>4mf_C|^XwM0x544NE)iRoLBlAP_^93A}HMz?xaAx5A#R zSgBCA)o>^Bc=ml>DIInAqPmoHReM$EU^RaZG8K}79Y?`|6yAE?oMozCmVoepi7)8sJqt(sT^`nEG9l$0n+Op`LN0Of#8?*1MZtIW*-XuqI zp=`Bb^(D!^IJ{T}ot)rGApZ-_O003#89tR7rP;DA(mWmLre})psyTu8p3tZLx>ULR zjSYzavA{36IDgLm3}h0-i%!RA@wyd$^sbd@b_$ZmT7Fq>pRQ_lxU?NnJeCy zy8=KX*eH>u6^cKtd>;HV8ghWB7FV?j44FYJevfdF5TyY#8j@&Dt*wXc7IBmpRX05q zUIuq2@=Ol~pr^qr|Fj(SgFgki5iKgj10H+cZY~7EFh{5Vx4C92W(wF(PJA6|7@I!? zt2+zf@ZlhViCJj<1c|By&yJ|l;KJX$GO$KUAd{gE#sN5@%>pzje15b;X%FWU3Qc;; z1zYYv4v0hK04zb!N@5ZbDEr!x@~IkX!Xq&HrvUwT%6FB- zvv_L1?*8EZQO}D-KSrTqx4J6H#s8&IE;FxeASNcrtX^>Y?UZ>?JueJ-e2Vf~YS*^5 z{^PIgM5N(SHr$AJY%cExUW3_iFi}$69`RSir;?J&_gHZXH-BL`G(fJZV9OEzqI_N8 z?o`IC|K4hCFe-zx7tnI_`y=zQ!;$Bag{Msr{6l|i6d*aaWf)Jan^>e)wCAvAtYxJ) z3FISp=b>M3&LO9xQ@e0oq3WI|o-sHtx50ik9r4Ix+O?8cd;A`}9?CT+_)peiltdgu zgmBVCYh;20Y3pzpx_`EwzbSk(9@9M0oG)a+OLaN1A^SJCws*F1b|JSX>nM)(&7RPe zBDZ60IXRR<1_q|N#YKF4>`V)ray)a7tH0BL+vpQXwH7*1OG4L{qiw*>z)~)c{iJ!5 zMo>|dyn<|#pZsY8=jHe5jIwqTjVpGc0~L=LQ36@3U|yBeN1o3sc(N#A9lsaDjfG6) z$eF!SD?~)xeg3?>?R^6UlyX=H8{xhxiN8ai(Nxm7oqkL)%Y`u(6{^qqUW#n}6RERY zLs$b{>r;3cx=y|BpNFlWo_HPe2tjCUSVz-T1>4>dotgXTJZfSuEDEPJ=htt0Esbss zySm*pc~+qjT-~O%Il=*DRmGmhuYvw&W%$&!AqX1k>VRf1cMnp?KRH2}B!%SkhBT52 zes7>9hHFDApf6w?1azALjXYBgQy}QMK~n+M;|e77@Y&7H+>2cqclWE1r6v5Lr4P}x zN;!a`r$eYD`9IOaB2|73-!e#&ck-PWkDL}lws^SaN9~UvPVR3mr?McEX@I*atf>uv z!@)fI3@FVFrzEn^vzO>8hLEsWxz~r~0cS?D^oN)SK!QA^cp<#Tm9< z;d&0YlGni&=UTh-OR$Wxm_|hDmEq17&EA;VAIq6v>d4tG!L5WPcdZ%0RW{li(JQGk zv;*2NSM#}zt9|NmN}JvU3{j0jH+7DmcPb=yoV8I2uPp+X<9i|M@)}vz!uh%-gdD_m zt*mliQG9Q_85Zbt8+C&7S?+nU0r|;VP5{=*3O8ZASx_euXhW#a@y8Fhidt1__UzYS z9h_e!_oh&w^zk6aG^1y@AjWxz>!$9)+0bu%lZI&WS?RM4aBt_S1p}EfnSCw`2*q*T4dc)&V*i!gGcdB~h>B0s2 zgfHBV&HsHYMWRKGoAavy$G)a%*_~j5$6va~G2ilkw3XlrE8o~;6Lxnhcey>FTze$Y zxUvHfsY|CK)xk%{!;ZGuD@|M|wtWovn=E1YSO{6aF9UR)iISGuV{7mh#GgII-cxy# zn6-(h!?al`F_rqvbU)yqm`Y4F_F;E+!D z@X~aGBO|Ek!kS3sQ|))Bf-T6m02&I4i>Mq0JQ3?>0C)JA2@MEja-j;)u7a!i zuE?jTzsbBW%!A!Mp9;iZX+4U3T+=We?-rfneD^K~7HvS@iYiZxI-||O+nUG8QY+rW zB-e3XWF6a=bX;5$VyBlFU9Tpo!9f$n&ziUF?@g-?o-V?ju6`1RHz()#fl_usFNSYI zI9>H_SvPHs#vxr56AlySNv}~6Lm+>8n?(On|5bb=S>C(BVl$jMFU&vflCr&HxG(2* zfzqD7Cz#p8AEH$gp8)WDVwX!7$^r|8*dsLenBRpd->UvL=dyG1#u@>Z8jx*RvWCvi zc}DCGW9{E2HV>GPy zqmp8R&Da60u03A17{w23d-QPe5=`3MNz>_}9m-zu(CN~H?@0>OvFI3R=;*NuK&fAq z-km>6lz@non3$9>J1ZlrkbT)+nwv`^SpUxE?(?2Gc#I8jmh9tAkRLq$DoRMy?Fuhh z)6l(FmtHT^GcigLOIGkF17+kdfGoA93oJ`w8w1U*bAfCPyZQRIUXGj%08 zO6POED8NRa zxsXgEqHzSC(Q!mN)GF9F$yrl|LOGGEcZ@{FRck{jCw*^oA z5H-|Vg8XI&f)wxr<+;OqjMab((7Trvjby}?0YEk^44`8*UonGdH_%c9OZ9IQqLt84 zY?h?}yTX6I^2iP$Cd30{!FT#Gb_K$|dip zTJ0iDLgilnrD9{66BgFA{Pv`-YTa)N=W3fOD!%u?m^mudTBFb}SnlI=7xH>j_CW9GcZza~>}#kTLx#P4RgEkbRgd z@shlcy8~#Jgh9E?n}`Kl?MA;2!FFtvS#FC-_&p*4aMLx!oQY>$Pcr!$2GU#@Il+wW zr5P4MC0}I={_M=Ro~m zDr`c3_iW48Nf-rg%x7X*<;*k<{QC6vTjY^?&g; zNa(v=x<_8e_HaB4L&eVcEqqTe&AyXO9h~iRkyOFO9`{7$`2CnPgsoae$ykU^M5D^` z%vaF<=%4SPV?2FX3DCbze(HcZxXr`thV-__3i!OP_aZsOwf8tQjf)1Y`KGujlK z5(wKV)C}8L=6+r}pu^#{yI@{m%FQgo4~TPD9H-VtF$Q@5T=mK%oE*9LN7XvI_S2WS zyO#zblQEG8_us+q4Hv{RYqAbirBOmByM)tHnxZVjCYR!ItMY4VhP1Q7w4gr3`G4@8 zqf-dbHd~ju{yb$i4h4FXcGhEEG%EhNL}Xmft?S*S=`f}I;#+sk?%>q8SBZDO$fK=- zzwN^*dQI-X*b@dA zU*j2i2vUYtTRqTvxRblmLD&ffhAg)`YYASPr5oc)YhR8pK%N>Okc8lH=F>!DGI?R&l+M zZnRhb9naeBNNFlwhv7q1d}Gg*LuR^>nc#N&hn*YqBHcw*^v7Z&PCE=arGNkT_RU?t zqBDhgCKP>X)+xf;!)UDySdmXcph_aM){S(X6XEIuZx3YPPCoVbwkGyo3U&RX#EmWs ze)dbd6y7%%_)|5I63m>WrJz)h&N;bzNy6^MXbI2a z-(#Es_D89hZ!eibHHpIRH1^Gw>n_J)@6jsV?E(K=52F{-_R`YVb(R+uBn|o|5^~C4 ztQOI|B`9%zOXGgT5pHX~V2Efb@&ZdtYDJA}L73H91&!GBdu;GmLg9MwS5n~cI-H-Q zDtpHQ80&{8-Sn)l@pQMv&i7dyzgbr7o3`2MF3s%2Ui6kMB41#6>gNydM`Z#(4nYxW zE*eVEqp3v4lRw_aZT@1wd8ukVVbXJfb^JDer)RMuyJbljMA|tPqw76A$_!U64McFm zpO*J)OqKIDmUfCQ?^!x7)fvmnVfN-tqjL1%jLA8Ue(!_p7*W8uz0~a$VcaG`XJL&N zL1*`iRw+49ZU6pI{En$Z=K8*{9h577mq{)&A*+%MH*4<u!ok-KMac`!WBN29+pg-&6G5+9soabFAY_hx}@0rB6Bc@e3-B zeT6s5xgepYyH8%Nh0r&lCOpOLi-%(&rXnCBuBlEgd9 z{?IVwa72X(L7-gH1n0$W#Gx3uU;4QRX=|F)V?&#mtW>sOGyou+|tI>4| z(QtOEw>0GWSSkAdw6XnvUeur{DQ)UXOYomnB~7GgP6O Date: Wed, 4 May 2016 14:57:31 -0700 Subject: [PATCH 17/38] cleaning up content --- .../device-guard-deployment-guide.md | 422 ++++++------------ 1 file changed, 126 insertions(+), 296 deletions(-) diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index 2dae3234ae..5bace9eb68 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -2,7 +2,7 @@ title: Device Guard deployment guide (Windows 10) description: Microsoft Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. ms.assetid: 4BA52AA9-64D3-41F3-94B2-B87EC2717486 -keywords: ["virtualization", "security", "malware"] +keywords: virtualization, security, malware ms.prod: W10 ms.mktglfcycl: deploy author: challum @@ -10,7 +10,6 @@ author: challum # Device Guard deployment guide - **Applies to** - Windows 10 @@ -19,7 +18,6 @@ Microsoft Device Guard is a feature set that consists of both hardware and softw ## Introduction to Device Guard - Today’s security threat landscape is more aggressive than ever before. Modern malicious attacks are focused on revenue generation, intellectual property theft, and targeted system degradation, which results in financial loss. Many of these modern attackers are sponsored by nation states with unknown motives and large cyber terrorism budgets. These threats can enter a company through something as simple as an email message and can permanently damage its reputation for securing its software assets, as well as having significant financial impact. Windows 10 introduces several new security features that help mitigate a large percentage of today’s known threats. It is estimated that more than 300,000 new malware variants are discovered daily. Unfortunately, companies currently use an ancient method to discover this infectious software and prevent its use. In fact, current PCs trust everything that runs until malware signatures determine whether a threat exists; then, the antimalware software attempts to clean the PC, often after the malicious software’s effect has already been noticed. This signature-based system focuses on reacting to an infection and ensuring that the particular infection does not happen again. In this model, the system that drives malware detection relies on the discovery of malicious software; only then can a signature be provided to the client to remediate it, which implies that a computer must be infected first. The time between the detection of the malware and a client being issued a signature could mean the difference between losing data and staying safe. @@ -32,15 +30,12 @@ Device Guard's features revolutionize the Windows operating system’s security ## Device Guard overview - Device Guard is a feature set that consists of both hardware and software system integrity hardening features. These features revolutionize the Windows operating system’s security by taking advantage of new virtualization-based security options and the trust-nothing mobile device operating system model. A key feature in this model is called *configurable code integrity*, which allows your organization to choose exactly which software or trusted software publishers are allowed to run code on your client machines—exactly what has made mobile phone security so successful. In addition, Device Guard offers organizations a way to sign existing line-of-business (LOB) applications so that they can trust their own code, without the requirement that the application be repackaged. Also, this same method of signing provides organizations with a way to trust individual third-party applications. Device Guard—with configurable code integrity, Credential Guard, and AppLocker—is the most complete security defense that any Microsoft product has ever been able to offer a Windows client. -Advanced hardware features such as CPU virtualization extensions, IOMMUs, and SLAT, drive these new client security offerings. By integrating these hardware features further into the core operating system, Windows 10 leverages them in new ways. For example, the same type 1 hypervisor technology that is used to run virtual machines in Microsoft Hyper-V is used to isolate core Windows services into a virtualization-based, protected container. This is just one example of how Windows 10 integrates advanced hardware features deeper into the operating system to offer comprehensive modern security to its users. These hardware features are now available in consumer and enterprise PC markets and are discussed in detail in the [Hardware considerations](#hardware) section. +Advanced hardware features such as CPU virtualization extensions, IOMMUs, and SLAT, drive these new client security offerings. By integrating these hardware features further into the core operating system, Windows 10 leverages them in new ways. For example, the same type 1 hypervisor technology that is used to run virtual machines in Microsoft Hyper-V is used to isolate core Windows services into a virtualization-based, protected container. This is just one example of how Windows 10 integrates advanced hardware features deeper into the operating system to offer comprehensive modern security to its users. These hardware features are now available in consumer and enterprise PC markets and are discussed in detail in the [Hardware considerations](#hardware-considerations) section. Along with these new features, some components of Device Guard are existing tools or technologies that have been included in this strategic security offering to provide customers with the most secure Windows operating system possible. Device Guard is intended as a set of client security features to be used in conjunction with the other threat-resistance features available in the Windows operating system, some of which are mentioned in this guide. In addition to an overview of each feature, this guide walks you through the configuration and deployment of them. -### - **Configurable code integrity** The Windows operating system consists of two operating modes: user mode and kernel mode. The base of the operating system runs within the kernel mode, which is where the Windows operating system directly interfaces with hardware resources. User mode is primarily responsible for running applications and brokering information to and from the kernel mode for hardware resource requests. For example, when an application that is running in user mode needs additional memory, the user mode process must request the resources from kernel mode, not directly from RAM. @@ -53,9 +48,7 @@ Historically, most malware has been unsigned. By simply deploying code integrity The Device Guard core functionality and protection start at the hardware level. Devices that have processors equipped with SLAT technologies and virtualization extensions, such as Intel Virtualization Technology (VT-x) and AMD-V, will be able to take advantage of virtualization-based security (VBS) features that enhance Windows security. Device Guard leverages VBS to isolate core Windows services that are critical to the security and integrity of the operating system. This isolation removes the vulnerability of these services from both the user and kernel modes and acts as an impenetrable barrier for most malware used today. One of these isolated services, called the Windows Code Integrity service, drives the Device Guard kernel mode configurable code integrity feature. This prevents code that has penetrated the kernel mode operations from compromising the code integrity service. -Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard provides additional protection to Active Directory domain users by storing domain credentials within the virtualization container that hosts the Windows security services, such as code integrity. By isolating these domain credentials from the active user mode and kernel mode, they have a much lower risk of being stolen. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#dg-with-cg) section. For information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-cg) section. - -### +Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard provides additional protection to Active Directory domain users by storing domain credentials within the virtualization container that hosts the Windows security services, such as code integrity. By isolating these domain credentials from the active user mode and kernel mode, they have a much lower risk of being stolen. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#device-guard-with-credential-guard) section. For information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. **Device Guard with AppLocker** @@ -63,12 +56,8 @@ Although AppLocker is not considered a new Device Guard feature, it complements **Note**  One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit universal applications. Universal applications have already been validated by Microsoft to be trustworthy to run, but an organization may not want to allow specific universal applications to run in their environment. You can accomplish this enforcement by using an AppLocker rule. -  - AppLocker and Device Guard should run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, Microsoft recommends that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. -### - **Device Guard with Credential Guard** Although Credential Guard is not a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against credential theft. Similar to virtualization-based protection of kernel mode code integrity, Credential Guard leverages hypervisor technology to protect domain credentials. This mitigation is targeted at resisting the use of pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Credential Guard, organizations can gain additional protection against such threats. For information about how to deploy Credential Guard to your Windows 10 Enterprise clients, see the [Enable Credential Guard](#enable-cg) section. In addition to the client-side enablement of Credential Guard, organizations can deploy mitigations at both the CA and domain controller level to help prevent credential theft. Microsoft will be releasing details about these additional mitigations in the future. @@ -86,42 +75,40 @@ You can easily manage Device Guard features by using the familiar enterprise and - **Windows PowerShell**. Windows PowerShell is primarily used to create and service code integrity policies. These policies represent the most powerful component of Device Guard. For a step-by-step walkthrough of how to create, audit, service, enforce, and deploy code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. These options provide the same experience you are used to in order to manage your existing enterprise management solutions. For more information about how to manage and deploy Device Guard hardware and code integrity features in your organization, see the [Device Guard deployment](#dg-deployment) section. -## Plan for Device Guard +## Plan for Device Guard In this section, you will learn about the following topics: -- [Approach enterprise code integrity deployment](#approach-enterprise). Device Guard deployment in your organization requires a planned approach. In this section, you get high-level recommendations for how to approach enterprise code integrity deployment in your organization. +- [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment). Device Guard deployment in your organization requires a planned approach. In this section, you get high-level recommendations for how to approach enterprise code integrity deployment in your organization. -- [Device Guard deployment scenarios](#device-guard-deployment). When you plan for Device Guard deployment, Microsoft recommends that you categorize each device in your organization into a deployment scenario. These scenarios will provide a roadmap for your Device Guard deployment. +- [Device Guard deployment scenarios](#device-guard-deployment-scenarios). When you plan for Device Guard deployment, Microsoft recommends that you categorize each device in your organization into a deployment scenario. These scenarios will provide a roadmap for your Device Guard deployment. - [Code signing adoption](#code-signing-adoption). Code signing is important to the security that Device Guard provides. This section outlines the options for code signing and the benefits and disadvantages of each method. -- [Hardware considerations](#hardware). Several Device Guard features require advanced hardware. This section outlines the requirements for each of those features and what to look for during your next hardware refresh. - -## Approach enterprise code integrity deployment +- [Hardware considerations](#hardware-considerations). Several Device Guard features require advanced hardware. This section outlines the requirements for each of those features and what to look for during your next hardware refresh. +## Approach enterprise code integrity deployment Enterprises that want to consider Device Guard should not expect deployment to their entire organization overnight. Device Guard implementation requires that you plan for both end-user and IT pro impact. In addition, the deployment of Device Guard features to your enterprise requires a planned, phased approach to ensure that end-user systems are fully capable and ready to enforce these new security restrictions. Perform the following high-level tasks to approach the deployment of Device Guard to your enterprise: -1. **Group devices into similar functions**. Categorize machines into the groups described in the [Device Guard deployment scenarios](#device-guard-deployment) section. This begins the roadmap for your Device Guard deployment and provides groups of easier and more difficult implementations. From there, assess the quantity of necessary Device Guard policies. The easiest solution is to lock down your entire enterprise, but it might not fit your individual departments’ needs. +1. **Group devices into similar functions**. Categorize machines into the groups described in the [Device Guard deployment scenarios](#device-guard-deployment-scenarios) section. This begins the roadmap for your Device Guard deployment and provides groups of easier and more difficult implementations. From there, assess the quantity of necessary Device Guard policies. The easiest solution is to lock down your entire enterprise, but it might not fit your individual departments’ needs. To discover an appropriate number of policies for your organization, try to separate the defined groups into departments or roles. Then ask some questions: What software does each department or role need to do their job? Should they be able to install and run other departments’ software? Do we need to create a base code integrity policy that aligns with our application catalog? Should users be able to install any application or only choose from an “allowed” list? Do we allow users to use their own peripheral devices? These questions will help you discover the number of necessary policies for your organization. Finally, try to focus on which people or departments would require an additional level of privileges. For example, should department x be able to install and run application xyz, even though no other department does? If the answer is yes and justifiable, you will need a secondary code integrity policy for that group. If not, you will likely be able to merge several policies to simplify management. For more information about configurable code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. -2. **Create code integrity policies from “golden” PCs**. After you create the groups of devices, you can create code integrity policies to align with those groups, similar to the way you would manage corporate images. When you have separated these groups and set up golden PCs that mimic the software and hardware those individual groups require, create code integrity policies from each of them. After you create these, you can merge these code integrity policies to create a master policy, or you can manage and deploy them individually. For step-by-step instructions about how to create code integrity policies, see the [Create code integrity policies from golden PCs](#create-code-golden) section. +2. **Create code integrity policies from “golden” PCs**. After you create the groups of devices, you can create code integrity policies to align with those groups, similar to the way you would manage corporate images. When you have separated these groups and set up golden PCs that mimic the software and hardware those individual groups require, create code integrity policies from each of them. After you create these, you can merge these code integrity policies to create a master policy, or you can manage and deploy them individually. For step-by-step instructions about how to create code integrity policies, see the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section. -3. **Audit and merge code integrity policies**. Microsoft recommends that you test code integrity policies in audit mode before you enforce them. Audit mode allows administrators to run the code integrity policy on a system but not actually block anything. Rather than not allowing applications to run, events are logged with each exception to the policy. This way, you can easily highlight any issues that were not discovered during the initial scan. You can create additional code integrity policies by using the audit events and merge them into the existing policy. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity) section. +3. **Audit and merge code integrity policies**. Microsoft recommends that you test code integrity policies in audit mode before you enforce them. Audit mode allows administrators to run the code integrity policy on a system but not actually block anything. Rather than not allowing applications to run, events are logged with each exception to the policy. This way, you can easily highlight any issues that were not discovered during the initial scan. You can create additional code integrity policies by using the audit events and merge them into the existing policy. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section. 4. **Assess LOB applications that are currently unsigned, and create a catalog file for them**. Catalog files allow organizations to sign applications that do not currently possess digitally signed binaries or applications that a customer would want to add a secondary signature to. These applications can be in-house applications or from third parties, and the process does not require any repackaging of the application. When you create code integrity policies at a rule level above hash values, you will not discover unsigned applications. To include these applications in your code integrity policies, simply create, sign, and deploy a catalog file. For information about catalog files, see the [Catalog files](#catalog-files) section. -5. **Enable desired hardware security features**. Each type of device found in the [Device Guard deployment scenarios](#device-guard-deployment) section takes advantage of different software and hardware integrity configurations. You should assess hardware-based security features separately from code integrity policies because they provide complementary functionality. For information about how to configure Device Guard hardware-based security features, see the [Configure hardware-based security features](#configure-hardware) section. +5. **Enable desired hardware security features**. Each type of device found in the [Device Guard deployment scenarios](#device-guard-deployment-scenarios) section takes advantage of different software and hardware integrity configurations. You should assess hardware-based security features separately from code integrity policies because they provide complementary functionality. For information about how to configure Device Guard hardware-based security features, see the [Configure hardware-based security features](#configure-hardware-based-security-features) section. -6. **Deploy code integrity policies and catalog files**. After you have created and signed the necessary catalog files and created and audited code integrity policies, you are ready to deploy them in phases. Microsoft strongly recommends that you deploy these components to a test group of users, even after your IT organization has tested and vetted them. This provides a final quality control validation before you deploy the catalog files and policies more broadly. For information about how to deploy catalog files with Group Policy, see the [Deploy catalog files with Group Policy](#deploy-cat-gp) section. For additional information about how to deploy code integrity policies, see the [Deploy code integrity policies with Group Policy](#deploy-manage-code-gp) section. +6. **Deploy code integrity policies and catalog