From 0ad9c266c0e21d13a1c984074c1620cb6a25add1 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 18 May 2017 09:00:17 -0700 Subject: [PATCH 01/62] Adding updated content --- .../enlightened-microsoft-apps-and-wip.md | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 77df2d4e51..4992f86d22 100644 --- a/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -42,9 +42,13 @@ Microsoft has made a concerted effort to enlighten several of our more popular a - Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar -- Microsoft Photos +- Office 365 ProPlus apps, including Word, Excel, PowerPoint, OneNote, and Outlook - +- OneDrive app + +- OneDrive sync client (OneDrive.exe, the next generation sync client) + +- Microsoft Photos - Groove Music @@ -58,6 +62,12 @@ Microsoft has made a concerted effort to enlighten several of our more popular a - Microsoft Remote Desktop +## List of unenlightened, WIP Work Only, supported Microsoft apps +Microsoft still has apps that are unenlightened, but supported as "WIP Work Only" apps. These are apps that while not enlightened, have been tested and deemed safe for use in an enterprise with WIP. + +- Skype for Business + + ## Adding enlightened Microsoft apps to the allowed apps list You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager. @@ -70,12 +80,14 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li |PowerPoint Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Office.PowerPoint
**App Type:** Universal app | |OneNote |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Office.OneNote
**App Type:** Universal app | |Outlook Mail and Calendar |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** microsoft.windowscommunicationsapps
**App Type:** Universal app | +|Office 365 ProPlus | |Microsoft Photos |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Windows.Photos
**App Type:** Universal app | |Groove Music |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.ZuneMusic
**App Type:** Universal app | |Microsoft Movies & TV |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.ZuneVideo
**App Type:** Universal app | |Microsoft Messaging |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Messaging
**App Type:** Universal app | |IE11 |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** iexplore.exe
**App Type:** Desktop app | -|Microsoft OneDrive |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** onedrive.exe
**App Type:** Desktop app| +|OneDrive Sync Client |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** onedrive.exe
**App Type:** Desktop app| +|OneDrive app |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Microsoftskydrive
**Product version:** 17.21.0.0 (and above) **App Type:** Universal app| |Notepad |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** notepad.exe
**App Type:** Desktop app | |Microsoft Paint |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** mspaint.exe
**App Type:** Desktop app | |Microsoft Remote Desktop |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** mstsc.exe
**App Type:** Desktop app | From 54a65c4a74c0e1de96ca1adaa420fe7a8bf84a2c Mon Sep 17 00:00:00 2001 From: John Tobin Date: Wed, 24 May 2017 09:50:28 -0700 Subject: [PATCH 02/62] Wifi/VPN considerations --- .../credential-guard/credential-guard-considerations.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/access-protection/credential-guard/credential-guard-considerations.md b/windows/access-protection/credential-guard/credential-guard-considerations.md index 0adc21dd7f..1663325a24 100644 --- a/windows/access-protection/credential-guard/credential-guard-considerations.md +++ b/windows/access-protection/credential-guard/credential-guard-considerations.md @@ -28,9 +28,9 @@ in the Deep Dive into Credential Guard video series. - You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials. - Credential Guard uses hardware security so some features, such as Windows To Go, are not supported. -## NTLM and CHAP Considerations +## Wi-fi and VPN Considerations +When you enable Credential Guard, you can no longer use NTLM v1 authentication. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as for NTLMv1. For WiFi and VPN connections, Microsoft recommends that organizations move from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS. -When you enable Credential Guard, you can no longer use NTLM v1 authentication. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as NTLMv1. We recommend that organizations use certificated-based authentication for WiFi and VPN connections. ## Kerberos Considerations From f41aefc433d60c4bd5fee740f4539e45c5407cb0 Mon Sep 17 00:00:00 2001 From: Celeste de Guzman Date: Wed, 7 Jun 2017 12:33:46 -0700 Subject: [PATCH 03/62] updated topics for accessibility statements, per CELA --- .../windows/configure-windows-for-education.md | 4 ++++ .../windows/edu-deployment-recommendations.md | 6 +++--- education/windows/switch-to-pro-education.md | 18 ++++++++---------- 3 files changed, 15 insertions(+), 13 deletions(-) diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index 897f7df8c4..8b976913f0 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -16,6 +16,8 @@ author: CelesteDG Privacy is important to us, we want to provide you with ways to customize the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, for