diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index f974394314..f85267c41d 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -14,6 +14,12 @@ localizationpriority: medium This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md). +## January 2017 + +| New or changed topic | Description | +| --- | --- | +| [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added graphics cards verified to work with 84" Surface Hubs and added information about the lengths of cables. | + ## December 2016 | New or changed topic | Description| diff --git a/devices/surface-hub/connect-and-display-with-surface-hub.md b/devices/surface-hub/connect-and-display-with-surface-hub.md index 895bb29632..3febb60ff6 100644 --- a/devices/surface-hub/connect-and-display-with-surface-hub.md +++ b/devices/surface-hub/connect-and-display-with-surface-hub.md @@ -251,7 +251,7 @@ In Replacement PC Mode, Surface Hub supports any graphics adapter that can produ **55" Surface Hubs** - For best experience, use a graphics card capable of 1080p resolution at 120Hz. -**84" Surface Hubs** - For best experience, use a graphics card capable of outputting four DisplayPort 1.2 streams to produce 2160p at 120Hz (3840 x 2160 at 120Hz vertical refresh). We've verified that this works with the NVIDIA Quadro K2200, NVIDIA Quadro K4200, and NVIDIA Quadro M6000. These are not the only graphics cards - others are available from other vendors. +**84" Surface Hubs** - For best experience, use a graphics card capable of outputting four DisplayPort 1.2 streams to produce 2160p at 120Hz (3840 x 2160 at 120Hz vertical refresh). We've verified that this works with the NVIDIA Quadro K2200, NVIDIA Quadro K4200, NVIDIA Quadro M6000, AMD FirePro W5100, AMD FirePro W7100, and AMD FirePro W9100. These are not the only graphics cards - others are available from other vendors. Check directly with graphics card vendors for the latest drivers. @@ -273,7 +273,7 @@ Check directly with graphics card vendors for the latest drivers.

AMD

-

[http://support.amd.com/download](http://support.amd.com/download)

+

[http://support.amd.com/en-us/download](http://support.amd.com/en-us/download)

Intel

@@ -470,6 +470,11 @@ Video Out port on the 84" Surface Hub +## Cables + +Both the 55” and 84” Surface Hub devices have been tested to work with Certified DisplayPort and HDMI cables. While vendors do sell longer cables that may work with the Surface Hub, only those cables that have been certified by testing labs are certain to work with the Hub. For example, DisplayPort cables are certified only up to 3 meters, however many vendors sell cables that are 3 times that length. If a long cable is necessary, we strongly suggest using HDMI. HDMI has many cost-effective solutions for long-haul cables, including the use of repeaters. Nearly every DisplayPort source will automatically switch to HDMI signaling if a HDMI sink is detected. + + ## Bluetooth accessories You can connect the following accessories to Surface Hub using Bluetooth: diff --git a/devices/surface-hub/save-bitlocker-key-surface-hub.md b/devices/surface-hub/save-bitlocker-key-surface-hub.md index 461864a1aa..2354de0f40 100644 --- a/devices/surface-hub/save-bitlocker-key-surface-hub.md +++ b/devices/surface-hub/save-bitlocker-key-surface-hub.md @@ -24,7 +24,7 @@ There are several ways to manage your BitLocker key on the Surface Hub. 2. If you’ve joined the Surface Hub to Azure Active Directory (Azure AD), the BitLocker key will be stored under the account that was used to join the device. -3. If you’re using a local admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive. +3. If you’re using an admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive. ## Related topics diff --git a/devices/surface-hub/use-room-control-system-with-surface-hub.md b/devices/surface-hub/use-room-control-system-with-surface-hub.md index 71051b3d27..06b5f7dd0a 100644 --- a/devices/surface-hub/use-room-control-system-with-surface-hub.md +++ b/devices/surface-hub/use-room-control-system-with-surface-hub.md @@ -184,7 +184,7 @@ In Replacement PC mode, the power states are only Ready and Off and only change

5

-

50

+

S0

Ready

diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md index caf7719cc4..8d241210d7 100644 --- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md +++ b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md @@ -65,7 +65,7 @@ However, issues may arise when organizations intend to use versions of Windows t ## Apply an asset tag during deployment -Surface Book, Surface Pro 4, Surface Pro 3, and Surface 3 devices all support the application of an asset tag in UEFI. This asset tag can be used to identify the device from UEFI even if the operating system fails, and it can also be queried from within the operating system. To read more about the Surface Asset Tag function, see the [Asset Tag Tool for Surface Pro 3](https://blogs.technet.microsoft.com/askcore/2014/10/20/asset-tag-tool-for-surface-pro-3/) blog post. +Surface Studio, Surface Book, Surface Pro 4, Surface Pro 3, and Surface 3 devices all support the application of an asset tag in UEFI. This asset tag can be used to identify the device from UEFI even if the operating system fails, and it can also be queried from within the operating system. To read more about the Surface Asset Tag function, see the [Asset Tag Tool for Surface Pro 3](https://blogs.technet.microsoft.com/askcore/2014/10/20/asset-tag-tool-for-surface-pro-3/) blog post. To apply an asset tag using the [Surface Asset Tag CLI Utility](https://www.microsoft.com/download/details.aspx?id=44076) during a Configuration Manager deployment task sequence, use the script and instructions found in the [Set Surface Asset Tag During a Configuration Manager Task Sequence](https://blogs.technet.microsoft.com/jchalfant/set-surface-pro-3-asset-tag-during-a-configuration-manager-task-sequence/) blog post. diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md index df861406ec..e986d59af3 100644 --- a/devices/surface/customize-the-oobe-for-surface-deployments.md +++ b/devices/surface/customize-the-oobe-for-surface-deployments.md @@ -18,16 +18,17 @@ This article walks you through the process of customizing the Surface out-of-box It is common practice in a Windows deployment to customize the user experience for the first startup of deployed computers — the out-of-box experience, or OOBE. ->**Note:**  OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](http://msdn.microsoft.com/library/windows/hardware/dn898581.aspx). +>[!NOTE] +>OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](http://msdn.microsoft.com/library/windows/hardware/dn898581.aspx). In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome. This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](https://technet.microsoft.com/itpro/windows/deploy/create-a-windows-10-reference-image). ->**Note:**  Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
-- [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit) -
-- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager) +>[!NOTE] +>Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
+>- [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit) +>- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager)   @@ -41,7 +42,7 @@ To ensure that an automated deployment is not stopped by this page, the page mus ## Scenario 2: Surface Pen pairing in OOBE -When you first take a Surface Pro 3, Surface Pro 4, or Surface Book out of the package and start it up, the first-run experience of the factory image includes a prompt that asks you to pair the included Surface Pen to the device. This prompt is only provided by the factory image that ships with the device and is not included in other images used for deployment, such as the Windows Enterprise installation media downloaded from the Volume Licensing Service Center. Because pairing the Bluetooth Surface Pen outside of this experience requires that you enter the Control Panel or PC Settings and manually pair a Bluetooth device, you may want to have users or a technician use this prompt to perform the pairing operation. +When you first take a Surface Pro 3, Surface Pro 4, Surface Book, or Surface Studio out of the package and start it up, the first-run experience of the factory image includes a prompt that asks you to pair the included Surface Pen to the device. This prompt is only provided by the factory image that ships with the device and is not included in other images used for deployment, such as the Windows Enterprise installation media downloaded from the Volume Licensing Service Center. Because pairing the Bluetooth Surface Pen outside of this experience requires that you enter the Control Panel or PC Settings and manually pair a Bluetooth device, you may want to have users or a technician use this prompt to perform the pairing operation. To provide the factory Surface Pen pairing experience in OOBE, you must copy four files from the factory Surface image into the reference image. You can copy these files into the reference environment before you capture the reference image, or you can add them later by using Deployment Image Servicing and Management (DISM) to mount the image. The four required files are: @@ -50,7 +51,8 @@ To provide the factory Surface Pen pairing experience in OOBE, you must copy fou - %windir%\\system32\\oobe\\info\\default\\1033\\PenError\_en-US.png - %windir%\\system32\\oobe\\info\\default\\1033\\PenSuccess\_en-US.png ->**Note:**  You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4. +>[!NOTE] +>You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4.   diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md index 6183f55206..1ad577cc48 100644 --- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md +++ b/devices/surface/deploy-surface-app-with-windows-store-for-business.md @@ -11,6 +11,14 @@ author: miladCA #Deploy Surface app with Windows Store for Business +**Applies to** +* Surface Pro 4 +* Surface Book +* Surface 3 + +>[!NOTE] +>The Surface app ships in Surface Studio. + The Surface app is a lightweight Windows Store app that provides control of many Surface-specific settings and options, including: * Enable or disable the Windows button on the Surface device @@ -25,7 +33,7 @@ The Surface app is a lightweight Windows Store app that provides control of many If your organization is preparing images that will be deployed to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Windows Store or your Windows Store for Business. -####Surface app overview +##Surface app overview The Surface app is available as a free download from the [Windows Store](https://www.microsoft.com/store/apps/Surface/9WZDNCRFJB8P). Users can download and install it from the Windows Store, but if your organization uses Windows Store for Business instead, you will need to add it to your store’s inventory and possibly include the app as part of your Windows deployment process. These processes are discussed throughout this article. For more information about Windows Store for Business, see [Windows Store for Business](https://technet.microsoft.com/windows/store-for-business) in the Windows TechCenter. @@ -73,7 +81,8 @@ After you add an app to the Windows Store for Business account in Offline mode, 6. Click either the **Encoded license** or **Unencoded license** option. Use the Encoded license option with management tools like System Center Configuration Manager or when you use Windows Imaging and Configuration Designer (Windows ICD). Select the Unencoded license option when you use Deployment Image Servicing and Management (DISM) or deployment solutions based on imaging, including the Microsoft Deployment Toolkit (MDT). 7. Click **Generate** to generate and download the license for the app. Make sure you note the path of the license file because you’ll need that later in this article. ->**Note:**  When you download an app for offline use, such as the Surface app, you may notice a section at the bottom of the page labeled **Required frameworks**. Your target computers must have the frameworks installed for the app to run, so you may need to repeat the download process for each of the required frameworks for your architecture (either x86 or x64) and also include them as part of your Windows deployment discussed later in this article. +>[!NOTE] +>When you download an app for offline use, such as the Surface app, you may notice a section at the bottom of the page labeled **Required frameworks**. Your target computers must have the frameworks installed for the app to run, so you may need to repeat the download process for each of the required frameworks for your architecture (either x86 or x64) and also include them as part of your Windows deployment discussed later in this article. Figure 5 shows the required frameworks for the Surface app. @@ -81,13 +90,15 @@ Figure 5 shows the required frameworks for the Surface app. *Figure 5. Required frameworks for the Surface app* ->**Note:**  The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Windows Store for Business. Always use the Surface app and recommended framework versions as provided by Windows Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes. +>[!NOTE] +>The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Windows Store for Business. Always use the Surface app and recommended framework versions as provided by Windows Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes. To download the required frameworks for the Surface app, follow these steps: 1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. 2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. ->**Note:**  Only the 64-bit (x64) version of each framework is required for Surface devices. Surface devices are native 64-bit UEFI devices and are not compatible with 32-bit (x86) versions of Windows that would require 32-bit frameworks. +>[!NOTE] +>Only the 64-bit (x64) version of each framework is required for Surface devices. Surface devices are native 64-bit UEFI devices and are not compatible with 32-bit (x86) versions of Windows that would require 32-bit frameworks. ##Install Surface app on your computer with PowerShell The following procedure provisions the Surface app onto your computer and makes it available for any user accounts created on the computer afterwards. diff --git a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md index f4d12836a2..05a27098bb 100644 --- a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md +++ b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md @@ -28,12 +28,18 @@ Driver and firmware updates for Surface devices are released in one of two ways: Installation files for administrative tools, drivers for accessories, and updates for Windows are also available for some devices and are detailed here in this article. ->**Note:**  To simplify the process of locating drivers for your device, downloads for Surface devices have been reorganized to separate pages for each model. Bookmark the Microsoft Download Center page for your device from the links provided on this page. Many of the filenames contain a placeholder denoted with *xxxxxx*, which identifies the current version number or date of the file. +>[!NOTE] +>To simplify the process of locating drivers for your device, downloads for Surface devices have been reorganized to separate pages for each model. Bookmark the Microsoft Download Center page for your device from the links provided on this page. Many of the filenames contain a placeholder denoted with *xxxxxx*, which identifies the current version number or date of the file.   Recent additions to the downloads for Surface devices provide you with options to install Windows 10 on your Surface devices and update LTE devices with the latest Windows 10 drivers and firmware. ->**Note:**  A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](https://support.microsoft.com/en-us/kb/2909710) for more information. + + +>[!NOTE] +>A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](https://go.microsoft.com/fwlink/p/?LinkId=618106) for more information. + + ## Surface Studio diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md index f16b7e5abd..f3393feea4 100644 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md @@ -11,7 +11,8 @@ author: Scottmca # Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit -#### Applies to +**Applies to** +- Surface Studio * Surface Pro 4 * Surface Book * Surface 3 @@ -47,13 +48,19 @@ You can download and find out more about the Windows ADK at [Download the Window Before you can perform a deployment with MDT, you must first supply a set of operating system installation files and an operating system image. These files and image can be found on the physical installation media (DVD) for Windows 10. You can also find these files in the disk image (ISO file) for Windows 10, which you can download from the [Volume Licensing Service Center (VLSC)](https://www.microsoft.com/Licensing/servicecenter/default.aspx). ->**Note:**  The installation media generated from the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT. + +>[!NOTE] +>The installation media generated from the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT. + #### Windows Server Although MDT can be installed on a Windows client, to take full advantage of Windows Deployment Services’ ability to network boot, a full Windows Server environment is recommended. To provide network boot for UEFI devices like Surface with WDS, you will need Windows Server 2008 R2 or later. ->**Note:**  To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter). + +>[!NOTE] +>To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter). + #### Windows Deployment Services @@ -63,11 +70,15 @@ Windows Deployment Services (WDS) is leveraged to facilitate network boot capabi The process of creating a reference image should always be performed in a virtual environment. When you use a virtual machine as the platform to build your reference image, you eliminate the need for installation of additional drivers. The drivers for a Hyper-V virtual machine are included by default in the factory Windows 10 image. When you avoid the installation of additional drivers – especially complex drivers that include application components like control panel applications – you ensure that the image created by your reference image process will be as universally compatible as possible. ->**Note:**  A Generation 1 virtual machine is recommended for the preparation of a reference image in a Hyper-V virtual environment. +>[!NOTE] +>A Generation 1 virtual machine is recommended for the preparation of a reference image in a Hyper-V virtual environment. Because customizations are performed by MDT at the time of deployment, the goal of reference image creation is not to perform customization but to increase performance during deployment by reducing the number of actions that need to occur on each deployed device. The biggest action that can slow down an MDT deployment is the installation of Windows updates. When MDT performs this step during the deployment process, it downloads the updates on each deployed device and installs them. By installing Windows updates in your reference image, the updates are already installed when the image is deployed to the device and the MDT update process only needs to install updates that are new since the image was created or are applicable to products other than Windows (for example, Microsoft Office updates). ->**Note:**  Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center. + +>[!NOTE] +>Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center. + #### Surface firmware and drivers @@ -78,13 +89,15 @@ When you browse to the specific Microsoft Download Center page for your device, In addition to the driver files that help Windows communicate with the hardware components of the Surface device, the .zip file you download will also contain firmware updates. These firmware updates will update the instructions used by the device hardware to communicate between components and Windows. The firmware of Surface device components is updated by installation of specific driver files and thus is installed along with the other drivers during deployment. The firmware of an out-of-date Surface device is thus updated when the device reboots during and after the Windows deployment process. ->**Note:**  Beginning in Windows 10, the drivers for Surface devices are included in the Windows Preinstallation Environment (WinPE). In earlier versions of Windows, specific drivers (like network drivers) had to be imported and configured in MDT for use in WinPE to successfully deploy to Surface devices. +>[!NOTE] +>Beginning in Windows 10, the drivers for Surface devices are included in the Windows Preinstallation Environment (WinPE). In earlier versions of Windows, specific drivers (like network drivers) had to be imported and configured in MDT for use in WinPE to successfully deploy to Surface devices. #### Application installation files In addition to the drivers that are used by Windows to communicate with the Surface device’s hardware and components, you will also need to provide the installation files for any applications that you want to install on your deployed Surface devices. To automate the deployment of an application, you will also need to determine the command-line instructions for that application to perform a silent installation. In this article, the Surface app and Microsoft Office 365 will be installed as examples of application installation. The application installation process can be used with any application with installation files that can be launched from command line. ->**Note:**  If the application files for your application are stored on your organization’s network and will be accessible from your Surface devices during the deployment process, you can deploy that application directly from that network location. To use installation files from a network location, use the **Install Application Without Source Files or Elsewhere on the Network** option in the MDT New Application Wizard, which is described in the [Import applications](#import-applications) section later in this article. +>[!NOTE] +>If the application files for your application are stored on your organization’s network and will be accessible from your Surface devices during the deployment process, you can deploy that application directly from that network location. To use installation files from a network location, use the **Install Application Without Source Files or Elsewhere on the Network** option in the MDT New Application Wizard, which is described in the [Import applications](#import-applications) section later in this article. #### Microsoft Surface Deployment Accelerator @@ -96,7 +109,8 @@ Before you can configure the deployment environment with Windows images, drivers To boot from the network with either your reference virtual machines or your Surface devices, your deployment environment must include a Windows Server environment. The Windows Server environment is required to install WDS and the WDS PXE server. Without PXE support, you will be required to create physical boot media, such as a USB stick to perform your deployment – MDT and Windows ADK will still be required, but Windows Server is not required. Both MDT and Windows ADK can be installed on a Windows client and perform a Windows deployment. ->**Note:**  To download deployment tools directly to Windows Server, you must disable [Internet Explorer Enhanced Security Configuration](https://technet.microsoft.com/library/dd883248). On Windows Server 2012 R2, this can be performed directly through the **Server Manager** option on the **Local Server** tab. In the **Properties** section, **IE Enhanced Security Configuration** can be found on the right side. You may also need to enable the **File Download** option for the **Internet** zone through the **Security** tab of **Internet Options**. +>[!NOTE] +>To download deployment tools directly to Windows Server, you must disable [Internet Explorer Enhanced Security Configuration](https://technet.microsoft.com/library/dd883248). On Windows Server 2012 R2, this can be performed directly through the **Server Manager** option on the **Local Server** tab. In the **Properties** section, **IE Enhanced Security Configuration** can be found on the right side. You may also need to enable the **File Download** option for the **Internet** zone through the **Security** tab of **Internet Options**. #### Install Windows Deployment Services @@ -112,17 +126,20 @@ After the WDS role is installed, you need to configure WDS. You can begin the co *Figure 2. Configure PXE response for Windows Deployment Services* ->**Note:**  Before you configure WDS make sure you have a local NTFS volume that is not your system drive (C:) available for use with WDS. This volume is used to store WDS boot images, deployment images, and configuration. +>[!NOTE] +>Before you configure WDS make sure you have a local NTFS volume that is not your system drive (C:) available for use with WDS. This volume is used to store WDS boot images, deployment images, and configuration. Using the Windows Deployment Services Configuration Wizard, configure WDS to fit the needs of your organization. You can find detailed instructions for the installation and configuration of WDS at [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426). On the **PXE Server Initial Settings** page, be sure to configure WDS so that it will respond to your Surface devices when they attempt to boot from the network. If you have already installed WDS or need to change your PXE server response settings, you can do so on the **PXE Response** tab of the **Properties** of your server in the Windows Deployment Services Management Console. ->**Note:**  You will add boot images to WDS when you update your boot images in MDT. You do not need to add boot images or Windows images to WDS when you configure the role. +>[!NOTE] +>You will add boot images to WDS when you update your boot images in MDT. You do not need to add boot images or Windows images to WDS when you configure the role. #### Install Windows Assessment and Deployment Kit To install Windows ADK, run the Adksetup.exe file that you downloaded from [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#adkwin10). Windows ADK must be installed before MDT. You should always download and use the most recent version of Windows ADK. A new version is usually released corresponding with each new version of Windows. ->**Note:**  You can also use the Adksetup.exe file to download the Windows ADK installation files locally for use on other devices. +>[!NOTE] +>You can also use the Adksetup.exe file to download the Windows ADK installation files locally for use on other devices. When you get to the **Select the features you want to install** page, you only need to select the **Deployment Tools** and **Windows Preinstallation Environment (Windows PE)** check boxes to deploy Windows 10 using MDT, as shown in Figure 3. @@ -170,13 +187,16 @@ To create the deployment share, follow these steps: * **Path** – Specify a local folder where the deployment share will reside, and then click **Next**. - >**Note:**  Like the WDS remote installation folder, it is recommended that you put this folder on an NTFS volume that is not your system volume. + >[!NOTE] + >Like the WDS remote installation folder, it is recommended that you put this folder on an NTFS volume that is not your system volume. * **Share** – Specify a name for the network share under which the local folder specified on the **Path** page will be shared, and then click **Next**. - >**Note:**  The share name cannot contain spaces. + >[!NOTE] + >The share name cannot contain spaces. - >**Note:**  You can use a Dollar Sign (**$**) to hide your network share so that it will not be displayed when users browse the available network shares on the server in File Explorer. + >[!NOTE] + >You can use a Dollar Sign (**$**) to hide your network share so that it will not be displayed when users browse the available network shares on the server in File Explorer. * **Descriptive Name** – Enter a descriptive name for the network share (this descriptive name can contain spaces), and then click **Next**. The descriptive name will be the name of the folder as it appears in the Deployment Workbench. * **Options** – You can accept the default options on this page. Click **Next**. @@ -189,7 +209,8 @@ To create the deployment share, follow these steps: To secure the deployment share and prevent unauthorized access to the deployment resources, you can create a local user on the deployment share host and configure permissions for that user to have read-only access to the deployment share only. It is especially important to secure access to the deployment share if you intend to automate the logon to the deployment share during the deployment boot process. By automating the logon to the deployment share during the boot of deployment media, the credentials for that logon are stored in plaintext in the bootstrap.ini file on the boot media. ->**Note:**  If you intend to capture images (such as the reference image) with this user, the user must also have write permission on the Captures folder in the MDT deployment share. +>[!NOTE] +>If you intend to capture images (such as the reference image) with this user, the user must also have write permission on the Captures folder in the MDT deployment share. You now have an empty deployment share that is ready for you to add the resources that will be required for reference image creation and deployment to Surface devices. @@ -197,7 +218,8 @@ You now have an empty deployment share that is ready for you to add the resource The first resources that are required to perform a deployment of Windows are the installation files from Windows 10 installation media. Even if you have an already prepared reference image, you still need to supply the unaltered installation files from your installation media. The source of these files can be a physical disk, or it can be an ISO file like the download from the Volume Licensing Service Center (VLSC). ->**Note:**  A 64-bit operating system is required for compatibility with Surface Pro 4, Surface Book, Surface Pro 3, and Surface 3. +>[!NOTE] +>A 64-bit operating system is required for compatibility with Surface Studio, Surface Pro 4, Surface Book, Surface Pro 3, and Surface 3. To import Windows 10 installation files, follow these steps: @@ -234,7 +256,8 @@ Now that you’ve imported the installation files from the installation media, y As described in the [Deployment tools](#deployment-tools) section of this article, the goal of creating a reference image is to keep the Windows environment as simple as possible while performing tasks that would be common to all devices being deployed. You should now have a basic MDT deployment share configured with default options and a set of unaltered, factory installation files for Windows 10. This simple configuration is perfect for reference image creation because the deployment share contains no applications or drivers to interfere with the process. ->**Note:**  For some organizations keeping a simple deployment share without applications or drivers is the simplest solution for creation of reference images. You can easily connect to more than one deployment share from a single Deployment Workbench and copy images from a simple, reference-image-only deployment share to a production deployment share complete with drivers and applications. +>[!NOTE] +>For some organizations keeping a simple deployment share without applications or drivers is the simplest solution for creation of reference images. You can easily connect to more than one deployment share from a single Deployment Workbench and copy images from a simple, reference-image-only deployment share to a production deployment share complete with drivers and applications. To create the reference image task sequence, follow these steps: @@ -246,13 +269,15 @@ To create the reference image task sequence, follow these steps: 2. The New Task Sequence Wizard presents a series of steps, as follows: * **General Settings** – Enter an identifier for the reference image task sequence in the **Task Sequence ID** field, a name for the reference image task sequence in the **Task Sequence Name** field, and any comments for the reference image task sequence in the **Task Sequence Comments** field, and then click **Next**. - >**Note:**  The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. + >[!NOTE] + >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. * **Select Template** – Select **Standard Client Task Sequence** from the drop-down menu, and then click **Next**. * **Select OS** – Navigate to and select the Windows 10 image you imported with the Windows 10 installation files, and then click **Next**. * **Specify Product Key** – Click **Do Not Specify a Product Key at This Time**, and then click **Next**. * **OS Settings** – Enter a name, organization, and home page URL in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**. * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**. - >**Note:**  During creation of a reference image, any specified Administrator password will be automatically removed when the image is prepared for capture with Sysprep. During reference image creation, a password is not necessary, but is recommended to remain in line with best practices for production deployment environments. + >[!NOTE] + >During creation of a reference image, any specified Administrator password will be automatically removed when the image is prepared for capture with Sysprep. During reference image creation, a password is not necessary, but is recommended to remain in line with best practices for production deployment environments. * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence. * **Progress** – While the task sequence is created, a progress bar is displayed on this page. * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard. @@ -282,7 +307,8 @@ To update the MDT boot media, follow these steps: 2. Use the Update Deployment Share Wizard to create boot images with the following process: * **Options** – Click **Completely Regenerate the Boot Images**, and then click **Next**. - >**Note:**  Because this is the first time the newly created deployment share has been updated, new boot images will be generated regardless of which option you select on the **Options** page. + >[!NOTE] + >Because this is the first time the newly created deployment share has been updated, new boot images will be generated regardless of which option you select on the **Options** page. * **Summary** – Review the specified options on this page before you click **Next** to begin generation of boot images. * **Progress** – While the boot images are being generated, a progress bar is displayed on this page. * **Confirmation** – When the boot images have been generated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard. @@ -319,17 +345,20 @@ To import the MDT boot media into WDS for PXE boot, follow these steps: * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**. * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard. ->**Note:**  Only the 32-bit boot image, LiteTouchPE_x86.wim, is required to boot from BIOS devices, including Generation 1 Hyper-V virtual machines like the reference virtual machine. +>[!NOTE] +>Only the 32-bit boot image, LiteTouchPE_x86.wim, is required to boot from BIOS devices, including Generation 1 Hyper-V virtual machines like the reference virtual machine. If your WDS configuration is properly set up to respond to PXE clients, you should now be able to boot from the network with any device with a network adapter properly configured for network boot (PXE). ->**Note:**  If your WDS server resides on the same server as DHCP or in a different subnet than the devices you are attempting to boot, additional configuration may be required. For more information, see [Managing Network Boot Programs](https://technet.microsoft.com/library/cc732351). +>[!NOTE] +>If your WDS server resides on the same server as DHCP or in a different subnet than the devices you are attempting to boot, additional configuration may be required. For more information, see [Managing Network Boot Programs](https://technet.microsoft.com/library/cc732351). ### Deploy and capture a reference image Your deployment environment is now set up to create a reference image for Windows 10 complete with Windows Updates. ->**Note:**  You cannot install version updates (such as Windows 10, Version 1511) in a reference image. To create a reference image with a new version of Windows, you must use installation files from that version of Windows. When you install a version update in Windows, it effectively performs an upgrade to a new version of Windows, and upgraded installations of Windows cannot be prepared for deployment with Sysprep.

+>[!NOTE] +>You cannot install version updates (such as Windows 10, Version 1511) in a reference image. To create a reference image with a new version of Windows, you must use installation files from that version of Windows. When you install a version update in Windows, it effectively performs an upgrade to a new version of Windows, and upgraded installations of Windows cannot be prepared for deployment with Sysprep.

By using a fully automated task sequence in an MDT deployment share dedicated to reference image creation, you can greatly reduce the time and effort required to create new reference images and it is the best way to ensure that your organization is ready for feature updates and new versions of Windows 10. You can now boot from the network with a virtual machine to run the prepared task sequence and generate a reference image. When you prepare your virtual machine in Hyper-V for reference image creation, consider the following: @@ -376,7 +405,8 @@ As the task sequence processes the deployment, it will automatically perform the * Reboot into WinPE * Capture an image of the Windows 10 environment and store it in the Captures folder in the MDT deployment share ->**Note:**  The Windows Update process can take some time to complete as it searches the Internet for updates, downloads those updates, and then installs them. By performing this process now, in the reference environment, you eliminate the need to perform these tasks on each deployed device and significantly reduce the amount of time and bandwidth required to perform your deployment. +>[!NOTE] +>The Windows Update process can take some time to complete as it searches the Internet for updates, downloads those updates, and then installs them. By performing this process now, in the reference environment, you eliminate the need to perform these tasks on each deployed device and significantly reduce the amount of time and bandwidth required to perform your deployment. When the task sequence completes, your virtual machine will be off and a new reference image complete with updates will be ready in your MDT deployment share for you to import it and prepare your deployment environment for deployment to Surface devices. @@ -401,7 +431,8 @@ To import the reference image for deployment, use the following steps: * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Operating System Wizard. 3. Expand the folder in which you imported the image to verify that the import completed successfully. ->**Note:**  You can import the reference image into the same deployment share that you used to create your reference image, or you could import the reference image into a new deployment share for deployment to your Surface devices. If you chose to create a new deployment share for deployment of your reference image, remember that you still need to import a full set of installation files from installation media. +>[!NOTE] +>You can import the reference image into the same deployment share that you used to create your reference image, or you could import the reference image into a new deployment share for deployment to your Surface devices. If you chose to create a new deployment share for deployment of your reference image, remember that you still need to import a full set of installation files from installation media. Now that your updated reference image is imported, it is time to prepare your deployment environment for deployment to Surface devices complete with drivers, applications, and automation. @@ -516,7 +547,8 @@ To create the deployment task sequence, follow these steps: 1. In the Deployment Workbench, under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard. 2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard: * **General Settings** – Enter an identifier for the deployment task sequence in the **Task Sequence ID** field, a name for the deployment task sequence in the **Task Sequence Name** field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, then click **Next**. - >**Note:**  The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. + >[!NOTE] + >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. * **Select Template** – Click **Standard Client Task Sequence** from the drop-down menu, and then click **Next**. * **Select OS** – Navigate to and select the reference image that you imported, and then click **Next**. * **Specify Product Key** – Select the product key entry that fits your organization's licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**. @@ -553,7 +585,7 @@ After the task sequence is created it can be modified for increased automation, ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images\surface-deploymdt-fig22.png "Configure a new Set Task Sequence Variable step in the deployment task sequence") - Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence + *Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence* 15. Select the **Inject Drivers** step, the next step in the task sequence. 16. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options: @@ -727,13 +759,15 @@ To import the updated MDT boot media into WDS for PXE boot, follow these steps: * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**. * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard. ->**Note:**  Although it is a best practice to replace and update the boot images in WDS whenever the MDT deployment share is updated, for deployment to Surface devices the 32-bit boot image, LiteTouchPE_x86.wim, is not required. Only the 64-bit boot image is required for 64-bit UEFI devices. +>[!NOTE] +>Although it is a best practice to replace and update the boot images in WDS whenever the MDT deployment share is updated, for deployment to Surface devices the 32-bit boot image, LiteTouchPE_x86.wim, is not required. Only the 64-bit boot image is required for 64-bit UEFI devices. ### Deploy Windows to Surface With all of the automation provided by the deployment share rules and task sequence, performing the deployment on each Surface device becomes as easy as a single touch. ->**Note:**  For the deployment to require only a single touch, the Surface devices must be connected to a keyboard, connected to the network with a Microsoft Surface USB Ethernet Adapter or Surface Dock, and configured with PXE boot as the first boot option, as shown in Figure 25. +>[!NOTE] +>For the deployment to require only a single touch, the Surface devices must be connected to a keyboard, connected to the network with a Microsoft Surface USB Ethernet Adapter or Surface Dock, and configured with PXE boot as the first boot option, as shown in Figure 25. ![Set boot priority for PXE boot](images\surface-deploymdt-fig25.png "Set boot priority for PXE boot") @@ -750,7 +784,8 @@ On a properly configured Surface device, simply turn on the device and press Ent * Windows Update will run, installing any new Windows Updates or updates for installed applications, like Microsoft Office * The task sequence will complete silently and log out of the device ->**Note:**  For Surface devices not configured to boot to the network as the first boot option, you can hold Volume Down and press Power to boot the system immediately to a USB or network device. +>[!NOTE] +>For Surface devices not configured to boot to the network as the first boot option, you can hold Volume Down and press Power to boot the system immediately to a USB or network device. The resulting configuration is a Surface device that is logged out and ready for an end user to enter their credentials, log on, and get right to work. The applications and drivers they need are already installed and up to date. diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md index 1140eb46c7..50ecdc81a9 100644 --- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md +++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md @@ -19,7 +19,8 @@ For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Manage The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. Run the Microsoft Surface UEFI Configurator Windows Installer (.msi) file to start the installation of the tool. When the installer completes, find Microsoft Surface UEFI Configurator in the All Apps section of your Start menu. ->**Note**:  Microsoft Surface UEFI Configurator is supported only on Windows 10. +>[!NOTE] +>Microsoft Surface UEFI Configurator is supported only on Windows 10. ## Create a Surface UEFI configuration package @@ -67,7 +68,8 @@ To create a Surface UEFI configuration package, follow these steps: 13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**. 14. When the package is created and saved, the **Successful** page is displayed. ->**Note**:  Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator. +>[!NOTE] +>Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator. ![Display of certificate thumbprint characters](images\surface-semm-enroll-fig6.png "Display of certificate thumbprint characters") @@ -75,7 +77,8 @@ To create a Surface UEFI configuration package, follow these steps: Now that you have created your Surface UEFI configuration package, you can enroll or configure Surface devices. ->**Note**:  When a Surface UEFI configuration package is created, a log file is created on the desktop with details of the configuration package settings and options. +>[!NOTE] +>When a Surface UEFI configuration package is created, a log file is created on the desktop with details of the configuration package settings and options. ## Enroll a Surface device in SEMM When the Surface UEFI configuration package is executed, the SEMM certificate and Surface UEFI configuration files are staged in the firmware storage of the Surface device. When the Surface device reboots, Surface UEFI processes these files and begins the process of applying the Surface UEFI configuration or enrolling the Surface device in SEMM, as shown in Figure 7. diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md index 78b995935a..3a5739d950 100644 --- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md +++ b/devices/surface/ethernet-adapters-and-surface-device-deployment.md @@ -55,7 +55,8 @@ To boot a Surface device from an alternative boot device, follow these steps: 3. Press and release the **Power** button. 4. After the system begins to boot from the USB stick or Ethernet adapter, release the **Volume Down** button. ->**Note:**  In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard. +>[!NOTE] +>In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard.   For Windows 10, version 1511 and later – including the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10, version 1511 – the drivers for Microsoft Surface Ethernet Adapters are present by default. If you are using a deployment solution that uses Windows Preinstallation Environment (WinPE), like the Microsoft Deployment Toolkit, and booting from the network with PXE, ensure that your deployment solution is using the latest version of the Windows ADK. diff --git a/devices/surface/manage-surface-dock-firmware-updates.md b/devices/surface/manage-surface-dock-firmware-updates.md index 1335d5a808..70a884e151 100644 --- a/devices/surface/manage-surface-dock-firmware-updates.md +++ b/devices/surface/manage-surface-dock-firmware-updates.md @@ -20,9 +20,12 @@ The Surface Dock provides external connectivity to Surface devices through a sin Like the firmware for Surface devices, firmware for Surface Dock is also contained within a downloaded driver that is visible in Device Manager. This driver stages the firmware update files on the Surface device. When a Surface Dock is connected and the driver is loaded, the newer version of the firmware staged by the driver is detected and firmware files are copied to the Surface Dock. The Surface Dock then begins a two-phase process to apply the firmware internally. Each phase requires the Surface Dock to be disconnected from the Surface device before the firmware is applied. The driver copies the firmware into the dock, but only applies it when the user disconnects the Surface device from the Surface Dock. This ensures that there are no disruptions because the firmware is only applied when the user leaves their desk with the device. ->**Note:**  You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links:
-- [How to manage and update Surface drivers and firmware](https://technet.microsoft.com/mt697551) from Microsoft Mechanics -- [Windows Update Makes Surface Better](https://blogs.windows.com/devices/2014/04/15/windows-update-makes-surface-better/#0MqzmYgshCDaJpvK.97) on the Microsoft Devices Blog + +>[!NOTE] +>You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links: +>- [How to manage and update Surface drivers and firmware](https://technet.microsoft.com/mt697551) from Microsoft Mechanics +>- [Windows Update Makes Surface Better](https://go.microsoft.com/fwlink/p/?LinkId=785354) on the Microsoft Devices Blog +   @@ -70,7 +73,8 @@ There are three methods you can use to update the firmware of the Surface Dock: Windows Update is the method that most users will use. The drivers for the Surface Dock are downloaded automatically from Windows Update and the dock update process is initiated without additional user interaction. The two-phase dock update process described earlier occurs in the background as the user connects and disconnects the Surface Dock during normal use. ->**Note:**  The driver version that is displayed in Device Manager may be different from the firmware version that the Surface Dock is using. +>[!NOTE] +>The driver version that is displayed in Device Manager may be different from the firmware version that the Surface Dock is using.   @@ -81,8 +85,9 @@ This method is used mostly in environments where Surface device drivers and firm For more information about how to deploy MSI packages see [Create and deploy an application with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/get-started/create-and-deploy-an-application). ->**Note:**  When drivers are installed through Windows Update or the MSI package, registry keys are added that indicate the version of firmware installed on the Surface Dock and contained within the Surface Dock driver. These registry keys can be found in:

- **HLKM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\SurfaceDockFwUpdate\\Parameters** +>[!NOTE] +>When drivers are installed through Windows Update or the MSI package, registry keys are added that indicate the version of firmware installed on the Surface Dock and contained within the Surface Dock driver. These registry keys can be found in: +> **HLKM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\SurfaceDockFwUpdate\\Parameters** Firmware status is displayed for both the main chipset (displayed as **Component10**) and the DisplayPort chipset (displayed as **Component20**). For each chipset there are four keys, where *xx* is **10** or **20** corresponding to each chipset: @@ -94,7 +99,8 @@ Firmware status is displayed for both the main chipset (displayed as **Component - **Component*xx*FirmwareUpdateStatusRejectReason** – This key changes as the firmware update is processed. It should result in 0 after the successful installation of Surface Dock firmware. ->**Note:**  These registry keys are not present unless you have installed updated Surface Dock drivers through Windows Update or MSI deployment. +>[!NOTE] +>These registry keys are not present unless you have installed updated Surface Dock drivers through Windows Update or MSI deployment.   diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md index a34215254f..bbf546f125 100644 --- a/devices/surface/manage-surface-uefi-settings.md +++ b/devices/surface/manage-surface-uefi-settings.md @@ -12,7 +12,7 @@ author: miladCA #Manage Surface UEFI settings -Current and future generations of Surface devices, including Surface Pro 4 and Surface Book, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings. +Current and future generations of Surface devices, including Surface Pro 4, Surface Book, and Surface Studio, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings. >[!NOTE] >Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI. diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index b1f6626197..ad68711a00 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -20,17 +20,19 @@ Find out how the Microsoft Surface Data Eraser tool can help you securely wipe d Compatible Surface devices include: -- Surface Book +- Surface Studio -- Surface Pro 4 +- Surface Book -- Surface Pro3 +- Surface Pro 4 -- Surface 3 +- Surface Pro3 -- Surface 3 LTE +- Surface 3 -- Surface Pro 2 +- Surface 3 LTE + +- Surface Pro 2 Some scenarios where Microsoft Surface Data Eraser can be helpful include: @@ -42,9 +44,11 @@ Some scenarios where Microsoft Surface Data Eraser can be helpful include: - Standard practice when performing reimaging for devices used with sensitive data ->**Note:**  Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser. +>[!NOTE] +>Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser. ->**Note:**  Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function. +>[!NOTE] +>Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function. ## How to create a Microsoft Surface Data Eraser USB stick @@ -71,7 +75,9 @@ After the creation tool is installed, follow these steps to create a Microsoft S *Figure 1. Start the Microsoft Surface Data Eraser tool* 4. Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost. - >**Note:**  If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB. + + >[!NOTE] + >If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB.   ![USB thumb drive selection](images/dataeraser-usb-selection.png "USB thumb drive selection") diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md index 4358e9b005..cc2236665f 100644 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ b/devices/surface/microsoft-surface-deployment-accelerator.md @@ -62,7 +62,8 @@ When the SDA completes, you can use the deployment share to deploy over the netw You can modify the task sequence in the MDT Deployment Workbench to [include your own apps](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt#sec04), or to [pause the automated installation routine](https://blogs.technet.microsoft.com/mniehaus/2009/06/26/mdt-2010-new-feature-3-suspend-and-resume-a-lite-touch-task-sequence/). While the installation is paused, you can make changes to customize your reference image. After the image is captured, you can configure a deployment task sequence and distribute this custom configuration by using the same network boot capabilities as before. ->**Note:**  With SDA v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment. +>[!NOTE] +>With SDA v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment.   @@ -77,15 +78,18 @@ For environments where the SDA server will not be able to connect to the Interne You can find a full list of available driver downloads at [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) ->**Note:**  Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder. +>[!NOTE] +>Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder. ->**Note:**  Using files from a local directory is not supported when including Office 365 in your deployment share. To include Office 365 in your deployment share, select the **Download from the Internet** check box. +>[!NOTE] +>Using files from a local directory is not supported when including Office 365 in your deployment share. To include Office 365 in your deployment share, select the **Download from the Internet** check box. ## Changes and updates SDA is periodically updated by Microsoft. For instructions on how these features are used, see [Step-by-Step: Microsoft Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator). ->**Note:**  To install a newer version of SDA on a server with a previous version of SDA installed, you only need to run the installation file for the new version of SDA. The installer will handle the upgrade process automatically. If you used SDA to create a deployment share prior to the upgrade and want to use new features of the new version of SDA, you will need to create a new deployment share. SDA does not support upgrades of an existing deployment share. +>[!NOTE] +>To install a newer version of SDA on a server with a previous version of SDA installed, you only need to run the installation file for the new version of SDA. The installer will handle the upgrade process automatically. If you used SDA to create a deployment share prior to the upgrade and want to use new features of the new version of SDA, you will need to create a new deployment share. SDA does not support upgrades of an existing deployment share.   ### Version 1.96.0405 This version of SDA adds support for the following: diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md index 914ae3a4d1..492a5e773c 100644 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ b/devices/surface/step-by-step-surface-deployment-accelerator.md @@ -39,7 +39,8 @@ The tool installs in the SDA program group, as shown in Figure 2. *Figure 2. The SDA program group and icon* ->**Note:**  At this point the tool has not yet prepared any deployment environment or downloaded any materials from the Internet. +>[!NOTE] +>At this point, the tool has not yet prepared any deployment environment or downloaded any materials from the Internet.   @@ -48,7 +49,8 @@ The tool installs in the SDA program group, as shown in Figure 2. The following steps show you how to create a deployment share for Windows 10 that supports Surface 3, Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, the Surface Asset Tag Tool, and Office 365. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps. ->**Note:**  SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice. +>[!NOTE] +>SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice.   @@ -58,12 +60,14 @@ The following steps show you how to create a deployment share for Windows 10 th 3. On the **Verify System** page, the SDA wizard verifies the prerequisites required for an SDA deployment share. This process also checks for the presence of the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10 and the Microsoft Deployment Toolkit (MDT) 2013 Update 2. If these tools are not detected, they are downloaded and installed automatically. Click **Next** to continue. - >**Note:**  As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows: - * Deployment tools - * User State Migration Tool (USMT) - * Windows Preinstallation Environment (WinPE)

+ >[!NOTE] + >As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows: + > * Deployment tools + > * User State Migration Tool (USMT) + > * Windows Preinstallation Environment (WinPE)

- >**Note:**  As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1. + >[!NOTE] + >As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1. 4. On the **Windows 8.1** page, to create a Windows 10 deployment share, do not select the **Would you like to support Windows 8.1** check box. Click **Next** to continue. @@ -93,7 +97,8 @@ The following steps show you how to create a deployment share for Windows 10 th *Figure 4. Selecting Surface Firmware Tool requires Surface Pro 3 drivers* - >**Note:**  You cannot select both Surface 3 and Surface 3 LTE models at the same time. + >[!NOTE] + >You cannot select both Surface 3 and Surface 3 LTE models at the same time. 7. On the **Summary** page confirm your selections and click **Finish** to begin the creation of your deployment share. The process can take several minutes as files are downloaded, the tools are installed, and the deployment share is created. While the SDA scripts are creating your deployment share, an **Installation Progress** window will be displayed, as shown in Figure 5. A typical SDA process includes: @@ -125,17 +130,21 @@ The following steps show you how to create a deployment share for Windows 10 th If you are unable to connect to the Internet with your deployment server, or if you want to download the Surface drivers and apps separately, you can specify a local source for the driver an app files at the time of deployment share creation. On the **Configure** page of the SDA wizard, select the **Copy from a Local Directory** check box, as shown in Figure 6. The **Download from the Internet** check box will be automatically deselected. Enter the folder location where you have placed the driver and app files in the **Local Path** field, as shown in Figure 6. ->**Note:**  All of the downloaded driver and applications files must be located in the same folder. If a required driver or application file is missing from the selected folder when you click **Next**, a warning is displayed and the wizard will not proceed to the next step. +>[!NOTE] +>All of the downloaded driver and applications files must be located in the same folder. If a required driver or application file is missing from the selected folder when you click **Next**, a warning is displayed and the wizard will not proceed to the next step. ->**Note:**  The driver and app files do not need to be extracted from the downloaded .zip files. +>[!NOTE] +>The driver and app files do not need to be extracted from the downloaded .zip files. ->**Note:**  Including Office 365 in your deployment share requires an Internet connection and cannot be performed if you use local files. +>[!NOTE] +>Including Office 365 in your deployment share requires an Internet connection and cannot be performed if you use local files. ![Specify Surface driver and app files](images/sdasteps-fig6-specify-driver-app-files.png "Specify Surface driver and app files") *Figure 6. Specify the Surface driver and app files from a local path* ->**Note:**  The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later. +>[!NOTE] +>The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later.   @@ -143,7 +152,8 @@ If you are unable to connect to the Internet with your deployment server, or if You can use USB media to perform an SDA deployment if your Surface device is unable to boot from the network. For example, if you do not have a Microsoft Surface Ethernet Adapter or Microsoft Surface dock to facilitate network boot (PXE boot). The USB drive produced by following these steps includes a complete copy of the SDA deployment share and can be run on a Surface device without a network connection. ->**Note:**  The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended. +>[!NOTE] +>The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended.   @@ -157,9 +167,8 @@ Before you can create bootable media files within the MDT Deployment Workbench o 4. **clean** – Removes all configuration from your USB drive. - >**Warning:**  This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command. - -   + >[!WARNING] + >This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command. 5. **create part pri** – Creates a primary partition on the USB drive. @@ -175,7 +184,8 @@ Before you can create bootable media files within the MDT Deployment Workbench o *Figure 7. Use DiskPart to prepare a USB drive for boot* - >**Note:**  You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly. + >[!NOTE] + >You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly.   @@ -284,9 +294,8 @@ When you run the task sequence, you will be prompted to provide the following in - A product key, if one is required - >**Note:**  If you are deploying the same version of Windows as the version that came on your device, no product key is required. - -   + >[!NOTE] + >If you are deploying the same version of Windows as the version that came on your device, no product key is required. - A time zone @@ -300,9 +309,9 @@ The **2 – Create Windows Reference Image** task sequence is used to perform a Like the **1 – Deploy Microsoft Surface** task sequence, the **2 – Create Windows Reference Image** task sequence performs a deployment of the unaltered Windows image directly from the installation media. Creation of a reference image should always be performed on a virtual machine. Using a virtual machine as your reference system helps to ensure that the resulting image is compatible with different hardware configurations. ->**Note:**  Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](http://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt). +>[!NOTE] +>Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](http://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt). -  In addition to the information required by the **1 – Deploy Microsoft Surface** task sequence, you will also be prompted to capture an image when you run this task sequence on your reference virtual machine. The **Location** and **File name** fields are automatically populated with the proper information for your deployment share. All that you need to do is select the **Capture an image of this reference computer** option when you are prompted on the **Capture Image** page of the Windows Deployment Wizard. diff --git a/devices/surface/surface-diagnostic-toolkit.md b/devices/surface/surface-diagnostic-toolkit.md index ee50c340e7..8baced791b 100644 --- a/devices/surface/surface-diagnostic-toolkit.md +++ b/devices/surface/surface-diagnostic-toolkit.md @@ -18,23 +18,19 @@ Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the ha The [Microsoft Surface Diagnostic Toolkit](https://www.microsoft.com/download/details.aspx?id=46703) is a small, portable diagnostic tool that runs through a suite of tests to diagnose the hardware of Surface devices. The Microsoft Surface Diagnostic Toolkit executable file is less than 3 MB, which allows it to be distributed through email. It does not require installation, so it can be run directly from a USB stick or over the network. The Microsoft Surface Diagnostic Toolkit walks you through several tests of individual components including the touchscreen, cameras, and sensors. ->**Note:**  A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices: +>[!NOTE] +>A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices: +>- Surface Studio +>- Surface Book +>- Surface Pro 4 +>- Surface 3 LTE +>- Surface 3 +>- Surface Pro 3 +>- Surface Pro 2 +>- Surface Pro -- Surface Book - -- Surface Pro 4 - -- Surface 3 LTE - -- Surface 3 - -- Surface Pro 3 - -- Surface Pro 2 - -- Surface Pro - ->**Note:**  Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the archive file (.zip) as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.) +>[!NOTE] +>Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the archive file (.zip) as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.) Running the Microsoft Surface Diagnostic Toolkit is a hands-on activity. The test sequence includes several tests that require you to perform actions or observe the outcome of the test, and then click the applicable **Pass** or **Fail** button. Some tests require connectivity to external devices, like an external display. Other tests use the built in Windows troubleshooters. At the end of testing, a visual report of the test results is displayed and you are given the option to save a log file or copy the results to the clipboard. @@ -54,7 +50,8 @@ To run a full set of tests with the Microsoft Surface Diagnostic Toolkit, you sh - A power adapter for your Surface device ->**Note:**  The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not resolve issues with the operating system or software. +>[!NOTE] +>The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not resolve issues with the operating system or software. ## Configure test options @@ -64,7 +61,8 @@ Before you select the tests you want to run, you can click the Tools ![images\su *Figure 1. The Tools button highlighted in upper right corner of window* ->**Note:**  Any options you want to select must be specified before you run the tests. You cannot change the test options after the testing sequence has started. +>[!NOTE] +>Any options you want to select must be specified before you run the tests. You cannot change the test options after the testing sequence has started. ####Test depth You can quickly select among three modes for testing and diagnostics by using the **Test Depth** page. The **Test Depth** page displays a slider with three possible positions, as shown in Figure 2. These positions determine which tests are run and what information is recorded without requiring you to select specific tests with the **Run Specific Tests** button. The three modes allow you to focus the tests of the Microsoft Surface Diagnostic Toolkit on hardware, software, or both hardware and software. @@ -173,34 +171,40 @@ These files and logs are stored in a .zip file saved by the Microsoft Surface Di #### Type Cover test ->**Note:**  A Surface Type Cover is required for this test. +>[!NOTE] +>A Surface Type Cover is required for this test. If a Surface Type Cover is not detected, the test prompts you to connect the Type Cover. When a Type Cover is detected the test prompts you to use the keyboard and touchpad. The cursor should move while you swipe the touchpad, and the keyboard Windows key should bring up the Start menu or Start screen to successfully pass this test. You can skip this test if a Type Cover is not used with the Surface device. #### Integrated keyboard test ->**Note:**  This test is only applicable to Surface Book and requires that the Surface Book be docked to the keyboard. +>[!NOTE] +>This test is only applicable to Surface Book and requires that the Surface Book be docked to the keyboard. This test is essentially the same as the Type Cover test, except the integrated keyboard in the Surface Book base is tested rather than the Type Cover. During the first stage of this test a diagram of the keyboard is displayed. When you press a key, the corresponding key will be marked on the diagram. The test will proceed when every key in the diagram is marked. In the second stage of this test, you are prompted to make several gestures on the keypad. As you perform each gesture (for example, a three finger tap), the gesture will be marked on the screen. When you have performed all gestures, the test will automatically complete. ->**Note:**  The F-keys on the diagram require that you press the Function (FN) key simultaneously to activate them. By default, these keys perform other actions. For the Home and End keys, you must press the same keys as F8 and F9, but without the Function (FN) key pressed. +>[!NOTE] +>The F-keys on the diagram require that you press the Function (FN) key simultaneously to activate them. By default, these keys perform other actions. For the Home and End keys, you must press the same keys as F8 and F9, but without the Function (FN) key pressed. #### Canvas mode battery test ->**Note:**  This test is only applicable to Surface Book. +>[!NOTE] +>This test is only applicable to Surface Book. Depending on which mode Surface Book is in, different batteries are used to power the device. When Surface Book is in clipboard mode (detached form the keyboard) it uses an internal battery, and when it is connected in either laptop mode or canvas mode it uses different connections to the battery in the keyboard. In canvas mode, the screen is connected to the keyboard so that when the device is closed, the screen remains face-up and visible. Connect the Surface Book to the keyboard in this manner for the test to automatically proceed. #### Clipboard mode battery test ->**Note:**  This test is only applicable to Surface Book. +>[!NOTE] +>This test is only applicable to Surface Book. Disconnect the Surface Book from the keyboard to work in clipboard mode. In clipboard mode the Surface Book operates from an internal battery that is tested when the Surface Book is disconnected from the keyboard. Disconnecting the Surface Book from the keyboard will also disconnect the Surface Book from power and will automatically begin this test. #### Laptop mode battery test ->**Note:**  This test is only applicable to Surface Book. +>[!NOTE] +>This test is only applicable to Surface Book. Connect the Surface Book to the keyboard in the opposite fashion to canvas mode in laptop mode. In laptop mode the screen will face you when the device is open and the device can be used in the same way as any other laptop. Disconnect AC Power from the laptop base when prompted for this test to check the battery status. @@ -210,25 +214,29 @@ In this test the battery is discharged for a few seconds and tested for health a #### Discrete graphics (dGPU) test ->**Note:**  This test is only applicable to Surface Book models with a discrete graphics processor. +>[!NOTE] +>This test is only applicable to Surface Book models with a discrete graphics processor. This test will query the device information of current hardware to check for the presence of both the Intel integrated graphics processor in the Surface Book and the NVIDIA discrete graphics processor in the Surface Book keyboard. The keyboard must be attached for this test to function. #### Discrete graphics (dGPU) fan test ->**Note:**  This test is only applicable to Surface Book models with a discrete graphics processor. +>[!NOTE] +>This test is only applicable to Surface Book models with a discrete graphics processor. The discrete graphics processor in the Surface Book includes a separate cooling fan. The fan is turned on automatically by the test for 5 seconds. Listen for the sound of the fan in the keyboard and report if the fan is working correctly when prompted. #### Muscle wire test ->**Note:**  This test is only applicable to Surface Book. +>[!NOTE] +>This test is only applicable to Surface Book. To disconnect the Surface Book from the keyboard, software must instruct the muscle wire latch mechanism to open. This is typically accomplished by pressing and holding the undock key on the keyboard. This test sends the same signal to the latch, which unlocks the Surface Book from the Surface Book keyboard. Remove the Surface Book from the keyboard when you are prompted to do so. #### Dead pixel and display artifacts tests ->**Note:**  Before you run this test, be sure to clean the screen of dust or smudges. +>[!NOTE] +>Before you run this test, be sure to clean the screen of dust or smudges. This test prompts you to view the display in search of malfunctioning pixels. The test displays full-screen, single-color images including black, white, red, green, and blue. Pixels that remain bright or dark when the screen displays an image of a different color indicate a failed test. You should also look for distortion or variance in the color of the screen. @@ -246,7 +254,8 @@ The Surface touchscreen should detect input across the entire screen of the devi #### Digitizer pen test ->**Note:**  A Microsoft Surface Pen is required for this test. +>[!NOTE] +>A Microsoft Surface Pen is required for this test. This test displays the same lines as those that are displayed during the Digitizer Touch test, but your input is performed with a Surface Pen instead of your finger. The lines should remain unbroken for as long as the Pen is pressed to the screen. Trace all of the lines in the image to look for unresponsive areas across the entire screen of the Surface device. @@ -264,7 +273,8 @@ This test prompts you to use the volume rocker to turn the volume all the way up #### Micro SD or SD slot test ->**Note:**  This test requires a micro SD or SD card that is compatible with the slot in your Surface device. +>[!NOTE] +>This test requires a micro SD or SD card that is compatible with the slot in your Surface device. Insert a micro SD or SD card when you are prompted. When the SD card is detected, the test prompts you to remove the SD card to ensure that the card is not left in the device. During this test a small file is written to the SD card and then verified. Detection and verification of the SD card automatically passes this test without additional input. @@ -274,13 +284,15 @@ This test displays a meter that shows the microphone sound level and records aud #### Video out test ->**Note:**  This test requires an external display with the applicable connection for your Surface device. +>[!NOTE] +>This test requires an external display with the applicable connection for your Surface device. Surface devices provide a Mini DisplayPort connection for connecting to an external display. Connect your display through the Mini DisplayPort on the device when prompted. The display should be detected automatically and an image should appear on the external display. #### Bluetooth test ->**Note:**  This test requires a Bluetooth device. The device must be set to pairing mode or made discoverable to perform this test. +>[!NOTE] +>This test requires a Bluetooth device. The device must be set to pairing mode or made discoverable to perform this test. After you receive a prompt to put the device in pairing mode, the test opens the **Add a device** window and begins to search for discoverable Bluetooth devices. Watch the **Add a device** window to verify that your Bluetooth device is detected. Select your Bluetooth device from the list and connect to the device to complete the test. @@ -288,17 +300,20 @@ After you receive a prompt to put the device in pairing mode, the test opens the Use this test to verify that the cameras on your Surface device are operating properly. Images will be displayed from both the front and rear cameras, and the infrared camera on a Surface Pro 4. Continuous autofocus can be enabled on the rear camera. Move the device closer and farther away from an object to verify the operation of continuous autofocus. ->**Note:**  You can also use the **Snapshot to Logs** option to save a snapshot of the video output to the log files. +>[!NOTE] +>You can also use the **Snapshot to Logs** option to save a snapshot of the video output to the log files. #### Speaker test ->**Note:**  Headphones or external speakers are required to test the headphone jack in this test. +>[!NOTE] +>Headphones or external speakers are required to test the headphone jack in this test. This test plays audio over left and right channels respectively, both for the internal speakers and for speakers or headphones connected through the headphone jack. Plug in your headphones or speakers to the 3.5mm stereo jack when prompted. The test will automatically detect that a sound playback device has been connected. Mark each channel as a pass or fail as you hear the audio play through the speakers or headphones. #### Network test ->**Note:**  Connect the Surface device to a Wi-Fi network before you run this test. Connections that are made during the test are removed when the test is completed. +>[!NOTE] +>Connect the Surface device to a Wi-Fi network before you run this test. Connections that are made during the test are removed when the test is completed. This test uses the Windows Network Diagnostics built in troubleshooter to diagnose potential issues with network connectivity, including proxy configuration, DNS problems, and IP address conflicts. An event log is saved by this test in Windows logs and is visible in the Windows Event Viewer. The Event ID is 6100. @@ -326,11 +341,13 @@ The compass detects which direction the Surface device is facing relative to nor The ambient light sensor is used to automatically adjust screen brightness relative to the ambient lighting in the environment. Turn the device toward or away from a light source to cause the screen to dim or brighten in response increased or decreased light. The test automatically passes when the screen brightness automatically changes. ->**Note:**  You can also block the ambient light from the sensor by holding your hand slightly in front of the light sensor, which is located directly next to the camera. Use the provided meter to determine if you are blocking light from the sensor. +>[!NOTE] +>You can also block the ambient light from the sensor by holding your hand slightly in front of the light sensor, which is located directly next to the camera. Use the provided meter to determine if you are blocking light from the sensor. #### Device orientation test ->**Note:**  Before you run this test, disable rotation lock from the Action Center if enabled. +>[!NOTE] +>Before you run this test, disable rotation lock from the Action Center if enabled. The device orientation sensor determines what the angle of the Surface device is, relative to the ground. Rotate the display 90 degrees or 180 degrees to cause the screen orientation to switch between portrait and landscape mode. If you have a Surface Type Cover or the Surface Book keyboard connected, you will be prompted to disconnect the Surface from the keyboard to allow screen rotation. The test automatically passes when the screen orientation switches. @@ -344,7 +361,8 @@ The Microsoft Surface Diagnostic Toolkit uses this test only if a Surface Dock i #### System assessment ->**Note:**  The Surface device must be connected to AC power before you can run this test. +>[!NOTE] +>The Surface device must be connected to AC power before you can run this test. The Windows System Assessment Tool (WinSAT) runs a series of benchmarks against the processor, memory, video adapter, and storage devices. The results include the processing speed of various algorithms, read and write performance of memory and storage, and performance in several Direct3D graphical tests. @@ -358,13 +376,15 @@ If your Surface device has encountered an error that caused the device to fail o #### Connected standby text ->**Note:**  This test is only available on Surface devices running Windows 8 or Windows 8.1. +>[!NOTE] +>This test is only available on Surface devices running Windows 8 or Windows 8.1. If connected standby is enabled on the Surface device, this test passes automatically. If connected standby is not enabled, a failure is recorded for this test. Find out more about Connected Standby and Modern Standby at [Modern Standby](https://msdn.microsoft.com/library/windows/hardware/mt282515) on MSDN. #### Modern standby test ->**Note:**  This test is only available on Surface devices running Windows 10. +>[!NOTE] +>This test is only available on Surface devices running Windows 10. This test records log files of the power configuration for the Surface device using the **powercfg.exe /a** command. The test completes automatically and a failure is only recorded if the command does not run. @@ -373,7 +393,8 @@ This test records log files of the power configuration for the Surface device us You can run the Microsoft Surface Diagnostic Toolkit from the command line or as part of a script. The tool supports the following arguments: ->**Note:**  Many of the tests performed by the Microsoft Surface Diagnostic Toolkit require technician interaction. The Microsoft Surface Diagnostic Toolkit cannot run unattended. +>[!NOTE] +>Many of the tests performed by the Microsoft Surface Diagnostic Toolkit require technician interaction. The Microsoft Surface Diagnostic Toolkit cannot run unattended. #### exclude @@ -526,7 +547,8 @@ If a localization file with the same name and in the same folder as the executab A custom localization file selected through this process does not need a specific name. After you select the custom localization file, the Microsoft Surface Diagnostic Toolkit will import the contents and write them to a .locale file with the same name as the .exe file, just like if you click the **Generate** button to create a new .locale file. ->**Note:**  If you import a localization file by clicking the **Browse** button, an existing localization file will be overwritten without prompting if that file has the same name as the Microsoft Surface Diagnostic Toolkit executable file. +>[!NOTE] +>If you import a localization file by clicking the **Browse** button, an existing localization file will be overwritten without prompting if that file has the same name as the Microsoft Surface Diagnostic Toolkit executable file.   diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md index ff07fba283..875fe51b0c 100644 --- a/devices/surface/surface-dock-updater.md +++ b/devices/surface/surface-dock-updater.md @@ -20,7 +20,8 @@ The [Microsoft Surface Dock Updater](https://www.microsoft.com/download/details. When you run the Microsoft Surface Dock Updater installer you will be prompted to accept an End User License Agreement (EULA). ->**Note:**  Updating Surface Dock firmware requires connectivity to the Surface Dock, available only on Surface Pro 3, Surface Pro 4, and Surface Book devices. A Surface Pro 3, Surface Pro 4, or Surface Book is required to successfully install Microsoft Surface Dock Updater. +>[!NOTE] +>Updating Surface Dock firmware requires connectivity to the Surface Dock, available only on Surface Pro 3, Surface Pro 4, and Surface Book devices. A Surface Pro 3, Surface Pro 4, or Surface Book is required to successfully install Microsoft Surface Dock Updater. ## Update a Surface Dock with Microsoft Surface Dock Updater @@ -75,7 +76,8 @@ To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps 9. If you want to update multiple Surface Docks in one sitting, you can click the **Update another Surface Dock** button to begin the process on the next Surface Dock. - >**Note:**  The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power. + >[!NOTE] + >The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power.   diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md index e6022963e9..0c040e2593 100644 --- a/devices/surface/surface-enterprise-management-mode.md +++ b/devices/surface/surface-enterprise-management-mode.md @@ -14,7 +14,7 @@ author: jobotto Microsoft Surface Enterprise Management Mode (SEMM) is a feature of Surface devices with Surface UEFI that allows you to secure and manage firmware settings within your organization. With SEMM, IT professionals can prepare configurations of UEFI settings and install them on a Surface device. In addition to the ability to configure UEFI settings, SEMM also uses a certificate to protect the configuration from unauthorized tampering or removal. >[!NOTE] ->SEMM is only available on devices with Surface UEFI firmware, such as Surface Pro 4 and Surface Book. For more information about Surface UEFI, see [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings). +>SEMM is only available on devices with Surface UEFI firmware, such as Surface Pro 4, Surface Book, and Surface Studio. For more information about Surface UEFI, see [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings). When Surface devices are configured by SEMM and secured with the SEMM certificate, they are considered *enrolled* in SEMM. When the SEMM certificate is removed and control of UEFI settings is returned to the user of the device, the Surface device is considered *unenrolled* in SEMM. diff --git a/devices/surface/unenroll-surface-devices-from-semm.md b/devices/surface/unenroll-surface-devices-from-semm.md index 0c8868a35f..d801c2e764 100644 --- a/devices/surface/unenroll-surface-devices-from-semm.md +++ b/devices/surface/unenroll-surface-devices-from-semm.md @@ -13,7 +13,8 @@ author: jobotto When a Surface device is enrolled in Surface Enterprise Management Mode (SEMM), a certificate is stored in the firmware of that device. The presence of that certificate and the enrollment in SEMM prevent any unauthorized changes to Surface UEFI settings or options while the device is enrolled in SEMM. To restore control of Surface UEFI settings to the user, the Surface device must be unenrolled from SEMM, a process sometimes described as reset or recovery. There are two methods you can use to unenroll a device from SEMM—a Surface UEFI reset package and a Recovery Request. ->**Warning:**  To unenroll a device from SEMM and restore user control of Surface UEFI settings, you must have the SEMM certificate that was used to enroll the device in SEMM. If this certificate becomes lost or corrupted, it is not possible to unenroll from SEMM. Back up and protect your SEMM certificate accordingly. +>[!WARNING] +>To unenroll a device from SEMM and restore user control of Surface UEFI settings, you must have the SEMM certificate that was used to enroll the device in SEMM. If this certificate becomes lost or corrupted, it is not possible to unenroll from SEMM. Back up and protect your SEMM certificate accordingly. For more information about SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode). @@ -27,7 +28,8 @@ Reset packages are created specifically for an individual Surface device. To beg *Figure 1. The serial number of the Surface device is displayed on the Surface UEFI PC information page* ->**Note:**  To boot to Surface UEFI, press **Volume Up** and **Power** simultaneously while the device is off. Hold **Volume Up** until the Surface logo is displayed and the device begins to boot. +>[!NOTE] +>To boot to Surface UEFI, press **Volume Up** and **Power** simultaneously while the device is off. Hold **Volume Up** until the Surface logo is displayed and the device begins to boot. To create a Surface UEFI reset package, follow these steps: @@ -79,7 +81,8 @@ To initiate a Recovery Request, follow these steps: 4. Click or press **Get Started**. 5. Click or press **Next** to begin the Recovery Request process. - >**Note:**  A Recovery Request expires two hours after it is created. If a Recovery Request is not completed in this time, you will have to restart the Recovery Request process. + >[!NOTE] + >A Recovery Request expires two hours after it is created. If a Recovery Request is not completed in this time, you will have to restart the Recovery Request process. 6. Select **SEMM Certificate** from the list of certificates displayed on the **Choose a SEMM reset key** page (shown in Figure 7), and then click or press **Next**. ![Select SEMM certificate for your Recovery Request](images\surface-semm-unenroll-fig7.png "Select SEMM certificate for your Recovery Request") @@ -101,7 +104,8 @@ To initiate a Recovery Request, follow these steps: * To use the Recovery Request (Reset Request) as text, simply type the text directly into Microsoft Surface UEFI Configurator. 8. Open Microsoft Surface UEFI Configurator from the Start menu on another computer. ->**Note:**  Microsoft Surface UEFI Configurator must run in an environment that is able to authenticate the certificate chain for the SEMM certificate. + >[!NOTE] + >Microsoft Surface UEFI Configurator must run in an environment that is able to authenticate the certificate chain for the SEMM certificate. 9. Click **Start**. 10. Click **Recovery Request**, as shown in Figure 10. diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md index 77a3fe6998..ea32d404cc 100644 --- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md +++ b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md @@ -45,8 +45,11 @@ Performing an upgrade deployment of Windows 10 requires the same tools and resou You will also need to have available the following resources: * Windows 10 installation files, such as the installation media downloaded from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx) - >**Note:**  Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT. -* [Surface firmware and drivers](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10 + + >[!NOTE] + >Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT. +* [Surface firmware and drivers](https://technet.microsoft.com/en-us/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10 + * Application installation files for any applications you want to install, such as the Surface app ## Prepare the upgrade deployment @@ -102,7 +105,8 @@ Create the upgrade task sequence with the following process: 1. In the Deployment Workbench under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard. 2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard: - **General Settings** – Enter an identifier for the deployment task sequence in the Task Sequence ID field, a name for the deployment task sequence in the Task Sequence Name field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, and then click **Next**. - >**Note:**  The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. + >[!NOTE] + >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. - **Select Template** – Select **Standard Client Upgrade Task Sequence** from the drop-down menu, and then click **Next**. - **Select OS** – Navigate to and select the Windows image that you imported, and then click **Next**. - **Specify Product Key** – Select the product key entry that fits your organization’s licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**. diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 766978b300..89225a2609 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -597,7 +597,7 @@ To create a new Office 365 Education subscription for use in the classroom, use 2. On the **Get started** page, in **Enter your school email address**, type your school email address, and then click **Sign up**. - You will receive an email in your school email account. + You will receive an email in your school email account. 3. Click the hyperlink in the email in your school email account. 4. On the **One last thing** page, complete your user information, and then click **Start**. @@ -627,7 +627,7 @@ Now that you have created your new Office 365 Education subscription, add the do To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant. ->**Note**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries require opt-in steps to add new users to existing Office 365 tenants. Check your country requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush). +>**Note**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush). Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks: @@ -841,7 +841,7 @@ After you have selected your user and group account bulk import method, you’re With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method. ->**Note**  Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. +>**Note**  Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. For more information about how to import user accounts into AD DS by using: @@ -891,7 +891,7 @@ Microsoft Exchange Online uses an email distribution group as a single email rec You can create email distribution groups based on job role (such as teacher, administration, or student) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group. ->**Note**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps. +>**Note**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps. For information about creating email distribution groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US). @@ -935,7 +935,7 @@ To create and configure your Windows Store for Business portal, simply use the a 5. In the **Welcome to the Windows Store for Business** dialog box, click **OK**. -After you create the Windows Store for Business portal, configure it by using the commands in the **Settings** menu listed in Table 14. Depending on your institution, you may (or may not) need to change these settings to further customize your portal. +After you create the Windows Store for Business portal, configure it by using the commands in the **Settings** menu listed in Table 14. Depending on your institution, you may (or may not) need to change these settings to further customize your portal. |Menu selection|What can you do in this menu| |--------------|----------------------------| @@ -1171,7 +1171,7 @@ For more information about how to update a deployment share, see [Update a Deplo >**Note**  If you have already configured your System Center Configuration Manager infrastructure to support the operating system deployment feature or if you selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next section. -Before you can use System Center Configuration Manager to deploy Windows 10 and manage your apps and devices, you must configure System Center Configuration Manager to support the operating system deployment feature. If you don’t have an existing System Center Configuration Manager infrastructure, you will need to deploy a new infrastructure. +Before you can use System Center Configuration Manager to deploy Windows 10 and manage your apps and devices, you must configure System Center Configuration Manager to support the operating system deployment feature. If you don’t have an existing System Center Configuration Manager infrastructure, you will need to deploy a new infrastructure. Deploying a new System Center Configuration Manager infrastructure is beyond the scope of this guide, but the following resources can help you deploy a new System Center Configuration Manager infrastructure: @@ -1217,9 +1217,9 @@ You can use Windows Deployment Services in conjunction with MDT to automatically * [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/en-us/library/jj648426.aspx) 2. Add LTI boot images (Windows PE images) to Windows Deployment Services. - + The LTI boot images (.wim files) that you will add to Windows Deployment Services are in the MDT deployment share. Locate the .wim files in the deployment share’s Boot subfolder. - + For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](https://technet.microsoft.com/en-us/library/dn759415.aspx#AddLTIBootImagestoWindowsDeploymentServices). ### Configure Window Deployment Services for System Center Configuration Manager @@ -1231,9 +1231,9 @@ You can use Windows Deployment Services in conjunction with System Center Config #### To configure Windows Deployment Services for System Center Configuration Manager 1. Set up and configure Windows Deployment Services. - + Windows Deployment Services is a server role available in all Windows Server editions. You can enable the Windows Deployment Services server role on a new server or on any server running Windows Server in your institution. - + For more information about how to perform this step, see the following resources: * [Windows Deployment Services Overview](https://technet.microsoft.com/library/hh831764.aspx) * The Windows Deployment Services Help file, included in Windows Deployment Services @@ -1244,9 +1244,9 @@ You can use Windows Deployment Services in conjunction with System Center Config To support PXE boot requests, you install the PXE service point site system role. Then, you must configure one or more distribution points to respond to PXE boot request. For more information about how to perform this step, see [Install site system roles for System Center Configuration Manager](https://technet.microsoft.com/en-us/library/mt704036.aspx), [Use PXE to deploy Windows over the network with System Center Configuration Manager](https://technet.microsoft.com/en-us/library/mt627940.aspx), and [Configuring distribution points to accept PXE requests](https://technet.microsoft.com/en-us/library/mt627944.aspx#BKMK_PXEDistributionPoint). 3. Configure the appropriate boot images (Windows PE images) to deploy from the PXE-enabled distribution point. - + Before a device can start a boot image from a PXE-enabled distribution point, you must change the properties of the boot image to enable PXE booting. Typically, you create this boot image when you created your MDT task sequence in the Configuration Manager console. - + For more information about how to perform this step, see [Configure a boot image to deploy from a PXE-enabled distribution point](https://technet.microsoft.com/en-us/library/mt627946.aspx#BKMK_BootImagePXE) and [Manage boot images with System Center Configuration Manager](https://technet.microsoft.com/en-us/library/mt627946.aspx). #### Summary @@ -1271,8 +1271,8 @@ You initially configured the MDT deployment share in the [Configure the MDT depl 1. Create a task sequence to deploy the appropriate Windows 10 edition. - A task sequence can deploy only one Windows 10 edition or version, which means that you must create a task sequence for each Windows 10 edition and version you selected in the [Select the operating systems](#select-the-operating-systems) section earlier in this guide. To create task sequences, use the New Task Sequence Wizard. - + A task sequence can deploy only one Windows 10 edition or version, which means that you must create a task sequence for each Windows 10 edition and version you selected in the [Select the operating systems](#select-the-operating-systems) section earlier in this guide. To create task sequences, use the New Task Sequence Wizard. + For more information, see [Create a New Task Sequence in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewTaskSequenceintheDeploymentWorkbench). 2. Create an MDT application for each desktop app you want to include in your reference image. @@ -1280,12 +1280,12 @@ You initially configured the MDT deployment share in the [Configure the MDT depl 3. Customize the task sequence to install the MDT applications that you created in step 2. You can add an **Install Application** task sequence step to your task sequence. Then, you can customize the **Install Application** task sequence step to install a specific app, which automatically installs the app with no user interaction required when your run the task sequence. - + You need to add an **Install Application** task sequence step for each app you want to include in your reference image. For more information, see [Customize Application Installation in Task Sequences](http://technet.microsoft.com/en-us/library/dn759415.aspx#CustomizeApplicationInstallationinTaskSequences). 4. Create a selection profile that contains the drivers for the device. A *selection profile* lets you select specific device drivers. For example, if you want to deploy the device drivers for a Surface Pro 4 device, you can create a selection profile that contains only the Surface Pro 4 device drivers. - + First, in the Out-of-Box Drivers node in the Deployment Workbench, create a folder that will contain your device drivers. Next, import the device drivers into the folder you just created. Finally, create the selection profile and specify the folder that contains the device drivers. For more information, see the following resources: * [Create Folders to Organize Device Drivers for LTI Deployments](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateFolderstoOrganizeDeviceDriversforLTIDeployments) @@ -1334,7 +1334,7 @@ For more information about how to create a task sequence in the: * Configuration Manager console, see [Create a task sequence to install an operating system in System Center Configuration Manager](https://technet.microsoft.com/en-us/library/mt627927.aspx). ####Summary -In this section, you customized the MDT deployment share to deploy Windows 10 and desktop apps to one or more reference devices by creating and customizing MDT applications, device drivers, and applications. Next, you ran the task sequence, which deploys Windows 10, deploys your apps, deploys the appropriate device drivers, and captures an image of the reference device. Then, you imported the captured reference image into a deployment share or System Center Configuration Manager. Finally, you created a task sequence to deploy your captured reference image to faculty and student devices. At this point in the process, you’re ready to deploy Windows 10 and your apps to your devices. +In this section, you customized the MDT deployment share to deploy Windows 10 and desktop apps to one or more reference devices by creating and customizing MDT applications, device drivers, and applications. Next, you ran the task sequence, which deploys Windows 10, deploys your apps, deploys the appropriate device drivers, and captures an image of the reference device. Then, you imported the captured reference image into a deployment share or System Center Configuration Manager. Finally, you created a task sequence to deploy your captured reference image to faculty and student devices. At this point in the process, you’re ready to deploy Windows 10 and your apps to your devices. ## Prepare for device management @@ -1548,7 +1548,7 @@ In this section, you prepared your institution for device management. You identi ## Deploy Windows 10 to devices -You’re ready to deploy Windows 10 to faculty and student devices. You must complete the steps in this section for each student device in the classrooms as well as for any new student devices you add in the future. You can also perform these actions for any device that’s eligible for a Windows 10 upgrade. This section discusses deploying Windows 10 to new devices, refreshing Windows 10 on existing devices, and upgrading existing devices that are running eligible versions of Windows 8.1 or Windows 7 to Windows 10. +You’re ready to deploy Windows 10 to faculty and student devices. You must complete the steps in this section for each student device in the classrooms as well as for any new student devices you add in the future. You can also perform these actions for any device that’s eligible for a Windows 10 upgrade. This section discusses deploying Windows 10 to new devices, refreshing Windows 10 on existing devices, and upgrading existing devices that are running eligible versions of Windows 8.1 or Windows 7 to Windows 10. ### Prepare for deployment @@ -1838,7 +1838,7 @@ Follow the same steps you followed in the [Deploy Windows 10 to devices](#deploy #### Summary -You have now identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your district and individual school configuration should match the typical school configuration you saw in the [Plan a typical district configuration](#plan-a-typical-district-configuration) section. By performing these maintenance tasks, you help ensure that your district as a whole stays secure and is configured as you specified. +You have now identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your district and individual school configuration should match the typical school configuration you saw in the [Plan a typical district configuration](#plan-a-typical-district-configuration) section. By performing these maintenance tasks, you help ensure that your district as a whole stays secure and is configured as you specified. ## Related topics diff --git a/education/windows/images/win-10-connect-to-work-or-school.png b/education/windows/images/win-10-connect-to-work-or-school.png deleted file mode 100644 index 844b08de56..0000000000 Binary files a/education/windows/images/win-10-connect-to-work-or-school.png and /dev/null differ diff --git a/education/windows/images/win-10-lets-get-2.png b/education/windows/images/win-10-lets-get-2.png deleted file mode 100644 index 0962cba642..0000000000 Binary files a/education/windows/images/win-10-lets-get-2.png and /dev/null differ diff --git a/education/windows/images/win10-connect-to-work-or-school.png b/education/windows/images/win10-connect-to-work-or-school.png new file mode 100644 index 0000000000..08afb5b092 Binary files /dev/null and b/education/windows/images/win10-connect-to-work-or-school.png differ diff --git a/education/windows/images/win10-lets-get-2.png b/education/windows/images/win10-lets-get-2.png new file mode 100644 index 0000000000..c2d3c3ba61 Binary files /dev/null and b/education/windows/images/win10-lets-get-2.png differ diff --git a/education/windows/images/win-10-set-up-work-or-school.png b/education/windows/images/win10-set-up-work-or-school.png similarity index 70% rename from education/windows/images/win-10-set-up-work-or-school.png rename to education/windows/images/win10-set-up-work-or-school.png index 7aeed81460..0ca83fb0e1 100644 Binary files a/education/windows/images/win-10-set-up-work-or-school.png and b/education/windows/images/win10-set-up-work-or-school.png differ diff --git a/education/windows/windows-10-pro-to-pro-edu-upgrade.md b/education/windows/windows-10-pro-to-pro-edu-upgrade.md index 3ad9a94f5a..cb88389ec9 100644 --- a/education/windows/windows-10-pro-to-pro-edu-upgrade.md +++ b/education/windows/windows-10-pro-to-pro-edu-upgrade.md @@ -131,19 +131,19 @@ Now the device is Azure AD joined to the company’s subscription. 1. Go to **Settings > Accounts > Access work or school**, as illustrated in **Figure 9**. - Connect to work or school configuration + Connect to work or school configuration **Figure 9** - Connect to work or school configuration in Settings 2. In **Set up a work or school account**, click **Join this device to Azure Active Directory**, as illustrated in **Figure 10**. - Set up a work or school account + Set up a work or school account **Figure 10** - Set up a work or school account 3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 11**. - Let's get you signed in - dialog box + Let's get you signed in - dialog box **Figure 11** - The “Let’s get you signed in” dialog box diff --git a/windows/deploy/assign-applications-using-roles-in-mdt-2013.md b/windows/deploy/assign-applications-using-roles-in-mdt-2013.md index a6e7d69377..d8b4505c51 100644 --- a/windows/deploy/assign-applications-using-roles-in-mdt-2013.md +++ b/windows/deploy/assign-applications-using-roles-in-mdt-2013.md @@ -122,11 +122,11 @@ Figure 14. ZTIGather.log displaying the application GUID belonging to the Adobe ## Related topics [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md) -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) -[Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md) -[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) -[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) -[Use web services in MDT](use-web-services-in-mdt-2013.md) -[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md) +
[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +
[Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md) +
[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +
[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +
[Use web services in MDT](use-web-services-in-mdt-2013.md) +
[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md)     diff --git a/windows/deploy/change-history-for-deploy-windows-10.md b/windows/deploy/change-history-for-deploy-windows-10.md index f7e67993e5..b244f70c5c 100644 --- a/windows/deploy/change-history-for-deploy-windows-10.md +++ b/windows/deploy/change-history-for-deploy-windows-10.md @@ -11,6 +11,11 @@ author: greg-lindsay # Change history for Deploy Windows 10 This topic lists new and updated topics in the [Deploy Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## January 2017 +| New or changed topic | Description | +|----------------------|-------------| +| [Get started with Upgrade Analytics](upgrade-analytics-get-started.md) | Updated exit code table with suggested fixes, and added link to the Upgrade Analytics blog | + ## October 2016 | New or changed topic | Description | |----------------------|-------------| diff --git a/windows/deploy/create-a-windows-10-reference-image.md b/windows/deploy/create-a-windows-10-reference-image.md index 4954dd3dcd..7f4671ccf1 100644 --- a/windows/deploy/create-a-windows-10-reference-image.md +++ b/windows/deploy/create-a-windows-10-reference-image.md @@ -167,7 +167,7 @@ If you need to add many applications, you can take advantage of the PowerShell s 2. Import the snap-in and create the PSDrive by running the following commands in an elevated PowerShell prompt: ``` syntax - Import-Topic "C:\Program Files\Microsoft Deployment Toolkit\bin\MicrosoftDeploymentToolkit.psd1" + Import-Module "C:\Program Files\Microsoft Deployment Toolkit\bin\MicrosoftDeploymentToolkit.psd1" New-PSDrive -Name "DS001" -PSProvider MDTProvider -Root "E:\MDTBuildLab" ``` diff --git a/windows/deploy/images/enterprise-e3-set-up-work-or-school.png b/windows/deploy/images/enterprise-e3-set-up-work-or-school.png index cebd87cff8..72844d7622 100644 Binary files a/windows/deploy/images/enterprise-e3-set-up-work-or-school.png and b/windows/deploy/images/enterprise-e3-set-up-work-or-school.png differ diff --git a/windows/deploy/images/win10-set-up-work-or-school.png b/windows/deploy/images/win10-set-up-work-or-school.png new file mode 100644 index 0000000000..0ca83fb0e1 Binary files /dev/null and b/windows/deploy/images/win10-set-up-work-or-school.png differ diff --git a/windows/deploy/provisioning-packages.md b/windows/deploy/provisioning-packages.md index 47223a7427..1e7493e331 100644 --- a/windows/deploy/provisioning-packages.md +++ b/windows/deploy/provisioning-packages.md @@ -124,7 +124,6 @@ Provisioning packages can be applied both during image deployment and during run - [Provision PCs with apps and certificates for initial deployments](provision-pcs-with-apps-and-certificates.md) - [Configure devices without MDM](../manage/configure-devices-without-mdm.md) - [Set up a shared or guest PC with Windows 10](../manage/set-up-shared-or-guest-pc.md) -- [Configure devices without MDM](../manage/configure-devices-without-mdm.md) - [Set up a device for anyone to use (kiosk mode)](../manage/set-up-a-device-for-anyone-to-use.md) - [Customize Windows 10 Start and taskbar with ICD and provisioning packages](../manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) - [Set up student PCs to join domain](https://technet.microsoft.com/edu/windows/set-up-students-pcs-to-join-domain) diff --git a/windows/deploy/upgrade-analytics-get-started.md b/windows/deploy/upgrade-analytics-get-started.md index f8f05c26b8..957c73cd4d 100644 --- a/windows/deploy/upgrade-analytics-get-started.md +++ b/windows/deploy/upgrade-analytics-get-started.md @@ -1,4 +1,4 @@ ---- +--- title: Get started with Upgrade Analytics (Windows 10) description: Explains how to get started with Upgrade Analytics. ms.prod: w10 @@ -53,7 +53,7 @@ If you are not using OMS: After you’ve signed in to Operations Management Suite and added the Upgrade Analytics solution to your workspace, complete the following tasks to establish communication and enable data sharing between user computers, Microsoft secure data centers, and Upgrade Analytics. -## Generate your commercial ID key +## Generate your commercial ID key Microsoft uses a unique commercial ID to map information from user computers to your OMS workspace. Generate your commercial ID key in OMS and then deploy it to user computers. @@ -77,14 +77,14 @@ For Upgrade Analytics to receive and display upgrade readiness data from Microso To enable data sharing, whitelist the following endpoints. Note that you may need to get approval from your security group to do this. -Note: The compatibility update KB runs under the computer’s system account and does not support user authenticated proxies. +Note: The compatibility update KB runs under the computer’s system account. If you are using user authenticated proxies, read [this blog post](https://go.microsoft.com/fwlink/?linkid=838688) to learn what you need to do to run it under the logged on user account. | **Endpoint** | **Function** | |---------------------------------------------------------|-----------| -| `https://v10.vortex-win.data.microsoft.com/collect/v1` | Connected User Experience and Telemetry component endpoint. User computers send data to Microsoft through this endpoint. | -| `https://settings-win.data.microsoft.com/settings` | Enables the compatibility update KB to send data to Microsoft. | -| `https://go.microsoft.com/fwlink/?LinkID=544713`
`https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc/extended` | This service provides driver information about whether there will be a driver available post-upgrade for the hardware on the system. | -| `https://vortex.data.microsoft.com/health/keepalive`
`https://settings.data.microsoft.com/qos`
`https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc` | These endpoints are used to validate that user computers are sharing data with Microsoft. | +| `https://v10.vortex-win.data.microsoft.com/collect/v1`

`https://Vortex-win.data.microsoft.com/health/keepalive` | Connected User Experience and Telemetry component endpoint. User computers send data to Microsoft through this endpoint. | +| `https://settings.data.microsoft.com/qos` | Enables the compatibility update KB to send data to Microsoft. | +| `https://go.microsoft.com/fwlink/?LinkID=544713`
`https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc` | This service provides driver information about whether there will be a driver available post-upgrade for the hardware on the system. | + ## Deploy the compatibility update and related KBs @@ -92,8 +92,8 @@ The compatibility update KB scans your computers and enables application usage t | **Operating System** | **KBs** | |----------------------|-----------------------------------------------------------------------------| -| Windows 8.1 | [KB 2976978](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2976978)
Performs diagnostics on the Windows 8.1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed.
For more information about this KB, see
[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)
Provides updated configuration and definitions for compatibility diagnostics performed on the system.
For more information about this KB, see
NOTE: KB2976978 must be installed before you can download and install KB3150513. | -| Windows 7 SP1 | [KB2952664](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2952664)
Performs diagnostics on the Windows 7 SP1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed.
For more information about this KB, see
[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)
Provides updated configuration and definitions for compatibility diagnostics performed on the system.
For more information about this KB, see
NOTE: KB2952664 must be installed before you can download and install KB3150513. | +| Windows 8.1 | [KB 2976978](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2976978)
Performs diagnostics on the Windows 8.1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed.
For more information about this KB, see

[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)
Provides updated configuration and definitions for compatibility diagnostics performed on the system.
For more information about this KB, see
NOTE: KB2976978 must be installed before you can download and install KB3150513. | +| Windows 7 SP1 | [KB2952664](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2952664)
Performs diagnostics on the Windows 7 SP1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed.
For more information about this KB, see

[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)
Provides updated configuration and definitions for compatibility diagnostics performed on the system.
For more information about this KB, see
NOTE: KB2952664 must be installed before you can download and install KB3150513. | IMPORTANT: Restart user computers after you install the compatibility update KBs for the first time. @@ -137,7 +137,7 @@ The Upgrade Analytics deployment script does the following: To run the Upgrade Analytics deployment script: -1. Download the [Upgrade Analytics deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and extract UpgradeAnalytics.zip. Inside, there are two folders: Pilot and Deployment. The Pilot folder contains advanced logging that can help troubleshoot issues and is inteded to be run from an elevated command prompt. The Deployment folder offers a lightweight script intended for broad deployment through ConfigMgr or other software deployment system. We recommend manually running the Pilot version of the script on 5-10 machines to verify that everything is configured correctly. Once you have confirmed that data is flowing successfully, proceed to run the Deployment version throughout your organization. +1. Download the [Upgrade Analytics deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and extract UpgradeAnalytics.zip. Inside, there are two folders: Pilot and Deployment. The Pilot folder contains advanced logging that can help troubleshoot issues and is intended to be run from an elevated command prompt. The Deployment folder offers a lightweight script intended for broad deployment through ConfigMgr or other software deployment system. We recommend manually running the Pilot version of the script on 5-10 machines to verify that everything is configured correctly. Once you have confirmed that data is flowing successfully, proceed to run the Deployment version throughout your organization. 2. Edit the following parameters in RunConfig.bat: @@ -165,41 +165,45 @@ To run the Upgrade Analytics deployment script: 4. After you finish editing the parameters in RunConfig.bat, you are ready to run the script. If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system. -The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered. +The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered.
-
Exit codeMeaning -
0Success -
1Unexpected error occurred while executing the script -
2Error when logging to console. $logMode = 0. -
3Error when logging to console and file. $logMode = 1. -
4Error when logging to file. $logMode = 2. -
5Error when logging to console and file. $logMode = unknown. -
6The commercialID parameter is set to unknown. Modify the script. -
7Function -CheckCommercialId: Unexpected failure. -
8Failure to create registry key path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection. -
9Error when writing CommercialId to registry. -
10Error when writing CommercialDataOptIn to registry. -
11Function -SetupCommercialId: Unexpected failure. -
12Can’t connect to Microsoft – Vortex. Check your network/proxy settings. -
13Can’t connect to Microsoft – setting. Check your network/proxy settings. -
14Can’t connect to Microsoft – compatexchange. Check your network/proxy settings. -
15Error connecting to Microsoft. Check your network/proxy settings. -
16Machine requires reboot. -
17Function -CheckRebootRequired: Unexpected failure. -
18Outdated compatibility update KB package. Update via Windows Update/WSUS. -
19This machine doesn’t have the proper KBs installed. Make sure you have recent compatibility update KB downloaded. -
20Error writing RequestAllAppraiserVersions registry key. -
21Function – SetRequestAllAppraiserVersions: Unexpected failure. -
22RunAppraiser failed with unexpected exception. -
23Error finding system variable %WINDIR%. -
24SetIEDataOptIn failed when writing IEDataOptIn to registry. -
25SetIEDataOptIn failed with unexpected exception. -
26The operating system is Server or LTSB SKU. The script does not support Server or LTSB SKUs. -
27The script is not running under System account. The Upgrade Analytics configuration script must be run as system. -
28Could not create log file at the specified logPath. +
Exit codeMeaningSuggested fix +
0Success +
1Unexpected error occurred while executing the script The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the download center and try again. +
2Error when logging to console. $logMode = 0. Try changing the $logMode value to **1** and try again. +
3Error when logging to console and file. $logMode = 1.Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. +
4Error when logging to file. $logMode = 2.Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. +
5Error when logging to console and file. $logMode = unknown.Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. +
6The commercialID parameter is set to unknown. Modify the script.Set the value for CommercialID in runconfig.bat file. +
8Failure to create registry key path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection. Verify that the configuration script has access to this location. +
9Error when writing CommercialId to registry.Verify that the configuration script has access to this location. +
10Error when writing CommercialDataOptIn to registry.Verify that the configuration script has access to this location. +
11Function -SetupCommercialId: Unexpected failure.Verify that the configuration script has access to this location. +
12Can’t connect to Microsoft – Vortex. Check your network/proxy settings.Verify that the required endpoints are whitelisted correctly. +
13Can’t connect to Microsoft – setting. Verify that the required endpoints are whitelisted correctly. +
14Can’t connect to Microsoft – compatexchange. Verify that the required endpoints are whitelisted. +
15Error connecting to Microsoft:Unexpected failure. +
16Machine requires reboot. The reboot is required to complete the installation of the compatibility update and related KBs. Reboot the machine before running the Upgrade Analytics deployment script. +
17Function -CheckRebootRequired: Unexpected failure.The reboot is required to complete the installation of the compatibility update and related KBs. Reboot the machine before running the Upgrade Analytics deployment script. +
18Outdated compatibility update KB package. Update via Windows Update/WSUS. +The configuration script detected a version of the Compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Analytics solution. Use the latest version of the Compatibility update for Windows 7 SP1/Windows 8.1. +
19The compatibility update failed with unexpected exception. The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the download center and try again. +
20Error writing RequestAllAppraiserVersions registry key. This registry key is required for data collection to work correctly. Verify that the configuration script has access to this location. +
21Function – SetRequestAllAppraiserVersions: Unexpected failure.This registry key is required for data collection to work correctly. Verify that the configuration script has access to this location. +
22RunAppraiser failed with unexpected exception. Check %windir%\System32 directory for a file called CompatTelRunner.exe. If the file does not exist, reinstall the required compatibility updates which include this file, and check your organization group policy to make sure it does not remove this file. +
23Error finding system variable %WINDIR%. Make sure that this environment variable is available on the machine. +
24SetIEDataOptIn failed when writing IEDataOptIn to registry. Verify that the deployment script in running in a context that has access to the registry key. +
25SetIEDataOptIn failed with unexpected exception. The files in the deployment script are likely corrupted. Download the latest script from the [download center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and try again. +
26The operating system is Server or LTSB SKU. The script does not support Server or LTSB SKUs. +
27The script is not running under System account.The Upgrade Analytics configuration script must be run as system. +
28Could not create log file at the specified logPath. Make sure the deployment script has access to the location specified in the logPath parameter. +
29 Connectivity check failed for proxy authentication. Install the cumulative updates on the machine and enable the `DisableEnterpriseAuthProxy` authentication proxy setting. The `DisableEnterpriseAuthProxy` setting is enabled by default for Windows 7. For Windows 8.1 machines, set the `DisableEnterpriseAuthProxy` setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). +
30Connectivity check failed. Registry key property `DisableEnterpriseAuthProxy` is not enabled. The `DisableEnterpriseAuthProxy` setting is enabled by default for Windows 7. For Windows 8.1 machines, set the `DisableEnterpriseAuthProxy` setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). +
30There is more than one instance of the Upgrade Analytics data collector running at the same time on this machine. Use the Windows Task Manager to check if CompatTelRunner.exe is running, and wait until it has completed to rerun the script. +**The Upgrade Analytics task is scheduled to run daily at 3 a.m.**
@@ -207,4 +211,3 @@ The deployment script displays the following exit codes to let you know if it wa ## Seeing data from computers in Upgrade Analytics After data is sent from computers to Microsoft, it generally takes 48 hours for the data to populate in Upgrade Analytics. The compatibility update KB takes several minutes to run. If the KB does not get a chance to finish running or if the computers are inaccessible (turned off or sleeping for example), data will take longer to populate in Upgrade Analytics. For this reason, you can expect most your computers to be populated in OMS in about 1-2 weeks after deploying the KB and configuration to user computers. - diff --git a/windows/deploy/upgrade-analytics-requirements.md b/windows/deploy/upgrade-analytics-requirements.md index 3d55cd49a6..0dd920f998 100644 --- a/windows/deploy/upgrade-analytics-requirements.md +++ b/windows/deploy/upgrade-analytics-requirements.md @@ -1,4 +1,4 @@ ---- +--- title: Upgrade Analytics requirements (Windows 10) description: Provides requirements for Upgrade Analytics. ms.prod: w10 @@ -43,6 +43,8 @@ See [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields `https://v10.vortex-win.data.microsoft.com/collect/v1` +`https://vortex-win.data.microsoft.com/health/keepalive` + `https://settings-win.data.microsoft.com/settings` `https://vortex.data.microsoft.com/health/keepalive` diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 0138ce287c..99abea5c99 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -692,16 +692,16 @@ ##### [Smart Cards Debugging Information](smart-card-debugging-information.md) ##### [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md) ##### [Smart Card Events](smart-card-events.md) -### [Trusted Platform Module](trusted-platform-module-overview.md) +### [Trusted Platform Module](trusted-platform-module-top-node.md) +#### [Trusted Platform Module Overview](trusted-platform-module-overview.md) #### [TPM fundamentals](tpm-fundamentals.md) #### [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) -#### [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md) -#### [Backup the TPM recovery Information to AD DS](backup-tpm-recovery-information-to-ad-ds.md) +#### [Back up the TPM recovery information to AD DS](backup-tpm-recovery-information-to-ad-ds.md) #### [Manage TPM commands](manage-tpm-commands.md) #### [Manage TPM lockout](manage-tpm-lockout.md) #### [Change the TPM owner password](change-the-tpm-owner-password.md) -#### [Initialize and configure ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md) -#### [Switch PCR banks on TPM 2.0 devices](switch-pcr-banks-on-tpm-2-0-devices.md) +#### [View status, clear, or troubleshoot the TPM](initialize-and-configure-ownership-of-the-tpm.md) +#### [Understanding PCR banks on TPM 2.0 devices](switch-pcr-banks-on-tpm-2-0-devices.md) #### [TPM recommendations](tpm-recommendations.md) ### [User Account Control](user-account-control-overview.md) #### [How User Account Control works](how-user-account-control-works.md) @@ -871,4 +871,5 @@ ### [Microsoft Passport guide](microsoft-passport-guide.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ### [Windows 10 security overview](windows-10-security-guide.md) +### [Windows 10 credential theft mitigation guide abstract](windows-credential-theft-mitigation-guide-abstract.md) ## [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) diff --git a/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md b/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md index 9ce1e76918..0efd393b76 100644 --- a/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md +++ b/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md @@ -1,289 +1,5 @@ --- -title: AD DS schema extensions to support TPM backup (Windows 10) -description: This topic provides more details about this change and provides template schema extensions that you can incorporate into your organization. -ms.assetid: beb7097c-e674-4eab-b8e2-6f67c85d1f3f -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -author: brianlic-msft +title: AD DS schema extensions to support TPM backup +redirect_url: https://technet.microsoft.com/library/jj635854.aspx --- -# AD DS schema extensions to support TPM backup - -**Applies to** -- Windows 10, version 1511 -- Windows 10, version 1507 - -**Does not apply to** -- Windows 10, version 1607 or later - -This topic provides more details about this change and provides template schema extensions that you can incorporate into your organization. - -## Why a schema extension is needed - -The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 schema. Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012, you need to extend the schema to support this change. If Active Directory backup of the TPM owner authorization value is enabled in a Windows Server 2008 R2 environment without extending the schema, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8. The following are the two schema extensions that you can use to bring your Windows Server 2008 R2 domain to parity with Windows Server 2012: - -### TpmSchemaExtension.ldf - -This schema extension brings parity with the Windows Server 2012 schema and is required if you want to store the TPM owner authorization value for a computer running Windows 8 in a Windows Server 2008 R2 AD DS domain. With this extension the TPM owner authorization information will be stored in a separate TPM object linked to the corresponding computer object. - -``` syntax -#=============================================================================== -# -# Active Directory Domain Services schema extension for -# BitLocker Drive Encryption and Trusted Platform Module (TPM) recovery -# -# This file contains attributes and class objects that enable Windows Server -# 2008 and Windows Server 2008 R2 domain controllers to store TPM recovery -# information in a new, TPM-specific location. -# -# Change History: -# 07/2010 - Created -# -# To extend the schema, use the LDIFDE tool on the schema master of the forest. -# -# Sample command: -# ldifde -i -v -f TPMSchemaExtension.ldf -c "DC=X" "DC=nttest,dc=microsoft,dc=com" -k -j . -# -# For more information on LDIFDE tool, see -# http://support.microsoft.com/default.aspx?scid=kb;en-us;237677 -# -#=============================================================================== -#=============================================================================== -# New schema attributes -#=============================================================================== -# -# ms-TPM-Srk-Pub-Thumbprint -# GUID: 19d706eb-4d76-44a2-85d6-1c342be3be37 -# -dn: CN=ms-TPM-Srk-Pub-Thumbprint,CN=Schema,CN=Configuration,DC=X -changetype: add -objectClass: attributeSchema -ldapDisplayName: msTPM-SrkPubThumbprint -adminDisplayName: TPM-SrkPubThumbprint -adminDescription: This attribute contains the thumbprint of the SrkPub corresponding to a particular TPM. This helps to index the TPM devices in the directory. -attributeId: 1.2.840.113556.1.4.2107 -attributeSyntax: 2.5.5.10 -omSyntax: 4 -isSingleValued: TRUE -searchFlags: 11 -schemaIdGuid:: 6wbXGXZNokSF1hw0K+O+Nw== -showInAdvancedViewOnly: TRUE -isMemberOfPartialAttributeSet: FALSE -rangeUpper: 20 -# -# ms-TPM-Owner-Information-Temp -# GUID: c894809d-b513-4ff8-8811-f4f43f5ac7bc -# -dn: CN=ms-TPM-Owner-Information-Temp,CN=Schema,CN=Configuration,DC=X -changetype: add -objectClass: attributeSchema -ldapDisplayName: msTPM-OwnerInformationTemp -adminDisplayName: TPM-OwnerInformationTemp -adminDescription: This attribute contains temporary owner information for a particular TPM. -attributeId: 1.2.840.113556.1.4.2108 -attributeSyntax: 2.5.5.12 -omSyntax: 64 -isSingleValued: TRUE -searchFlags: 640 -rangeUpper: 128 -schemaIdGuid:: nYCUyBO1+E+IEfT0P1rHvA== -showInAdvancedViewOnly: TRUE -isMemberOfPartialAttributeSet: FALSE -# -# ms-TPM-Tpm-Information-For-Computer -# GUID: ea1b7b93-5e48-46d5-bc6c-4df4fda78a35 -# -dn: CN=ms-TPM-Tpm-Information-For-Computer,CN=Schema,CN=Configuration,DC=X -changetype: add -objectClass: attributeSchema -ldapDisplayName: msTPM-TpmInformationForComputer -adminDisplayName: TPM-TpmInformationForComputer -adminDescription: This attribute links a Computer object to a TPM object. -attributeId: 1.2.840.113556.1.4.2109 -attributeSyntax: 2.5.5.1 -omSyntax: 127 -isSingleValued: TRUE -searchFlags: 16 -omObjectClass:: KwwCh3McAIVK -schemaIdGuid:: k3sb6khe1Ua8bE30/aeKNQ== -showInAdvancedViewOnly: TRUE -isMemberOfPartialAttributeSet: FALSE -linkId: 2182 -# -# ms-TPM-TpmInformation-For-Computer-BL -# GUID: 14fa84c9-8ecd-4348-bc91-6d3ced472ab7 -# -dn: CN=ms-TPM-Tpm-Information-For-Computer-BL,CN=Schema,CN=Configuration,DC=X -changetype: add -objectClass: attributeSchema -ldapDisplayName: msTPM-TpmInformationForComputerBL -adminDisplayName: TPM-TpmInformationForComputerBL -adminDescription: This attribute links a TPM object to the Computer objects associated with it. -attributeId: 1.2.840.113556.1.4.2110 -attributeSyntax: 2.5.5.1 -omSyntax: 127 -isSingleValued: FALSE -searchFlags: 0 -omObjectClass:: KwwCh3McAIVK -schemaIdGuid:: yYT6FM2OSEO8kW087Ucqtw== -showInAdvancedViewOnly: TRUE -systemOnly: TRUE -linkId: 2183 -# -# Commit the new attributes -# -dn: -changetype: modify -add: schemaUpdateNow -schemaUpdateNow: 1 -- -# -# Modify the Computer schema to support the TPM link -# -dn: CN=computer,CN=Schema,CN=Configuration,DC=X -changetype: modify -add: mayContain -mayContain: msTPM-TpmInformationForComputer -- -# -# Commit the modification to the computer class -# -dn: -changetype: modify -add: schemaUpdateNow -schemaUpdateNow: 1 -- -#=============================================================================== -# New schema classes -#=============================================================================== -# -# ms-TPM-Information-Objects-Container -# GUID: e027a8bd-6456-45de-90a3-38593877ee74 -# -dn: CN=ms-TPM-Information-Objects-Container,CN=Schema,CN=Configuration,DC=X -changetype: add -objectClass: classSchema -ldapDisplayName: msTPM-InformationObjectsContainer -adminDisplayName: TPM-InformationObjectsContainer -adminDescription: Container for TPM objects. -governsID: 1.2.840.113556.1.5.276 -objectClassCategory: 1 -subClassOf: top -systemMustContain: cn -systemPossSuperiors: domain -systemPossSuperiors: domainDNS -schemaIdGUID:: vagn4FZk3kWQozhZOHfudA== -defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;LOLCCCRP;;;DC) -defaultHidingValue: TRUE -defaultObjectCategory: CN=ms-TPM-Information-Objects-Container,CN=Schema,CN=Configuration,DC=X -# -# ms-TPM-Information-Object -# GUID: 85045b6a-47a6-4243-a7cc-6890701f662c -# -# NOTE: If the 'defaultSecurityDescriptor' value below is changed, -# also change the other '.ldf' files in this directory, as appropriate. -# -dn: CN=ms-TPM-Information-Object,CN=Schema,CN=Configuration,DC=X -changetype: add -objectClass: classSchema -ldapDisplayName: msTPM-InformationObject -adminDisplayName: TPM-InformationObject -adminDescription: This class contains recovery information for a Trusted Platform Module (TPM) device. -governsID: 1.2.840.113556.1.5.275 -objectClassCategory: 1 -subClassOf: top -systemMustContain: msTPM-OwnerInformation -systemMayContain: msTPM-SrkPubThumbprint -systemMayContain: msTPM-OwnerInformationTemp -systemPossSuperiors: 1.2.840.113556.1.5.276 -schemaIdGUID:: alsEhaZHQ0KnzGiQcB9mLA== -defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLO;;;DC)(A;;WP;;;CO) -defaultHidingValue: TRUE -defaultObjectCategory: CN=ms-TPM-Information-Object,CN=Schema,CN=Configuration,DC=X -# -# NOTE: If the 'defaultSecurityDescriptor' value above is changed, -# also change the other '.ldf' files in this directory, as appropriate. -# -# -# Commit the new TPM object class -# -dn: -changetype: modify -add: schemaUpdateNow -schemaUpdateNow: 1 -- -#=============================================================================== -# New objects -#=============================================================================== -# -# Add the TPM container to its location in the directory -# -dn: CN=TPM Devices,DC=X -changetype: add -objectClass: msTPM-InformationObjectsContainer -``` - -You should be aware that only the Computer object that has created the TPM object can update it. This means that any subsequent updates to the TPM objects will not succeed in dual boot scenarios or scenarios where the computer is reimaged resulting in a new AD computer object being created. If you are planning to support such scenarios, you will need to update the schema further as shown in the schema extension example, TpmSchemaExtensionACLChanges.ldf. - -### TpmSchemaExtensionACLChanges.ldf - -This schema update modifies the ACLs on the TPM object to be less restrictive so that any subsequent operating system which takes ownership of the computer object can update the owner authorization value in AD DS. -> **Important**  After implementing this schema update, any computer in the domain can update the OwnerAuth of the TPM object (although it cannot read the OwnerAuth). When using this extension, perform a regular backup of the TPM objects and enable auditing to track the changes for these objects. -  -``` syntax -#=============================================================================== -# -# Active Directory Domain Services schema extension for -# BitLocker Drive Encryption and Trusted Platform Module (TPM) recovery -# -# This file modifies a class object that enables Windows Server 2008 -# and Windows Server 2008 R2 domain controllers to store TPM recovery -# information in a new, TPM-specific location. -# -# This file converts the standard schema extension in which only the creator -# of an 'ms-TPM-Information-Object' can write to the object to the Open -# schema extension in which any Domain Computer can write to the object. -# -# This conversion does not apply to any 'ms-TPM-Information-Object' that -# was created before the conversion. -# -# Change History: -# 12/2011 - Created -# -# To change the schema, use the LDIFDE tool on the schema master of the forest. -# -# Sample command: -# ldifde -i -v -f TpmSchemaExtensionACLChanges.ldf -# -c "DC=X" "DC=nttest,dc=microsoft,dc=com" -k -j . -# -# For more information on LDIFDE tool, see -# http://support.microsoft.com/default.aspx?scid=kb;en-us;237677 -# -#=============================================================================== -# -# Modify the TPM-Information-Object class schema 'defaultSecurityDescriptor' to -# allow any Domain Computer to write its properties (including the TPM OwnerAuth -# value) from allowing only the creating Computer object to write its properties -# -# NOTE: Keep any changes to the 'defaultSecurityDescriptor' value in synchronization -# with the value in the TPM-Information-Object class description in the -# 'TpmSchemaExtension.ldf' file -# -dn: CN=ms-TPM-Information-Object,CN=Schema,CN=Configuration,DC=X -changetype: modify -replace: defaultSecurityDescriptor -defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPLO;;;DC) -- -# -# Commit the modification to the TPM-Information-Object schema -# -dn: -changetype: modify -add: schemaUpdateNow -schemaUpdateNow: 1 -- -``` -  -  diff --git a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md index 3f72f93ba5..10963dd930 100644 --- a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md @@ -1,6 +1,6 @@ --- -title: Backup the TPM recovery Information to AD DS (Windows 10) -description: This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer. +title: Back up the TPM recovery information to AD DS (Windows 10) +description: This topic for the IT professional describes backup of Trusted Platform Module (TPM) information. ms.assetid: 62bcec80-96a1-464e-8b3f-d177a7565ac5 ms.prod: w10 ms.mktglfcycl: deploy @@ -9,556 +9,19 @@ ms.pagetype: security author: brianlic-msft --- -# Backup the TPM recovery Information to AD DS +# Back up the TPM recovery information to AD DS **Applies to** - Windows 10, version 1511 - Windows 10, version 1507 **Does not apply to** -- Windows 10, version 1607 or later -This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer. +- Windows 10, version 1607 or later -## About administering TPM remotely +With Windows 10, versions 1511 and 1507, you can back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS). By doing this, you can use AD DS to administer the TPM from a remote computer. The procedure is the same as it was for Windows 8.1. For more information, see [Backup the TPM Recovery Information to AD DS](https://technet.microsoft.com/library/dn466534(v=ws.11).aspx). -Backing up the TPM owner information for a computer allows administrators in a domain to remotely configure the TPM security hardware on the local computer. For example, administrators might want to reset the TPM to the manufacturer’s defaults when they decommission or repurpose computers, without having to be present at the computer. +## Related topics -You can use AD DS to store TPM owner information for use in recovery situations where the TPM owner has forgotten the password or where you must take control of the TPM. There is only one TPM owner password per computer; therefore, the hash of the TPM owner password can be stored as an attribute of the computer object in AD DS. The attribute has the common name (CN) of **ms-TPM-OwnerInformation**. - -> **Note:**  The TPM owner authorization value is stored in AD DS, and it is present in a TPM owner password file as a SHA-1 hash of the TPM owner password, which is base 64–encoded. The actual owner password is not stored. -  -Domain controllers running Windows Server 2012 R2 or Windows Server 2012 include the required AD DS schema objects by default. However, if your domain controller is running Windows Server 2008 R2, you need to update the schema as described in [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). - -This topic contains procedures, some of which are dependent on Visual Basic scripts, to recover TPM information and decommission TPM on remote computers. Sample scripts are available, which you can customize to meet the requirements of your environment. - -In this topic: - -1. [Check status of prerequisites](#bkmk-prereqs) -2. [Set permissions to back up password information](#bkmk-setperms) -3. [Configure Group Policy to back up TPM recovery information in AD DS](#bkmk-configuregp) -4. [Use AD DS to recover TPM information](#bkmk-useit) -5. [Sample scripts](#bkmk-adds-tpm-scripts) - -## Check status of prerequisites - -Before you begin your backup, ensure that the following prerequisites are met: - -1. All domain controllers that are accessible by client computers that will be using TPM services are running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 with the updated schema. - - > **Tip:**  For more info about the schema extensions that are required for a TPM backup in Active Directory domains that are running Windows Server 2008 R2, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). -   -2. You have domain administrator rights in the target forest, or you are using an account that has been granted appropriate permissions to extend the schema for the target forest. Members of the Enterprise Admins or Schema Admins groups are examples of accounts that have the appropriate permissions. - -## Set permissions to back up password information - -This procedure uses the sample script [Add-TPMSelfWriteACE.vbs](#bkmk-add-tpmselfwriteace) to add an access control entry (ACE) so that backing up TPM recovery information is possible. A client computer cannot back up TPM owner information until this ACE is added. - -This script is run on the domain controller that you will use to administer the TPM recovery information, and it operates under the following assumptions: - -- You have domain administrator credentials to set permissions for the top-level domain object. -- Your target domain is the same as the domain for the user account that is running the script. For example, running the script as TESTDOMAIN\\admin will extend permissions for TESTDOMAIN. - - > **Note:**  You might need to modify the sample script if you want to set permissions for multiple domains, but you do not have domain administrator accounts for each of those domains. Find the variable **strPathToDomain** in the script, and modify it for your target domain, for example: - `LDAP://DC=testdomain,DC=nttest,DC=microsoft,DC=com` -   -- Your domain is configured so that permissions are inherited from the top-level domain object to targeted computer objects. - - Permissions will not take effect if any container in the hierarchy does not allow inherited permissions. By default, permissions inheritance is set in AD DS. If you are not sure whether your configuration differs from this default, you can continue with the setup steps to set the permissions. - You can then verify your configuration as described later in this topic. Or you can click the **Effective Permissions** button while viewing the properties of a computer object, then check that **Self** is approved to write the **msTPM-OwnerInformation** attribute. - -**To add an ACE to allow TPM recovery information backup** - -1. Open the sample script **Add-TPMSelfWriteACE.vbs**. - - The script contains a permission extension, and you must modify the value of **strPathToDomain** by using your domain name. - -2. Save your modifications to the script. -3. Type the following at a command prompt, and then press ENTER: - - **cscript Add-TPMSelfWriteACE.vbs** - -This script adds a single ACE to the top-level domain object. The ACE is an inheritable permission that allows the computer (SELF) to write to the **ms-TPM-OwnerInformation** attribute for computer objects in the domain. -Complete the following procedure to check that the correct permissions are set and to remove TPM and BitLocker ACEs from the top-level domain, if necessary. - -**Manage ACEs configured on TPM schema objects** - -1. Open the sample script **List-ACEs.vbs**. -2. Modify **List-ACEs.vbs**. - - You must modify: - - Value of **strPathToDomain**: Use your domain name. - - Filter options: The script sets a filter to address BitLocker and TPM schema objects, so you must modify **If IsFilterActive ()** if you want to list or remove other schema objects. - -3. Save your modifications to the script. -4. Type the following at a command prompt, and then press ENTER: - - **cscript List-ACEs.vbs** - - With this script you can optionally remove ACEs from BitLocker and TPM schema objects on the top-level domain. - -## Configure Group Policy to back up TPM recovery information in AD DS - -Use these procedures to configure the [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-addsbu) policy setting on a local computer. In a production environment, an efficient way to do this is to create or edit a Group Policy Object (GPO) that can target client computers in the domain. - -**To enable local policy setting to back up TPM recovery information to AD DS** - -1. Sign in to a domain-joined computer by using a domain account that is a member of the local Administrators group. -2. Open the Local Group Policy Editor (gpedit.msc), and in the console tree, navigate to **Computer Configuration\\Administrative Templates\\System**. -3. Click **Trusted Platform Module Services**. -4. Double-click **Turn on TPM backup to Active Directory Domain Services**. -5. Click **Enabled**, and then click **OK**. -> **Important:**  When this setting is enabled, the TPM owner password cannot be set or changed unless the computer is connected to the domain and AD DS backup of the TPM recovery information succeeds. -  -## Use AD DS to recover TPM information - -When you need to recover the TPM owner information from AD DS and use it to manage the TPM, you need to read the **ms-TPM-OwnerInformation** object from AD DS, and then manually create a TPM owner password backup file that can be supplied when TPM owner credentials are required. - -**To obtain TPM owner backup information from AD DS and create a password file** - -1. Sign in to a domain controller by using domain administrator credentials. -2. Copy the sample script file, [Get-TPMOwnerInfo.vbs](#bkmk-get-tpmownerinfo), to a location on your computer. -3. Open a Command Prompt window, and change the default location to the location of the sample script files you saved in the previous step. -4. At the command prompt, type **cscript Get-TPMOwnerInfo.vbs**. - - The expected output is a string that is the hash of the password that you created earlier. - > **Note:**  If you receive the error message, "Active Directory: The directory property cannot be found in the cache," verify that you are using a domain administrator account, which is required to read the **ms-TPM-OwnerInformation** attribute. - - The only exception to this requirement is that if users are the Creator Owner of computer objects that they join to the domain, they can possibly read the TPM owner information for their computer objects. -   -5. Open Notepad or another text editor, and copy the following code sample into the file, and replace *TpmOwnerPasswordHash* with the string that you recorded in the previous step. - - ``` syntax - - - -                 -                 TpmOwnerPasswordHash - - ``` -6. Save this file with a .tpm extension on a removable storage device, such as a USB flash drive. When you access the TPM, and you are required to provide the TPM owner password, choose the option for reading the password from a file and provide the path to this file. - -## Sample scripts - -You can use all or portions of the following sample scripts, which are used in the preceding procedures, to configure AD DS for backing up TPM recovery information. Customization is required depending on how your environment is configured. - -- [Add-TPMSelfWriteACE.vbs: Use to add the access control entry (ACE) for the TPM to AD DS](#bkmk-add-tpmselfwriteace) -- [List-ACEs.vbs: Use to list or remove the ACEs that are configured on BitLocker and TPM schema objects](#bkmk-list-aces) -- [Get-TPMOwnerInfo.vbs: Use to retrieve the TPM recovery information from AD DS for a particular computer](#bkmk-get-tpmownerinfo) - -### Add-TPMSelfWriteACE.vbs - -This script adds the access control entry (ACE) for the TPM to AD DS so that the computer can back up TPM recovery information in AD DS. - -``` syntax -'=============================================================================== -' -' This script demonstrates the addition of an Access Control Entry (ACE) -' to allow computers to write Trusted Platform Module (TPM) -' recovery information to Active Directory. -' -' This script creates a SELF ACE on the top-level domain object, and -' assumes that inheritance of ACL's from the top-level domain object to -' down-level computer objects are enabled. -' -' -' -' Last Updated: 12/05/2012 -' Last Reviewed: 12/05/2012 -' Microsoft Corporation -' -' Disclaimer -' -' The sample scripts are not supported under any Microsoft standard support program -' or service. The sample scripts are provided AS IS without warranty of any kind. -' Microsoft further disclaims all implied warranties including, without limitation, -' any implied warranties of merchantability or of fitness for a particular purpose. -' The entire risk arising out of the use or performance of the sample scripts and -' documentation remains with you. In no event shall Microsoft, its authors, or -' anyone else involved in the creation, production, or delivery of the scripts be -' liable for any damages whatsoever (including, without limitation, damages for loss -' of business profits, business interruption, loss of business information, or -' other pecuniary loss) arising out of the use of or inability to use the sample -' scripts or documentation, even if Microsoft has been advised of the possibility -' of such damages. -' -' Version 1.0.2 - Tested and re-released for Windows 8 and Windows Server 2012 -' -'=============================================================================== -' -------------------------------------------------------------------------------- -' Access Control Entry (ACE) constants -' -------------------------------------------------------------------------------- -'- From the ADS_ACETYPE_ENUM enumeration -Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT = &H5 'Allows an object to do something -'- From the ADS_ACEFLAG_ENUM enumeration -Const ADS_ACEFLAG_INHERIT_ACE = &H2 'ACE can be inherited to child objects -Const ADS_ACEFLAG_INHERIT_ONLY_ACE = &H8 'ACE does NOT apply to target (parent) object -'- From the ADS_RIGHTS_ENUM enumeration -Const ADS_RIGHT_DS_WRITE_PROP = &H20 'The right to write object properties -Const ADS_RIGHT_DS_CREATE_CHILD = &H1 'The right to create child objects -'- From the ADS_FLAGTYPE_ENUM enumeration -Const ADS_FLAG_OBJECT_TYPE_PRESENT = &H1 'Target object type is present in the ACE -Const ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT = &H2 'Target inherited object type is present in the ACE -' -------------------------------------------------------------------------------- -' TPM and FVE schema object GUID's -' -------------------------------------------------------------------------------- -'- ms-TPM-OwnerInformation attribute -SCHEMA_GUID_MS_TPM_OWNERINFORMATION = "{AA4E1A6D-550D-4E05-8C35-4AFCB917A9FE}" -'- ms-FVE-RecoveryInformation object -SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION = "{EA715D30-8F53-40D0-BD1E-6109186D782C}" -'- Computer object -SCHEMA_GUID_COMPUTER = "{BF967A86-0DE6-11D0-A285-00AA003049E2}" -'Reference: "Platform SDK: Active Directory Schema" -' -------------------------------------------------------------------------------- -' Set up the ACE to allow write of TPM owner information -' -------------------------------------------------------------------------------- -Set objAce1 = createObject("AccessControlEntry") -objAce1.AceFlags = ADS_ACEFLAG_INHERIT_ACE + ADS_ACEFLAG_INHERIT_ONLY_ACE -objAce1.AceType = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT -objAce1.Flags = ADS_FLAG_OBJECT_TYPE_PRESENT + ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT -objAce1.Trustee = "SELF" -objAce1.AccessMask = ADS_RIGHT_DS_WRITE_PROP -objAce1.ObjectType = SCHEMA_GUID_MS_TPM_OWNERINFORMATION -objAce1.InheritedObjectType = SCHEMA_GUID_COMPUTER -' -------------------------------------------------------------------------------- -' NOTE: BY default, the "SELF" computer account can create -' BitLocker recovery information objects and write BitLocker recovery properties -' -' No additional ACE's are needed. -' -------------------------------------------------------------------------------- -' -------------------------------------------------------------------------------- -' Connect to Discretional ACL (DACL) for domain object -' -------------------------------------------------------------------------------- -Set objRootLDAP = GetObject("LDAP://rootDSE") -strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com -Set objDomain = GetObject(strPathToDomain) -WScript.Echo "Accessing object: " + objDomain.Get("distinguishedName") -Set objDescriptor = objDomain.Get("ntSecurityDescriptor") -Set objDacl = objDescriptor.DiscretionaryAcl - -' -------------------------------------------------------------------------------- -' Add the ACEs to the Discretionary ACL (DACL) and set the DACL -' -------------------------------------------------------------------------------- -objDacl.AddAce objAce1 -objDescriptor.DiscretionaryAcl = objDacl -objDomain.Put "ntSecurityDescriptor", Array(objDescriptor) -objDomain.SetInfo -WScript.Echo "SUCCESS!" -``` - -### List-ACEs.vbs - -This script lists or removes the ACEs that are configured on BitLocker and TPM schema objects for the top-level domain. This enables you to verify that the expected ACEs have been added appropriately or to remove any ACEs that are related to BitLocker or the TPM, if necessary. - -``` syntax -'=============================================================================== -' -' This script lists the access control entries (ACE's) configured on -' Trusted Platform Module (TPM) and BitLocker Drive Encryption (BDE) schema objects -' for the top-level domain. -' -' You can use this script to check that the correct permissions have been set and -' to remove TPM and BitLocker ACE's from the top-level domain. -' -' -' Last Updated: 12/05/2012 -' Last Reviewed: 12/02/2012 -' -' Microsoft Corporation -' -' Disclaimer -' -' The sample scripts are not supported under any Microsoft standard support program -' or service. The sample scripts are provided AS IS without warranty of any kind. -' Microsoft further disclaims all implied warranties including, without limitation, -' any implied warranties of merchantability or of fitness for a particular purpose. -' The entire risk arising out of the use or performance of the sample scripts and -' documentation remains with you. In no event shall Microsoft, its authors, or -' anyone else involved in the creation, production, or delivery of the scripts be -' liable for any damages whatsoever (including, without limitation, damages for loss -' of business profits, business interruption, loss of business information, or -' other pecuniary loss) arising out of the use of or inability to use the sample -' scripts or documentation, even if Microsoft has been advised of the possibility -' of such damages. -' -' Version 1.0.2 - Tested and re-released for Windows 8 and Windows Server 2012 -' -'=============================================================================== -' -------------------------------------------------------------------------------- -' Usage -' -------------------------------------------------------------------------------- -Sub ShowUsage - Wscript.Echo "USAGE: List-ACEs" - Wscript.Echo "List access permissions for BitLocker and TPM schema objects" - Wscript.Echo "" - Wscript.Echo "USAGE: List-ACEs -remove" - Wscript.Echo "Removes access permissions for BitLocker and TPM schema objects" - WScript.Quit -End Sub -' -------------------------------------------------------------------------------- -' Parse Arguments -' -------------------------------------------------------------------------------- -Set args = WScript.Arguments -Select Case args.Count - - Case 0 - ' do nothing - checks for ACE's - removeACE = False - - Case 1 - If args(0) = "/?" Or args(0) = "-?" Then - ShowUsage - Else - If UCase(args(0)) = "-REMOVE" Then - removeACE = True - End If - End If - Case Else - ShowUsage -End Select -' -------------------------------------------------------------------------------- -' Configuration of the filter to show/remove only ACE's for BDE and TPM objects -' -------------------------------------------------------------------------------- -'- ms-TPM-OwnerInformation attribute -SCHEMA_GUID_MS_TPM_OWNERINFORMATION = "{AA4E1A6D-550D-4E05-8C35-4AFCB917A9FE}" -'- ms-FVE-RecoveryInformation object -SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION = "{EA715D30-8F53-40D0-BD1E-6109186D782C}" -' Use this filter to list/remove only ACEs related to TPM and BitLocker -aceGuidFilter = Array(SCHEMA_GUID_MS_TPM_OWNERINFORMATION, _ - SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION) -' Note to script source reader: -' Uncomment the following line to turn off the filter and list all ACEs -'aceGuidFilter = Array() -' -------------------------------------------------------------------------------- -' Helper functions related to the list filter for listing or removing ACE's -' -------------------------------------------------------------------------------- -Function IsFilterActive() - If Join(aceGuidFilter) = "" Then - IsFilterActive = False - Else - IsFilterActive = True - End If -End Function -Function isAceWithinFilter(ace) - aceWithinFilter = False ' assume first not pass the filter - For Each guid In aceGuidFilter - If ace.ObjectType = guid Or ace.InheritedObjectType = guid Then - isAceWithinFilter = True - End If - Next -End Function -Sub displayFilter - For Each guid In aceGuidFilter - WScript.echo guid - Next -End Sub -' -------------------------------------------------------------------------------- -' Connect to Discretional ACL (DACL) for domain object -' -------------------------------------------------------------------------------- -Set objRootLDAP = GetObject("LDAP://rootDSE") -strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. dc=fabrikam,dc=com -Set domain = GetObject(strPathToDomain) -WScript.Echo "Accessing object: " + domain.Get("distinguishedName") -WScript.Echo "" -Set descriptor = domain.Get("ntSecurityDescriptor") -Set dacl = descriptor.DiscretionaryAcl -' -------------------------------------------------------------------------------- -' Show Access Control Entries (ACE's) -' -------------------------------------------------------------------------------- -' Loop through the existing ACEs, including all ACEs if the filter is not active -i = 1 ' global index -c = 0 ' found count - relevant if filter is active -For Each ace In dacl - If IsFilterActive() = False or isAceWithinFilter(ace) = True Then - ' note to script source reader: - ' echo i to show the index of the ACE - - WScript.echo "> AceFlags: " & ace.AceFlags - WScript.echo "> AceType: " & ace.AceType - WScript.echo "> Flags: " & ace.Flags - WScript.echo "> AccessMask: " & ace.AccessMask - WScript.echo "> ObjectType: " & ace.ObjectType - WScript.echo "> InheritedObjectType: " & ace.InheritedObjectType - WScript.echo "> Trustee: " & ace.Trustee - WScript.echo "" - if IsFilterActive() = True Then - c = c + 1 - ' optionally include this ACE in removal list if configured - ' note that the filter being active is a requirement since we don't - ' want to accidentally remove all ACEs - If removeACE = True Then - dacl.RemoveAce ace - End If - end if - End If - i = i + 1 -Next -' Display number of ACEs found -If IsFilterActive() = True Then - WScript.echo c & " ACE(s) found in " & domain.Get("distinguishedName") _ - & " related to BitLocker and TPM" 'note to script source reader: change this line if you configure your own -filter - ' note to script source reader: - ' uncomment the following lines if you configure your own filter - 'WScript.echo "" - 'WScript.echo "The following filter was active: " - 'displayFilter - 'Wscript.echo "" -Else - i = i - 1 - WScript.echo i & " total ACE(s) found in " & domain.Get("distinguishedName") - -End If -' -------------------------------------------------------------------------------- -' Optionally remove ACE's on a filtered list -' -------------------------------------------------------------------------------- -if removeACE = True and IsFilterActive() = True then - descriptor.DiscretionaryAcl = dacl - domain.Put "ntSecurityDescriptor", Array(descriptor) - domain.setInfo - WScript.echo c & " ACE(s) removed from " & domain.Get("distinguishedName") -else - if removeACE = True then - WScript.echo "You must specify a filter to remove ACEs from " & domain.Get("distinguishedName") - - end if -end if -``` - -### Get-TPMOwnerInfo.vbs - -This script retrieves TPM recovery information from AD DS for a particular computer so that you can verify that only domain administrators (or delegated roles) can read backed up TPM recovery information and verify that the information is being backed up correctly. - -``` syntax -'================================================================================= -' -' This script demonstrates the retrieval of Trusted Platform Module (TPM) -' recovery information from Active Directory for a particular computer. -' -' It returns the TPM owner information stored as an attribute of a -' computer object. -' -' Last Updated: 12/05/2012 -' Last Reviewed: 12/05/2012 -' -' Microsoft Corporation -' -' Disclaimer -' -' The sample scripts are not supported under any Microsoft standard support program -' or service. The sample scripts are provided AS IS without warranty of any kind. -' Microsoft further disclaims all implied warranties including, without limitation, -' any implied warranties of merchantability or of fitness for a particular purpose. -' The entire risk arising out of the use or performance of the sample scripts and -' documentation remains with you. In no event shall Microsoft, its authors, or -' anyone else involved in the creation, production, or delivery of the scripts be -' liable for any damages whatsoever (including, without limitation, damages for loss -' of business profits, business interruption, loss of business information, or -' other pecuniary loss) arising out of the use of or inability to use the sample -' scripts or documentation, even if Microsoft has been advised of the possibility -' of such damages. -' -' Version 1.0 - Initial release -' Version 1.1 - Updated GetStrPathToComputer to search the global catalog. -' Version 1.1.2 - Tested and re-released for Windows 8 and Windows Server 2012 -' -'================================================================================= -' -------------------------------------------------------------------------------- -' Usage -' -------------------------------------------------------------------------------- -Sub ShowUsage - Wscript.Echo "USAGE: Get-TpmOwnerInfo [Optional Computer Name]" - Wscript.Echo "If no computer name is specified, the local computer is assumed." - WScript.Quit -End Sub -' -------------------------------------------------------------------------------- -' Parse Arguments -' -------------------------------------------------------------------------------- -Set args = WScript.Arguments -Select Case args.Count - - Case 0 - ' Get the name of the local computer - Set objNetwork = CreateObject("WScript.Network") - strComputerName = objNetwork.ComputerName - - Case 1 - If args(0) = "/?" Or args(0) = "-?" Then - ShowUsage - Else - strComputerName = args(0) - End If - - Case Else - ShowUsage -End Select -' -------------------------------------------------------------------------------- -' Get path to Active Directory computer object associated with the computer name -' -------------------------------------------------------------------------------- -Function GetStrPathToComputer(strComputerName) - ' Uses the global catalog to find the computer in the forest - ' Search also includes deleted computers in the tombstone - Set objRootLDAP = GetObject("LDAP://rootDSE") - namingContext = objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com - strBase = "" - - Set objConnection = CreateObject("ADODB.Connection") - Set objCommand = CreateObject("ADODB.Command") - objConnection.Provider = "ADsDSOOBject" - objConnection.Open "Active Directory Provider" - Set objCommand.ActiveConnection = objConnection - strFilter = "(&(objectCategory=Computer)(cn=" & strComputerName & "))" - strQuery = strBase & ";" & strFilter & ";distinguishedName;subtree" - objCommand.CommandText = strQuery - objCommand.Properties("Page Size") = 100 - objCommand.Properties("Timeout") = 100 - objCommand.Properties("Cache Results") = False - ' Enumerate all objects found. - Set objRecordSet = objCommand.Execute - If objRecordSet.EOF Then - WScript.echo "The computer name '" & strComputerName & "' cannot be found." - WScript.Quit 1 - End If - ' Found object matching name - Do Until objRecordSet.EOF - dnFound = objRecordSet.Fields("distinguishedName") - GetStrPathToComputer = "LDAP://" & dnFound - objRecordSet.MoveNext - Loop - ' Clean up. - Set objConnection = Nothing - Set objCommand = Nothing - Set objRecordSet = Nothing -End Function -' -------------------------------------------------------------------------------- -' Securely access the Active Directory computer object using Kerberos -' -------------------------------------------------------------------------------- -Set objDSO = GetObject("LDAP:") -strPath = GetStrPathToComputer(strComputerName) -WScript.Echo "Accessing object: " + strPath -Const ADS_SECURE_AUTHENTICATION = 1 -Const ADS_USE_SEALING = 64 '0x40 -Const ADS_USE_SIGNING = 128 '0x80 -Set objComputer = objDSO.OpenDSObject(strPath, vbNullString, vbNullString, _ - ADS_SECURE_AUTHENTICATION + ADS_USE_SEALING + ADS_USE_SIGNING) -' -------------------------------------------------------------------------------- -' Get the TPM owner information from the Active Directory computer object -' -------------------------------------------------------------------------------- -strOwnerInformation = objComputer.Get("msTPM-OwnerInformation") -WScript.echo "msTPM-OwnerInformation: " + strOwnerInformation -``` - -## Additional resources - -- [Trusted Platform Module technology overview](trusted-platform-module-overview.md) -- [TPM fundamentals](tpm-fundamentals.md) -- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) -- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -- [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md) -- [Prepare your organization for BitLocker: Planning and Policies](http://technet.microsoft.com/library/jj592683.aspx), see TPM considerations +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) +- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) \ No newline at end of file diff --git a/windows/keep-secure/basic-audit-logon-events.md b/windows/keep-secure/basic-audit-logon-events.md index 143c150317..dd0764f2b5 100644 --- a/windows/keep-secure/basic-audit-logon-events.md +++ b/windows/keep-secure/basic-audit-logon-events.md @@ -22,6 +22,8 @@ If you define this policy setting, you can specify whether to audit successes, a To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the **Define these policy settings** check box and clear the **Success** and **Failure** check boxes. +For information about advanced security policy settings for logon events, see the [Logon/logoff](advanced-security-audit-policy-settings.md#logonlogoff) section in [Advanced security audit policy settings](advanced-security-audit-policy-settings.md). + ## Configure this audit setting You can configure this security setting by opening the appropriate policy under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. diff --git a/windows/keep-secure/bitlocker-group-policy-settings.md b/windows/keep-secure/bitlocker-group-policy-settings.md index 8d3864a681..26cadf522b 100644 --- a/windows/keep-secure/bitlocker-group-policy-settings.md +++ b/windows/keep-secure/bitlocker-group-policy-settings.md @@ -1509,7 +1509,6 @@ If the **Require BitLocker backup to AD DS** option is not selected, AD DS bac TPM initialization might be needed during the BitLocker setup. Enable the **Turn on TPM backup to Active Directory Domain Services** policy setting in **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services** to ensure that TPM information is also backed up. For more information about this setting, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md). -If you are using domain controllers running Windows Server 2003 with Service Pack 1, you must first set up appropriate schema extensions and access control settings on the domain before a backup to AD DS can succeed. For more info, see [Backup the TPM recovery Information to AD DS](backup-tpm-recovery-information-to-ad-ds.md). ### Choose default folder for recovery password diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 759d44b4af..e17a75ec92 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -12,6 +12,13 @@ author: brianlic-msft # Change history for Keep Windows 10 secure This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## December 2016 + +| New or changed topic | Description | +| --- | --- | +|[Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) |Added filter examples for Windows 10 and Windows Server 2016. | + + ## November 2016 | New or changed topic | Description | | --- | --- | diff --git a/windows/keep-secure/change-the-tpm-owner-password.md b/windows/keep-secure/change-the-tpm-owner-password.md index 50d9175eb2..a8b0e386d3 100644 --- a/windows/keep-secure/change-the-tpm-owner-password.md +++ b/windows/keep-secure/change-the-tpm-owner-password.md @@ -12,52 +12,35 @@ author: brianlic-msft # Change the TPM owner password **Applies to** -- Windows 10 +- Windows 10, version 1511 +- Windows 10, version 1507 This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. ## About the TPM owner password -Starting with Windows 10, version 1607 , Windows will not retain the TPM owner password when provisioning the TPM. The password will be set to a random high entropy value and then discarded. -In order to retain the TPM owner password, you will need to set the registry key 'HKLM\Software\Policies\Microsoft\TPM' [REG_DWORD] 'OSManagedAuthLevel' to 4. The default value for this key is 2, and unless it is changed to 4 before the TPM is provisioned, the owner password will not be saved. Microsoft strongly recommends that you do not change the default value of this registry key in order to retain the owner password. +Starting with Windows 10, version 1607, Windows will not retain the TPM owner password when provisioning the TPM. The password will be set to a random high entropy value and then discarded. -Only one owner password exists for each TPM. The TPM owner password allows the ability to enable, disable, or clear the TPM without having physical access to the computer, for example, by using the command-line tools remotely. The TPM owner password also allows manipulation of the TPM dictionary attack logic. Taking ownership of the TPM is performed by Windows as part of the provisioning process on each boot. Ownership can change when you share the password or clear your ownership of the TPM so someone else can initialize it. +> [!IMPORTANT] +> Although the TPM owner password is not retained starting with Windows 10, version 1607, you can change a default registry key to retain it. However, we strongly recommend that you do not make this change. To retain the TPM owner password, set the registry key 'HKLM\\Software\\Policies\\Microsoft\\TPM' \[REG\_DWORD\] 'OSManagedAuthLevel' to 4. The default value for this key is 2, and unless it is changed to 4 before the TPM is provisioned, the owner password will not be saved. + +Only one owner password exists for each TPM. The TPM owner password allows the ability to enable, disable, or clear the TPM without having physical access to the computer, for example, by using the command-line tools remotely. The TPM owner password also allows manipulation of the TPM dictionary attack logic. Taking ownership of the TPM is performed by Windows as part of the provisioning process on each boot. Ownership can change when you share the password or clear your ownership of the TPM so someone else can initialize it. Without the owner password you can still perform all the preceding actions by means of a physical presence confirmation from UEFI. -**Other TPM management options** +### Other TPM management options Instead of changing your owner password, you can also use the following options to manage your TPM: -- **Clear the TPM**   If you want to invalidate all of the existing keys that have been created since you took ownership of the TPM, you can clear it. For more info, see [Initialize and Configure Ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md#bkmk-clear1). +- **Clear the TPM**   If you want to invalidate all of the existing keys that have been created since you took ownership of the TPM, you can clear it. For important precautions for this process, and instructions for completing it, see [Clear all the keys from the TPM](initialize-and-configure-ownership-of-the-tpm.md#clear-all-the-keys-from-the-tpm). - >**Important:**  Clearing the TPM can result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM. -   -- **Turn off the TPM**   If you want to keep all existing keys and data intact, and you want to disable the services that are provided by the TPM, you can turn it off. For more info, see [Initialize and Configure Ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md#bkmk-onoff). This option is only available for TPM 1.2. +- **Turn off the TPM**   With TPM 1.2 and Windows 10, versions 1507 and 1511, you can turn off the TPM. Do this if you want to keep all existing keys and data intact and disable the services that are provided by the TPM. For more info, see [Turn off the TPM](initialize-and-configure-ownership-of-the-tpm.md#turn-off-the-tpm). ## Change the TPM owner password -The following procedure provides the steps that are necessary to change the TPM owner password. +With Windows 10, version 1507 or 1511, if you have opted specifically to preserve the TPM owner password, you can use the saved password to change to a new password. -**To change the TPM owner password** - -If you have opted specifically to preserve the TPM owner password, you can use the saved password to change to a new password. - -1. Open the TPM MMC (tpm.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. -2. In the **Actions** pane, click **Change Owner Password**. -3. In the **Manage the TPM security hardware** dialog box, select a method to enter your current TPM owner password. - - - If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, use **Browse** to navigate to the .tpm file that is saved on your removable storage device. Click **Open**, and then click **Create New Password**. - - If you do not have the removable storage device with your saved password, click **I want to enter the owner password**. In the **Type your TPM owner password** dialog box, enter your password (including hyphens), and click **Create New Password**. -4. On the **Create the TPM owner password** page, select a method for creating a new TPM owner password. - - 1. Click **Automatically create the password** to have a new owner password generated for you. - 2. Click **Manually create the password** if you want to specify a password. - >**Note:**  The TPM owner password must have a minimum of eight characters. -   -5. After the new password is created, you can choose **Save the password** to save the password in a password backup file on a removable storage device or **Print the password** to print a copy of the password for later reference. - -6. Click **Change password** to apply the new owner password to the TPM. +To change to a new TPM owner password, in TPM.msc, click **Change Owner Password**, and follow the instructions. You will be prompted to provide the owner password file or to type the password. Then you can create a new password, either automatically or manually, and save the password in a file or as a printout. ## Use the TPM cmdlets @@ -66,6 +49,6 @@ If you are using Windows PowerShell to manage your computers, you can also manag For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). -## Additional resources +## Related topics -For more info about TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) diff --git a/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md b/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md index 6476c88d16..8f914cd9f0 100644 --- a/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md +++ b/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md @@ -16,7 +16,7 @@ author: brianlic-msft This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. -Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference device +Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference device. To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. diff --git a/windows/keep-secure/images/security-stages.png b/windows/keep-secure/images/security-stages.png new file mode 100644 index 0000000000..249ced9d4b Binary files /dev/null and b/windows/keep-secure/images/security-stages.png differ diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index a4444b25e1..31ea44aebd 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -28,7 +28,7 @@ You can create a Group Policy or mobile device management (MDM) policy that will   ## Group Policy settings for Windows Hello for Business -The following table lists the Group Policy settings that you can configure for Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. +The following table lists the Group Policy settings that you can configure for Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. Be aware that not all settings are in both places. diff --git a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md index cc8625adb9..013355ffa6 100644 --- a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md @@ -1,6 +1,6 @@ --- -title: Initialize and configure ownership of the TPM (Windows 10) -description: This topic for the IT professional describes how to initialize and set the ownership the Trusted Platform Module (TPM), turn the TPM on and off, and clear TPM keys. +title: View status, clear, or troubleshoot the TPM (Windows 10) +description: This topic for the IT professional describes how to view status for, clear, or troubleshoot the Trusted Platform Module (TPM). ms.assetid: 1166efaf-7aa3-4420-9279-435d9c6ac6f8 ms.prod: w10 ms.mktglfcycl: deploy @@ -9,156 +9,146 @@ ms.pagetype: security author: brianlic-msft --- -# Initialize and configure ownership of the TPM +# View status, clear, or troubleshoot the TPM **Applies to** - Windows 10 +- Windows Server 2016 -This topic for the IT professional describes how to initialize and set the ownership the Trusted Platform Module (TPM), turn the TPM on and off, and clear TPM keys. It also explains how to troubleshoot issues that you might encounter as a result of using these procedures. +This topic for the IT professional describes actions you can take through the Trusted Platform Module (TPM) snap-in, **TPM.msc**: -## About TPM initialization and ownership +- [View the status of the TPM](#view-the-status-of-the-tpm) -The TPM must be initialized and ownership must be taken before it can be used to help secure your computer. The owner of the TPM is the user who possesses the owner password and is able to set it and change it. Only one owner password exists per TPM. The owner of the TPM can make full use of TPM capabilities. Taking ownership of the TPM can be done as part of the initialization process. +- [Troubleshoot TPM initialization](#troubleshoot-tpm-initialization) -When you start the TPM Initialization Wizard, which is accessed through the TPM Microsoft Management Console (MMC), you can determine whether the computer's TPM has been initialized. You can also view the TPM properties. +- [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm) -This topic contains procedures for the following tasks: +With TPM 1.2 and Windows 10, version 1507 or 1511, you can also take the following actions: -- [Initialize the TPM and set ownership](#bkmk-initializetpm) -- [Troubleshoot TPM initialization](#bkmk-troubleshootinit) -- [Turn on or turn off the TPM](#bkmk-onoff) -- [Clear all the keys from the TPM](#bkmk-clear1) -- [Use the TPM cmdlets](#bkmk-tpmcmdlets) +- [Turn on or turn off the TPM](#turn-on-or-turn-off) -## Initialize the TPM and set ownership +This topic also provides information about [using the TPM cmdlets](#use-the-tpm-cmdlets). -Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. In addition, the computer must be equipped with a Trusted Computing Group-compliant BIOS. +## About TPM initialization and ownership -**To start the TPM Initialization Wizard** +Starting with Windows 10, the operating system automatically initializes and takes ownership of the TPM. This is a change from previous operating systems, where you would initialize the TPM and create an owner password. Therefore, with Windows 10, in most cases, we recommend that you avoid configuring the TPM through **TPM.msc**. The one exception is that in certain circumstances you might use **TPM.msc** to clear the TPM. For more information, see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic. -1. Open the TPM Management console (tpm.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. -2. On the **Action** menu, click **Initialize TPM** to start the TPM Initialization Wizard. -3. If the TPM has never been initialized or is turned off, the TPM Initialization Wizard displays the **Turn on the TPM security hardware** dialog box. This dialog box provides guidance for initializing or turning on the TPM. Follow the instructions in the wizard. +## View the status of the TPM - >**Note:** If the TPM is already turned on, the TPM Initialization Wizard displays the **Create the TPM owner password** dialog box. Skip the remainder of this procedure and continue with the **To set ownership of the TPM** procedure. -   - >**Note:**  If the TPM Initialization Wizard detects that you do not have a compatible BIOS, you cannot continue with the TPM Initialization Wizard, and you are alerted to consult the computer manufacturer's documentation for instructions to initialize the TPM. -   -4. Click **Restart**. -5. Follow the BIOS screen prompts. An acceptance prompt is displayed to ensure that a user has physical access to the computer and that no malicious software is attempting to turn on the TPM. - - >**Note:**  BIOS screen prompts and the required keystrokes vary by computer manufacturer. -   -6. After the computer restarts, sign in to the computer with the same administrative credentials that you used to start this procedure. -7. The TPM Initialization Wizard automatically restarts. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. -8. Continue with the next procedure to take ownership of the TPM. +To view the status of the TPM, open the TPM Management console (TPM.msc). In the center pane, find the **Status** box. -To finish initializing the TPM for use, you must set an owner for the TPM. The process of taking ownership includes creating an owner password for the TPM. +In most cases, the status will be **Ready**. If the status is ready but “**with reduced functionality**,” see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic. -**To set ownership of the TPM** +If the status is **Not ready**, you can try the steps in [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic. If this does not bring it to a **Ready** state, contact the manufacturer, and see the troubleshooting suggestions in the next section. -1. If you are not continuing immediately from the last procedure, start the TPM Initialization Wizard. If you need to review the steps to do so, see the previous procedure **To start the TPM Initialization Wizard**. -2. In the **Create the TPM owner password** dialog box, click **Automatically create the password (recommended)**. -3. In the **Save your TPM owner password** dialog box, click **Save the password**. -4. In the **Save As** dialog box, select a location to save the password, and then click **Save**. The password file is saved as *computer\_name.tpm*. +## Troubleshoot TPM initialization - >**Important:**  We highly recommend saving the TPM owner password to a removable storage device and storing it in a safe location. -   -5. Click **Print the password** if you want to print a copy of your password. - >**Important:**  We highly recommend printing a copy of your TPM owner password and storing it in a safe location. -   -6. Click **Initialize**. - >**Note:**  The process of initializing the TPM might take a few minutes to complete. -   -7. Click **Close**. - >**Caution:**  Do not lose your password. If you do, you will be unable to make administrative changes unless you clear the TPM, which can result in data loss. -   -## Troubleshoot TPM initialization +If you find that Windows is not able to initialize the TPM automatically, review the following information: -Managing the Trusted Platform Module (TPM) is usually a straightforward procedure. If are unable to complete the initialization procedure, review the following information: +- You can try clearing the TPM to the factory default values and allowing Windows to re-initialize it. For important precautions for this process, and instructions for completing it, see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic. -- If the TPM is not detected by Windows, verify that your computer hardware contains a Trusted Computing Group-compliant BIOS. Ensure that no BIOS settings have been used to hide the TPM from the operating system. -- If you are attempting to initialize the TPM as part of the BitLocker setup, check which TPM driver is installed on the computer. We recommend always using one of the TPM drivers that is provided by Microsoft and is protected with BitLocker. If a non-Microsoft TPM driver is installed, it may prevent the default TPM driver from loading and cause BitLocker to report that a TPM is not present on the computer. If you have a non-Microsoft driver installed, remove it and then try to initialize the TPM. The following table lists the three standard TPM drivers that are provided by Microsoft. +- If the TPM is a TPM 2.0 and is not detected by Windows, verify that your computer hardware contains a Unified Extensible Firmware Interface (UEFI) that is Trusted Computing Group-compliant. Also, ensure that in the UEFI settings, the TPM has not been disabled or hidden from the operating system. -| Driver name | Manufacturer | -| - | - | -| Trusted Platform Module 1.2 | (Standard)| -| Broadcom Trusted Platform Module (A1), v1.2 | Broadcom| -| Broadcom Trusted Platform Module (A2), v1.2 | Broadcom| -   -- If the TPM has been previously initialized and you do not have the owner password, you may have to clear or reset the TPM to the factory default values. For more information, see [Clear all the keys from the TPM](#bkmk-clear1). - > **Caution:**  Clearing the TPM can result in data loss. To avoid data loss, make sure that you have a backup or recovery method for any data that is protected or encrypted by the TPM. -   -Because your TPM security hardware is a physical part of your computer, you may want to read the manuals or instructions that came with your computer, or search the manufacturer's website. +- If you have TPM 1.2 with Windows 10, version 1507 or 1511, the TPM might be turned off, and need to be turned back on, as described in [Turn on the TPM](#turn-on-the-tpm). When it is turned back on, Windows will re-initialize it. -**Network connection** +- If you are attempting to set up BitLocker with the TPM, check which TPM driver is installed on the computer. We recommend always using one of the TPM drivers that is provided by Microsoft and is protected with BitLocker. If a non-Microsoft TPM driver is installed, it may prevent the default TPM driver from loading and cause BitLocker to report that a TPM is not present on the computer. If you have a non-Microsoft driver installed, remove it and then allow the operating system to initialize the TPM. -You cannot complete the initialization of the Trusted Platform Module (TPM) when your computer is disconnected from your organization's network if either of the following conditions exist: +### Troubleshoot network connection issues for Windows 10, versions 1507 and 1511 + +If you have Windows 10, version 1507 or 1511, the initialization of the TPM cannot complete when your computer has network connection issues and both of the following conditions exist: - An administrator has configured your computer to require that TPM recovery information be saved in Active Directory Domain Services (AD DS). This requirement can be configured through Group Policy. + - A domain controller cannot be reached. This can occur on a computer that is currently disconnected from the network, separated from the domain by a firewall, or experiencing a network component failure (such as an unplugged cable or a faulty network adapter). -In either case, an error message appears, and you cannot complete the initialization process. To avoid this issue, initialize the TPM while you are connected to the corporate network and you can contact a domain controller. +If these issues occur, an error message appears, and you cannot complete the initialization process. To avoid this issue, allow Windows to initialize the TPM while you are connected to the corporate network and you can contact a domain controller. -**Systems with multiple TPMs** +### Troubleshoot systems with multiple TPMs -Some systems may have multiple TPMs and the active TPM may be toggled in the BIOS. Windows 10 does not support this behavior. If you switch TPMs, functionality that depends on the TPM will not work with the new TPM unless it is cleared and put through provisioning. Performing this clear may cause data loss, in particular of keys and certificates associated with the previous TPM. For example, toggling TPMs will cause Bitlocker to enter recovery mode. It is strongly recommended that, on systems with two TPMs, one TPM is selected to be used and the selection is not changed. +Some systems may have multiple TPMs and the active TPM may be toggled in UEFI. Windows 10 does not support this behavior. If you switch TPMs, Windows might not properly detect or interact with the new TPM. If you plan to switch TPMs you should toggle to the new TPM, clear it, and reinstall Windows. For more information, see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic. -## Turn on or turn off the TPM +For example, toggling TPMs will cause BitLocker to enter recovery mode. We strongly recommend that, on systems with two TPMs, one TPM is selected to be used and the selection is not changed. -Normally, the TPM is turned on as part of the TPM initialization process. You do not normally need to turn the TPM on or off. However, if necessary you can do so by using the TPM MMC. This option is only available with TPM 1.2 and does not apply to TPM 2.0. +## Clear all the keys from the TPM -### Turn on the TPM +With Windows 10, in most cases, we recommend that you avoid configuring the TPM through TPM.msc. The one exception is that you can use TPM.msc to clear the TPM, for example, as a troubleshooting step, or as a final preparation before a clean installation of a new operating system. Preparing for a clean installation in this way helps ensure that the new operating system can fully deploy any TPM-based functionality that it includes, for example, attestation. However, even if the TPM is not cleared before a new operating system is installed, most TPM functionality will probably work correctly. -If the TPM has been initialized but has never been used, or if you want to use the TPM after you have turned it off, you can use the following procedure to turn on the TPM. +Clearing the TPM resets it to an unowned state. After you clear the TPM, the Windows 10 operating system will automatically re-initialize it and take ownership again. -**To turn on the TPM (TPM 1.2 Only)** +> [!WARNING] +> Clearing the TPM can result in data loss. For more information, see the next section, “Precautions to take before clearing the TPM.” -1. Open the TPM MMC (tpm.msc). -2. In the **Action** pane, click **Turn TPM On** to display the **Turn on the TPM Security Hardware** page. Read the instructions on this page. -3. Click **Shutdown** (or **Restart**), and then follow the BIOS screen prompts. +There are several ways to clear the TPM: - After the computer restarts, but before you sign in to Windows, you will be prompted to accept the reconfiguration of the TPM. This ensures that the user has physical access to the computer and that malicious software is not attempting to make changes to the TPM. +- **Clear the TPM as part of a complete reset of the computer**: You might want to remove all files from the computer and completely reset it, for example, in preparation for a clean installation. To do this, we recommend that you use the **Reset** option in **Settings**. When you perform a reset and use the **Remove everything** option, it will clear the TPM as part of the reset. You might be prompted to press a key before the TPM can be cleared. For more information, see the “Reset this PC” section in [Recovery options in Windows 10](https://support.microsoft.com/en-us/help/12415/windows-10-recovery-options). -### Turn off the TPM +- **Clear the TPM to fix “reduced functionality” or “Not ready” TPM status**: If you open TPM.msc and see that the TPM status is something other than **Ready**, you can can try using TPM.msc to clear the TPM and fix the status. However, be sure to review the precautions in the next section. -If you want to stop using the services that are provided by the TPM, you can use the TPM MMC to turn off the TPM. If you have the TPM owner password, physical access to the computer is not required to turn off the TPM. If you do not have the TPM owner password, you must have physical access to the -computer to turn off the TPM. +### Precautions to take before clearing the TPM -**To turn off the TPM (TPM 1.2 only)** +Clearing the TPM can result in data loss. To protect against such loss, review the following precautions: -1. Open the TPM MMC (tpm.msc). -2. In the **Action** pane, click **Turn TPM Off** to display the **Turn off the TPM security hardware** page. -3. In the **Turn off the TPM security hardware** dialog box, select a method to enter your owner password and turning off the TPM: +- Clearing the TPM causes you to lose all created keys associated with the TPM, and data protected by those keys, such as a virtual smart card or a login PIN. Make sure that you have a backup and recovery method for any data that is protected or encrypted by the TPM. - - If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, click **Browse** to locate the .tpm file that is saved on your removable storage device, click **Open**, and then click **Turn TPM Off**. - - If you do not have the removable storage device with your saved TPM owner password, click **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then click **Turn TPM Off**. - - If you do not know your TPM owner password, click **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent BIOS screens to turn off the TPM without entering the password. +- Do not clear the TPM on a device you do not own, such as a work or school PC, without being instructed to do so by your IT administrator. -## Clear all the keys from the TPM +- If you want to temporarily suspend TPM operations and you have TPM 1.2 with Windows 10, version 1507 or 1511, you can turn off the TPM. For more information, see [Turn off the TPM](#turn-off-the-tpm), later in this topic. -Clearing the TPM resets it to an unowned state. After clearing the TPM, you need to complete the TPM initialization process before using software that relies on the TPM, such as BitLocker Drive Encryption. By default, the TPM is initialized automatically. +- Always use functionality in the operating system (such as TPM.msc) to the clear the TPM. Do not clear the TPM directly from UEFI. ->**Important:**  Clearing the TPM can result in data loss. To avoid data loss, make sure that you have a backup or recovery method for any data that is protected or encrypted by the TPM. -  -After the TPM is cleared, it is also turned off. - -To temporarily suspend TPM operations, turn off the TPM instead of clearing it. +- Because your TPM security hardware is a physical part of your computer, before clearing the TPM, you might want to read the manuals or instructions that came with your computer, or search the manufacturer's website. Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. **To clear the TPM** 1. Open the TPM MMC (tpm.msc). -2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. -3. Under **Actions**, click **Clear TPM**. - >**Warning:**  If the TPM is off, reinitialize it before clearing it. - - Clearing the TPM resets it to factory defaults and turns it off. You will lose all created keys and data that is protected by those keys. -   -4. You will be prompted to restart the computer. During the restart, you will be prompted by the BIOS or UEFI to press a button to confirm you wish to clear the TPM. -## Use the TPM cmdlets +2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + +3. Under **Actions**, click **Clear TPM**. + +4. You will be prompted to restart the computer. During the restart, you might be prompted by the UEFI to press a button to confirm that you wish to clear the TPM. + +5. After the PC restarts, your TPM will be automatically prepared for use by Windows 10. + +## Turn on or turn off the TPM (TPM 1.2 with Windows 10, version 1507 or 1511) + +Normally, the TPM is turned on as part of the TPM initialization process. You do not normally need to turn the TPM on or off. However, if necessary you can do so by using the TPM MMC. + +### Turn on the TPM + +If you want to use the TPM after you have turned it off, you can use the following procedure to turn on the TPM. + +**To turn on the TPM (TPM 1.2 with Windows 10, version 1507 or 1511 only)** + +1. Open the TPM MMC (tpm.msc). + +2. In the **Action** pane, click **Turn TPM On** to display the **Turn on the TPM Security Hardware** page. Read the instructions on this page. + +3. Click **Shutdown** (or **Restart**), and then follow the UEFI screen prompts. + + After the computer restarts, but before you sign in to Windows, you will be prompted to accept the reconfiguration of the TPM. This ensures that the user has physical access to the computer and that malicious software is not attempting to make changes to the TPM. + +### Turn off the TPM + +If you want to stop using the services that are provided by the TPM, you can use the TPM MMC to turn off the TPM. + +**To turn off the TPM (TPM 1.2 with Windows 10, version 1507 or 1511 only)** + +1. Open the TPM MMC (tpm.msc). + +2. In the **Action** pane, click **Turn TPM Off** to display the **Turn off the TPM security hardware** page. + +3. In the **Turn off the TPM security hardware** dialog box, select a method to enter your owner password and turning off the TPM: + + - If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, click **Browse** to locate the .tpm file that is saved on your removable storage device, click **Open**, and then click **Turn TPM Off**. + + - If you do not have the removable storage device with your saved TPM owner password, click **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then click **Turn TPM Off**. + + - If you did not save your TPM owner password or no longer know it, click **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent UEFI screens to turn off the TPM without entering the password. + +## Use the TPM cmdlets If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: @@ -166,6 +156,6 @@ If you are using Windows PowerShell to manage your computers, you can also manag For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). -## Additional resources +## Related topics -For more info about TPM, see [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md#bkmk-additionalresources). +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) diff --git a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md index 11d5fe781d..1e16d409a2 100644 --- a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md @@ -24,8 +24,8 @@ Certificates in Windows 10 Mobile are primarily used for the following purposes - For installation and licensing of applications (from the Windows Phone Store or a custom company distribution site). -**Warning**   -In Windows 10, Version 1607, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. [Learn more about this known issue in Version 1607](https://go.microsoft.com/fwlink/p/?LinkId=786764) +>[!WARNING]   +>In Windows 10, Version 1607, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. [Learn more about this known issue in Version 1607](https://go.microsoft.com/fwlink/p/?LinkId=786764) ## Install certificates using Microsoft Edge @@ -33,12 +33,13 @@ A certificate can be posted on a website and made available to users through a d ## Install certificates using email -The Windows 10 Mobile certificate installer supports .cer, .p7b, .pem, and .pfx files. To install certificates via email, make sure your mail filters do not block .cer files. Certificates that are sent via email appear as message attachments. When a certificate is received, a user can tap to review the contents and then tap to install the certificate. Typically, when an identity certificate is installed, the user is prompted for the password (or passphrase) that protects it. +The Windows 10 Mobile certificate installer supports .cer, .p7b, .pem, and .pfx files. Some email programs block .cer files for security reasons. If this is the case in your organization, use an alternative method to deploy the certificate. Certificates that are sent via email appear as message attachments. When a certificate is received, a user can tap to review the contents and then tap to install the certificate. Typically, when an identity certificate is installed, the user is prompted for the password (or passphrase) that protects it. ## Install certificates using mobile device management (MDM) Windows 10 Mobile supports root, CA, and client certificate to be configured via MDM. Using MDM, an administrator can directly add, delete, or query root and CA certificates, and configure the device to enroll a client certificate with a certificate enrollment server that supports Simple Certificate Enrollment Protocol (SCEP). SCEP enrolled client certificates are used by Wi-Fi, VPN, email, and browser for certificate-based client authentication. An MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. -> **Warning:**  Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certificate profile to support S/MIME on Windows 10 Mobile. For instructions on creating a PFX certificate profile in Microsoft Intune, see [Enable access to company resources using certificate profiles with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkID=718216). +>[!WARNING] +>Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certificate profile to support S/MIME on Windows 10 Mobile. For instructions on creating a PFX certificate profile in Microsoft Intune, see [Enable access to company resources using certificate profiles with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkID=718216).   **Process of installing certificates using MDM** @@ -50,14 +51,17 @@ Windows 10 Mobile supports root, CA, and client certificate to be configured vi 6. The device connects to Internet-facing point exposed by MDM server. 7. MDM server creates a certificate that is signed with proper CA certificate and returns it to device. - > **Note:**  The device supports the pending function to allow server side to do additional verification before issuing the cert. In this case, a pending status is sent back to the device. The device will periodically contact the server, based on preconfigured retry count and retry period parameters. Retrying ends when either: - A certificate is successfully received from the server - The server returns an error - The number of retries reaches the preconfigured limit + >[!NOTE] + >The device supports the pending function to allow server side to do additional verification before issuing the cert. In this case, a pending status is sent back to the device. The device will periodically contact the server, based on preconfigured retry count and retry period parameters. Retrying ends when either: + > + >- A certificate is successfully received from the server + >- The server returns an error + >- The number of retries reaches the preconfigured limit   8. The cert is installed in the device. Browser, Wi-Fi, VPN, email, and other first party applications have access to this certificate. - > **Note:**  If MDM requested private key being stored in Trusted Process Module (TPM) (configured during enrollment request), the private key will be saved in TPM. Note that SCEP enrolled cert protected by TPM isn’t guarded by a PIN. However, if the certificate is imported to the Passport for Work Key Storage Provider (KSP), it is guarded by the Passport PIN. + >[!NOTE] + >If MDM requested private key stored in Trusted Process Module (TPM) (configured during enrollment request), the private key will be saved in TPM. Note that SCEP enrolled cert protected by TPM isn’t guarded by a PIN. However, if the certificate is imported to the Windows Hello for Business Key Storage Provider (KSP), it is guarded by the Hello PIN.   ## Related topics diff --git a/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md index 7c1d049314..f82d103fb6 100644 --- a/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md +++ b/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md @@ -35,7 +35,7 @@ When a session is locked in a Windows operating system (meaning the user at the - Blank. - Default setting. This translates to “Not defined,” but it will display the user’s full name in the same manner as the **User display name, domain and user names** option. When an option is set, you cannot reset this policy to blank, or not defined. + Default setting. This translates to “Not defined,” but it will display the user’s full name in the same manner as the **User display name** option. When an option is set, you cannot reset this policy to blank, or not defined. ### Best practices diff --git a/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md b/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md index 0177def043..5af92d1bcf 100644 --- a/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md +++ b/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md @@ -34,8 +34,6 @@ If this policy is disabled, the full name of the last user to log on is displaye Your implementation of this policy depends on your security requirements for displayed logon information. If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have devices with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy. -Depending on your security policy, you might also want to enable the [Interactive logon: Display user information when the session is locked](interactive-logon-display-user-information-when-the-session-is-locked.md) policy, which will prevent the Windows operating system from displaying the logon name when the session is locked or started. - ### Location Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options diff --git a/windows/keep-secure/maintain-applocker-policies.md b/windows/keep-secure/maintain-applocker-policies.md index 43bd39884e..69cf6d1483 100644 --- a/windows/keep-secure/maintain-applocker-policies.md +++ b/windows/keep-secure/maintain-applocker-policies.md @@ -47,7 +47,7 @@ Before modifying a policy, evaluate how the policy is currently implemented. For ### Step 2: Export the AppLocker policy from the GPO -Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference or test computer. To prepare an AppLocker policy for modification, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) +Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference or test computer. To prepare an AppLocker policy for modification, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md). ### Step 3: Update the AppLocker policy by editing the appropriate AppLocker rule diff --git a/windows/keep-secure/manage-tpm-commands.md b/windows/keep-secure/manage-tpm-commands.md index c4b6611da4..71f3c2229e 100644 --- a/windows/keep-secure/manage-tpm-commands.md +++ b/windows/keep-secure/manage-tpm-commands.md @@ -13,44 +13,54 @@ author: brianlic-msft **Applies to** - Windows 10 +- Windows Server 2016 This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. -## - After a computer user takes ownership of the TPM, the TPM owner can limit which TPM commands can be run by creating a list of blocked TPM commands. The list can be created and applied to all computers in a domain by using Group Policy, or a list can be created for individual computers by using the TPM MMC. Because some hardware vendors might provide additional commands or the Trusted Computing Group may decide to add commands in the future, the TPM MMC also supports the ability to block new commands. -Domain administrators can configure a list of blocked TPM commands by using Group Policy. Local administrators cannot allow TPM commands that are blocked through Group Policy. For more information about this Group Policy setting, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-clbtc). +Domain administrators can configure a list of blocked TPM commands by using Group Policy. Local administrators cannot allow TPM commands that are blocked through Group Policy. For more information about this Group Policy setting, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#configure-the-list-of-blocked-tpm-commands). Local administrators can block commands by using the TPM MMC, and commands on the default block list are also blocked unless the Group Policy settings are changed from the default settings. -Two policy settings control the enforcement which allows TPM commands to run. For more information about these policy settings, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-idlb). +Two policy settings control the enforcement which allows TPM commands to run. For more information about these policy settings, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#ignore-the-default-list-of-blocked-tpm-commands). The following procedures describe how to manage the TPM command lists. You must be a member of the local Administrators group. **To block TPM commands by using the Local Group Policy Editor** 1. Open the Local Group Policy Editor (gpedit.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - - >**Note:**  Administrators with appropriate rights in a domain can configure a Group Policy Object (GPO) that can be applied through Active Directory Domain Services (AD DS). -   + + > [!NOTE] + > Administrators with appropriate rights in a domain can configure a Group Policy Object (GPO) that can be applied through Active Directory Domain Services (AD DS). + 2. In the console tree, under **Computer Configuration**, expand **Administrative Templates**, and then expand **System**. + 3. Under **System**, click **Trusted Platform Module Services**. + 4. In the details pane, double-click **Configure the list of blocked TPM commands**. + 5. Click **Enabled**, and then click **Show**. + 6. For each command that you want to block, click **Add**, enter the command number, and then click **OK**. - - >**Note:**  For a list of commands, see the [Trusted Platform Module (TPM) Specifications](https://go.microsoft.com/fwlink/p/?linkid=139770). -   + + > [!NOTE] + > For a list of commands, see links in the [TPM Specification](https://www.trustedcomputinggroup.org/tpm-main-specification/). + 7. After you have added numbers for each command that you want to block, click **OK** twice. + 8. Close the Local Group Policy Editor. **To block or allow TPM commands by using the TPM MMC** 1. Open the TPM MMC (tpm.msc) + 2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + 3. In the console tree, click **Command Management**. A list of TPM commands is displayed. + 4. In the list, select a command that you want to block or allow. + 5. Under **Actions**, click **Block Selected Command** or **Allow Selected Command** as needed. If **Allow Selected Command** is unavailable, that command is currently blocked by Group Policy. **To block new commands** @@ -60,17 +70,19 @@ The following procedures describe how to manage the TPM command lists. You must If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 2. In the console tree, click **Command Management**. A list of TPM commands is displayed. + 3. In the **Action** pane, click **Block New Command**. The **Block New Command** dialog box is displayed. + 4. In the **Command Number** text box, type the number of the new command that you want to block, and then click **OK**. The command number you entered is added to the blocked list. -## Use the TPM cmdlets +## Use the TPM cmdlets If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: `dism /online /enable-feature /FeatureName:tpm-psh-cmdlets` -For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) +For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). -## Additional resources +## Related topics -For more info about TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) diff --git a/windows/keep-secure/manage-tpm-lockout.md b/windows/keep-secure/manage-tpm-lockout.md index f59a117ee3..3f5e966157 100644 --- a/windows/keep-secure/manage-tpm-lockout.md +++ b/windows/keep-secure/manage-tpm-lockout.md @@ -12,10 +12,11 @@ author: brianlic-msft **Applies to** - Windows 10 +- Windows Server 2016 This topic for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. -## About TPM lockout +## About TPM lockout The TPM will lock itself to prevent tampering or malicious attacks. TPM lockout often lasts for a variable amount of time or until the computer is turned off. While the TPM is in lockout mode, it generally returns an error message when it receives commands that require an authorization value. One exception is that the TPM always allows the owner at least one attempt to reset the TPM lockout when it is in lockout mode. @@ -24,49 +25,58 @@ TPM ownership is taken upon first boot by Windows. By default, Windows does not In some cases, encryption keys are protected by a TPM by requiring a valid authorization value to access the key. A common example is configuring BitLocker Drive Encryption to use the TPM plus PIN key protector. In this scenario, the user must type the correct PIN during the boot process to access the volume encryption key protected by the TPM. To prevent malicious users or software from discovering authorization values, TPMs implement protection logic. The protection logic is designed to slow or stop responses from the TPM if it detects that an entity might be trying to guess authorization values. **TPM 1.2** + The industry standards from the Trusted Computing Group (TCG) specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 and TPM 2.0 chips. TPM 1.2 devices implement different protection mechanisms and behavior. In general, the TPM chip takes exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when they mistype an authorization value that is sent to the TPM. This can prevent them from using the TPM for a period of time. **TPM 2.0** - TPM 2.0 devices have standardized lockout behavior which is configured by Windows. TPM 2.0 devices have a maximum count threshold and a healing time. Windows configures the maximum count to be 32 and the healing time to be 2 hours. This means that every continuous two hours of powered on operation without an event which increases the counter will cause the counter to decrease by 1. -If your TPM has entered lockout mode or is responding slowly to commands, you can reset the lockout value by using the following procedures. Resetting the TPM lockout requires the TPM owner’s authorization. This value is no longer retained by default starting with Windows 10 version 1607. +TPM 2.0 devices have standardized lockout behavior which is configured by Windows. TPM 2.0 devices have a maximum count threshold and a healing time. Windows configures the maximum count to be 32 and the healing time to be 2 hours. This means that every continuous two hours of powered on operation without an event which increases the counter will cause the counter to decrease by 1. + +If your TPM has entered lockout mode or is responding slowly to commands, you can reset the lockout value by using the following procedures. Resetting the TPM lockout requires the TPM owner’s authorization. This value is no longer retained by default starting with Windows 10 version 1607. ## Reset the TPM lockout by using the TPM MMC -**Note:** This procedure is only available if you have configured Windows to retain the TPM Owner Password. By default, this password is not available in Windows 10 starting with version 1607. -The following procedure explains the steps to reset the TPM lockout by using the TPM MMC. +> [!NOTE] +> This procedure is only available if you have configured Windows to retain the TPM Owner Password. By default, this password is not available in Windows 10 starting with version 1607. + +The following procedure explains the steps to reset the TPM lockout by using the TPM MMC. **To reset the TPM lockout** 1. Open the TPM MMC (tpm.msc). -2. In the **Action** pane, click **Reset TPM Lockout** to start the Reset TPM Lockout Wizard. -3. Choose one of the following methods to enter the TPM owner password: - - If you saved your TPM owner password to a .tpm file, click **I have the owner password file**, and then type the path to the file, or click **Browse** to navigate to the file location. - - If you want to manually enter your TPM owner password, click **I want to enter the owner password**, and then type the password in the text box provided. - >**Note:**  If you enabled BitLocker and your TPM at the same time, and you printed your BitLocker recovery password when you turned on BitLocker, your TPM owner password may have printed with it. -   +2. In the **Action** pane, click **Reset TPM Lockout** to start the Reset TPM Lockout Wizard. + +3. Choose one of the following methods to enter the TPM owner password: + + - If you saved your TPM owner password to a .tpm file, click **I have the owner password file**, and then type the path to the file, or click **Browse** to navigate to the file location. + + - If you want to manually enter your TPM owner password, click **I want to enter the owner password**, and then type the password in the text box provided. + + > [!NOTE] + > If you enabled BitLocker and your TPM at the same time, and you printed your BitLocker recovery password when you turned on BitLocker, your TPM owner password may have printed with it. + ## Use Group Policy to manage TPM lockout settings The TPM Group Policy settings in the following list are located at: **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** -- [Standard User Lockout Duration](trusted-platform-module-services-group-policy-settings.md#bkmk-individual) +- [Standard User Lockout Duration](trusted-platform-module-services-group-policy-settings.md#standard-user-lockout-duration) This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for TPM commands that require authorization. An authorization failure occurs each time a user sends a command to the TPM and receives an error message that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, the user is prevented from sending commands to the TPM that require authorization. -- [Standard User Individual Lockout Threshold](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-suld) +- [Standard User Individual Lockout Threshold](trusted-platform-module-services-group-policy-settings.md#standard-user-individual-lockout-threshold) This policy setting allows you to manage the maximum number of authorization failures for the TPM for each user. This value is the maximum number of authorization failures that each user can have before the user is not allowed to send commands to the TPM that require authorization. If the number of authorization failures equals the duration that is set for the policy setting, the user is prevented from sending commands to the TPM that require authorization. -- [Standard User Total Lockout Threshold](trusted-platform-module-services-group-policy-settings.md#bkmk-total) - +- [Standard User Total Lockout Threshold](trusted-platform-module-services-group-policy-settings.md#standard-user-total-lockout-threshold) + This policy setting allows you to manage the maximum number of authorization failures for the TPM for all standard users. If the total number of authorization failures for all users equals the duration that is set for the policy, all users are prevented from sending commands to the TPM that require authorization. -For information about mitigating dictionary attacks that use the lockout settings, see [TPM fundamentals](tpm-fundamentals.md#bkmk-howtpmmitigates). +For information about mitigating dictionary attacks that use the lockout settings, see [TPM fundamentals](tpm-fundamentals.md#how-the-tpm-mitigates-dictionary-attacks). -## Use the TPM cmdlets +## Use the TPM cmdlets If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: @@ -74,6 +84,6 @@ If you are using Windows PowerShell to manage your computers, you can also manag For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). -## Additional resources +## Related topics -For more info about TPM, see [TPM technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) diff --git a/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md index c57a618f8e..cf75c935f9 100644 --- a/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -97,22 +97,9 @@ The protection differences provided by multifactor authentication methods cannot In your deployment plan, identify what TPM-based hardware platforms will be supported. Document the hardware models from an OEM of your choice, so that their configurations can be tested and supported. TPM hardware requires special consideration during all aspects of planning and deployment. -### TPM states of existence +### TPM 1.2 states and initialization -For each of the TPM states of existence, the TPM can transition into another state (for example, moving from disabled to enabled). The states are not exclusive. - -| State | Description | -| - | - | -| Enabled| Most features of the TPM are available.
The TPM may be enabled and disabled multiple times within a boot period, if ownership is taken.| -| Disabled | The TPM restricts most operations. Exceptions include the ability to report TPM capabilities, extend and reset Platform Configuration Register (PCR) functions, and to perform hashing and basic initialization.
The TPM may be enabled and disabled multiple times within a boot period.| -| Activated| Most features of the TPM are available. The TPM may be activated and deactivated only through physical presence which requires a reboot.| -| Deactivated| Similar to disabled, with the exception that ownership can be taken while deactivated and enabled. The TPM may be activated and deactivated only through physical presence which requires a reboot.| -| Owned| Most features of the TPM are available. The TPM has an endorsement key and storage root key, and the owner knows information about owner authorization data.| -| Un-owned| The TPM does not have a storage root key and may or may not have an endorsement key.| -  ->**Important:**  BitLocker cannot use the TPM until it is in the following state: enabled, activated, and owned. When the TPM is in this state and only when it is in this state, all operations are available. -  -The state of the TPM exists independent of the computer’s operating system. Once the TPM is enabled, activated, and owned, the state of the TPM is preserved if the operating system is reinstalled. +For TPM 1.2, there are multiple possible states. Windows 10 automatically initializes the TPM, which brings it to an enabled, activated, and owned state. This is the state that BitLocker requires before it can use the TPM. ### Endorsement keys diff --git a/windows/keep-secure/requirements-to-use-applocker.md b/windows/keep-secure/requirements-to-use-applocker.md index 60ac319a63..81fe0f76ba 100644 --- a/windows/keep-secure/requirements-to-use-applocker.md +++ b/windows/keep-secure/requirements-to-use-applocker.md @@ -33,12 +33,10 @@ The following table show the on which operating systems AppLocker features are s | Version | Can be configured | Can be enforced | Available rules | Notes | | - | - | - | - | - | -| Windows 10| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| You can use the [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) to configure AppLocker policies on any edition of Windows 10. You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise and Windows Server 2016. | -| Windows Server 2012 R2| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| | +| Windows 10| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| You can use the [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) to configure AppLocker policies on any edition of Windows 10. You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise, Windows 10 Education, and Windows Server 2016. | +| Windows Server 2016
Windows Server 2012 R2
Windows Server 2012| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| | | Windows 8.1| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| Only the Enterprise edition supports AppLocker| | Windows RT 8.1| No| No| N/A|| -| Windows Server 2012 Standard| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL|| -| Windows Server 2012 Datacenter| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL|| | Windows 8 Pro| No| No| N/A|| | Windows 8 Enterprise| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL|| | Windows RT| No| No| N/A| | diff --git a/windows/keep-secure/smart-card-architecture.md b/windows/keep-secure/smart-card-architecture.md index 84d38741cf..41b2dcc225 100644 --- a/windows/keep-secure/smart-card-architecture.md +++ b/windows/keep-secure/smart-card-architecture.md @@ -74,7 +74,7 @@ Credential providers must be registered on a computer running Windows, and they ## Smart card subsystem architecture -Vendors provide smart cards and smart card readers, and in many cases the vendors are different for the smart card and the smart card reader. Drivers for smart card readers are written to the [Personal Computer/Smart Card (PC/SC) standard](http://www.pcscworkgroup.com/specifications/overview.php). Each smart card must have a Credential Service Provider (CSP) that uses the CryptoAPI interfaces to enable cryptographic operations, and the WinSCard APIs to enable communications with smart card hardware. +Vendors provide smart cards and smart card readers, and in many cases the vendors are different for the smart card and the smart card reader. Drivers for smart card readers are written to the [Personal Computer/Smart Card (PC/SC) standard](https://www.pcscworkgroup.com/). Each smart card must have a Credential Service Provider (CSP) that uses the CryptoAPI interfaces to enable cryptographic operations, and the WinSCard APIs to enable communications with smart card hardware. ### Base CSP and smart card minidriver architecture diff --git a/windows/keep-secure/smart-card-smart-cards-for-windows-service.md b/windows/keep-secure/smart-card-smart-cards-for-windows-service.md index a0c0edd3dc..1c4f17a7f2 100644 --- a/windows/keep-secure/smart-card-smart-cards-for-windows-service.md +++ b/windows/keep-secure/smart-card-smart-cards-for-windows-service.md @@ -14,7 +14,7 @@ Applies To: Windows 10, Windows Server 2016 This topic for the IT professional and smart card developers describes how the Smart Cards for Windows service (formerly called Smart Card Resource Manager) manages readers and application interactions. -The Smart Cards for Windows service provides the basic infrastructure for all other smart card components as it manages smart card readers and application interactions on the computer. It is fully compliant with the specifications set by the PC/SC Workgroup. For information about these specifications, see the [PC/SC Workgroup Specifications Overview](http://www.pcscworkgroup.com/specifications/overview.php). +The Smart Cards for Windows service provides the basic infrastructure for all other smart card components as it manages smart card readers and application interactions on the computer. It is fully compliant with the specifications set by the PC/SC Workgroup. For information about these specifications, see the [PC/SC Workgroup Specifications website](https://www.pcscworkgroup.com/). The Smart Cards for Windows service runs in the context of a local service, and it is implemented as a shared service of the services host (svchost) process. The Smart Cards for Windows service, Scardsvr, has the following service description: diff --git a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md index b60489c882..993c5d1aea 100644 --- a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md @@ -1,6 +1,6 @@ --- -title: Switch PCR banks on TPM 2.0 devices (Windows 10) -description: A Platform Configuration Register (PCR) is a memory location in the TPM that has some unique properties. +title: Understanding PCR banks on TPM 2.0 devices (Windows 10) +description: This topic for the IT professional provides background about what happens when you switch PCR banks on TPM 2.0 devices. ms.assetid: 743FCCCB-99A9-4636-8F48-9ECB3A3D10DE ms.prod: w10 ms.mktglfcycl: deploy @@ -9,10 +9,13 @@ ms.pagetype: security author: brianlic-msft --- -# Switch PCR banks on TPM 2.0 devices +# Understanding PCR banks on TPM 2.0 devices **Applies to** - Windows 10 +- Windows Server 2016 + +For steps on how to switch PCR banks on TPM 2.0 devices on your PC, you should contact your OEM or UEFI vendor. This topic provides background about what happens when you switch PCR banks on TPM 2.0 devices. A Platform Configuration Register (PCR) is a memory location in the TPM that has some unique properties. The size of the value that can be stored in a PCR is determined by the size of a digest generated by an associated hashing algorithm. A SHA-1 PCR can store 20 bytes – the size of a SHA-1 digest. Multiple PCRs associated with the same hashing algorithm are referred to as a PCR bank. @@ -21,7 +24,7 @@ PCR\[N\] = HASHalg( PCR\[N\] || ArgumentOfExtend ) The existing value is concatenated with the argument of the TPM Extend operation. The resulting concatenation is then used as input to the associated hashing algorithm, which computes a digest of the input. This computed digest becomes the new value of the PCR. -The [TCG PC Client Specific Platform TPM Profile for TPM 2.0](https://go.microsoft.com/fwlink/p/?LinkId=746577) defines the inclusion of at least one PCR bank with 24 registers. The only way to reset the first 16 PCRs is to reset the TPM itself. This restriction helps ensure that the value of those PCRs can only be modified via the TPM Extend operation. +The [TCG PC Client Platform TPM Profile Specification](http://www.trustedcomputinggroup.org/pc-client-platform-tpm-profile-ptp-specification/) defines the inclusion of at least one PCR bank with 24 registers. The only way to reset the first 16 PCRs is to reset the TPM itself. This restriction helps ensure that the value of those PCRs can only be modified via the TPM Extend operation. Some TPM PCRs are used as checksums of log events. The log events are extended in the TPM as the events occur. Later, an auditor can validate the logs by computing the expected PCR values from the log and comparing them to the PCR values of the TPM. Since the first 16 TPM PCRs cannot be modified arbitrarily, a match between an expected PCR value in that range and the actual TPM PCR value provides assurance of an unmodified log. @@ -29,8 +32,7 @@ Some TPM PCRs are used as checksums of log events. The log events are extended i To bind the use of a TPM based key to a certain state of the PC, the key can be sealed to an expected set of PCR values. For instance, PCRs 0 through 7 have a well-defined value after the boot process – when the OS is loaded. When the hardware, firmware, or boot loader of the machine changes, the change can be detected in the PCR values. Windows 10 uses this capability to make certain cryptographic keys only available at certain times during the boot process. For instance, the BitLocker key can be used at a certain point in the boot, but not before or after. -It is important to note that this binding to PCR values also includes the hashing algorithm used for the PCR. For instance, a key can be bound to a specific value of the SHA-1 PCR\[12\], if using SHA-256 PCR banks, even with the -same system configuration otherwise, the PCR values will not match. +It is important to note that this binding to PCR values also includes the hashing algorithm used for the PCR. For instance, a key can be bound to a specific value of the SHA-1 PCR\[12\], if using SHA-256 PCR banks, even with the same system configuration. Otherwise, the PCR values will not match. ## What happens when PCR banks are switched? @@ -41,3 +43,7 @@ As a result, if the currently used PCR bank is switched all keys that have been ## What can I do to switch PCRs when BitLocker is already active? Before switching PCR banks you should suspend or disable BitLocker – or have your recovery key ready. For steps on how to switch PCR banks on your PC, you should contact your OEM or UEFI vendor. + +## Related topics + +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) diff --git a/windows/keep-secure/tpm-fundamentals.md b/windows/keep-secure/tpm-fundamentals.md index 92a6fe9b1d..efb080c89c 100644 --- a/windows/keep-secure/tpm-fundamentals.md +++ b/windows/keep-secure/tpm-fundamentals.md @@ -13,6 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 +- Windows Server 2016 This topic for the IT professional provides a description of the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and explains how they are used to mitigate dictionary attacks. @@ -30,109 +31,65 @@ For info about which versions of Windows support which versions of the TPM, see The following sections provide an overview of the technologies that support the TPM: -- [TPM-based Virtual Smart Card](#bkmk-vsc) -- [Measured Boot with support for attestation](#bkmk-measuredboot) -- [Automated provisioning and management of the TPM](#bkmk-autoprov) -- [TPM-based certificate storage](#bkmk-tpmcs) -- [Physical presence interface](#bkmk-physicalpresenceinterface) -- [TPM Cmdlets](#bkmk-tpmcmdlets) -- [TPM Owner Authorization Value](#bkmk-authvalue) -- [States of existence in a TPM](#bkmk-stateex) -- [Endorsement keys](#bkmk-endorsementkeys) -- [TPM Key Attestation](#bkmk-ketattestation) -- [How the TPM mitigates dictionary attacks](#bkmk-howtpmmitigates) -- [How do I check the state of my TPM?](#bkmk-checkstate) -- [What can I do if my TPM is in reduced functionality mode?](#bkmk-fixrfm) +- [Measured Boot with support for attestation](#measured-boot-with-support-for-attestation) + +- [TPM-based Virtual Smart Card](#tpm-based-virtual-smart-card) + +- [TPM-based certificate storage](#tpm-based-certificate-storage) + +- [TPM Cmdlets](#tpm-cmdlets) + +- [Physical presence interface](#physical-presence-interface) + +- [TPM 1.2 states and initialization](#tpm-12-states-and-initialization) + +- [Endorsement keys](#endorsement-keys) + +- [TPM Key Attestation](#key-attestation) + +- [How the TPM mitigates dictionary attacks](#how-the-tpm-mitigates-dictionary-attacks) The following topic describes the TPM Services that can be controlled centrally by using Group Policy settings: -[Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) +[TPM Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). -## Automated provisioning and management of the TPM - -TPM provisioning can be streamlined to make it easier to deploy systems that are ready for BitLocker and other TPM-dependent features. These enhancements include simplifying the TPM state model to report **Ready**, **Ready with reduced functionality**, or **Not ready**. You can also automatically provision TPMs in the **Ready** state, remote provisioning to remove the requirement for the physical presence of a technician for the initial deployment. In addition, the TPM stack is available in the Windows Preinstallation Environment (Windows PE). - -A number of management settings have been added for easier management and configuration of the TPM through Group Policy. The primary new settings include Active Directory-based backup of TPM owner authentication, the level of owner authentication that should be stored locally on the TPM, and the software-based TPM lockout settings for standard users. For more info about backing up owner authentication to Windows Server 2008 R2 AD DS domains, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). - -## Measured Boot with support for attestation +## Measured Boot with support for attestation The Measured Boot feature provides antimalware software with a trusted (resistant to spoofing and tampering) log of all boot components. Antimalware software can use the log to determine whether components that ran before it are trustworthy versus infected with malware. It can also send the Measured Boot logs to a remote server for evaluation. The remote server can initiate remediation actions by interacting with software on the client or through out-of-band mechanisms, as appropriate. -## TPM-based Virtual Smart Card +## TPM-based Virtual Smart Card -The Virtual Smart Card emulates the functionality of traditional smart cards, but Virtual Smart Cards use the TPM chip that is available on an organization’s computers, rather than requiring the use of a separate physical smart card and reader. This greatly reduces the management and deployment cost of smart cards in an enterprise. To the end user, the Virtual Smart Card is always available on the computer. If a user needs to use more than one computer, a +The Virtual Smart Card emulates the functionality of traditional smart cards, but Virtual Smart Cards use the TPM chip that is available on an organization’s computers, rather than requiring the use of a separate physical smart card and reader. This greatly reduces the management and deployment cost of smart cards in an enterprise. To the end user, the Virtual Smart Card is always available on the computer. If a user needs to use more than one computer, a Virtual Smart Card must be issued to the user for each computer. A computer that is shared among multiple users can host multiple Virtual Smart Cards, one for each user. -## TPM-based certificate storage +## TPM-based certificate storage The TPM can be used to protect certificates and RSA keys. The TPM key storage provider (KSP) provides easy, convenient use of the TPM as a way of strongly protecting private keys. The TPM KSP can be used to generate keys when an organization enrolls for certificates, and the KSP is managed by templates in the UI. The TPM can also be used to protect certificates that are imported from an outside source. TPM-based certificates can be used exactly as standard certificates with the added functionality that the certificate can never leave the TPM from which the keys were generated. The TPM can now be used for crypto-operations through Cryptography API: Next Generation (CNG). For more info, see [Cryptography API: Next Generation](http://msdn.microsoft.com/library/windows/desktop/aa376210.aspx). -## TPM Owner Authorization Value - -For Windows 8 a change to how the TPM owner authorization value is stored in AD DS was implemented in the AD DS schema. The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. -This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 schemas. Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012 you need to extend the schema to support this change. If Active Directory backup of the TPM owner authorization value is enabled in a Windows Server 2008 R2 environment without extending the schema, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8. - -If your computer is not being joined to a domain the TPM owner authorization value will be stored in the local computer registry. Using BitLocker to encrypt the operating system drive will protect the owner authorization value from being disclosed when the computer is at rest, but there is a risk that a malicious user could obtain the TPM owner authorization value when the computer is unlocked. Therefore, we recommend that in this situation you configure your computer to automatically lock after 30 seconds of inactivity. If automatic locking is not used, then you should consider removing full owner authorization from the computer registry. - -**Registry information** - -Registry key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\TPM -DWORD: OSManagedAuthLevel - -| Value Data | Setting | -| - | - | -| 0 | None| -| 2 | Delegated| -| 4 | Full| -  ->**Note:**  If the operating system managed TPM authentication setting is changed from "Full" to "Delegated" the full TPM owner authorization value will be regenerated and any copies of the original TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value will be automatically backed up to AD DS when it is changed. -  -## TPM Cmdlets +## TPM Cmdlets If you are using PowerShell to script and manage your computers, you can now manage the TPM using Windows PowerShell as well. To install the TPM cmdlets use the following command: `dism /online /enable-feature /FeatureName:tpm-psh-cmdlets` -For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -## Physical presence interface +For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). -The TCG specifications for TPMs require physical presence to perform some TPM administrative functions, such as turning on and turning off the TPM. Physical presence means a person must physically interact with the system and the -TPM interface to confirm or reject changes to TPM status. This typically cannot be automated with scripts or other automation tools unless the individual OEM supplies them. Here are some are examples of TPM administrative tasks that require physical presence: +## Physical presence interface -- Activating the TPM -- Clearing the existing owner information from the TPM without the owner’s password -- Deactivating the TPM -- Disabling the TPM temporarily without the owner’s password +For TPM 1.2, the TCG specifications for TPMs require physical presence (typically, pressing a key) for turning the TPM on, turning it off, or clearing it. These actions typically cannot be automated with scripts or other automation tools unless the individual OEM supplies them. -## States of existence in a TPM +## TPM 1.2 states and initialization -For each of these TPM 1.2 states of existence, the TPM can transition into another state (for example, moving from disabled to enabled). The states are not exclusive. +For TPM 1.2, there are multiple possible states. Windows 10 automatically initializes the TPM, which brings it to an enabled, activated, and owned state. -These states of existence do not apply for Trusted Platform Module 2.0 because it cannot be turned off from within the operating system environment. +## Endorsement keys -| State | Description | -| - | - | -| Enabled| Most features of the TPM are available.
The TPM can be enabled and disabled multiple times within a boot period, if ownership is taken.| -| Disabled| The TPM restricts most operations. Exceptions include the ability to report TPM capabilities, extend and reset Platform Configuration Register (PCR) functions, and perform hashing and basic initialization.
The TPM can be enabled and disabled multiple times within a start-up period. | -| Activated| Most features of the TPM are available. The TPM can be activated and deactivated only through physical presence, which requires a restart.| -| Deactivated| Similar to the disabled state, with the exception that ownership can be taken when the TPM is deactivated and enabled. The TPM can be activated and deactivated only through physical presence, which requires a restart.| -| Owned| Most features of the TPM are available. The TPM has an endorsement key and storage root key, and the owner knows information about owner authorization data.| -| Unowned| The TPM does not have a storage root key, and it may or may not have an endorsement key.| -  ->**Important:**  Applications cannot use the TPM until the state is enabled, activated, and owned. All operations are available only when the TPM is in this state. -  -The state of the TPM exists independently of the computer’s operating system. When the TPM is enabled, activated, and owned, the state of the TPM is preserved if the operating system is reinstalled. +For a TPM to be usable by a trusted application, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM, and it is never revealed or accessible outside the TPM. -## Endorsement keys - -For a TPM to be usable by a trusted application, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM, and it is never revealed or accessible outside the TPM. If the -TPM does not contain an endorsement key, the application might cause the TPM to generate one automatically as part of the setup. -An endorsement key can be created at various points in the TPM’s lifecycle, but it needs to be created only once for the lifetime of the TPM. The existence of an endorsement key is a requirement before TPM ownership can be taken. - -## Key attestation +## Key attestation TPM key attestation allows a certification authority to verify that a private key is actually protected by a TPM and that the TPM is one that the certification authority trusts. Endorsement keys which have been proven valid can be used to bind the user identity to a device. Moreover, the user certificate with a TPM attested key provides higher security assurance backed up by the non-exportability, anti-hammering, and isolation of keys provided by a TPM. -## How the TPM mitigates dictionary attacks +## How the TPM mitigates dictionary attacks When a TPM processes a command, it does so in a protected environment, for example, a dedicated microcontroller on a discrete chip or a special hardware-protected mode on the main CPU. A TPM can be used to create a cryptographic key that is not disclosed outside the TPM, but is able to be used in the TPM after the correct authorization value is provided. @@ -144,8 +101,9 @@ Because many entities can use the TPM, a single authorization success cannot res TPM 2.0 has well defined dictionary attack logic behavior. This is in contrast to TPM 1.2 for which the dictionary attack logic was set by the manufacturer, and the logic varied widely throughout the industry. ->**Warning:**  For the purposes of this topic, Windows 8 Certified Hardware also pertains to Windows 8.1 systems. The following references to “Windows” include these supported Windows versions. -  +> [!WARNING] +> For the purposes of this topic, Windows 8 Certified Hardware also pertains to Windows 8.1 systems. The following references to “Windows” include these supported Windows versions. + For Windows 8 Certified Hardware systems with TPM 2.0, the TPM is configured by Windows to lock after 32 authorization failures and to forget one authorization failure every two hours. This means that a user could quickly attempt to use a key with the wrong authorization value 32 times. For each of the 32 attempts, the TPM records if the authorization value was correct or not. This inadvertently causes the TPM to enter a locked state after 32 failed attempts. Attempts to use a key with an authorization value for the next two hours would not return success or failure; instead the response indicates that the TPM is locked. After two hours, one authorization failure is forgotten and the number of authorization failures remembered by the TPM drops to 31, so the TPM leaves the locked state and returns to normal operation. With the correct authorization value, keys could be used normally if no authorization failures occur during the next two hours. If a period of 64 hours elapses with no authorization failures, the TPM does not remember any authorization failures, and 32 failed attempts could occur again. @@ -165,35 +123,15 @@ For example, when BitLocker is used with a TPM plus PIN configuration, it needs The Windows TPM-based smart card, which is a virtual smart card, can be configured to allow sign in to the system. In contrast with physical smart cards, the sign-in process uses a TPM-based key with an authorization value. The following list shows the advantages of virtual smart cards: -Physical smart cards can enforce lockout for only the physical smart card PIN, and they can reset the lockout after the correct PIN is entered. With a virtual smart card, the TPM’s dictionary attack is not reset after a successful authentication. The allowed number of authorization failures before the TPM enters lockout includes many factors. +- Physical smart cards can enforce lockout for only the physical smart card PIN, and they can reset the lockout after the correct PIN is entered. With a virtual smart card, the TPM’s dictionary attack is not reset after a successful authentication. The allowed number of authorization failures before the TPM enters lockout includes many factors. -Hardware manufacturers and software developers have the option to use the security features of the TPM to meet their requirements. +- Hardware manufacturers and software developers have the option to use the security features of the TPM to meet their requirements. -The intent of selecting 32 failures as the lock-out threshold is so users rarely lock the TPM (even when learning to type new passwords or if they frequently lock and unlock their computers). If users lock the TPM, they must to wait two hours or use some other credential to sign in, such as a user name and password. +- The intent of selecting 32 failures as the lock-out threshold is so users rarely lock the TPM (even when learning to type new passwords or if they frequently lock and unlock their computers). If users lock the TPM, they must to wait two hours or use some other credential to sign in, such as a user name and password. -## How do I check the state of my TPM? +## Related topics -You can check the state of the TPM on a PC by running the Trusted Platform Module snap-in (tpm.msc). The **Status** heading tells you the state of your TPM. The TPM can be in one of the following states: **Ready for use**, **Ready for use, with reduced functionality**, and **Not ready for use**. To take advantage of most of the TPM features in Windows 10, the TPM must be **Ready for use**. - -## What can I do if my TPM is in reduced functionality mode? - -If your TPM is in reduced functionality mode, some features that rely on the TPM will not function correctly. This is most often caused by doing a clean installation of Windows 10 on a device where Windows 8.1, Windows 8, or Windows 7 had previously been installed on the same hardware. If your TPM is in reduced functionality mode, the Status heading in the Trusted Platform Module snap-in shows **The TPM is ready for use, with reduced functionality**. -You can fix this by clearing the TPM. - -**To clear the TPM** - -1. Open the Trusted Platform Module snap-in (tpm.msc). -2. Click **Clear TPM**, and then click **Restart.** -3. When the PC is restarting, you might be prompted to press a button on the keyboard to clear the TPM. -4. After the PC restarts, your TPM will be automatically prepared for use by Windows 10. - ->**Note:**  Clearing the TPM causes you to lose all TPM keys and data protected by those keys, such as a virtual smart card. You should not perform this procedure on a device you do not own, such as a work or school PC, without being instructed to do so by your IT administrator. -  -## Additional resources - -- [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) -- [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) - [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -- [Schema Extensions for Windows Server 2008 R2 to support AD DS backup of TPM information from Windows 8 clients](ad-ds-schema-extensions-to-support-tpm-backup.md) -- [TPM WMI providers](https://go.microsoft.com/fwlink/p/?LinkId=93478) -- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) +- [TPM WMI providers](https://msdn.microsoft.com/library/aa376476.aspx) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://technet.microsoft.com/itpro/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) \ No newline at end of file diff --git a/windows/keep-secure/tpm-recommendations.md b/windows/keep-secure/tpm-recommendations.md index 0b34d5a9a8..20d05b68d2 100644 --- a/windows/keep-secure/tpm-recommendations.md +++ b/windows/keep-secure/tpm-recommendations.md @@ -12,26 +12,21 @@ author: brianlic-msft # TPM recommendations +**Applies to** + **Applies to** - Windows 10 -- Windows 10 Mobile -- Windows Server 2016 -- Windows 10 IoT Core (IoT Core) +- Windows Server 2016 This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. -## Overview +For a basic feature description of TPM, see the [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md). -Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. It has a security-related crypto-processor that is designed to carry out cryptographic operations in a variety of devices and form factors. It includes multiple physical security mechanisms to help prevent malicious software from tampering with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: +## TPM design and implementation -1. Generate, store, use, and protected cryptographic keys, -2. Use TPM technology for platform device authentication by using a unique endorsement key (EK), and -3. Help enhance platform integrity by taking and storing security measurements. - -The most common TPM functions are used for system integrity measurements and for key creation and use. During the boot process of a system, the boot code that is loaded (including firmware and the operating system components) can be measured and recorded in the TPM. The integrity measurements can be used as evidence for how a system started and to make sure that a TPM-based key was used only when the correct software was used to boot the system. Traditionally, TPMs have been discrete chips soldered to a computer’s motherboard. Such implementations allow the computer’s original equipment manufacturer (OEM) to evaluate and certify the TPM separate from the rest of the system. Although discrete TPM implementations are still common, they can be problematic for integrated devices that are small or have low power consumption. Some newer TPM implementations integrate TPM functionality into the same chipset as other platform components while still providing logical separation similar to discrete TPM chips. -TPMs are passive: they receive commands and return responses. To realize the full benefit of a TPM, the OEM must carefully integrate system hardware and firmware with the TPM to send it commands and react to its responses. TPMs were originally designed to provide security and privacy benefits to a platform’s owner and users, but newer versions can provide security and privacy benefits to the system hardware itself. Before it can be used for advanced scenarios, however, a TPM must be provisioned. Windows 10 automatically provisions a TPM, but if the user reinstalls the operating system, he or she may need to tell the operating system to explicitly provision the TPM again before it can use all the TPM’s features. +TPMs are passive: they receive commands and return responses. To realize the full benefit of a TPM, the OEM must carefully integrate system hardware and firmware with the TPM to send it commands and react to its responses. TPMs were originally designed to provide security and privacy benefits to a platform’s owner and users, but newer versions can provide security and privacy benefits to the system hardware itself. Before it can be used for advanced scenarios, however, a TPM must be provisioned. Windows 10 automatically provisions a TPM, but if the user is planning to reinstall the operating system, he or she may need to clear the TPM before reinstalling so that Windows can take full advantage of the TPM. The Trusted Computing Group (TCG) is the nonprofit organization that publishes and maintains the TPM specification. The TCG exists to develop, define, and promote vendor-neutral, global industry standards that support a hardware-based root of trust for interoperable trusted computing platforms. The TCG also publishes the TPM specification as the international standard ISO/IEC 11889, using the Publicly Available Specification Submission Process that the Joint Technical Committee 1 defines between the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). @@ -39,9 +34,6 @@ OEMs implement the TPM as a component in a trusted computing platform, such as a The TCG designed the TPM as a low-cost, mass-market security solution that addresses the requirements of different customer segments. There are variations in the security properties of different TPM implementations just as there are variations in customer and regulatory requirements for different sectors. In public-sector procurement, for example, some governments have clearly defined security requirements for TPMs whereas others do not. ->**Note:**  Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - - ## TPM 1.2 vs. 2.0 comparison From an industry standard, Microsoft has been an industry leader in moving and standardizing on TPM 2.0, which has many key realized benefits across algorithms, crypto, hierarchy, root keys, authorization and NV RAM. @@ -51,16 +43,23 @@ From an industry standard, Microsoft has been an industry leader in moving and s TPM 2.0 products and systems have important security advantages over TPM 1.2, including: - The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. + - For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. + - TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. - - TPM 2.0 supports SHA-256 as well as ECC, the latter being critical to drive signing and key generation performance. + - TPM 2.0 supports newer algorithms, which can improve drive signing and key generation performance. For the full list of supported algorithms, see the [TCG Algorithm Registry](http://www.trustedcomputinggroup.org/tcg-algorithm-registry/). Some TPMs do not support all algorithms. + + - For the list of algorithms that Windows supports in the platform cryptographic storage provider, see [CNG Cryptographic Algorithm Providers](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx). + - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](http://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)). + - Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions. - TPM 2.0 offers a more **consistent experience** across different implementations. - TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary. + - TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee. - While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. @@ -69,22 +68,24 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in There are three implementation options for TPMs: -- Discrete TPM chip as a separate component in its own semiconductor package -- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components +- Discrete TPM chip as a separate component in its own semiconductor package + +- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components + - Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit -Windows uses any compatible TPM in the same way. Microsoft does not take a position on which way a TPM should be implemented and there is a wide ecosystem of available TPM solutions which should suit all needs. +Windows uses any compatible TPM in the same way. Microsoft does not take a position on which way a TPM should be implemented and there is a wide ecosystem of available TPM solutions which should suit all needs. -## Is there any importance for TPM for consumer? +## Is there any importance for TPM for consumers? -For end consumers, TPM is behind the scenes but is still very relevant. TPM is used for Windows Hello, Windows Hello for Business and in the future, will be a components of many other key security features in Windows. TPM secures the PIN, helps encrypt passwords, and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. +For end consumers, TPM is behind the scenes but is still very relevant. TPM is used for Windows Hello, Windows Hello for Business and in the future, will be a component of many other key security features in Windows. TPM secures the PIN, helps encrypt passwords, and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. ## TPM 2.0 Compliance for Windows 10 ### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) -- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7, https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx) - +- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx) page). + ### IoT Core - TPM is optional on IoT Core. @@ -95,212 +96,28 @@ For end consumers, TPM is behind the scenes but is still very relevant. TPM is ## TPM and Windows Features -The following table defines which Windows features require TPM support. Some features are not applicable to Windows 7/8/8.1 and are noted accordingly. +The following table defines which Windows features require TPM support. -
------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows FeaturesWindows 7/8/8.1 TPM 1.2Windows 10 TPM 1.2Windows 10 TPM 2.0Details
Measured BootRequiredRequiredRequiredMeasured boot requires TPM 1.2 or 2.0 and UEFI Secure boot.
BitlockerRequiredRequiredRequiredTPM 1.2 or later required or a removable USB memory device such as a flash drive.
Passport: Domain AADJ Joinn/aRequiredRequiredSupports both versions of TPM, but requires TPM with HMAC and EK certificate for key attestation support.
Passport: MSA or Local Accountn/aRequiredRequiredTPM 2.0 is required with HMAC and EK certificate for key attestation support.
Device Encryptionn/aNot RequiredRequiredTPM 2.0 is required for all InstantGo devices.
Device Guard / Configurable Code Integrityn/aOptionalOptional
Credential Guardn/aRequiredRequiredFor Windows 10, version 1511, TPM 1.2 or 2.0 is highly recommended. If you don't have a TPM installed, Credential Guard will still be enabled, but the keys used to encrypt Credential Guard will not be protected by the TPM.
Device Health Attestationn/aRequiredRequired
Windows Hellon/aNot RequiredNot Required
UEFI Secure BootNot RequiredNot RequiredNot Required
Platform Key Storage providern/aRequiredRequired
Virtual Smart Cardn/aRequiredRequired
Certificate storage (TPM bound)n/aRequiredRequired
-  -## Chipset options for TPM 2.0 -There is a vibrant ecosystem of TPM manufacturers. -### Discrete TPM - --- - - - - - - - - - - -
Supplier
    -
  • Infineon
    • -
  • Nuvoton
    • -
  • Atmel
    • -
  • NationZ
    • -
  • ST Micro
    • -
-  -### Integrated TPM - --- - - - - - - - - - - - - -
SupplierChipset
Intel
    -
  • Atom (CloverTrail) -
  • Baytrail
    • -
  • Braswell
    • -
  • 4th generation Core (Haswell)
    • -
  • 5th generation Core (Broadwell)
    • -
  • 6th generation Core (Skylake)
    • -
  • 7th generation Core (Kaby Lake)
    • -
+| Windows Features | Windows 10 TPM 1.2 | Windows 10 TPM 2.0 | Details | +|-------------------------|----------------------|----------------------|----------| +| Measured Boot | Required | Required | Measured boot requires TPM 1.2 or 2.0 and UEFI Secure boot. | +| Bitlocker | Required | Required | TPM 1.2 or later required or a removable USB memory device such as a flash drive. | +| Passport: Domain AADJ Join | Required | Required | Supports both versions of TPM, but requires TPM with HMAC and EK certificate for key attestation support. | +| Passport: MSA or Local Account | Required | Required | TPM 2.0 is required with HMAC and EK certificate for key attestation support. | +| Device Encryption | Not Applicable | Required | TPM 2.0 is required for all InstantGo devices. | +| Device Guard / Configurable Code Integrity | See next column | Recommended | | +| Credential Guard | Required | Required | For Windows 10, version 1511, TPM 1.2 or 2.0 is highly recommended. If you don't have a TPM installed, Credential Guard will still be enabled, but the keys used to encrypt Credential Guard will not be protected by the TPM. | +| Device Health Attestation | Required | Required | | +| Windows Hello | Not Required | Recommended | | +| UEFI Secure Boot | Not Required | Recommended | | +| Platform Key Storage provider | Required | Required | | +| Virtual Smart Card | Required | Required | | +| Certificate storage (TPM bound) | Required | Required | | + +## OEM Status on TPM 2.0 system availability and certified parts -### Firmware TPM - ---- - - - - - - - - - - - - - - - - -
SupplierChipset
AMD
    -
  • Mullins
    • -
  • Beema
    • -
  • Carrizo
    • -
Qualcomm
    -
  • MSM8994
    • -
  • MSM8992
    • -
  • MSM8952
    • -
  • MSM8909
    • -
  • MSM8208
    • -