files**. After you have created and signed the necessary catalog files and created and audited code integrity policies, you are ready to deploy them in phases. Microsoft strongly recommends that you deploy these components to a test group of users, even after your IT organization has tested and vetted them. This provides a final quality control validation before you deploy the catalog files and policies more broadly. For information about how to deploy catalog files with Group Policy, see the [Deploy catalog files with Group Policy](#deploy-catalog-files-with-group-policy) section. For additional information about how to deploy code integrity policies, see the [Deploy code integrity policies with Group Policy](#deploy-code-integrity-policies-with-group-policy) section. -## Device Guard deployment scenarios +## Device Guard deployment scenarios - -To help simplify the deployment of Device Guard to your organization, Microsoft recommends that you group devices into the deployment scenarios described in this section. Device Guard is not a feature that organizations will just simply “turn on”; rather, it typically requires a phased implementation approach. To see where these scenarios fit into an overall Device Guard deployment approach, see the [Approach to enterprise code integrity deployment](#approach-enterprise) section. +To help simplify the deployment of Device Guard to your organization, Microsoft recommends that you group devices into the deployment scenarios described in this section. Device Guard is not a feature that organizations will just simply “turn on”; rather, it typically requires a phased implementation approach. To see where these scenarios fit into an overall Device Guard deployment approach, see the [Approach to enterprise code integrity deployment](#approach-to-enterprise-code-integrity-deployment) section. **Fixed-workload devices** @@ -131,8 +118,6 @@ Device Guard components that are applicable to fixed-workload devices include: - KMCI VBS protection - - - Enforced UMCI policy **Fully managed devices** @@ -163,14 +148,11 @@ Device Guard is not a good way to manage devices in a Bring Your Own Device (BYO ## Code signing adoption - Code signing is crucial to the successful implementation of configurable code integrity policies. These policies can trust the signing certificates from both independent software vendors and customers. In Windows 10, all Windows Store applications are signed. Also, you can easily trust any other signed application by adding the signing certificate to the code integrity policy. -For unsigned applications, customers have multiple options for signing them so that code integrity policies can trust them. The first option is traditional embedded code signing. Organizations that have in-house development teams can incorporate binary code signing into their application development process, and then simply add the signing certificate to their code integrity policies. The second option for signing unsigned applications is to use catalog files. In Windows 10, customers have the ability to create catalog files as they monitor the installation and initial run of an application. For more information about signing existing unsigned LOB applications or third-party applications, see the [Existing line-of-business applications](#existing-lob) section. +For unsigned applications, customers have multiple options for signing them so that code integrity policies can trust them. The first option is traditional embedded code signing. Organizations that have in-house development teams can incorporate binary code signing into their application development process, and then simply add the signing certificate to their code integrity policies. The second option for signing unsigned applications is to use catalog files. In Windows 10, customers have the ability to create catalog files as they monitor the installation and initial run of an application. For more information about signing existing unsigned LOB applications or third-party applications, see the [Existing line-of-business applications](#existing-line-of-business-applications) section. -### - -**Existing line-of-business applications** +### Existing line-of-business applications Until now, existing LOB applications were difficult to trust if they were signed by a source other than the Windows Store or not signed at all. With Windows 10, signing your existing LOB and third-party unsigned applications is simplified. This new signing method does not require that applications be repackaged in any way. With catalog files, administrators can sign these unsigned applications simply by monitoring for an installation and initial startup. By using this monitoring information, an administrator can generate a catalog file. Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries’ hash values are updated every time an application is updated and therefore require an updated catalog file. For simplified administration, consider incorporating embedded code signing into your application development process. For more information about how to generate catalog files, see the [Catalog files](#catalog-files) section. @@ -178,17 +160,16 @@ Until now, existing LOB applications were difficult to trust if they were signed Catalog files are lists of individual binaries’ hash values. If the scanned application is updated, you will need to create a new catalog file. That said, binary signing is still highly recommended for any future applications so that no catalog files are needed.   - When you create a catalog file, you must sign it by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. When signed, code integrity policies can trust the signer or signing certificate of those files. For information about catalog file signing, see the [Catalog files](#catalog-files) section. **Application development** Although in-house applications can be signed after packaging by using catalog files, Microsoft strongly recommends that embedded code signing be incorporated into your application development process. When signing applications, simply add the code signing certificate used to sign your applications to your code integrity policy. This ensures that your code integrity policy will trust any future application that is signed with that certificate. Embedding code signing into any in-house application development process is beneficial to your IT organization as you implement code integrity policies. -## Hardware considerations +## Hardware considerations -Careful consideration about which hardware vendor and specific models to purchase during your next hardware refresh is vitally important to the success of your organization’s Device Guard implementation efforts. In alignment with your current hardware life cycle, consider the process that is discussed in the [Approach enterprise code integrity deployment](#approach-enterprise) section when you determine the appropriate order of hardware replacement in your organization. Device Guard should be deployed in phases; therefore, you have time to methodically plan for its implementation. +Careful consideration about which hardware vendor and specific models to purchase during your next hardware refresh is vitally important to the success of your organization’s Device Guard implementation efforts. In alignment with your current hardware life cycle, consider the process that is discussed in the [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment) section when you determine the appropriate order of hardware replacement in your organization. Device Guard should be deployed in phases; therefore, you have time to methodically plan for its implementation. Different hardware features are required to implement the various features of Device Guard. There will likely be some individual features that you will be able to enable with your current hardware and some that you will not. However, for organizations that want to implement Device Guard in its entirety, several advanced hardware features will be required. For additional details about the hardware features that are required for Device Guard components, see the following table. @@ -251,57 +232,47 @@ Different hardware features are required to implement the various features of De -  - -## Device Guard deployment - +## Device Guard deployment In this section, you learn about the following topics: -- [Configure hardware-based security features](#configure-hardware). This section explains how to enable the hardware-based security features in Device Guard. Also, you verify that the features are enabled by using both Windows Management Infrastructure (WMI) and Msinfo32.exe. +- [Configure hardware-based security features](#configure-hardware-based-security-features). This section explains how to enable the hardware-based security features in Device Guard. Also, you verify that the features are enabled by using both Windows Management Infrastructure (WMI) and Msinfo32.exe. - [Catalog files](#catalog-files). In this section, you create, sign, and deploy catalog files. You deploy the catalog files by using both Group Policy and System Center Configuration Manager. Also, you use System Center Configuration Manager to inventory the deployed catalog files for reporting purposes. - [Code integrity policies](#code-integrity-policies). This section provides information on how to create, audit, service, merge, deploy, and remove signed and unsigned configurable code integrity policies. -## Configure hardware-based security features - +## Configure hardware-based security features Hardware-based security features make up a large part of Device Guard security offerings. VBS reinforces the most important feature of Device Guard: configurable code integrity. There are three steps to configure hardware-based security features in Device Guard: -1. **Verify that hardware requirements are met and enabled**. Verify that your client machines possess the necessary hardware to run these features. A list of hardware requirements for the hardware-based security features is available in the [Hardware considerations](#hardware) section. +1. **Verify that hardware requirements are met and enabled**. Verify that your client machines possess the necessary hardware to run these features. A list of hardware requirements for the hardware-based security features is available in the [Hardware considerations](#hardware-considerations) section. -2. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. For details on which Windows features are needed, see the [Windows feature requirements for virtualization-based security](#vb-security) section. +2. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. For details on which Windows features are needed, see the [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security) section. -3. **Enable desired features**. When the necessary hardware and Windows features have been enabled, you are ready to enable the desired hardware-based security features. For UEFI Secure Boot, see the [Enable UEFI Secure Boot](#enable-secureboot) section. For information about how to enable VBS protection of the KMCI service, see the [Enable virtualization-based protection of kernel mode code integrity](#enable-virtualbased) section. Finally, for information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-cg) section. +3. **Enable desired features**. When the necessary hardware and Windows features have been enabled, you are ready to enable the desired hardware-based security features. For UEFI Secure Boot, see the [Enable UEFI Secure Boot](#enable-unified-extensible-interface-secure-boot) section. For information about how to enable VBS protection of the KMCI service, see the [Enable virtualization-based protection of kernel mode code integrity](#enable-virtualbased) section. Finally, for information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. -### +### Windows feature requirements for virtualization-based security -**Windows feature requirements for virtualization-based security** - -In addition to the hardware requirements found in the [Hardware considerations](#hardware) section, you must enable certain operating system features before you can enable VBS: Microsoft Hyper-V and isolated user mode (shown in Figure 1). +In addition to the hardware requirements found in the [Hardware considerations](#hardware-considerations) section, you must enable certain operating system features before you can enable VBS: Microsoft Hyper-V and isolated user mode (shown in Figure 1). **Note**   You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, refer to the [Credential Guard documentation](http://go.microsoft.com/fwlink/p/?LinkId=624529).   - ![figure 1](images/dg-fig1-enableos.png) Figure 1. Enable operating system features for VBS -After you enable these features, you can configure any hardware-based security features you want. For information about how to enable virtualization-based protection of kernel-mode code integrity, see the [Enable virtualization-based protection of kernel-mode code integrity](#enable-virtualbased) section. For information about how to enable UEFI Secure Boot, see the [Enable Unified Extensible Firmware Interface Secure Boot](#enable-secureboot) section. Finally, for additional information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-cg) section. +After you enable these features, you can configure any hardware-based security features you want. For information about how to enable virtualization-based protection of kernel-mode code integrity, see the [Enable virtualization-based protection of kernel-mode code integrity](#enable-virtualization-based-protection-of-kernel-mode-code-integrity) section. For information about how to enable UEFI Secure Boot, see the [Enable UEFI Secure Boot](#enable-unified-extensible-interface-secure-boot) section. Finally, for additional information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. -### +### Enable Unified Extensible Firmware Interface Secure Boot -**Enable Unified Extensible Firmware Interface Secure Boot** - -Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in the [Hardware considerations](#hardware) section. There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10: +Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in the [Hardware considerations](#hardware-considerations) section. There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10: **Note**   There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include DMA protection (IOMMU) technologies. Without the presence of IOMMUs and with DMA protection disabled, customers will lose protection from driver-based attacks. -  1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. @@ -320,8 +291,6 @@ Unfortunately, it would be time consuming to perform these steps manually on eve **Note**   Microsoft recommends that you test-enable this feature on a group of test machines before you deploy it to machines that are currently deployed to users. -  - **Use Group Policy to deploy Secure Boot** @@ -358,17 +327,13 @@ Microsoft recommends that you test-enable this feature on a group of test machin Processed Device Guard policies are logged in event viewer at Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. When the **Turn On Virtualization Based Security** policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. -### +### Enable virtualization-based security of kernel-mode code integrity -**Enable virtualization-based security of kernel-mode code integrity** - -Before you begin this process, verify that the desired computer meets the hardware requirements for VBS found in the [Hardware considerations](#hardware) section, and enable the Windows features discussed in the [Virtualization-based security Windows feature requirements](#vb-security) section. When validated, you can enable virtualization-based protection of KMCI in one of two ways: manual configuration of the appropriate registry subkeys and Group Policy deployment. +Before you begin this process, verify that the desired computer meets the hardware requirements for VBS found in the [Hardware considerations](#hardware-considerations) section, and enable the Windows features discussed in the [Virtualization-based security Windows feature requirements](#virtualization-based-security-windows-featurerrequirements) section. When validated, you can enable virtualization-based protection of KMCI in one of two ways: manual configuration of the appropriate registry subkeys and Group Policy deployment. **Note**   All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. Microsoft recommends that you enable this feature on a group of test machines before you enable it on deployed machines. -  - To configure virtualization-based protection of KMCI manually: 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. @@ -382,8 +347,6 @@ It would be time consuming to perform these steps manually on every protected ma **Note**   Microsoft recommends that you test-enable this feature on a group of test computers before you deploy it to machines that are currently deployed to users. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. -  - To use Group Policy to configure VBS of KMCI: 1. Create a new GPO: Right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. @@ -416,13 +379,11 @@ To use Group Policy to configure VBS of KMCI: Processed Device Guard policies are logged in event viewer under Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. When the **Turn On Virtualization Based Security** policy has been successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. -### - -**Enable Credential Guard** +### Enable Credential Guard Credential Guard provides an additional layer of credential protection specifically for domain users by storing the credentials within the virtualized container, away from both the kernel and user mode operating system. This makes it difficult for even a compromised system to obtain access to the credentials. In addition to the client-side enablement of Credential Guard, you can deploy additional mitigations at both the Certification Authority and domain controller level to prevent credential theft. Microsoft will be releasing details about these additional mitigations in the future. -Before you begin this process, verify that the desired system meets the hardware requirements for VBS found in the [Hardware considerations](#hardware) section, and that you have enabled the Windows features laid out in the [Virtualization-based security Windows feature requirements](#vb-security) section. When validated, you can enable Credential Guard manually, by configuring the appropriate registry subkeys, or through Group Policy deployment. +Before you begin this process, verify that the desired system meets the hardware requirements for VBS found in the [Hardware considerations](#hardware) section, and that you have enabled the Windows features laid out in the [Virtualization-based security Windows feature requirements](#virtualization-based-security-windows-feature-requirements) section. When validated, you can enable Credential Guard manually, by configuring the appropriate registry subkeys, or through Group Policy deployment. To configure VBS of Credential Guard manually: @@ -437,8 +398,6 @@ To avoid spending an unnecessary amount of time in manual deployments, use Group **Note**   Microsoft recommends that you enable Credential Guard before you join a machine to the domain to ensure that all credentials are properly protected. Setting the appropriate registry subkeys during your imaging process would be ideal to achieve this protection. -  - To use Group Policy to enable Credential Guard: 1. Create a new GPO: right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here** . @@ -470,8 +429,6 @@ To use Group Policy to enable Credential Guard: **Note**   The default platform security level is **Secure Boot**. If IOMMUs are available within the protected machines, it is recommended that you select **Secure Boot and DMA Protection** to maximize the mitigations that are available through Credential Guard. -   - 7. Check the test client event log for Device Guard GPOs. **Note**   @@ -575,8 +532,6 @@ Table 1. Win32\_DeviceGuard properties -  - Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 11. ![figure 11](images/dg-fig11-dgproperties.png) @@ -590,35 +545,29 @@ Enforcement of Device Guard on a system requires that every trusted application **Note**   The Enterprise edition of Windows 10 or Windows Server 2016 is required to create and use catalog files. -### - -**Create catalog files** +### Create catalog files The creation of catalog files is the first step to add an unsigned application to a code integrity policy. To create a catalog file, copy each of the following commands into an elevated Windows PowerShell session, and then complete the steps: **Note**   -When you establish a naming convention it makes it easier to detect deployed catalog files in the future. In this guide, you will use *\*-Contoso.cat* as the naming convention. For more information about why this practice is helpful to inventory or detect catalog files, see the [Inventory catalog files with System Center Configuration Manager](#inventory-cat-sccm) section. +When you establish a naming convention it makes it easier to detect deployed catalog files in the future. In this guide, you will use *\*-Contoso.cat* as the naming convention. For more information about why this practice is helpful to inventory or detect catalog files, see the [Inventory catalog files with System Center Configuration Manager](#inventory-catalog-files-with-system-center-configuration-manager) section.   1. Be sure that a code integrity policy is currently running in audit mode. - Package Inspector does not always detect installation files that have been removed from the machine during the installation process. To ensure that these binaries are also trusted, the code integrity policy that you created and audited in the [Create code integrity policies from golden PCs](#create-code-golden) and [Audit code integrity policies](#audit-code-integrity) sections should be deployed, in audit mode, to the system on which you are running Package Inspector. + Package Inspector does not always detect installation files that have been removed from the machine during the installation process. To ensure that these binaries are also trusted, the code integrity policy that you created and audited in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) and [Audit code integrity policies](#audit-code-integrity-policies) sections should be deployed, in audit mode, to the system on which you are running Package Inspector. **Note**   This process should **not** be performed on a system running an enforced Device Guard policy, only with a policy running in audit mode. If a policy is currently being enforced, you will not be able to install and run the application. -   - 2. Start Package Inspector, and then scan drive C: `PackageInspector.exe Start C:` **Note**   Package inspector can monitor installations on any local drive. In this example, we install the application on drive C, but any other drive can be used. - -   - +   3. Copy the installation media to drive C. By copying the installation media to drive C, you ensure that Package Inspector detects and catalogs the actual installer. If you skip this step, the future code integrity policy may trust the application to run but not be installed. @@ -645,11 +594,9 @@ When you establish a naming convention it makes it easier to detect deployed cat **Note**   This scan catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries’ hash values. -When finished, the files will be saved to your desktop. To trust this catalog file within a code integrity policy, the catalog must first be signed. Then, the signing certificate can be included in the code integrity policy, and the catalog file can be distributed to the individual client machines. Catalog files can be signed by using a certificate and SignTool.exe, a free tool available in the Windows SDK. For more information about signing catalog files with SignTool.exe, see the [Catalog signing with SignTool.exe](#catsign-signtool) section. +When finished, the files will be saved to your desktop. To trust this catalog file within a code integrity policy, the catalog must first be signed. Then, the signing certificate can be included in the code integrity policy, and the catalog file can be distributed to the individual client machines. Catalog files can be signed by using a certificate and SignTool.exe, a free tool available in the Windows SDK. For more information about signing catalog files with SignTool.exe, see the [Catalog signing with SignTool.exe](#catalog-signing-with-signtool.exe) section. -### - -**Catalog signing with SignTool.exe** +### Catalog signing with SignTool.exe Device Guard makes it easy for organizations to sign and trust existing unsigned LOB applications. In this section, you sign a catalog file you generated in a previous section by using PackageInspector.exe. For information about how to create catalog files, see the [Create catalog files](#create-catalog-files) section. In this example, you need the following: @@ -659,7 +606,7 @@ Device Guard makes it easy for organizations to sign and trust existing unsigned - Internal certification authority (CA) code signing certificate or purchased code signing certificate -If you do not have a code signing certificate, please see the [Create a Device Guard code signing certificate](#create-dg-code) section for a walkthrough of how to create one. In addition to using the certificate you create in the Create a Device Guard code signing certificate section, this example signs the catalog file that you created in the [Create catalog files](#create-catalog-files) section. If you are using an alternate certificate or catalog file, update the following steps with the appropriate variables and certificate. To sign the existing catalog file, copy each of the following commands into an elevated Windows PowerShell session: +If you do not have a code signing certificate, please see the [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) section for a walkthrough of how to create one. In addition to using the certificate you create in the Create a Device Guard code signing certificate section, this example signs the catalog file that you created in the [Create catalog files](#create-catalog-files) section. If you are using an alternate certificate or catalog file, update the following steps with the appropriate variables and certificate. To sign the existing catalog file, copy each of the following commands into an elevated Windows PowerShell session: 1. Initialize the variables that will be used: @@ -670,29 +617,17 @@ If you do not have a code signing certificate, please see the [Create a Device G **Note**   In this example, you use the catalog file you created in the [Create catalog files](#create-catalog-files) section. If you are signing another catalog file, be sure to update the *$ExamplePath* and *$CatFileName* variables with the correct information. -2. Import the code signing certificate. Import the code signing certificate that will be used to sign the catalog file to the signing user’s personal store. In this example, you use the certificate that you created in the [Create a Device Guard code signing certificate](#create-dg-code) section. +2. Import the code signing certificate. Import the code signing certificate that will be used to sign the catalog file to the signing user’s personal store. In this example, you use the certificate that you created in the [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) section. 3. Sign the catalog file with Signtool.exe: - - - - - - - - - - - 
<Path to signtool.exe> sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName
+ ` sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName` - **Note**   - The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* is the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the machine on which you are attempting to sign the catalog file. + **Note**   + The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* is the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the machine on which you are attempting to sign the catalog file. -   - - **Note**   - For additional information about Signtool.exe and all additional switches, visit [MSDN Sign Tool page](http://go.microsoft.com/fwlink/p/?LinkId=624163). + **Note**   + For additional information about Signtool.exe and all additional switches, visit [MSDN Sign Tool page](http://go.microsoft.com/fwlink/p/?LinkId=624163).   @@ -706,17 +641,13 @@ If you do not have a code signing certificate, please see the [Create a Device G For testing purposes, you can manually copy signed catalog files to their intended folder. For large-scale implementations, Microsoft recommends that you use Group Policy File Preferences to copy the appropriate catalog files to all desired machines or an enterprise systems management product such as System Center Configuration Manager. Doing this simplifies the management of catalog versions, as well. -### - -**Deploy catalog files with Group Policy** +### Deploy catalog files with Group Policy To simplify the management of catalog files, you can use Group Policy preferences to deploy catalog files to the appropriate PCs in your organization. The following process walks you through the deployment of a signed catalog file called LOBApp-Contoso.cat to a test OU called DG Enabled PCs with a GPO called **Contoso DG Catalog File GPO Test**. **Note**   This walkthrough requires that you have previously created a signed catalog file and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create and sign a catalog file, see the [Catalog files](#catalog-files) section. -  - To deploy a catalog file with Group Policy: 1. From either a domain controller or a client PC that has Remote Server Administration Tools (RSAT) installed, open the Group Policy Management Console (GPMC) by running **GPMC.MSC** or by searching for Group Policy Management. @@ -724,7 +655,7 @@ To deploy a catalog file with Group Policy: 2. Create a new GPO: right-click the DG Enabled PCs OU, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 13. **Note**   - The DG Enabled PCs OU is just an example of where to link the test GPO that you created in this section. You can use any OU name. Also, security group filtering is an option when you consider policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise) section. + The DG Enabled PCs OU is just an example of where to link the test GPO that you created in this section. You can use any OU name. Also, security group filtering is an option when you consider policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment) section. ![figure 13](images/dg-fig13-createnewgpo.png) @@ -767,17 +698,13 @@ To deploy a catalog file with Group Policy: 12. Close the Group Policy Management Editor, and then update the policy on the test Windows 10 machine by running GPUpdate.exe. When the policy has been updated, verify that the catalog file exists in C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} on the Windows 10 machine. -### - -**Deploy catalog files with System Center Configuration Manager** +### Deploy catalog files with System Center Configuration Manager As an alternative to Group Policy, you can use System Center Configuration Manager to deploy catalog files to the managed machines in your environment. This approach can simplify the deployment and management of multiple catalog files as well as provide reporting around which catalog each client or collection has deployed. In addition to the deployment of these files, System Center Configuration Manager can also be used to inventory the currently deployed catalog files for reporting and compliance purposes. Complete the following steps to create a new deployment package for catalog files: **Note**   The following example uses a network share named \\\\Shares\\CatalogShare as a source for the catalog files. If you have collection specific catalog files, or prefer to deploy them individually, use whichever folder structure works best for your organization. -  - 1. Open the Configuration Manager console, and select the Software Library workspace. 2. Navigate to Overview\\Application Management, right-click **Packages**, and then click **Create Package**. @@ -844,17 +771,13 @@ After you create the deployment package, deploy it to a collection so that the c 11. Close the wizard. -### - -**Inventory catalog files with System Center Configuration Manager** +### Inventory catalog files with System Center Configuration Manager When catalog files have been deployed to the machines within your environment, whether by using Group Policy or System Center Configuration Manager, you can inventory them with the software inventory feature of System Center Configuration Manager. The following process walks you through the enablement of software inventory to discover catalog files on your managed systems through the creation and deployment of a new client settings policy. **Note**   A standard naming convention for your catalog files will significantly simplify the catalog file software inventory process. In this example, *-Contoso* has been added to all catalog file names. -  - 1. Open the Configuration Manager console, and select the Administration workspace. 2. Navigate to **Overview\\Client Settings**, right-click **Client Settings**, and then click **Create Custom Client Device Settings**. @@ -908,25 +831,19 @@ If nothing is displayed in this view, navigate to Software\\Last Software Scan i ## Code integrity policies -Code integrity policies maintain the standards by which a computer running Windows 10 determines whether an application is trustworthy and can be run. For an overview of code integrity, see the [Configurable code integrity](#config-code) section. +Code integrity policies maintain the standards by which a computer running Windows 10 determines whether an application is trustworthy and can be run. For an overview of code integrity, see the [Configurable code integrity](#configurable-code-integrity) section. A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. Code integrity policies follow a similar methodology, that begins with the establishment of a golden PC. Like when imaging, you can have multiple golden PCs based on model, department, application set, and so on. Although the thought process around the creation of code integrity policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional code integrity policies based on what should be allowed to be installed and run and for whom. **Note**   Each machine can have only **one** code integrity policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to C:\\Windows\\System32\\CodeIntegrity. Keep this in mind when you create your code integrity policies. -  - Optionally, code integrity policies can align with your software catalog as well as any IT department–approved applications. One simple method to implement code integrity policies is to use existing images to create one master code integrity policy. You do so by creating a code integrity policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, should the applications be installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed. **Note**   The following section assumes that you will deploy code integrity policies as part of your Device Guard deployment. Alternatively, configurable code integrity is available without the enablement of Device Guard. -  - -### - -**Code integrity policy rules** +### Code integrity policy rules Code integrity policies consist of several components. The two major components, which are configurable, are called *policy rules* and *file rules*, respectively. Code integrity policy rules are options that the code integrity policy creator can specify on the policy. These options include the enablement of audit mode, UMCI, and so on. You can modify these options in a new or existing code integrity policy. File rules are the level to which the code integrity policy scan ties each binary trust. For example, the hash level is going to itemize each discovered hash on the system within the generated code integrity policy. This way, when a binary prepares to run, the code integrity service will validate its hash value against the trusted hashes found in the code integrity policy. Based on that result, the binary will or will not be allowed to run. @@ -944,58 +861,48 @@ You can set several rule options within a code integrity policy. Table 2 lists e Table 2. Code integrity policy - policy rule options -| **Rule option** | **Description** | -|----------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **0 Enabled:UMCI** | Code integrity policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | -| **1 Enabled:Boot Menu Protection** | This option is not currently supported. | -| **2 Required:WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | -| **3 