usage with [education editions of Windows 10](windows-editions-for-education-customers.md) in education environments. To learn more about Microsoft’s commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). +We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store for Education, and use devices running Windows 10 S, will be able to configure the device at no additional charge to Windows 10 Pro Education. To learn more about the steps to configure this, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md). + In Windows 10, version 1703 (Creators Update), it is straightforward to configure Windows to be education ready. | Area | How to configure | What this does | Notes | @@ -48,6 +50,8 @@ It is easy to be education ready when using Microsoft products. We recommend the * Manually Azure AD join the PC during the Windows device setup experience. 3. Enroll the PCs in MDM. * If you have activated Intune for Education in your Azure AD tenant, enrollment will happen automatically when the PC is joined to Azure AD. Intune for Education will automatically set **SetEduPolicies** to True and **AllowCortana** to False. + 4. Ensure that needed assistive technology apps can be used. + * If you have students or school personnel who rely on assistive technology apps that are not available in the Microsoft Store for Education, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md) for more info. 4. Distribute the PCs to students. diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index ceecbfb175..e3e6859327 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -15,17 +15,17 @@ ms.prod: W10 - Windows 10 -Your privacy is important to us, so we want to provide you with ways to customize the OS privacy settings, as well as some of the apps, so that you can choose what information is shared with Microsoft. To learn more about Microsoft’s commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). +Your privacy is important to us, so we want to provide you with ways to customize the OS privacy settings, as well as some of the apps, so that you can choose what information is shared with Microsoft. To learn more about Microsoft’s commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). The following sections provide some best practices and specific privacy settings we’d like you to be aware of. Also see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md) for more information about ways to customize the OS diagnostic data, consumer experiences, Cortana, and search. -Here are some best practices and specific privacy settings we’d like you to be aware of. Also see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md) for more information about ways to customize the OS diagnostic data, consumer experiences, Cortana, and search. +We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store for Education, and use devices running Windows 10 S, will be able to configure the device at no additional charge to Windows 10 Pro Education. To learn more about the steps to configure this, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md). ## Deployment best practices Keep these best practices in mind when deploying any edition of Windows 10 in schools or districts: * A Microsoft account is only intended for consumer services. Enterprises and educational institutions should use enterprise versions where possible, such as Skype for Business, OneDrive for Business, and so on. For schools, consider using mobile device management (MDM) or Group Policy to block students from adding a Microsoft account as a secondary account. - * If schools allow the use of personal accounts by their students to access personal services, schools should be aware that these accounts belong to individuals, not the school. * IT administrators, school officials, and teachers should also consider ratings when picking apps from the Windows Store. +* If you have students or school personnel who rely on assistive technology apps that are not available in the Microsoft Store for Education, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md) for more info. ## Windows 10 Contacts privacy settings diff --git a/education/windows/switch-to-pro-education.md b/education/windows/switch-to-pro-education.md index a42e464435..b603d144c5 100644 --- a/education/windows/switch-to-pro-education.md +++ b/education/windows/switch-to-pro-education.md @@ -41,30 +41,28 @@ There are two ways to switch from Windows 10 S to Windows 10 Pro Education, outl 1. **Bulk switch through Microsoft Store for Education** - In this scenario, the global admin for the Azure AD education tenant can use Microsoft Store to switch all Windows 10 S devices on the tenant to Windows 10 Pro Education. See [Switch using Microsoft Store for Education](#switch-using-microsoft-store-for-education) for details on how to do this. + In this scenario, the global admin for the Azure AD education tenant can use Microsoft Store to switch all Windows 10 S devices on the tenant to Windows 10 Pro Education. + + See [Switch using Microsoft Store for Education](#switch-using-microsoft-store-for-education) for details on how to do this. 2. **Asynchronous switch** In this scenario, the global admin must acquire the necessary keys and then select a method for key distribution. **Key acquisition