-  -## OEM Feedback and Status on TPM 2.0 system availability +Government customers and enterprise customers in regulated industries may have acquisition standards that require use of common certified TPM parts. As a result, OEMs, who provide the devices, may be required to use only certified TPM components on their commercial class systems. For more information, contact your OEM or hardware vendor. -### Certified TPM parts +## Related topics -Government customers and enterprise customers in regulated industries may have acquisition standards that require use of common certified TPM parts. As a result, OEMs, who provide the devices, may be required to use only certified TPM components on their commercial class systems. Discrete TPM 2.0 vendors have completion certification. - -### Windows 7 32-bit support - -Even though Windows 7 shipped before the TPM 2.0 spec or products existed, Microsoft backported TPM 2.0 support to Windows 7 64-bit and released it in summer 2014 as a downloadable Windows hotfix for UEFI based Windows 7 systems. Microsoft is not currently planning to backport support to Windows 7 32-bit support. +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) \ No newline at end of file diff --git a/windows/keep-secure/trusted-platform-module-overview.md b/windows/keep-secure/trusted-platform-module-overview.md index a1b3a32c2d..ba05130ce1 100644 --- a/windows/keep-secure/trusted-platform-module-overview.md +++ b/windows/keep-secure/trusted-platform-module-overview.md @@ -1,6 +1,6 @@ --- title: Trusted Platform Module Technology Overview (Windows 10) -description: This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM. +description: This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. ms.assetid: face8932-b034-4319-86ac-db1163d46538 ms.prod: w10 ms.mktglfcycl: deploy @@ -14,64 +14,70 @@ author: brianlic-msft **Applies to** - Windows 10 +- Windows Server 2016 -This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM. +This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. -## Feature description +## Feature description Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: - Generate, store, and limit the use of cryptographic keys. + - Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself. + - Help ensure platform integrity by taking and storing security measurements. The most common TPM functions are used for system integrity measurements and for key creation and use. During the boot process of a system, the boot code that is loaded (including firmware and the operating system components) can be measured and recorded in the TPM. The integrity measurements can be used as evidence for how a system started and to make sure that a TPM-based key was used only when the correct software was used to boot the system. TPM-based keys can be configured in a variety of ways. One option is to make a TPM-based key unavailable outside the TPM. This is good to mitigate phishing attacks because it prevents the key from being copied and used without the TPM. TPM-based keys can also be configured to require an authorization value to use them. If too many incorrect authorization guesses occur, the TPM will activate its dictionary attack logic and prevent further authorization value guesses. -Different versions of the TPM are defined in specifications by the Trusted Computing Group (TCG). For more information, consult the TCG Web site (). +Different versions of the TPM are defined in specifications by the Trusted Computing Group (TCG). For more information, consult the [TCG Web site](http://www.trustedcomputinggroup.org/work-groups/trusted-platform-module/). -Windows can automatically provision and manage the TPM. Group Policy settings can be configured to control whether the TPM owner authorization value is backed up in Active Directory. Because the TPM state persists across operating system installations, TPM information is stored in a location in Active Directory that is separate from computer objects. Depending on an enterprise’s security goals, Group Policy can be configured to allow or prevent local administrators from resetting the TPM’s dictionary attack logic. Standard users can use the TPM, but Group Policy controls limit how many authorization failures standard users can attempt so that one user is unable to prevent other users or the administrator from using the TPM. TPM technology can also be used as a virtual smart card and for secure certificate storage. With BitLocker Network Unlock, domain-joined computers are not prompted for a BitLocker PIN. +### Automatic initialization of the TPM with Windows 10 -## Practical applications +Starting with Windows 10, the operating system automatically initializes and takes ownership of the TPM. This means that in most cases, we recommend that you avoid configuring the TPM through the TPM management console, **TPM.msc**. There are a few exceptions, mostly related to resetting or performing a clean installation on a PC. For more information, see [Clear all the keys from the TPM](initialize-and-configure-ownership-of-the-tpm.md#clear-all-the-keys-from-the-tpm). + +In certain specific enterprise scenarios limited to Windows 10, versions 1507 and 1511, Group Policy might be used to back up the TPM owner authorization value in Active Directory. Because the TPM state persists across operating system installations, this TPM information is stored in a location in Active Directory that is separate from computer objects. + +## Practical applications Certificates can be installed or created on computers that are using the TPM. After a computer is provisioned, the RSA private key for a certificate is bound to the TPM and cannot be exported. The TPM can also be used as a replacement for smart cards, which reduces the costs associated with creating and disbursing smart cards. Automated provisioning in the TPM reduces the cost of TPM deployment in an enterprise. New APIs for TPM management can determine if TPM provisioning actions require physical presence of a service technician to approve TPM state change requests during the boot process. -Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. +Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10 or Windows Server 2016. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. -The TPM has several Group Policy settings that can be used to manage how it is used. These settings can be used to manage the owner authorization value, the blocked TPM commands, the standard user lockout, and the backup of the TPM to AD DS. For more info, see [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). +The TPM has several Group Policy settings that might be useful in certain enterprise scenarios. For more info, see [TPM Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). -## New and changed functionality +## New and changed functionality -For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](../whats-new/whats-new-windows-10-version-1507-and-1511.md#trusted-platform-module). +For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511#trusted-platform-module). -## Device health attestation +## Device health attestation Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device heath attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource. Some things that you can check on the device are: - Is Data Execution Prevention supported and enabled? + - Is BitLocker Drive Encryption supported and enabled? + - Is SecureBoot supported and enabled? ->**Note:**  The device must be running Windows 10 and it must support at least TPM 2.0. -  -## Supported versions +> [!NOTE] +> The device must be running Windows 10 and it must support at least TPM 2.0. -| TPM version | Windows 10 | Windows Server 2012 R2, Windows 8.1, and Windows RT | Windows Server 2012, Windows 8, and Windows RT | Windows Server 2008 R2 and Windows 7 | -| - | - | - | - | - | -| TPM 1.2| X| X| X| X| -| TPM 2.0| X| X| X| X| +## Supported versions -## Additional Resources +| TPM version | Windows 10 | Windows Server 2016 | +|-------------|------------|---------------------| +| TPM 1.2 | X | X | +| TPM 2.0 | X | X | -- [TPM Fundamentals](tpm-fundamentals.md) -- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) -- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -- [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md) -- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) -  -  +## Related topics + +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) +- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://technet.microsoft.com/itpro/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) diff --git a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md index 8621397fcd..27fa6ec7db 100644 --- a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md +++ b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md @@ -13,103 +13,94 @@ author: brianlic-msft **Applies to** - Windows 10 +- Windows Server 2016 This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. -## - The TPM Services Group Policy settings are located at: **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** -| Setting | Windows 10, version 1607 | Windows 10, version 1511 and Windows 10, version 1507 | Windows Server 2012 R2, Windows 8.1 and Windows RT | Windows Server 2012, Windows 8 and Windows RT | Windows Server 2008 R2 and Windows 7 | Windows Server 2008 and Windows Vista | -| - | - | - | - | - | - | - | -| [Turn on TPM backup to Active Directory Domain Services](#bkmk-tpmgp-addsbu) | | X| X| X| X| X| -| [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc)| X| X| X| X| X| X| -| [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) | X| X| X| X| X| X| -| [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) | X| X| X| X| X| X| -| [Configure the level of TPM owner authorization information available to the operating system](#bkmk-tpmgp-oauthos)| | X| X| X||| -| [Standard User Lockout Duration](#bkmk-tpmgp-suld)| X| X| X| X||| -| [Standard User Individual Lockout Threshold](#bkmk-individual)| X| X| X| X||| -| [Standard User Total Lockout Threshold](#bkmk-total)| X| X| X| X|||| +| Setting | Windows 10, version 1607 and Windows Server 2016 | Windows 10, version 1511 and Windows 10, version 1507 | +|-----------------|--------------------------------------------------|-------------------------------------------------------| +| [Turn on TPM backup to Active Directory Domain Services](#turn-on-tpm-backup-to-active-directory-domain-services) | | X | +| [Configure the list of blocked TPM commands](#configure-the-list-of-blocked-tpm-commands) | X | X | +| [Ignore the default list of blocked TPM commands](#ignore-the-default-list-of-blocked-tpm-commands) | X | X | +| [Ignore the local list of blocked TPM commands](#ignore-the-local-list-of-blocked-tpm-commands) | X | X | +| [Configure the level of TPM owner authorization information available to the operating system](#configure-the-level-of-tpm-owner-authorization-information-available-to-the-operating-system) | X | X | +| [Standard User Lockout Duration](#standard-user-lockout-duration) | X | X | +| [Standard User Individual Lockout Threshold](#standard-user-individual-lockout-threshold) | X | X | +| [Standard User Total Lockout Threshold](#standard-user-total-lockout-threshold) | X | X | -### Turn on TPM backup to Active Directory Domain Services +### Turn on TPM backup to Active Directory Domain Services This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of TPM owner information. ->[!NOTE] ->This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). - - TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can be run only by the TPM owner. This hash authorizes the TPM to run these commands. ->[!IMPORTANT] ->To back up TPM owner information from a computer running Windows 10, version 1507, Windows 10, version 1511, Windows 8.1, or Windows 8, you might need to first set up appropriate schema extensions and access control settings on the domain so that the AD DS backup can succeed. Windows Server 2012 R2 and Windows Server 2012 include the required schema extensions by default. For more information, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). This functionality is discontinued starting with Windows 10, version 1607. +> [!IMPORTANT] +> The **Turn on TPM backup to Active Directory Domain Services** is not available in the Windows 10, version 1607 and Windows Server 2016 and later versions of the ADMX files. If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. When this policy setting is enabled, a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds. If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS. ->[!NOTE] -> The **Turn on TPM backup to Active Directory Domain Services** is not available in the Windows 10, version 1607 and Windows Server 2016 and later versions of the ADMX files. - - -### Configure the list of blocked TPM commands +### Configure the list of blocked TPM commands This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands that are blocked by Windows. ->**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -  -If you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is **TPM\_OwnerReadInternalPub**, and command number 170 is **TPM\_FieldUpgrade**. To find the command number that is associated with each TPM command, at the command prompt, type **tpm.msc**to open the TPM Management Console and navigate to the **Command Management** section. +If you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is **TPM\_OwnerReadInternalPub**, and command number 170 is **TPM\_FieldUpgrade**. To find the command number that is associated with each TPM command, at the command prompt, type **tpm.msc** to open the TPM Management Console and navigate to the **Command Management** section. If you disable or do not configure this policy setting, only those TPM commands that are specified through the default or local lists can be blocked by Windows. The default list of blocked TPM commands is preconfigured by Windows. - You can view the default list by typing **tpm.msc** at the command prompt, navigating to the **Command Management** section, and exposing the **On Default Block List** column. + - The local list of blocked TPM commands is configured outside of Group Policy by running the TPM Management Console or scripting using the **Win32\_Tpm** interface. For information how to enforce or ignore the default and local lists of blocked TPM commands, see -- [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) -- [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) +- [Ignore the default list of blocked TPM commands](#ignore-the-default-list-of-blocked-tpm-commands) -### Ignore the default list of blocked TPM commands +- [Ignore the local list of blocked TPM commands](#ignore-the-local-list-of-blocked-tpm-commands) + +### Ignore the default list of blocked TPM commands This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands. ->**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -  -The default list of blocked TPM commands is preconfigured by Windows. You can view the default list by typing **tpm.msc** at the command prompt to open the TPM Management Console, navigating to the **Command Management** section, and exposing the **On Default Block List** column. Also see the related policy setting, [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc). +The default list of blocked TPM commands is preconfigured by Windows. You can view the default list by typing **tpm.msc** at the command prompt to open the TPM Management Console, navigating to the **Command Management** section, and exposing the **On Default Block List** column. Also see the related policy setting, [Configure the list of blocked TPM commands](#configure-the-list-of-blocked-tpm-commands). If you enable this policy setting, the Windows operating system will ignore the computer's default list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the local list. If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to the commands that are specified by Group Policy and the local list of blocked TPM commands. -### Ignore the local list of blocked TPM commands +### Ignore the local list of blocked TPM commands This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands. ->**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -  -The local list of blocked TPM commands is configured outside of Group Policy by typing **tpm.msc** at the command prompt to open the TPM Management Console, or scripting using the **Win32\_Tpm** interface. (The default list of blocked TPM commands is preconfigured by Windows.) Also see the related policy setting to **Configure the list of blocked TPM commands**. +The local list of blocked TPM commands is configured outside of Group Policy by typing **tpm.msc** at the command prompt to open the TPM Management Console, or scripting using the **Win32\_Tpm** interface. (The default list of blocked TPM commands is preconfigured by Windows.) Also see the related policy setting, [Configure the list of blocked TPM commands](#configure-the-list-of-blocked-tpm-commands). If you enable this policy setting, the Windows operating system will ignore the computer's local list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the default list. If you disable or do not configure this policy setting, Windows will block the TPM commands in the local list, in addition to the commands that are specified in Group Policy and the default list of blocked TPM commands. -### Configure the level of TPM owner authorization information available to the operating system +### Configure the level of TPM owner authorization information available to the operating system This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information that is stored locally, the Windows operating system and TPM-based applications can perform certain actions in the TPM that require TPM owner authorization without requiring the user to enter the TPM owner password. ->**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -  +> [!IMPORTANT] +> This policy setting is not available in the Windows 10, version 1607 and Windows Server 2016 and later versions of the ADMX files. + There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**. - **Full**   This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. + - **Delegated**   This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. This is the default setting in Windows. + - **None**   This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization cannot be stored locally. Using this setting might cause issues with some TPM-based applications. ->**Note:**  If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. -  +> [!NOTE] +> If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. + **Registry information** Registry key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\TPM @@ -118,43 +109,41 @@ DWORD: OSManagedAuthLevel The following table shows the TPM owner authorization values in the registry. -| Value Data | Setting | -| - | - | -| 0 | None| -| 2 | Delegated| -| 4 | Full| +| Value Data | Setting | +|------------|-----------| +| 0 | None | +| 2 | Delegated | +| 4 | Full | +   If you enable this policy setting, the Windows operating system will store the TPM owner authorization in the registry of the local computer according to the TPM authentication setting you choose. -If you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not +If you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not configured, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is enabled, only the administrative delegation and the user delegation blobs are stored in the local registry. -### Standard User Lockout Duration +### Standard User Lockout Duration -This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, a standard user is prevented from sending commands that require +This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, a standard user is prevented from sending commands that require authorization to the TPM. ->**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -  The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption. This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. For each standard user, two thresholds apply. Exceeding either threshold prevents the user from sending a command that requires authorization to the TPM. Use the following policy settings to set the lockout duration: -- [Standard User Individual Lockout Threshold](#bkmk-individual)   This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. -- [Standard User Total Lockout Threshold](#bkmk-total)   This value is the maximum total number of authorization failures that all standard users can have before all standard users are not allowed to send commands that require authorization to the TPM. +- [Standard User Individual Lockout Threshold](#standard-user-individual-lockout-threshold)   This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. + +- [Standard User Total Lockout Threshold](#standard-user-total-lockout-threshold)   This value is the maximum total number of authorization failures that all standard users can have before all standard users are not allowed to send commands that require authorization to the TPM. An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. If you do not configure this policy setting, a default value of 480 minutes (8 hours) is used. -### Standard User Individual Lockout Threshold +### Standard User Individual Lockout Threshold This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM). This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. If the number of authorization failures for the user within the duration that is set for the **Standard User Lockout Duration** policy setting equals this value, the standard user is prevented from sending commands that require authorization to the Trusted Platform Module (TPM). ->**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -  This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. @@ -163,29 +152,20 @@ An administrator with the TPM owner password can fully reset the TPM's hardware If you do not configure this policy setting, a default value of 4 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. -### Standard User Total Lockout Threshold +### Standard User Total Lockout Threshold This policy setting allows you to manage the maximum number of authorization failures for all standard users for the Trusted Platform Module (TPM). If the total number of authorization failures for all standard users within the duration that is set for the **Standard User Lockout Duration** policy equals this value, all standard users are prevented from sending commands that require authorization to the Trusted Platform Module (TPM). ->**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -  This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. -For each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization. - -1. The standard user individual lockout value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM. -2. The standard user total lockout threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. -The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features -such as BitLocker Drive Encryption.. - An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. If you do not configure this policy setting, a default value of 9 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. -## Additional resources +## Related topics -- [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) - [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://technet.microsoft.com/itpro/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) \ No newline at end of file diff --git a/windows/keep-secure/trusted-platform-module-top-node.md b/windows/keep-secure/trusted-platform-module-top-node.md new file mode 100644 index 0000000000..ad6428c661 --- /dev/null +++ b/windows/keep-secure/trusted-platform-module-top-node.md @@ -0,0 +1,33 @@ +--- +title: Trusted Platform Module (Windows 10) +description: This topic for the IT professional provides links to information about the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +--- + +# Trusted Platform Module + +**Applies to** +- Windows 10 +- Windows Server 2016 + +Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. The following topics provide details. + + + +| Topic | Description | +|-------|-------------| +| [Trusted Platform Module Overview](trusted-platform-module-overview.md) | Provides an overview of the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. | +| [TPM fundamentals](tpm-fundamentals.md) | Provides background about how a TPM can work with cryptographic keys. Also describes technologies that work with the TPM, such as TPM-based virtual smart cards. | +| [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) | Describes TPM services that can be controlled centrally by using Group Policy settings. | +| [Back up the TPM recovery information to AD DS](backup-tpm-recovery-information-to-ad-ds.md) | For Windows 10, version 1511 and Windows 10, version 1507 only, describes how to back up a computer’s TPM information to Active Directory Domain Services. | +| [Manage TPM commands](manage-tpm-commands.md) | Describes methods by which a local or domain administrator can block or allow specific TPM commands. | +| [Manage TPM lockout](manage-tpm-lockout.md) | Describes how TPM lockout works (to help prevent tampering or malicious attacks), and outlines ways to work with TPM lockout settings. | +| [Change the TPM owner password](change-the-tpm-owner-password.md) | In most cases, applies to Windows 10, version 1511 and Windows 10, version 1507 only. Tells how to change the TPM owner password. | +| [View status, clear, or troubleshoot the TPM](initialize-and-configure-ownership-of-the-tpm.md) | Describes actions you can take through the TPM snap-in, TPM.msc: view TPM status, troubleshoot TPM initialization, and clear keys from the TPM. Also, for TPM 1.2 and Windows 10, version 1507 or 1511, describes how to turn the TPM on or off. | +| [Understanding PCR banks on TPM 2.0 devices](switch-pcr-banks-on-tpm-2-0-devices.md) | Provides background about what happens when you switch PCR banks on TPM 2.0 devices. | +| [TPM recommendations](tpm-recommendations.md) | Discusses aspects of TPMs such as the difference between TPM 1.2 and 2.0, and the Windows 10 features for which a TPM is required or recommended. | diff --git a/windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md b/windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md new file mode 100644 index 0000000000..0386127ed4 --- /dev/null +++ b/windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md @@ -0,0 +1,67 @@ +--- +title: Windows 10 Credential Theft Mitigation Guide Abstract (Windows 10) +description: Provides a summary of the Windows 10 credential theft mitigation guide. +ms.assetid: 821ddc1a-f401-4732-82a7-40d1fff5a78a +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: justinha +--- + +# Windows 10 Credential Theft Mitigation Guide Abstract + +**Applies to** +- Windows 10 + +This topic provides a summary of the Windows 10 credential theft mitigation guide, which can be downloaded from the Microsoft Download Center. +This guide explains how credential theft attacks occur and the strategies and countermeasures you can implement to mitigate them, following these security stages: + +- Identify high-value assets +- Protect against known and unknown threats +- Detect pass-the-hash and related attacks +- Respond to suspicious activity +- Recover from a breach + +![Security stages](images\security-stages.png) + +## Attacks that steal credentials + +Learn about the different types of attacks that are used to steal credentials, and the factors that can place your organization at risk. +The types of attacks that are covered include: + +- Pass the hash +- Kerberos pass the ticket +- Kerberos golden ticket and silver ticket +- Key loggers +- Shoulder surfing + +## Credential protection strategies + +This part of the guide helps you consider the mindset of the attacker, with prescriptive guidance about how to prioritize high-value accounts and computers. +You'll learn how to architect a defense against credential theft: + +- Establish a containment model for account privileges +- Harden and restrict administrative hosts +- Ensure that security configurations and best practices are implemented + +## Technical countermeasures for credential theft + +Objectives and expected outcomes are covered for each of these countermeasures: + +- Use Windows 10 with Credential Guard +- Restrict and protect high-privilege domain accounts +- Restrict and protect local accounts with administrative privileges +- Restrict inbound network traffic + +Many other countermeasures are also covered, such as using Microsoft Passport and Windows Hello, or multifactor authentication. + +## Detecting credential attacks + +This sections covers how to detect the use of stolen credentials and how to collect computer events to help you detect credential theft. + +## Responding to suspicious activity + +Learn Microsoft's recommendations for responding to incidents, including how to recover control of compromised accounts, how to investigate attacks, and how to recover from a breach. + + diff --git a/windows/keep-secure/working-with-applocker-rules.md b/windows/keep-secure/working-with-applocker-rules.md index 26270475b6..c6fd38667f 100644 --- a/windows/keep-secure/working-with-applocker-rules.md +++ b/windows/keep-secure/working-with-applocker-rules.md @@ -89,6 +89,7 @@ The following table describes how a publisher condition is applied. | Option | The publisher condition allows or denies… | +|---|---| | **All signed files** | All files that are signed by any publisher.| | **Publisher only**| All files that are signed by the named publisher.| | **Publisher and product name**| All files for the specified product that are signed by the named publisher.| diff --git a/windows/manage/configure-devices-without-mdm.md b/windows/manage/configure-devices-without-mdm.md index b28734a5f6..04ba35f499 100644 --- a/windows/manage/configure-devices-without-mdm.md +++ b/windows/manage/configure-devices-without-mdm.md @@ -104,11 +104,14 @@ When you run Windows ICD, you have several options for creating your package. 6. Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, type, and (if required) password for the wireless network. 7. Click **Enroll into Active Directory**. 8. Toggle **Yes** or **No** for Active Directory enrollment. If you select **Yes**, enter the credentials for an account with permissions to enroll the device. (Optional) Enter a user name and password to create a local administrator account. + > [!WARNING] > If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you will have to reimage the device and start over. As a best practice, we recommend: - - Use a least-privileged domain account to join the device to the domain. - - Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully. - - [Use Group Policy to delete the temporary administrator account](https://blogs.technet.microsoft.com/canitpro/2014/12/10/group-policy-creating-a-standard-local-admin-account/) after the device is enrolled in Active Directory. + > + >- Use a least-privileged domain account to join the device to the domain. + >- Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully. + >- [Use Group Policy to delete the temporary administrator account](https://blogs.technet.microsoft.com/canitpro/2014/12/10/group-policy-creating-a-standard-local-admin-account/) after the device is enrolled in Active Directory. + 9. Click **Finish**. 10. Review your settings in the summary. You can return to previous pages to change your selections. Then, under **Protect your package**, toggle **Yes** or **No** to encrypt the provisioning package. If you select **Yes**, enter a password. This password must be entered to apply the encrypted provisioning package. 11. Click **Create**. diff --git a/windows/manage/configure-windows-10-taskbar.md b/windows/manage/configure-windows-10-taskbar.md index 8f9c046ff2..50576b01ad 100644 --- a/windows/manage/configure-windows-10-taskbar.md +++ b/windows/manage/configure-windows-10-taskbar.md @@ -289,7 +289,9 @@ The resulting taskbar for computers in any other country region: ## Related topics -[Manage Windows 10 Start and taskbar layout ](windows-10-start-layout-options-and-policies.md)[Customize and export Start layout](customize-and-export-start-layout.md) +[Manage Windows 10 Start and taskbar layout ](windows-10-start-layout-options-and-policies.md) + +[Customize and export Start layout](customize-and-export-start-layout.md) [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) diff --git a/windows/manage/connect-to-remote-aadj-pc.md b/windows/manage/connect-to-remote-aadj-pc.md index b05c575380..8424e7c1c3 100644 --- a/windows/manage/connect-to-remote-aadj-pc.md +++ b/windows/manage/connect-to-remote-aadj-pc.md @@ -25,7 +25,7 @@ From its release, Windows 10 has supported remote connections to PCs that are jo ## Set up - Both PCs (local and remote) must be running Windows 10, version 1607. Remote connection to an Azure AD-joined PC that is running earlier versions of Windows 10 is not supported. -- Ensure [Remote Credential Guard](../keep-secure/remote-credential-guard.md), a new feature in Windows 10, version 1607, is turned off on the client PC. +- Ensure [Remote Credential Guard](../keep-secure/remote-credential-guard.md), a new feature in Windows 10, version 1607, is turned off on the client PC that you are using to connect to the remote PC. - On the PC that you want to connect to: 1. Open system properties for the remote PC. 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. diff --git a/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md b/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md index 1608edb2f8..47b68d045b 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md @@ -47,9 +47,9 @@ Three features enable Start and taskbar layout control: >[!NOTE]   >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. -- [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. +- [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. -- In Group Policy, you use the **Start Layout** settings for the **Start Menu and Taskbar** administrative template to set a Start and taskbar layout from an .xml file when the policy is applied. +- In Group Policy, you use the **Start Layout** settings for the **Start Menu and Taskbar** administrative template to set a Start and taskbar layout from an .xml file when the policy is applied. The Group Policy object doesn't support an empty tile layout, so the default tile layout for Windows is loaded in that case. >[!NOTE]   >To learn how customize Start to include your line-of-business apps when you deploy Windows 10, see [Customize the Windows 10 Start layout]( https://go.microsoft.com/fwlink/p/?LinkId=620863). diff --git a/windows/manage/waas-manage-updates-wsus.md b/windows/manage/waas-manage-updates-wsus.md index 1185ebcf25..b1255530c7 100644 --- a/windows/manage/waas-manage-updates-wsus.md +++ b/windows/manage/waas-manage-updates-wsus.md @@ -29,7 +29,7 @@ To be able to use WSUS to manage and deploy Windows 10 feature updates, you must ## WSUS scalability -To use WSUS to manage all Windows updates, some organizations may need access to WSUS from a demilitarized zone, or they might have some other complex scenario. WSUS is highly scalable and configurable for organizations of any size or site layout. For specific information about scaling WSUS, including upstream and downstream server configuration, branch offices, WSUS load balancing, and other complex scenarios, see [Choose a Type of WSUS Deployment](https://technet.microsoft.com/library/cc720448%28v=ws.10%29.aspx). +To use WSUS to manage all Windows updates, some organizations may need access to WSUS from a perimeter network, or they might have some other complex scenario. WSUS is highly scalable and configurable for organizations of any size or site layout. For specific information about scaling WSUS, including upstream and downstream server configuration, branch offices, WSUS load balancing, and other complex scenarios, see [Choose a Type of WSUS Deployment](https://technet.microsoft.com/library/cc720448%28v=ws.10%29.aspx). ## Express Installation Files diff --git a/windows/manage/windows-store-for-business-overview.md b/windows/manage/windows-store-for-business-overview.md index bf514619ee..c2ce1d7706 100644 --- a/windows/manage/windows-store-for-business-overview.md +++ b/windows/manage/windows-store-for-business-overview.md @@ -238,7 +238,7 @@ Store for Business is currently available in these markets.
  • Bulgaria
  • Cameroon
  • Canada
    • -
  • Cape Verde
    • +
  • Republic of Cabo Verde
  • Cayman Islands
  • Chile
  • Colombia
    • @@ -267,7 +267,7 @@ Store for Business is currently available in these markets.
  • Greece
  • Guatemala
  • Honduras
    • -
  • Hong Kong
    • +
  • Hong Kong SAR
  • Hungary
  • Iceland
  • Indonesia
    • @@ -304,7 +304,7 @@ Store for Business is currently available in these markets.
  • Norway
  • Oman
  • Pakistan
    • -
  • Palestinian Territory
    • +
  • Palestinian Authority
  • Panama
  • Paraguay
  • Peru
    • diff --git a/windows/plan/change-history-for-plan-for-windows-10-deployment.md b/windows/plan/change-history-for-plan-for-windows-10-deployment.md index db42adde11..6d43bdcb7f 100644 --- a/windows/plan/change-history-for-plan-for-windows-10-deployment.md +++ b/windows/plan/change-history-for-plan-for-windows-10-deployment.md @@ -13,6 +13,11 @@ author: TrudyHa This topic lists new and updated topics in the [Plan for Windows 10 deployment](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## January 2017 +| New or changed topic | Description | +|----------------------|-------------| +| [Windows 10 Infrastructure Requirements](windows-10-infrastructure-requirements.md) | Added link for Windows Server 2008 R2 and Windows 7 activation and a link to Windows Server 2016 Volume Activation Tips | + ## September 2016 | New or changed topic | Description | diff --git a/windows/plan/windows-10-infrastructure-requirements.md b/windows/plan/windows-10-infrastructure-requirements.md index be533cabf2..d92c0e8afd 100644 --- a/windows/plan/windows-10-infrastructure-requirements.md +++ b/windows/plan/windows-10-infrastructure-requirements.md @@ -94,10 +94,12 @@ Windows 10 volume license editions of Windows 10 will continue to support all | Windows 10 | None | | Windows Server 2012 R2 and Windows 8.1 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | | Windows Server 2012 and Windows 8 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | -| Windows Server 2008 R2 and Windows 7 | Available by October 2015 | +| Windows Server 2008 R2 and Windows 7 | [https://support.microsoft.com/kb/3079821](https://support.microsoft.com/kb/3079821) |   +Also see: [Windows Server 2016 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2016/10/19/windows-server-2016-volume-activation-tips/) + Additionally, new product keys will be needed for all types of volume license activation (KMS, MAK, and AD-based Activation); these keys are available on the Volume Licensing Service Center (VLSC) for customers with rights to the Windows 10 operating system. To find the needed keys: - Sign into the [Volume Licensing Service Center (VLSC)](https://go.microsoft.com/fwlink/p/?LinkId=625088) at with a Microsoft account that has appropriate rights. @@ -112,10 +114,8 @@ Note that Windows 10 Enterprise and Windows 10 Enterprise LTSB installations u [Windows 10 servicing options](windows-10-servicing-options.md) - -[Windows 10 deployment considerations](windows-10-deployment-considerations.md) - -[Windows 10 compatibility](windows-10-compatibility.md) +
    [Windows 10 deployment considerations](windows-10-deployment-considerations.md) +
    [Windows 10 compatibility](windows-10-compatibility.md)