-
+
+
+
-
-
+
-
-
-
-
+
+
+
-
+
+
+
+
-
-
-
-
-
-
-
-
-
+
-
-
-
-
-
+
+
-
-
-
-
-
-
-
-
-
-
-
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
-
-
-
-
-
-
-
+
+
+
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/unlocked-drive.svg b/windows/security/operating-system-security/data-protection/bitlocker/images/unlocked-drive.svg
new file mode 100644
index 0000000000..94f06bf78b
--- /dev/null
+++ b/windows/security/operating-system-security/data-protection/bitlocker/images/unlocked-drive.svg
@@ -0,0 +1,125 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
From 7147dcdbcf39b84ce956a025faa081910ee54345 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 21 Sep 2023 11:41:14 -0400
Subject: [PATCH 008/505] tests
---
.../data-protection/bitlocker/configure.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/configure.md b/windows/security/operating-system-security/data-protection/bitlocker/configure.md
index 98729868a1..8782cf83d9 100644
--- a/windows/security/operating-system-security/data-protection/bitlocker/configure.md
+++ b/windows/security/operating-system-security/data-protection/bitlocker/configure.md
@@ -110,9 +110,9 @@ Computer or User Configuration > Administrative Templates > Start Menu and Taskb
| Title | Description |
|-|-|
-|Choose default folder for recovery password| This policy setting allows you to specify the default path that is displayed when the BitLocker Drive Encryption setup wizard prompts the user to enter the location of a folder in which to save the recovery password. This policy setting is applied when you turn on BitLocker. If you enable this policy setting, you can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify either a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker setup wizard will display the computer's top-level folder view. If you disable or do not configure this policy setting, the BitLocker setup wizard will display the computer's top-level folder view when the user chooses the option to save the recovery password in a folder. Note: This policy setting does not prevent the user from saving the recovery password in another folder.|
-|Choose drive encryption method and cipher strength| This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress. If you enable this policy setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10 (Version 1511). If you disable or do not configure this policy setting, BitLocker will use AES with the same bit strength (128-bit or 256-bit) as the "Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)" and "Choose drive encryption method and cipher strength" policy settings (in that order), if they are set. If none of the policies are set, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by the setup script." |
-|Choose how BitLocker-protected removable drives can be recovered|This policy setting allows you to control how BitLocker-protected removable data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. The "Allow data recovery agent" check box is used to specify whether a data recovery agent can be used with BitLocker-protected removable data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. Select "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. In "Save BitLocker recovery information to Active Directory Domain Services" choose which BitLocker recovery information to store in AD DS for removable data drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. If you select "Backup recovery password only" only the recovery password is stored in AD DS. Select the "Do not enable BitLocker until recovery information is stored in AD DS for removable data drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. Note: If the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box is selected, a recovery password is automatically generated. If you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected removable data drives. If this policy setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS|
+|Choose default folder for recovery password| This policy setting allows you to specify the default path that is displayed when the BitLocker Drive Encryption setup wizard prompts the user to enter the location of a folder in which to save the recovery password. This policy setting is applied when you turn on BitLocker. If you enable this policy setting, you can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify either a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker setup wizard will display the computer's top-level folder view. If you disable or do not configure this policy setting, the BitLocker setup wizard will display the computer's top-level folder view when the user chooses the option to save the recovery password in a folder. Note: This policy setting does not prevent the user from saving the recovery password in another folder.|
+|Choose drive encryption method and cipher strength| This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress. If you enable this policy setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10 (Version 1511). If you disable or do not configure this policy setting, BitLocker will use AES with the same bit strength (128-bit or 256-bit) as the "Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)" and "Choose drive encryption method and cipher strength" policy settings (in that order), if they are set. If none of the policies are set, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by the setup script." **NOTE:** The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting, which is located at *Computer Configuration* > *Windows Settings* > *Security Settings* > *Local Policies* > *Security Options* specifies whether FIPS-compliance is enabled.
|
-|**When enabled**|Users can configure a password that meets the defined requirements. To enforce complexity requirements for the password, select **Require complexity**.|
-|**When disabled or not configured**|The default length constraint of eight characters will apply to operating system drive passwords and no complexity checks will occur.|
-
-#### Reference: Configure use of passwords for operating system drives
-
-If non-TPM protectors are allowed on operating system drives, a password, enforcement of complexity requirements on the password, and configuration of a minimum length for the password can all be provisioned. For the complexity requirement setting to be effective, the group policy setting **Password must meet complexity requirements**, which is located at *Computer Configuration* > *Windows Settings* > *Security Settings* > *Account Policies* > *Password Policy*, must be also enabled.
-
-> [!NOTE]
-> These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive.
-
-When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. If no domain controllers are found, the password will be accepted regardless of actual password complexity, and the drive will be encrypted by using that password as a protector. When set to **Do not allow complexity**, there's no password complexity validation.
-
-Passwords must be at least eight characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box.
-
-When this policy setting is enabled, the option **Configure password complexity for operating system drives** can be set to:
-
-- Allow password complexity
-- Deny password complexity
-- Require password complexity
-
-### Require additional authentication at startup (Windows Server 2008 and Windows Vista)
-
-This policy setting is used to control what unlock options are available for computers running Windows Server 2008 or Windows Vista.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be controlled whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.|
-|**Introduced**|Windows Server 2008 and Windows Vista|
-|**Drive type**|Operating system drives (Windows Server 2008 and Windows Vista)|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
-|**Conflicts**|If an additional authentication method is chosen, other authentication methods can't be allowed.|
-|**When enabled**|The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. Setting options can be further configured for computers with or without a TPM.|
-|**When disabled or not configured**|The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.|
-
-#### Reference: Require additional authentication at startup (Windows Server 2008 and Windows Vista)
-
-On a computer with a compatible TPM, two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can prompt users to insert a USB drive that contains a startup key. It can also prompt users to enter a startup PIN with a length between 6 and 20 digits.
-
-A USB drive that contains a startup key is needed on computers without a compatible TPM. Without a TPM, BitLocker-encrypted data is protected solely by the key material that is on this USB drive.
-
-There are two options for TPM-enabled computers or devices:
-
-- Configure TPM startup PIN
- - Allow startup PIN with TPM
- - Require startup PIN with TPM
- - Do not allow startup PIN with TPM
-
-- Configure TPM startup key
- - Allow startup key with TPM
- - Require startup key with TPM
- - Do not allow startup key with TPM
-
-These options are mutually exclusive. If a startup key is required, a startup PIN isn't allowed. If startup PIN is required, startup key isn't allowed. If these policies are in conflict, a policy error will occur.
-
-To hide the advanced page on a TPM-enabled computer or device, set these options to **Do not allow** for the startup key and for the startup PIN.
-
-### Configure use of smart cards on fixed data drives
-
-This policy setting is used to require, allow, or deny the use of smart cards with fixed data drives.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|This policy setting can be used to specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Fixed data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
-|**Conflicts**|To use smart cards with BitLocker, the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting may need to be modified to match the object identifier of the smart card certificates.|
-|**When enabled**|Smart cards can be used to authenticate user access to the drive. Smart card authentication can be required by selecting the **Require use of smart cards on fixed data drives** check box.|
-|**When disabled**|Users can't use smart cards to authenticate their access to BitLocker-protected fixed data drives.|
-|**When not configured**|Smart cards can be used to authenticate user access to a BitLocker-protected drive.|
-
-#### Reference: Configure use of smart cards on fixed data drives
-
-> [!NOTE]
-> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive.
-
-### Configure use of passwords on fixed data drives
-
-This policy setting is used to require, allow, or deny the use of passwords with fixed data drives.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be specified whether a password is required to unlock BitLocker-protected fixed data drives.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Fixed data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
-|**Conflicts**|To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled.|
-|**When enabled**|Users can configure a password that meets the defined requirements. To require the use of a password, select **Require password for fixed data drive**. To enforce complexity requirements on the password, select **Require complexity**.|
-|**When disabled**|The user isn't allowed to use a password.|
-|**When not configured**|Passwords are supported with the default settings, which don't include password complexity requirements and require only eight characters.|
-
-#### Reference: Configure use of passwords on fixed data drives
-
-When set to **Require complexity**, a connection to a domain controller is necessary to validate the complexity of the password when BitLocker is enabled.
-
-When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. However, if no domain controllers are found, the password is accepted regardless of the actual password complexity, and the drive is encrypted by using that password as a protector.
-
-When set to **Do not allow complexity**, no password complexity validation is performed.
-
-Passwords must be at least eight characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box.
-
-> [!NOTE]
-> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive.
-
-For the complexity requirement setting to be effective, the Group Policy setting **Computer Configuration** > **Windows Settings** > **Security Settings** > **Account Policies** > **Password Policy** > **Password must meet complexity requirements** must also be enabled. This policy setting is configured on a per-computer basis. The policy setting also applies to both local user accounts and domain user accounts. Because the password filter that's used to validate password complexity is located on the domain controllers, local user accounts can't access the password filter because they're not authenticated for domain access. When this policy setting is enabled, if a local user account signs in, and a drive is attempted to be encrypted or a password changed on an existing BitLocker-protected drive, an **Access denied** error message is displayed. In this situation, the password key protector can't be added to the drive.
-
-Enabling this policy setting requires that a device is connected to a domain before adding a password key protector to a BitLocker-protected drive. Users who work remotely and have periods of time in which they can't connect to the domain should be made aware of this requirement so that they can schedule a time when they'll be connected to the domain to turn on BitLocker or to change a password on a BitLocker-protected data drive.
-
-> [!IMPORTANT]
-> Passwords can't be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in *Computer Configuration* > *Windows Settings* > *Security Settings* > *Local Policies* > *Security Options* specifies whether FIPS compliance is enabled.
-
-### Configure use of smart cards on removable data drives
-
-This policy setting is used to require, allow, or deny the use of smart cards with removable data drives.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|This policy setting can be used to specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Removable data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
-|**Conflicts**|To use smart cards with BitLocker, the object identifier setting in the **Computer Configuration** > **Administrative Templates** > **BitLocker Drive Encryption** > **Validate smart card certificate usage rule compliance** policy setting may also need to be modified to match the object identifier of the smart card certificates.|
-|**When enabled**|Smart cards can be used to authenticate user access to the drive. Smart card authentication can be required by selecting the **Require use of smart cards on removable data drives** check box.|
-|**When disabled or not configured**|Users aren't allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.|
-|**When not configured**|Smart cards are available to authenticate user access to a BitLocker-protected removable data drive.|
-
-#### Reference: Configure use of smart cards on removable data drives
-
-> [!NOTE]
-> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive.
-
-### Configure use of passwords on removable data drives
-
-This policy setting is used to require, allow, or deny the use of passwords with removable data drives.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be specified whether a password is required to unlock BitLocker-protected removable data drives.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Removable data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
-|**Conflicts**|To use password complexity, the **Password must meet complexity requirements** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy** must also be enabled.|
-|**When enabled**|Users can configure a password that meets the defined requirements. To require the use of a password, select **Require password for removable data drive**. To enforce complexity requirements on the password, select **Require complexity**.|
-|**When disabled**|The user isn't allowed to use a password.|
-|**When not configured**|Passwords are supported with the default settings, which don't include password complexity requirements and require only eight characters.|
-
-#### Reference: Configure use of passwords on removable data drives
-
-If use of passwords is allowed, requiring a password to be used, enforcement of password complexity requirements, and password minimum length can all be configured. For the complexity requirement setting to be effective, the group policy setting **Password must meet complexity requirements**, which is located at *Computer Configuration* > *Windows Settings* > *Security Settings* > *Account Policies* > *Password Policy*, must also be enabled.
-
-> [!NOTE]
-> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive.
-
-Passwords must be at least eight characters. To configure a greater minimum length for the password, enter the wanted number of characters in the **Minimum password length** box.
-
-When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity of the password.
-
-When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. However, if no domain controllers are found, the password is still be accepted regardless of actual password complexity and the drive is encrypted by using that password as a protector.
-
-When set to **Do not allow complexity**, no password complexity validation is done.
-
-> [!NOTE]
-> Passwords can't be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options** specifies whether FIPS compliance is enabled.
-
-For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](../../../threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md).
-
-### Validate smart card certificate usage rule compliance
-
-This policy setting is used to determine what certificate to use with BitLocker.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, an object identifier from a smart card certificate can be associated to a BitLocker-protected drive.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Fixed and removable data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption*|
-|**Conflicts**|None|
-|**When enabled**|The object identifier that is specified in the **Object identifier** setting must match the object identifier in the smart card certificate.|
-|**When disabled or not configured**|The default object identifier is used.|
-
-#### Reference: Validate smart card certificate usage rule compliance
-
-This policy setting is applied when BitLocker is turned on.
-
-The object identifier is specified in the extended key usage (EKU) of a certificate. BitLocker can identify which certificates can be used to authenticate a user certificate to a BitLocker-protected drive by matching the object identifier in the certificate with the object identifier that is defined by this policy setting.
-
-The default object identifier is 1.3.6.1.4.1.311.67.1.1.
-
-> [!NOTE]
-> BitLocker doesn't require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker.
-
-### Enable use of BitLocker authentication requiring preboot keyboard input on slates
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, users can be allowed to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.|
-|**Introduced**|Windows Server 2012 and Windows 8|
-|**Drive type**|Operating system drive|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
-|**Conflicts**|None|
-|**When enabled**|Devices must have an alternative means of preboot input (such as an attached USB keyboard).|
-|**When disabled or not configured**|The Windows Recovery Environment must be enabled on tablets to support entering the BitLocker recovery password.|
-
-#### Reference: Enable use of BitLocker authentication requiring preboot keyboard input on slates
-
-The Windows touch keyboard (such as used by tablets) isn't available in the preboot environment where BitLocker requires additional information, such as a PIN or password.
-
-It's recommended that administrators enable this policy only for devices that are verified to have an alternative means of preboot input, such as attaching a USB keyboard.
-
-When the Windows Recovery Environment (WinRE) isn't enabled and this policy isn't enabled, BitLocker can't be turned on a device that uses the Windows touch keyboard.
-
-If this policy setting isn't enabled, the following options in the **Require additional authentication at startup** policy might not be available:
-
-- Configure TPM startup PIN: Required and Allowed
-- Configure TPM startup key and PIN: Required and Allowed
-- Configure use of passwords for operating system drives
-
-### Deny write access to fixed drives not protected by BitLocker
-
-This policy setting is used to require encryption of fixed drives prior to granting Write access.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be set whether BitLocker protection is required for fixed data drives to be writable on a computer.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Fixed data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
-|**Conflicts**|See the Reference section for a description of conflicts.|
-|**When enabled**|All fixed data drives that aren't BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it's mounted with Read and Write access.|
-|**When disabled or not configured**|All fixed data drives on the computer are mounted with Read and Write access.|
-
-#### Reference: Deny write access to fixed drives not protected by BitLocker
-
-This policy setting is applied when BitLocker is turned on.
-
-Conflict considerations include:
-
-1. When this policy setting is enabled, users receive **Access denied** error messages when they try to save data to unencrypted fixed data drives. See the Reference section for additional conflicts.
-
-2. If `BdeHdCfg.exe` is run on a computer when this policy setting is enabled, the following issues could be encountered:
-
- - If it was attempted to shrink a drive to create the system drive, the drive size is successfully reduced, and a raw partition is created. However, the raw partition isn't formatted. The following error message is displayed: **The new active drive cannot be formatted. You may need to manually prepare your drive for BitLocker.**
-
- - If it was attempted to use unallocated space to create the system drive, a raw partition will be created. However, the raw partition won't be formatted. The following error message is displayed: **The new active drive cannot be formatted. You may need to manually prepare your drive for BitLocker.**
-
- - If it was attempted to merge an existing drive into the system drive, the tool fails to copy the required boot file onto the target drive to create the system drive. The following error message is displayed: **BitLocker setup failed to copy boot files. You may need to manually prepare your drive for BitLocker.**
-
-3. If this policy setting is enforced, a hard drive can't be repartitioned because the drive is protected. If computers are being upgrading in an organization from a previous version of Windows, and those computers were configured with a single partition, the required BitLocker system partition should be created before applying this policy setting to the computers.
-
-### Deny write access to removable drives not protected by BitLocker
-
-This policy setting is used to require that removable drives are encrypted prior to granting Write access, and to control whether BitLocker-protected removable drives that were configured in another organization can be opened with Write access.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be configured whether BitLocker protection is required for a computer to be able to write data to a removable data drive.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Removable data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
-|**Conflicts**|See the Reference section for a description of conflicts.|
-|**When enabled**|All removable data drives that aren't BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it's mounted with Read and Write access.|
-|**When disabled or not configured**|All removable data drives on the computer are mounted with Read and Write access.|
-
-#### Reference: Deny write access to removable drives not protected by BitLocker
-
-If the **Deny write access to devices configured in another organization** option is selected, only drives with identification fields that match the computer's identification fields are given Write access. When a removable data drive is accessed, it's checked for a valid identification field and allowed identification fields. These fields are defined by the **Provide the unique identifiers for your organization** policy setting.
-
-> [!NOTE]
-> This policy setting can be overridden with the policy settings under **User Configuration** > **Administrative Templates** > **System** > **Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored.
-
-Conflict considerations include:
-
-1. Use of BitLocker with the TPM plus a startup key or with the TPM plus a PIN and startup key must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.
-
-2. Use of recovery keys must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.
-
-3. The **Provide the unique identifiers for your organization** policy setting must be enabled if Write access needs to be denied to drives that were configured in another organization.
-
-### Control use of BitLocker on removable drives
-
-This policy setting is used to prevent users from turning BitLocker on or off on removable data drives.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be controlled the use of BitLocker on removable data drives.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Removable data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
-|**Conflicts**|None|
-|**When enabled**|Property settings can be selected that control how users can configure BitLocker.|
-|**When disabled**|Users can't use BitLocker on removable data drives.|
-|**When not configured**|Users can use BitLocker on removable data drives.|
-
-#### Reference: Control use of BitLocker on removable drives
-
-This policy setting is applied when BitLocker is turned on.
-
-For information about suspending BitLocker protection, see [BitLocker Basic Deployment](bitlocker-basic-deployment.md).
-
-The options for choosing property settings that control how users can configure BitLocker are:
-
-- **Allow users to apply BitLocker protection on removable data drives** Enables the user to run the BitLocker Setup Wizard on a removable data drive.
-
-- **Allow users to suspend and decrypt BitLocker on removable data drives** Enables the user to remove BitLocker from the drive or to suspend the encryption while performing maintenance.
-
-#### Reference: Choose drive encryption method and cipher strength
-
-The values of this policy determine the strength of the cipher that BitLocker uses for encryption. Enterprises may want to control the encryption level for increased security (AES-256 is stronger than AES-128).
-
-If this setting is enabled, it can be configured an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually.
-
-- For fixed and operating system drives, it's recommended to use the XTS-AES algorithm.
-
-- For removable drives, AES-CBC 128-bit or AES-CBC 256-bit should be used if the drive will be used in other devices that aren't running Windows 10, version 1511 or later.
-
-Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. In these cases, this policy setting is ignored.
-
-> [!WARNING]
-> This policy doesn't apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning.
-
-When this policy setting is disabled or not configured, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method that is specified in the setup script.
-
-### Configure use of hardware-based encryption for fixed data drives
-
-This policy controls how BitLocker reacts to systems that are equipped with encrypted drives when they're used as fixed data volumes. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|This policy setting allows management of BitLocker's use of hardware-based encryption on fixed data drives and to specify which encryption algorithms BitLocker can use with hardware-based encryption.|
-|**Introduced**|Windows Server 2012 and Windows 8|
-|**Drive type**|Fixed data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
-|**Conflicts**|None|
-|**When enabled**|Additional options can be specified that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that don't support hardware-based encryption. It can also be specified to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.|
-|**When disabled**|BitLocker can't use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.|
-|**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.|
-
-#### Reference: Configure use of hardware-based encryption for fixed data drives
-
-> [!NOTE]
-> The **Choose drive encryption method and cipher strength** policy setting doesn't apply to hardware-based encryption.
-
-The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables restriction of the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive isn't available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example:
-
-- Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2
-- AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42
-
-### Configure use of hardware-based encryption for operating system drives
-
-This policy controls how BitLocker reacts when encrypted drives are used as operating system drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|This policy setting allows management of BitLocker's use of hardware-based encryption on operating system drives and specifies which encryption algorithms it can use with hardware-based encryption.|
-|**Introduced**|Windows Server 2012 and Windows 8|
-|**Drive type**|Operating system drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
-|**Conflicts**|None|
-|**When enabled**|Additional options can be specified that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that don't support hardware-based encryption. It can also be specified to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.|
-|**When disabled**|BitLocker can't use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.|
-|**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.|
-
-#### Reference: Configure use of hardware-based encryption for operating system drives
-
-If hardware-based encryption isn't available, BitLocker software-based encryption is used instead.
-
-> [!NOTE]
-> The **Choose drive encryption method and cipher strength** policy setting doesn't apply to hardware-based encryption.
-
-The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables restriction of the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive isn't available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example:
-
-- Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2
-- AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42
-
-### Configure use of hardware-based encryption for removable data drives
-
-This policy controls how BitLocker reacts to encrypted drives when they're used as removable data drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|This policy setting allows management of BitLocker's use of hardware-based encryption on removable data drives and specifies which encryption algorithms it can use with hardware-based encryption.|
-|**Introduced**|Windows Server 2012 and Windows 8|
-|**Drive type**|Removable data drive|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
-|**Conflicts**|None|
-|**When enabled**|Additional options can be specified that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that don't support hardware-based encryption. It can also be specified to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.|
-|**When disabled**|BitLocker can't use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.|
-|**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.|
-
-#### Reference: Configure use of hardware-based encryption for removable data drives
-
-If hardware-based encryption isn't available, BitLocker software-based encryption is used instead.
-
-> [!NOTE]
-> The **Choose drive encryption method and cipher strength** policy setting doesn't apply to hardware-based encryption.
-
-The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables restriction of the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive isn't available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example:
-
-- Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2
-- AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42
-
-### Enforce drive encryption type on fixed data drives
-
-This policy controls whether fixed data drives utilize Used Space Only encryption or Full encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page so no encryption selection displays to the user.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be configured the encryption type that is used by BitLocker.|
-|**Introduced**|Windows Server 2012 and Windows 8|
-|**Drive type**|Fixed data drive|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
-|**Conflicts**|None|
-|**When enabled**|This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option isn't presented in the BitLocker Setup Wizard.|
-|**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.|
-
-#### Reference: Enforce drive encryption type on fixed data drives
-
-This policy setting is applied when BitLocker is turned on. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to make it mandatory for the entire drive to be encrypted when BitLocker is turned on. Choose Used Space Only encryption to make it mandatory to encrypt only that portion of the drive that is used to store data when BitLocker is turned on.
-
-> [!NOTE]
-> This policy is ignored when a volume is being shrunk or expanded and the BitLocker drive uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space isn't wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: `manage-bde.exe -w`. If the volume is shrunk, no action is taken for the new free space.
-
-For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde).
-
-### Enforce drive encryption type on operating system drives
-
-This policy controls whether operating system drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be configured the encryption type that is used by BitLocker.|
-|**Introduced**|Windows Server 2012 and Windows 8|
-|**Drive type**|Operating system drive|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
-|**Conflicts**|None|
-|**When enabled**|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option isn't presented in the BitLocker Setup Wizard.|
-|**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.|
-
-#### Reference: Enforce drive encryption type on operating system drives
-
-This policy setting is applied when BitLocker is turned on. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to make it mandatory for the entire drive to be encrypted when BitLocker is turned on. Choose Used Space Only encryption to make it mandatory to encrypt only that portion of the drive that is used to store data when BitLocker is turned on.
-
-> [!NOTE]
-> This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space isn't wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: `manage-bde.exe -w`. If the volume is shrunk, no action is taken for the new free space.
-
-For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde).
-
-### Enforce drive encryption type on removable data drives
-
-This policy controls whether fixed data drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be configured the encryption type that is used by BitLocker.|
-|**Introduced**|Windows Server 2012 and Windows 8|
-|**Drive type**|Removable data drive|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
-|**Conflicts**|None|
-|**When enabled**|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option isn't presented in the BitLocker Setup Wizard.|
-|**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.|
-
-#### Reference: Enforce drive encryption type on removable data drives
-
-This policy setting is applied when BitLocker is turned on. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to make it mandatory for the entire drive to be encrypted when BitLocker is turned on. Choose Used Space Only encryption to make it mandatory to encrypt only that portion of the drive that is used to store data when BitLocker is turned on.
-
-> [!NOTE]
-> This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space isn't wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: `manage-bde.exe -w`. If the volume is shrunk, no action is taken for the new free space.
-
-For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde).
-
-### Choose how BitLocker-protected operating system drives can be recovered
-
-This policy setting is used to configure recovery methods for operating system drives.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be controlled how BitLocker-protected operating system drives are recovered in the absence of the required startup key information.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Operating system drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
-|**Conflicts**|The use of recovery keys must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. When using data recovery agents, the **Provide the unique identifiers for your organization** policy setting must be enabled.|
-|**When enabled**|it can be controlled the methods that are available to users to recover data from BitLocker-protected operating system drives.|
-|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information isn't backed up to AD DS.|
-
-#### Reference: Choose how BitLocker-protected operating system drives can be recovered
-
-This policy setting is applied when BitLocker is turned on.
-
-The **Allow data recovery agent** check box is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used, it must be added from **Public Key Policies**, which is located in the Group Policy Management Console (GPMC) or in the Local Group Policy Editor.
-
-For more information about adding data recovery agents, see [BitLocker basic deployment](bitlocker-basic-deployment.md).
-
-In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password.
-
-Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This policy setting means that which recovery option to use when BitLocker is enabled can't be specified. Instead, BitLocker recovery options for the drive are determined by the policy setting.
-
-In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS) for operating system drives. If **Store recovery password and key packages** is selected, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports the recovery of data from a drive that is physically corrupted. If **Store recovery password only** is selected, only the recovery password is stored in AD DS.
-
-Select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box if users need to be prevented from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.
-
-> [!NOTE]
-> If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated.
-
-### Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
-
-This policy setting is used to configure recovery methods for BitLocker-protected drives on computers running Windows Server 2008 or Windows Vista.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be controlled whether the BitLocker Setup Wizard can display and specify BitLocker recovery options.|
-|**Introduced**|Windows Server 2008 and Windows Vista|
-|**Drive type**|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption*|
-|**Conflicts**|This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If the **Do not allow** option is chosen for both user recovery options, the **Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)** policy setting must be enabled to prevent a policy error.|
-|**When enabled**|The options that the BitLocker Setup Wizard displays to users for recovering BitLocker encrypted data can be configured.|
-|**When disabled or not configured**|The BitLocker Setup Wizard presents users with ways to store recovery options.|
-
-#### Reference: Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
-
-This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when BitLocker is turned on.
-
-Two recovery options can be used to unlock BitLocker-encrypted data in the absence of the required startup key information. Users can type a 48-digit numerical recovery password, or they can insert a USB drive that contains a 256-bit recovery key.
-
-- Saving the recovery password to a USB drive stores the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file.
-- Saving the recovery password to a folder stores the 48-digit recovery password as a text file.
-- Printing the recovery password sends the 48-digit recovery password to the default printer.
-
-For example, not allowing the 48-digit recovery password prevents users from printing or saving recovery information to a folder.
-
-> [!IMPORTANT]
-> If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information.
-> The 48-digit recovery password isn't available in FIPS-compliance mode.
-
-> [!IMPORTANT]
-> To prevent data loss, there must be a way to recover BitLocker encryption keys. If both recovery options are not allowed, backup of BitLocker recovery information to AD DS must be enabled. Otherwise, a policy error occurs.
-
-### Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)
-
-This policy setting is used to configure the storage of BitLocker recovery information in AD DS. This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|This policy setting allows management of the AD DS backup of BitLocker Drive Encryption recovery information.|
-|**Introduced**|Windows Server 2008 and Windows Vista|
-|**Drive type**|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption*|
-|**Conflicts**|None|
-|**When enabled**|BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.|
-|**When disabled or not configured**|BitLocker recovery information isn't backed up to AD DS.|
-
-#### Reference: Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)
-
-This policy is only applicable to computers running Windows Server 2008 or Windows Vista.
-
-This policy setting is applied when BitLocker is turned on.
-
-BitLocker recovery information includes the recovery password and unique identifier data. A package that contains an encryption key for a BitLocker-protected drive can also be included. This key package is secured by one or more recovery passwords, and it can help perform specialized recovery when the disk is damaged or corrupted.
-
-If **Require BitLocker backup to AD DS** is selected, BitLocker can't be turned on unless the computer is connected to the domain, and the backup of BitLocker recovery information to AD DS succeeds. This option is selected by default to help ensure that BitLocker recovery is possible.
-
-A recovery password is a 48-digit number that unlocks access to a BitLocker-protected drive. A key package contains a drive's BitLocker encryption key, which is secured by one or more recovery passwords. Key packages may help perform specialized recovery when the disk is damaged or corrupted.
-
-If the **Require BitLocker backup to AD DS** option isn't selected, AD DS backup is attempted, but network or other backup failures don't prevent the BitLocker setup. The Backup process isn't automatically retried, and the recovery password might not be stored in AD DS during BitLocker setup.
-TPM initialization might be needed during the BitLocker setup. Enable the **Turn on TPM backup to Active Directory Domain Services** policy setting in **Computer Configuration** > **Administrative Templates** > **System** > **Trusted Platform Module Services** to ensure that TPM information is also backed up.
-
-For more information about this setting, see [TPM Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings).
-
-### Choose default folder for recovery password
-
-This policy setting is used to configure the default folder for recovery passwords.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, the default path that is displayed when the BitLocker Setup Wizard prompts the user to enter the location of a folder in which to save the recovery password can be specified.|
-|**Introduced**|Windows Vista|
-|**Drive type**|All drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption*|
-|**Conflicts**|None|
-|**When enabled**|The path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder can be specified. A fully qualified path can be specified. The target computer's environment variables can also be included in the path. If the path isn't valid, the BitLocker Setup Wizard displays the computer's top-level folder view.|
-|**When disabled or not configured**|The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.|
-
-#### Reference: Choose default folder for recovery password
-
-This policy setting is applied when BitLocker is turned on.
-
-> [!NOTE]
-> This policy setting doesn't prevent the user from saving the recovery password in another folder.
-
-### Choose how BitLocker-protected fixed drives can be recovered
-
-This policy setting is used to configure recovery methods for fixed data drives.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be controlled how BitLocker-protected fixed data drives are recovered in the absence of the required credentials.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Fixed data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
-|**Conflicts**|The use of recovery keys must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. When using data recovery agents, the **Provide the unique identifiers for your organization** policy setting must be enabled.|
-|**When enabled**|it can be controlled the methods that are available to users to recover data from BitLocker-protected fixed data drives.|
-|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information isn't backed up to AD DS.|
-
-#### Reference: Choose how BitLocker-protected fixed drives can be recovered
-
-This policy setting is applied when BitLocker is turned on.
-
-The **Allow data recovery agent** check box is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used, it must be added from **Public Key Policies**, which is located in the Group Policy Management Console (GPMC) or in the Local Group Policy Editor.
-
-In **Configure user storage of BitLocker recovery information**, select whether users can be allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.
-
-Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This policy setting means that which recovery option to use when BitLocker is enabled can't be specified. Instead, BitLocker recovery options for the drive are determined by the policy setting.
-
-In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If **Backup recovery password and key package** is selected, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, the `Repair-bde.exe` command-line tool can be used. If **Backup recovery password only** is selected, only the recovery password is stored in AD DS.
-
-For more information about the BitLocker repair tool, see [Repair-bde](/windows-server/administration/windows-commands/repair-bde).
-
-Select the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box if users should be prevented from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.
-
-> [!NOTE]
-> If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated.
-
-### Choose how BitLocker-protected removable drives can be recovered
-
-This policy setting is used to configure recovery methods for removable data drives.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be controlled how BitLocker-protected removable data drives are recovered in the absence of the required credentials.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
-|**Drive type**|Removable data drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
-|**Conflicts**|The use of recovery keys must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. When using data recovery agents, the **Provide the unique identifiers for your organization** policy setting must be enabled.|
-|**When enabled**|it can be controlled the methods that are available to users to recover data from BitLocker-protected removable data drives.|
-|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information isn't backed up to AD DS.|
-
-#### Reference: Choose how BitLocker-protected removable drives can be recovered
-
-This policy setting is applied when BitLocker is turned on.
-
-The **Allow data recovery agent** check box is used to specify whether a data recovery agent can be used with BitLocker-protected removable data drives. Before a data recovery agent can be used, it must be added from **Public Key Policies** , which is accessed using the GPMC or the Local Group Policy Editor.
-
-In **Configure user storage of BitLocker recovery information**, select whether users can be allowed, required, or not allowed to generate a 48-digit recovery password.
-
-Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This policy setting means that which recovery option to use when BitLocker is enabled can't be specified. Instead, BitLocker recovery options for the drive are determined by the policy setting.
-
-In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information is to be stored in AD DS for removable data drives. If **Backup recovery password and key package** is selected, the BitLocker recovery password and the key package are stored in AD DS. If **Backup recovery password only** is selected, only the recovery password is stored in AD DS.
-
-Select the **Do not enable BitLocker until recovery information is stored in AD DS for removable data drives** check box if users should be prevented from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.
-
-> [!NOTE]
-> If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated.
-
-### Configure the pre-boot recovery message and URL
-
-This policy setting is used to configure the entire recovery message and to replace the existing URL that is displayed on the pre-boot recovery screen when the operating system drive is locked.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be configured the BitLocker recovery screen to display a customized message and URL.|
-|**Introduced**|Windows|
-|**Drive type**|Operating system drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives* > *Configure pre-boot recovery message and URL*|
-|**Conflicts**|None|
-|**When enabled**|The customized message and URL are displayed on the pre-boot recovery screen. If a custom recovery message and URL has been previously enabled and the message and URL need to be reverted back to the default message and URL, the policy setting must be enabled and the **Use default recovery message and URL** option selected.|
-|**When disabled or not configured**|If the setting hasn't been previously enabled, then the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is later disabled, then the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.|
-
-#### Reference: Configure the pre-boot recovery message and URL
-
-Enabling the **Configure the pre-boot recovery message and URL** policy setting allows customization of the default recovery screen message and URL to assist customers in recovering their key.
-
-Once the setting is enabled, three options are available:
-
-- If the **Use default recovery message and URL** option is selected, the default BitLocker recovery message and URL will be displayed on the pre-boot recovery screen.
-- If the **Use custom recovery message** option is selected, enter the custom message in the **Custom recovery message option** text box. The message that is entered in the **Custom recovery message option** text box is displayed on the pre-boot recovery screen. If a recovery URL is available, include it in the message.
-- If the **Use custom recovery URL** option is selected, enter the custom message URL in the **Custom recovery URL option** text box. The URL that is entered in the **Custom recovery URL option** text box replaces the default URL in the default recovery message, which is displayed on the pre-boot recovery screen.
-
-> [!IMPORTANT]
-> Not all characters and languages are supported in the pre-boot environment. It is strongly recommended to verify the correct appearance of the characters that are used for the custom message and URL on the pre-boot recovery screen.
-
-> [!IMPORTANT]
-> Because BCDEdit commands can be altered manually before Group Policy settings have been set, the policy setting can't be returned to the default setting by selecting the **Not Configured** option after this policy setting has been configured. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box.
-
-### Allow Secure Boot for integrity validation
-
-This policy controls how BitLocker-enabled system volumes are handled with the Secure Boot feature. Enabling this feature forces Secure Boot validation during the boot process and verifies Boot Configuration Data (BCD) settings according to the Secure Boot policy.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be configured whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives.|
-|**Introduced**|Windows Server 2012 and Windows 8|
-|**Drive type**|All drives|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
-|**Conflicts**|If **Allow Secure Boot for integrity validation** is enabled, make sure the Configure TPM platform validation profile for native UEFI firmware configurations Group Policy setting isn't enabled, or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation. **NOTE:** The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting, which is located at *Computer Configuration* > *Windows Settings* > *Security Settings* > *Local Policies* > *Security Options* specifies whether FIPS-compliance is enabled.
|
-|**When enabled**|Users can configure a password that meets the defined requirements. To enforce complexity requirements for the password, select **Require complexity**.|
-|**When disabled or not configured**|The default length constraint of eight characters will apply to operating system drive passwords and no complexity checks will occur.|
-
-#### Reference: Configure use of passwords for operating system drives
-
-If non-TPM protectors are allowed on operating system drives, a password, enforcement of complexity requirements on the password, and configuration of a minimum length for the password can all be provisioned. For the complexity requirement setting to be effective, the group policy setting **Password must meet complexity requirements**, which is located at *Computer Configuration* > *Windows Settings* > *Security Settings* > *Account Policies* > *Password Policy*, must be also enabled.
-
-> [!NOTE]
-> These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive.
-
-When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. If no domain controllers are found, the password will be accepted regardless of actual password complexity, and the drive will be encrypted by using that password as a protector. When set to **Do not allow complexity**, there's no password complexity validation.
-
-Passwords must be at least eight characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box.
-
-When this policy setting is enabled, the option **Configure password complexity for operating system drives** can be set to:
-
-- Allow password complexity
-- Deny password complexity
-- Require password complexity
-
-### Require additional authentication at startup (Windows Server 2008 and Windows Vista)
-
-This policy setting is used to control what unlock options are available for computers running Windows Server 2008 or Windows Vista.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be controlled whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.|
-|**Introduced**|Windows Server 2008 and Windows Vista|
-|**Drive type**|Operating system drives (Windows Server 2008 and Windows Vista)|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
-|**Conflicts**|If an additional authentication method is chosen, other authentication methods can't be allowed.|
-|**When enabled**|The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. Setting options can be further configured for computers with or without a TPM.|
-|**When disabled or not configured**|The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.|
-
-#### Reference: Require additional authentication at startup (Windows Server 2008 and Windows Vista)
-
-On a computer with a compatible TPM, two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can prompt users to insert a USB drive that contains a startup key. It can also prompt users to enter a startup PIN with a length between 6 and 20 digits.
-
-A USB drive that contains a startup key is needed on computers without a compatible TPM. Without a TPM, BitLocker-encrypted data is protected solely by the key material that is on this USB drive.
-
-There are two options for TPM-enabled computers or devices:
-
-- Configure TPM startup PIN
- - Allow startup PIN with TPM
- - Require startup PIN with TPM
- - Do not allow startup PIN with TPM
-
-- Configure TPM startup key
- - Allow startup key with TPM
- - Require startup key with TPM
- - Do not allow startup key with TPM
-
-These options are mutually exclusive. If a startup key is required, a startup PIN isn't allowed. If startup PIN is required, startup key isn't allowed. If these policies are in conflict, a policy error will occur.
-
-To hide the advanced page on a TPM-enabled computer or device, set these options to **Do not allow** for the startup key and for the startup PIN.
-
### Configure use of smart cards on fixed data drives
This policy setting is used to require, allow, or deny the use of smart cards with fixed data drives.
@@ -182,7 +48,6 @@ This policy setting is used to require, allow, or deny the use of smart cards wi
| Item | Info |
|:---|:---|
|**Policy description**|This policy setting can be used to specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Fixed data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
|**Conflicts**|To use smart cards with BitLocker, the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting may need to be modified to match the object identifier of the smart card certificates.|
@@ -202,7 +67,6 @@ This policy setting is used to require, allow, or deny the use of passwords with
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be specified whether a password is required to unlock BitLocker-protected fixed data drives.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Fixed data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
|**Conflicts**|To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled.|
@@ -237,7 +101,6 @@ This policy setting is used to require, allow, or deny the use of smart cards wi
| Item | Info |
|:---|:---|
|**Policy description**|This policy setting can be used to specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Removable data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
|**Conflicts**|To use smart cards with BitLocker, the object identifier setting in the **Computer Configuration** > **Administrative Templates** > **BitLocker Drive Encryption** > **Validate smart card certificate usage rule compliance** policy setting may also need to be modified to match the object identifier of the smart card certificates.|
@@ -257,7 +120,6 @@ This policy setting is used to require, allow, or deny the use of passwords with
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be specified whether a password is required to unlock BitLocker-protected removable data drives.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Removable data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
|**Conflicts**|To use password complexity, the **Password must meet complexity requirements** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy** must also be enabled.|
@@ -292,7 +154,6 @@ This policy setting is used to determine what certificate to use with BitLocker.
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, an object identifier from a smart card certificate can be associated to a BitLocker-protected drive.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Fixed and removable data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption*|
|**Conflicts**|None|
@@ -315,7 +176,6 @@ The default object identifier is 1.3.6.1.4.1.311.67.1.1.
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, users can be allowed to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.|
-|**Introduced**|Windows Server 2012 and Windows 8|
|**Drive type**|Operating system drive|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
|**Conflicts**|None|
@@ -343,7 +203,6 @@ This policy setting is used to require encryption of fixed drives prior to grant
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be set whether BitLocker protection is required for fixed data drives to be writable on a computer.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Fixed data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
|**Conflicts**|See the Reference section for a description of conflicts.|
@@ -375,7 +234,6 @@ This policy setting is used to require that removable drives are encrypted prior
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be configured whether BitLocker protection is required for a computer to be able to write data to a removable data drive.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Removable data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
|**Conflicts**|See the Reference section for a description of conflicts.|
@@ -404,7 +262,6 @@ This policy setting is used to prevent users from turning BitLocker on or off on
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be controlled the use of BitLocker on removable data drives.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Removable data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
|**Conflicts**|None|
@@ -431,7 +288,6 @@ This policy controls how BitLocker reacts to systems that are equipped with encr
| Item | Info |
|:---|:---|
|**Policy description**|This policy setting allows management of BitLocker's use of hardware-based encryption on fixed data drives and to specify which encryption algorithms BitLocker can use with hardware-based encryption.|
-|**Introduced**|Windows Server 2012 and Windows 8|
|**Drive type**|Fixed data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
|**Conflicts**|None|
@@ -456,7 +312,6 @@ This policy controls how BitLocker reacts when encrypted drives are used as oper
| Item | Info |
|:---|:---|
|**Policy description**|This policy setting allows management of BitLocker's use of hardware-based encryption on operating system drives and specifies which encryption algorithms it can use with hardware-based encryption.|
-|**Introduced**|Windows Server 2012 and Windows 8|
|**Drive type**|Operating system drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
|**Conflicts**|None|
@@ -483,7 +338,6 @@ This policy controls how BitLocker reacts to encrypted drives when they're used
| Item | Info |
|:---|:---|
|**Policy description**|This policy setting allows management of BitLocker's use of hardware-based encryption on removable data drives and specifies which encryption algorithms it can use with hardware-based encryption.|
-|**Introduced**|Windows Server 2012 and Windows 8|
|**Drive type**|Removable data drive|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
|**Conflicts**|None|
@@ -510,7 +364,6 @@ This policy controls whether fixed data drives utilize Used Space Only encryptio
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be configured the encryption type that is used by BitLocker.|
-|**Introduced**|Windows Server 2012 and Windows 8|
|**Drive type**|Fixed data drive|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
|**Conflicts**|None|
@@ -533,7 +386,6 @@ This policy controls whether operating system drives utilize Full encryption or
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be configured the encryption type that is used by BitLocker.|
-|**Introduced**|Windows Server 2012 and Windows 8|
|**Drive type**|Operating system drive|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
|**Conflicts**|None|
@@ -556,7 +408,6 @@ This policy controls whether fixed data drives utilize Full encryption or Used S
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be configured the encryption type that is used by BitLocker.|
-|**Introduced**|Windows Server 2012 and Windows 8|
|**Drive type**|Removable data drive|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
|**Conflicts**|None|
@@ -579,7 +430,6 @@ This policy setting is used to configure recovery methods for operating system d
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be controlled how BitLocker-protected operating system drives are recovered in the absence of the required startup key information.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Operating system drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
|**Conflicts**|The use of recovery keys must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. When using data recovery agents, the **Provide the unique identifiers for your organization** policy setting must be enabled.|
@@ -605,69 +455,7 @@ Select the **Do not enable BitLocker until recovery information is stored in AD
> [!NOTE]
> If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated.
-### Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
-This policy setting is used to configure recovery methods for BitLocker-protected drives on computers running Windows Server 2008 or Windows Vista.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|With this policy setting, it can be controlled whether the BitLocker Setup Wizard can display and specify BitLocker recovery options.|
-|**Introduced**|Windows Server 2008 and Windows Vista|
-|**Drive type**|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption*|
-|**Conflicts**|This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If the **Do not allow** option is chosen for both user recovery options, the **Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)** policy setting must be enabled to prevent a policy error.|
-|**When enabled**|The options that the BitLocker Setup Wizard displays to users for recovering BitLocker encrypted data can be configured.|
-|**When disabled or not configured**|The BitLocker Setup Wizard presents users with ways to store recovery options.|
-
-#### Reference: Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
-
-This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when BitLocker is turned on.
-
-Two recovery options can be used to unlock BitLocker-encrypted data in the absence of the required startup key information. Users can type a 48-digit numerical recovery password, or they can insert a USB drive that contains a 256-bit recovery key.
-
-- Saving the recovery password to a USB drive stores the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file.
-- Saving the recovery password to a folder stores the 48-digit recovery password as a text file.
-- Printing the recovery password sends the 48-digit recovery password to the default printer.
-
-For example, not allowing the 48-digit recovery password prevents users from printing or saving recovery information to a folder.
-
-> [!IMPORTANT]
-> If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information.
-> The 48-digit recovery password isn't available in FIPS-compliance mode.
-
-> [!IMPORTANT]
-> To prevent data loss, there must be a way to recover BitLocker encryption keys. If both recovery options are not allowed, backup of BitLocker recovery information to AD DS must be enabled. Otherwise, a policy error occurs.
-
-### Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)
-
-This policy setting is used to configure the storage of BitLocker recovery information in AD DS. This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information.
-
-| Item | Info |
-|:---|:---|
-|**Policy description**|This policy setting allows management of the AD DS backup of BitLocker Drive Encryption recovery information.|
-|**Introduced**|Windows Server 2008 and Windows Vista|
-|**Drive type**|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.|
-|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption*|
-|**Conflicts**|None|
-|**When enabled**|BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.|
-|**When disabled or not configured**|BitLocker recovery information isn't backed up to AD DS.|
-
-#### Reference: Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)
-
-This policy is only applicable to computers running Windows Server 2008 or Windows Vista.
-
-This policy setting is applied when BitLocker is turned on.
-
-BitLocker recovery information includes the recovery password and unique identifier data. A package that contains an encryption key for a BitLocker-protected drive can also be included. This key package is secured by one or more recovery passwords, and it can help perform specialized recovery when the disk is damaged or corrupted.
-
-If **Require BitLocker backup to AD DS** is selected, BitLocker can't be turned on unless the computer is connected to the domain, and the backup of BitLocker recovery information to AD DS succeeds. This option is selected by default to help ensure that BitLocker recovery is possible.
-
-A recovery password is a 48-digit number that unlocks access to a BitLocker-protected drive. A key package contains a drive's BitLocker encryption key, which is secured by one or more recovery passwords. Key packages may help perform specialized recovery when the disk is damaged or corrupted.
-
-If the **Require BitLocker backup to AD DS** option isn't selected, AD DS backup is attempted, but network or other backup failures don't prevent the BitLocker setup. The Backup process isn't automatically retried, and the recovery password might not be stored in AD DS during BitLocker setup.
-TPM initialization might be needed during the BitLocker setup. Enable the **Turn on TPM backup to Active Directory Domain Services** policy setting in **Computer Configuration** > **Administrative Templates** > **System** > **Trusted Platform Module Services** to ensure that TPM information is also backed up.
-
-For more information about this setting, see [TPM Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings).
### Choose how BitLocker-protected fixed drives can be recovered
@@ -676,7 +464,6 @@ This policy setting is used to configure recovery methods for fixed data drives.
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be controlled how BitLocker-protected fixed data drives are recovered in the absence of the required credentials.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Fixed data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*|
|**Conflicts**|The use of recovery keys must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. When using data recovery agents, the **Provide the unique identifiers for your organization** policy setting must be enabled.|
@@ -709,7 +496,6 @@ This policy setting is used to configure recovery methods for removable data dri
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be controlled how BitLocker-protected removable data drives are recovered in the absence of the required credentials.|
-|**Introduced**|Windows Server 2008 R2 and Windows 7|
|**Drive type**|Removable data drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Removable Data Drives*|
|**Conflicts**|The use of recovery keys must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. When using data recovery agents, the **Provide the unique identifiers for your organization** policy setting must be enabled.|
@@ -770,7 +556,6 @@ This policy controls how BitLocker-enabled system volumes are handled with the S
| Item | Info |
|:---|:---|
|**Policy description**|With this policy setting, it can be configured whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives.|
-|**Introduced**|Windows Server 2012 and Windows 8|
|**Drive type**|All drives|
|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Operating System Drives*|
|**Conflicts**|If **Allow Secure Boot for integrity validation** is enabled, make sure the Configure TPM platform validation profile for native UEFI firmware configurations Group Policy setting isn't enabled, or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation. domain\username
```
- - question: What is the difference between a recovery password, recovery key, PIN, enhanced PIN, and startup key?
+ - question: What is the difference between a TPM owner password, recovery password, recovery key, PIN, enhanced PIN, and startup key?
answer: |
- For tables that list and describe elements such as a recovery password, recovery key, and PIN, see [BitLocker key protectors](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-key-protectors) and [BitLocker authentication methods](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-authentication-methods).
+ There are multiple keys that can be generated and used by BitLocker. Some keys are required and some are optional protectors you can choose to use depending on the level of security you require.
+
+ **TPM owner password**
+
+ Prior to enabling BitLocker on a computer with a TPM version 1.2, you must initialize the TPM. The initialization process generates a TPM owner password, which is a password set on the TPM. You must be able to supply the TPM owner password to change the state of the TPM, such as when enabling or disabling the TPM or resetting the TPM lockout.
+
+ **Recovery password and recovery key**
+
+ When you set up BitLocker, you must choose how access to BitLocker-protected drives can be recovered in the event that the specified unlock method cannot be used (such as if the TPM cannot validate the boot components, the personal identification number (PIN) is forgotten, or the password is forgotten). In these situations, you must be able to supply either the recovery key or the recovery password to unlock the encrypted data on the drive. When you supply the recovery information, you can use either of the following formats:
+
+ - A recovery password consisting of 48 digits divided into eight groups. During recovery, you need to type this password into the BitLocker recovery console by using the function keys on your keyboard
+ - A key file on a USB flash drive that is read directly by the BitLocker recovery console. During recovery, you need to insert this USB device
+
+ **PIN and enhanced PIN**
+ For a higher level of security with the TPM, you can configure BitLocker with a personal identification number (PIN). The PIN is a user-created value that must be entered each time the computer starts or resumes from hibernation. The PIN can consist of 4 to 20 digits as specified by the *Configure minimum PIN length for startup* policy setting and is stored internally as a 256-bit hash of the entered Unicode characters. This value is never displayed to the user. The PIN is used to provide another factor of authentication in conjunction with TPM authentication.\
+ For an even higher level of security with the TPM, you can configure BitLocker to use enhanced PINs. Enhanced PINs are PINs that use the full keyboard character set in addition to the numeric set to allow for more possible PIN combinations and are between 4 and 20 characters in length. To use enhanced PINs, you must enable the *Allow enhanced PINs for startup* policy setting before adding the PIN to the drive. By enabling this policy, all PINs created can utilize full keyboard characters.
+
+ **Startup key**
+
+ Configuring a startup key is another method to enable a higher level of security with the TPM. The startup key is a key stored on a USB flash drive, and the USB flash drive must be inserted every time the computer starts. The startup key is used to provide another factor of authentication in conjunction with TPM authentication. To use a USB flash drive as a startup key, the USB flash drive must be formatted by using the NTFS, FAT, or FAT32 file system.
+
+ >[!IMPORTANT]
+ > You must have a startup key to use BitLocker on a non-TPM computer.
+
- question: How can the recovery password and recovery key be stored?
answer: |
The recovery password and recovery key for an operating system drive or a fixed data drive can be saved to a folder, saved to one or more USB devices, saved to a Microsoft Account, or printed.
For removable data drives, the recovery password and recovery key can be saved to a folder, saved to a Microsoft Account, or printed. By default, a recovery key for a removable drive can't be stored on a removable drive.
- A domain administrator can also configure Group Policy to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) for any BitLocker-protected drive.
+ A domain administrator can also configure policy settings to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) or Microsoft Entra ID for any BitLocker-protected drive.
- question: Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled?
answer: |
@@ -195,11 +208,10 @@ sections:
```cmd
manage-bde.exe -protectors -delete %systemdrive% -type tpm
-
+
manage-bde.exe -protectors -add %systemdrive% -tpmandpin <4-20 digit numeric PIN>
```
-
-
+
- question: When should an additional method of authentication be considered?
answer: |
New hardware that meets [Windows Hardware Compatibility Program](/windows-hardware/design/compatibility/) requirements make a PIN less critical as a mitigation, and having a TPM-only protector is likely sufficient when combined with policies like device lockout. For example, Surface Pro and Surface Book don't have external DMA ports to attack.
@@ -210,8 +222,8 @@ sections:
BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive.
> [!IMPORTANT]
- > Store the recovery information in AD DS, along with in a Microsoft Account, or another safe location.
-
+ > Store the recovery information in Microsoft Entra ID, AD DS, Microsoft Account, or another safe location.
+
- question: Can the USB flash drive that is used as the startup key also be used to store the recovery key?
answer: While using a USB flash drive as both the startup key and for storage of the recovery key is technically possible, it isn't a best practice to use one USB flash drive to store both keys. If the USB flash drive that contains the startup key is lost or stolen, the recovery key will also be lost. In addition, inserting this key would cause the computer to automatically boot from the recovery key even if TPM-measured files have changed, which circumvents the TPM's system integrity check.
@@ -247,7 +259,7 @@ sections:
It's possible that a personal identification number (PIN) can be discovered by an attacker performing a brute force attack. A brute force attack occurs when an attacker uses an automated tool to try different PIN combinations until the correct one is discovered. For BitLocker-protected computers, this type of attack, also known as a dictionary attack, requires that the attacker has physical access to the computer.
The TPM has the built-in ability to detect and react to these types of attacks. Because different manufacturers' TPMs may support different PIN and attack mitigations, contact the TPM's manufacturer to determine how the computer's TPM mitigates PIN brute force attacks.
- After the TPM's manufacturer has been determined, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset.
+ After the TPM's manufacturer is determined, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset.
- question: How can I determine the manufacturer of my TPM?
answer: The TPM manufacturer can be determined in **Windows Defender Security Center** > **Device Security** > **Security processor details**.
@@ -260,11 +272,15 @@ sections:
- What is the algorithm for determining the duration of a lockout based on the number of failed attempts and any other relevant parameters?
- What actions can cause the failure count and lockout duration to be decreased or reset?
- - question: Can PIN length and complexity be managed with Group Policy?
+ - question: Can PIN length and complexity be managed with policy settings?
answer: |
- Yes and No. The minimum personal identification number (PIN) length can be configured by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** Group Policy setting. However, PIN complexity can't be required via Group Policy.
+ The minimum personal identification number (PIN) length can be configured by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** policy setting. PIN complexity can't be required via policy settings.
For more info, see [BitLocker policy settings](policy-settings.md).
+
+ - question: How are the PIN and TPM used to derive the volume master key?
+ answer: |
+ BitLocker hashes the user-specified personal identification number (PIN) by using SHA-256, and the first 160 bits of the hash are used as authorization data sent to the TPM to seal the volume master key. The volume master key is now protected by both the TPM and the PIN. To unseal the volume master key, you are required to enter the PIN each time the computer restarts or resumes from hibernation.
- name: BitLocker To Go
questions:
@@ -288,18 +304,17 @@ sections:
answer: |
Stored information | Description
-------------------|------------
- Hash of the TPM owner password | Beginning with Windows 10, the password hash isn't stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in.
BitLocker recovery password | The recovery password allows unlocking of and access to the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md).
BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`.
- question: |
- What if BitLocker is enabled on a computer before the computer has joined the domain?
+ What if BitLocker is enabled on a computer before the computer joins the domain?
answer: |
- If BitLocker is enabled on a drive before Group Policy has been applied to enforce a backup, the recovery information won't be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, the Group Policy settings **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** can be chosen to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in the organization is backed up to AD DS.
+ If BitLocker is enabled on a drive before policy settings are applied to enforce a backup, the recovery information won't be automatically backed up to AD DS when the computer joins the domain or when the policy settings are subsequently applied. However, the policy settings **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** can be chosen to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in the organization is backed up to AD DS.
For more info, see [BitLocker policy settings](policy-settings.md).
- The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information. However, BitLocker doesn't automatically manage this process. The `manage-bde.exe` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, the following command script can be used from an elevated command prompt:
+ The BitLocker Windows Management Instrumentation (WMI) interface allows administrators to write a script to back up or synchronize an online client's existing recovery information. However, BitLocker doesn't automatically manage this process. The `manage-bde.exe` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, the following command script can be used from an elevated command prompt:
```powershell
$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive
@@ -310,7 +325,7 @@ sections:
```
> [!IMPORTANT]
- > Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy).
+ > Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled with policy settings).
- question: |
Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup?
@@ -329,7 +344,7 @@ sections:
answer: |
If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker doesn't try again to back up the recovery information to AD DS.
- When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker can't be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization.
+ When an administrator selects the **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker can't be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization.
For more info, see [BitLocker policy settings](policy-settings.md).
@@ -340,17 +355,17 @@ sections:
- question: |
What form of encryption does BitLocker use? Is it configurable?
answer: |
- BitLocker uses Advanced Encryption Standard (AES) as its encryption algorithm with configurable key lengths of 128 bits or 256 bits. The default encryption setting is AES-128, but the options are configurable by using Group Policy.
+ BitLocker uses Advanced Encryption Standard (AES) as its encryption algorithm with configurable key lengths of 128 bits or 256 bits. The default encryption setting is AES-128, but the options are configurable by using policy settings.
- question: |
What is the best practice for using BitLocker on an operating system drive?
answer: |
- The recommended practice for BitLocker configuration on an operating system drive is to implement BitLocker on a computer with a TPM version 1.2 or higher, and a Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware implementation, along with a PIN. By requiring a PIN that was set by the user in addition to the TPM validation, a malicious user that has physical access to the computer can't start the computer.
+ The recommended practice for BitLocker configuration on an operating system drive is to implement BitLocker on a computer with a TPM version 1.2 or higher.
- question: |
What are the implications of using the sleep or hibernate power management options?
answer: |
- BitLocker on operating system drives in its basic configuration (with a TPM but without other startup authentication) provides extra security for the hibernate mode. However, BitLocker provides greater security when it's configured to use another startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. In sleep mode, the computer is vulnerable to direct memory access attacks, since unprotected data remains in RAM. Therefore, for improved security, it's recommended to disable sleep mode and to use TPM+PIN for the authentication method. Startup authentication can be configured by using a [policy setting](policy-settings.md) or Mobile Device Management with the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp).
+ BitLocker on operating system drives in its basic configuration provides extra security for the hibernate mode. In sleep mode, the computer is vulnerable to direct memory access attacks, since unprotected data remains in RAM. Therefore, for improved security, it's recommended to disable sleep mode. Startup authentication can be configured by using a [policy setting](policy-settings.md).
- question: |
What are the advantages of a TPM?
@@ -363,9 +378,9 @@ sections:
- name: Network Unlock
questions:
- question: |
- BitLocker Network Unlock FAQ
+ What is BitLocker Network Unlock
answer: |
- BitLocker Network Unlock enables easier management for BitLocker-enabled desktops and servers that use the TPM+PIN protection method in a domain environment. When a computer that is connected to a wired corporate network is rebooted, Network Unlock allows the PIN entry prompt to be bypassed. It automatically unlocks BitLocker-protected operating system volumes by using a trusted key that is provided by the Windows Deployment Services server as its secondary authentication method.
+ BitLocker Network Unlock enables easier management for BitLocker-enabled clients and servers that use the TPM+PIN protection method in a domain environment. When a computer that is connected to a wired corporate network is rebooted, Network Unlock allows the PIN entry prompt to be bypassed. It automatically unlocks BitLocker-protected operating system volumes by using a trusted key that is provided by the Windows Deployment Services server as its secondary authentication method.
To use Network Unlock, a PIN must be configured for the computer. When the computer isn't connected to the network, a PIN will need to be provided to unlock it.
@@ -412,13 +427,13 @@ sections:
answer: |
The system check is designed to ensure the computer's BIOS or UEFI firmware is compatible with BitLocker and that the TPM is working correctly. The system check can fail for several reasons:
- - The computer's BIOS or UEFI firmware can't read USB flash drives.
- - The computer's BIOS, uEFI firmware, or boot menu doesn't have reading USB flash drives enabled.
- - There are multiple USB flash drives inserted into the computer.
- - The PIN wasn't entered correctly.
- - The computer's BIOS or UEFI firmware only supports using the function keys (F1-F10) to enter numerals in the pre-boot environment.
- - The startup key was removed before the computer finished rebooting.
- - The TPM has malfunctioned and fails to unseal the keys.
+ - The computer's BIOS or UEFI firmware can't read USB flash drives
+ - The computer's BIOS, uEFI firmware, or boot menu doesn't have reading USB flash drives enabled
+ - There are multiple USB flash drives inserted into the computer
+ - The PIN wasn't entered correctly
+ - The computer's BIOS or UEFI firmware only supports using the function keys (F1-F10) to enter numerals in the pre-boot environment
+ - The startup key was removed before the computer finished rebooting
+ - The TPM has malfunctioned and fails to unseal the keys
- question: |
What can I do if the recovery key on my USB flash drive can't be read?
@@ -441,7 +456,7 @@ sections:
Limited BitLocker functionality is available in Safe Mode. BitLocker-protected drives can be unlocked and decrypted by using the **BitLocker Drive Encryption** Control Panel item. Right-clicking to access BitLocker options from Windows Explorer isn't available in Safe Mode.
- question: |
- How do I "lock" a data drive?
+ How do I *lock* a data drive?
answer: |
Both fixed and removable data drives can be locked by using the Manage-bde command-line tool and the -lock command.
@@ -466,11 +481,11 @@ sections:
answer: |
BitLocker should work like any specific physical machine within its hardware limitations as long as the environment (physical or virtual) meets Windows Operating System requirements to run.
- With TPM: Yes, it's supported.
- - Without TPM: Yes, it's supported (with password protector).
+ - Without TPM: Yes, it's supported (with password protector).
- BitLocker is also supported on data volume VHDs, such as those used by clusters, if running Windows 10, Windows 8.1, Windows 8, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012.
+ BitLocker is also supported on data volume VHDs, such as those used by clusters.
- question: |
Can I use BitLocker with virtual machines (VMs)?
answer: |
- Yes. Password protectors and virtual TPMs can be used with BitLocker to protect virtual machines. VMs can be domain joined, Azure AD-joined, or workplace-joined (via **Settings** > **Accounts** > **Access work or school** > **Connect**) to receive policy. Encryption can be enabled either while creating the VM or by using other existing management tools such as the BitLocker CSP, or even by using a startup script or sign-in script delivered by Group Policy. Windows Server 2016 also supports [Shielded VMs and guarded fabric](/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-and-shielded-vms-top-node) to protect VMs from malicious administrators.
+ Yes, BitLocker can be used with virtual machines (VMs) if the environment meets BitLocker's hardware and software requirements.
From 1fdbf32810bbc18f1bc7f6bbf1eab32a40cfcec7 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 29 Sep 2023 14:53:48 -0400
Subject: [PATCH 052/505] FAQ updates
---
.../operating-system-security/data-protection/bitlocker/faq.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/faq.yml b/windows/security/operating-system-security/data-protection/bitlocker/faq.yml
index a8b020ee1d..73ec4cf75e 100644
--- a/windows/security/operating-system-security/data-protection/bitlocker/faq.yml
+++ b/windows/security/operating-system-security/data-protection/bitlocker/faq.yml
@@ -348,7 +348,7 @@ sections:
For more info, see [BitLocker policy settings](policy-settings.md).
- When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker won't automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain-) to capture the information after connectivity is restored.
+ When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker won't automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer joins the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-joins-the-domain-) to capture the information after connectivity is restored.
- name: Security
questions:
From 6f440f2fdee9d34662ce249fede32abb8275986e Mon Sep 17 00:00:00 2001
From: Justin Piesco <107575186+JustPies@users.noreply.github.com>
Date: Sun, 1 Oct 2023 13:19:18 -0400
Subject: [PATCH 053/505] policheck update
---
store-for-business/microsoft-store-for-business-overview.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/store-for-business/microsoft-store-for-business-overview.md b/store-for-business/microsoft-store-for-business-overview.md
index 06da85f98c..834bc6a47d 100644
--- a/store-for-business/microsoft-store-for-business-overview.md
+++ b/store-for-business/microsoft-store-for-business-overview.md
@@ -333,7 +333,7 @@ Customers in these markets can use Microsoft Store for Business and Education to
- Aremenia
- Azerbaijan
- Belarus
-- Bosnia
+- Bosnia and Herzegovina
- Brazil
- Georgia
- India
From 76f92579d161410d64c0460e9df17046875e7c7a Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 2 Oct 2023 09:14:19 -0400
Subject: [PATCH 054/505] updates
---
.../bitlocker-recovery-guide-plan.md | 589 ++----------------
1 file changed, 61 insertions(+), 528 deletions(-)
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan.md
index 275521ba0b..556792a072 100644
--- a/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan.md
+++ b/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan.md
@@ -1,16 +1,16 @@
---
title: BitLocker recovery guide
-description: This article for IT professionals describes how to recover BitLocker keys from Active Directory Domain Services (AD DS).
+description: Learn how to recover BitLocker keys from Microsoft Entra ID and Active Directory Domain Services (AD DS).
ms.collection:
- highpri
- tier1
-ms.topic: conceptual
-ms.date: 11/08/2022
+ms.topic: howto
+ms.date: 09/29/2023
---
# BitLocker recovery guide
-This article describes how to recover BitLocker keys from AD DS.
+This article describes how to recover BitLocker keys from Microsoft Entra ID and Active Directory Domain Services (AD DS).
Organizations can use BitLocker recovery information saved in Active Directory Domain Services (AD DS) to access BitLocker-protected data. It's recommended to create a recovery model for BitLocker while planning for BitLocker deployment.
@@ -368,13 +368,13 @@ There are rules governing which hint is shown during the recovery (in the order
#### Example 1 (single recovery key with single backup)
-| Custom URL | Yes |
-|----------------------|------------|
-| Saved to Microsoft Account | Yes |
-| Saved to Azure AD | No |
-| Saved to Active Directory | No |
-| Printed | No |
-| Saved to file | No |
+| Custom URL | Yes |
+|----------------------------|-----|
+| Saved to Microsoft Account | Yes |
+| Saved to Azure AD | No |
+| Saved to Active Directory | No |
+| Printed | No |
+| Saved to file | No |
**Result:** The hints for the Microsoft account and custom URL are displayed.
@@ -382,13 +382,13 @@ There are rules governing which hint is shown during the recovery (in the order
#### Example 2 (single recovery key with single backup)
-| Custom URL | Yes |
-|----------------------|------------|
-| Saved to Microsoft Account | No |
-| Saved to Azure AD | No |
-| Saved to Active Directory | Yes |
-| Printed | No |
-| Saved to file | No |
+| Custom URL | Yes |
+|----------------------------|-----|
+| Saved to Microsoft Account | No |
+| Saved to Azure AD | No |
+| Saved to Active Directory | Yes |
+| Printed | No |
+| Saved to file | No |
**Result:** Only the custom URL is displayed.
@@ -396,13 +396,13 @@ There are rules governing which hint is shown during the recovery (in the order
#### Example 3 (single recovery key with multiple backups)
-| Custom URL | No |
-|----------------------|------------|
-| Saved to Microsoft Account | Yes |
-| Saved to Azure AD | Yes |
-| Saved to Active Directory | No |
-| Printed | Yes |
-| Saved to file | Yes |
+| Custom URL | No |
+|----------------------------|-----|
+| Saved to Microsoft Account | Yes |
+| Saved to Azure AD | Yes |
+| Saved to Active Directory | No |
+| Printed | Yes |
+| Saved to file | Yes |
**Result:** Only the Microsoft Account hint is displayed.
@@ -410,28 +410,26 @@ There are rules governing which hint is shown during the recovery (in the order
#### Example 4 (multiple recovery passwords)
-| Custom URL | No |
-|----------------------|-----------------|
-| Saved to Microsoft Account | No |
-| Saved to Azure AD | No |
-| Saved to Active Directory | No |
-| Printed | No |
-| Saved to file | Yes |
-| Creation time | **1PM** |
-| Key ID | A564F193 |
+| Custom URL | No |
+|----------------------------|----------|
+| Saved to Microsoft Account | No |
+| Saved to Azure AD | No |
+| Saved to Active Directory | No |
+| Printed | No |
+| Saved to file | Yes |
+| Creation time | **1PM** |
+| Key ID | A564F193 |
-
- Expand to view sample recovery password VBscript to reset the recovery passwords
-
-```vb
-' Target drive letter
-strDriveLetter = "c:"
-' Target computer name
-' Use "." to connect to the local computer
-strComputerName = "."
-' --------------------------------------------------------------------------------
-' Connect to the BitLocker WMI provider class
-' --------------------------------------------------------------------------------
-strConnectionStr = "winmgmts:" _
- & "{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" _
- & strComputerName _
- & "\root\cimv2\Security\MicrosoftVolumeEncryption"
-
-
-On Error Resume Next 'handle permission errors
-Set objWMIService = GetObject(strConnectionStr)
-If Err.Number <> 0 Then
- WScript.Echo "Failed to connect to the BitLocker interface (Error 0x" & Hex(Err.Number) & ")."
- Wscript.Echo "Ensure that you are running with administrative privileges."
- WScript.Quit -1
-End If
-On Error GoTo 0
-strQuery = "Select * from Win32_EncryptableVolume where DriveLetter='" & strDriveLetter & "'"
-Set colTargetVolumes = objWMIService.ExecQuery(strQuery)
-If colTargetVolumes.Count = 0 Then
- WScript.Echo "FAILURE: Unable to find BitLocker-capable drive " & strDriveLetter & " on computer " & strComputerName & "."
- WScript.Quit -1
-End If
-' there should only be one volume found
-For Each objFoundVolume in colTargetVolumes
- set objVolume = objFoundVolume
-Next
-' objVolume is now our found BitLocker-capable disk volume
-' --------------------------------------------------------------------------------
-' Perform BitLocker WMI provider functionality
-' --------------------------------------------------------------------------------
-' Add a new recovery password, keeping the ID around so it doesn't get deleted later
-' ----------------------------------------------------------------------------------
-nRC = objVolume.ProtectKeyWithNumericalPassword("Recovery Password Refreshed By Script", , sNewKeyProtectorID)
-If nRC <> 0 Then
-WScript.Echo "FAILURE: ProtectKeyWithNumericalPassword failed with return code 0x" & Hex(nRC)
-WScript.Quit -1
-End If
-' Removes the other, "stale", recovery passwords
-' ----------------------------------------------------------------------------------
-nKeyProtectorTypeIn = 3 ' type associated with "Numerical Password" protector
-nRC = objVolume.GetKeyProtectors(nKeyProtectorTypeIn, aKeyProtectorIDs)
-If nRC <> 0 Then
-WScript.Echo "FAILURE: GetKeyProtectors failed with return code 0x" & Hex(nRC)
-WScript.Quit -1
-End If
-' Delete those key protectors other than the one we just added.
-For Each sKeyProtectorID In aKeyProtectorIDs
-If sKeyProtectorID <> sNewKeyProtectorID Then
-nRC = objVolume.DeleteKeyProtector(sKeyProtectorID)
-If nRC <> 0 Then
-WScript.Echo "FAILURE: DeleteKeyProtector on ID " & sKeyProtectorID & " failed with return code 0x" & Hex(nRC)
-WScript.Quit -1
-Else
-' no output
-'WScript.Echo "SUCCESS: Key protector with ID " & sKeyProtectorID & " deleted"
-End If
-End If
-Next
-WScript.Echo "A new recovery password has been added. Old passwords have been removed."
-' - some advanced output (hidden)
-'WScript.Echo ""
-'WScript.Echo "Type ""manage-bde.exe -protectors -get " & strDriveLetter & " -type recoverypassword"" to view existing passwords."
-```
-
-
-
-## Retrieving the BitLocker key package
-
-Two methods can be used to retrieve the key package as described in [Using Additional Recovery Information](#using-additional-recovery-information):
-
-- **Export a previously saved key package from AD DS.** Read access is required to BitLocker recovery passwords that are stored in AD DS.
-
-- **Export a new key package from an unlocked, BitLocker-protected volume.** Local administrator access to the working volume is required before any damage occurred to the volume.
-
-### Running the sample key package retrieval script that exports all previously saved key packages from AD DS
-
-The following steps and sample script exports all previously saved key packages from AD DS.
-
-1. Save the following sample script in a VBScript file. For example: `GetBitLockerKeyPackageADDS.vbs`.
-
-2. At the command prompt, enter a command similar to the following sample script:
-
- ```cmd
- cscript.exe GetBitLockerKeyPackageADDS.vbs -?
- ```
-
-The following sample script can be used to create a VBScript file to retrieve the BitLocker key package from AD DS:
-
-
- Expand to view sample key package retrieval VBscript that exports all previously saved key packages from AD DS
-
-```vb
-' --------------------------------------------------------------------------------
-' Usage
-' --------------------------------------------------------------------------------
-Sub ShowUsage
- Wscript.Echo "USAGE: GetBitLockerKeyPackageADDS [Path To Save Key Package] [Optional Computer Name]"
- Wscript.Echo "If no computer name is specified, the local computer is assumed."
- Wscript.Echo
- Wscript.Echo "Example: GetBitLockerKeyPackageADDS E:\bitlocker-ad-key-package mycomputer"
- WScript.Quit
-End Sub
-' --------------------------------------------------------------------------------
-' Parse Arguments
-' --------------------------------------------------------------------------------
-Set args = WScript.Arguments
-Select Case args.Count
- Case 1
- If args(0) = "/?" Or args(0) = "-?" Then
- ShowUsage
- Else
- strFilePath = args(0)
- ' Get the name of the local computer
- Set objNetwork = CreateObject("WScript.Network")
- strComputerName = objNetwork.ComputerName
- End If
-
- Case 2
- If args(0) = "/?" Or args(0) = "-?" Then
- ShowUsage
- Else
- strFilePath = args(0)
- strComputerName = args(1)
- End If
- Case Else
- ShowUsage
-End Select
-' --------------------------------------------------------------------------------
-' Get path to Active Directory computer object associated with the computer name
-' --------------------------------------------------------------------------------
-Function GetStrPathToComputer(strComputerName)
- ' Uses the global catalog to find the computer in the forest
- ' Search also includes deleted computers in the tombstone
- Set objRootLDAP = GetObject("LDAP://rootDSE")
- namingContext = objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com
- strBase = ""
-
- Set objConnection = CreateObject("ADODB.Connection")
- Set objCommand = CreateObject("ADODB.Command")
- objConnection.Provider = "ADsDSOOBject"
- objConnection.Open "Active Directory Provider"
- Set objCommand.ActiveConnection = objConnection
- strFilter = "(&(objectCategory=Computer)(cn=" & strComputerName & "))"
- strQuery = strBase & ";" & strFilter & ";distinguishedName;subtree"
- objCommand.CommandText = strQuery
- objCommand.Properties("Page Size") = 100
- objCommand.Properties("Timeout") = 100
- objCommand.Properties("Cache Results") = False
- ' Enumerate all objects found.
- Set objRecordSet = objCommand.Execute
- If objRecordSet.EOF Then
- WScript.echo "The computer name '" & strComputerName & "' cannot be found."
- WScript.Quit 1
- End If
- ' Found object matching name
- Do Until objRecordSet.EOF
- dnFound = objRecordSet.Fields("distinguishedName")
- GetStrPathToComputer = "LDAP://" & dnFound
- objRecordSet.MoveNext
- Loop
- ' Clean up.
- Set objConnection = Nothing
- Set objCommand = Nothing
- Set objRecordSet = Nothing
-End Function
-' --------------------------------------------------------------------------------
-' Securely access the Active Directory computer object using Kerberos
-' --------------------------------------------------------------------------------
-Set objDSO = GetObject("LDAP:")
-strPathToComputer = GetStrPathToComputer(strComputerName)
-WScript.Echo "Accessing object: " + strPathToComputer
-Const ADS_SECURE_AUTHENTICATION = 1
-Const ADS_USE_SEALING = 64 '0x40
-Const ADS_USE_SIGNING = 128 '0x80
-' --------------------------------------------------------------------------------
-' Get all BitLocker recovery information from the Active Directory computer object
-' --------------------------------------------------------------------------------
-' Get all the recovery information child objects of the computer object
-Set objFveInfos = objDSO.OpenDSObject(strPathToComputer, vbNullString, vbNullString, _
- ADS_SECURE_AUTHENTICATION + ADS_USE_SEALING + ADS_USE_SIGNING)
-objFveInfos.Filter = Array("msFVE-RecoveryInformation")
-' Iterate through each recovery information object and saves any existing key packages
-nCount = 1
-strFilePathCurrent = strFilePath & nCount
-For Each objFveInfo in objFveInfos
- strName = objFveInfo.Get("name")
- strRecoveryPassword = objFveInfo.Get("msFVE-RecoveryPassword")
- strKeyPackage = objFveInfo.Get("msFVE-KeyPackage")
- WScript.echo
- WScript.echo "Recovery Object Name: " + strName
- WScript.echo "Recovery Password: " + strRecoveryPassword
- ' Validate file path
- Set fso = CreateObject("Scripting.FileSystemObject")
- If (fso.FileExists(strFilePathCurrent)) Then
- WScript.Echo "The file " & strFilePathCurrent & " already exists. Please use a different path."
-WScript.Quit -1
- End If
- ' Save binary data to the file
- SaveBinaryDataText strFilePathCurrent, strKeyPackage
-
- WScript.echo "Related key package successfully saved to " + strFilePathCurrent
- ' Update next file path using base name
- nCount = nCount + 1
- strFilePathCurrent = strFilePath & nCount
-Next
-'----------------------------------------------------------------------------------------
-' Utility functions to save binary data
-'----------------------------------------------------------------------------------------
-Function SaveBinaryDataText(FileName, ByteArray)
- 'Create FileSystemObject object
- Dim FS: Set FS = CreateObject("Scripting.FileSystemObject")
-
- 'Create text stream object
- Dim TextStream
- Set TextStream = FS.CreateTextFile(FileName)
-
- 'Convert binary data To text And write them To the file
- TextStream.Write BinaryToString(ByteArray)
-End Function
-Function BinaryToString(Binary)
- Dim I, S
- For I = 1 To LenB(Binary)
- S = S & Chr(AscB(MidB(Binary, I, 1)))
- Next
- BinaryToString = S
-End Function
-WScript.Quit
-```
-
-
-
-### Running the sample key package retrieval script that exports a new key package from an unlocked, encrypted volume
-
-The following steps and sample script exports a new key package from an unlocked, encrypted volume.
-
-1. Save the following sample script in a VBScript file. For example: `GetBitLockerKeyPackage.vbs`
-
-2. Open an administrator command prompt, and then enter a command similar to the following sample script:
-
- ```cmd
- cscript.exe GetBitLockerKeyPackage.vbs -?
- ```
-
-
- Expand to view sample VBscript that exports a new key package from an unlocked, encrypted volume
-
-```vb
-' --------------------------------------------------------------------------------
-' Usage
-' --------------------------------------------------------------------------------
-Sub ShowUsage
- Wscript.Echo "USAGE: GetBitLockerKeyPackage [VolumeLetter/DriveLetter:] [Path To Save Key Package]"
- Wscript.Echo
- Wscript.Echo "Example: GetBitLockerKeyPackage C: E:\bitlocker-backup-key-package"
- WScript.Quit
-End Sub
-' --------------------------------------------------------------------------------
-' Parse Arguments
-' --------------------------------------------------------------------------------
-Set args = WScript.Arguments
-Select Case args.Count
- Case 2
- If args(0) = "/?" Or args(0) = "-?" Then
- ShowUsage
- Else
- strDriveLetter = args(0)
- strFilePath = args(1)
- End If
- Case Else
- ShowUsage
-End Select
-' --------------------------------------------------------------------------------
-' Other Inputs
-' --------------------------------------------------------------------------------
-' Target computer name
-' Use "." to connect to the local computer
-strComputerName = "."
-' Default key protector ID to use. Specify "" to let the script choose.
-strDefaultKeyProtectorID = ""
-' strDefaultKeyProtectorID = "{001298E0-870E-4BA0-A2FF-FC74758D5720}" ' sample
-' --------------------------------------------------------------------------------
-' Connect to the BitLocker WMI provider class
-' --------------------------------------------------------------------------------
-strConnectionStr = "winmgmts:" _
- & "{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" _
- & strComputerName _
- & "\root\cimv2\Security\MicrosoftVolumeEncryption"
-
-
-On Error Resume Next 'handle permission errors
-Set objWMIService = GetObject(strConnectionStr)
-If Err.Number <> 0 Then
- WScript.Echo "Failed to connect to the BitLocker interface (Error 0x" & Hex(Err.Number) & ")."
- Wscript.Echo "Ensure that you are running with administrative privileges."
- WScript.Quit -1
-End If
-On Error GoTo 0
-strQuery = "Select * from Win32_EncryptableVolume where DriveLetter='" & strDriveLetter & "'"
-Set colTargetVolumes = objWMIService.ExecQuery(strQuery)
-If colTargetVolumes.Count = 0 Then
- WScript.Echo "FAILURE: Unable to find BitLocker-capable drive " & strDriveLetter & " on computer " & strComputerName & "."
- WScript.Quit -1
-End If
-' there should only be one volume found
-For Each objFoundVolume in colTargetVolumes
- set objVolume = objFoundVolume
-Next
-' objVolume is now our found BitLocker-capable disk volume
-' --------------------------------------------------------------------------------
-' Perform BitLocker WMI provider functionality
-' --------------------------------------------------------------------------------
-' Collect all possible valid key protector ID's that can be used to get the package
-' ----------------------------------------------------------------------------------
-nNumericalKeyProtectorType = 3 ' type associated with "Numerical Password" protector
-nRC = objVolume.GetKeyProtectors(nNumericalKeyProtectorType, aNumericalKeyProtectorIDs)
-If nRC <> 0 Then
-WScript.Echo "FAILURE: GetKeyProtectors failed with return code 0x" & Hex(nRC)
-WScript.Quit -1
-End If
-nExternalKeyProtectorType = 2 ' type associated with "External Key" protector
-nRC = objVolume.GetKeyProtectors(nExternalKeyProtectorType, aExternalKeyProtectorIDs)
-If nRC <> 0 Then
-WScript.Echo "FAILURE: GetKeyProtectors failed with return code 0x" & Hex(nRC)
-WScript.Quit -1
-End If
-' Get first key protector of the type "Numerical Password" or "External Key", if any
-' ----------------------------------------------------------------------------------
-if strDefaultKeyProtectorID = "" Then
-' Save first numerical password, if exists
-If UBound(aNumericalKeyProtectorIDs) <> -1 Then
-strDefaultKeyProtectorID = aNumericalKeyProtectorIDs(0)
-End If
-' No numerical passwords exist, save the first external key
-If strDefaultKeyProtectorID = "" and UBound(aExternalKeyProtectorIDs) <> -1 Then
-strDefaultKeyProtectorID = aExternalKeyProtectorIDs(0)
-End If
-' Fail case: no recovery key protectors exist.
-If strDefaultKeyProtectorID = "" Then
-WScript.Echo "FAILURE: Cannot create backup key package because no recovery passwords or recovery keys exist. Check that BitLocker protection is on for this drive."
-WScript.Echo "For help adding recovery passwords or recovery keys, enter ""manage-bde.exe -protectors -add -?""."
-WScript.Quit -1
-End If
-End If
-' Get some information about the chosen key protector ID
-' ----------------------------------------------------------------------------------
-' is the type valid?
-nRC = objVolume.GetKeyProtectorType(strDefaultKeyProtectorID, nDefaultKeyProtectorType)
-If Hex(nRC) = "80070057" Then
-WScript.Echo "The key protector ID " & strDefaultKeyProtectorID & " is not valid."
-WScript.Echo "This ID value may have been provided by the script writer."
-ElseIf nRC <> 0 Then
-WScript.Echo "FAILURE: GetKeyProtectorType failed with return code 0x" & Hex(nRC)
-WScript.Quit -1
-End If
-' what's a string that can be used to describe it?
-strDefaultKeyProtectorType = ""
-Select Case nDefaultKeyProtectorType
- Case nNumericalKeyProtectorType
- strDefaultKeyProtectorType = "recovery password"
- Case nExternalKeyProtectorType
- strDefaultKeyProtectorType = "recovery key"
- Case Else
- WScript.Echo "The key protector ID " & strDefaultKeyProtectorID & " does not refer to a valid recovery password or recovery key."
- WScript.Echo "This ID value may have been provided by the script writer."
-End Select
-' Save the backup key package using the chosen key protector ID
-' ----------------------------------------------------------------------------------
-nRC = objVolume.GetKeyPackage(strDefaultKeyProtectorID, oKeyPackage)
-If nRC <> 0 Then
-WScript.Echo "FAILURE: GetKeyPackage failed with return code 0x" & Hex(nRC)
-WScript.Quit -1
-End If
-' Validate file path
-Set fso = CreateObject("Scripting.FileSystemObject")
-If (fso.FileExists(strFilePath)) Then
-WScript.Echo "The file " & strFilePath & " already exists. Please use a different path."
-WScript.Quit -1
-End If
-Dim oKeyPackageByte, bKeyPackage
-For Each oKeyPackageByte in oKeyPackage
- 'WScript.echo "key package byte: " & oKeyPackageByte
- bKeyPackage = bKeyPackage & ChrB(oKeyPackageByte)
-Next
-' Save binary data to the file
-SaveBinaryDataText strFilePath, bKeyPackage
-' Display helpful information
-' ----------------------------------------------------------------------------------
-WScript.Echo "The backup key package has been saved to " & strFilePath & "."
-WScript.Echo "IMPORTANT: To use this key package, the " & strDefaultKeyProtectorType & " must also be saved."
-' Display the recovery password or a note about saving the recovery key file
-If nDefaultKeyProtectorType = nNumericalKeyProtectorType Then
-nRC = objVolume.GetKeyProtectorNumericalPassword(strDefaultKeyProtectorID, sNumericalPassword)
-If nRC <> 0 Then
-WScript.Echo "FAILURE: GetKeyProtectorNumericalPassword failed with return code 0x" & Hex(nRC)
-WScript.Quit -1
-End If
-WScript.Echo "Save this recovery password: " & sNumericalPassword
-ElseIf nDefaultKeyProtectorType = nExternalKeyProtectorType Then
-WScript.Echo "The saved key file is named " & strDefaultKeyProtectorID & ".BEK"
-WScript.Echo "For help re-saving this external key file, enter ""manage-bde.exe -protectors -get -?"""
-End If
-'----------------------------------------------------------------------------------------
-' Utility functions to save binary data
-'----------------------------------------------------------------------------------------
-Function SaveBinaryDataText(FileName, ByteArray)
- 'Create FileSystemObject object
- Dim FS: Set FS = CreateObject("Scripting.FileSystemObject")
-
- 'Create text stream object
- Dim TextStream
- Set TextStream = FS.CreateTextFile(FileName)
-
- 'Convert binary data To text And write them To the file
- TextStream.Write BinaryToString(ByteArray)
-End Function
-Function BinaryToString(Binary)
- Dim I, S
- For I = 1 To LenB(Binary)
- S = S & Chr(AscB(MidB(Binary, I, 1)))
- Next
- BinaryToString = S
-End Function
-```
-
-
-
-## Related articles
-
-- [BitLocker overview](index.md)
From 4aef7ec18d9ace8699af5e6ad4d09c6c8fa08836 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 2 Oct 2023 11:13:57 -0400
Subject: [PATCH 055/505] updates
---
...nd-storage-area-networks-with-bitlocker.md | 0
.../bitlocker-deployment-comparison.md | 75 ++++++++----------
.../bitlocker-recovery-guide-plan.md | 20 ++---
...-countermeasures.md => countermeasures.md} | 41 ++--------
.../images/kernel-dma-protection.png | Bin 269397 -> 0 bytes
.../pre-boot-authentication-group-policy.png | Bin 1293849 -> 0 bytes
...ma-devices-when-this-computer-is-locked.md | 3 +
.../data-protection/bitlocker/index.md | 22 +++--
8 files changed, 66 insertions(+), 95 deletions(-)
rename windows/security/operating-system-security/data-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md => protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md (100%)
rename windows/security/operating-system-security/data-protection/bitlocker/{bitlocker-countermeasures.md => countermeasures.md} (72%)
delete mode 100644 windows/security/operating-system-security/data-protection/bitlocker/images/kernel-dma-protection.png
delete mode 100644 windows/security/operating-system-security/data-protection/bitlocker/images/pre-boot-authentication-group-policy.png
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
similarity index 100%
rename from windows/security/operating-system-security/data-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
rename to protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-deployment-comparison.md b/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-deployment-comparison.md
index 1654153fec..ebe9a4d9a8 100644
--- a/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-deployment-comparison.md
+++ b/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-deployment-comparison.md
@@ -1,49 +1,42 @@
---
title: BitLocker deployment comparison
-description: This article shows the BitLocker deployment comparison chart.
+description: Learn about the differences between Microsoft Intune and Microsoft Configuration Manager when managing BitLocker.
ms.topic: conceptual
-ms.date: 11/08/2022
+ms.date: 10/02/2023
---
# BitLocker deployment comparison
-This article depicts the BitLocker deployment comparison chart.
+This article compares the BitLocker management options between Microsoft Intune and Microsoft Configuration Manager.
-## BitLocker deployment comparison chart
-
-| Requirements | Microsoft Intune | Microsoft Configuration Manager | Microsoft BitLocker Administration and Monitoring (MBAM) |
-|--|--|--|--|
-| *Minimum client operating system version* | Windows 11 and Windows 10 | Windows 11, Windows 10, and Windows 8.1 | Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 10 IoT, and Windows 11 |
-| *Supported Windows SKUs* | Enterprise, Pro, Education | Enterprise, Pro, Education | Enterprise |
-| *Minimum Windows version* | 1909 | None | None |
-| *Supported domain-joined status* | Microsoft Azure Active Directory (Azure AD) joined, hybrid Azure AD joined | Active Directory-joined, hybrid Azure AD joined | Active Directory-joined |
-| *Permissions required to manage policies* | Endpoint security manager or custom | Full administrator or custom | Domain Admin or Delegated GPO access |
-| *Cloud or on premises* | Cloud | On premises | On premises |
-| Server components required? | | ✅ | ✅ |
-| *Additional agent required?* | No (device enrollment only) | Configuration Manager client | MBAM client |
-| *Administrative plane* | Microsoft Intune admin center | Configuration Manager console | Group Policy Management Console and MBAM sites |
-| *Administrative portal installation required* | | ✅ | ✅ |
-| *Compliance reporting capabilities* | ✅ | ✅ | ✅ |
-| *Force encryption* | ✅ | ✅ | ✅ |
-| *Encryption for storage cards (mobile)* | ✅ | ✅ | |
-| *Allow recovery password* | ✅ | ✅ | ✅ |
-| *Manage startup authentication* | ✅ | ✅ | ✅ |
-| *Select cipher strength and algorithms for fixed drives* | ✅ | ✅ | ✅ |
-| *Select cipher strength and algorithms for removable drives* | ✅ | ✅ | ✅ |
-| *Select cipher strength and algorithms for operating environment drives* | ✅ | ✅ | ✅ |
-| *Standard recovery password storage location* | Azure AD or Active Directory | Configuration Manager site database | MBAM database |
-| *Store recovery password for operating system and fixed drives to Azure AD or Active Directory* | Yes (Active Directory and Azure AD) | Yes (Active Directory only) | Yes (Active Directory only) |
-| *Customize preboot message and recovery link* | ✅ | ✅ | ✅ |
-| *Allow/deny key file creation* | ✅ | ✅ | ✅ |
-| *Deny Write permission to unprotected drives* | ✅ | ✅ | ✅ |
-| *Can be administered outside company network* | ✅ | ✅ | |
-| *Support for organization unique IDs* | | ✅ | ✅ |
-| *Self-service recovery* | Yes (through Azure AD or Company Portal app) | ✅ | ✅ |
-| *Recovery password rotation for fixed and operating environment drives* | Yes (Windows 10, version 1909 and later) | ✅ | ✅ |
-| *Wait to complete encryption until recovery information is backed up to Azure AD* | ✅ | | |
-| *Wait to complete encryption until recovery information is backed up to Active Directory* | | ✅ | ✅ |
-| *Allow or deny Data Recovery Agent* | ✅ | ✅ | ✅ |
-| *Unlock a volume using certificate with custom object identifier* | | ✅ | ✅ |
-| *Prevent memory overwrite on restart* | | ✅ | ✅ |
-| *Configure custom Trusted Platform Module Platform Configuration Register profiles* | | | ✅ |
-| *Manage auto-unlock functionality* | | ✅ | ✅ |
+| Requirements | Microsoft Intune | Microsoft Configuration Manager |
+|--|--|--|
+| *Supported Windows client editions* | Pro, Enterprise, Pro Education, Education | Pro, Enterprise, Pro Education, Education |
+| *Windows server support* | | ✅ |
+| *Supported domain-joined status* | Microsoft Entra joined and hybrid joined | Active Directory-joined, Microsoft Entra hybrid joined |
+| *Permissions required to manage policies* | Endpoint security manager or custom | Full administrator or custom |
+| *Cloud or on premises* | Cloud | On premises |
+| *Additional agent required?* | No (device enrollment only) | Configuration Manager client |
+| *Administrative plane* | Microsoft Intune admin center | Configuration Manager console |
+| *Compliance reporting capabilities* | ✅ | ✅ |
+| *Force encryption* | ✅ | ✅ |
+| *Allow recovery password* | ✅ | ✅ |
+| *Manage startup authentication* | ✅ | ✅ |
+| *Select cipher strength and algorithms for fixed drives* | ✅ | ✅ |
+| *Select cipher strength and algorithms for removable drives* | ✅ | ✅ |
+| *Select cipher strength and algorithms for operating environment drives* | ✅ | ✅ |
+| *Standard recovery password storage location* | Microsoft Entra ID or Active Directory | Configuration Manager site database |
+| *Store recovery password for operating system and fixed drives to Microsoft Entra ID or Active Directory* | Both | Active Directory only |
+| *Customize preboot message and recovery link* | ✅ | ✅ |
+| *Allow/deny key file creation* | ✅ | ✅ |
+| *Deny Write permission to unprotected drives* | ✅ | ✅ |
+| *Can be administered outside company network* | ✅ | ✅ |
+| *Support for organization unique IDs* | ✅ | ✅ |
+| *Self-service recovery* | ✅ | ✅ |
+| *Recovery password rotation for fixed and operating environment drives* | ✅ | ✅ |
+| *Wait to complete encryption until recovery information is backed up to Microsoft Entra ID* | ✅ | |
+| *Wait to complete encryption until recovery information is backed up to Active Directory* | ✅ | ✅ |
+| *Allow or deny Data Recovery Agent* | ✅ | |
+| *Unlock a volume using certificate with custom object identifier* | | ✅ |
+| *Prevent memory overwrite on restart* | ✅ | ✅ |
+| *Manage auto-unlock functionality* | ✅ | ✅ |
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan.md
index 556792a072..1744bbab08 100644
--- a/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan.md
+++ b/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan.md
@@ -4,29 +4,25 @@ description: Learn how to recover BitLocker keys from Microsoft Entra ID and Act
ms.collection:
- highpri
- tier1
-ms.topic: howto
+ms.topic: how-to
ms.date: 09/29/2023
---
# BitLocker recovery guide
+Organizations can use BitLocker recovery information saved in Microsoft Entra ID and Active Directory Domain Services (AD DS) to access BitLocker-protected drives. It's recommended to create a recovery model for BitLocker while planning for BitLocker deployment.
+
This article describes how to recover BitLocker keys from Microsoft Entra ID and Active Directory Domain Services (AD DS).
-Organizations can use BitLocker recovery information saved in Active Directory Domain Services (AD DS) to access BitLocker-protected data. It's recommended to create a recovery model for BitLocker while planning for BitLocker deployment.
-
-This article assumes that it's understood how to set up AD DS to back up BitLocker recovery information automatically, and what types of recovery information are saved to AD DS.
-
-This article doesn't detail how to configure AD DS to store the BitLocker recovery information.
+This article assumes that it's understood how to configure devices to automatically backup BitLocker recovery information, and what types of recovery information are saved to Microsoft Entra ID and AD DS.
## What is BitLocker recovery?
-BitLocker recovery is the process by which access can be restored to a BitLocker-protected drive if the drive can't be unlocked normally. In a recovery scenario, the following options to restore access to the drive are available:
+BitLocker recovery is the process by which access to a BitLocker-protected drive can be restored if the drive can't be unlocked normally. In a recovery scenario, the following options to restore access to the drive are available:
-- **The user can supply the recovery password.** If the organization allows users to print or store recovery passwords, the users can enter in the 48-digit recovery password that they printed or stored on a USB drive or with a Microsoft account online. Saving a recovery password with a Microsoft account online is only allowed when BitLocker is used on a PC that isn't a member of a domain.
-
-- **Data recovery agents can use their credentials to unlock the drive.** If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it.
-
-- **A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive.** Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in an organization if needed. This method makes it mandatory to enable this recovery method in the BitLocker group policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker policy settings](policy-settings.md).
+- **The user can supply the recovery password**: if the organization allows users to print or store recovery passwords, the users can enter the 48-digit recovery password
+- **Data recovery agents can use their credentials to unlock the drive:** if the drive is an operating system drive, the drive must be mounted as a data drive on another device for the data recovery agent to unlock it
+- **A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive:** storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in an organization if needed. This method requires to enable the recovery method **Choose how BitLocker-protected operating system drives can be recovered**. For more information, review [BitLocker policy settings](policy-settings.md).
### What causes BitLocker recovery?
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/operating-system-security/data-protection/bitlocker/countermeasures.md
similarity index 72%
rename from windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures.md
rename to windows/security/operating-system-security/data-protection/bitlocker/countermeasures.md
index 93527d56a6..c6cd4d6f6f 100644
--- a/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures.md
+++ b/windows/security/operating-system-security/data-protection/bitlocker/countermeasures.md
@@ -1,26 +1,17 @@
---
title: BitLocker countermeasures
-description: Windows uses technologies including TPM, Secure Boot, Trusted Boot, and Early Launch Anti-malware (ELAM) to protect against attacks on the BitLocker encryption key.
+description: Learn about technologies and features to protect against attacks on the BitLocker encryption key.
ms.topic: conceptual
-ms.date: 11/08/2022
+ms.date: 10/02/2023
---
# BitLocker countermeasures
-Windows uses technologies including *trusted platform module (TPM)*, *Secure Boot*, and *Measured Boot* to help protect BitLocker encryption keys against attacks. BitLocker is part of a strategic approach to securing data against offline attacks through encryption technology. Data on a lost or stolen device is vulnerable. For example, there could be unauthorized access, either by running a software attack tool against the device or by transferring the device's hard disk to a different device.
-
-BitLocker helps mitigate unauthorized data access on lost or stolen devices before the authorized operating system is started. This mitigation is done by:
-
-- **Encrypting volumes.** For example, BitLocker can be turned on for the operating system volume, a volume on a fixed drive, or removable data drive (such as a USB flash drive, SD card, etc.). Turning on BitLocker for the operating system volume encrypts all system files on the volume, including the paging files and hibernation files. The only exception is for the System partition, which includes the Windows Boot Manager and minimal boot collateral required for decryption of the operating system volume after the key is unsealed.
-- **Ensuring the integrity of early boot components and boot configuration data.** On devices that have a TPM version 1.2 or higher, BitLocker uses the enhanced security capabilities of the TPM to make data accessible only if the computer's BIOS firmware code and configuration, original boot sequence, boot components, and BCD configuration all appear unaltered and the encrypted disk is located in the original computer. On systems that use TPM PCR[7], BCD setting changes deemed safe are permitted to improve usability.
-
-The next sections provide more details about how Windows protects against various attacks on the BitLocker encryption keys in Windows 11, Windows 10, Windows 8.1, and Windows 8.
-
-For more information about how to enable the best overall security configuration for devices beginning with Windows 10 version 1803, see [Standards for a highly secure Windows device](/windows-hardware/design/device-experiences/oem-highly-secure).
+Windows uses hardware solutions and security features that protect BitLocker encryption keys against attacks. These technologies include *Trusted Platform Module (TPM)*, *Secure Boot*, and *Measured Boot*.
## Protection before startup
-Before Windows starts, security features implemented as part of the device hardware and firmware must be relied on, including TPM and secure boot. These features help ensure that the device hasn't been tampered with while the system was offline. The following sections provide more details about how Windows uses these features to protect against attacks on the BitLocker encryption keys.
+Before Windows starts, security features implemented as part of the device hardware and firmware must be relied on, including TPM and secure boot. These features ensure that the device hasn't been tampered with while the system was offline.
### Trusted Platform Module
@@ -59,33 +50,15 @@ On computers with a compatible TPM, operating system drives that are BitLocker-p
- **TPM with startup key and PIN.** In addition to the core component protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, and a PIN is required to authenticate the user to the TPM. This configuration provides multifactor authentication so that if the USB key is lost or stolen, it can't be used for access to the drive, because the correct PIN is also required.
-In the following group policy example, TPM + PIN is required to unlock an operating system drive:
-
-
-
Pre-boot authentication with a PIN can mitigate an attack vector for devices that use a bootable eDrive because an exposed eDrive bus can allow an attacker to capture the BitLocker encryption key during startup. Pre-boot authentication with a PIN can also mitigate DMA port attacks during the window of time between when BitLocker unlocks the drive and Windows boots to the point that Windows can set any port-related policies that have been configured.
-On the other hand, Pre-boot authentication-prompts can be inconvenient to users. In addition, users who forget their PIN or lose their startup key are denied access to their data until they can contact their organization's support team to obtain a recovery key. Pre-boot authentication can also make it more difficult to update unattended desktops and remotely administered servers because a PIN needs to be entered when a computer reboots or resumes from hibernation.
+On the other hand, Pre-boot authentication-prompts can be inconvenient to users. In addition, users who forget their PIN or lose their startup key are denied access to their data until they can contact their organization's support team to obtain a recovery key. Pre-boot authentication can also make it more difficult to update unattended desktops and remotely administered servers because a PIN must be entered when a device reboots or resumes from hibernation.
To address these issues, [BitLocker Network Unlock](bitlocker-how-to-enable-network-unlock.md) can be deployed. Network Unlock allows systems within the physical enterprise security perimeter that meet the hardware requirements and have BitLocker enabled with TPM+PIN to boot into Windows without user intervention. It requires direct ethernet connectivity to an enterprise Windows Deployment Services (WDS) server.
-### Protecting Thunderbolt and other DMA ports
+### Protect DMA ports
-There are a few different options to protect DMA ports, such as Thunderbolt™3. Beginning with Windows 10 version 1803, new Intel-based devices have kernel protection against DMA attacks via Thunderbolt™ 3 ports enabled by default. This Kernel DMA Protection is available only for new systems beginning with Windows 10 version 1803, as it requires changes in the system firmware and/or BIOS.
-
-You can use the System Information desktop app `MSINFO32.exe` to check if a device has kernel DMA protection enabled:
-
-
-
-If kernel DMA protection isn't enabled, follow these steps to protect Thunderbolt™ 3 enabled ports:
-
-1. Require a password for BIOS changes
-
-2. Intel Thunderbolt Security must be set to User Authorization in BIOS settings. Refer to [Intel Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating System documentation](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf)
-
-3. Additional DMA security may be added by deploying policy (beginning with Windows 10 version 1607 or Windows 11): [Disable new DMA devices when this computer is locked](policy-settings.md)
-
-For Thunderbolt v1 and v2 (DisplayPort Connector), refer to the **Thunderbolt Mitigation** section in [Blocking the SBP-2 driver and Thunderbolt controllers to reduce 1394 DMA and Thunderbolt DMA threats to BitLocker](https://support.microsoft.com/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d). For SBP-2 and 1394 (also known as Firewire), refer to the **SBP-2 Mitigation** section in [Blocking the SBP-2 driver and Thunderbolt controllers to reduce 1394 DMA and Thunderbolt DMA threats to BitLocker](https://support.microsoft.com/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d).
+It's important to protect DMA ports, as external peripherals may gain unauthorized access to memory. Depending on the device capabilities, there are different options to protect DMA ports. To learn more, see the policy setting [Disable new DMA devices when this computer is locked](policy-settings.md?tabs=common#disable-new-dma-devices-when-this-computer-is-locked).
## Attack countermeasures
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/kernel-dma-protection.png b/windows/security/operating-system-security/data-protection/bitlocker/images/kernel-dma-protection.png
deleted file mode 100644
index 297809afdce8d30b82fe5c16d8e6dab9206de487..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001
literal 269397
zcmZ5{by!>9vUXcqoZ@c9-QA13whgYqT^d}9J1Oo^+$FeEG`JOacX#LG-1GhJ>A8Po
zCwuSb$yzgO&CEOR%nDUel14!!Kz#G&4T`LcgxZ@o9}?fZfoXz=eSNZlVWIT;_0~yE
zTI@~v2+`i_&3iLZMbS5JAYi0N!w;|b2=+3XPH*0jP5$fic6tHe_U6q?o~(rES698m
zr4I&JPy)D9A3-u^w6sqhWDWB6E-o&?Ge#tl>9hY}diM|VHXkJ-JUh21D
zM#y8TxPQ9eJ{sbwuJ%Z@ce%5*QyLu}R)i6QCksIP=d#JO+P|e)ZAz#3&y)Xor=JaK
zR^oL!e#c30cdsiXB-Hlp&k@iDU`EBog?)d2?^$we28oNqYWsFFifF}h*Ey3SToUFI-dFXTxAosIga)Zfpq(sj?!
z`e~1TQF*0f$wT>UtxNj$;f|c09fOUHO-4aMp`PO}Ndq1ei!d9rnK2*{G8i02434GN
zgGR|zj`%oVaJg{_d-wO*9EF}Vf_kQaJ%K%?Wyipa{fvT;Y9~w}Xh%_=nTC>by?JU4
zkDu$KO%Oqjw?3hchjDmfCZofSBu2S#R2LVj&!YG3+X}tb^-$Bl1-%+{
z4S*FCiH=}`9*YTe)Yb_d+P5xks&ueq%%9wRQSW8jzms^UNtuPu28h691DI)pjFN3Y
zdFlN$nV-9+vK!ORgLVsRCc>klM7fdV^RD3N>c4p{XueCdk*rEU_ln>TEnz12Em=r_R`Jb!
z>vqi6=uWeg_sMW|UG!jl`WZ+4*LuCYVSIriIvq@xeWzk(j)J~e67tyo$Y>*h{Ya9Q
zz-S`ubsx|>TYMtU2FGAwhCzUV0zHH+1TdqMK6b7h
zY#@DkGAH7@APOF7jXl1ly}h^iNkj+-0|R5iLWb}sWwLj1N@QcLEBMxJoTx>`y{$Wx
zYRTcyB4FZP>o^CLs3<3dB-^n&&>PZoJH42)%ouN@qeMBE=7tu*5v%B@7_NMA@4W@eHWPZ#>itsFN|t}6G@lA2PDDpA#KF{7{azGXpAD~%feFR1sl)EKSlWQpHR)qr-R0$5wo9l)
z;DWq!H#dz1J&wVZW9E4H7ON+O0keg)x3CiH!_BU@aNVn2P)gT!WeH2MQqJBGWm-z<
zKqGkxlE(%|x*%kHzmxi-&j@)Z@~*D)JUcJc^C$Q*F_H-@A7f1;
z0=;`zNdFdbdV4f8GwW-)j^^Hzhk@)gQz|z(Jv~9|{iSHKMfoE(a1PK)Dxl5==$1@HM*xamLds|rOhZio5+VYqS8Yav*IzPG!$SkAC)b}!
zhcSjrm4^nwz0B%9*W`#NE7GgWPcm4eNV7@W9ShJmp`qKf@ye(fCo!k{AWBAs977Y6
z9%p%=xkd0j864|g!Onav{LK%WP*EAxlnkh8*40FbOoYfgq2_mZ^Z6(P%ED35;Ka3C
zCKgW~5B3C-29_hzNUgxDu?7d8q!fazlhKpAXNJ_T-Q!!eW5(vnyYf7%y;1$F!u4D*4$^3~2hIglIq>8GiYM^BkWM+ud5Nh<(@~y!o8Q?@)d+){LWA
zzh%j*wfRPlea+;o(;E4Z+tc^eGl!i^T_tSJ=L!}>+M9o@Mk;isyFGvIyPMCH^AyXA
z6uz6Hrc>wCk3K%|w*Sr;l*JU@FTzVg^Pgbx0$_~3u?qCWch)b{Z^nT`B@s*K2dR`6
zR!>}jLemOmn)0_~u=gd(cY!7!_r?%rhi?#f5mhrNMqp3P)lg!C3iw++
zel$_yjQ4c!-5fpv!TQmH#{1yz-zz+@1=sDqk;^oK-iMLrA3E)KOR-y8{LTg#-n*yp
zVlnF^os^mcEa?$od9&lrMWR4X<}rWg3u?{j2I#9*O=kL0$vYd!w$nEVHlpS~+G7(&
z5&1&b6KEHl-)RAydUm16Q6)xxjm4ZX;^LU-fc3g;4pAoe|Gf5
znzu%bJ}#V@{ZxxdA!1-z0WdHd#cPBNc9D|7SuG0t!?$xZc-#mL2qpzR(e=-sRtrp{
zI`+1yTc?}BSl=jgkA`m>_BR6IpB+AxUL^W1^c@#2I%5GCGrCM=t3ltr6k7NF#e?fM
z@-O{U)HmqsmVUN#ssbPJ-oCA>{y=uzmYxQQNCY2#JlY$%f&bpZlot{
zt+s&XXu4C{IuHDM5m@;N+f8t$#kY_z%hb-AFS1Ef`OJwi5TkDw7oKyF`2(;^P
zNp-Q~JxXG`)T6Iz-6X!Uee8dO^fW_I|@7NN7xJ
zkxr;7H#jLXJzPc!XQK=uu-SdK=g8d33bV%PI`y=+jzT+cLcHZoBA_{
zBo6M6)llthCwZjJx>)KlN>dFdJ|V&({AI+7WhpZCR=YDtQ*lAz8hBuV@^-5`?8jSg
zD0+)<8%7xe>IPda!Bsf0`#jcSh2QOA!hx68>qQwh=n$BiP^C`9P69TYh)zL9+mL39nBvo$?
z^lFFJwYkfCo)*;4wx=)yZhbyiu6XDO?nDJ%m>Di6p_?yN@rB_qb?&GEABrouaR%)}
z?lg71M#y^$N5hW_GPJujBSyRF84az0Ko}$>r1!9JU44^Z>7`ClFMEUQaaYwYiA^IE
z6Fw$&CyuL_O~sNw85&uKbOx4W7uV?fpR5?Fb?K;q*%qa#vbWP{b~QWvz`A>ue)m@o
z*>dSp=1s=*;P?_XIG{EcboIpc*PWmC>?AL0n(ji5`;|2FZFfw%yQ?H4La
z_Wfi5HzA4&GN_ws{mfLAJOf=4?;6Wj)SuNJRmuKb9#(s1tYvaZxGWjk7gXN<<7zlO
z`)fFJA>~p%;d1@wdO05{xxeiD=SuJVe98_wXpp7-F(zT?vE=UlzVl&t0a;zG`eLEh
ziRQEx(5r$`R@$d%W5mZ`9g(JOf}q3KyKmHpxExbwG?KB@{OfB!MqjJ|E+gZR+o62u
z1^PwkU5_JPQz#IWuDix~jk%L8|F5ip!)lsw*??z%B2V6vRi3?ii-nwm0v!h@=*N#Y
zczAff%*V6)VrftvcScY+I5^r?c5X9?BC^2u>!)!9a{q}SufLw}=4(#;ICe$~s0<{l
z05zKEHjpXZFh44HO$AD4&8UQ73g%)4?O(f1C$dz@w7|X4PIj;|zURf(|a*QrR!1{b#*>K8){TX$;3hsZY4WlVGmv9s?FtQ(Onm_JwzBADEHYUnC`
z9&`#f=Clg;y5p5&{yRtOvxCMAnvGc|Zh`%V4=j_`LdlcAc?0VaG}ZU_hoepBLd
zVUHi&$SoK!2UYqWEHFpsjZbHO2^C!STR8|iDD9JnNU$@IGtbBAQ2(XDpDW^B(^^WB
z_blC*p_&P~@$HOYs_40?_IJud`MR2n6*EKEKuE;Jqp-CPV0JOPtQq?$JETsAKimr+
zl1V_7`1e-YbQz;XFs7B)smv{vnGEY@JV=Zk!mp4s)sHYUFz7q*;}0F|{QzsywtZfK
zzC#|<7jd07K@%pKdK9afIjihNsF4;k_}Apn&IJlFD@x0?B{F5st6r6XXp&H963CQD
zR<2>{MNT(__~n;9!YtpmcqluzYP~4OB{A#!RG--(+zLUr*Xeq$@0*L>;E_`oj;bm~
z7;1yk|IgpUg#<8A?C-y~F-3UY_EwTrJSA>Mz>U+92O-;)#&BJaYs1Z51oP!8AqB=m
zL)#5_`R24r=RSYu^d{f|cmbV+B)YDGnY+UM4n@i(O-Ak@1C@}bx5{bcr%w5CE}T3A
zgT|Q}3YnUyU5iR$4$cV;<&%G}$BXCwW~t2YD&ta_zN#{r-Kx&Qdh+DKaw7oPu*$O9ZO+>|b8{1`
z8w%Z++^fc8a~E{nW+;tF2zA1k1c`QkhgMNmrR)NsBbx(TM(_w=31dozdIJ_o?xo3J
zUL=h-U=7FpEOt9eDK7d#365A&J8`{^$u}XW-u_KbJM?EmbAY4JMbvx-Ce7Kqy}}9G
zz^@E%PR0^h^Q~(Bo~Ay!{CQX|grBS=71`8_Q8txZX%BG2b}0YSEok&{8i$R#ns*_8
zI2~b{24i;L!HD4=Z<F(>!kX*hxvze*v(Y$N<wQTIiXx|FjU=<0>9$Y)r~sI!qE!?5IV$k{}O1#|<%RzCr)H?l<#!3nQE8*rEftbER#nSC~_lITZqb`gfduj4Z%42;j5962shvn
z3YFWqb)`BR3~`b<0BRQ%-e4jaO`8H|AJ@Yy*z|@nrHaD>*cURf+raFUv71#a`O2wb
zMPCYx&YJw?6cS-m7xRJE(DPRY5n2mJ7Siraq$+0zNYL@_LCr`Z2t%ya`7D7{vkX+Bwvq<;8?Z3)QmhFgd>E7LUTGgo4F4@n~Ll{@rCy)=)d&xM!vTgqt&7xNQKT|l&lIi^tK^&Ac{sao&8YJ
z1XUl+p&pSp06|E*_Kn<-qff9vTn-9)J1?0^dW=uD_z6tfLCL^oS~gt*N}9aiW0UYw
zQl%OOchBEgRo&aa{<33_h=>oOoDKH!UpaAc{l>)jwD&gQs11x?J{MmIP&1-O9`5EN
z1a_>E8c_F`T`~s`vtZaC1K-vh&SE2Zw}3%|w!id2+HTMlg(jbvsT(jA;86SRlw$nW
zXx3LsSlF@pmsTjnUw-~^?y{Sz1tYq_q+cV!6T5%DMxykqI*p5Ddq}7Qa(F2DykAqf
z(qmWyZ(SkBI&XFv$>4rAQ(Xk!U}ckeH89K}nKH3GK$stSFZjz%%UGc*MNtF!9L*=-
z`K5YIDk~n)5;cyHOi$zVvrbQ%o`FQJ+Jj(XhPJ(@H=N+W43hI4@~d1>JDRoIWWoVH
zp7$-wzGZ2uUY$3$rZRAGgk0G6g~7XCC6zP~p`ooMZ#b{-L}N$=BrS@~J~5B)IF?0N
z>ej;QACXv{I(Z|~CZcEl_HHl8jAVfr)4Pnn-YPeMMR@vjQ4tTItVLY~{bS%n8snNA%uC>wY`IH{YS3GGEPtyvDFqA
zw;P_z5qoRHQQl7El$xN%|2OLKaUs|f0iAP|lVdb0m~Kc;B#bMbBkn&*8nRsh
z(AY#H)WP4thT2!IWK>jCHZATYJKNj&$y`=BP{%jEj~RJW&|{`Ba7!>PLh^QA1L
zku;&v1ID$1%J*#Y1SPRG+04DH76@8Ynhe*fC(saYU8A&J%nO9l;gLX_sfUss%&Vah
zO%*V~SC6j2_S)xvWkjJx6MaJmE7x(;$%pW!Cf5CuBu#~(Eb88K6SiJ3=_uh}27@Nn
zrZA)TWWTm`h79L51NfkW5m
z@|q#M4EtnWq2pl9#U^zb$}iA%PsF~Eh`!My=&6a!@F0lCU6{xo@KYZbhvcmj$Crl8wvf8A
zRC?9Fyx#NEI~Z{TpiM_&PlM~8oK{sldZ;EyOe4M2WJ7~I@hUu^++BaEX;yu*C*i1K
zp`g6FQB${DW8wGjPc~_@VQw1e4^?GN%)R?^^2}gTE_eh4gb*-Ty{Ydd76M@#8XAh5
z7Ew0W;6=W?a&>If-l>y|`;TxxeMDYL%w7k~|@%Km??m^aKTDc|<(HOmuARHbqF02nPDMwH)0WE>xy
z&j#0mFgx~*D+>>(BYRw_tKBA{SZr)cXdoQiz$5AZ1N@0Km;sd9AL=dx_zf9C-k0&K
zmh`TZvoYOkr1ofz3q>UbtIpuF>8ad=H-tc5WiGr?pZUO@@PDwcK<+-Ji6lEO6;)t8
z{!%xiRW*69X+ndEMw&ixDP?gFc0aQ6VKK&R69^!Yt(8VdvA^C>8q$=cKa?jBgucUg
zPy62n(+(qFiAat?32uP}ne^#T28R}+b<*Aj>BB^!AH{*squr&c;I4pa@7Tj{VXg#X}6X3i{P
z>F~Xz0%dlOhLo-uyCO3xo%TCA5YDQuJ#S|h%vzg|-^9h%h@IvSBs>53=^2p0wE9N
zi+{>acLgdmR+8Gpe-!(|l2UeOB00#Zw=GmwuwfpqI+CKhSe-B7kqHISgqlIVt*u`3
zyt?E?j3E-WzwalXEXg&QqF5?j^XcaP_|g@s9Fs^sPj8EnfwTIm{d!X|k0pMT~Gk<57*BY3a(SVg?J6l9sbL)ieS%iOJnPlf(
zS)b-e)AoLKOt`KHob5JlX>7;+U}K|FfBc!UpxrOk<7$mU4#52J%a>{P&ryPn2DD2t
zKNrHs-FKCQgYN9Txto+0M-Q~;H+x-pa#(Y0>GpWPp{4&s78#ADHM9!1oN6MML}#=3dOWqr7MsDqM8zICO>SwzR%-&}-P_ziNdjj}
z4*nv&__(J%8+QN}bF=xSYxu#nwTNk-sXeFWIo)=pt!(l~$5xuXR1v0FpN}L>E8%WE
z`xDUX_D}fi^)x{X%|C?=JdjvniP^Cm^!+?ek`cRl{w)*58K!=I(`paO((%TIw
zaCc{8b*1SRJEI;eZurh=C#PJRTnP3d}Xuf9PC$H%w)S#P>o%|I}U51wNx&+zG
z;juCQ**rfw+F-3I#&phTiIkw?u+%SwO_3n&UO?juB{+FO%m_}ne&!=I(f(+u2}
zk37=Pi&KzOv{PnABAC+5?CWmK0opRvSW}}D8Fj{aXAJZ+xl^RlG*-M=W|6K1j;Eh9
z5PqrB(~j^;Rt08Ee=)CX`kWvBf10!U>q<_&s*sirralMah^$Gu(tcF3@>gRjIDhY<
z=89ITJ=`sA@$wUTq1vY76>{k)b}3CXcH(y$EMj1@gMkO)mDqa=JKE-pvQa`?=2H*l
zQR)&P$Ki=0>PTjo54d<5Omx`nlXbn9q>KK#$mbz(ui3kCKTg5xwk-?}x^tJ?h+2K_
z;%QNYCwsx7a6arvCpDvGnj67h>9l!vt(-hBX->S|Shyp!`)W6D8R+F20GBbJm*=`0AHJKaBh
zpCAV1glTDr25T`U_KwUSkOZW^A5J5&=(`zRM-=T&hQ
zWVoNZ=2W@e0+_D3uNX(y>5JAiXWUG>0I4u7X9r1Z6Z6*-v
zagyd&n5yokJ6xp!hN4B
zR0r-OlqDxYwwBU5#RbK`d203Sq2hS;_|m!WL-hPcWLe<
zWkQeY_{m3&dykuzD-8$BETR|G!pUDB!nCxrK+q`jKb6#{_h@ZCdc-?`QHhgfe+N@1
zQqC7ZDwbxO!H1^r#}VHIqBb6nb7rf|F!@0QkxZ%XYmdnh{kUTAcMB6dy`^>o1`pnM
zC=-1@oht2w-%#ZiWck5xci2qQem|Ur^B84>7NMu!C9!;Kyl`A}b;W6Q2X&`hphE2a
zz~=@3@6svuLri6UzXIObFyUzc^n2`Rw*F8DVzXMK#YPY-2Zz6tEUtt!^wb+*_);B%x>XwXCJ*>XNMkbF291C|!?%=s3@MdvC?`+f*#|SF)&pl~;X=-_7UHdctu0
zt_$(Y`1vsyeB6JK+6sP#lLq-cv~Nv}i_3U5qV)Fmw(z=Wg*8Yk$LoCxE<;%%z>{mo
z-x}yt)l8V2FZ$#szB^zd)+Zugf-Ya_{H)e3KROtmQX>rx-Eb2;Kla8;(jqq-Nh@5k
z`NZka{=8i{?IA%enH3QK$ZKhB{nmeTQ=v`p=l|+ebkhhFTct^5p($7$P$e^8B@7Y?
zZ;qpjbYwO;8+`VE1+~hAgM|my0-$?q4K1xtX3Wwgz^78yQvIR+kd2VCPxl-YQSmY4
z6?thEj*UrQlp-?PKQ_CZ^yV%rs^%Wk_7%VkB`tkO=fCRtjV~Vu&+0KuK*aBXBR^v&
zarNq-OFw6c@iuu8kEAWZ{7K6@wdu#*Wi_B5$q@3-^q!CC5%76QoM*yc##@peTHC3&
zyf@JKSQbF3>RUfBxUr-zkFtN1A=AC
ztvjfG$@rJcgo6Fr+eOOdMq}r1d}@)0htM*Ac~NkYaZ43p|L~0m-b2SvQ9bEs{>d$T
z0!w2D$RP|EP1*4K!XRy-jQ&^}9!GwDqpPM!3w7jh@2lq_D46tadSHTGS10m_V%tzd
zTV{Qd?%`)k09Hz#N&;73Kyg0
zv0`{sx$eHDjM+-tw#h-P-msGiABnlKPLg<=CpMq~A=UXx^im%@iSi~(9{u8XVL1vv-N)ao&-6dub3I5c|WPV^j;!u
zOOhj9dNL0a=m412xWbz@RcAQ3uD+Adb!p+pAI>FScrD5SO)}v&q*27g#NM^n+&djt
z*hD3V$~ze8&{2tbE9zA8=$$Bo-W5LyHv^vVKdXI}uxtK(t7Ik*Ohfu)Me^Co|^&5=5`glAI4
zPjpt6>UV@jXWyaQDKURe-MBmbZo^{n717o$o2pwS=uPkHL@%Prjdj-g3BU5~4-9(i?Fh1Y6(zqTk($7^nA
zWPu3sQ}5=lvkNx~$6Xz$J=k6HVFe@X8?zGX7aEARxO$?>Csh0%(!7|!=z8rIV!Hl<
zxkJ5fq%>_Rd3n&=CfG=Hj=>$MP3Do|cO<{#O*x
zHI=SD+qxmmX{~}pR$!uuSP^2{f5S=u|)C8RMPVQN0@e2N8HbTbC{4rxx(7-k$5{w_kZIL0!v1IU
zy9zayaEIegDiX|ot)&1a3M1>mN(dbtogg(LMNHfN77ZT2#lBK{^jLSi_6uA?98=C^
zUv^FowRxQc?b8jClA2hJDtC;*RrfL@hL0yW{PEsvFmFD}@E92E&
zmU3Tg#I`bbfeYCRw$W&GCuSk!w(A*fz9#47WV9(wlE(@frrLfb6}x)?1{)eN$%fj~
zI6K`3Ei_2Z&dzd?|KH{O&oChbgX2}kB{GX)xn=xx3>c7X=M;t{wH#W!Z4IxsKI@-|n`YY45hoGPw4zZexMuxj^yN&y37OYD+9
zRn7QxAC&2i+w{BTUF~4hGn74cEc_FF{^j%TZYC;Ugk!~xy#O_U47G&3^1ZS_s5;09
zfQFz`XCj$ihz$afYj$@F`@OP96_hv|Qy1aF09-F4k}C~#pba`uLnm&?SOdr3OFoO1
zS+OA3>V+oG*1y_pbbYb$qM^6M$GbIpzj@8BU!Re0VPpe
zV|Goa>exW?jCb-J#~5ka-+%&bw^;IU4a|lmEgUTW6nXV@h%=4A>KkRLMToHS~n)Rw`W-!#Zq%
zq^=JuHcT$VnDMI98FN198eBQUhZmS0oNi|XY1fr@s#UCPt-&Gw~vP#89Y(eGb9
z@M`N8*)VLiy5h_FIVck%g^uyMvgM)$Da$8)@_VDDvz2*nxGNh?3yG>
z1xsD@85v`GQjrHW3p%kD)*1lUWT7gq%SxXJjc$t7#qFqS
z96gsMgOE>|!^drNu7|XVd#@IjQmMo(-1uob^iZwsUf$boWs8D(GdY+ck#h-)CuhSO
z@9E_o6oS?Dr8jvyV8qX|U&LJldgyKbZ6~yv%e&{BWMQv+#B$
zW8LBPw17$6=F(LSCdO73y*RJ?m0JK6^~N{_N>s$4Z%?W%tq{TCN)EVz5=9Hg;WOBJ
zI>~zyj#R{3!nKe^5a)0wCj!w$v~E*zm4}53FE|5NYWLjERe!8j=+uHUY(`*|FY0Fl
zuE2M>pdYHd|W2hKXftLQOqmn<6t-BN1-?>fNV3nd_P?+zk{DF#4k?#!+<|L82C<5zT~MQyRxy6WXB2#319um%M7Y;-rs
zoq9Ckq%J3X7CR^03nmR5I59O`xxn(|XGI((v{oCTfE}4rjKhENgrMSdEJBdOu64s7
zZcczk+L)Uh6J7o4j$wSvo5aZ0x++eO$}K)qzk^OuwsrSf+^^A;^QSsfC8mfAWIJ+j
z&*xWO(fUoEZ*VYNTY9TpabDtg_q5BjEBLpn=c#p0t^W2-l2&>zf2ab16O#|8O5Wj{
zr2M}xc6oMrRlP|7PSz8s^(RgJqy1qY{C#@cFtz{KW>VAR$tzQm+qGHy9NFB9g;tE_
zWM9rx>CbJSqJ)3Ro{*2Kq_O{*(FL2{5+HBpEqa9UvEhL(c9d1p`-f(k#iLt9yZ}!*
zJ+bD3Kr68+u}^8uvq&3iR0msqklewIEc{CVuJE~o`_wKSXIj}F9NdeV3;ew?u{=nF+HePmN29{p)(GN|wQVq;U9x)pXqDtPN$
zmdXHr?HAO+r=ru~IQo=5$y9nN`%Z5Ky58gT+FR{VljMZAmRU2`<$DoC&$arak?B4`
zl^`bBN`Rirz#T!}+Kp-$birCYk`XfU@n)5(hlNPUpJ{^BT;UdKrU5Y$PT^vRoS<;|
zv|lCy=IE+ZQnz%N%|Jsf06#!{L|)l0fj=VBEzAb1zkSX1YN_*yZ$3YTos-IVv=jR~
znuIYtoCND8BR04mF`rMLd>Fi9s&rjI2$1zrVLSffo-;*zG}Yfb?Z#TS_S(Cgd^e?R
z35@bCn8c`Dy1~4@Wd2oS;z1oL!I#KBe?j}&bymJ8MlwTExim`@?k(s$W_~C5jNy=J
zpn9g=q5v;3BNgac=o$_=ZS#3^Wa%Orad|>_xQRS@$cn;bxwG~ZZ&@d91E)9q>G+s`
zvV0arb1BW4!JciFB&H7OElgyOFM#QAcaq*=*<(UTvyka)0SI|DOcNGgK
z=zRpK#~=&%DWVkHjvUsm<%>(UCnCE(55!yy+WMk3;k4M*)o>%~(UVI}k655w4drra
zK?)Id%tjs2^9n;%t}uLQEI9v_OS#zY9w*|g>vOLcMd!CHymiK5_BHcSM&@_qU~um3
z+r^7Xy>Cq~ztJTqFray7E+=~3MF$zDZlKr`7NN3|P0{CEi8Of+g76OXa8KHGH(b4e
zA~^R<=`2{#D(%!%eLr-A{P@A@^xpUT^F+&u--erxtD|_7$e5e8shIu%cr+NSD;?*^
zBh}XQV-Q?3y6TemTwg4>+mSuSkD!xc9oY39=Q&hr3I4D=}@t)~n(^YrmvlLR+o
zrL||lMX%WI&)Zu`=-MUZ2|hx;^N-WRneaPT*Aq(8heQ8st|@<*hc(RfA5Jv6HWEa_
zOABCV+r05z`o+$jFluYndNOyZa?#*Uq#}Te@3-RN+;71XK7mvD^F}Ai=PfHPu
z*jgX77Ek+Ey7{2-QMFzp6OPwDv=uR4NW=pJ{Phd5K-!ri{{O_J^Oa9A<%~Q7A-N0`
zG5zHEBRR#uh<`QpYjX$7kRMRz^|VDal?%-5%t!E&0wi>;KTP95RiGS{iF4Qk*%3!G
zthx{KRFXbob4@TRWo{ySsGGPARSq>1UAtt>>1x9gGL_fy_m%Nor%#il_B!|ChQ=iW
z8tf%F-h$X6Pc$dlN?AHGic!+Zj%6y@0CggfXZVV!VZe3V)Ga4G$};48!Z0
zgddR;sY;=ykKoYMjM2(p=?o-ygFf#IVj?E4S*C31VL2J$XJ&^
zO&eE2yBuWxQu)Xsw7^A@l2Y=CMJqeL+L~dqwh2D-x5g|tDY&En$LJ-pUe0d%lHsGI
z*#d(`)k!jjY{j4YR5Uc=Nb{8vdrsyo2_Rd!9ZlRZFTNoiod#uLDt%4W9;1g8N2r?*(4v$Lp4cU>ryz02Kw_}z?*
ze3fg~hm|WcO2fuBfrOL8OSxZgzJq%-h%pyMcL%wGrnZncI)5x}E|r-12;c?jDm5(K
zjiX%gUu}V|Y?_|BI4}2Ch_#vB$hmj%2aIvSQ@^L}7P3~Fx+W-CD?P5?q`48$y2vP%
z6ZxORn32o4KYKn{^EhJDMZVeFPMy0mIPK#bp#3FTpoGVEQ@IGw7nqf^UOv!lAjQxlD}dbV`Ct%mm{
zItE3nihwdgKo7NO?58EUE{Sfrik8`@LF>%rkGi^`x>v~Gd8lA_;{}U+sDVx-W*;|iOlw?B8WWtuoPr`*e=tc&JmCE
z<~QPm%?4Y;Jda$9BVW!_QIxM0M7Nw*WY}Pck{1bt@-x@ZN^eC30&QEH))%hKe6d8n
zJ1_@@XE<`N)HYy7i6Cw3!?$iHr4{N4HDb1iZ`B8o9w$cy`Qx7A{zAQB>KyW)r#!##
z`l4Di#p_K1&94zpq&qLzP#VdM7#4}_9Ea-&iF$dAu^v~QIMHC2H--YG3PjD946)w5
z^S{Hs7BF-EyyLcz`=CXN#6Q*TBAwA8>TWSz3t(tt*=c+$p4bOX=PJg`#@yUIZ*$Wf
zH{7P)+cEla(lpiS=LP;bOpTRJ2wHs_s_a-=o3{;I4DtM7OI$bb@1Cyn%$x$60(D8T
zgf0E4z%8*4+)|Wjnrd2<_EQh}`2*?#gBO+?MiHMdh8^3vnZZEq*T&XvzOcsGgr08i
z!`h0FYPYEig!LADHy~d7XL@$x0NK6l
z?bZ2!XRVYFtZDCjI<30&{LlVt1k(y(;S;lo7Jd8;Cxlv-`#1N#Gc;RuGmo3YB|5{_
zy(z#pISM4z3|!7aE;S1a&U){RY>4$<@4@IzK4
zN;ZL_ST{{%kr$OBUONg)-on=mXtGV2HK&Pg`^Ht^w{VN;mhErlUZQZr*@SZ9Yi{;6
z`Om9Yatuxk_cK$aEd@^chZb_
ztE~m%tXM3EzF{OP*!XK%2=)qfknqeVD`etULhdSwHBxtuTClvNExl2yt+|tv%H~(7
zg2FaayS!E2%B6eDi04c*&I_LfMmDD@Hx=jGP)9-G&B)$D1%^gZcru^Qaz>@FAByFa
zzp|w)CiKdE&B32&2-q&tuQ3IhnI~kRZbJU#FmgV*$bw~Kf_jcP)x|MgbwdyyB!Rl6
z8J7{XuLSw8{JS{)xPm)UhG=!7ivOctJ<+KQq{
zmVUrIDWjx(G&%F`KN}?!n4H9Ia|JaM^6>3h4#m?MGq~SID)Q5(lZ51_SU7Fl><2xZYaY_4b_zEodCFXHE4Oa5uY=+pfhz1s-u5Hniy{1JXQlFce
z-;H+Ub!&r!JKWh!*3xFCr5(8dk!~qR@X29wC@l*8nOV%ariaUw4+=VSx3g$_ZIgCQ
zPX>^rEFaj>G3}X(%x2Ne$hLWjqg--5aksC6whctgsY#;s&0kM`_SReC^g0vRZS7D#
zedU6U>WOcf9)yYIGU+AW1dSqOgq)d2iKYwk@_Z!Sh
z9@t3>%1Sm&r}-xKvqLUo!4@<&bHdJh`{$nXo$J}m1!dUG%*?OnS(LThp6)?S&Ute2
zanYG($pxQuGKl@!syP&xYz&tzeoVxUN1k@!srF!fK*ajtcAaLgJubOt7%|4)hcu^k
z>4z=yCx+F_6aI>@b~{mrFeN2h^;8^ha}<@q!wT;*amILLs1{EdnKm7T&uKd#J)P}*
zJH7bQxXkhq-|+v5hU4)kRx6M3IaSFfh&}_Y-b$>-s@1b~aXbf??QQIxbF^Wl7$Aks|WG
z4?lN618&6=d>J#v0>&(NEfYb+O1?yZ
zYYklv_>k}7bS1NS9HOGXVO-3jk8e5@HCK#Z!Etv~-Sr?YXavllV1C3t*G&2?K>&;|
zd4Jj2iCz{#@tU3tu@VA6Oi_lxIX@qt>Fe$Q;*hj$xq@;P*N33&gfhs)H2vyVMR%z<
zUEZn>T>De1T0h!+nY3z#BX8P7X$AK&6cX!w4a+AQu5_N+JG2u&=9o(2>X}_eB4w+6
zW02^5tYcx};I4S{qU~}<&Gmt>wQG!?P^HOMTkye_Vx9Bsv~oBcQIqjTKM!D%2OG!E
zAs%ySaP)G$^dIBKPe-cd=XiQz0YpGb$YQ1^Q+y#AM&L4X^Vpu;c+
z{tjTc_bk&RTk}$=C3ahBLxz%LXY
z)z>iV5np7Vs)+CY^L+D_s#!3D>Mwde|TlkyWYw*ONd{X_QY$sCq@lPJMZz8E4c7TbXS#xu8{Gw
zVM&&40#lMSIzQ1NXtD^CInk?qI=VI+O~<99JI8M00dNLJhLSZk*+`Q&8;J($S{SC$
zusG&T5eB^C0=oZslBCS>p&_ru
zspE>bzS%;^4ffy1l#JdN>h}v4`r_K#BbDCJLOk60khpjRwwAbd7DM5#zE`rYSt)3GSSUU|
zJ^?}0-2*1RSo77k<%namv(hron{IsKc%Y0F_O1jim}%mouII;(0f>Syk8If&rY@9{
zyIb4)p`SWHm0KP#Z`HKpUu>njem^3GM7n~V`{K}ts59PBTEONC>SeQ3?n8@wT)qPZ
zEAF9~#ZD!@t!LLLe$zdFlw;KomukVzfxn{c64lDa4CyT+ETsug_hn?O{w
zNK71}UrgtO9~qdh^-K*J_+7-M8e|WTM@$Npfk34kxAoA4wo^*+Q&b5?{7g`Xd87R<
zb$P+e&U3_a7h%XeT=!wiIDVBpa2zsEkSz~6aJ>e~kFr%{tV--svqN2#ApL!~WuE8X
zf{1P;aX>3WCTi7|6&1rftq-Gpstqr#d@B89v^=%Lan|e#iuSOY>yYp2~uP!}^eT!z)3?|7|c&d@t3KA$Dle{j_>5LbVyNk_tuO8d&
z5Iq8?Odk{$*dKXISDimHB5(Iai(#MrE-&Holp$TT+8cTEuky)DiBi01iDaXgcNspqE$|`p%p5&apRsY!J~+LI!mllZ`+Q03gq>jVDau@`(mk`4t`FJb+O3=
zog+)jyg;`W!Y}sXr{NCgpPm|Y0!`w^5X#u`04^h9YtTYlXH3o}hA#9G(hSp=FY>@|
z6~y=dXfaPXJ_!4}C0+tkjWcBCyuF5?!?x^Z>sg(%8L9kX`0yb8#f~T)mn5jVN$zZ~
z_6Z3iyqk&EuwWu%i#JL)P^v8jqCx2qA=?+#_cmt9lZ0sDZ8bUtFXA1d@y$NAM)*rC
z0JK7h`eL1n1=HNDDv^UZ!lK`FGveM6AQIY4yV-=rJ27~827J;dIr%K3n6gb9ARna0
za`xEf`Mk1M8N3H@B27TG+kQ4WxbDsKV#_?`32&fhKMG+7iD&iK-a{pu4XW-j+v*<19%kJyQ>_3AT7)t+KtF~`0(CHF@&
zL>K&Xe0L|A`ZDT*IZCjk+$>j$`y^HTFi_Omr2_JA`*O4Z~vT*TBhhx$e^XF?c)Tyx@rhG4-Ukz;)rvvqeOBp=@Sl;-o
z9u?ED&Sev>Q{AUV$pvu54<}u}{BK=($;glk%7=AnO`(a6bmN98(75#zpY)5D65E90
zdnXZe$YWcBD=z@>@dR%xBU%3>D#W!Jfh6>L!;~ztjOD|C3HlH3aNyH5+P{S6dmDoa
z`|aM+r(f!nCh!SApahB4dUsvbdAY5y=1)5x#Jo_iy_>zv8K|)qm%Nnk1M8X{278aE
z>ysy_6OWGsF2_6q46~*-9b9(=&@V@LFLj&Ib58zLn|uo5h<>??Tj0zH?c_bwW4eyF
zT0rB4E?fn&`MMQJz?*3tEUslvU8D%Uvkyo9!cp5xJ*OAO5p;jvP_Tit
zW$*(=Qp8OjU^Bm7D-OP1N#K9P@vpuR;>n}u5V5s|>z^4a5dFc_#_@si>om?V0%ZG+EQzyIKJlW)Gf@tveP$6jAuqGF_|edaK9wy4l+|4^pJH|BQ-;
zrr7T37FV35!@Aw@OQV4aHTNDdb!A6rSAumCL(S%v;{}P)m9r4p%!;
zWa{qJO}EK@`&;o&MaR%nAL^*>k=YyT6U(8~<$kNjY(ss!^#jn+g;-;Z5?Y?Up?zJI
z?`L#Ar0$%z#P{uJTFw$uCimCj>FqG?iD$uwnF3GkUpQPuv%o<7Nx5q(-+!5Twgf||
z^p%yjCyc5)FhrH06%qKDN+Y{t4lh^@27a;|H9T=kF;-1IJ3w$@N$92CE-ln;AR?36
z^0W=bZ@diIy}X*~!qPTqsDQn)GUB~RB1qXo5NETqv-Ql9?{{Ggbh3Ibs<>)f8D=Bunx3Vh!G?$QbOY{as^d?HnZf
zTr*^(>5%-_SKF$Xwb-_sk-4Sn`}bv|J5ZdafX5q|{>uaUh~va?lWiyR@|Q
zl7InIkQG}vTPagQSM=eMgT82ll~_!6EBKh^wkpo7O5JL3g`18)3dB8GCE
zc@4QX3_|A9o^c71lGS4DUHhY&q3yvz$vp9Yx-�skAg$6R6@frsPfzfcqmMUT}(P
zHe!k(tEvihL5+M~`4eo1N-tDY)Vwlh^dPI*UGjwS$(s>qQuClm-9Uo~0=;Z>^!xw0
zEMCjUBr2U*HF!dN{4;2twv6DZN@HqzI$C7&e7XaaB_$>0S_pdHeIxiBp#PkURH)O!VcuXJIV(}|
z+3sH(=D*+WU7(o_Wb%zs!-OLvu^EDEKJt7SAi9V~lyDQdCVzo-npK}RIrV`-3FC#z
z$R_>)fVF;%OQKmTJv9|oLSmrSz+^YNeC#1mp`k%!{S)HTh)d6GiJG0kF3(ESxzhgg
zZPIKpxijMQ#ixHfP0^*H0T#wm+EqAWls>be+Ep3uKB}DT?Aule-*Aykp;;gR)PtlI
zq?0w;zaNFErE}nI=WQTof(ylXNrsnzCk!P^YGiW7idNj+o9m;oNJCn$`!{2Bv5Z|x
zdO@nHZdIVEuRs$6uQt1#2;P-dn@KdX@C)>CCyEO5tpBV0x2J3c-a1QTYu-H#+cVyBbXpw29Y
znBadtNUuT%Ta~{WyOS`bw4nTxASn6!{kWpOHl-$O|7|fE^k!x*}{Z5
z<6gk*0O()f3MiV5{#RPVg2e5O@xLqoyDQ#&eck;j9;6c;_#jmNSy2xzX@hJWsdz
zfk(v2A`=%`Z99B2U+`pi5x%vD#CiK;OMa&L_@YnG#y5k7CXK3hk^1=13Q
zwSnN>#BU4rU%&%_5){-_B<+eZ@4yiV!h9QX6|CuPAwPl#7`1(*ER+s4+f39WaOb!fo7?&h$R#e5;b4_`
zG=38@z}$b?d9~|gH-X$f(W-(No%#Gpndech#%r6^VR=IO>XM_O)DIalarV$t#{bRi
zgb_H=dB}Ao4OaS??BQiVFC5?ee#b31V`8%}C8oF)e>3;d1YU67jO&=J;~O?mXOX52
zpAami%-OB${-6;1A=qnuV&k%GiKZjy?;-QlP$gQ@NUKI^L9oi6D0ZP*J6j!A1c4@b
z`ZwVnTs5*kIB7*=_gKDOT~>3+poag%iQ!VEiQDF`3*B|}f=cBd|4JSTn!hLEcMo{F
zzl7xIejuIPO&Pn}ZxQm;ds$I+J^KUm@r&sXFR$y$h6k@BQYGKp{c6BS6t9pst-1c-
zGSq9`H~Chz@f`Ajp`<)`o}#U?T>`U+Mv;e1MjI^m6^*TEzlo$N#mDdT(2WbwMxZHR
z4Kp?sv)^jK(xKp_e!K1)o8pYpV2VYTDS+|Fv4g+uYhy(UhjL?R*C
zUa|xbH)mlkd@rE~d4t45pZA*T3(e|X<7@SQOs}<$>yFSR)0f!41XSHae#cZ;BATl!
zz7IaPyxBe{JEF25d@c8`xjWNq1+xoRt<3#Ju6bD#0Ir9Yd*%PxNl|d6;4i@azIo^P
zp2H|;<8Bru#HSjiEci8I;hRmKGUjghMH4b;u&bufz$$=_{Q#2Sf=aio^w+F7)h?w#
z`sJr@RcY*eOI0KD$z^N0dMc%dDCu=&T$yCq=j$l_@$ODwFO|r*}d}};-T3OKZ
zbL3cFs+P~Ox~{s>@E==
z-@H4&0wyK(>YI-6;M-3luBJM4o{j@+wVtsEO&mpz1}+QdPfYGaf&Tur6A$A}@7F;X
zzv63qnm!xZ(JrH>u202INc_D@+ni&(^GhxQG~XP6!xPJMWqPZdCHt$J)w6}=_<`>q
zi*8MZ6FyV*EvR#dujS`gyDh3)Jq`Uf@$9fPHkOo@7dFVgG0@jJ!Y{3)Y~;eLQX$of
zq>AsW#^2;)YqRGr@c(RY#2G99DauAe-_F8#zv4nsrn*i>hJkH-yXDUf
z_I5EyYRJG|37-W)R&KkORk=36kw_sA=4yXYq)4hd-mg8~b9?qTO~W6}FU%EeLAbNg
zJ&G;jVjEcFW}FNr<$RLz#*25HArY4nm?#wO2%%M>IPZ!5S={jHW)rYSWVu1ghR*BD
zk_{k(X&8JNm$f-%g&3!(*N&3;qy00jz2aI!OhklCVaPdORqD^5A(@$<;DW`4wM!F!
z5e1(Os`rWolF`b(5DW~6p4;i`U#RQ`8RrjLQ&lkcNOg>2ZU}kGeowtI$@um2$7F~p
zB~|Z5`(TpmUpbW**`kH!3yzi3$4plNLMm!PWuy0V{K#L+l=3Dk4?P?6A0Pz{OL+xJ
zG6<}o54v%{vg37zfnsH#I%{JyR?I4o%X_q4U_f{{O7ZMr
zh$0%1-QJkQ8s}jx#sf!DVD`8Xz-a>UNT4=qfWRk1**0dpL^fIcOj{8qCt-ExTpFSP
zx}8j*J=P{VrXlqgxiBV~kd47Iy0hCo;R(ZQIQ8c*w)hFc#4T@g=V6yJml(`22Gm#k
z>C}&|yU9vP{mfwV6Y0ztW{dYLJLI=rf?y+aY0?1}-5c(coc}ONOEnZJf~h3mo%QPE
zo%+7Yc&GP;tM#-qhEI7dk&#TOrsy6O6D>#_LNP
z(d&KruH7h^QTVUJC)rkqe6GGmwaQ-!Vhu_?Cn#J~;R>a+%tHkbzS`uCO-O%Q8
zX&=M|vb016x6Io?F1Xv7b38nQX8YX2x|cRn)iHbd$g5JVNl6s-b(d&{n~1Te>jK5G
zT{ipEo8CMHwNjzU*Z$>uxOD<
z9*eAf;*QisE!GoJz4U3Kru_*3i~XhX#!A_<<~SXT%FMp*M@>6P6e7KqRExC-i}8?N
zFJh~x^`j>~r!_l*vsDBSf1+=mGOX_D*H~-+$x<_$2%s}AY57Tza?^u)wIRFvwRPXF
ztCs(A+Qz2bZTsN3yS3iTcZ@xTc1>Rb!Psy!IY);;D$N>)3DdrkVQ0F-DV8
zNJMsTZun1CPB7$&B*N^RXu#0Z=M_!Aq+s6JK@2D<-$0!|Ld9t)bo5^4K!x;d)nqJb
z8AhaZg*CEZs|U_^hV7LN(ix+F6Q!PRD;@K!Srce<;(N>7-B1&9am0>#!uHg_iUS17
zB}c7LPpxEwQD5&*uQ?^vc5RKViA20SnfNWMD#4x|oCUW~(fShrJmv@klXUY|b#gMn
z$!bfY(NIF5;t~9=b;}vE8ix3yOviU}9B`h6e
znDxlR;G%&O(C#=lm*);L1D`P&tx~(_Q=SQ}JWw!b^>XRYco+O$hapV@Q<^_yV9P~k
zM!t*`=~C#>?xa(ILA?@Bfdts&hkK1#rfo$+U=}E15~Y8Vs>4;AN33eYP44nucu<$=
zO(@cSg%XoaIR_T7LrpURLE+>+TOGyCC$erUG<8EmVntZd%o5I_eXytSeJ7
z&(?5jHfG2`l}cR5-2EvHL}SAY3UGbcLd6Tpr@AoMnX{5k`S%h0LN`yowm7zu!KN^(
zil=9jfw~+ESM4o|0h5zHbRr-v8kY$JL=?onDm?B;RhI@P(U=f*9O%Wm*34H4bBC*z*ep7#$z6ALl7QT*q)
zImq6k=pfLZifNdbAivN=n1<)$y2;g|2NGgSVn9|F`>6RuPrRAswnXOlL=D%6o_Akj
zqAZU7ganW~*g9&mt=)24SO@o<&3^E9bA^^Yzhwrfr&Cz;c(3@e%SmT_ono2u`a^(uSvAgHv?R@Am6Y)
zbst1IymjFy%Tbz7K~A)Y$KP&f7b#3VU*Xd&J=BKTRst!1Y<0Z#xOppJ-o*dJ7INot_xf`^j)QG
z*OW+XBrBmdW{RZU)1J5@*kYgRt2s>DRkI%ZQ7beu;Bl(SQiyBiX~FG#(CK_!`0#xq#@mjz
zVMp9`dou_RFQH5OIyHp|=UvZHUnMgO5gU)%%TqXFU{N0S0efwi@~hsyS(l_cAm^F&
zt=x2lu78=0UI^UmPi-OJipwc^;+_)f0vU?%ANx8!txs$`;|fu%+X
zR8~@Q9si!Di{ll6Pk+Ebz_?_7P!itvlH4bncJDk5H&dj;rlX{B1=ws=mxTuXbJ9~3
zPid@UmrPy-P?3-n%>$k|{CAmq!8M4TBbg1*!bO95D5it=cg@aNE#@paLQ^kSstTjD
z8V%A)i|#Eksap4lSM;2qt6*JNneVxOx}%ccF>n&k?JP0JPzFSIlw<^}3AO24xbp8j
zTgf)1VL<3ARpFeUXgj)=90#>alLQd-tA-@yqym;l+3^Ky`A>O$^wW%{bx+*Z+=;KZUPC^s7N##=+cASL|#0n
z6YuZ-e5lWm7w+?$2Ey}f%>E|D#P1T&$BGotsn!(KC~;^I!e{p`x`LJP-wMEI(0KBP
zqE5`W#)1GA6X))-e|T%tpWf(r%)@uv+l=Cxk$+{AG1L1
zDG6@*EkG>tw^+k)O@~zpP4cAaJ2_>mtqz0)RNzzmY|ZAc)U`p~TSj?)yo#$=(lN(4
zny0a%ucQRXxLMqBIBYIhS}UrND)cU>uBuj$GL9eGq-d8MNMB$(`?KELV`zsFzcv3v
z1%Rm_&*%h()d(n#dx&owSLvP|Om;fj9g?fudp3ypD@x;-{Oi~n)2r>l;;SpmP~%CqTr#X9+X
zP2`hjn2IS_(Zm{LDW(-5xr=iRj4DC7+*(5$H9h^w1T1~!S-Yiu!L~2jEIn!@?0@|G
zpLvx#I)#lfHFC0}VktpscACO{EGmj^&F=6xg?Wbp{^}Z_-QC@DcY$X~_>nHYlEv|G
zR`A&_9umUcYxnyBC!3Kb&uDYOKmZVYqTPA|g>O|=PxznbAe{eLy1(3=$`pE=Cl;bw
zc!gq_S%G-_8*i%2L5oWI?+=G+1cMzJK40ID%0^DrsrhI(x^gpa&|y_a@CeZ_F}N{6
z5!>yfA$H!Rt+@yle!4|NP!;uO$&aU1*LC@iV2gR1&EoG#rBOWwr3zQ!^_s?Bmh{#G
zCKcM{+T0Kc&_9D~0dF4MmwKzz8`NhA=5R$x>B;p=qQaY*c(t^)KC4I2fG@dlAlEDK
zVdM?5^$UxO`Nt))@z!e-m})ZNCFKOG4u)2W3$Auruk|Aaf7c2A^&r3~j
zooAh#GTd8D!x_UvxgJ^hRp)iug%eM-4bWB9@TQpSODpY~)l|cIdLDYUQJ0nM|E1~w
zN7400j2Sf2b*90pu%t)Mk)LFR(!}fini&tM6VM5MwnIT6nnnsKE>KEIqca2-Tv82Q5{PAKF`uZkY8aqlvdUcXofZcF%p%f
z%zy`o6N9cD8-{=X#)g`!jzsZ;p~#S#eA_$3+MbQ3OKu1x!{#RGS4L`wwfT
zJ2z}VH=m!HfIGKy%qB=hW(;1MYN8p!%$DwB1T4;i{epYUwxZ@ib6V$6Rbs!LQ9iCgqJJILh;bcbuDmU
z7vXOC5Z4sIh|VYt23SB3nR~m-lP0S;+V0rhG)O+)C{&U0;}hzSJx-;9?L;Ci4KRME
zptCq)=?UH5W?JER-mv(4M*Gji9b=rg0tWMY($a^gHjn^CSFDsmsKWZ6|N9+T2i^#M
zSO9&`lHVXN@&U(kFjb(&TKudA;LDdSuLCbQyNJ=KycQhL%yB7{68mi)9{TM-tl4Q~
zO{vhAYI^HaQaK}KM1)(DqC&oaF%!;Q`@+cFmLsYBU~wSlE$Y
zusvn`MS!3A)mM|n)=`WB{j9IN<8_=x&Ay5!*_pw)eBO)#gMw0M!b1au3v%Crmw7}$N;JS$$
z@T*7_=@LG|>m_KhwwSLH_)^Y+K&;RmmNk|~no2U4dZX%|tw@td((139UG4b#p@;=n
zYMMFuacOGWYQE>}^Kx`?Y6vwujux(5+zsc~x)+(~QcwM@lb1Zejx0IuP4R@!f>y=d
zc6dO0X~!-#=?o_s4NF7MfGPvG-NE0V5ao(2-MEg5Am>NLMLZv!IY@
z9Z}b(GG;lllzdFH1JY7eht=R$_2L7F&(x4VKnY>D$y-rOps1{GUBjNsPDcQe+soL*
z$V$sL1b627%)YbxJN*21SPs}5j)V~WR>UGGdPblEzjPG!J>7Mw?QQ?0bfB$Lv;SI0
zM^M}knZY3RCv?L3CfH&4V-ZtI89bRsV!p^_3snk5o`JYR1+JH3o-mxjpdZSD2E#+U
z(*i|FRxWUJ&*&F9tZF;xT{E#CiGEGNfg7U4V$%om2$TJ2JX*58M@dV5|5?6IDc18m
zh)JZsy=Pa57q(Z=O=6P^DJ?0*2+yb2PcGnc|Crhr-vDS8oO&gw_bv__9(QgntM`$`
zc(PUVFDjFU++UCsegU!ZtyPnbS{;$7eDt61P!fmL(!>#}xj&IayX~ru>U&?m@0oi-menx?W(G7M
zINniG+rDxf$+j`GE0HJm?!Lq@wlIxkl)QjrW6b)rYw=P4~v92b8%X@_&!;Xdfhgs!)bOsWsHk^Nykh
zYDWdY8{xDqBheInz$z$|KC*9i;J{l|Z6Z-a#|3J(!-MiXN$LIeCcZSa+R1x8)iz?T
zwYQ8kEaS3oo@+O48Bw4{jGo;&z0ushkeDK(#^-*f1wRs{fzRAaSf=Ve*x(iMe6Tpg
z2b~YGtd0L7=4mL5%CYH*CL#{VsfwSz3EgWS
zNq`se)5_M#2FsRi(1?I4z?;r&6)JJ
ziV_@_OTV=(Uxz_KY@%a?>MwG!KSS!Rma`Qr7R@rM_17|VLyb1nCdBDhUrhVB^kjF)3aG3vWvIw%Q2^i=m?S8{#3cEF
za=C0U8>t6}_>gH|cQO1%0}{pl9{*!`ZS`D%0=BHS2d2I+-nW{0SJa~;Kb%C+pDGh>
zO~=E|fl<1HfS+l2JzZI-LD$7SAmKh%?l?`#Cr|Rpa$~1BX5DnW^$!xF7N<0f*jlJ0
z?8rIl1l*`Q(p3UMVmI^qd#Hzr$yfI
zS;2`4;hl=1;^z`&ll*O?>`q>aY;UE}O
zDYkjOBkAMsPMhZc##1wr;Iv>=(+g2Q_DUpjz(-#^q$?9FWdpl@gI
zck~8(QM@Fg0bKZ{N#=5>IvCG}=-o~j1RtMTwRgZ_
zIFU>^vYG+8KsBjdrqea>o-V^_wsuF?LX@a2SAyT^7jMLWAIa6>V!GS2{`cCI3=KETv&@!A)Jl_LhqtvM8+&J;+Qt)7vr{6;Suo;~
z^lQHfP_e%x&lR!~|1=oe#){nT9U?K@j2nd;)R_B_DbKkd>Roe%kLhU?dBqhg<34H{
zbTpTMUwOcA3Py8(JMeMURVOjNj30`M2nyRK*3X<54IPe>KZ<~bN6u`%QaAoHgNw8o
z{^omkTY1;uC~|punZAv6L`M3wJ;8rgI#MVMM2=Ed11Q^uUb8Sfq}8OGpC*#li{ns}
zM2i}JSkJaxJiuZg$R5LG?3K-8pz9=SNidhl)Re0A@b-4G#zZ5*^Zw%84s$>}(|px>
zq0)=Do;f27w4q-{yVmbfV`SFiEz`-c%J=)qG!>JMMpZKAbezAmdI7&6CN`bSzi8
zyWh>QJNx78X!V7Eb>Qc3N^t{>7Bp$@-Sa~fc814##(qxH$SnHRxWQeWdm|D$ZXUfc
z<_^8nHI>Rr!ictAPTDq~73Lg=9N}wuF83>1?}vSwtK$}({h?ps4(O%Hb*Lsx!z0O_
za<>(N;&n~QWf_*}1>M{m1UQj7!RVQvkT-rfj*l!4O6_5Q-`bt%e3B=+?kXeZuX0cJ
zq_U$ZNnLnlMQ}MK5wqQrkgb5WpJIg$VNu&3%p71vnnUcfiy@ju+>yJWpmuLEQ3N<>
zT>oM$GST$HjPb~xSAQgnH+nt%o^|$@W)Eb{G+VFOckJRd!fY+wm`FmhL3Sn?h$&f7E{r$!$fi7HI^N;jx
z9n1>K>9*5HNVUtGDB|nBdzEVzmt)K(|MwTyi}RgDV#m=fWl#MHOB;P&nA0E}ST8TT
z4L@es3}T7!&GM(vhrP9o80>93^#@J?nrB3(My-~)tm#rrPqTcS5<>lP?R)O?^P3a=
zMJxDylwofF5YRI0P-iPv(*RtU2@9
zzqw%$IFy-JV
zy~}MK|!oHh^&
z!}}_?6pk3}$}w2fy>(LT64Q>s3Mge_PZJ1S%f4R8vmF~R(Y|TU!F)b}vG406TjL`2
z%o98*p~t&c-Q&P{)~@aN&S=aa`nJ6}7%9Je1%YsT*z~uyQKeOwv)Ae-ntP7Vb9U?6
z_%W-u#yXz9zW&p0gR_+lNd=FdK=X)k
zu`DYK0I*T{TjN25R=Y2-qGU{+8&5)(p@o$n_2}1DkHbTz0;y_01r-44VqO}Se;56`
zxp`1!9CcXeL=wlw>wDSA7&)_30dM$;iPO%FWUFrlp_2Vi&Cx$ZKMW_oJtYMSHMTMK
zW5i5MSj`HxwmJuQ#8lPlSjQEv!D-14sWAq7y1t9;U)`|GIJdtgqYt91i_nx;Z3|Vb
zWJg6?ql+v}bJ0Y-ZPRkCUZ{H3
zY;CS4Ir_LUzdVrn0_*nqljyy{U1n6__aTC&ky#0+nT7`E
z_s{C=5OrfIUGcPB9IZK;o5aibrS2O%r>Th$4tmrSH7GcnDWs~|4$!cm7BQ73xVrLx
z4ykA?@~!#6punE5x)>(~%-Mg@(LYGKH6R8BB1m=^F6AjVCbg0gU{Y#UB#>o8O#P
z;61r0bQc*ajR2ND=iQaU_9=|vRo(jx=xDZ^BL+uw_3*sS7O`CYLGF^W2`@0gYku+1
zu%hN$B@>I)_&TREJvn)0EP1{p=B20-7UxmmTzP#jBA&(HtsTA}Ko-Xm}~IA=NSR+6O5m?5&+0P(Q+3@ZGJ+Y&Z0vxmV4I>=dqk
z29RxPeQ@2QXoK!&!F)Su=h_au$B~?5Oji`ui@R!?nkNc=lclw9algz-oZLgZ2WEbW
z5_o}AF0yfjz?wE}As@t#zwK${w5|OZ;qq(b>m=a^OEzK{PUlPR(aQwUhzWu^@J!@S85O?jr6|W17EzvbDTH
zamVc+F+(q$?2r^QSX!kpzi3nwEXr-`eixx6-&e!q($%HA
zoNn0Tr6yzn!WmsLE9bjjV8Oy90B?aY7`h!VNFuHt(aK^byQS6Je~>4`U_wnjN(#}6
z>kWPwne6{Cs8WiB%6uf2)SsG>l9q;s8aZ}{%w07!R5=X%a0nh1IjfHyRLMoJ*3kje
zGjEp!D92*IC%!#I5jZ^pynAXP%v-iK8To2x(V9Gv=QB2K$J(*kxI74@g`44SDlN3=
ze{5~9!~_$GcduMcJVN_kOS&)G;|`p3q2qT5wTOFGykJkdOk?$4((HV1wS7fDMWM4%
zl~R~S2oXVkbxBR1SLm61ZjpIH(upe}>^FG9Fu6ZWEO$@^4FoARnk=Q!BqVosDhyih
zz7Y|5yCP7JO6s){G&@W2c9
zbZS`(*0;@~r!_Gd^I1g3wFzp?VKO)j$iH|af+Cxy1Q%$(+qYM7)NHP`P_G`TpcS{xHF^md9fCIn&f>zO>_}u`ZQCvNB)X^!rV*;b
zqhy;Vjy0aX^6UM4t9F_;kb8rZMblRnmf$P#r=rXi`ReJOu$C!CtND2mpznj~7j>P;
zYgwG>qU<9u55C=s{xfY&ZL9(oQe>mpa$psmU%Wlv8ZFk98^#uX>EMxF`r&%|CJ+Am
z=_@gH+*62f(8Hik=ZELSww`chlr8z1Cww**!lTRG9)|mt+v(c79rAt*>DRu>I`_!V
zmO4muT((davJPhJE!5*@9XAcVTTMh(VN0Dw(SVya`yUtIlJYJn<~k2V5tDF613w-o
z=BReTN`o0DnlkkCKJh0ke)us`*jBg+b$*yOc>o8d1*l@^)tFw=&`TUiOaE4}w{*X*
zf0ZYxS&0#sVqr5=yAR`IT&8nM*HgXOureAs%VSJPh@-l1HuW^7)bA8p_#~N=V^Xt~q@i4CP
zg)o4hJCv{^)1a`LPoMbDs?e5;WMZR=eFJ%ZN~w`m%+q$L!P}!Bsqo>EXQ^}*r_Jw37QCGQF_US6^{!={%=bXqXft8A$6l?
zL%TWvMLoIMNIgS7(9cg1tc-U~^`kW8-i_a?^$W(U0(qZ$YC(kCG=ZcP<{^8HgMmX8
zd**eX!YZ2
zyBk1=&qQuF$&ly)DG5cKUAzUvz~GrHR-kC$#aB
z2&_7^Wn#<<4nSOIUJklHNdZT03>mx?>Et5((vREPxj^*MOGH4PA%*M)$EiNUQFIL#
zP>-Xob<{IJ=Vf52*{wl9@y$Nj(`yP?sND%yKGysfOKxv6myRf$LrhPW{8U~lLi~^w
zeyUK#Wo^A(g-si2Q)mB6x%!)WT*kNr=~mL=-8%6!x5W6)`Rm_%)FJrQ@SlCtrME`X
zGzDQ=1OxxteEY;xbCcB9*YB~?#0FUX;a+RlF@I;XQ>28Uf}(Npkio=`&ZtwonOH!Y
zd0)f^tNY}ag?&q(*8IiQ){^3=%s$I%{pIPr#VMR;!Q(J?`t|mF?+TgWZaaN?S|nba
zF?zLI((G@@^5A^W&k6(tgjOc3+5_^RwG8?rl}QU>+2O}IT3l>el+E&@-IL*x_^!yI
zZ&%%<@LjQxM8+wyuBA>0_
zn3ZJj)jl(wX!8a_kFJo>$bmbvB;w+_3}3?{!M!a*xDUi3goz4gFDQxS*+6GEU7en^
zaf612>2Iz?%RjX12x-eICN6cjmc9&?)Ox41m{eRWOTHuPZ%RFLo>hnIqlf9ciqe^C
z^We^dk0bmOv{6SCHf+)nz_suTSbL1o%+A9al8h}N!fLS;QJNLHAUg6H2F&bs#r7Wg6qlVG>mAR;#ns}s
zkZZQ1Edfxe5{J~bPhS|*&3N?f`K>kso)b7oYtR=-83qa_Me!5q!X?rh;@T&)oLzW#
z(3Aecm5%ORzU{B2&#m<}tw0$xvI%9)lacAz!^LM^*V%XTPtBvtaoJ9#Rb7KM=7@5|
z`gD866oa_CMK>={LChqz?9`)aa6Bflr_}KAV{Jxg2#rMa?{V1e;dp=FEUNyBHrmrq
zcCYQsmZh@avRglw5{K&@7S7$hOzT`(Yop8(HoWa7?FLp}k)vM8NWEs(WX)DO@gby2oETV5kq5J1Nuv%ownEc7HuO^qn4son
zz18bm=>WIT`1#@->kE-Qv{VACQ0PNX$Cw!#iye_S@I^v`VkY?{YT?Yw){N&J`|)U&
zn)gT28XH+P^%TNPM>h)fh3(#Y-YmZHEvH(M@zia71A{ElAMC5Yy2w)mhU2FEoo@KJ
zPCpj_N7RaZ8(e)4wnuV&UfWIi%?QvfNqsMrc*S;M3dF{I)$JbWE~LR8$xStmUyc|f
zzE!rO$(9kF9RmcXDB5U?djC6xE3?&^BN_Tg6BOuK%@Q!=CpZ9nC=fixNt5@M
zbDirtlZE5YUV5A}>ymJxfx+Th@T#}Fe;xjpVFJ|s$pH|HEg7mACrVk5QHG`{4fZo>*TrWx3SdBM<4_^2d*@=G?U|GISVHGY#49@>%7=ko
z4I4_;Sh~e0gtxp1C;IRsB9wK8h%5kf&R}ZsHALXou%vfhd6AJ?(z0#{#i!r!0f6uK
zm1&EoX(}5qikHMg=c^?6!7OT-^a8g;wPl7$?>qHZI7|jw_F+2IqoFgC*bszI`I&{|
z)y+C7aPf&Z&vM&!pqr^t{)=0woRi~Ksocj)-SF#(kH6{XoG5ON!e4*1Kr{Z>!9c$v
zfLE2mGH@eX9oYAC*8!Xj)e!|C12lP_Ld@A1-
z?>XpsyBpkp#l(+J4!eGOvEY9KQ^v!K4Je>icwYCSX(f-A-tE9^LZEcba+}`d1B=R^h#{#KV)Un2Fm?T1CdQ67!)qqWrakh2=FF9;o3fth=0~k)T$*D%
zr&EjI3inRqr2`|k2U}%HL;E)P;BQXTmph|5bk7q?KgWH2n(^SBDG%?GduF)C35>D8v{*AKxZWZ~`XBGB4X}RcKX4JQ}8m$ApW-OV~wc~ai
zNqI{Qtlz|K>51i@<&e7==Pd!0^g|TH1FIN6?2yxi{FGXW8`AORxn9X5M)Af2&uhwV
zbRjl}(l!BGdYFbJz?*aqC(&4!Rr%n#xwW`S(?_bPHlzIY!&`0L`tzse_#3YZqa5`8
zqook1B4FSQkxIXqtgf_v*G0cP&&v%vKfcBl!N-^v#*o>WseK9C!>lk6XJ(S4PNUM)o*P(u>@HwBQ-m#)-CU3#h1t)A6>
z#cW;vbjlpudDVfPdPO|?>7|$iUYBG|NXxy{PHQVR@`u%k-v=sYZ^Y|maH5zhQw3t!
z=JaKDnL_-wRj>Ko6Ms05Ey;F@W2?K8m-YHT@ecIeO{Xb+-pHn?!>=unrOWyKm+>N~
zN6XlZ=K+9O2X(kCDW;xH7VjWJilfafTX^r0hUFNw^&}3vbE6Al_hgU{;C?J_YuPq#Mn=3f<$)@I-S
ziirmLwlD?V@^OhbQsz)#bq*qnS4CW?IIC_6HL>ukdM;CvZI>P1xz6Zv2qd3X;}9^|
ztWmx=Svtl04H0>U(H)~$es*OZty0uGv!3{d`AEo5bv2Ih)>(3&hjTEK0ogcuKuY{>
zO>vvPPdgvsSSQ=wBBNI(x~ZJ$V+E-tHV?x&Va1YezIp;;$^6mdM6xoJKAkiRhmW0l
zzGLoER2lg(rflq%@|UdV%aH&jdZyQsQSrMw(yRZ*{ZwA>9K{wNCzbbWo!JP^*cMLu
zwTF$oddi3`^spI*!+YTL(e2T9tmN*o9Wr^u_Bu$A*?|muGva#Y`nOxc+}hRNsi}u&
z(|d7iqdzGbsJ1dtUFPToxw1sQbdnb5jy9!Ccgbs2w?`dm%lRFafQOl1%x{wgz{;oQ
zqhA87N8v=o3q$n_9pe}}BekBIGr9)!8{?2domYd3fvyR7lBqdQ%t=*c{#5RD3ro8~lT$uNTuX3b5&8rrmdQJPW8lQslu<
zhYbbs0T;Wmawu+VA!YjL&L)hs$y&7Q(kAyYA2zz|aV*^1P@fY0R
z#QT|zU+v$xEeXCK2+ZJn^|io_cg7s2G(@$#q?5ywh5&hkrYck8A2>-;GMV@L#}Nj!
z)c6Gr@3pfcvLV&QUjK$Cp46iU{}4XUQF?|CUOUz;;uH5%{&`HS$~x`MnK5WnC~e7=
zaBb$=4K*R(IXx3poZJt}Zs5$*=8rOIW%+O$4tF|Qw*tl79?!Au%vIEk{YR=rOj$n>eyc|6zTCq)BPzrEYa(^kZVNV64=_ZvbQ873u2{1Q=bY_`$}xv7<))87O0bgkv_7#H%*bEW(m}ni^XVYQ
z!F@JIBI01_3G5k@8CdgyFsAz(8ID7_+{qi9}P4QK{mKYo_0w3L(LTXI=>jJ<;8yDkNz@uWHJ0
ztgbZnhu;8z4VbsEVs%?Z>a-b~__E1uEv@q4U^JhJL>kOCJb&!U)nO|;VpdO=d@o1K
zMqFqz11egF{X-~r8l!>ZvOBnD5!lm7*G_Vyw|Nj@)h(OzUIF7yx0AY^%fWSR1>*Ok
zo@_{&^|`kjSg1jlA=T(%N%I|El-`0N*p0#G2*nceG|Jt6NP#tbN_qVv4?Cytcy5v+
zYU-V{bMGU~)CE!qFLp4m#95AX0iOKA)T7Vbd8UcQ31_;TlGuEpl$vgM#$+xcgehZO
zbPqwwH%}P+sfzC`7qPd!BB49eT#4#q`EO3w`T{W@O7xk@LeB_kqw=S7MeSxkkQFSQ
znG`bFnWTky`?Beq|1^OCXFR$RB1xCt?23pnsy-#_hx%n~%4>MwSsjeG?uOJ}80(W!
zGiOvWwUueo9Sks4t~C7r3kYev4Z3ao?~?RiWgvVM2-Ld8pv>7vODA%w2L0=SdL%#n
zWjdE$J}|6zXX3I+C5x`M?9grwLeEh>fFnMN%K;hR58d>yO3EFzJCM?37FJuV>FPOj
zlFBZ=J4Zo5S7Q)ka=^CcHK!DX>%1
zEphu?GJvV*iHkjOyIY;9T1GjtW)m{j&G!FDvc}2}!3k>3iz&bk(L0v?M&D{t;&~ih
zd_}_5CNp>5-#qz5iA}tu6xfSlMJ-$b*2St3IsXDCchc9^3RwT$%)wTgsLW=L>4A#q
zadd_8oP!mNrg&;?#a4@f5TJ=Ur}EU~YUf9XLoAP4B99z_8dLX!)av!H4S*?y~u%Nw!
zoKz~#og52g`M``6Llgbn6rY#*=DVb~oPN{S==~Bk@z%mqH*KQ#4?N!=qBJ4GN!#n-
zzIlV9*Jr;gJOl65z7uWdNU+Fu%#gHI{%2FaC#XgNeC>Ci&HY+KORo^JhFk*{g0hRl
zxpDS^7SqoZF<*-DVWOAw979L}35Nx#E5xVaA~}u`jHlb7F7|hSa65UGe>=Ba->_Ox%)5oEqOu+take!2~f}I`KPLd}2x{H;-}b
zC-&*<&&5R}Ou`T0L~Pm%5lW+L+PU?b3yY`^75>|RPKQ>=JF8z8+@CZQmoFV!x2Lg1
zPX`VTjO)|H4hDhgg0l1aiAWLKIqFOae9Ji2SwZ}5Eo+?9k8N?CK;lQ6buD)k%I3zb|9F|avBD1%FTXRn9&oYr$X6tTg4$QQ)j()*e55p|
zxLE|g4OcWU`X&Oi2I(HAAu}i?!{`HwNen*;_^Gc9mIUtf?Xe;$vpZF~>k^(yOV4ye
zD+Cb{()^Q=rz6tJ8L=&SfP_;5q?fXzP097e4v*yy28VG+VMiqrlN>epKQll$sUNlO
zG)H=6n)|lC_1I%TwK+3avZjfr)JEwEi(Q-wwRk?pINHzV77~eg>?Ysc{?x7!-)!@S
zp?b?A$U`JMu|1S?iQ4&;5TTjX5Qc2p@;wzE(N3?LODseV2sI3#{stn0I`BA=wrA8C
z>`d{`L+R_iG>ECnx8RNhddv!v?ECx{$~R9{k6J3npKuqm8_=rT&8f&gy^;o8@O4E%
z4!591GfN4i&libL(Bzm>&*^>pMomUu{yT#izX-)fcy7riGQv1iaZMvL`-U~yUR8u3
zeuc?)zp|MI7ms;QaIGL9p_%+kBkdt;Ai4+k-W9v7mI2T~q&w;6U|4Q-gZGc|iS+Pu
zyuzTNggV!<(j${Ct50!YBbW|{in>X8L1FLfXW-dgGCla*TYN;CG1FdRh_{Gc#J&gE
zFGn@FOja9Vuno9@g8ep{4#Q{UXp}lHD9^7uh=%jucJp_Fn^bP5yi~h}C+gv|Hv#`F
z9@N)e>Ohzdyco4)a!YJAvvMmpn{)0m?D|3
zh6xY}R|A3%^4I?zwE!6pwncz8qXV0sVy_Ov8wz4aMOsZ>J?1#BFpE*_Dup@ya0r?<
zv0~d?HCLEn{Of$=ITw-bzFSd+piCN1`gc!k_V?Q;*s`?v?KUY=>@bRDJ4#SBJu@$f
zV4xbLBP!>Y)&AddSGjnmAD;^{SDe8Y&}Q;J+@`aY?7kdct^G<)Im}6TNV5r7jqN`uHkizQYTm8l-w{U8-p?VCznn;w*?ZJ$d`4Lh
ztZga#5yH~J^L87gW6|MkZ7RaAdnR8?3O?u$%dJ$5>IHiRO`NnpZtKs=i(uW|
z-`UA^qEb219OyNJQ$Wr#x9m^0e$eLp4fZ5W8
z{1)QBhOIvgE
zkJbPLqxM;Ou+~ZQ*|>ag`fz*Xr_tQ529?F=^4CPOwdWUo=y5&KhLXPQ9T$C(D$`J{
z%PP!%V7(^^KUccKt!uo!*webpq1XB_=nc1N`mSgWI}8RJO33{Tn|j6FQ!+~^
z((koe6a6(Ce%4fWOVg12jfRo$b-H3oU%kA1M7?s!UT2DK9)NdNQARSM0=>dT8Qk!6
zJYkJ@R7GZhqxQE?$HH%2bLeP!Eqg`rP`kzsrA+#bH8uDyDSUIAcBo&gL&Du&ghV*e
zdi?f1xM*ZJ&as?zjfKm1>8}&GShi@A1gN*j-)l}p3NcwlUh>LTPNjr{jvTCullJ*D
zmQVqQEVvM0tBMc-zyMXS)XN+&(10jB6(RWB|z)-^$fe%gt?jI7~n~1N%6;aS9!urjwgi*}7!={-gF2qu9{|!mb9$^zr;B(HkDa#~K-Af$x--
z*Wav&OE-B2u%RSO@<=_<@)}D!Ag$d`v3vrYnz~n}PqPC77xxduulM|PGrn*IXB4U^
zm;ehp%8hk;HI>jnU6U;d9ThVs#BN4BU5|(+OAYK=8}7pBqwLZGqrc`S?LPSok2uXs
zDjL>0lib0A*50U{&8CM4WuVmEiY^Mm?`Re!{)>MmZ;o~ccA6s;`!wFpN_?_AtYVIg
zY;+;w%PQ5E4cxOe>1?9O@&#ktrCk(22HfDKo+XfZpWrIb;)_=(4~*FB!;YS^OecK8f^g~;l0+96Z~xZ
z4!b5#oP%FLnmlh#|I65r8)3<}>r>|^h!T)1de_W7#+f?>l5P4UZ+>avD9zahmta?H
zy;ocQ*OF)aite-M_h`t2Gmy
zOUvxvMO|?(af%R*F9e+@;a5tZ7v+8npVb6-V6g)_wG7Xb_k;GfAcL%Bwd`~%+cKHD
zOk0o%-C)#Gc3RD#6|PP93?t(T0M<{xVeB&^cT9cPCP`^Mw@KS|ekThx_;~$HmgK4I
zI=$YgMISa^)j6@5(`|(>(ksV)_EUwFD1#UI+?ThGk|D8jJ_n?l!~%1wpM;wiTJ_&R
zbx&{~VQ_cE_8Z`;b%EF7UwR!GNWQqdJgmw%El%6fKT_is8ze5%g>Yvk#_>^
zsaAJho6MMsxpZrFkSZEkbrlOA6
z+4;1c%V>d;1f|#q(#z-fp%b!o>LrWnl;TxS47`+Of}narjBnOPUQX;U;2>{$$4aTh
zEG|(XOuKY$<8O}l&DCWDklQ5><^6g5X9Ub0NX-yV9Rm#2QZ=;s@W2*WJ)$
zJKlczlMACZ=z-rOCaWUdrOO=|Ci_7JLv~xvEEnmf<>tm#SIdrJU34m)C|o5=#$gkjeHH=PlRles(Q*dt19E>#;|d^(03UtK
zHSb(jajLWW$zy)Ybk1DSpMrdgBZ^RgV82@_^umpYHVW!jHq-ez`)+?Ul!E6WyUtMP
z)yeu=&;b~VM2yCkDV~iHR14r0lUSi_H?==h9pBlhHQ)kHtH@Lt)63LhvI4D5yK(}p
z)8;f#DXCl1R$gskzl*J%!NkY)G--p0a|v66wMwoo^7T&7{ze!3=Cay+39#gN+TKip
z1s_s5(%i6<%Xe&Td+>irTbz>siwOvA%2%n^nElK+q_AR(Bly{%W#$0Lp|f^*&Pp;d
zyK7vVDly!)7+F{v4ygMySB(-8O%uYR648p-kH;7PUK>x>b(eIXT6dG`i*Yam!HuMt
ziXN53y?Y$Cz7g!yLqTQ=t?@O@#+IU;4b%K7wHNlFTV=yhh?oc6!q^s~a7j$|2ZfGreH%($%sA(=ikMFN4hPtqTpq1!J%ym>WV(vTis*gi22f|L0WE-F}0bb$|ww
zat0ultxJA5Y)J`T>xrnyEq9^A9n4D@ddWR9%8;G8$1giM=r&UqW=nBOzHLEWFw{-?
zCt4w7g7!Yt&&(X>i@kfr%^HZRdX6lRl@bg;?G;8Eg$!czwzBby0ECJyjT*l}kwm9S
zd->ThKc|Ae)s!WaePiP{UM5EXvo=Lbwz*H&I8&6|gOG*X>h
z+xFbw%ArXr|V4Yw#^f45Z&PbH`aFu^8;=HS;v
zZt0}YEErZP$ZQy6Z9)ZR?GH|i8mzIw)a!kA0@~@RDRMxBi)%6xnYMT)YDim)oOqAtS&0Pe5TVe#kTju&e=7
zAKQsNBTCGBJq>Dp9V0=m2DWGgB#K#ih@P3NzBUMF3bU^s>~)KNTyUP$dB@Mv>hpK#
zNT&+57X0|H0+*u*GPksFq&H=JeVzoWh%3B4sOzBAM2t*{$)-O7z;w3Xc(@rJmhTCk
z{!ZyXQ1U?`HGkLVpX>vPStyW5Az&977y|1n6o@Xa4Oi@gKjxkcBhR^@+mdK>P2#Qw
z>folX!&TM?J>GT$!Tf_>=YaEhn2yKXm;@moONyiiXUkd0-<1BJ{oaC)c+8n)Q7T-a
zjD)MOekxYaWVeNSasp3_T^RG%$)Th`uvRO4{A5x%3E{9^aRJN{VM+Y!aR2qXJn9O%
ziuL$Pzb8j^FK5zn^O9`GwIe|eGEClsVI~5`hdEuEMuS=Sqqb>3bz#W~+_{Z6_^;Xd
zQ9o>j+DLTftKIhg^*#SSP_2sD`33ulqKlh`F3@8xr5k^eS?kr2oCA^O`ot6^!$kfj
z{{X9keT#^m!yv#z>{NSlFl|w6WoNCc*YaGdT?+wO~amoj&m|
znLLV0Z?v)#_uwW(lgxV`ZA-}2?6(0?mJ<2oO7n%Rb{ey3{`tSx$Ly@DZqZS5MZlh&
zb$*qAj5tibKzXhIS?}H=E&}vSC%BBX)B0yjK0wmxWX%HrFh%fM-2V|EwE
zmM_sO^C^oeVcE{n(V3VeN1Q)}&|ValUAVN%0#vl=yXclgG*#wq^O3M}Qj^->veuKU
z>BdmDWT{n%`v!aA*_Y^YHo|kv{5KiwTq9Y^sgceSsIun5=
zh84oK1y+U@+|#&sX4$A#&YVSg%d=e6>=y>i-dIW@Q*xD$E2LW^A~1L@ikZBzl4Cjp
zbZX5iEib5_#D34-nNgBGy;JRX(Q4QwFhBciotaku#>PLviC2i1SEKq_GYPNe5o|&i
z;TyabHvtMWA}{Y6^W6$6hopxqY8AUNz{{ePg5SCm@huY1!5g4Lkriclr9*oE6pa}r
zGRdo{$2U@i^*J_lbk>(FZbfQ1Jl(>}IF;w;dCHl1i@$4Qxr&+66&dWNuqw~vgRj;H
z4((Y@BuHEtFXMg=6W&l0SlRoZ(}e*pU|(trPlO5+LrA)_jU!#vX`p+CcRElCZG4KT
z<+x}`x>^?V(*20YM2QnM)h8*sQB=6c)U8uzuj%V3L%%F;d~*7_1AE&1NiH^J74*6=
z)CqMNUgYR~7v??fC=E3=RKV!b>K?Ff3)M|B&_#%Xn__Hn@f0sbsLEbJSVVs)Sn(qF
zS7qQ|JKbGtRVEf%a8)o{m-ZT(GrC1y%Gs9eq1fD7z{0X9FbxY~!Q*d=oE&?)?#8y*
zrxLcsd(!6=2K%H$EPoIKoyV5sF%%wbyqu&b_?yA!UMs9vB{75)+=zBW+Z#fa)Q1@v
z8P;N+JimquLt-5AO$X!h<JNU89S$sNeGqyip?MK^13h+*RYQ%;M2Sdgvqu{jfc
zuQ9ObhtsWtEwiVaAs@$wY!a$^6l%|PZ)BE>+{gC
zvr}i8{L1EI{VtuF!H^-*+Y_nI0F(yUYebePH0ttIbVn8?=k!K%^JAV6Mf&7eA&>WB
zolF)JPUCUjKO!NRCn_nAZx)7n^gR6sLA?}m_W`*!3#-2}2&L-8-mGaQpOETA>n+!v
zZ{ZpmPrgtIag5ISM1bN59F}{_G&cld`bxS#=v^0H8R@?aeU2$TO|#G7xX{s~zUM9W
zMMpuk)DX9I$v5DZjcNpZV#ClwikR<+G{LLCr{t0Dr(hW)e6uYpX>K}flMr;eeflGO
z+-{`al`F_+t5sz3pyBZ(9|Bx>_$V_Df49=B&BV_I_j;8~A7?Qb(_8zE&y526gr}r!
zr^F{2oy|wz9Dl9dkj~8ebh-(Bc1J!D-@BVtv-%H$luT8ef^$R+_UgD*PPM?2P-S^n
zVR3ZWb@)co^T-^?#Dc97WXnys?U>v-tQW&>x+DdhKBYM?()XspozMB`#$KiBv(i|
zPvrDSsVTFCEiaza(v`X0^4mhg;^L$bPI8GCZam^|M#cqpv>RC8iE)M$ym>eynJf02
z@LDD+-0=|ZTX^T-G&{Ck1bQgRt;c16u2x<$<8oi)OKqmBze8_(9;;xnxX>60@Hq8+
z-0B&)I8Lzw(*|BZyalPJuXC1@G`MbG8BUe~$->ErzpNw;rl
za7^%CkIRpPl;&^SQJ;IcBKn?!4~~9c++i~gCK4%}-K^f7t2-RvcMNF}%LF8@0l!^)
ztqsS%v~qx!;)N-;Qbk8gPL=Cv49wypX=1UtcOpemSx&{mN!K&}$($t_K#P;aTT|kh!14mghk-0?PA{e~_UL3K4)LEdQ)=
zr~)+kGBYYpX~2ZOZm#s|esfRXxtt%Rd6If2ZQq4F{N0q!uuBhar
zX_@+;Ff%jN^8*)pqv6O4_>%=LNuYfD~94oy#f