Enabled:Audit Mode (Default)** | Enables the execution of binaries outside of the code integrity policy but logs each occurrence in the CodeIntegrity event log, which can be used to update the existing policy before enforcement. To enforce a code integrity policy, remove this option. | -| **4 Disabled:Flight Signing** | If enabled, code integrity policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | -| **5 Enabled:Inherent Default Policy** | This option is not currently supported. | -| **6 Enabled:Unsigned System Integrity Policy (Default)** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | -| **7 Allowed:Debug Policy Augmented** | This option is not currently supported. | -| **8 Required:EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All future Windows 10 and later drivers will meet this requirement. | -| **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all code integrity policies. Setting this rule option allows the F8 menu to appear to physically present users. | -| **10 Enabled:Boot Audit on Failure** | Used when the code integrity policy is in enforcement mode. When a driver fails during startup, the code integrity policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | - -  +| Rule option | Description | +|------------ | ----------- | +| **0 Enabled:UMCI** | Code integrity policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | +| **1 Enabled:Boot Menu Protection** | This option is not currently supported. | +| **2 Required:WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | +| **3 Enabled:Audit Mode (Default)** | Enables the execution of binaries outside of the code integrity policy but logs each occurrence in the CodeIntegrity event log, which can be used to update the existing policy before enforcement. To enforce a code integrity policy, remove this option. | +| **4 Disabled:Flight Signing** | If enabled, code integrity policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | +| **5 Enabled:Inherent Default Policy** | This option is not currently supported. | +| **6 Enabled:Unsigned System Integrity Policy (Default)** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | +| **7 Allowed:Debug Policy Augmented** | This option is not currently supported. | +| **8 Required:EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All future Windows 10 and later drivers will meet this requirement. | +| **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all code integrity policies. Setting this rule option allows the F8 menu to appear to physically present users. | +| **10 Enabled:Boot Audit on Failure** | Used when the code integrity policy is in enforcement mode. When a driver fails during startup, the code integrity policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as low as the hash of each binary and as high as a PCA certificate. File rule levels are specified both when you create a new code integrity policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, code integrity policies combine their file rules. Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Device Guard deployment scenario. Table 3. Code integrity policy - file rule levels -| **Rule level** | **Description** | -|-----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. | -| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. | -| **SignedVersion** | This combines the publisher rule with a file version number. This option allows anything from the specified publisher, with a file version at or above the specified version number, to run. | -| **Publisher** | This is a combination of the PCA certificate and the common name (CN) on the leaf certificate. In the scenario that a PCA certificate is used to sign multiple companies’ applications (such as VeriSign), this rule level allows organizations to trust the PCA certificate but only for the company whose name is on the leaf certificate (for example, Intel for device drivers). This level trusts a certificate with a long validity period but only when combined with a trusted leaf certificate. | -| **FilePublisher** | This is a combination of the publisher file rule level and the SignedVersion rule level. Any signed file from the trusted publisher that is the specified version or newer is trusted. | -| **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product will have different hash values but typically the same signing certificate. Using this level, no policy update would be needed to run the new version of the application. However, leaf certificates have much shorter validity periods than PCA certificates, so additional administrative overhead is associated with updating the code integrity policy when these certificates expire. | -| **PcaCertificate** | Adds the highest certificate in the provided certificate chain to signers. This is typically one certificate below the root certificate, because the scan does not validate anything above the presented signature by going online or checking local root stores. | -| **RootCertificate** | Currently unsupported. | -| **WHQL** | Trusts binaries if they have been validated and signed by WHQL. This is primarily for kernel binaries. | -| **WHQLPublisher** | This is a combination of the WHQL and the CN on the leaf certificate and is primarily for kernel binaries. | -| **WHQLFilePublisher** | Specifies that the binaries are validated and signed by WHQL, with a specific publisher (WHQLPublisher), and that the binary is the specified version or newer. This is primarily for kernel binaries. | - -  +| Rule level | Description | +|----------- | ----------- | +| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. | +| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. | +| **SignedVersion** | This combines the publisher rule with a file version number. This option allows anything from the specified publisher, with a file version at or above the specified version number, to run. | +| **Publisher** | This is a combination of the PCA certificate and the common name (CN) on the leaf certificate. In the scenario that a PCA certificate is used to sign multiple companies’ applications (such as VeriSign), this rule level allows organizations to trust the PCA certificate but only for the company whose name is on the leaf certificate (for example, Intel for device drivers). This level trusts a certificate with a long validity period but only when combined with a trusted leaf certificate. | +| **FilePublisher** | This is a combination of the publisher file rule level and the SignedVersion rule level. Any signed file from the trusted publisher that is the specified version or newer is trusted. | +| **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product will have different hash values but typically the same signing certificate. Using this level, no policy update would be needed to run the new version of the application. However, leaf certificates have much shorter validity periods than PCA certificates, so additional administrative overhead is associated with updating the code integrity policy when these certificates expire. | +| **PcaCertificate** | Adds the highest certificate in the provided certificate chain to signers. This is typically one certificate below the root certificate, because the scan does not validate anything above the presented signature by going online or checking local root stores. | +| **RootCertificate** | Currently unsupported. | +| **WHQL** | Trusts binaries if they have been validated and signed by WHQL. This is primarily for kernel binaries. | +| **WHQLPublisher** | This is a combination of the WHQL and the CN on the leaf certificate and is primarily for kernel binaries. | +| **WHQLFilePublisher** | Specifies that the binaries are validated and signed by WHQL, with a specific publisher (WHQLPublisher), and that the binary is the specified version or newer. This is primarily for kernel binaries. | **Note**   When you create code integrity policies with the **New-CIPolicy** cmdlet, you can specify a primary file rule level by including the **–Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **–Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate. -  - -### - -**Create code integrity policies from golden PCs** +### Create code integrity policies from golden PCs The process to create a golden code integrity policy from a reference system is straightforward. This section outlines the process that is required to successfully create a code integrity policy with Windows PowerShell. First, for this example, you must initiate variables to be used during the creation process. Rather than using variables, you can simply use the full file paths in the command. Next, you create the code integrity policy by scanning the system for installed applications. When created, the policy file is converted to binary format so that Windows can consume its contents. **Note**   Before you begin this procedure, ensure that the reference PC is clean of viruses or malware. Each piece of installed software should be validated as trustworthy before you create this policy. Also, be sure that any software that you would like to be scanned is installed on the system before you create the code integrity policy. -  - To create a code integrity policy, copy each of the following commands into an elevated Windows PowerShell session, in order: 1. Initialize variables that you will use: @@ -1010,22 +917,16 @@ To create a code integrity policy, copy each of the following commands into an e `New-CIPolicy -Level PcaCertificate -FilePath $InitialCIPolicy –UserPEs 3> CIPolicyLog.txt ` - **Note**   - By specifying the *–UserPEs* parameter, rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. If you do not specify this parameter, use the following command to enable UMCI: + **Note**   + By specifying the *–UserPEs* parameter, rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. If you do not specify this parameter, use the following command to enable UMCI: `Set-RuleOption -Option 0 -FilePath $InitialCIPolicy` -   + **Note**   + You can add the *–Fallback* parameter to catch any applications not discovered using the primary file rule level specified by the *–Level* parameter. For more information about file rule level options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. - **Note**   - You can add the *–Fallback* parameter to catch any applications not discovered using the primary file rule level specified by the *–Level* parameter. For more information about file rule level options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. - -   - - **Note**   - If you would like to specify the code integrity policy scan to look only at a specific drive, you can do so by using the *–ScanPath* parameter. Without this parameter, as shown in the example, the entire system is scanned. - -   + **Note**   + If you would like to specify the code integrity policy scan to look only at a specific drive, you can do so by using the *–ScanPath* parameter. Without this parameter, as shown in the example, the entire system is scanned. 3. Convert the code integrity policy to a binary format: @@ -1034,57 +935,45 @@ To create a code integrity policy, copy each of the following commands into an e After you complete these steps, the Device Guard binary file (DeviceGuardPolicy.bin) and original .xml file (IntialScan.xml) will be available on your desktop. You can use the binary version as a code integrity policy or sign it for additional security. **Note**   -Microsoft recommends that you keep the original .xml file of the policy for use when you need to merge the code integrity policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge code integrity policies, see the [Merge code integrity policies](#merge-code-integrity) section. +Microsoft recommends that you keep the original .xml file of the policy for use when you need to merge the code integrity policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge code integrity policies, see the [Merge code integrity policies](#merge-code-integrity-policies) section. -  +Microsoft recommends that every code integrity policy be run in audit mode before being enforced. Doing so allows administrators to discover any issues with the policy without receiving error message dialog boxes. For information about how to audit a code integrity policy, see the [Audit code integrity policies](#audit-code-integrity-policies) section. -Microsoft recommends that every code integrity policy be run in audit mode before being enforced. Doing so allows administrators to discover any issues with the policy without receiving error message dialog boxes. For information about how to audit a code integrity policy, see the [Audit code integrity policies](#audit-code-integrity) section. - -### - -**Audit code integrity policies** +### Audit code integrity policies When code integrity policies are run in audit mode, it allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a code integrity policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the Applications and Services Logs\\Microsoft\\CodeIntegrity\\Operational event log. When these logged binaries have been validated, they can easily be added to a new code integrity policy. When the new exception policy is created, you can merge it with your existing code integrity policies. **Note**   -Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see the [Create a code integrity policy](#create-code-golden) section for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format. - -  +Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see the [Create a code integrity policy](#create-a-code-integrity-policy) section for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format. To audit a code integrity policy with local policy: -1. Copy the DeviceGuardPolicy.bin file that you created in the [Create code integrity policies from golden PCs](#create-code-golden) section to C:\\Windows\\System32\\CodeIntegrity. +1. Copy the DeviceGuardPolicy.bin file that you created in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section to C:\\Windows\\System32\\CodeIntegrity. 2. On the system you want to run in audit mode, open the Local Group Policy Editor by running **GPEdit.msc**. 3. Navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard, and then select **Deploy Code Integrity Policy**. Enable this setting by using the file path C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 22. - **Note**   - *DeviceGuardPolicy.bin* is not a required policy name. This name was simply used in the [Create code integrity policies from golden PCs](#create-code-golden) section and so was used here. Also, this policy file does not need to be copied to every system. Alternatively, you can copy the code integrity policies to a file share to which all computer accounts have access. + **Note**   + *DeviceGuardPolicy.bin* is not a required policy name. This name was simply used in the [Create code integrity policies from golden PCs](#create-code-golden) section and so was used here. Also, this policy file does not need to be copied to every system. Alternatively, you can copy the code integrity policies to a file share to which all computer accounts have access. -   + **Note**   + Any policy you select here is converted to SIPolicy.p7b when it is deployed to the individual computers. - **Note**   - Any policy you select here is converted to SIPolicy.p7b when it is deployed to the individual computers. + ![figure 22](images/dg-fig22-deploycode.png) -   + Figure 22. Deploy your code integrity policy - ![figure 22](images/dg-fig22-deploycode.png) - - Figure 22. Deploy your code integrity policy - - **Note**   - You may have noticed that the GPO setting references a .p7b file and this policy uses a .bin file. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 computers. Microsoft recommends that you make your code integrity policies friendly and allow the system to convert the policy names for you. By doing this, it ensures that the policies are easily distinguishable when viewed in a share or any other central repository. - -   + **Note**   + You may have noticed that the GPO setting references a .p7b file and this policy uses a .bin file. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 computers. Microsoft recommends that you make your code integrity policies friendly and allow the system to convert the policy names for you. By doing this, it ensures that the policies are easily distinguishable when viewed in a share or any other central repository. 4. Restart reference system for the code integrity policy to take effect. 5. Monitor the CodeIntegrity event log. While in audit mode, any exception to the deployed code integrity policy will be logged in the Applications and Services Logs\\Microsoft\\CodeIntegrity\\Operational event log, as shown in Figure 23. - ![figure 23](images/dg-fig23-exceptionstocode.png) + ![figure 23](images/dg-fig23-exceptionstocode.png) - Figure 23. Exceptions to the deployed code integrity policy + Figure 23. Exceptions to the deployed code integrity policy 6. Validate any code integrity policy exceptions. @@ -1097,11 +986,7 @@ To audit a code integrity policy with local policy: **Note**   An alternative method to test a policy is to rename the test file to SIPolicy.p7b and drop it into C:\\Windows\\System32\\CodeIntegrity, rather than deploy it with the local machine policy. -  - -### - -**Create an audit code integrity policy** +### Create an audit code integrity policy When you run code integrity policies in audit mode, validate any exceptions and determine whether you will need to add them to the code integrity policy you want to audit. Use the system as you normally would to ensure that any use exceptions are logged. When you are ready to create a code integrity policy from the auditing events, complete the following steps in an elevated Windows PowerShell session: @@ -1113,7 +998,7 @@ When you run code integrity policies in audit mode, validate any exceptions and 2. Analyze audit results. - Before you create a code integrity policy from audit events, Microsoft recommends that each exception be analyzed, as discussed in steps 5 and 6 of the [Audit code integrity policies](#audit-code-integrity) section. + Before you create a code integrity policy from audit events, Microsoft recommends that each exception be analyzed, as discussed in steps 5 and 6 of the [Audit code integrity policies](#audit-code-integrity-policies) section. 3. Generate a new code integrity policy from logged audit events: @@ -1122,25 +1007,17 @@ When you run code integrity policies in audit mode, validate any exceptions and **Note**   When you create policies from audit events, you should carefully consider the file rule level that you select to trust. In this example, you use the Hash rule level, which should be used as a last resort. -  - -After you complete these steps, the Device Guard audit policy .xml file (DeviceGuardAuditPolicy.xml) will be available on your desktop. You can now use this file to update the existing code integrity policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing code integrity policy, see the [Merge code integrity policies](#merge-code-integrity) section. +After you complete these steps, the Device Guard audit policy .xml file (DeviceGuardAuditPolicy.xml) will be available on your desktop. You can now use this file to update the existing code integrity policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing code integrity policy, see the [Merge code integrity policies](#merge-code-integrity-policies) section. **Note**   -You may have noticed that you did not generate a binary version of this policy as you did in the [Create code integrity policies from golden PCs](#create-code-golden) section. This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies. +You may have noticed that you did not generate a binary version of this policy as you did in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section. This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies. -  - -### - -**Merge code integrity policies** +### Merge code integrity policies When you develop code integrity policies, you will occasionally need to merge two policies. A common example is when a code integrity policy is initially created and audited. Another example is when you create a single master policy by using multiple code integrity policies previously created from golden PCs. Because each Windows 10 machine can have only one code integrity policy, it is important to properly maintain these policies. In this example, audit events have been saved into a secondary code integrity policy that you then merge with the initial code integrity policy. **Note**   -The following example uses the code integrity policy .xml files that you created in the [Create code integrity policies from golden PCs](#create-code-golden) and [Audit code integrity policies](#audit-code-integrity) sections. You can follow this process, however, with any two code integrity policies you would like to combine. - -  +The following example uses the code integrity policy .xml files that you created in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) and [Audit code integrity policies](#audit-code-integrity-policies) sections. You can follow this process, however, with any two code integrity policies you would like to combine. To merge two code integrity policies, complete the following steps in an elevated Windows PowerShell session: @@ -1178,8 +1055,6 @@ Every code integrity policy is created with audit mode enabled. After you have s **Note**   Every code integrity policy should be tested in audit mode first. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity) section. -  - 1. Initialize the variables that will be used: `$CIPolicyPath=$env:userprofile+"\Desktop\"` @@ -1217,13 +1092,13 @@ Every code integrity policy should be tested in audit mode first. For informatio   -Now that this policy has been enforced, you can deploy it to your test machines. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in the [Deploy and manage code integrity policies with Group Policy](#deploy-manage-code-gp) section, or through client management software by following the instructions in the section “Deploying and managing code integrity policies by using Microsoft client management solutions.” +Now that this policy has been enforced, you can deploy it to your test machines. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in the [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy) section, or through client management software by following the instructions in the section “Deploying and managing code integrity policies by using Microsoft client management solutions.” **Signing code integrity policies with SignTool.exe** -Signed code integrity policies give organizations the highest level of malware protection available in Windows 10. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the machine. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed code integrity policies than unsigned ones. Before you sign and deploy a signed code integrity policy, Microsoft recommends that you audit the policy to discover any blocked applications that should be allowed to run. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity) section. +Signed code integrity policies give organizations the highest level of malware protection available in Windows 10. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the machine. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed code integrity policies than unsigned ones. Before you sign and deploy a signed code integrity policy, Microsoft recommends that you audit the policy to discover any blocked applications that should be allowed to run. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section. -Signing code integrity policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward. If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Create a Device Guard code signing certificate](#create-dg-code) to create one with your on-premises CA. Before signing code integrity policies for the first time, be sure to enable rule options 9 and 10 to leave troubleshooting options available to test administrators. When validated and ready for enterprise deployment, you can remove these options. For information about how to add rule options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. +Signing code integrity policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward. If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) to create one with your on-premises CA. Before signing code integrity policies for the first time, be sure to enable rule options 9 and 10 to leave troubleshooting options available to test administrators. When validated and ready for enterprise deployment, you can remove these options. For information about how to add rule options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. **Note**   Signing code integrity policies is the last step in a code integrity deployment. It is much more difficult to remove a signed code integrity policy than an unsigned one. Before you deploy a signed code integrity policy to deployed client computers, be sure to test its effect on a subset of machines. @@ -1236,8 +1111,6 @@ To sign a code integrity policy with SignTool.exe, you need the following compon - An internal CA code signing certificate or a purchased code signing certificate -  - If you do not have a code signing certificate, see the [Create a Device Guard code signing certificate](#create-dg-code) section for instructions on how to create one. If you use an alternate certificate or code integrity policy, be sure to update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing code integrity policy, copy each of the following commands into an elevated Windows PowerShell session: 1. Initialize the variables that will be used: @@ -1247,8 +1120,6 @@ If you do not have a code signing certificate, see the [Create a Device Guard co **Note**   This example uses the code integrity policy that you created in the [Create code integrity policies from golden PCs](#create-code-golden) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. -   - 2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the code integrity policy into the signing user’s personal store on the machine that will be doing the signing. In this example, you use the certificate that was created in the [Create a Device Guard code signing certificate](#create-dg-code) section. 3. Export the .cer code signing certificate. After the code signing certificate has been imported, export the .cer version to your desktop. This version will be added to the policy so that it can be updated later. @@ -1261,15 +1132,11 @@ If you do not have a code signing certificate, see the [Create a Device Guard co `Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update` - **Note**   - *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3. - -   - - **Note**   - Adding update signers is crucial to being able to modify or disable this policy in the future. For more information about how to disable signed code integrity policies, see the [Disable signed code integrity policies within Windows](#disable-signed-code) section. - -   + **Note**   + *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3. + + **Note**   + Adding update signers is crucial to being able to modify or disable this policy in the future. For more information about how to disable signed code integrity policies, see the [Disable signed code integrity policies within Windows](#disable-signed-code) section. 6. Remove the unsigned policy rule option: @@ -1286,13 +1153,9 @@ If you do not have a code signing certificate, see the [Create a Device Guard co **Note**   The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the code integrity policy. You should import this certificate to your personal certificate store on the machine you use to sign the policy. -   +9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy code integrity policies, see the [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy) section. -9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy code integrity policies, see the [Deploy and manage code integrity policies with Group Policy](#deploy-manage-code-gp) section. - -### - -**Disable unsigned code integrity policies** +### Disable unsigned code integrity policies There may come a time when an administrator wants to disable a code integrity policy. For unsigned code integrity policies, this process is simple. Depending on how the code integrity policy was deployed, unsigned policies can be disabled in one of two ways. If a code integrity policy was manually enabled and copied to the code integrity folder location, simply delete the file and restart the machine. The following locations can contain executing code integrity policies: @@ -1302,9 +1165,7 @@ There may come a time when an administrator wants to disable a code integrity po If the code integrity policy was deployed by using Group Policy, the GPO that is currently enabling and deploying the policy must be set to disabled. Then, the code integrity policy will be disabled on the next computer restart. -### - -**Disable signed code integrity policies within Windows** +### Disable signed code integrity policies within Windows Signed policies protect Windows from administrative manipulation as well as malware that has gained administrative-level access to the system. For this reason, signed code integrity policies are intentionally more difficult to remove than unsigned policies. They inherently protect themselves from modification or removal and therefore are difficult even for administrators to remove successfully. If the signed code integrity policy is manually enabled and copied to the CodeIntegrity folder, to remove the policy, you must complete the following steps: @@ -1315,15 +1176,12 @@ For reference, signed code integrity policies should be replaced and removed fro - <OS Volume>\\Windows\\System32\\CodeIntegrity\\ -  1. Replace the existing policy with another signed policy that has the **6 Enabled: Unsigned System Integrity Policy** rule option enabled. **Note**   To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace. -   - 2. Restart the client computer. 3. Verify that the new signed policy exists on the client. @@ -1331,8 +1189,6 @@ For reference, signed code integrity policies should be replaced and removed fro **Note**   If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. -   - 4. Delete the new policy. 5. Restart the client computer. @@ -1353,17 +1209,13 @@ If the signed code integrity policy has been deployed using by using Group Polic **Note**   If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. -   - 4. Set the GPO to disabled. 5. Delete the new policy. 6. Restart the client computer. -### - -**Disable signed code integrity policies within the BIOS** +### Disable signed code integrity policies within the BIOS There may be a time when signed code integrity policies cause a boot failure. Because code integrity policies enforce kernel mode drivers, it is important that they be thoroughly tested on each software and hardware configuration before being enforced and signed. Signed code integrity policies are validated in the pre-boot sequence by using Secure Boot. When you disable the Secure Boot feature in the BIOS, and then delete the file from the following locations on the operating system disk, it allows the system to boot into Windows: @@ -1378,15 +1230,11 @@ There may be a time when signed code integrity policies cause a boot failure. Be Code integrity policies can easily be deployed and managed with Group Policy. A Device Guard administrative template will be available in Windows Server 2016 that allows you to simplify deployment of Device Guard hardware-based security features and code integrity policies. The following procedure walks you through how to deploy a code integrity policy called **DeviceGuardPolicy.bin** to a test OU called *DG Enabled PCs* by using a GPO called **Contoso GPO Test**. **Note**   -This walkthrough requires that you have previously created a code integrity policy and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create a code integrity policy, see the [Create code integrity polices from golden PCs](#create-code-golden) section. - -  +This walkthrough requires that you have previously created a code integrity policy and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create a code integrity policy, see the [Create code integrity polices from golden PCs](#create-code-integrity-polices-from-golden-pcs) section. **Note**   Signed code integrity policies can cause boot failures when deployed. Microsoft recommends that signed code integrity policies be thoroughly tested on each hardware platform before enterprise deployment. -  - To deploy and manage a code integrity policy with Group Policy: 1. On a domain controller on a client computer on which RSAT is installed, open the GPMC by running **GPMC.MSC** or searching for “Group Policy Management” in Windows Search. @@ -1396,11 +1244,9 @@ To deploy and manage a code integrity policy with Group Policy: **Note**   The DG Enabled PCs OU is just an example of where to link the test GPO created in this section. Any OU name can be used. Also, security group filtering is an option when considering policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise) section. -   + ![figure 24](images/dg-fig24-creategpo.png) - ![figure 24](images/dg-fig24-creategpo.png) - - Figure 24. Create a GPO + Figure 24. Create a GPO 3. Name new GPO **Contoso GPO Test**. This example uses Contoso GPO Test as the name of the GPO. You can choose any name that you prefer for this example. @@ -1426,12 +1272,9 @@ To deploy and manage a code integrity policy with Group Policy: **Note**   You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 client computers. Make your code integrity policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. -   - -7. Close the Group Policy Management Editor, and then restart the Windows 10 test machine. Restarting the client computer updates the code integrity policy. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity)section. - -## Create a Device Guard code signing certificate +7. Close the Group Policy Management Editor, and then restart the Windows 10 test machine. Restarting the client computer updates the code integrity policy. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies)section. +## Create a Device Guard code signing certificate To sign catalog files or code integrity policies internally, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip these steps and proceed to the sections that outline the steps to sign catalog files and code integrity policies. If you have not purchased a certificate but have an internal CA, complete these steps to create a code signing certificate: @@ -1500,8 +1343,6 @@ Now that the template is available to be issued, you must request one from the W **Note**   If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client. -  - This certificate must be installed in the user’s personal store on the computer that will be signing the catalog files and code integrity policies. If the signing is going to be taking place on the machine on which you just requested the certificate, exporting the certificate to a .pfx file will not be required because it already exists in your personal store. If you are signing on another computer, you will need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps: 1. Right-click the certificate, point to **All Tasks**, and then click **Export**. @@ -1517,23 +1358,12 @@ When the certificate has been exported, import it into the personal store for th ## Related topics -[AppLocker overview](http://go.microsoft.com/fwlink/p/?LinkId=624172) +[AppLocker overview](applocker-overview.md) [Code integrity](http://go.microsoft.com/fwlink/p/?LinkId=624173) -[Credential guard](http://go.microsoft.com/fwlink/p/?LinkId=624529) - -[Device Guard certification and compliance](http://go.microsoft.com/fwlink/p/?LinkId=624840) +[Credential guard](credential-guard.md) [Driver compatibility with Device Guard in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624843) [Dropping the Hammer Down on Malware Threats with Windows 10’s Device Guard](http://go.microsoft.com/fwlink/p/?LinkId=624844) - -  - -  - - - - - From c07cc2be53f666db57a48fe76450b57678c47c66 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 4 May 2016 20:59:40 -0700 Subject: [PATCH 18/38] Edits --- windows/plan/deploy-windows-10-in-a-school.md | 161 +++++++++--------- 1 file changed, 83 insertions(+), 78 deletions(-) diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index 3627aaab6b..b5678c5efa 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -38,29 +38,25 @@ Figure 2 shows the classroom configuration this guide uses. *Figure 2. Typical classroom configuration in a school* This school configuration has the following characteristics: -