options:** - - - Volume Licensing customers - For schools with active Microsoft Volume Licensing agreements, global admins can obtain free MAK keys for Windows 10 Pro Education. - + - **Volume Licensing customers** - For schools with active Microsoft Volume Licensing agreements, global admins can obtain free MAK keys for Windows 10 Pro Education. > [!NOTE] > Windows 10 S is a Qualified OS (QOS) for Academic Volume Licensing only. - - - Non-Volume Licensing customers - For schools without an active Microsoft Volume Licensing agreement, the global admin can contact CSS, fill out a form and provide a proof of purchase to receive MAK keys for Windows 10 Pro Education. + - **Non-Volume Licensing customers** - For schools without an active Microsoft Volume Licensing agreement, the global admin can contact CSS, fill out a form and provide a proof of purchase to receive MAK keys for Windows 10 Pro Education. **Key distribution options:** - - - Bulk key distribution - You can apply MAK keys to switch the operating system on select devices or groups of devices using one of these methods: + You can find step-by-step info on how to use each of the options described here in [Switch options from Windows 10 S to Windows 10 Pro Education](#switch-options-from-windows-10-s-to-windows-10-pro-education). + - **Bulk key distribution** - You can apply MAK keys to switch the operating system on select devices or groups of devices using one of these methods: - Use Microsoft Intune for Education. See [Switch using Intune for Education](#switch-using-intune-for-education) for details on how to do this. - Use Windows Configuration Designer to create a provisioning package that will provision the switch on the device(s). See [Switch using Windows Configuration Designer](#switch-using-windows-configuration-designer) for details on how to do this. - Use the mobile device management (MDM) policy, **UpgradeEditionWithProductKey**. See [Switch using MDM](#switch-using-mdm) for details on how to do this. - Use scripting. See [Switch using scripting](#switch-using-scripting) for details on how to do this. - - - Manual key entry - You can also manually apply the MAK key using one of these methods: + - **Manual key entry** - You can also manually apply the MAK key using one of these methods: - Enter the MAK key in the Windows **Settings > Activation** page. See [Switch using the Activation page](#switch-using-the-activation-page) for details on how to do this. - Install with a media and key through Windows setup. We don't recommend this option due to the potential for multi-reboot requirements. From ce772bbf2d967a4ab2b8d22947200ec5dae78ca8 Mon Sep 17 00:00:00 2001 From: Celeste de Guzman Date: Wed, 7 Jun 2017 13:13:22 -0700 Subject: [PATCH 04/62] updated --- education/windows/switch-to-pro-education.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/education/windows/switch-to-pro-education.md b/education/windows/switch-to-pro-education.md index b603d144c5..7c15654347 100644 --- a/education/windows/switch-to-pro-education.md +++ b/education/windows/switch-to-pro-education.md @@ -51,12 +51,16 @@ There are two ways to switch from Windows 10 S to Windows 10 Pro Education, outl **Key acquisition options:** - **Volume Licensing customers** - For schools with active Microsoft Volume Licensing agreements, global admins can obtain free MAK keys for Windows 10 Pro Education. + > [!NOTE] > Windows 10 S is a Qualified OS (QOS) for Academic Volume Licensing only. + - **Non-Volume Licensing customers** - For schools without an active Microsoft Volume Licensing agreement, the global admin can contact CSS, fill out a form and provide a proof of purchase to receive MAK keys for Windows 10 Pro Education. - **Key distribution options:** - You can find step-by-step info on how to use each of the options described here in [Switch options from Windows 10 S to Windows 10 Pro Education](#switch-options-from-windows-10-s-to-windows-10-pro-education). + **Key distribution options:** + + You can find step-by-step info on how to use each of the options described here in [Switch options from Windows 10 S to Windows 10 Pro Education](#switch-options-from-windows-10-s-to-windows-10-pro-education). + - **Bulk key distribution** - You can apply MAK keys to switch the operating system on select devices or groups of devices using one of these methods: - Use Microsoft Intune for Education. See [Switch using Intune for Education](#switch-using-intune-for-education) for details on how to do this. - Use Windows Configuration Designer to create a provisioning package that will provision the switch on the device(s). See [Switch using Windows Configuration Designer](#switch-using-windows-configuration-designer) for details on how to do this. From 85a265297d3fd3b144f5062c201174778a5d9eba Mon Sep 17 00:00:00 2001 From: seankru Date: Wed, 7 Jun 2017 17:17:47 -0700 Subject: [PATCH 05/62] Update Office 365 ProPlus row Includes link to O365 ProPlus Applocker policy files --- .../enlightened-microsoft-apps-and-wip.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 4992f86d22..82ecd32cc3 100644 --- a/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -80,7 +80,7 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li |PowerPoint Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Office.PowerPoint
**App Type:** Universal app | |OneNote |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Office.OneNote
**App Type:** Universal app | |Outlook Mail and Calendar |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** microsoft.windowscommunicationsapps
**App Type:** Universal app | -|Office 365 ProPlus | +|Office 365 ProPlus |**Note:** Office 365 ProPlus applications are configured as a suite. You should use the linked Allow and Exempt AppLocker Policy files to enable Office 365 ProPlus for WIP. It is not recommended to configure Office with individual Path or Publisher rules
**Link:** [O365 ProPlus - WIP Enterprise AppLocker Policy Files (ZIP)](http://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) | |Microsoft Photos |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Windows.Photos
**App Type:** Universal app | |Groove Music |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.ZuneMusic
**App Type:** Universal app | |Microsoft Movies & TV |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.ZuneVideo
**App Type:** Universal app | @@ -93,4 +93,4 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li |Microsoft Remote Desktop |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** mstsc.exe
**App Type:** Desktop app | >[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). From e8c576d247d6974a48d4191cf09c31264832be91 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 8 Jun 2017 11:26:22 -0700 Subject: [PATCH 06/62] stage whiteboard mdm settings --- devices/surface-hub/TOC.md | 1 + .../surface-hub/change-history-surface-hub.md | 5 +++- ...anage-settings-with-mdm-for-surface-hub.md | 27 +++++++++++++++++++ devices/surface-hub/manage-surface-hub.md | 1 + .../surface-hub/whiteboard-collaboration.md | 15 +++++++++++ 5 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 devices/surface-hub/whiteboard-collaboration.md diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md index 8e368555cc..240bcc485e 100644 --- a/devices/surface-hub/TOC.md +++ b/devices/surface-hub/TOC.md @@ -31,6 +31,7 @@ #### [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md) #### [Wireless network management](wireless-network-management-for-surface-hub.md) ### [Install apps on your Surface Hub](install-apps-on-surface-hub.md) +### [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) ### [End a Surface Hub meeting with End session](i-am-done-finishing-your-surface-hub-meeting.md) ### [Save your BitLocker key](save-bitlocker-key-surface-hub.md) ### [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index 598c4e9807..9c7d2a2e12 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -14,8 +14,11 @@ localizationpriority: medium This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md). +## June 2017 - +| New or changed topic | Description | +| --- | --- | +| [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | New | ## RELEASE: Windows 10, version 1703 diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index d50f750484..1e19d74bd8 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -178,6 +178,33 @@ The following tables include info on Windows 10 settings that have been validate | Set Network proxy | Use to configure a proxy server for ethernet and Wi-Fi connections. | [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. +### Whiteboard collaboration settings + +MDM settings for Whiteboard collaboration use the **AppManagement/AppStore** node of the [EnterpriseModernAppManagement CSP](https://docs.microsoft.com/windows/client-management/mdm/enterprisemodernappmanagement-csp#appmanagement-appstore) to configure an **AppSettingPolicy**. + +The value for each setting can be **True** or **False**. The default value for each setting is **False**. + + +| Setting | Details | OMA URI | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML*? | +| --- | ---- | --- |---- | --- | --- | +| Enable sign-in | Users can sign in and authenticate | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/EnableSignIn | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable sign-in | Users are unable to sign in and access collaboration or education features | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableSignIn + | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable Collaboration | Users can sign in but not create or join collaborative sessions | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableCollaboration + | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable Sharing | Hide entry points for the Share button, hiding export in the Share charm and Collaboration | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableSharing + | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable Export | Users cannot send whiteboards using email, thumb drives, or other mechanisms through the Share charm | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableExport | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Enable Ink to Shape | **Ink to Shape** is on by default when users open Whiteboard | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/EnableInkShapes + | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable Ink to Shape | **Ink to Shape** is off by default when users open Whiteboard | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableInkShapes + | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Enable Ink to Table | **Ink to Table** is on by default when users open Whiteboard | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/EnableInkTables + | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable Search | Hide entry points for Bing Search | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableSearch + | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. + ### Generate OMA URIs for settings You need to use a setting’s OMA URI to create a custom policy in Intune, or a custom setting in System Center Configuration Manager. diff --git a/devices/surface-hub/manage-surface-hub.md b/devices/surface-hub/manage-surface-hub.md index 56340d14d0..2116519048 100644 --- a/devices/surface-hub/manage-surface-hub.md +++ b/devices/surface-hub/manage-surface-hub.md @@ -30,6 +30,7 @@ Learn about managing and updating Surface Hub. | [Remote Surface Hub management](remote-surface-hub-management.md) |Topics related to managing your Surface Hub remotely. Include install apps, managing settings with MDM and monitoring with Operations Management Suite. | | [Manage Surface Hub settings](manage-surface-hub-settings.md) |Topics related to managing Surface Hub settings: accessibility, device account, device reset, fully qualified domain name, Windows Update settings, and wireless network | | [Install apps on your Surface Hub]( https://technet.microsoft.com/itpro/surface-hub/install-apps-on-surface-hub) | Admins can install apps can from either the Microsoft Store or the Microsoft Store for Business.| +| [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Microsoft Whiteboard’s latest update includes the capability for two Surface Hubs to collaborate in real time on the same board. | | [End a meeting with End session](https://technet.microsoft.com/itpro/surface-hub/i-am-done-finishing-your-surface-hub-meeting) | At the end of a meeting, users can tap **End session** to clean up any sensitive data and prepare the device for the next meeting.| | [Save your BitLocker key](https://technet.microsoft.com/itpro/surface-hub/save-bitlocker-key-surface-hub) | Every Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys.| | [Connect other devices and display with Surface Hub](https://technet.microsoft.com/itpro/surface-hub/connect-and-display-with-surface-hub) | You can connect other device to your Surface Hub to display content.| diff --git a/devices/surface-hub/whiteboard-collaboration.md b/devices/surface-hub/whiteboard-collaboration.md new file mode 100644 index 0000000000..5e12dc7d7e --- /dev/null +++ b/devices/surface-hub/whiteboard-collaboration.md @@ -0,0 +1,15 @@ +--- +title: Set up and use Whiteboard to Whiteboard collaboration +description: Microsoft Whiteboard’s latest update includes the capability for two Surface Hubs to collaborate in real time on the same board. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: surfacehub +author: jdeckerms +localizationpriority: medium +--- + +# Set up and use Whiteboard to Whiteboard collaboration (Surface Hub) + + + From 0530ff30fac21b8c9872624ee57b8c15371904e5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 8 Jun 2017 11:38:33 -0700 Subject: [PATCH 07/62] revise table --- ...anage-settings-with-mdm-for-surface-hub.md | 27 ++++++++----------- 1 file changed, 11 insertions(+), 16 deletions(-) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 1e19d74bd8..f7b702fa71 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -184,25 +184,20 @@ MDM settings for Whiteboard collaboration use the **AppManagement/AppStore** nod The value for each setting can be **True** or **False**. The default value for each setting is **False**. +The OMA URI for each setting consists of `./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/` and the string from the **OMA URI** column in the table. For example, the full OMA URI for **Enable sign-in** is `./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/EnableSignIn`. + | Setting | Details | OMA URI | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML*? | | --- | ---- | --- |---- | --- | --- | -| Enable sign-in | Users can sign in and authenticate | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/EnableSignIn | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable sign-in | Users are unable to sign in and access collaboration or education features | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableSignIn - | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable Collaboration | Users can sign in but not create or join collaborative sessions | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableCollaboration - | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable Sharing | Hide entry points for the Share button, hiding export in the Share charm and Collaboration | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableSharing - | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable Export | Users cannot send whiteboards using email, thumb drives, or other mechanisms through the Share charm | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableExport | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Enable Ink to Shape | **Ink to Shape** is on by default when users open Whiteboard | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/EnableInkShapes - | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable Ink to Shape | **Ink to Shape** is off by default when users open Whiteboard | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableInkShapes - | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Enable Ink to Table | **Ink to Table** is on by default when users open Whiteboard | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/EnableInkTables - | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable Search | Hide entry points for Bing Search | ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/DisableSearch - | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Enable sign-in | Users can sign in and authenticate | EnableSignIn | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable sign-in | Users are unable to sign in and access collaboration or education features | DisableSignIn | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable Collaboration | Users can sign in but not create or join collaborative sessions | DisableCollaboration | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable Sharing | Hide entry points for the Share button, hiding export in the Share charm and Collaboration | DisableSharing | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable Export | Users cannot send whiteboards using email, thumb drives, or other mechanisms through the Share charm | DisableExport | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Enable Ink to Shape | **Ink to Shape** is on by default when users open Whiteboard | EnableInkShapes | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable Ink to Shape | **Ink to Shape** is off by default when users open Whiteboard | DisableInkShapes | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Enable Ink to Table | **Ink to Table** is on by default when users open Whiteboard | EnableInkTables | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Disable Search | Hide entry points for Bing Search | DisableSearch | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. ### Generate OMA URIs for settings From 60608d5319f1021ff6e7a88e5fcae64b94d9f196 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Thu, 8 Jun 2017 15:38:08 -0700 Subject: [PATCH 08/62] TFS 11920594, Policy CSP, added DeviceGuard policies new in RS3 --- .../policy-configuration-service-provider.md | 117 ++++++++++++++++++ 1 file changed, 117 insertions(+) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 5b81c0026b..17bfe37f09 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -11,6 +11,9 @@ author: nickbrower # Policy CSP +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + The Policy configuration service provider enables the enterprise to configure policies on Windows 10. Use this configuration service provider to configure any company policies. The Policy configuration service provider has the following sub-categories: @@ -5522,6 +5525,120 @@ ADMX Info: + + +**DeviceGuard/EnableVirtualizationBasedSecurity** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobileEnterprise
cross markcheck mark3check mark3check mark3check mark3cross markcross mark
+ + + +  +

Turns On Virtualization Based Security(VBS) at the next reboot. Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Value type is integer. Supported values: +

    +
  • 0 - disable Virtualization Based Security
    • +
  • 1 - enable Virtualization Based Security
    • +
+ + + + + +**DeviceGuard/RequirePlatformSecurityFeatures** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobileEnterprise
cross markcheck mark3check mark3check mark3check mark3cross markcross mark
+ + +Specifies the platform security level at the next reboot. Value type is interger. Supported values: +
    +
  • 1 - Turns on VBS with Secure Boot.
    • +
  • 3 - Turns on VBS with Secure Boot and DMA. DMA requires hardware support.
    • +
+  +

+ + + + + +**DeviceGuard/LsaCfgFlags** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobileEnterprise
cross markcheck mark3check mark3check mark3check mark3cross markcross mark
+ + + +  +

This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Value type is integer. Supported values: +

    +
  • 0 - (Disabled) Turns off Credential Guard remotely if configured previously without UEFI Lock
    • +
  • 1 - (Enabled with UEFI lock) Turns on CredentialGuard with UEFI lock
    • +
  • 2 - (Enabled without lock) Turns on CredentialGuard without UEFI lock
    • + +
+ + + + **DeviceInstallation/PreventInstallationOfMatchingDeviceIDs** From 480dfe944a43d95f93c18e52b687f558642a56a1 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Thu, 8 Jun 2017 15:40:22 -0700 Subject: [PATCH 09/62] DeviceGuard policies in Policy CSP added version information --- .../mdm/policy-configuration-service-provider.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 17bfe37f09..914dacf821 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -5554,7 +5554,7 @@ ADMX Info:   -

Turns On Virtualization Based Security(VBS) at the next reboot. Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Value type is integer. Supported values: +

Turns On Virtualization Based Security(VBS) at the next reboot. Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Value type is integer. Added in the next major update to Windows 10. Supported values: