diff --git a/.gitignore b/.gitignore index a0e2c0d368..b674ff367c 100644 --- a/.gitignore +++ b/.gitignore @@ -6,7 +6,11 @@ _site/ Tools/NuGet/ .optemp/ + .openpublishing.build.mdproj .openpublishing.buildcore.ps1 packages.config -*.zip \ No newline at end of file +windows/keep-secure/index.md + +# User-specific files +.vs/ \ No newline at end of file diff --git a/.localization-config b/.localization-config deleted file mode 100644 index c24369eb99..0000000000 --- a/.localization-config +++ /dev/null @@ -1,8 +0,0 @@ -{ - "locales": [ "zh-cn" ], - "files": ["!/*.md", "**/**/*.md", "**/*.md"], - "includeDependencies": true, - "autoPush": true, - "xliffVersion": "2.0", - "useJavascriptMarkdownTransformer": true -} diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 469c22cfdc..e06f28392e 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -1,78 +1,108 @@ { - "build_entry_point": "", - "git_repository_url_open_to_public_contributors": "", - "docsets_to_publish": [ - { - "docset_name": "microsoft-edge", - "build_output_subfolder": "browsers/edge", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "internet-explorer", - "build_output_subfolder": "browsers/internet-explorer", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "windows", - "build_output_subfolder": "windows", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "surface", - "build_output_subfolder": "devices/surface", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "surface-hub", - "build_output_subfolder": "devices/surface-hub", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "mdop", - "build_output_subfolder": "mdop", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "education", - "build_output_subfolder": "education", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - } - ], - "notification_subscribers": ["brianlic@microsoft.com"], - "branches_to_filter": [""] -} + "build_entry_point": "", + "need_generate_pdf": false, + "need_generate_intellisense": false, + "docsets_to_publish": [ + { + "docset_name": "education", + "build_source_folder": "education", + "build_output_subfolder": "education", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "internet-explorer", + "build_source_folder": "browsers/internet-explorer", + "build_output_subfolder": "browsers/internet-explorer", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "itpro-hololens", + "build_source_folder": "devices/hololens", + "build_output_subfolder": "devices/hololens", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "op" + }, + { + "docset_name": "mdop", + "build_source_folder": "mdop", + "build_output_subfolder": "mdop", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "microsoft-edge", + "build_source_folder": "browsers/edge", + "build_output_subfolder": "browsers/edge", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "surface", + "build_source_folder": "devices/surface", + "build_output_subfolder": "devices/surface", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "surface-hub", + "build_source_folder": "devices/surface-hub", + "build_output_subfolder": "devices/surface-hub", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "windows", + "build_source_folder": "windows", + "build_output_subfolder": "windows", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content" + } + } + ], + "notification_subscribers": [ + "brianlic@microsoft.com" + ], + "branches_to_filter": [ + "" + ], + "git_repository_url_open_to_public_contributors": "https://github.com/Microsoft/windows-itpro-docs", + "git_repository_branch_open_to_public_contributors": "master", + "skip_source_output_uploading": false, + "dependent_repositories": [] +} \ No newline at end of file diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000000..fb6c3024d1 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,92 @@ +# Contributing to Windows IT professional documentation + +Thank you for your interest in the Windows IT professional documentation! We appreciate your feedback, edits, and additions to our docs. +This page covers the basic steps for contributing to our technical documentation. + +## Sign a CLA + +All contributors who are ***not*** a Microsoft employee must [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before contributing to any Microsoft repositories. +If you've already contributed to Microsoft repositories in the past, congratulations! +You've already completed this step. + +## Editing topics + +We've tried to make editing an existing, public file as simple as possible. + +>**Note**
+>At this time, only the English (en-us) content is available for editing. + +**To edit a topic** + +1. Go to the page on TechNet that you want to update, and then click **Contribute**. + + ![GitHub Web, showing the Contribute link](images/contribute-link.png) + +2. Log into (or sign up for) a GitHub account. + + You must have a GitHub account to get to the page that lets you edit a topic. + +3. Click the **Pencil** icon (in the red box) to edit the content. + + ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) + +4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: + - **If you're linked to the Microsoft organization in GitHub:** [Windows Open Publishing Guide Home](http://aka.ms/windows-op-guide) + + - **If you're external to Microsoft:** [Mastering Markdown](https://guides.github.com/features/mastering-markdown/) + +5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. + + ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) + +6. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change** to create a fork in your personal GitHub account. + + ![GitHub Web, showing the Propose file change button](images/propose-file-change.png) + + The **Comparing changes** screen appears to see what the changes are between your fork and the original content. + +7. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. + + If there are no problems, you’ll see the message, **Able to merge**. + + ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) + +8. Click **Create pull request**. + +9. Enter a title and description to give the approver the appropriate context about what’s in the request. + +10. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. + +11. Click **Create pull request** again to actually submit the pull request. + + The pull request is sent to the writer of the topic and your edits are reviewed. If your request is accepted, updates are published to one of the following places: + + - [Windows 10](https://technet.microsoft.com/itpro/windows) + - [Internet Explorer 11](https://technet.microsoft.com/itpro/internet-explorer) + - [Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge) + - [Surface](https://technet.microsoft.com/itpro/surface) + - [Surface Hub](https://technet.microsoft.com/itpro/surface-hub) + - [Windows 10 for Education](https://technet.microsoft.com/edu/windows) + - [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop) + +## Making more substantial changes + +To make substantial changes to an existing article, add or change images, or contribute a new article, you will need to create a local clone of the content. +For info about creating a fork or clone, see the GitHub help topic, [Fork a Repo](https://help.github.com/articles/fork-a-repo/). + +Fork the official repo into your personal GitHub account, and then clone the fork down to your local device. Work locally, then push your changes back into your fork. Then open a pull request back to the master branch of the official repo. + +## Using issues to provide feedback on documentation + +If you just want to provide feedback rather than directly modifying actual documentation pages, you can create an issue in the repository. + +At the top of a topic page you'll see an **Issues** tab. Click the tab and then click the **New issue** button. + +Be sure to include the topic title and the URL for the page you're submitting the issue for, if that page is different from the page you launched the **New issue** dialog from. + +## Resources + +You can use your favorite text editor to edit Markdown. We recommend [Visual Studio Code](https://code.visualstudio.com/), a free lightweight open source editor from Microsoft. + +You can learn the basics of Markdown in just a few minutes. To get started, check out [Mastering Markdown](https://guides.github.com/features/mastering-markdown/). + diff --git a/README.md b/README.md index f5b28b423b..fa13a55593 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,20 @@ -# win-cpub-itpro-docs -This repo hosts the WDG ITPro content that is published to TechNet. +# Windows IT professional documentation + +Welcome! This repository houses the docs that are written for IT professionals for the following products: + +- [Windows 10](https://technet.microsoft.com/itpro/windows) +- [Internet Explorer 11](https://technet.microsoft.com/itpro/internet-explorer) +- [Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge) +- [Surface](https://technet.microsoft.com/itpro/surface) +- [Surface Hub](https://technet.microsoft.com/itpro/surface-hub) +- [Windows 10 for Education](https://technet.microsoft.com/edu/windows) +- [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop) + +## Contributing + +We actively merge contributions into this repository via [pull request](https://help.github.com/articles/using-pull-requests/) into the *master* branch. +If you are not a Microsoft employee, before you submit a pull request you must [sign a Contribution License Agreement](https://cla.microsoft.com/) to ensure that the community is free to use your submissions. +For more information on contributing, read our [contributions guide](CONTRIBUTING.md). + This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. - -English Handoff Folder Structure Demo! diff --git a/browsers/edge/Index.md b/browsers/edge/Index.md index ab4caaef1d..29090e5faa 100644 --- a/browsers/edge/Index.md +++ b/browsers/edge/Index.md @@ -6,15 +6,17 @@ ms.prod: edge ms.mktglfcycl: general ms.sitesec: library title: Microsoft Edge - Deployment Guide for IT Pros (Microsoft Edge for IT Pros) +localizationpriority: high --- # Microsoft Edge - Deployment Guide for IT Pros **Applies to:** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge also introduces new features like Web Note, Reading View, and Cortana that you can use along with your normal web browsing abilities. @@ -26,6 +28,7 @@ Microsoft Edge lets you stay up-to-date through the Windows Store and to manage | Topic | Description | | -----------------------| ----------------------------------- | |[Change history for Microsoft Edge](change-history-for-microsoft-edge.md) |Lists new and updated topics in the Microsoft Edge documentation for both Windows 10 and Windows 10 Mobile. | +|[Enterprise guidance about using Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Guidance about how to use both Microsoft Edge and Internet Explorer 11 in your enterprise.| | [Microsoft Edge requirements and language support](hardware-and-software-requirements.md) | Microsoft Edge is pre-installed on all Windows 10-capable devices that meet the minimum system requirements and are on the supported language list.| | [Available policies for Microsoft Edge](available-policies.md) | Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings.

Group Policy objects (GPO's) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. By using Group Policy and Intune, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain. | | [Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md) | If you have specific web sites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the web sites will automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work properly with Microsoft Edge, you can set all intranet sites to automatically open using IE11.

Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. | @@ -47,11 +50,11 @@ However, if you're running web apps that continue to use: * legacy document modes -You'll need to keep running them using IE11. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](http://go.microsoft.com/fwlink/p/?linkid=290956). Alternatively, you can also use Enterprise Mode with Microsoft Edge to transition only the sites that need these technologies to load in IE11. For info about Enterprise Mode and Edge, see [Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md). +You'll need to keep running them using IE11. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). Alternatively, you can also use Enterprise Mode with Microsoft Edge to transition only the sites that need these technologies to load in IE11. For info about Enterprise Mode and Edge, see [Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md). ## Related topics -- [Download Internet Explorer 11](http://go.microsoft.com/fwlink/p/?linkid=290956) -- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](http://go.microsoft.com/fwlink/p/?LinkId=760644) -- [Internet Explorer 11 - FAQ for IT Pros](http://go.microsoft.com/fwlink/p/?LinkId=760645) -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](http://go.microsoft.com/fwlink/p/?LinkId=760646) +- [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=290956) +- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760644) +- [Internet Explorer 11 - FAQ for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760645) +- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](https://go.microsoft.com/fwlink/p/?LinkId=760646) diff --git a/browsers/edge/TOC.md b/browsers/edge/TOC.md index df9d4246da..fb5ad0c6f2 100644 --- a/browsers/edge/TOC.md +++ b/browsers/edge/TOC.md @@ -1,5 +1,6 @@ #[Microsoft Edge - Deployment Guide for IT Pros](index.md) ##[Change history for Microsoft Edge](change-history-for-microsoft-edge.md) +##[Enterprise guidance about using Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) ##[Microsoft Edge requirements and language support](hardware-and-software-requirements.md) ##[Available policies for Microsoft Edge](available-policies.md) ##[Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index c56c47624b..c7e1e2fcd2 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -6,21 +6,20 @@ ms.prod: edge ms.mktglfcycl: explore ms.sitesec: library title: Available policies for Microsoft Edge (Microsoft Edge for IT Pros) +localizationpriority: high --- # Available policies for Microsoft Edge **Applies to:** -- Windows 10 Insider Preview -- Windows 10 Mobile - -[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] +- Windows 10 +- Windows 10 Mobile Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPO's) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. By using Group Policy and Intune, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain. -

**Note**
For more info about Group Policy, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=214514). This site provides links to the latest technical documentation, videos, and downloads for Group Policy. For more info about the tools you can use to change your Group Policy objects, see the Internet Explorer 11 topics, [Group Policy and the Group Policy Management Console (GPMC)](http://go.microsoft.com/fwlink/p/?LinkId=617921), [Group Policy and the Local Group Policy Editor](http://go.microsoft.com/fwlink/p/?LinkId=617922), [Group Policy and the Advanced Group Policy Management (AGPM)](http://go.microsoft.com/fwlink/p/?LinkId=617923), and [Group Policy and Windows Powershell](http://go.microsoft.com/fwlink/p/?LinkId=617924). +

**Note**
For more info about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). This site provides links to the latest technical documentation, videos, and downloads for Group Policy. For more info about the tools you can use to change your Group Policy objects, see the Internet Explorer 11 topics, [Group Policy and the Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=617921), [Group Policy and the Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=617922), [Group Policy and the Advanced Group Policy Management (AGPM)](https://go.microsoft.com/fwlink/p/?LinkId=617923), and [Group Policy and Windows Powershell](https://go.microsoft.com/fwlink/p/?LinkId=617924). ## Group Policy settings Microsoft Edge works with these Group Policy settings (`Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\`) to help you manage your company's web browser configurations: @@ -49,7 +48,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A |Show message when opening sites in Internet Explorer |Windows 10 Insider Preview |This policy setting lets you decide whether employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.

If you enable this setting, employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.

If you disable or don’t configure this setting, the default app behavior occurs and no additional page appears. |**Enabled:** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.

**Disabled or not configured (default):** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11. | ## Using Microsoft Intune to manage your Mobile Data Management (MDM) settings for Microsoft Edge -If you manage your policies using Intune, you'll want to use these MDM policy settings. You can see the full list of available policies, on the [Policy CSP]( http://go.microsoft.com/fwlink/p/?LinkId=722885) page. +If you manage your policies using Intune, you'll want to use these MDM policy settings. You can see the full list of available policies, on the [Policy CSP]( https://go.microsoft.com/fwlink/p/?LinkId=722885) page.

**Note**
The **Supports** column uses these options: @@ -103,8 +102,8 @@ These are additional Windows 10-specific MDM policy settings that work with Mic |AllowSyncMySettings |Desktop |

| ## Related topics -* [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=214514) -* [Mobile Data Management (MDM) settings]( http://go.microsoft.com/fwlink/p/?LinkId=722885) +* [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514) +* [Mobile Data Management (MDM) settings]( https://go.microsoft.com/fwlink/p/?LinkId=722885)     diff --git a/browsers/edge/change-history-for-microsoft-edge.md b/browsers/edge/change-history-for-microsoft-edge.md index f10af1201c..61e8ba0de9 100644 --- a/browsers/edge/change-history-for-microsoft-edge.md +++ b/browsers/edge/change-history-for-microsoft-edge.md @@ -9,7 +9,19 @@ ms.sitesec: library # Change history for Microsoft Edge This topic lists new and updated topics in the Microsoft Edge documentation for both Windows 10 and Windows 10 Mobile. -For a detailed feature list of what's in the current Microsoft Edge releases, the Windows Insider Preview builds, and what was introduced in previous releases, see the [Microsoft Edge changelog](https://developer.microsoft.com/en-us/microsoft-edge/platform/changelog/). +For a detailed feature list of what's in the current Microsoft Edge releases, the Windows Insider Preview builds, and what was introduced in previous releases, see the [Microsoft Edge changelog](https://developer.microsoft.com/microsoft-edge/platform/changelog/). + +## July 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Microsoft Edge requirements and language support](hardware-and-software-requirements.md)| Updated to include a note about the Long Term Servicing Branch (LTSB). | + +## July 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise guidance about using Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) | Content moved from What's New section. | +|[Available policies for Microsoft Edge](available-policies.md) |Updated | + ## June 2016 |New or changed topic | Description | diff --git a/browsers/edge/emie-to-improve-compatibility.md b/browsers/edge/emie-to-improve-compatibility.md index adb462310e..4d6bfce510 100644 --- a/browsers/edge/emie-to-improve-compatibility.md +++ b/browsers/edge/emie-to-improve-compatibility.md @@ -7,18 +7,19 @@ ms.mktglfcycl: support ms.sitesec: library ms.pagetype: appcompat title: Use Enterprise Mode to improve compatibility (Microsoft Edge for IT Pros) +localizationpriority: high --- # Use Enterprise Mode to improve compatibility **Applies to:** -- Windows 10 +- Windows 10 If you have specific web sites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the web sites will automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work properly with Microsoft Edge, you can set all intranet sites to automatically open using IE11. Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. -

**Note**
If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy]( http://go.microsoft.com/fwlink/p/?LinkId=620714). +

**Note**
If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714). ## Fix specific websites @@ -26,7 +27,7 @@ Microsoft Edge doesn't support ActiveX controls, Browser Helper Objects, VBScrip ![](images/wedge.gif) **To add sites to your list** -1. In the Enterprise Mode Site List Manager, click **Add**.

If you already have an existing site list, you can import it into the tool. After it's in the tool, the xml updates the list, checking **Open in IE** for each site. For info about importing the site list, see [Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](http://go.microsoft.com/fwlink/p/?LinkId=618322).

![Enterprise Mode Site List Manager with Open in IE box](images/emie_open_in_ie.png) +1. In the Enterprise Mode Site List Manager, click **Add**.

If you already have an existing site list, you can import it into the tool. After it's in the tool, the xml updates the list, checking **Open in IE** for each site. For info about importing the site list, see [Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](https://go.microsoft.com/fwlink/p/?LinkId=618322).

![Enterprise Mode Site List Manager with Open in IE box](images/emie_open_in_ie.png) 2. Type or paste the URL for the website that’s experiencing compatibility problems, like *<domain>*.com or *<domain>*.com/*<path>* into the **URL** box.

You don’t need to include the `http://` or `https://` designation. The tool will automatically try both versions during validation. @@ -36,11 +37,11 @@ Microsoft Edge doesn't support ActiveX controls, Browser Helper Objects, VBScrip 5. Click **Save** to validate your website and to add it to the site list for your enterprise.

If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. -6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your Group Policy setting. For more info, see [Turn on Enterprise Mode and use a site list](http://go.microsoft.com/fwlink/p/?LinkId=618952). +6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your Group Policy setting. For more info, see [Turn on Enterprise Mode and use a site list](https://go.microsoft.com/fwlink/p/?LinkId=618952). ### Set up Microsoft Edge to use the Enterprise Mode site list -You must turn on the **Use Enterprise Mode Site List** Group Policy setting before Microsoft Edge can use the Enterprise Mode site list. This Group Policy applies to both Microsoft Edge and IE11, letting Microsoft Edge switch to IE11 as needed, based on the Enterprise Mode site list. For more info about IE11 and Enterprise Mode, see [Enterprise Mode for Internet Explorer 11 (IE11)](http://go.microsoft.com/fwlink/p/?linkid=618377). +You must turn on the **Use Enterprise Mode Site List** Group Policy setting before Microsoft Edge can use the Enterprise Mode site list. This Group Policy applies to both Microsoft Edge and IE11, letting Microsoft Edge switch to IE11 as needed, based on the Enterprise Mode site list. For more info about IE11 and Enterprise Mode, see [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). ![](images/wedge.gif) **To turn on Enterprise Mode using Group Policy** @@ -69,7 +70,7 @@ You must turn on the **Use Enterprise Mode Site List** Group Policy setting befo ## Fix your intranet sites You can add the **Send all intranet traffic over to Internet Explorer** Group Policy setting for Windows 10 so that all of your intranet sites open in IE11. This means that even if your employees are using Microsoft Edge, they will automatically switch to IE11 while viewing the intranet. -

**Note**
If you want to use Group Policy to set IE as the default browser for Internet sites, you can find the info here, [Set the default browser using Group Policy]( http://go.microsoft.com/fwlink/p/?LinkId=620714). +

**Note**
If you want to use Group Policy to set IE as the default browser for Internet sites, you can find the info here, [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714). ![](images/wedge.gif) **To turn on Sends all intranet traffic over to Internet Explorer using Group Policy** @@ -80,11 +81,11 @@ You can add the **Send all intranet traffic over to Internet Explorer** Group Po 3. Refresh your policy in your organization and then view the affected sites in Microsoft Edge.

The site shows a message in Microsoft Edge, saying that the page needs IE. At the same time, the page opens in IE11; in a new frame if it's not yet running, or in a new tab if it is. ## Related topics -* [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](http://go.microsoft.com/fwlink/p/?LinkID=624035) -* [Enterprise Mode Site List Manager for Windows 7 and Windows 8.1 download](http://go.microsoft.com/fwlink/p/?LinkId=394378) -* [Enterprise Mode Site List Manager for Windows 10 download](http://go.microsoft.com/fwlink/?LinkId=746562) -* [Enterprise Mode for Internet Explorer 11 (IE11)](http://go.microsoft.com/fwlink/p/?linkid=618377) -* [Set the default browser using Group Policy]( http://go.microsoft.com/fwlink/p/?LinkId=620714) +* [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](https://go.microsoft.com/fwlink/p/?LinkID=624035) +* [Enterprise Mode Site List Manager for Windows 7 and Windows 8.1 download](https://go.microsoft.com/fwlink/p/?LinkId=394378) +* [Enterprise Mode Site List Manager for Windows 10 download](https://go.microsoft.com/fwlink/?LinkId=746562) +* [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377) +* [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714)     diff --git a/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md b/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md new file mode 100644 index 0000000000..a3dcf46f40 --- /dev/null +++ b/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md @@ -0,0 +1,52 @@ +--- +title: Microsoft Edge and Internet Explorer 11 (Microsoft Edge for IT Pros) +description: Enterprise guidance for using Microsoft Edge and Internet Explorer 11. +ms.assetid: 3c5bc4c4-1060-499e-9905-2504ea6dc6aa +author: eross-msft +ms.prod: edge +ms.mktglfcycl: support +ms.sitesec: library +ms.pagetype: appcompat +localizationpriority: high +--- + +# Browser: Microsoft Edge and Internet Explorer 11 +**Microsoft Edge content applies to:** + +- Windows 10 +- Windows 10 Mobile + +**Internet Explorer 11 content applies to:** + +- Windows 10 + +## Enterprise guidance +Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). + +We also recommend that you upgrade to IE11 if you're running any earlier versions of Internet Explorer. IE11 is supported on Windows 7, Windows 8.1, and Windows 10. So any legacy apps that work with IE11 will continue to work even as you migrate to Windows 10. + +### Microsoft Edge +Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana. + +- **Web Note.** Microsoft Edge lets you annotate, highlight, and call things out directly on webpages. +- **Reading view.** Microsoft Edge lets you enjoy and print online articles in a distraction-free layout that's optimized for your screen size. While in reading view, you can also save webpages or PDF files to your reading list, for later viewing. +- **Cortana.** Cortana is automatically enabled on Microsoft Edge. Microsoft Edge lets you highlight words for more info and gives you one-click access to things like restaurant reservations and reviews, without leaving the webpage. +- **Compatibility and security.** Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or that are included on your Enterprise Mode Site List. You must use IE11 to run older, less secure technology, such as ActiveX controls. + +### IE11 +IE11 offers enterprises additional security, manageability, performance, backward compatibility, and modern standards support. + +- **Backward compatibility.** IE11 supports 9 document modes that include high-fidelity emulations for older versions of IE. +- **Modern web standards.** IE11 supports modern web technologies like HTML5, CSS3, and WebGL, which help to ensure today's modern websites and apps work just as well as your old, legacy websites and apps. +- **More secure.** IE11 was designed with security in mind and is more secure than older versions. Using security features like SmartScreen and Enhanced Protected Mode can help IE11 reduce your risk. +- **Faster.** IE11 is significantly faster than previous versions of Internet Explorer, taking advantage of network optimization and hardware-accelerated text, graphics, and JavaScript rendering. +- **Easier migration to Windows 10.** IE11 is the only version of IE that runs on Windows 7, Windows 8.1, and Windows 10. Upgrading to IE11 on Windows 7 can also help your organization support the next generation of software, services, and devices. +- **Administration.** IE11 can use the Internet Explorer Administration Kit (IEAK) 11 or MSIs for deployment, and includes more than 1,600 Group Policies and preferences for granular control. + +## Related topics +- [Web Application Compatibility Lab Kit for Internet Explorer 11](https://technet.microsoft.com/en-us/browser/mt612809.aspx) +- [Download Internet Explorer 11](http://windows.microsoft.com/en-US/internet-explorer/download-ie) +- [Microsoft Edge - Deployment Guide for IT Pros](https://technet.microsoft.com/itpro/microsoft-edge/index) +- [Internet Explorer 11 - Deployment Guide for IT Pros](https://technet.microsoft.com/itpro/internet-explorer/ie11-deploy-guide/index) +- [IEAK 11 - Internet Explorer Administration Kit 11 Users Guide](https://technet.microsoft.com/en-us/itpro/internet-explorer/ie11-ieak/index) +- [Internet Explorer 11 - FAQ for IT Pros](https://technet.microsoft.com/en-us/itpro/internet-explorer/ie11-faq/faq-for-it-pros-ie11) diff --git a/browsers/edge/hardware-and-software-requirements.md b/browsers/edge/hardware-and-software-requirements.md index e7467694cc..d423c37bd4 100644 --- a/browsers/edge/hardware-and-software-requirements.md +++ b/browsers/edge/hardware-and-software-requirements.md @@ -7,18 +7,21 @@ ms.mktglfcycl: support ms.sitesec: library ms.pagetype: appcompat title: Microsoft Edge requirements and language support (Microsoft Edge for IT Pros) +localizationpriority: high --- # Microsoft Edge requirements and language support **Applies to:** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile Microsoft Edge is pre-installed on all Windows 10-capable devices that meet the minimum system requirements and are on the supported language list. +>**Note**
The Long-Term Servicing Branch (LTSB) versions of Windows, including Windows Server 2016, don't include Microsoft Edge or many other Universal Windows Platform (UWP) apps. These apps and their services are frequently updated with new functionality, and can't be supported on systems running the LTSB operating systems. For customers who require the LTSB for specialized devices, we recommend using Internet Explorer 11. + ## Minimum system requirements Some of the components in this table might also need additional system resources. Check the component's documentation for more information. @@ -26,7 +29,7 @@ Some of the components in this table might also need additional system resources | Item | Minimum requirements | | ------------------ | -------------------------------------------- | | Computer/processor | 1 gigahertz (GHz) or faster (32-bit (x86) or 64-bit (x64)) | -| Operating system |

**Note**
For specific Windows 10 Mobile requirements, see the [Minimum hardware requirements for Windows 10 Mobile](http://go.microsoft.com/fwlink/p/?LinkID=699266) topic. | +| Operating system |

**Note**
For specific Windows 10 Mobile requirements, see the [Minimum hardware requirements for Windows 10 Mobile](https://go.microsoft.com/fwlink/p/?LinkID=699266) topic. | | Memory |

| | Hard drive space | | | DVD drive | DVD-ROM drive (if installing from a DVD-ROM) | diff --git a/browsers/edge/security-enhancements-microsoft-edge.md b/browsers/edge/security-enhancements-microsoft-edge.md index 9db29bd47d..17ac7d1722 100644 --- a/browsers/edge/security-enhancements-microsoft-edge.md +++ b/browsers/edge/security-enhancements-microsoft-edge.md @@ -5,9 +5,16 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security title: Security enhancements for Microsoft Edge (Microsoft Edge for IT Pros) +localizationpriority: high --- # Security enhancements for Microsoft Edge + +**Applies to:** + +- Windows 10 +- Windows 10 Mobile + Microsoft Edge is designed with significant security improvements, helping to defend people from increasingly sophisticated and prevalent web-based attacks against Windows. ## Help to protect against web-based security threats @@ -43,15 +50,15 @@ Microsoft Edge has a new rendering engine, Microsoft EdgeHTML, which is focused The Microsoft EdgeHTML engine also helps to defend against hacking through these new security standards features: -- Support for the W3C standard for [Content Security Policy (CSP)](https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/security/content-Security-Policy), which can help web developers defend their sites against cross-site scripting attacks. +- Support for the W3C standard for [Content Security Policy (CSP)](https://developer.microsoft.com/microsoft-edge/platform/documentation/dev-guide/security/content-Security-Policy), which can help web developers defend their sites against cross-site scripting attacks. -- Support for the [HTTP Strict Transport Security (HSTS)](https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/security/HSTS/) security feature (IETF-standard compliant). This helps ensure that connections to important sites, such as to your bank, are always secured. +- Support for the [HTTP Strict Transport Security (HSTS)](https://developer.microsoft.com/microsoft-edge/platform/documentation/dev-guide/security/HSTS/) security feature (IETF-standard compliant). This helps ensure that connections to important sites, such as to your bank, are always secured. **Note**
Both Microsoft Edge and Internet Explorer 11 support HSTS. #### All web content runs in an app container sandbox -Internet Explorer 7 on Windows Vista was the first web browser to provide a browsing sandbox, called [Protected Mode](http://windows.microsoft.com/en-US/windows-vista/What-does-Internet-Explorer-protected-mode-do). Protected Mode forced the part of the browser that rendered web content to run with less privilege than the browser controls or the user, providing a level of isolation and protection should a malicious website attempt to exploit a bug in the browser or one of its plug-ins. +Internet Explorer 7 on Windows Vista was the first web browser to provide a browsing sandbox, called [Protected Mode](http://windows.microsoft.com/windows-vista/What-does-Internet-Explorer-protected-mode-do). Protected Mode forced the part of the browser that rendered web content to run with less privilege than the browser controls or the user, providing a level of isolation and protection should a malicious website attempt to exploit a bug in the browser or one of its plug-ins. Internet Explorer 10 introduced Enhanced Protected Mode (EPM), based on the Windows 8 app container technology, providing a stronger sandbox by adding deny-by-default and no-read-up semantics. EPM was turned on by default in the Windows 8 and Windows 8.1 immersive browser, but was optional on the Internet Explorer 10 and Internet Explorer 11 desktop versions. @@ -68,10 +75,10 @@ The value of running 64-bit all the time is that it strengthens Windows Address #### New extension model and HTML5 support Back in 1996, we introduced ActiveX for web browser extensions in an attempt to let 3rd parties experiment with various forms of alternate content on the web. However, we quickly learned that browser extensions can come at a cost of security and reliability. For example, binary extensions can bring code and data into the browser’s processes without any protection, meaning that if anything goes wrong, the entire browser itself can be compromised or go down. -Based on that learning, we’ve stopped supporting binary extensions in Microsoft Edge and instead encourage everyone to use our new, scripted HTML5-based extension model. For more info about the new extensions, see the [Microsoft Edge Developer Center](https://developer.microsoft.com/en-us/microsoft-edge/extensions/). +Based on that learning, we’ve stopped supporting binary extensions in Microsoft Edge and instead encourage everyone to use our new, scripted HTML5-based extension model. For more info about the new extensions, see the [Microsoft Edge Developer Center](https://developer.microsoft.com/microsoft-edge/extensions/). #### Reduced attack surfaces -In addition to removing support for VBScript, Jscript, VML, Browser Helper Objects, Toolbars, and ActiveX controls, Microsoft Edge also removed support for legacy Internet Explorer [document modes](https://msdn.microsoft.com/en-us/library/jj676915.aspx). Because many IE browser vulnerabilities are only present in legacy document modes, removing support for document modes significantly reduces attack surface, making the browser much more secure than before. However, it also means that it’s not as backward compatible. +In addition to removing support for VBScript, Jscript, VML, Browser Helper Objects, Toolbars, and ActiveX controls, Microsoft Edge also removed support for legacy Internet Explorer [document modes](https://msdn.microsoft.com/library/jj676915.aspx). Because many IE browser vulnerabilities are only present in legacy document modes, removing support for document modes significantly reduces attack surface, making the browser much more secure than before. However, it also means that it’s not as backward compatible. Because of the reduced backward compatibility, we’ve given Microsoft Edge the ability to automatically fall back to Internet Explorer 11, using the Enterprise Mode Site List, for any apps that need backward compatibility. diff --git a/browsers/internet-explorer/TOC.md b/browsers/internet-explorer/TOC.md index 440e179791..f55624a429 100644 --- a/browsers/internet-explorer/TOC.md +++ b/browsers/internet-explorer/TOC.md @@ -1,4 +1,5 @@ #[IE11 Deployment Guide for IT Pros](ie11-deploy-guide/index.md) +##[Change history for the Internet Explorer 11 (IE11) Deployment Guide](ie11-deploy-guide/change-history-for-internet-explorer-11.md) ##[System requirements and language support for Internet Explorer 11](ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md) ##[List of updated features and tools - Internet Explorer 11 (IE11)](ie11-deploy-guide/updated-features-and-tools-with-ie11.md) ##[Install and Deploy Internet Explorer 11 (IE11)](ie11-deploy-guide/install-and-deploy-ie11.md) @@ -22,23 +23,23 @@ ###[What is Enterprise Mode?](ie11-deploy-guide/what-is-enterprise-mode.md) ###[Set up Enterprise Mode logging and data collection](ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md) ###[Turn on Enterprise Mode and use a site list](ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md) -###[Enterprise Mode schema v.2 guidance for Windows 10 devices](ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md) -###[Enterprise Mode schema v.1 guidance for Windows 7 and Windows 8.1 devices](ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md) +###[Enterprise Mode schema v.2 guidance](ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md) +###[Enterprise Mode schema v.1 guidance](ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md) ###[Check for a new Enterprise Mode site list xml file](ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md) ###[Turn on local control and logging for Enterprise Mode](ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md) -###[Use the Enterprise Mode Site List Manager tool](ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md) -####[Add sites to the Enterprise Mode site list using the Windows 10 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) -####[Add sites to the Enterprise Mode site list using the Windows 7 and Windows 8.1 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) -####[Add multiple sites to the Enterprise Mode site list using a file and the Windows 10 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) -####[Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and Windows 8.1 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) -####[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager tool](ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) -####[Fix validation problems using the Enterprise Mode Site List Manager tool](ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) -####[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -####[Save your site list to XML in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) -####[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager tool](ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) -####[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager tool](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) -####[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -####[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +###[Use the Enterprise Mode Site List Manager](ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md) +####[Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) +####[Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) +####[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) +####[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) +####[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) +####[Fix validation problems using the Enterprise Mode Site List Manager](ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) +####[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +####[Save your site list to XML in the Enterprise Mode Site List Manager](ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) +####[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) +####[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) +####[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +####[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) ###[Using IE7 Enterprise Mode or IE8 Enterprise Mode](ie11-deploy-guide/using-enterprise-mode.md) ###[Fix web compatibility issues using document modes and the Enterprise Mode site list](ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) ###[Remove sites from a local Enterprise Mode site list](ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md) @@ -143,4 +144,5 @@ ###[Use the URL .INS file to use an auto-configured proxy server](ie11-ieak/url-ins-file-setting.md) ##[IExpress Wizard for Windows Server 2008 R2 with SP1](ie11-ieak/iexpress-wizard-for-win-server.md) ###[IExpress Wizard command-line options](ie11-ieak/iexpress-command-line-options.md) -###[Internet Explorer Setup command-line options and return codes](ie11-ieak/ie-setup-command-line-options-and-return-codes.md) \ No newline at end of file +###[Internet Explorer Setup command-line options and return codes](ie11-ieak/ie-setup-command-line-options-and-return-codes.md) + diff --git a/browsers/internet-explorer/ie11-deploy-guide/.vscode/settings.json b/browsers/internet-explorer/ie11-deploy-guide/.vscode/settings.json new file mode 100644 index 0000000000..d6332e1831 --- /dev/null +++ b/browsers/internet-explorer/ie11-deploy-guide/.vscode/settings.json @@ -0,0 +1,5 @@ +// Place your settings in this file to overwrite default and user settings. +{ + "editor.snippetSuggestions": "none", + "editor.quickSuggestions": false +} \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md index 76fc4cad35..11347ac764 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: security description: How to use Group Policy to install ActiveX controls. -ms.assetid: 59185370-558c-47e0-930c-8a5ed657e9e3 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security +ms.assetid: 59185370-558c-47e0-930c-8a5ed657e9e3 title: ActiveX installation using group policy (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Group Policy and ActiveX installation ActiveX controls are installed and invoked using the HTML object tag with the CODEBASE attribute. This attribute, through a URL, makes Internet Explorer: @@ -33,7 +35,7 @@ You use the ActiveX Installer Service (AXIS) and Group Policy to manage your Act - **ActiveX installation policy for sites in trusted zones.** Identifies how AXIS should behave when a website tries to install an ActiveX control. First, AXIS looks to see if the site appears in either the list of approved installation sites or in the **Trusted sites** zone. If the does, then AXIS checks to make sure the control meets your company's policy requirements. If the ActiveX control meets all of these requirements, the control is installed. -For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](http://go.microsoft.com/fwlink/p/?LinkId=214503). +For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=214503).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md index 2a371e334b..a923c7b2dd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: appcompat description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. -ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: appcompat +ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) **Applies to:** @@ -97,7 +99,7 @@ After you’ve added all of your sites to the tool and saved the file to XML, yo ## Related topics - [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) -- [Download the Enterprise Mode Site List Manager (schema v.1)](http://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378)     diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md index db61a49c80..4770a4ffb0 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: appcompat description: Add multiple sites to your Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2). -ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: appcompat +ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) **Applies to:** @@ -106,7 +108,7 @@ You can save the file locally or to a network share. However, you must make sure After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). ## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](http://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) - [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md)   diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md index bb761657fb..7e8c3c6910 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: appcompat description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: appcompat +ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) **Applies to:** @@ -51,7 +53,7 @@ You can save the file locally or to a network share. However, you must make sure After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). ## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.1)](http://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378)     diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md index 7ae8e40626..b18fa646cd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: appcompat description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that''s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: appcompat +ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) **Applies to:** @@ -67,7 +69,7 @@ You can save the file locally or to a network share. However, you must make sure After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). ## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](http://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853)     diff --git a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md index 35311869b0..137b689b2f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: security description: Administrative templates and Internet Explorer 11 -ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security +ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Administrative templates and Internet Explorer 11 Administrative Templates are made up of a hierarchy of policy categories and subcategories that define how your policy settings appear in the Local Group Policy Editor, including: @@ -21,7 +23,7 @@ Administrative Templates are made up of a hierarchy of policy categories and sub - Text explanations about each setting and the supported version of Internet Explorer. -For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](http://go.microsoft.com/fwlink/p/?LinkId=214519). +For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=214519). ## What are Administrative Templates? Administrative Templates are XML-based, multi-language files that define the registry-based Group Policy settings in the Local Group Policy Editor. There are two types of Administrative Templates: @@ -32,7 +34,7 @@ Administrative Templates are XML-based, multi-language files that define the reg ## How do I store Administrative Templates? As an admin, you can create a central store folder on your SYSVOL directory, named **PolicyDefinitions**. For example, %*SystemRoot*%\\PolicyDefinitions. This folder provides a single, centralized storage location for your Administrative Templates (both ADMX and ADML) files, so they can be used by your domain-based Group Policy Objects (GPOs). -

**Important**
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see [Scenario 1: Editing the Local GPO Using ADMX Files](http://go.microsoft.com/fwlink/p/?LinkId=276810). +

**Important**
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see [Scenario 1: Editing the Local GPO Using ADMX Files](https://go.microsoft.com/fwlink/p/?LinkId=276810). ## Administrative Templates-related Group Policy settings When you install Internet Explorer 11, it updates the local administrative files, Inetres.admx and Inetres.adml, both located in the **PolicyDefinitions** folder. @@ -66,10 +68,11 @@ IE11 provides these new policy settings, which are editable in the Local Group P ## Editing Group Policy settings Regardless which tool you're using to edit your Group Policy settings, you'll need to follow one of these guides for step-by-step editing instructions: -- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](http://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. +- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](https://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. -- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](http://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. +- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](https://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. ## Related topics -- [Administrative templates (.admx) for Windows 10 download](http://go.microsoft.com/fwlink/p/?LinkId=746579) -- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](http://go.microsoft.com/fwlink/p/?LinkId=746580) \ No newline at end of file +- [Administrative templates (.admx) for Windows 10 download](https://go.microsoft.com/fwlink/p/?LinkId=746579) +- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) + diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md index 128ec70d49..a64b645896 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: networking description: Auto configuration and auto proxy problems with Internet Explorer 11 -ms.assetid: 3fbbc2c8-859b-4b2e-abc3-de2c299e0938 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: networking +ms.assetid: 3fbbc2c8-859b-4b2e-abc3-de2c299e0938 title: Auto configuration and auto proxy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Auto configuration and auto proxy problems with Internet Explorer 11 You might experience some problems using automatic configuration and auto-proxy with Internet Explorer 11. @@ -30,7 +32,7 @@ If you experience issues while setting up your proxy server, you can try these t 2. Click **Settings** or **LAN Settings**, and then look at your proxy server address. -3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](http://go.microsoft.com/fwlink/p/?LinkId=85652). +3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](https://go.microsoft.com/fwlink/p/?LinkId=85652). ![](images/wedge.gif) **To check that you've turned on the correct settings** diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md index b2219c09cc..f49ab30704 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: networking description: Auto configuration settings for Internet Explorer 11 -ms.assetid: 90308d59-45b9-4639-ab1b-497e5ba19023 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: networking +ms.assetid: 90308d59-45b9-4639-ab1b-497e5ba19023 title: Auto configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Auto configuration settings for Internet Explorer 11 Automatic configuration lets you apply custom branding and graphics to your internal Internet Explorer installations, running on Windows 8.1 or Windows Server 2012 R2. For more information about adding custom branding and graphics to your IE package, see [Customize the toolbar button and Favorites List icons using IEAK 11](../ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md).

**Important**
You'll only see and be able to use the **IE Customization Wizard 11 - Automatic Configuration** page if you're creating an internal IE installation package. For more information about the **IE Customization Wizard 11 - Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). @@ -35,7 +37,7 @@ For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry ## Updating your automatic configuration settings After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your automatic configuration settings to pick up the updated branding. -

**Important**
Your branding changes won't be added or updated if you've previously chosen the **Disable external branding of IE** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=214514). +

**Important**
Your branding changes won't be added or updated if you've previously chosen the **Disable external branding of IE** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). ![](images/wedge.gif) **To update your settings** @@ -49,7 +51,7 @@ After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your - **Automatic Configuration URL (.INS file) box:** Type the location of your automatic configuration script. - - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

**Important**
Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like *http://share/test.ins*. + - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

**Important**
Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `http://share/test.ins`. If your branding changes aren't correctly deployed after running through this process, see [Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md). diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md index 4705ca8638..b93b60f816 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: networking description: Auto detect settings Internet Explorer 11 -ms.assetid: c6753cf4-3276-43c5-aae9-200e9e82753f author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: networking +ms.assetid: c6753cf4-3276-43c5-aae9-200e9e82753f title: Auto detect settings Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Auto detect settings Internet Explorer 11 After you specify the specific settings related to automatic detection on your Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) servers, you can set up your users' browser settings from a central location. @@ -27,7 +29,7 @@ To use automatic detection, you have to set up your DHCP and DNS servers.

**No 2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. For more information about the **Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). -3. Open the [DHCP Administrative Tool](http://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](http://go.microsoft.com/fwlink/p/?LinkId=294649). +3. Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). ![](images/wedge.gif) **To turn on automatic detection for DNS servers** @@ -35,7 +37,7 @@ To use automatic detection, you have to set up your DHCP and DNS servers.

**No 2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. -3. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

**-OR-**

Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

**Note**
For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](http://go.microsoft.com/fwlink/p/?LinkId=294651).  +3. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

**-OR-**

Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

**Note**
For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](https://go.microsoft.com/fwlink/p/?LinkId=294651).  4. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.

**Note**
Internet Explorer 11 creates a default URL template based on the host name, **wpad**. For example, `http://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md index b4de4ac246..119052b438 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: networking description: Auto proxy configuration settings for Internet Explorer 11 -ms.assetid: 5120aaf9-8ead-438a-8472-3cdd924b7d9e author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: networking +ms.assetid: 5120aaf9-8ead-438a-8472-3cdd924b7d9e title: Auto proxy configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Auto proxy configuration settings for Internet Explorer 11 Configure and maintain your proxy settings, like pointing your users' browsers to your automatic proxy script, through the Internet Explorer Customization Wizard 11 running on either Windows 8.1 or Windows Server 2012 R2. @@ -34,7 +36,7 @@ You have two options to restrict your users' ability to override the automatic c - **Using Microsoft Active Directory.** Choose **Disable changing proxy settings** from the Administrative Templates setting. -- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=214514). +- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md index 00ff5c0914..36de09f8ce 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md +++ b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md @@ -1,18 +1,20 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: performance description: Browser cache changes and roaming profiles -ms.assetid: 85f0cd01-6f82-4bd1-9c0b-285af1ce3436 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: performance +ms.assetid: 85f0cd01-6f82-4bd1-9c0b-285af1ce3436 title: Browser cache changes and roaming profiles (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Browser cache changes and roaming profiles We’ve redesigned the browser cache to improve the performance, flexibility, reliability, and scalability of Internet Explorer and the apps that rely on the Windows Internet (WinINet) cache. Our new database design stops multiple clients from simultaneously accessing and using cached information, while also providing a higher level of data integrity. -You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](http://go.microsoft.com/fwlink/p/?LinkId=401544). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

**Note**
Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Windows Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](http://go.microsoft.com/fwlink/p/?LinkId=401545). +You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](https://go.microsoft.com/fwlink/p/?LinkId=401544). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

**Note**
Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Windows Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](https://go.microsoft.com/fwlink/p/?LinkId=401545). To get the best results while using roaming profiles, we strongly recommend the following: diff --git a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md index 90e7030ed4..fdd8ac9361 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md @@ -1,16 +1,36 @@ --- -title: Change history for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -description: This topic lists new and updated topics in the Internet Explorer 11 documentation for Windows 10 and Windows 10 Mobile. -ms.prod: ie11 +localizationpriority: low +title: Change history for Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) +description: This topic lists new and updated topics in the Internet Explorer 11 Deployment Guide documentation for Windows 10 and Windows 10 Mobile. ms.mktglfcycl: deploy +ms.prod: ie11 ms.sitesec: library --- + # Change history for Internet Explorer 11 This topic lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile. -## May 2016 - +## August 2016 |New or changed topic | Description | |----------------------|-------------| -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. | \ No newline at end of file +|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | + +## July 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to include the comprehensive list of Group Policies that were added with Internet Explorer 11. | + +## June 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated with 2 new policies, Send all sites not included in the Enterprise Mode Site List to Microsoft Edge and Show message when opening sites in Microsoft Edge using Enterprise Mode. | + + +## May 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. | + diff --git a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md index 0428d2e62b..846ede6863 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md +++ b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: appcompat description: You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. -ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: appcompat +ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df title: Check for a new Enterprise Mode site list xml file (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Check for a new Enterprise Mode site list xml file **Applies to:** diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md index 1ad3d887f4..ccf72489f1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md @@ -1,13 +1,15 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy description: Choose how to deploy Internet Explorer 11 (IE11) -ms.assetid: 21b6a301-c222-40bc-ad0b-27f66fc54d9d author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library +ms.assetid: 21b6a301-c222-40bc-ad0b-27f66fc54d9d title: Choose how to deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Choose how to deploy Internet Explorer 11 (IE11) In this section, you can learn about how to deploy your custom version of Internet Explorer using Automatic Version Synchronization (AVS) or using your software distribution tools. diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md index fa044bc3ce..cf90d5c6b3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md @@ -1,13 +1,15 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy description: Choose how to install Internet Explorer 11 (IE11) -ms.assetid: 9572f5f1-5d67-483e-bd63-ffea95053481 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library +ms.assetid: 9572f5f1-5d67-483e-bd63-ffea95053481 title: Choose how to install Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Choose how to install Internet Explorer 11 (IE11) Before you install Internet Explorer 11, you should: @@ -15,13 +17,13 @@ Before you install Internet Explorer 11, you should: - **Check vendor support for updated functionality.** Check whether third-party vendors have new versions or updates to necessary add-ons, apps, or code libraries. -- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](http://go.microsoft.com/fwlink/p/?LinkId=214251) site. +- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214251) site. - **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. - - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](http://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](http://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](http://go.microsoft.com/fwlink/p/?linkid=276667). + - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://go.microsoft.com/fwlink/p/?linkid=276667). - - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](http://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](http://go.microsoft.com/fwlink/p/?LinkId=276669). + - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index a5b982f662..22d411f58d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -1,11 +1,12 @@ --- -description: Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. -ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6 -ms.prod: ie11 +localizationpriority: low ms.mktglfcycl: deploy -ms.sitesec: library +description: Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. author: eross-msft +ms.prod: ie11 +ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6 title: Collect data using Enterprise Site Discovery +ms.sitesec: library --- # Collect data using Enterprise Site Discovery @@ -23,7 +24,7 @@ Before you start, you need to make sure you have the following: - Latest cumulative security update (for all supported versions of Internet Explorer): - 1. Go to the [Microsoft Security Bulletin](http://go.microsoft.com/fwlink/p/?LinkID=718223) page, and change the filter to **Windows Internet Explorer 11**. + 1. Go to the [Microsoft Security Bulletin](https://go.microsoft.com/fwlink/p/?LinkID=718223) page, and change the filter to **Windows Internet Explorer 11**. ![microsoft security bulletin techcenter](images/securitybulletin-filter.png) @@ -33,7 +34,7 @@ Before you start, you need to make sure you have the following: 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. -- [Setup and configuration package](http://go.microsoft.com/fwlink/p/?LinkId=517719), including: +- [Setup and configuration package](https://go.microsoft.com/fwlink/p/?LinkId=517719), including: - Configuration-related PowerShell scripts @@ -62,9 +63,50 @@ Data is collected on the configuration characteristics of IE and the sites it br |Number of visits | X | X | X | X |Number of times a site has been visited. | |Zone | X | X | X | X |Zone used by IE to browse sites, based on browser settings. | -

**Important**
By default, IE doesn’t collect this data; you have to turn this feature on if you want to use it. After you turn on this feature, data is collected on all sites visited by IE, except during InPrivate sessions. -The data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. +>**Important**
By default, IE doesn’t collect this data; you have to turn this feature on if you want to use it. After you turn on this feature, data is collected on all sites visited by IE, except during InPrivate sessions. Additionally, the data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. + +### Understanding the returned reason codes +The following tables provide more info about the Document mode reason, Browser state reason, and the Zone codes that are returned as part of your data collection. + +#### DocMode reason +The codes in this table can tell you what document mode was set by IE for a webpage.
These codes only apply to Internet Explorer 10 and Internet Explorer 11. + +|Code |Description | +|-----|------------| +|3 |Page state is set by the `FEATURE_DOCUMENT_COMPATIBLE_MODE` feature control key.| +|4 |Page is using an X-UA-compatible meta tag. | +|5 |Page is using an X-UA-compatible HTTP header. | +|6 |Page appears on an active **Compatibility View** list. | +|7 |Page is using native XML parsing. | +|9 |Page is using a special Quirks Mode Emulation (QME) mode that uses the modern layout engine, but the quirks behavior of Internet Explorer 5. | + +#### Browser state reason +The codes in this table can tell you why the browser is in its current state. Also called “browser mode”.
These codes only apply to Internet Explorer 10 and Internet Explorer 11. + +|Code |Description | +|-----|------------| +|1 |Site is on the intranet, with the **Display intranet sites in Compatibility View** box checked. | +|2 |Site appears on an active **Compatibility View** list, created in Group Policy. | +|3 |Site appears on an active **Compatibility View** list, created by the user. | +|4 |Page is using an X-UA-compatible tag. | +|5 |Page state is set by the **Developer** toolbar. | +|6 |Page state is set by the `FEATURE_BROWSER_EMULATION` feature control key. | +|7 |Site appears on the Microsoft **Compatibility View (CV)** list. | +|8 |Site appears on the **Quirks** list, created in Group Policy. | +|11 |Site is using the default browser. | + +#### Zone +The codes in this table can tell you what zone is being used by IE to browse sites, based on browser settings.
These codes apply to Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11. + +|Code |Description | +|-----|------------| +|-1 |Internet Explorer is using an invalid zone. | +|0 |Internet Explorer is using the Local machine zone. | +|1 |Internet Explorer is using the Local intranet zone. | +|2 |Internet Explorer is using the Trusted sites zone. | +|3 |Internet Explorer is using the Internet zone. | +|4 |Internet Explorer is using the Restricted sites zone. | ## Where is the data stored and how do I collect it? The data is stored locally, in an industry-standard WMI class, .MOF file or in an XML file, depending on your configuration. This file remains on the client computer until it’s collected. To collect the files, we recommend: @@ -76,8 +118,9 @@ The data is stored locally, in an industry-standard WMI class, .MOF file or in a ## WMI Site Discovery suggestions We recommend that you collect your data for at most a month at a time, to capture a user’s typical workflow. We don’t recommend collecting data longer than that because the data is stored in a WMI provider and can fill up your computer’s hard drive. You may also want to collect data only for pilot users or a representative sample of people, instead of turning this feature on for everyone in your company. -On average, a website generates about 250bytes of data for each visit, causing only a minor impact to Internet Explorer’s performance. Over the course of a month, collecting data from 20 sites per day from 1,000 users, you’ll get about 150MB of data:
\[250bytes (per site visit) \* 20sites/day\* 30days = (approximately) 150KB \*1000users = (approximately) 150MB\]. -

**Important**
The data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. +On average, a website generates about 250bytes of data for each visit, causing only a minor impact to Internet Explorer’s performance. Over the course of a month, collecting data from 20 sites per day from 1,000 users, you’ll get about 150MB of data:

250 bytes (per site visit) X 20 sites/day X 30 days = (approximately) 150KB X 1000 users = (approximately) 150MB + +>**Important**
The data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. ## Getting ready to use Enterprise Site Discovery Before you can start to collect your data, you must run the provided PowerShell script (IETelemetrySetUp.ps1) on your client devices to start generating the site discovery data and to set up a place to store this data locally. Then, you must start collecting the site discovery data from the client devices, using one of these three options: @@ -90,16 +133,17 @@ Before you can start to collect your data, you must run the provided PowerShell ### WMI only: Running the PowerShell script to compile the .MOF file and to update security privileges You need to set up your computers for data collection by running the provided PowerShell script (IETelemetrySetUp.ps1) to compile the .mof file and to update security privileges for the new WMI classes. -

**Important**
You must run this script if you’re using WMI as your data output. It's not necessary if you're using XML as your data output. -![](images/wedge.gif) **To set up Enterprise Site Discovery** +>**Important**
You must run this script if you’re using WMI as your data output. It's not necessary if you're using XML as your data output. -- Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETElemetrySetUp.ps1`. For more info, see [about Execution Policies](http://go.microsoft.com/fwlink/p/?linkid=517460). +**To set up Enterprise Site Discovery** + +- Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETElemetrySetUp.ps1`. For more info, see [about Execution Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). ### WMI only: Set up your firewall for WMI data If you choose to use WMI as your data output, you need to make sure that your WMI data can travel through your firewall for the domain. If you’re sure, you can skip this section; otherwise, follow these steps: -![](images/wedge.gif) **To set up your firewall** +**To set up your firewall** 1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. @@ -109,65 +153,107 @@ If you choose to use WMI as your data output, you need to make sure that your WM ## Use PowerShell to finish setting up Enterprise Site Discovery You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). -

**Important**
The .ps1 file updates turn on Enterprise Site Discovery and WMI collection for all users on a device. + +>**Important**
The .ps1 file updates turn on Enterprise Site Discovery and WMI collection for all users on a device. - **Domain allow list.** If you have a domain allow list, a comma-separated list of domains that should have this feature turned on, you should use this process. - **Zone allow list.** If you have a zone allow list, a comma-separated list of zones that should have this feature turned on, you should use this process. - ![](images/wedge.gif) **To set up data collection using a domain allow list** +**To set up data collection using a domain allow list** - Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1, using this command: `.\IETElemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. - **Important**
Wildcards, like \*.microsoft.com, aren’t supported. + >**Important**
Wildcards, like \*.microsoft.com, aren’t supported. - ![](images/wedge.gif) **To set up data collection using a zone allow list** +**To set up data collection using a zone allow list** - Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1, using this command: `.\IETElemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. - **Important**
Only Computer, Intranet, TrustedSites, Internet, and RestrictedSites are supported. + >**Important**
Only Computer, Intranet, TrustedSites, Internet, and RestrictedSites are supported. ## Use Group Policy to finish setting up Enterprise Site Discovery You can use Group Policy to finish setting up Enterprise Site Discovery. If you don’t want to use Group Policy, you can do this using PowerShell. For more info, see [Use Powershell to finish setting up Enterprise Site Discovery](#use-powershell-to-finish-setting-up-enterprise-site-discovery). -

**Note**
 All of the Group Policy settings can be used individually or as a group. - ![](images/wedge.gif) **To set up Enterprise Site Discovery using Group Policy** +>**Note**
 All of the Group Policy settings can be used individually or as a group. + + **To set up Enterprise Site Discovery using Group Policy** - Open your Group Policy editor, and go to these new settings: -|Setting name and location |Description |Options | -|---------------------------|-------------|---------| -|Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output |Writes collected data to a WMI class, which can be aggregated using a client-management solution like Configuration Manager. |

| -|Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery XML output |Writes collected data to an XML file, which is stored in your specified location. | | -|Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by Zone |Manages which zone can collect data. |To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

0 – Restricted Sites zone
0 – Internet zone
0 – Trusted Sites zone
0 – Local Intranet zone
0 – Local Machine zone

**Example 1:** Include only the Local Intranet zone

Binary representation: *00010*, based on:

0 – Restricted Sites zone
0 – Internet zone
0 – Trusted Sites zone
1 – Local Intranet zone
0 – Local Machine zone

**Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones

Binary representation: *10110*, based on:

1 – Restricted Sites zone
0 – Internet zone
1 – Trusted Sites zone
1 – Local Intranet zone
1 – Local Machine zone | -|Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by domain |Manages which domains can collect data |To specify which domains can collect data, you must include your selected domains, one domain per line, in the provided box. It should look like:

microsoft.sharepoint.com
outlook.com
onedrive.com
timecard.contoso.com
LOBApp.contoso.com | + |Setting name and location |Description |Options | + |---------------------------|-------------|---------| + |Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output |Writes collected data to a WMI class, which can be aggregated using a client-management solution like Configuration Manager. |

| + |Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery XML output |Writes collected data to an XML file, which is stored in your specified location. | | + |Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by Zone |Manages which zone can collect data. |To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

0 – Restricted Sites zone
0 – Internet zone
0 – Trusted Sites zone
0 – Local Intranet zone
0 – Local Machine zone

**Example 1:** Include only the Local Intranet zone

Binary representation: *00010*, based on:

0 – Restricted Sites zone
0 – Internet zone
0 – Trusted Sites zone
1 – Local Intranet zone
0 – Local Machine zone

**Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones

Binary representation: *10110*, based on:

1 – Restricted Sites zone
0 – Internet zone
1 – Trusted Sites zone
1 – Local Intranet zone
1 – Local Machine zone | + |Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by domain |Manages which domains can collect data |To specify which domains can collect data, you must include your selected domains, one domain per line, in the provided box. It should look like:

microsoft.sharepoint.com
outlook.com
onedrive.com
timecard.contoso.com
LOBApp.contoso.com | ### Combining WMI and XML Group Policy settings -You can use both the WMI and XML settings individually or together, based on: +You can use both the WMI and XML settings individually or together: - ![](images/wedge.gif) **To turn off Enterprise Site Discovery** -

+**To turn off Enterprise Site Discovery** + + + + + + + + + + + + + +
Setting nameOption
Turn on Site Discovery WMI outputOff
Turn on Site Discovery XML outputBlank
- ![](images/wedge.gif) **To turn on WMI recording only** - +**Turn on WMI recording only** + + + + + + + + + + + + + +
Setting nameOption
Turn on Site Discovery WMI outputOn
Turn on Site Discovery XML outputBlank
- ![](images/wedge.gif) **To turn on XML recording only** - +**To turn on XML recording only** + + + + + + + + + + + + + +
Setting nameOption
Turn on Site Discovery WMI outputOff
Turn on Site Discovery XML outputXML file path
- ![](images/wedge.gif) **To turn on both WMI and XML recording** - +**To turn on both WMI and XML recording** + + + + + + + + + + + + + +
Setting nameOption
Turn on Site Discovery WMI outputOn
Turn on Site Discovery XML outputXML file path
## Use Configuration Manager to collect your data After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options: @@ -181,7 +267,7 @@ After you’ve collected your data, you’ll need to get the local files off of ### Collect your hardware inventory using the MOF Editor while connected to a client device You can collect your hardware inventory using the MOF Editor, while you’re connected to your client devices. - ![](images/wedge.gif) **To collect your inventory** + **To collect your inventory** 1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. @@ -207,7 +293,7 @@ Your environment is now ready to collect your hardware inventory and review the ### Collect your hardware inventory using the MOF Editor with a .MOF import file You can collect your hardware inventory using the MOF Editor and a .MOF import file. - ![](images/wedge.gif) **To collect your inventory** + **To collect your inventory** 1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. @@ -221,7 +307,7 @@ Your environment is now ready to collect your hardware inventory and review the ### Collect your hardware inventory using the SMS\DEF.MOF file (System Center Configuration Manager 2007 only) You can collect your hardware inventory using the using the Systems Management Server (SMS\DEF.MOF) file. Editing this file lets you collect your data for System Center Configuration Manager 2007. If you aren’t using this version of Configuration Manager, you won’t want to use this option. - ![](images/wedge.gif) **To collect your inventory** +**To collect your inventory** 1. Using a text editor like Notepad, open the SMS\DEF.MOF file, located in your `\inboxes\clifiles.src\hinv` directory. @@ -289,8 +375,8 @@ You can collect your hardware inventory using the using the Systems Management S }; ``` -3. Save the file and close it to the same location.
-Your environment is now ready to collect your hardware inventory and review the sample reports. +3. Save the file and close it to the same location. + Your environment is now ready to collect your hardware inventory and review the sample reports. ## View the sample reports with your collected data The sample reports, **SCCM Report Sample – ActiveX.rdl** and **SCCM Report Sample – Site Discovery.rdl**, work with System Center 2012, so you can review your collected data. @@ -337,26 +423,27 @@ After the XML files are created, you can use your own solutions to extract and p ``` You can import this XML data into the correct version of the Enterprise Mode Site List Manager, automatically adding the included sites to your Enterprise Mode site list. - ![](images/wedge.gif) **To add your XML data to your Enterprise Mode site list** +**To add your XML data to your Enterprise Mode site list** 1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. -![Enterprise Mode Site List Manager with Bulk add from file option](images/bulkadd-emiesitelistmgr.png) -2. Go to your XML file to add the included sites to the tool, and then click **Open**.
-Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). + ![Enterprise Mode Site List Manager with Bulk add from file option](images/bulkadd-emiesitelistmgr.png) + +2. Go to your XML file to add the included sites to the tool, and then click **Open**.
Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). 3. Click **OK** to close the **Bulk add sites to the list** menu. ## Turn off data collection on your client devices After you’ve collected your data, you’ll need to turn Enterprise Site Discovery off. - ![](images/wedge.gif) **To stop collecting data, using PowerShell** +**To stop collecting data, using PowerShell** -- On your client computer, start Windows PowerShell in elevated mode (using admin privileges) and run `IETelemetrySetUp.ps1`, using this command: `powershell -ExecutionPolicy Bypass .\IETElemetrySetUp.ps1 –IEFeatureOff`.

**Note**
-Turning off data collection only disables the Enterprise Site Discovery feature – all data already written to WMI stays on your employee’s computer. +- On your client computer, start Windows PowerShell in elevated mode (using admin privileges) and run `IETelemetrySetUp.ps1`, using this command: `powershell -ExecutionPolicy Bypass .\IETElemetrySetUp.ps1 –IEFeatureOff`. -   - ![](images/wedge.gif) **To stop collecting data, using Group Policy** + >**Note**
Turning off data collection only disables the Enterprise Site Discovery feature – all data already written to WMI stays on your employee’s computer. + + +**To stop collecting data, using Group Policy** 1. Open your Group Policy editor, go to `Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output`, and click **Off**. @@ -365,7 +452,7 @@ Turning off data collection only disables the Enterprise Site Discovery feature ### Delete already stored data from client computers You can completely remove the data stored on your employee’s computers. - ![](images/wedge.gif) **To delete all existing data** +**To delete all existing data** - On the client computer, start PowerShell in elevated mode (using admin privileges) and run these four commands: @@ -377,8 +464,8 @@ You can completely remove the data stored on your employee’s computers. - `Remove-Item -Path 'HKCU:\Software\Microsoft\Internet Explorer\WMITelemetry'` - ## Related topics -* [Enterprise Mode Site List Manager (schema v.2) download](http://go.microsoft.com/fwlink/?LinkId=746562) +## Related topics +* [Enterprise Mode Site List Manager (schema v.2) download](https://go.microsoft.com/fwlink/?LinkId=746562) * [Enterprise Mode for Internet Explorer 11 (IE11)](enterprise-mode-overview-for-ie11.md)   diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md index 33f573e4ba..1d2df29b8f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md @@ -1,13 +1,15 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy description: Create packages for multiple operating systems or languages -ms.assetid: 44051f9d-63a7-43bf-a427-d0a0a1c717da author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library +ms.assetid: 44051f9d-63a7-43bf-a427-d0a0a1c717da title: Create packages for multiple operating systems or languages (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Create packages for multiple operating systems or languages You'll create multiple versions of your custom browser package if: diff --git a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md index b2e068e5f8..7a8162ee05 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md @@ -1,13 +1,15 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy description: Customize Internet Explorer 11 installation packages -ms.assetid: 10a14a09-673b-4f8b-8d12-64036135e7fd author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library +ms.assetid: 10a14a09-673b-4f8b-8d12-64036135e7fd title: Customize Internet Explorer 11 installation packages (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Customize Internet Explorer 11 installation packages You can customize Internet Explorer 11 to support various browser behaviors, multiple operating system versions and languages, and Setup information (.inf) files. @@ -26,7 +28,7 @@ In addition, you can configure IE before, during, or after deployment, using the - **Group Policy**. Configures and enforces IE11 settings. For more information about settings and configuration options, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). - **Unattend.xml**. Customizes some of the IE settings during your Windows installation. This option only applies if you're updating a Windows image with IE11.

**Note**
-You'll only see the new IE11 Unattend.xml settings if your Unattend.xml file's associated with a Windows image that includes the IE11 update. For more information about editing and using the Unattend.xml file, see [Unattended Windows Setup Reference](http://go.microsoft.com/fwlink/p/?LinkId=276788). For more information about using the Windows System Image Manager, see [Windows System Image Manager Technical Reference](http://go.microsoft.com/fwlink/p/?LinkId=276789). +You'll only see the new IE11 Unattend.xml settings if your Unattend.xml file's associated with a Windows image that includes the IE11 update. For more information about editing and using the Unattend.xml file, see [Unattended Windows Setup Reference](https://go.microsoft.com/fwlink/p/?LinkId=276788). For more information about using the Windows System Image Manager, see [Windows System Image Manager Technical Reference](https://go.microsoft.com/fwlink/p/?LinkId=276789).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index ab440a2332..360620938d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -1,14 +1,16 @@ --- +localizationpriority: low description: Delete a single site from your global Enterprise Mode site list. -title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a +ms.pagetype: appcompat +ms.mktglfcycl: deploy author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy +ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a +title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library -ms.pagetype: appcompat --- + # Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager **Applies to:** @@ -32,8 +34,8 @@ If you delete a site by mistake, you’ll need to manually add it back using the - [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) ## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](http://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](http://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md)   diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md index e91b8ce485..846a265850 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md @@ -1,12 +1,14 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy description: You can deploy Internet Explorer 11 to your users' computers by using your custom browser packages and Automatic Version Synchronization (AVS). -ms.assetid: f51224bd-3371-4551-821d-1d62310e3384 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library +ms.assetid: f51224bd-3371-4551-821d-1d62310e3384 title: Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) You can deploy Internet Explorer 11 to your users' computers by using your custom browser packages and Automatic Version Synchronization (AVS). diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md index 9ba9bc1914..6654729ec6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md @@ -1,23 +1,25 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy description: Deploy Internet Explorer 11 using software distribution tools -ms.assetid: fd027775-651a-41e1-8ec3-d32eca876d8a author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library +ms.assetid: fd027775-651a-41e1-8ec3-d32eca876d8a title: Deploy Internet Explorer 11 using software distribution tools (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Deploy Internet Explorer 11 using software distribution tools If you already manage software distribution and updates on your network through software distribution tools, you can also use these tools for ongoing deployments of Internet Explorer. Software distribution tools include: -- **System Center R2 2012 System Center 2012 R2 Configuration Manager.** Deploy and install Internet Explorer 11 on your user's computers through a software distribution package. For more information about using this tool, see [System Center R2 2012 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkID=276664). +- **System Center R2 2012 System Center 2012 R2 Configuration Manager.** Deploy and install Internet Explorer 11 on your user's computers through a software distribution package. For more information about using this tool, see [System Center R2 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664). -- **Windows Server Update Services (WSUS).** Download a single copy of the IE11 updates, caching them to local servers so your users' computers can receive the updates directly from the WSUS servers, instead of through Windows Update. For more information about using this tool, see [Windows Server Update Services](http://go.microsoft.com/fwlink/p/?LinkID=276790). +- **Windows Server Update Services (WSUS).** Download a single copy of the IE11 updates, caching them to local servers so your users' computers can receive the updates directly from the WSUS servers, instead of through Windows Update. For more information about using this tool, see [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790). -- **Group Policy Software Installation.** Deploy and install IE11 on your user's computers through a combination of Group Policy and Microsoft Active Directory. For more information about using this tool, see [Group Policy Software Installation overview](http://go.microsoft.com/fwlink/p/?LinkId=296365). +- **Group Policy Software Installation.** Deploy and install IE11 on your user's computers through a combination of Group Policy and Microsoft Active Directory. For more information about using this tool, see [Group Policy Software Installation overview](https://go.microsoft.com/fwlink/p/?LinkId=296365). -- **Microsoft Deployment Toolkit (MDT).** Add the IE11 update to your deployment share, using MDT to update your previously-deployed Windows image. For more information about using this tool, see [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkID=331148). +- **Microsoft Deployment Toolkit (MDT).** Add the IE11 update to your deployment share, using MDT to update your previously-deployed Windows image. For more information about using this tool, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkID=331148).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md index cf0f73e234..affd42d162 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md @@ -1,13 +1,15 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy description: You can pin websites to the Windows 8.1 taskbar for quick access using the Microsoft Deployment Toolkit (MDT) 2013. -ms.assetid: 24f4dcac-9032-4fe8-bf6d-2d712d61cb0c author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library +ms.assetid: 24f4dcac-9032-4fe8-bf6d-2d712d61cb0c title: Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 **Applies to:** @@ -20,10 +22,10 @@ title: Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 (Int You can pin websites to the Windows 8.1 taskbar for quick access. You pin a website simply by dragging its tab to the taskbar. Some websites can also extend the icon’s Jump List. -The ability to pin websites to the Windows 8.1 taskbar can help make end users in businesses more productive. As an IT professional, for example, you can pin intranet and SharePoint websites to the taskbar to make them immediately available to users. In this article, you learn how to deploy pinned websites by using Lite Touch Installation in the [Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=398474). +The ability to pin websites to the Windows 8.1 taskbar can help make end users in businesses more productive. As an IT professional, for example, you can pin intranet and SharePoint websites to the taskbar to make them immediately available to users. In this article, you learn how to deploy pinned websites by using Lite Touch Installation in the [Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=398474). ## Deploying pinned websites in MDT 2013 -This topic requires that you have a complete MDT 2013 deployment share that contains Windows 8.1 which comes with Internet Explorer 11. If you’re deploying to Windows 7 clients and need to learn how to add IE11 to an MDT 2013 deployment share as an update, see [Installing Internet Explorer 11 using Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=398475) in the TechNet library. +This topic requires that you have a complete MDT 2013 deployment share that contains Windows 8.1 which comes with Internet Explorer 11. If you’re deploying to Windows 7 clients and need to learn how to add IE11 to an MDT 2013 deployment share as an update, see [Installing Internet Explorer 11 using Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=398475) in the TechNet library. Deploying pinned websites in MDT 2013 is a 4-step process: @@ -99,13 +101,13 @@ With the .website files ready to copy to the **Public Links** folder on target c ## Updating intranet websites for pinning The MDT 2013 deployment share and task sequences are now ready to pin websites to the taskbar during deployment. This pinning feature can include intranet sites important in your organization. -You can make your intranet websites act more like applications by extending them to fully support the Windows 8.1 taskbar. This includes creating custom Jump Lists, thumbnail previews, and notifications. For info about extending your intranet websites, see [Pinned Sites Developer Documentation](http://go.microsoft.com/fwlink/p/?LinkId=398484) on MSDN. For more ideas about what to pin, see [Add-ons](http://go.microsoft.com/fwlink/p/?LinkId=398483) in the Internet Explorer Gallery. +You can make your intranet websites act more like applications by extending them to fully support the Windows 8.1 taskbar. This includes creating custom Jump Lists, thumbnail previews, and notifications. For info about extending your intranet websites, see [Pinned Sites Developer Documentation](https://go.microsoft.com/fwlink/p/?LinkId=398484) on MSDN. For more ideas about what to pin, see [Add-ons](https://go.microsoft.com/fwlink/p/?LinkId=398483) in the Internet Explorer Gallery. ## Related topics -- [Unattended Windows Setup Reference](http://go.microsoft.com/fwlink/p/?LinkId=276788) -- [Windows System Image Manager Technical Reference](http://go.microsoft.com/fwlink/p/?LinkId=276789) -- [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=331148) -- [Windows ADK Overview](http://go.microsoft.com/fwlink/p/?LinkId=276669) +- [Unattended Windows Setup Reference](https://go.microsoft.com/fwlink/p/?LinkId=276788) +- [Windows System Image Manager Technical Reference](https://go.microsoft.com/fwlink/p/?LinkId=276789) +- [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148) +- [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669)   diff --git a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md index 77ad3c2aea..0be45f20c1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: appcompat description: Windows Internet Explorer 8 introduced document modes as a way to move from the proprietary coding of web features to a more standardized type of coding that could run on multiple browsers and devices. -ms.assetid: 00cb1f39-2b20-4d37-9436-62dc03a6320b author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: appcompat +ms.assetid: 00cb1f39-2b20-4d37-9436-62dc03a6320b title: Deprecated document modes and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Deprecated document modes and Internet Explorer 11 **Applies to:** @@ -24,7 +26,7 @@ Windows Internet Explorer 8 introduced document modes as a way to move from the This means that while Internet Explorer 11 will continue to support document modes, Microsoft Edge won’t. And because of that, it also means that if you want to use Microsoft Edge, you’re going to have to update your legacy webpages and apps to support modern features, browsers, and devices. **Note**
-For specific details about the technologies and APIs that are no longer supported in Microsoft Edge, see [A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent](http://go.microsoft.com/fwlink/p/?LinkId=615953). +For specific details about the technologies and APIs that are no longer supported in Microsoft Edge, see [A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent](https://go.microsoft.com/fwlink/p/?LinkId=615953). ## What is document mode? Each release after Internet Explorer 8 has helped with the transition by introducing additional document modes that emulated previously supported versions, while also introducing support for features defined by industry standards. During this time, numerous websites and apps were updated to the latest and greatest industry standards, while many other sites and apps continued to simply rely on document modes to work properly. diff --git a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md index 2df84a765e..7ebacccb8b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: appcompat description: You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. -ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: appcompat +ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea title: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager **Applies to:** @@ -36,8 +38,8 @@ If your change passes validation, it’s added to the global site list. If the u You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). ## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](http://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](http://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md)   diff --git a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md index ee46784821..4a7966faaa 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: security description: Enable and disable add-ons using administrative templates and group policy -ms.assetid: c6fe1cd3-0bfc-4d23-8016-c9601f674c0b author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security +ms.assetid: c6fe1cd3-0bfc-4d23-8016-c9601f674c0b title: Enable and disable add-ons using administrative templates and group policy (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Enable and disable add-ons using administrative templates and group policy Add-ons let your employees personalize Internet Explorer. You can manage IE add-ons using Group Policy and Group Policy templates. diff --git a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md index 9d30f3ba62..971612c41b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md @@ -1,20 +1,22 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: security description: Enhanced Protected Mode problems with Internet Explorer -ms.assetid: 15890ad1-733d-4f7e-a318-10399b389f45 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security +ms.assetid: 15890ad1-733d-4f7e-a318-10399b389f45 title: Enhanced Protected Mode problems with Internet Explorer (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Enhanced Protected Mode problems with Internet Explorer Enhanced Protected Mode further restricts Protected Mode to deny potential attackers access to sensitive or personal information. If this feature is turned on, users might start to see errors asking them to turn it off, like **This webpage wants to run "npctrl.dll. If you trust this site, you can disable Enhanced Protected Mode for this site to run the control**. If your users click the **Disable** box, Enhanced Protected Mode is turned off for only the single visit to that specific site. After the user leaves the site, Enhanced Protected Mode is automatically turned back on. You can use your company’s Group Policy to turn Enhanced Protected Mode on or off for all users. For more information, see the [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md) information in this guide. -For more information about Enhanced Protected Mode, see the [Enhanced Protected Mode](http://go.microsoft.com/fwlink/p/?LinkId=267512) post on IEBlog, and both the [Understanding Enhanced Protected Mode](http://go.microsoft.com/fwlink/p/?LinkId=282662) and the [Enhanced Protected Mode and Local Files](http://go.microsoft.com/fwlink/p/?LinkId=282663) blog posts on IEInternals. +For more information about Enhanced Protected Mode, see the [Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=267512) post on IEBlog, and both the [Understanding Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=282662) and the [Enhanced Protected Mode and Local Files](https://go.microsoft.com/fwlink/p/?LinkId=282663) blog posts on IEInternals.   diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md index 50970689b7..1624192493 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: appcompat description: Use the topics in this section to learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. -ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: appcompat +ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e title: Enterprise Mode for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Enterprise Mode for Internet Explorer 11 **Applies to:** diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md index 1e91d25a85..e78df6c4c1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md @@ -1,20 +1,23 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: appcompat description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 7 or Windows 8.1 Update. -ms.assetid: 17c61547-82e3-48f2-908d-137a71938823 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: appcompat +ms.assetid: 17c61547-82e3-48f2-908d-137a71938823 title: Enterprise Mode schema v.1 guidance (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Enterprise Mode schema v.1 guidance **Applies to:** -- Windows 8.1 -- Windows 7 +- Windows 10 +- Windows 8.1 +- Windows 7 Use the Enterprise Mode Site List Manager (schema v.1) to create and update your Enterprise Mode site list for devices running the v.1 version of the schema, or the Enterprise Mode Site List Manager (schema v.2) to create and update your Enterprise Mode site list for devices running the v.2 version of the schema. We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). @@ -84,7 +87,19 @@ This table includes the elements used by the Enterprise Mode schema. <emie> <domain>contoso.com</domain> </emie> -</rules>> +</rules> +-or- +

For IPv6 ranges:

<rules version="205">
+  <emie>
+    <domain>[10.122.34.99]:8080</domain>
+  </emie>
+  </rules>
+-or- +

For IPv4 ranges:

<rules version="205">
+  <emie>
+    <domain>10.122.34.99:8080</domain>
+  </emie>
+  </rules>
Internet Explorer 11 and Microsoft Edge @@ -189,7 +204,6 @@ For example, say you want all of the sites in the contoso.com domain to open usi We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: - Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing. - Don’t use wildcards. -- Don't use IP Addresses. - Don’t use query strings, ampersands break parsing. ## How to use trailing slashes diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md index 88ee4fb670..5c003a24c1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md @@ -1,14 +1,16 @@ --- +localizationpriority: low +ms.mktglfcycl: deploy +ms.pagetype: appcompat description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 10. -ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5 author: eross-msft ms.prod: ie11 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: appcompat +ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5 title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros) +ms.sitesec: library --- + # Enterprise Mode schema v.2 guidance **Applies to:** @@ -116,7 +118,15 @@ This table includes the elements used by the v.2 version of the Enterprise Mode <site url="contoso.com"> <compat-mode>default</compat-mode> <open-in>none</open-in> -</site>

+</site> +-or- +

For IPv4 ranges:

<site url="10.122.34.99:8080">
+  <compat-mode>IE8Enterprise</compat-mode>
+<site>

+-or- +

For IPv6 ranges:

<site url="[10.122.34.99]:8080">
+  <compat-mode>IE8Enterprise</compat-mode>
+<site>

You can also use the self-closing version, <url="contoso.com" />, which also sets:

@@ -230,7 +230,7 @@ If the system requirements of a locally installed application exceed the require

  • Download and install [KB2533623](http://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)

    • -

  • For computers running Microsoft Windows Server 2008 R2 SP1, download and install [KB2533623](http://go.microsoft.com/fwlink/?LinkId=286102 ) (http://go.microsoft.com/fwlink/?LinkId=286102)

    +

  • For computers running Microsoft Windows Server 2008 R2 SP1, download and install [KB2533623](https://go.microsoft.com/fwlink/?LinkId=286102 ) (https://go.microsoft.com/fwlink/?LinkId=286102)

    Important   @@ -313,7 +313,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve  

  • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x64)](http://www.microsoft.com/download/details.aspx?id=13523) (http://www.microsoft.com/download/details.aspx?id=13523)

    • -

  • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](http://go.microsoft.com/fwlink/?LinkId=267110) (http://go.microsoft.com/fwlink/?LinkId=267110)

    • +

  • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=267110) (https://go.microsoft.com/fwlink/?LinkId=267110)

  • 64-bit ASP.NET registration

    • The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management server.

    @@ -345,7 +345,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve

    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management database.

    Reporting Server

    +

    Note: 4, 5, and 6 were added as of Windows 10, version 1607.

    + InstanceIdentifier @@ -188,10 +172,15 @@ Table 1. Win32\_DeviceGuard properties This field describes the required security properties to enable virtualization-based security. +

  • 1. If present, hypervisor support is needed.

    • +

  • 2. If present, Secure Boot is needed.

    • +

  • 3. If present, DMA protection is needed.

    • +

  • 4. If present, Secure Memory Overwrite is needed.

    • +

  • 5. If present, NX protections are needed.

    • +

  • 6. If present, SMM mitigations are needed.

    • + +

    Note: 4, 5, and 6 were added as of Windows 10, version 1607.

    + SecurityServicesConfigured @@ -233,11 +222,11 @@ Table 1. Win32\_DeviceGuard properties -Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 11. +Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 6. ![Device Guard properties in the System Summary](images/dg-fig11-dgproperties.png) -Figure 11. Device Guard properties in the System Summary +Figure 6. Device Guard properties in the System Summary ## Related topics diff --git a/windows/keep-secure/deploy-edp-policy-using-intune.md b/windows/keep-secure/deploy-edp-policy-using-intune.md index 7b23a44cf2..c9528077e0 100644 --- a/windows/keep-secure/deploy-edp-policy-using-intune.md +++ b/windows/keep-secure/deploy-edp-policy-using-intune.md @@ -1,50 +1,5 @@ --- title: Deploy your enterprise data protection (EDP) policy using Microsoft Intune (Windows 10) description: After you’ve created your enterprise data protection (EDP) policy, you'll need to deploy it to your organization's enrolled devices. -ms.assetid: 9c4a01e7-0b1c-4f15-95d0-0389f0686211 -keywords: EDP, Enterprise Data Protection, Intune -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -author: eross-msft ---- - -# Deploy your enterprise data protection (EDP) policy using Microsoft Intune -**Applies to:** - -- Windows 10 Insider Preview -- Windows 10 Mobile Preview - -[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -After you’ve created your enterprise data protection (EDP) policy, you'll need to deploy it to your organization's enrolled devices. Enrollment can be done for business or personal devices, allowing the devices to use your managed apps and to sync with your managed content and information. - -**To deploy your EDP policy** - -1. On the **Configuration policies** page, locate your newly-created policy, click to select it, and then click the **Manage Deployment** button. - - ![Microsoft Intune: Click the Manage Deployment link from the Configuration Policies screen](images/intune-managedeployment.png) - -2. In the left pane of the **Manage Deployment** box, click the employees or groups that should get the policy, and then click **Add**.

    -The added people move to the **Selected Groups** list on the right-hand pane. - - ![Microsoft Intune: Pick the group of employees that should get the policy](images/intune-groupselection.png) - -3. After you've picked all of the employees and groups that should get the policy, click **OK**.

    -The policy is deployed to the selected users' devices. - -## Related topics -- [Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) --[Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) -- [Create and deploy a VPN policy for enterprise data protection (EDP) using Microsoft Intune](create-vpn-and-edp-policy-using-intune.md) -- [General guidance and best practices for enterprise data protection (EDP)](guidance-and-best-practices-edp.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/deploy-wip-policy-using-intune +--- \ No newline at end of file diff --git a/windows/keep-secure/deploy-wip-policy-using-intune.md b/windows/keep-secure/deploy-wip-policy-using-intune.md new file mode 100644 index 0000000000..075fba2473 --- /dev/null +++ b/windows/keep-secure/deploy-wip-policy-using-intune.md @@ -0,0 +1,40 @@ +--- +title: Deploy your Windows Information Protection (WIP) policy using Microsoft Intune (Windows 10) +description: After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. +ms.assetid: 9c4a01e7-0b1c-4f15-95d0-0389f0686211 +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, Intune +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: eross-msft +localizationpriority: high +--- + +# Deploy your Windows Information Protection (WIP) policy using Microsoft Intune +**Applies to:** + +- Windows 10, version 1607 +- Windows 10 Mobile + +After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. Enrollment can be done for business or personal devices, allowing the devices to use your managed apps and to sync with your managed content and information. + +**To deploy your WIP policy** + +1. On the **Configuration policies** page, locate your newly-created policy, click to select it, and then click the **Manage Deployment** button. + + ![Microsoft Intune: Click the Manage Deployment link from the Configuration Policies screen](images/intune-managedeployment.png) + +2. In the left pane of the **Manage Deployment** box, click the employees or groups that should get the policy, and then click **Add**.

    +The added people move to the **Selected Groups** list on the right-hand pane. + + ![Microsoft Intune: Pick the group of employees that should get the policy](images/intune-groupselection.png) + +3. After you've picked all of the employees and groups that should get the policy, click **OK**.

    +The policy is deployed to the selected users' devices. + +## Related topics +- [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) +- [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) +- [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md) +- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) \ No newline at end of file diff --git a/windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md b/windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md index 144252b206..df45d7bcb2 100644 --- a/windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md +++ b/windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To select the most effective design for helping to protect the network, you must spend time collecting key information about your current computer environment. You must have a good understanding of what tasks the devices on the network perform, and how they use the network to accomplish those tasks. You must understand the network traffic generated by the programs running on the devices. diff --git a/windows/keep-secure/determining-the-trusted-state-of-your-devices.md b/windows/keep-secure/determining-the-trusted-state-of-your-devices.md index 8bbd75608d..01ed85051c 100644 --- a/windows/keep-secure/determining-the-trusted-state-of-your-devices.md +++ b/windows/keep-secure/determining-the-trusted-state-of-your-devices.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After obtaining information about the devices that are currently part of the IT infrastructure, you must determine at what point a device is considered trusted. The term *trusted* can mean different things to different people. Therefore, you must communicate a firm definition for it to all stakeholders in the project. Failure to do this can lead to problems with the security of the trusted environment, because the overall security cannot exceed the level of security set by the least secure client that achieves trusted status. diff --git a/windows/keep-secure/device-guard-certification-and-compliance.md b/windows/keep-secure/device-guard-certification-and-compliance.md index 5e60c5e980..566a6df4da 100644 --- a/windows/keep-secure/device-guard-certification-and-compliance.md +++ b/windows/keep-secure/device-guard-certification-and-compliance.md @@ -1,4 +1,4 @@ --- title: Device Guard certification and compliance (Windows 10) -redirect_url: device-guard-deployment-guide.md +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/device-guard-deployment-guide --- diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index e82f511105..cf8c3bd107 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -5,6 +5,7 @@ ms.assetid: 4BA52AA9-64D3-41F3-94B2-B87EC2717486 keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy +localizationpriority: high author: brianlic-msft --- @@ -14,7 +15,7 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Device Guard can use the new virtualization-based security in Windows 10 Enterprise to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. +Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Device Guard can use the new virtualization-based security in Windows 10 (available in Enterprise and Education desktop SKUs and in all Server SKUs) to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. This guide explores the individual features in Device Guard as well as how to plan for, configure, and deploy them. It includes: diff --git a/windows/keep-secure/documenting-the-zones.md b/windows/keep-secure/documenting-the-zones.md index 88e67e80c4..9c120835e8 100644 --- a/windows/keep-secure/documenting-the-zones.md +++ b/windows/keep-secure/documenting-the-zones.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Generally, the task of determining zone membership is not complex, but it can be time-consuming. Use the information generated during the [Designing a Windows Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) section of this guide to determine the zone in which to put each host. You can document this zone placement by adding a Group column to the inventory table shown in the Designing a Windows Firewall with Advanced Security Strategy section. A sample is shown here: diff --git a/windows/keep-secure/domain-isolation-policy-design-example.md b/windows/keep-secure/domain-isolation-policy-design-example.md index 2bfcf9cbc8..f5cc8ea0f6 100644 --- a/windows/keep-secure/domain-isolation-policy-design-example.md +++ b/windows/keep-secure/domain-isolation-policy-design-example.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This design example continues to use the fictitious company Woodgrove Bank, and builds on the example described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section. See that example for an explanation of the basic corporate network infrastructure at Woodgrove Bank with diagrams. diff --git a/windows/keep-secure/domain-isolation-policy-design.md b/windows/keep-secure/domain-isolation-policy-design.md index da2564242b..6f15c8338f 100644 --- a/windows/keep-secure/domain-isolation-policy-design.md +++ b/windows/keep-secure/domain-isolation-policy-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 In the domain isolation policy design, you configure the devices on your network to accept only connections coming from devices that are authenticated as members of the same isolated domain. diff --git a/windows/keep-secure/dynamic-access-control.md b/windows/keep-secure/dynamic-access-control.md index 643a78aa1c..466562cc90 100644 --- a/windows/keep-secure/dynamic-access-control.md +++ b/windows/keep-secure/dynamic-access-control.md @@ -16,7 +16,7 @@ This overview topic for the IT professional describes Dynamic Access Control and Domain-based Dynamic Access Control enables administrators to apply access-control permissions and restrictions based on well-defined rules that can include the sensitivity of the resources, the job or role of the user, and the configuration of the device that is used to access these resources. -For example, a user might have different permissions when they access a resource from their office computer versus when they are using a portable computer over a virtual private network. Or access may be allowed only if a device meets the security requirements that are defined by the network administrators. When Dynamic Access Control is used, a user’s permissions change dynamically without additional administrator intervention if the user’s job or role changes (resulting in changes to the user’s account attributes in AD DS). +For example, a user might have different permissions when they access a resource from their office computer versus when they are using a portable computer over a virtual private network. Or access may be allowed only if a device meets the security requirements that are defined by the network administrators. When Dynamic Access Control is used, a user’s permissions change dynamically without additional administrator intervention if the user’s job or role changes (resulting in changes to the user’s account attributes in AD DS). For more detailed examples of Dynamic Access Control in use, see the scenarios described in [Dynamic Access Control: Scenario Overview](https://technet.microsoft.com/windows-server-docs/identity/solution-guides/dynamic-access-control--scenario-overview). Dynamic Access Control is not supported in Windows operating systems prior to Windows Server 2012 and Windows 8. When Dynamic Access Control is configured in environments with supported and non-supported versions of Windows, only the supported versions will implement the changes. diff --git a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md index 923334f58b..e3c6cbddf6 100644 --- a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md +++ b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md @@ -6,6 +6,7 @@ ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS +localizationpriority: high --- # Enable phone sign-in to PC or VPN @@ -16,22 +17,26 @@ author: jdeckerMS - Windows 10 - Windows 10 Mobile -In Windows 10, Version 1607, your network users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser. Phone sign-in uses Bluetooth, which means no need to wait for a phone call -- just unlock the phone and tap the app. +In Windows 10, version 1607, your network users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser. Phone sign-in uses Bluetooth, which means no need to wait for a phone call -- just unlock the phone and tap the app. - (add screenshot when I can get the app working) +![Sign in to a device](images/phone-signin-menu.png) + +> [!NOTE] +> Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. You can create a Group Policy or mobile device management (MDM) policy that will allow users to sign in to a work PC or their company's VPN using the credentials stored on their Windows 10 phone. ## Prerequisites - - Both phone and PC must be running Windows 10, Version 1607. + - Both phone and PC must be running Windows 10, version 1607. - The PC must be running Windows 10 Pro, Enterprise, or Education - Both phone and PC must have Bluetooth. + - The **Microsoft Authenticator** app must be installed on the phone. - The PC must be joined to an Active Directory domain that is connected to an Azure Active Directory (Azure AD) domain, or the PC must be joined to Azure AD. - The phone must be joined to Azure AD or have a work account added. - - VPN configuration profile must use certificate-based authentication. + - The VPN configuration profile must use certificate-based authentication. -## Set policies and get the app +## Set policies To enable phone sign-in, you must enable the following policies using Group Policy or MDM. @@ -42,7 +47,16 @@ To enable phone sign-in, you must enable the following policies using Group Poli - Set **UsePassportForWork** to **True** - Set **Remote\UseRemotePassport** to **True** -Everyone can get the **Microsoft Authenticator** app from the Windows Store. If you want to distribute the **Microsoft Authenticator** app, your organization must have set up Windows Store for Business, with Microsoft added as a Line of Business (LOB) publisher. +## Configure VPN + +To enable phone sign-in to VPN, you must enable the [policy](#set-policies) for phone sign-in and ensure that VPN is configured as follows: + +- For inbox VPN, set up the VPN profile with Extensible Authentication Protocol (EAP) with the **Smart card or other certificate (TLS)** EAP type, also known as EAP-Transport Level Security (EAP-TLS). To exclusively access the VPN certificates on the phone, in the EAP filtering XML, add either **EKU** or **Issuer** (or both) filtering to make sure it picks only the Remote NGC certificate. +- For a Universal Windows Platform (UWP) VPN plug-in, add filtering criteria based on the 3rd party mechanism for the Remote NGC Certificate. + +## Get the app + +If you want to distribute the **Microsoft Authenticator** app, your organization must have set up Windows Store for Business, with Microsoft added as a [Line of Business (LOB) publisher](../manage/working-with-line-of-business-apps.md). [Tell people how to sign in using their phone.](prepare-people-to-use-microsoft-passport.md#bmk-remote) diff --git a/windows/keep-secure/enable-predefined-inbound-rules.md b/windows/keep-secure/enable-predefined-inbound-rules.md index fe16701837..59e8325dac 100644 --- a/windows/keep-secure/enable-predefined-inbound-rules.md +++ b/windows/keep-secure/enable-predefined-inbound-rules.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Windows Firewall with Advanced Security includes many predefined rules for common networking roles and functions. When you install a new server role on a device or enable a network feature on a client device, the installer typically enables the rules required for that role instead of creating new ones. When deploying firewall rules to the devices on the network, you can take advantage of these predefined rules instead of creating new ones. Doing this helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use. diff --git a/windows/keep-secure/enable-predefined-outbound-rules.md b/windows/keep-secure/enable-predefined-outbound-rules.md index 1691399b8a..137de67aa2 100644 --- a/windows/keep-secure/enable-predefined-outbound-rules.md +++ b/windows/keep-secure/enable-predefined-outbound-rules.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 By default, Windows Firewall with Advanced Security allows all outbound network traffic unless it matches a rule that prohibits the traffic. Windows Firewall with Advanced Security includes many predefined outbound rules that can be used to block network traffic for common networking roles and functions. When you install a new server role on a computer or enable a network feature on a client computer, the installer can install, but typically does not enable, outbound block rules for that role. When deploying firewall rules to the computers on the network, you can take advantage of these predefined rules instead of creating new ones. Doing this helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use. diff --git a/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md b/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md new file mode 100644 index 0000000000..82a3908d87 --- /dev/null +++ b/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md @@ -0,0 +1,120 @@ +--- +title: Detect and block Potentially Unwanted Application with Windows Defender +description: In Windows 10, you can enable the Potentially Unwanted Application (PUA) feature in Managed Windows Defender to identify and block unwanted software during download and install time. +keywords: pua, enable, detect pua, block pua, windows defender and pua +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: detect +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: dulcemv +--- + +# Detect and block Potentially Unwanted Application in Windows 10 + +**Applies to:** + +- Windows 10 + +You can enable the Potentially Unwanted Application (PUA) feature in Managed Windows Defender to identify and block unwanted software during download and install time. + +Potentially Unwanted Application (PUA) refers to applications that are not considered viruses, malware, or other types of threats, but might perform actions on your computer that adversely affect your computing experience. It also refers to applications considered to have a poor reputation. + +Typical examples of PUA behavior include: +* Various types of software bundling +* Ad-injection into your browsers +* Driver and registry optimizers that detect issues, request payment to fix them, and persist + +These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify among the noise, and can waste helpdesk, IT, and user time in cleaning up the applications. + +Since the stakes are higher in an enterprise environment, the potential disaster and potential productivity and performance disruptions that PUA brings can be a cause of concern. Hence, it is important to deliver trusted protection in this field. + +##Enable PUA protection in System Center Configuration Manager and Intune + +The PUA feature is available for enterprise users who are running System Center Configuration Manager or Intune in their infrastructure. + +###Configure PUA in System Center Configuration Manager + +For System Center Configuration Manager users, PUA is enabled by default. See the following topics for configuration details: + +If you are using these versions | See these topics +:---|:--- +System Center Configuration Manager (current branch) version 1606 | [Create a new antimalware policy](https://technet.microsoft.com/en-US/library/mt613199.aspx#To-create-a-new-antimalware-policy)
    [Real-time Protection Settings](https://technet.microsoft.com/en-US/library/mt613199.aspx#Real-time-Protection-Settings) +System Center 2012 R2 Endpoint Protection
    System Center 2012 Configuration Manager
    System Center 2012 Configuration Manager SP1
    System Center 2012 Configuration Manager SP2
    System Center 2012 R2 Configuration Manager
    System Center 2012 Endpoint Protection SP1
    System Center 2012 Endpoint Protection
    System Center 2012 R2 Configuration Manager SP1| [How to Deploy Potentially Unwanted Application Protection Policy for Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/hh508770.aspx#BKMK_PUA) + +
    +###Use PUA audit mode in System Center Configuration Manager + +You can use PowerShell to detect PUA without blocking them. In fact, you can run audit mode on individual machines. This feature is useful if your company is conducting an internal software security compliance check and you’d like to avoid any false positives. + +1. Open PowerShell as Administrator:
    + + a. Click **Start**, type **powershell**, and press **Enter**. + + b. Click **Windows PowerShell** to open the interface. + >[!NOTE] + >You may need to open an administrator-level version of PowerShell. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. +2. Enter the PowerShell command: + + ```text + set-mpPreference -puaprotection 2 + ``` +> [!NOTE] +> PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager. + + +###Configure PUA in Intune + + PUA is not enabled by default. You need to [Create and deploy a PUA configuration policy to use it](https://docs.microsoft.com/en-us/intune/deploy-use/manage-settings-and-features-on-your-devices-with-microsoft-intune-policies). See the [Potentially Unwanted Application Detection policy setting](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune) for details. + + +###Use PUA audit mode in Intune + + You can detect PUA without blocking them from your client so you can gain insights into what can be blocked. + +1. Open PowerShell as Administrator:
    + + a. Click **Start**, type **powershell**, and press **Enter**. + + b. Click **Windows PowerShell** to open the interface. + + >[!NOTE] + >You may need to open an administrator-level version of PowerShell. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. + +2. Enter the PowerShell command: + + ```text + set-mpPreference -puaprotection 1 + ``` + +##View PUA events + +PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager or Intune. To view PUA events: + +1. Open **Event Viewer**. +2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender**. +3. Double-click on **Operational**. +4. In the details pane, view the list of individual events to find your event. PUA events are under Event ID 1160 along with detection details. + +You can find a complete list of the Microsoft antimalware event IDs, the symbol, and the description of each ID in [Windows Server Antimalware Events TechNet](https://technet.microsoft.com/library/dn913615.aspx). + + +##What PUA notifications look like + +When a detection occurs, end users who enabled the PUA detection feature will see the following notification: + + +To see historical PUA detections that occurred on a PC, users can go to History, then **Quarantined items** or **All detected items**. + +##PUA threat naming convention + +When enabled, potentially unwanted applications are identified with threat names that start with “PUA:”, such as, PUA:Win32/Creprote. + +##PUA blocking conditions + +PUA protection quarantines the file so they won’t run. PUA will be blocked only at download or install-time. A file will be included for blocking if it has been identified as PUA and meets one of the following conditions: +* The file is being scanned from the browser +* The file is in the %downloads% folder +* Or if the file in the %temp% folder diff --git a/windows/keep-secure/encrypted-hard-drive.md b/windows/keep-secure/encrypted-hard-drive.md index 7de2f367e0..3bae653290 100644 --- a/windows/keep-secure/encrypted-hard-drive.md +++ b/windows/keep-secure/encrypted-hard-drive.md @@ -12,7 +12,8 @@ author: brianlic-msft # Encrypted Hard Drive **Applies to** -- Windows 10 +- Windows 10 +- Windows Server 2016 Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. diff --git a/windows/keep-secure/encryption-zone-gpos.md b/windows/keep-secure/encryption-zone-gpos.md index dcb49121a4..357f2eebfc 100644 --- a/windows/keep-secure/encryption-zone-gpos.md +++ b/windows/keep-secure/encryption-zone-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Handle encryption zones in a similar manner to the boundary zones. A device is added to an encryption zone by adding the device account to the encryption zone group. Woodgrove Bank has a single service that must be protected, and the devices that are running that service are added to the group CG\_DOMISO\_Encryption. This group is granted Read and Apply Group Policy permissions in on the GPO described in this section. diff --git a/windows/keep-secure/encryption-zone.md b/windows/keep-secure/encryption-zone.md index f6fd2aacd4..7e59ef31e3 100644 --- a/windows/keep-secure/encryption-zone.md +++ b/windows/keep-secure/encryption-zone.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Some servers in the organization host data that is very sensitive, including medical, financial, or other personally identifying data. Government or industry regulations might require that this sensitive information must be encrypted when it is transferred between devices. diff --git a/windows/keep-secure/enlightened-microsoft-apps-and-edp.md b/windows/keep-secure/enlightened-microsoft-apps-and-edp.md index bf8d546f56..c152dca1e5 100644 --- a/windows/keep-secure/enlightened-microsoft-apps-and-edp.md +++ b/windows/keep-secure/enlightened-microsoft-apps-and-edp.md @@ -1,89 +1,5 @@ --- title: List of enlightened Microsoft apps for use with enterprise data protection (EDP) (Windows 10) description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your Protected Apps list. -ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f -keywords: EDP, Enterprise Data Protection -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -author: eross-msft ---- - -# List of enlightened Microsoft apps for use with enterprise data protection (EDP) - -**Applies to:** - -- Windows 10 Insider Preview -- Windows 10 Mobile Preview - -[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your **Protected Apps** list. - -## Enlightened versus unenlightened apps -Apps can be enlightened (policy-aware) or unenlightened (policy unaware). - -- **Enlightened apps** can differentiate between corporate and personal data, correctly determining which to protect, based on your policies. - -- **Unenlightened apps** consider all data corporate and encrypt everything. Typically, you can tell an unenlightened app because: - - - Windows Desktop shows it as always running in enterprise mode. - - - Windows **Save As** experiences only allow you to save your files as enterprise. - -## List of enlightened Microsoft apps -Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following: - -- Microsoft Edge - -- Internet Explorer 11 - -- Microsoft People - -- Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar - -- Microsoft Photos - -- Microsoft OneDrive - -- Groove Music - -- Notepad - -- Microsoft Paint - -- Microsoft Movies & TV - -- Microsoft Messaging - -## Adding enlightened Microsoft apps to the Protected Apps list -You can add any or all of the enlightened Microsoft apps to your Protected Apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager. - -|Product name |App info | -|-------------|---------| -|Microsoft Edge |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.MicrosoftEdge
    **App Type:** Universal app | -|IE11 |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** iexplore.exe
    **App Type:** Desktop app | -|Microsoft People |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.People
    **App Type:** Universal app | -|Word Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Office.Word
    **App Type:** Universal app | -|Excel Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Office.Excel
    **App Type:** Universal app | -|PowerPoint Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Office.PowerPoint
    **App Type:** Universal app | -|OneNote |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Office.OneNote
    **App Type:** Universal app | -|Outlook Mail and Calendar |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** microsoft.windowscommunicationsapps
    **App Type:** Universal app | -|Microsoft Photos |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Windows.Photos
    **App Type:** Universal app | -|Microsoft OneDrive |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** microsoft.microsoftskydrive
    **App Type:** Universal app | -|Groove Music |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.ZuneMusic
    **App Type:** Universal app | -|Notepad |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** notepad.exe
    **App Type:** Desktop app | -|Microsoft Paint |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** mspaint.exe
    **App Type:** Desktop app | -|Microsoft Movies & TV |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.ZuneVideo
    **App Type:** Universal app | -|Microsoft Messaging |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Messaging
    **App Type:** Universal app | - - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/enlightened-microsoft-apps-and-wip +--- \ No newline at end of file diff --git a/windows/keep-secure/enlightened-microsoft-apps-and-wip.md b/windows/keep-secure/enlightened-microsoft-apps-and-wip.md new file mode 100644 index 0000000000..9793cfc53f --- /dev/null +++ b/windows/keep-secure/enlightened-microsoft-apps-and-wip.md @@ -0,0 +1,78 @@ +--- +title: List of enlightened Microsoft apps for use with Windows Information Protection (WIP) (Windows 10) +description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your Protected Apps list. +ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: eross-msft +localizationpriority: high +--- + +# List of enlightened Microsoft apps for use with Windows Information Protection (WIP) + +**Applies to:** + +- Windows 10, version 1607 +- Windows 10 Mobile + +Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. + +## Enlightened versus unenlightened apps +Apps can be enlightened (policy-aware) or unenlightened (policy-unaware). + +- **Enlightened apps** can differentiate between corporate and personal data, correctly determining which to protect, based on your policies. + +- **Unenlightened apps** consider all data corporate and encrypt everything. Typically, you can tell an unenlightened app because: + + - Windows Desktop shows it as always running in enterprise mode. + + - Windows **Save As** experiences only allow you to save your files as enterprise. + +## List of enlightened Microsoft apps +Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following: + +- Microsoft Edge + +- Internet Explorer 11 + +- Microsoft People + +- Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar + +- Microsoft Photos + + + +- Groove Music + +- Notepad + +- Microsoft Paint + +- Microsoft Movies & TV + +- Microsoft Messaging + +## Adding enlightened Microsoft apps to the allowed apps list +You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager. + +|Product name |App info | +|-------------|---------| +|Microsoft Edge |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.MicrosoftEdge
    **App Type:** Universal app | +|Microsoft People |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.People
    **App Type:** Universal app | +|Word Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Office.Word
    **App Type:** Universal app | +|Excel Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Office.Excel
    **App Type:** Universal app | +|PowerPoint Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Office.PowerPoint
    **App Type:** Universal app | +|OneNote |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Office.OneNote
    **App Type:** Universal app | +|Outlook Mail and Calendar |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** microsoft.windowscommunicationsapps
    **App Type:** Universal app | +|Microsoft Photos |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Windows.Photos
    **App Type:** Universal app | +|Groove Music |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.ZuneMusic
    **App Type:** Universal app | +|Microsoft Movies & TV |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.ZuneVideo
    **App Type:** Universal app | +|Microsoft Messaging |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Product Name:** Microsoft.Messaging
    **App Type:** Universal app | +|IE11 |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Binary Name:** iexplore.exe
    **App Type:** Desktop app | +|Microsoft OneDrive |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Binary Name:** onedrive.exe
    **App Type:** Desktop app| +|Notepad |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Binary Name:** notepad.exe
    **App Type:** Desktop app | +|Microsoft Paint |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Binary Name:** mspaint.exe
    **App Type:** Desktop app | \ No newline at end of file diff --git a/windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md b/windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md index 35a8444e6e..c7fe4f7637 100644 --- a/windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md +++ b/windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The following Windows Firewall with Advanced Security design examples illustrate how you can use Windows Firewall with Advanced Security to improve the security of the devices connected to the network. You can use these topics to evaluate how the firewall and connection security rules work across all Windows Firewall with Advanced Security designs and to determine which design or combination of designs best suits the goals of your organization. diff --git a/windows/keep-secure/event-4706.md b/windows/keep-secure/event-4706.md index 3eb6bdda15..8681185c08 100644 --- a/windows/keep-secure/event-4706.md +++ b/windows/keep-secure/event-4706.md @@ -108,7 +108,7 @@ This event is generated only on domain controllers. |-------|------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 | TRUST\_TYPE\_DOWNLEVEL | The domain controller of the trusted domain is a computer running an operating system earlier than Windows 2000. | | 2 | TRUST\_TYPE\_UPLEVEL | The domain controller of the trusted domain is a computer running Windows 2000 or later. | -| 3 | TRUST\_TYPE\_MIT | The trusted domain is running a non-Windows, RFC4120-compliant Kerberos distribution. This type of trust is distinguished in that (1) a [SID](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_83f2020d-0804-4840-a5ac-e06439d50f8d) is not required for the [TDO](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_f2ceef4e-999b-4276-84cd-2e2829de5fc4), and (2) the default key types include the DES-CBC and DES-CRC encryption types (see [\[RFC4120\]](http://go.microsoft.com/fwlink/?LinkId=90458) section 8.1). | +| 3 | TRUST\_TYPE\_MIT | The trusted domain is running a non-Windows, RFC4120-compliant Kerberos distribution. This type of trust is distinguished in that (1) a [SID](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_83f2020d-0804-4840-a5ac-e06439d50f8d) is not required for the [TDO](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_f2ceef4e-999b-4276-84cd-2e2829de5fc4), and (2) the default key types include the DES-CBC and DES-CRC encryption types (see [\[RFC4120\]](https://go.microsoft.com/fwlink/?LinkId=90458) section 8.1). | | 4 | TRUST\_TYPE\_DCE | The trusted domain is a DCE realm. Historical reference, this value is not used in Windows. | - **Trust Direction** \[Type = UInt32\]**:** the direction of new trust. The following table contains possible values for this field: @@ -127,13 +127,13 @@ This event is generated only on domain controllers. | 0x1 | TRUST\_ATTRIBUTE\_NON\_TRANSITIVE | If this bit is set, then the trust cannot be used transitively. For example, if domain A trusts domain B, which in turn trusts domain C, and the A<-->B trust has this attribute set, then a client in domain A cannot authenticate to a server in domain C over the A<-->B<-->C trust linkage. | | 0x2 | TRUST\_ATTRIBUTE\_UPLEVEL\_ONLY | If this bit is set in the attribute, then only Windows 2000 operating system and newer clients may use the trust link. [Netlogon](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_70771a5a-04a3-447d-981b-e03098808c32) does not consume [trust objects](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_e81f6436-01d2-4311-93a4-4316bb67eabd) that have this flag set. | | 0x4 | TRUST\_ATTRIBUTE\_QUARANTINED\_DOMAIN | If this bit is set, the trusted domain is quarantined and is subject to the rules of [SID](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_83f2020d-0804-4840-a5ac-e06439d50f8d) Filtering as described in [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section [4.1.2.2](https://msdn.microsoft.com/en-us/library/cc237940.aspx). | -| 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.
    Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 Technical Preview operating system.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | -| 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/en-us/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/en-us/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/en-us/library/cc223991.aspx).
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | -| 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview. | -| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently [filtered](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_ffbe7b55-8e84-4f41-a18d-fc29191a4cda) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.
    Only evaluated if SID Filtering is used.
    Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | -| 0x80 | TRUST\_ATTRIBUTE\_USES\_RC4\_ENCRYPTION | This bit is set on trusts with the [trustType](https://msdn.microsoft.com/en-us/library/cc220955.aspx) set to TRUST\_TYPE\_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([\[RFC4120\]](http://go.microsoft.com/fwlink/?LinkId=90458), [\[RFC3961\]](http://go.microsoft.com/fwlink/?LinkId=90450)). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx), so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section [6.1.6.9.1](https://msdn.microsoft.com/en-us/library/cc223782.aspx).
    Only evaluated on TRUST\_TYPE\_MIT | -| 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section 3.3.5.7.5.
    Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview. | -| 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Evaluated only on Windows Server 2016 Technical Preview
    Evaluated only if SID Filtering is used.
    Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. | +| 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.
    Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 operating system.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/en-us/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/en-us/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/en-us/library/cc223991.aspx).
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | +| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently [filtered](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_ffbe7b55-8e84-4f41-a18d-fc29191a4cda) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
    Only evaluated if SID Filtering is used.
    Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x80 | TRUST\_ATTRIBUTE\_USES\_RC4\_ENCRYPTION | This bit is set on trusts with the [trustType](https://msdn.microsoft.com/en-us/library/cc220955.aspx) set to TRUST\_TYPE\_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([\[RFC4120\]](https://go.microsoft.com/fwlink/?LinkId=90458), [\[RFC3961\]](https://go.microsoft.com/fwlink/?LinkId=90450)). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx), so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section [6.1.6.9.1](https://msdn.microsoft.com/en-us/library/cc223782.aspx).
    Only evaluated on TRUST\_TYPE\_MIT | +| 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section 3.3.5.7.5.
    Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | +| 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Evaluated only on Windows Server 2016
    Evaluated only if SID Filtering is used.
    Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. | - **SID Filtering** \[Type = UnicodeString\]: [SID Filtering](https://technet.microsoft.com/en-us/library/cc772633(v=ws.10).aspx) state for the new trust: diff --git a/windows/keep-secure/event-4716.md b/windows/keep-secure/event-4716.md index 8140c94b16..6f8731a019 100644 --- a/windows/keep-secure/event-4716.md +++ b/windows/keep-secure/event-4716.md @@ -108,7 +108,7 @@ This event is generated only on domain controllers. |-------|------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 | TRUST\_TYPE\_DOWNLEVEL | The domain controller of the trusted domain is a computer running an operating system earlier than Windows 2000. | | 2 | TRUST\_TYPE\_UPLEVEL | The domain controller of the trusted domain is a computer running Windows 2000 or later. | -| 3 | TRUST\_TYPE\_MIT | The trusted domain is running a non-Windows, RFC4120-compliant Kerberos distribution. This type of trust is distinguished in that (1) a [SID](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_83f2020d-0804-4840-a5ac-e06439d50f8d) is not required for the [TDO](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_f2ceef4e-999b-4276-84cd-2e2829de5fc4), and (2) the default key types include the DES-CBC and DES-CRC encryption types (see [\[RFC4120\]](http://go.microsoft.com/fwlink/?LinkId=90458) section 8.1). | +| 3 | TRUST\_TYPE\_MIT | The trusted domain is running a non-Windows, RFC4120-compliant Kerberos distribution. This type of trust is distinguished in that (1) a [SID](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_83f2020d-0804-4840-a5ac-e06439d50f8d) is not required for the [TDO](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_f2ceef4e-999b-4276-84cd-2e2829de5fc4), and (2) the default key types include the DES-CBC and DES-CRC encryption types (see [\[RFC4120\]](https://go.microsoft.com/fwlink/?LinkId=90458) section 8.1). | | 4 | TRUST\_TYPE\_DCE | The trusted domain is a DCE realm. Historical reference, this value is not used in Windows. | - **Trust Direction** \[Type = UInt32\]**:** the direction of new trust. If this attribute was not changed, then it will have “**-**“ value or its old value. The following table contains possible values for this field: @@ -127,13 +127,13 @@ This event is generated only on domain controllers. | 0x1 | TRUST\_ATTRIBUTE\_NON\_TRANSITIVE | If this bit is set, then the trust cannot be used transitively. For example, if domain A trusts domain B, which in turn trusts domain C, and the A<-->B trust has this attribute set, then a client in domain A cannot authenticate to a server in domain C over the A<-->B<-->C trust linkage. | | 0x2 | TRUST\_ATTRIBUTE\_UPLEVEL\_ONLY | If this bit is set in the attribute, then only Windows 2000 operating system and newer clients may use the trust link. [Netlogon](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_70771a5a-04a3-447d-981b-e03098808c32) does not consume [trust objects](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_e81f6436-01d2-4311-93a4-4316bb67eabd) that have this flag set. | | 0x4 | TRUST\_ATTRIBUTE\_QUARANTINED\_DOMAIN | If this bit is set, the trusted domain is quarantined and is subject to the rules of [SID](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_83f2020d-0804-4840-a5ac-e06439d50f8d) Filtering as described in [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section [4.1.2.2](https://msdn.microsoft.com/en-us/library/cc237940.aspx). | -| 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.
    Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 Technical Preview operating system.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | -| 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/en-us/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/en-us/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/en-us/library/cc223991.aspx).
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | -| 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview. | -| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently [filtered](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_ffbe7b55-8e84-4f41-a18d-fc29191a4cda) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.
    Only evaluated if SID Filtering is used.
    Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | -| 0x80 | TRUST\_ATTRIBUTE\_USES\_RC4\_ENCRYPTION | This bit is set on trusts with the [trustType](https://msdn.microsoft.com/en-us/library/cc220955.aspx) set to TRUST\_TYPE\_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([\[RFC4120\]](http://go.microsoft.com/fwlink/?LinkId=90458), [\[RFC3961\]](http://go.microsoft.com/fwlink/?LinkId=90450)). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx), so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section [6.1.6.9.1](https://msdn.microsoft.com/en-us/library/cc223782.aspx).
    Only evaluated on TRUST\_TYPE\_MIT | -| 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section 3.3.5.7.5.
    Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview. | -| 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Evaluated only on Windows Server 2016 Technical Preview
    Evaluated only if SID Filtering is used.
    Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. | +| 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.
    Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 operating system.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/en-us/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/en-us/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/en-us/library/cc223991.aspx).
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | +| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently [filtered](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_ffbe7b55-8e84-4f41-a18d-fc29191a4cda) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
    Only evaluated if SID Filtering is used.
    Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x80 | TRUST\_ATTRIBUTE\_USES\_RC4\_ENCRYPTION | This bit is set on trusts with the [trustType](https://msdn.microsoft.com/en-us/library/cc220955.aspx) set to TRUST\_TYPE\_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([\[RFC4120\]](https://go.microsoft.com/fwlink/?LinkId=90458), [\[RFC3961\]](https://go.microsoft.com/fwlink/?LinkId=90450)). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx), so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section [6.1.6.9.1](https://msdn.microsoft.com/en-us/library/cc223782.aspx).
    Only evaluated on TRUST\_TYPE\_MIT | +| 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section 3.3.5.7.5.
    Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | +| 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Evaluated only on Windows Server 2016
    Evaluated only if SID Filtering is used.
    Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. | - **SID Filtering** \[Type = UnicodeString\]: [SID Filtering](https://technet.microsoft.com/en-us/library/cc772633(v=ws.10).aspx) state for the new trust: diff --git a/windows/keep-secure/event-4739.md b/windows/keep-secure/event-4739.md index 8b692f1ea3..44897f5f13 100644 --- a/windows/keep-secure/event-4739.md +++ b/windows/keep-secure/event-4739.md @@ -165,14 +165,14 @@ This event generates when one of the following changes was made to local compute | Value | Identifier | Domain controller operating systems that are allowed in the domain | |-------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 0 | DS\_BEHAVIOR\_WIN2000 | Windows 2000 Server operating system
    Windows Server 2003 operating system
    Windows Server 2008 operating system
    Windows Server 2008 R2 operating system
    Windows Server 2012 operating system
    Windows Server 2012 R2 operating system
    Windows Server 2016 Technical Preview operating system | -| 1 | DS\_BEHAVIOR\_WIN2003\_WITH\_MIXED\_DOMAINS | Windows Server 2003
    Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 2 | DS\_BEHAVIOR\_WIN2003 | Windows Server 2003
    Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 3 | DS\_BEHAVIOR\_WIN2008 | Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 4 | DS\_BEHAVIOR\_WIN2008R2 | Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 5 | DS\_BEHAVIOR\_WIN2012 | Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 6 | DS\_BEHAVIOR\_WIN2012R2 | Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 7 | DS\_BEHAVIOR\_WINTHRESHOLD | Windows Server 2016 Technical Preview | +| 0 | DS\_BEHAVIOR\_WIN2000 | Windows 2000 Server operating system
    Windows Server 2003 operating system
    Windows Server 2008 operating system
    Windows Server 2008 R2 operating system
    Windows Server 2012 operating system
    Windows Server 2012 R2 operating system
    Windows Server 2016 operating system | +| 1 | DS\_BEHAVIOR\_WIN2003\_WITH\_MIXED\_DOMAINS | Windows Server 2003
    Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 | +| 2 | DS\_BEHAVIOR\_WIN2003 | Windows Server 2003
    Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 | +| 3 | DS\_BEHAVIOR\_WIN2008 | Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 | +| 4 | DS\_BEHAVIOR\_WIN2008R2 | Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 | +| 5 | DS\_BEHAVIOR\_WIN2012 | Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 | +| 6 | DS\_BEHAVIOR\_WIN2012R2 | Windows Server 2012 R2
    Windows Server 2016 | +| 7 | DS\_BEHAVIOR\_WINTHRESHOLD | Windows Server 2016 | - **OEM Information** \[Type = UnicodeString\]: there is no information about this field in this document. diff --git a/windows/keep-secure/event-4826.md b/windows/keep-secure/event-4826.md index 989ba1f6e1..c8213b2290 100644 --- a/windows/keep-secure/event-4826.md +++ b/windows/keep-secure/event-4826.md @@ -118,7 +118,7 @@ This event is always logged regardless of the "Audit Other Policy Change Events" - **HyperVisor Load Options** \[Type = UnicodeString\]**:** shows hypervisor **loadoptions**. See more information here: . -- **HyperVisor Launch Type** \[Type = UnicodeString\]**:** shows the hypervisor launch options (**Off** or **Auto**). If you are setting up a debugger to debug Hyper-V on a target computer, set this option to **Auto** on the target computer. For more information, see [Attaching to a Target Computer Running Hyper-V](https://msdn.microsoft.com/en-us/library/windows/hardware/ff538138(v=vs.85).aspx). Information about [Hyper-V](http://go.microsoft.com/fwlink/p/?linkid=271817) technology is available on Microsoft TechNet web site. +- **HyperVisor Launch Type** \[Type = UnicodeString\]**:** shows the hypervisor launch options (**Off** or **Auto**). If you are setting up a debugger to debug Hyper-V on a target computer, set this option to **Auto** on the target computer. For more information, see [Attaching to a Target Computer Running Hyper-V](https://msdn.microsoft.com/en-us/library/windows/hardware/ff538138(v=vs.85).aspx). Information about [Hyper-V](https://go.microsoft.com/fwlink/p/?linkid=271817) technology is available on Microsoft TechNet web site. - **HyperVisor Debugging** \[Type = UnicodeString\]**:** shows whether the hypervisor debugger is enabled or not (**Yes** or **No**). For information about hypervisor debugging, see [Attaching to a Target Computer Running Hyper-V](https://msdn.microsoft.com/en-us/library/windows/hardware/ff538138(v=vs.85).aspx). diff --git a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md index f019d14fdf..cdde9f9522 100644 --- a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md @@ -1,13 +1,14 @@ --- title: Review events and errors on endpoints with Event Viewer description: Get descriptions and further troubleshooting steps (if required) for all events reported by the Windows Defender ATP service. -keywords: troubleshoot, event viewer, log summary, failure code, failed, Windows Advanced Threat Protection service, cannot start, broken, can't start +keywords: troubleshoot, event viewer, log summary, failure code, failed, Windows Defender Advanced Threat Protection service, cannot start, broken, can't start search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: iaanw +localizationpriority: high --- @@ -15,16 +16,19 @@ author: iaanw **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Event Viewer +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/en-US/library/aa745633(v=bts.10).aspx) on individual endpoints. +You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/library/aa745633(v=bts.10).aspx) on individual endpoints. For example, if endpoints are not appearing in the **Machines view** list, you might need to look for event IDs on the endpoints. You can then use this table to determine further troubleshooting steps. -> **Note**  It can take several days for endpoints to begin reporting to the Windows Defender ATP service. +> [!NOTE] +> It can take several days for endpoints to begin reporting to the Windows Defender ATP service. **Open Event Viewer and find the Windows Defender ATP service event log:** @@ -35,7 +39,8 @@ For example, if endpoints are not appearing in the **Machines view** list, you m a. You can also access the log by expanding **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE** and click on **Operational**. - > **Note**  SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. + > [!NOTE] + > SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. 3. Events recorded by the service will appear in the log. See the following table for a list of events recorded by the service. @@ -49,39 +54,39 @@ For example, if endpoints are not appearing in the **Machines view** list, you m 1 -Windows Advanced Threat Protection service started (Version ```variable```). +Windows Defender Advanced Threat Protection service started (Version ```variable```). Occurs during system start up, shut down, and during onbboarding. Normal operating notification; no action required. 2 -Windows Advanced Threat Protection service shutdown. +Windows Defender Advanced Threat Protection service shutdown. Occurs when the endpoint is shut down or offboarded. Normal operating notification; no action required. 3 -Windows Advanced Threat Protection service failed to start. Failure code: ```variable``` +Windows Defender Advanced Threat Protection service failed to start. Failure code: ```variable```. Service did not start. Review other messages to determine possible cause and troubleshooting steps. 4 -Windows Advanced Threat Protection service contacted the server at ```variable```. -variable = URL of the Windows Defender ATP processing servers.
    +Windows Defender Advanced Threat Protection service contacted the server at ```variable```. +Variable = URL of the Windows Defender ATP processing servers.
    This URL will match that seen in the Firewall or network activity. Normal operating notification; no action required. 5 -Windows Advanced Threat Protection service failed to connect to the server at ```variable```. -variable = URL of the Windows Defender ATP processing servers.
    +Windows Defender Advanced Threat Protection service failed to connect to the server at ```variable```. +Variable = URL of the Windows Defender ATP processing servers.
    The service could not contact the external processing servers at that URL. Check the connection to the URL. See [Configure proxy and Internet connectivity](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#configure-proxy-and-Internet-connectivity). 6 -Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found. +Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. The endpoint did not onboard correctly and will not be reporting to the portal. Onboarding must be run before starting the service.
    Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    @@ -89,72 +94,66 @@ See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defen 7 -Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable``` -The endpoint did not onboard correctly and will not be reporting to the portal. +Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure: ```variable```. +Variable = detailed error description. The endpoint did not onboard correctly and will not be reporting to the portal. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). 8 -Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable``` -The endpoint did not onboard correctly and will not be reporting to the portal. -Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +Windows Defender Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```. +**During onboarding:** The service failed to clean its configuration during the onboarding. The onboarding process continues.

    **During offboarding:** The service failed to clean its configuration during the offboarding. The offboarding process finished but the service keeps running. + +**Onboarding:** No action required.

    **Offboarding:** Reboot the system.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). 9 -Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable``` -The endpoint did not onboard correctly and will not be reporting to the portal. +Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: ```variable```. +**During onboarding:** The endpoint did not onboard correctly and will not be reporting to the portal.

    **During offboarding:** Failed to change the service start type. The offboarding process continues. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). 10 -Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable``` +Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```. The endpoint did not onboard correctly and will not be reporting to the portal. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). 11 -Windows Advanced Threat Protection service completed. +Onboarding or re-onboarding of Windows Defender Advanced Threat Protection service completed. The endpoint onboarded correctly. Normal operating notification; no action required.
    It may take several hours for the endpoint to appear in the portal. 12 -Windows Advanced Threat Protection failed to apply the default configuration. -Service was unable to apply configuration from the processing servers. -This is a server error and should resolve after a short period. +Windows Defender Advanced Threat Protection failed to apply the default configuration. +Service was unable to apply the default configuration. +This error should resolve after a short period of time. 13 -Service machine ID calculated: ```variable``` +Windows Defender Advanced Threat Protection machine ID calculated: ```variable```. Normal operating process. Normal operating notification; no action required. -14 -Service cannot calculate machine ID. Failure code: ```variable``` -Internal error. -Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) - - 15 -Windows Advanced Threat Protection cannot start command channel with URL: ```variable``` -variable = URL of the Windows Defender ATP processing servers.
    +Windows Defender Advanced Threat Protection cannot start command channel with URL: ```variable```. +Variable = URL of the Windows Defender ATP processing servers.
    The service could not contact the external processing servers at that URL. Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). 17 -Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable``` +Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```. An error occurred with the Windows telemetry service. -[Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
    +[Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). 18 @@ -171,44 +170,45 @@ If this error persists after a system restart, ensure all Windows updates have f 20 -Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable``` +Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```. Internal error. If this error persists after a system restart, ensure all Windows updates have full installed. 25 -Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable``` -The endpoint did not onboard correctly and will not be reporting to the portal. +Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: ```variable```. +The endpoint did not onboard correctly. +It will report to the portal, however the service may not appear as registered in SCCM or the registry. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). 26 -Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable``` +Windows Defender Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```. The endpoint did not onboard correctly.
    It will report to the portal, however the service may not appear as registered in SCCM or the registry. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). 27 -Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable``` +Windows Defender Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```. Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
    Ensure real-time antimalware protection is running properly. 28 -Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable``` +Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```. An error occurred with the Windows telemetry service. [Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). 30 -Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable``` +Windows Defender Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```. Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    @@ -216,24 +216,115 @@ Ensure real-time antimalware protection is running properly. 31 -Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable``` -An error occurred with the Windows telemetry service. +Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```. +An error occurred with the Windows telemetry service during onboarding. The offboarding process continues. [Check for errors with the Windows telemetry service](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-the-telemetry-and-diagnostics-service-is-enabled). +32 +Windows Defender Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: %1 +An error occurred during offboarding. +Reboot the machine. + + 33 -Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable``` +Windows Defender Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```. A unique identifier is used to represent each endpoint that is reporting to the portal.
    If the identifier does not persist, the same machine might appear twice in the portal. Check registry permissions on the endpoint to ensure the service can update the registry. 34 -Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable``` +Windows Defender Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```. An error occurred with the Windows telemetry service. [Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). + + +35 +Windows Defender Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```. +An error occurred with the Windows telemetry service during offboarding. The offboarding process continues. + +Check for errors with the Windows telemetry service. + + +36 +Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration succeeded. Completion code: ```variable```. +Registering Windows Defender Advanced Threat Protection with the Connected User Experiences and Telemetry service completed successfully. +Normal operating notification; no action required. + + +37 +Windows Defender Advanced Threat Protection A module is about to exceed its quota. Module: %1, Quota: {%2} {%3}, Percentage of quota utilization: %4. +The machine has almost used its allocated quota of the current 24-hour window. It’s about to be throttled. +Normal operating notification; no action required. + + +38 +Network connection is identified as low. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4. +The machine is using a metered/paid network and will be contacting the server less frequently. +Normal operating notification; no action required. + + +39 +Network connection is identified as normal. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4. +The machine is not using a metered/paid connection and will contact the server as usual. +Normal operating notification; no action required. + + +40 +Battery state is identified as low. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2. +The machine has low battery level and will contact the server less frequently. +Normal operating notification; no action required. + + +41 +Battery state is identified as normal. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2. +The machine doesn’t have low battery level and will contact the server as usual. +Normal operating notification; no action required. + + +42 +Windows Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception message: %4 +Internal error. The service failed to start. +If this error persists, contact Support. + + +43 +Windows Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception Error: %4, Exception message: %5 +Internal error. The service failed to start. +If this error persists, contact Support. + + +44 +Offboarding of Windows Defender Advanced Threat Protection service completed. +The service was offboarded. +Normal operating notification; no action required. + + +45 +Failed to register and to start the event trace session [%1]. Error code: %2 +An error occurred on service startup while creating ETW session. This caused service start-up failure. +If this error persists, contact Support. + + +46 +Failed to register and start the event trace session [%1] due to lack of resources. Error code: %2. This is most likely because there are too many active event trace sessions. The service will retry in 1 minute. +An error occurred on service startup while creating ETW session due to lack of resources. The service started and is running, but will not report any sensor event until the ETW session is started. +Normal operating notification; no action required. The service will try to start the session every minute. + + +47 +Successfully registered and started the event trace session - recovered after previous failed attempts. +This event follows the previous event after successfully starting of the ETW session. +Normal operating notification; no action required. + + +48 +Failed to add a provider [%1] to event trace session [%2]. Error code: %3. This means that events from this provider will not be reported. +Failed to add a provider to ETW session. As a result, the provider events aren’t reported. +Check the error code. If the error persists contact Support. diff --git a/windows/keep-secure/exempt-icmp-from-authentication.md b/windows/keep-secure/exempt-icmp-from-authentication.md index a60e483753..21100a9674 100644 --- a/windows/keep-secure/exempt-icmp-from-authentication.md +++ b/windows/keep-secure/exempt-icmp-from-authentication.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This procedure shows you how to add exemptions for any network traffic that uses the ICMP protocol. diff --git a/windows/keep-secure/exemption-list.md b/windows/keep-secure/exemption-list.md index 3ebf7a465b..fc0fd3b704 100644 --- a/windows/keep-secure/exemption-list.md +++ b/windows/keep-secure/exemption-list.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 When you implement a server and domain isolation security model in your organization, you are likely to find some additional challenges. Key infrastructure servers such as DNS servers and DHCP servers typically must be available to all devicess on the internal network, yet secured from network attacks. However, if they must remain available to all devicess on the network, not just to isolated domain members, then these servers cannot require IPsec for inbound access, nor can they use IPsec transport mode for outbound traffic. diff --git a/windows/keep-secure/firewall-gpos.md b/windows/keep-secure/firewall-gpos.md index b264a38993..229cb2a3e0 100644 --- a/windows/keep-secure/firewall-gpos.md +++ b/windows/keep-secure/firewall-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 All the devices on Woodgrove Bank's network that run Windows are part of the isolated domain, except domain controllers. To configure firewall rules, the GPO described in this section is linked to the domain container in the Active Directory OU hierarchy, and then filtered by using security group filters and WMI filters. diff --git a/windows/keep-secure/firewall-policy-design-example.md b/windows/keep-secure/firewall-policy-design-example.md index 41310314aa..8dad2b48f7 100644 --- a/windows/keep-secure/firewall-policy-design-example.md +++ b/windows/keep-secure/firewall-policy-design-example.md @@ -13,13 +13,13 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 In this example, the fictitious company Woodgrove Bank is a financial services institution. Woodgrove Bank has an Active Directory domain that provides Group Policy-based management for all their Windows devices. The Active Directory domain controllers also host Domain Name System (DNS) for host name resolution. Separate devices host Windows Internet Name Service (WINS) for network basic input/output system (NetBIOS) name resolution. A set of devices that are running UNIX provide the Dynamic Host Configuration Protocol (DHCP) services for automatic IP addressing. -Woodgrove Bank is in the process of migrating their devices from Windows Vista and Windows Server 2008 to Windows 10 and Windows Server 2016 Technical Preview. A significant number of the devices at Woodgrove Bank continue to run Windows Vista and Windows Server 2008. Interoperability between the previous and newer operating systems must be maintained. Wherever possible, security features applied to the newer operating systems must also be applied to the previous operating systems. +Woodgrove Bank is in the process of migrating their devices from Windows Vista and Windows Server 2008 to Windows 10 and Windows Server 2016. A significant number of the devices at Woodgrove Bank continue to run Windows Vista and Windows Server 2008. Interoperability between the previous and newer operating systems must be maintained. Wherever possible, security features applied to the newer operating systems must also be applied to the previous operating systems. A key line-of-business program called WGBank consists of a client program running on most of the desktop devices in the organization. This program accesses several front-end server devices that run the server-side part of WGBank. These front-end servers only do the processing — they do not store the data. The data is stored in several back-end database devices that are running Microsoft SQL Server. @@ -60,7 +60,7 @@ Woodgrove Bank uses Active Directory groups and Group Policy Objects to deploy t - Client devices that run Windows 10, Windows 8, or Windows 7 -- WGBank front-end servers that run Windows Server 2016 Technical Preview, Windows Server 2012 R2, Windows Server 2012 or Windows Server 2008 R2 (there are none in place yet, but their solution must support adding them) +- WGBank front-end servers that run Windows Server 2016, Windows Server 2012 R2, Windows Server 2012 or Windows Server 2008 R2 (there are none in place yet, but their solution must support adding them) - WGBank partner servers that run Windows Server 2008 diff --git a/windows/keep-secure/gathering-information-about-your-active-directory-deployment.md b/windows/keep-secure/gathering-information-about-your-active-directory-deployment.md index 33727fc9f4..0c507fdc73 100644 --- a/windows/keep-secure/gathering-information-about-your-active-directory-deployment.md +++ b/windows/keep-secure/gathering-information-about-your-active-directory-deployment.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Active Directory is another important item about which you must gather information. You must understand the forest structure. This includes domain layout, organizational unit (OU) architecture, and site topology. This information makes it possible to know where devices are currently placed, their configuration, and the impact of changes to Active Directory that result from implementing Windows Firewall with Advanced Security. Review the following list for information needed: diff --git a/windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md b/windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md index 65555cc782..67dcea5661 100644 --- a/windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md +++ b/windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Perhaps the most important aspect of planning for Windows Firewall with Advanced Security deployment is the network architecture, because IPsec is layered on the Internet Protocol itself. An incomplete or inaccurate understanding of the network can prevent any Windows Firewall with Advanced Security solution from being successful. Understanding subnet layout, IP addressing schemes, and traffic patterns are part of this effort, but accurately documenting the following components are important to completing the planning phase of this project: diff --git a/windows/keep-secure/gathering-information-about-your-devices.md b/windows/keep-secure/gathering-information-about-your-devices.md index 1f3b73fa21..3643e51814 100644 --- a/windows/keep-secure/gathering-information-about-your-devices.md +++ b/windows/keep-secure/gathering-information-about-your-devices.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 One of the most valuable benefits of conducting an asset discovery project is the large amount of data that is obtained about the client and server devices on the network. When you start designing and planning your isolation zones, you must make decisions that require accurate information about the state of all hosts to ensure that they can use IPsec as planned. @@ -45,7 +45,7 @@ Using an automated auditing network management system provides valuable informat The biggest difference between manual discovery methods and automated methods is time. -You can use Windows PowerShell to create a script file that can collect the system configuration information. For more information, see [Windows PowerShell Scripting](http://go.microsoft.com/fwlink/?linkid=110413). +You can use Windows PowerShell to create a script file that can collect the system configuration information. For more information, see [Windows PowerShell Scripting](https://go.microsoft.com/fwlink/?linkid=110413). Whether you use an automatic, manual, or hybrid option to gather the information, one of the biggest issues that can cause problems to the design is capturing the changes between the original inventory scan and the point at which the implementation is ready to start. After the first scan has been completed, make support staff aware that all additional changes must be recorded and the updates noted in the inventory. diff --git a/windows/keep-secure/gathering-other-relevant-information.md b/windows/keep-secure/gathering-other-relevant-information.md index ca8d396fcb..85e9be98dc 100644 --- a/windows/keep-secure/gathering-other-relevant-information.md +++ b/windows/keep-secure/gathering-other-relevant-information.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This topic discusses several other things that you should examine to see whether they will cause any complications in your ability to deploy Windows Firewall with Advanced Security policies in your organization. @@ -52,7 +52,7 @@ In some cases, IPsec-secured traffic might have to pass through a router, perime In the case of a filtering router or a firewall, you must configure these devices to allow IPsec traffic to be forwarded. Configure the firewall to allow IPsec traffic on UDP source and destination port 500 (IKE), UDP source and destination port 4500 (IPsec NAT-T), and IP Protocol 50 (ESP). You might also have to configure the firewall to allow IPsec traffic on IP protocol 51 (AH) to allow troubleshooting by IPsec administrators and to allow the IPsec traffic to be inspected. -For more info, see [How to Enable IPsec Traffic Through a Firewall](http://go.microsoft.com/fwlink/?LinkId=45085). +For more info, see [How to Enable IPsec Traffic Through a Firewall](https://go.microsoft.com/fwlink/?LinkId=45085). ## Network load balancing and server clusters diff --git a/windows/keep-secure/gathering-the-information-you-need.md b/windows/keep-secure/gathering-the-information-you-need.md index 3e8a62b0cc..a11fbf67c8 100644 --- a/windows/keep-secure/gathering-the-information-you-need.md +++ b/windows/keep-secure/gathering-the-information-you-need.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Before starting the planning process for a Windows Firewall with Advanced Security deployment, you must collect and analyze up-to-date information about the network, the directory services, and the devices that are already deployed in the organization. This information enables you to create a design that accounts for all possible elements of the existing infrastructure. If the gathered information is not accurate, problems can occur when devices and devices that were not considered during the planning phase are encountered during implementation. diff --git a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md index 1a19780713..f7c920bb4f 100644 --- a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md +++ b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: jasesso --- @@ -183,7 +184,7 @@ In Endpoint Protection, you can use the advanced scanning options to configure a ## Related topics -[Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) -[Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) +- [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) +- [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md)     diff --git a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md index 542e85c56f..88a3f076b6 100644 --- a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md +++ b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md @@ -1,4 +1,4 @@ --- title: Get apps to run on Device Guard-protected devices (Windows 10) -redirect_url: device-guard-deployment-guide.md +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/device-guard-deployment-guide --- diff --git a/windows/keep-secure/gpo-domiso-boundary.md b/windows/keep-secure/gpo-domiso-boundary.md index 22db5273b8..00fb043b7a 100644 --- a/windows/keep-secure/gpo-domiso-boundary.md +++ b/windows/keep-secure/gpo-domiso-boundary.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. Woodgrove Bank began by copying and pasting the GPO for the Windows Server 2008 version of the isolated domain GPO, and then renamed the copy to reflect its new purpose. diff --git a/windows/keep-secure/gpo-domiso-firewall.md b/windows/keep-secure/gpo-domiso-firewall.md index 226c9deac1..d1349941e1 100644 --- a/windows/keep-secure/gpo-domiso-firewall.md +++ b/windows/keep-secure/gpo-domiso-firewall.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to devices that are running at least Windows 7 or Windows Server 2008. diff --git a/windows/keep-secure/gpo-domiso-isolateddomain-clients.md b/windows/keep-secure/gpo-domiso-isolateddomain-clients.md index 0f2faadb9e..a6ab80ad09 100644 --- a/windows/keep-secure/gpo-domiso-isolateddomain-clients.md +++ b/windows/keep-secure/gpo-domiso-isolateddomain-clients.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to client devices that are running Windows 8, Windows 7, or Windows Vista. diff --git a/windows/keep-secure/gpo-domiso-isolateddomain-servers.md b/windows/keep-secure/gpo-domiso-isolateddomain-servers.md index fb984adf5f..91cd4e3890 100644 --- a/windows/keep-secure/gpo-domiso-isolateddomain-servers.md +++ b/windows/keep-secure/gpo-domiso-isolateddomain-servers.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to server devices that are running at least Windows Server 2008. diff --git a/windows/keep-secure/guidance-and-best-practices-edp.md b/windows/keep-secure/guidance-and-best-practices-edp.md index fd1ffe2dcd..cfd70be3cc 100644 --- a/windows/keep-secure/guidance-and-best-practices-edp.md +++ b/windows/keep-secure/guidance-and-best-practices-edp.md @@ -1,39 +1,5 @@ --- title: General guidance and best practices for enterprise data protection (EDP) (Windows 10) description: This section includes info about the enlightened Microsoft apps, including how to add them to your Protected Apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with enterprise data protection (EDP). -ms.assetid: aa94e733-53be-49a7-938d-1660deaf52b0 -keywords: EDP, Enterprise Data Protection -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -author: eross-msft ---- - -# General guidance and best practices for enterprise data protection (EDP) -**Applies to:** - -- Windows 10 Insider Preview -- Windows 10 Mobile Preview - -[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -This section includes info about the enlightened Microsoft apps, including how to add them to your **Protected Apps** list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with enterprise data protection (EDP). - -## In this section -|Topic |Description | -|------|------------| -|[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |A list of all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. | -|[Enlightened apps for use with enterprise data protection (EDP)](enlightened-microsoft-apps-and-edp.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your **Protected Apps** list. | -|[Testing scenarios for enterprise data protection (EDP)](testing-scenarios-for-edp.md) |We've come up with a list of suggested testing scenarios that you can use to test EDP in your company. | - -  - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/guidance-and-best-practices-wip +--- \ No newline at end of file diff --git a/windows/keep-secure/guidance-and-best-practices-wip.md b/windows/keep-secure/guidance-and-best-practices-wip.md new file mode 100644 index 0000000000..b64a82a6e0 --- /dev/null +++ b/windows/keep-secure/guidance-and-best-practices-wip.md @@ -0,0 +1,28 @@ +--- +title: General guidance and best practices for Windows Information Protection (WIP) (Windows 10) +description: This section includes info about the enlightened Microsoft apps, including how to add them to your Protected Apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP). +ms.assetid: aa94e733-53be-49a7-938d-1660deaf52b0 +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: eross-msft +localizationpriority: high +--- + +# General guidance and best practices for Windows Information Protection (WIP) +**Applies to:** + +- Windows 10, version 1607 +- Windows 10 Mobile + +This section includes info about the enlightened Microsoft apps, including how to add them to your allowed apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP). + +## In this section +|Topic |Description | +|------|------------| +|[Windows Information Protection (WIP) overview](wip-enterprise-overview.md) |High-level overview info about why to use WIP, the enterprise scenarios, and how to turn it off. | +|[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |A list of all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. | +|[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. | +|[Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) |We've come up with a list of suggested testing scenarios that you can use to test WIP in your company. | \ No newline at end of file diff --git a/windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md b/windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md index b1adf33fd9..092982bd0a 100644 --- a/windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md +++ b/windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Correctly identifying your Windows Firewall with Advanced Security deployment goals is essential for the success of your Windows Firewall with Advanced Security design project. Form a project team that can clearly articulate deployment issues in a vision statement. When you write your vision statement, identify, clarify, and refine your deployment goals. Prioritize and, if possible, combine your deployment goals so that you can design and deploy Windows Firewall with Advanced Security by using an iterative approach. You can take advantage of the predefined Windows Firewall with Advanced Security deployment goals presented in this guide that are relevant to your scenarios. diff --git a/windows/keep-secure/images/alert-details.png b/windows/keep-secure/images/alert-details.png index 7d23ae0374..e2f5a387b0 100644 Binary files a/windows/keep-secure/images/alert-details.png and b/windows/keep-secure/images/alert-details.png differ diff --git a/windows/keep-secure/images/alertsq2.png b/windows/keep-secure/images/alertsq2.png index a11b5ba76b..8e823cd9c7 100644 Binary files a/windows/keep-secure/images/alertsq2.png and b/windows/keep-secure/images/alertsq2.png differ diff --git a/windows/keep-secure/images/defender/client.png b/windows/keep-secure/images/defender/client.png new file mode 100644 index 0000000000..4f2118206e Binary files /dev/null and b/windows/keep-secure/images/defender/client.png differ diff --git a/windows/keep-secure/images/defender/detection-source.png b/windows/keep-secure/images/defender/detection-source.png new file mode 100644 index 0000000000..7d471dc22d Binary files /dev/null and b/windows/keep-secure/images/defender/detection-source.png differ diff --git a/windows/keep-secure/images/defender/download-wdo.png b/windows/keep-secure/images/defender/download-wdo.png new file mode 100644 index 0000000000..50d2fc3152 Binary files /dev/null and b/windows/keep-secure/images/defender/download-wdo.png differ diff --git a/windows/keep-secure/images/defender/enhanced-notifications.png b/windows/keep-secure/images/defender/enhanced-notifications.png new file mode 100644 index 0000000000..8317458416 Binary files /dev/null and b/windows/keep-secure/images/defender/enhanced-notifications.png differ diff --git a/windows/keep-secure/images/defender/gp.png b/windows/keep-secure/images/defender/gp.png new file mode 100644 index 0000000000..8b57c7b45c Binary files /dev/null and b/windows/keep-secure/images/defender/gp.png differ diff --git a/windows/keep-secure/images/defender/notification.png b/windows/keep-secure/images/defender/notification.png new file mode 100644 index 0000000000..cad9f162e9 Binary files /dev/null and b/windows/keep-secure/images/defender/notification.png differ diff --git a/windows/keep-secure/images/defender/sccm-wdo.png b/windows/keep-secure/images/defender/sccm-wdo.png new file mode 100644 index 0000000000..8f504b94e1 Binary files /dev/null and b/windows/keep-secure/images/defender/sccm-wdo.png differ diff --git a/windows/keep-secure/images/defender/settings-wdo.png b/windows/keep-secure/images/defender/settings-wdo.png new file mode 100644 index 0000000000..23412856b0 Binary files /dev/null and b/windows/keep-secure/images/defender/settings-wdo.png differ diff --git a/windows/keep-secure/images/defender/ux-config-key.png b/windows/keep-secure/images/defender/ux-config-key.png new file mode 100644 index 0000000000..3e2d966342 Binary files /dev/null and b/windows/keep-secure/images/defender/ux-config-key.png differ diff --git a/windows/keep-secure/images/defender/ux-uilockdown-key.png b/windows/keep-secure/images/defender/ux-uilockdown-key.png new file mode 100644 index 0000000000..86d1b4b249 Binary files /dev/null and b/windows/keep-secure/images/defender/ux-uilockdown-key.png differ diff --git a/windows/keep-secure/images/detection-source.png b/windows/keep-secure/images/detection-source.png new file mode 100644 index 0000000000..7d471dc22d Binary files /dev/null and b/windows/keep-secure/images/detection-source.png differ diff --git a/windows/keep-secure/images/device-guard-gp.png b/windows/keep-secure/images/device-guard-gp.png index 0c2c1c9d4f..169d2f245b 100644 Binary files a/windows/keep-secure/images/device-guard-gp.png and b/windows/keep-secure/images/device-guard-gp.png differ diff --git a/windows/keep-secure/images/dg-fig1-enableos.png b/windows/keep-secure/images/dg-fig1-enableos.png index cefb124344..a114c520de 100644 Binary files a/windows/keep-secure/images/dg-fig1-enableos.png and b/windows/keep-secure/images/dg-fig1-enableos.png differ diff --git a/windows/keep-secure/images/dg-fig11-dgproperties.png b/windows/keep-secure/images/dg-fig11-dgproperties.png index ce16705d0f..3c93b2b948 100644 Binary files a/windows/keep-secure/images/dg-fig11-dgproperties.png and b/windows/keep-secure/images/dg-fig11-dgproperties.png differ diff --git a/windows/keep-secure/images/dg-fig7-enablevbsofkmci.png b/windows/keep-secure/images/dg-fig7-enablevbsofkmci.png index bf0d55dd7f..ddc2158a8a 100644 Binary files a/windows/keep-secure/images/dg-fig7-enablevbsofkmci.png and b/windows/keep-secure/images/dg-fig7-enablevbsofkmci.png differ diff --git a/windows/keep-secure/images/edp-sccm-add-network-domain.png b/windows/keep-secure/images/edp-sccm-add-network-domain.png deleted file mode 100644 index 505a3ca5fe..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-add-network-domain.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-addapplockerfile.png b/windows/keep-secure/images/edp-sccm-addapplockerfile.png deleted file mode 100644 index 36d4508747..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-addapplockerfile.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-adddesktopapp.png b/windows/keep-secure/images/edp-sccm-adddesktopapp.png deleted file mode 100644 index 18b1970f81..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-adddesktopapp.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-additionalsettings.png b/windows/keep-secure/images/edp-sccm-additionalsettings.png deleted file mode 100644 index 3bd31c8e27..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-additionalsettings.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-addpolicy.png b/windows/keep-secure/images/edp-sccm-addpolicy.png deleted file mode 100644 index d506a859a2..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-addpolicy.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-adduniversalapp.png b/windows/keep-secure/images/edp-sccm-adduniversalapp.png deleted file mode 100644 index cd8b78c72d..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-adduniversalapp.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-appmgmt.png b/windows/keep-secure/images/edp-sccm-appmgmt.png deleted file mode 100644 index 52a6ef5fd9..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-appmgmt.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-devicesettings.png b/windows/keep-secure/images/edp-sccm-devicesettings.png deleted file mode 100644 index 1573ef06d7..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-devicesettings.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-dra.png b/windows/keep-secure/images/edp-sccm-dra.png deleted file mode 100644 index d823ecb78d..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-dra.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-generalscreen.png b/windows/keep-secure/images/edp-sccm-generalscreen.png deleted file mode 100644 index e0013f5b2d..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-generalscreen.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-optsettings.png b/windows/keep-secure/images/edp-sccm-optsettings.png deleted file mode 100644 index 65365356da..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-optsettings.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-summaryscreen.png b/windows/keep-secure/images/edp-sccm-summaryscreen.png deleted file mode 100644 index 2cbb827d7a..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-summaryscreen.png and /dev/null differ diff --git a/windows/keep-secure/images/edp-sccm-supportedplat.png b/windows/keep-secure/images/edp-sccm-supportedplat.png deleted file mode 100644 index 7add4926a9..0000000000 Binary files a/windows/keep-secure/images/edp-sccm-supportedplat.png and /dev/null differ diff --git a/windows/keep-secure/images/gp-process-mitigation-options-bit-flag-image.png b/windows/keep-secure/images/gp-process-mitigation-options-bit-flag-image.png new file mode 100644 index 0000000000..e493da9e20 Binary files /dev/null and b/windows/keep-secure/images/gp-process-mitigation-options-bit-flag-image.png differ diff --git a/windows/keep-secure/images/gp-process-mitigation-options-show.png b/windows/keep-secure/images/gp-process-mitigation-options-show.png new file mode 100644 index 0000000000..0269ddf21f Binary files /dev/null and b/windows/keep-secure/images/gp-process-mitigation-options-show.png differ diff --git a/windows/keep-secure/images/gp-process-mitigation-options.png b/windows/keep-secure/images/gp-process-mitigation-options.png new file mode 100644 index 0000000000..cd69708af3 Binary files /dev/null and b/windows/keep-secure/images/gp-process-mitigation-options.png differ diff --git a/windows/keep-secure/images/hellosettings.png b/windows/keep-secure/images/hellosettings.png index 77a8753b5c..9b897a136e 100644 Binary files a/windows/keep-secure/images/hellosettings.png and b/windows/keep-secure/images/hellosettings.png differ diff --git a/windows/keep-secure/images/intune-add-applocker-xml-file.png b/windows/keep-secure/images/intune-add-applocker-xml-file.png index 8829c070a6..3ceabfd15a 100644 Binary files a/windows/keep-secure/images/intune-add-applocker-xml-file.png and b/windows/keep-secure/images/intune-add-applocker-xml-file.png differ diff --git a/windows/keep-secure/images/intune-add-classic-apps.png b/windows/keep-secure/images/intune-add-classic-apps.png index bf4e5792c1..09bbda3a06 100644 Binary files a/windows/keep-secure/images/intune-add-classic-apps.png and b/windows/keep-secure/images/intune-add-classic-apps.png differ diff --git a/windows/keep-secure/images/intune-add-uwp-apps.png b/windows/keep-secure/images/intune-add-uwp-apps.png index 933cd9addf..17a97b8d3a 100644 Binary files a/windows/keep-secure/images/intune-add-uwp-apps.png and b/windows/keep-secure/images/intune-add-uwp-apps.png differ diff --git a/windows/keep-secure/images/intune-corporate-identity.png b/windows/keep-secure/images/intune-corporate-identity.png index 4ffb6223ea..808de2db0e 100644 Binary files a/windows/keep-secure/images/intune-corporate-identity.png and b/windows/keep-secure/images/intune-corporate-identity.png differ diff --git a/windows/keep-secure/images/intune-createnewpolicy.png b/windows/keep-secure/images/intune-createnewpolicy.png index 26ab066343..3f7b7af6b6 100644 Binary files a/windows/keep-secure/images/intune-createnewpolicy.png and b/windows/keep-secure/images/intune-createnewpolicy.png differ diff --git a/windows/keep-secure/images/intune-data-recovery.png b/windows/keep-secure/images/intune-data-recovery.png index 32d7282110..f889dbca48 100644 Binary files a/windows/keep-secure/images/intune-data-recovery.png and b/windows/keep-secure/images/intune-data-recovery.png differ diff --git a/windows/keep-secure/images/intune-generalinfo.png b/windows/keep-secure/images/intune-generalinfo.png index c740cad913..70e726d379 100644 Binary files a/windows/keep-secure/images/intune-generalinfo.png and b/windows/keep-secure/images/intune-generalinfo.png differ diff --git a/windows/keep-secure/images/intune-groupselection.png b/windows/keep-secure/images/intune-groupselection.png index 992d7a52cf..e48b59aa4b 100644 Binary files a/windows/keep-secure/images/intune-groupselection.png and b/windows/keep-secure/images/intune-groupselection.png differ diff --git a/windows/keep-secure/images/intune-groupselection_vpnlink.png b/windows/keep-secure/images/intune-groupselection_vpnlink.png new file mode 100644 index 0000000000..6aa8f89355 Binary files /dev/null and b/windows/keep-secure/images/intune-groupselection_vpnlink.png differ diff --git a/windows/keep-secure/images/intune-managedeployment.png b/windows/keep-secure/images/intune-managedeployment.png index 93d37116ef..6786a93416 100644 Binary files a/windows/keep-secure/images/intune-managedeployment.png and b/windows/keep-secure/images/intune-managedeployment.png differ diff --git a/windows/keep-secure/images/intune-network-detection-boxes.png b/windows/keep-secure/images/intune-network-detection-boxes.png index 256b586c70..bc801a8521 100644 Binary files a/windows/keep-secure/images/intune-network-detection-boxes.png and b/windows/keep-secure/images/intune-network-detection-boxes.png differ diff --git a/windows/keep-secure/images/intune-networklocation.png b/windows/keep-secure/images/intune-networklocation.png index 058aaec38e..64d9ebda26 100644 Binary files a/windows/keep-secure/images/intune-networklocation.png and b/windows/keep-secure/images/intune-networklocation.png differ diff --git a/windows/keep-secure/images/intune-optional-settings.png b/windows/keep-secure/images/intune-optional-settings.png index 2d2bf90bb1..3ec8bec32d 100644 Binary files a/windows/keep-secure/images/intune-optional-settings.png and b/windows/keep-secure/images/intune-optional-settings.png differ diff --git a/windows/keep-secure/images/intune-protection-mode.png b/windows/keep-secure/images/intune-protection-mode.png index 80804f7946..b3340d6e4f 100644 Binary files a/windows/keep-secure/images/intune-protection-mode.png and b/windows/keep-secure/images/intune-protection-mode.png differ diff --git a/windows/keep-secure/images/intune-vpn-customconfig.png b/windows/keep-secure/images/intune-vpn-customconfig.png index 1e1dd0345b..cf9f85181a 100644 Binary files a/windows/keep-secure/images/intune-vpn-customconfig.png and b/windows/keep-secure/images/intune-vpn-customconfig.png differ diff --git a/windows/keep-secure/images/intune-vpn-edpmodeid.png b/windows/keep-secure/images/intune-vpn-edpmodeid.png deleted file mode 100644 index 80852af30d..0000000000 Binary files a/windows/keep-secure/images/intune-vpn-edpmodeid.png and /dev/null differ diff --git a/windows/keep-secure/images/intune-vpn-omaurisettings.png b/windows/keep-secure/images/intune-vpn-omaurisettings.png index 382301498e..c7016e13c4 100644 Binary files a/windows/keep-secure/images/intune-vpn-omaurisettings.png and b/windows/keep-secure/images/intune-vpn-omaurisettings.png differ diff --git a/windows/keep-secure/images/intune-vpn-wipmodeid.png b/windows/keep-secure/images/intune-vpn-wipmodeid.png new file mode 100644 index 0000000000..6c45fd0a25 Binary files /dev/null and b/windows/keep-secure/images/intune-vpn-wipmodeid.png differ diff --git a/windows/keep-secure/images/machines-view.png b/windows/keep-secure/images/machines-view.png index 3baf15a05f..f1d00f4035 100644 Binary files a/windows/keep-secure/images/machines-view.png and b/windows/keep-secure/images/machines-view.png differ diff --git a/windows/keep-secure/images/onboardingstate.png b/windows/keep-secure/images/onboardingstate.png index 0606e2b2c6..ab49c49e17 100644 Binary files a/windows/keep-secure/images/onboardingstate.png and b/windows/keep-secure/images/onboardingstate.png differ diff --git a/windows/keep-secure/images/phone-signin-device-select.png b/windows/keep-secure/images/phone-signin-device-select.png new file mode 100644 index 0000000000..a002efa427 Binary files /dev/null and b/windows/keep-secure/images/phone-signin-device-select.png differ diff --git a/windows/keep-secure/images/phone-signin-menu.png b/windows/keep-secure/images/phone-signin-menu.png new file mode 100644 index 0000000000..4672433344 Binary files /dev/null and b/windows/keep-secure/images/phone-signin-menu.png differ diff --git a/windows/keep-secure/images/phone-signin-settings.png b/windows/keep-secure/images/phone-signin-settings.png new file mode 100644 index 0000000000..e0ae827426 Binary files /dev/null and b/windows/keep-secure/images/phone-signin-settings.png differ diff --git a/windows/keep-secure/images/pinerror.png b/windows/keep-secure/images/pinerror.png index 188b981299..28a759f2fc 100644 Binary files a/windows/keep-secure/images/pinerror.png and b/windows/keep-secure/images/pinerror.png differ diff --git a/windows/keep-secure/images/portal-image.png b/windows/keep-secure/images/portal-image.png index be59f06fa5..c038da30de 100644 Binary files a/windows/keep-secure/images/portal-image.png and b/windows/keep-secure/images/portal-image.png differ diff --git a/windows/keep-secure/images/pua1.png b/windows/keep-secure/images/pua1.png new file mode 100644 index 0000000000..f3d96a245a Binary files /dev/null and b/windows/keep-secure/images/pua1.png differ diff --git a/windows/keep-secure/images/pua2.png b/windows/keep-secure/images/pua2.png new file mode 100644 index 0000000000..72ffa10aa5 Binary files /dev/null and b/windows/keep-secure/images/pua2.png differ diff --git a/windows/keep-secure/images/remote-credential-guard-gp.png b/windows/keep-secure/images/remote-credential-guard-gp.png new file mode 100644 index 0000000000..98c97825fa Binary files /dev/null and b/windows/keep-secure/images/remote-credential-guard-gp.png differ diff --git a/windows/keep-secure/images/remote-credential-guard.png b/windows/keep-secure/images/remote-credential-guard.png new file mode 100644 index 0000000000..d8e3598dc9 Binary files /dev/null and b/windows/keep-secure/images/remote-credential-guard.png differ diff --git a/windows/keep-secure/images/security-fig2-vbsarchitecture-redo.png b/windows/keep-secure/images/security-fig2-vbsarchitecture-redo.png new file mode 100644 index 0000000000..6bcddd364a Binary files /dev/null and b/windows/keep-secure/images/security-fig2-vbsarchitecture-redo.png differ diff --git a/windows/keep-secure/images/timeline.png b/windows/keep-secure/images/timeline.png index 83ac56f312..ac657b2a12 100644 Binary files a/windows/keep-secure/images/timeline.png and b/windows/keep-secure/images/timeline.png differ diff --git a/windows/keep-secure/images/edp-intune-app-reconfig-warning.png b/windows/keep-secure/images/wip-intune-app-reconfig-warning.png similarity index 100% rename from windows/keep-secure/images/edp-intune-app-reconfig-warning.png rename to windows/keep-secure/images/wip-intune-app-reconfig-warning.png diff --git a/windows/keep-secure/images/wip-sccm-add-network-domain.png b/windows/keep-secure/images/wip-sccm-add-network-domain.png new file mode 100644 index 0000000000..6f5e80d670 Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-add-network-domain.png differ diff --git a/windows/keep-secure/images/wip-sccm-addapplockerfile.png b/windows/keep-secure/images/wip-sccm-addapplockerfile.png new file mode 100644 index 0000000000..6cd571b404 Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-addapplockerfile.png differ diff --git a/windows/keep-secure/images/wip-sccm-adddesktopapp.png b/windows/keep-secure/images/wip-sccm-adddesktopapp.png new file mode 100644 index 0000000000..e6c9769e68 Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-adddesktopapp.png differ diff --git a/windows/keep-secure/images/wip-sccm-additionalsettings.png b/windows/keep-secure/images/wip-sccm-additionalsettings.png new file mode 100644 index 0000000000..4b66070098 Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-additionalsettings.png differ diff --git a/windows/keep-secure/images/wip-sccm-addpolicy.png b/windows/keep-secure/images/wip-sccm-addpolicy.png new file mode 100644 index 0000000000..49613b5587 Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-addpolicy.png differ diff --git a/windows/keep-secure/images/wip-sccm-adduniversalapp.png b/windows/keep-secure/images/wip-sccm-adduniversalapp.png new file mode 100644 index 0000000000..8d1815ddf9 Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-adduniversalapp.png differ diff --git a/windows/keep-secure/images/wip-sccm-appmgmt.png b/windows/keep-secure/images/wip-sccm-appmgmt.png new file mode 100644 index 0000000000..495fdfdb95 Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-appmgmt.png differ diff --git a/windows/keep-secure/images/edp-sccm-corp-identity.png b/windows/keep-secure/images/wip-sccm-corp-identity.png similarity index 100% rename from windows/keep-secure/images/edp-sccm-corp-identity.png rename to windows/keep-secure/images/wip-sccm-corp-identity.png diff --git a/windows/keep-secure/images/wip-sccm-devicesettings.png b/windows/keep-secure/images/wip-sccm-devicesettings.png new file mode 100644 index 0000000000..bee8ddfb1a Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-devicesettings.png differ diff --git a/windows/keep-secure/images/wip-sccm-dra.png b/windows/keep-secure/images/wip-sccm-dra.png new file mode 100644 index 0000000000..cc58cdb34a Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-dra.png differ diff --git a/windows/keep-secure/images/wip-sccm-generalscreen.png b/windows/keep-secure/images/wip-sccm-generalscreen.png new file mode 100644 index 0000000000..c2c85c62d4 Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-generalscreen.png differ diff --git a/windows/keep-secure/images/edp-sccm-network-domain.png b/windows/keep-secure/images/wip-sccm-network-domain.png similarity index 100% rename from windows/keep-secure/images/edp-sccm-network-domain.png rename to windows/keep-secure/images/wip-sccm-network-domain.png diff --git a/windows/keep-secure/images/wip-sccm-optsettings.png b/windows/keep-secure/images/wip-sccm-optsettings.png new file mode 100644 index 0000000000..c52e7a4fdb Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-optsettings.png differ diff --git a/windows/keep-secure/images/wip-sccm-summaryscreen.png b/windows/keep-secure/images/wip-sccm-summaryscreen.png new file mode 100644 index 0000000000..5cae0416bd Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-summaryscreen.png differ diff --git a/windows/keep-secure/images/wip-sccm-supportedplat.png b/windows/keep-secure/images/wip-sccm-supportedplat.png new file mode 100644 index 0000000000..c09ff3cfc3 Binary files /dev/null and b/windows/keep-secure/images/wip-sccm-supportedplat.png differ diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index db0f315439..b9e72308cc 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS +localizationpriority: high --- # Implement Windows Hello for Business in your organization @@ -17,9 +18,15 @@ author: jdeckerMS - Windows 10 Mobile You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10. -> **Important:** The Group Policy setting **Turn on PIN sign-in** does not apply to Windows 10. Use **Windows Hello for Business** policy settings to manage PINs. + +>[!IMPORTANT] +>The Group Policy setting **Turn on PIN sign-in** does not apply to Windows Hello for Business. It still prevents or enables the creation of a convenience PIN for Windows 10, version 1507 and 1511. +> +>Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**. +> +>Use **Windows Hello for Business** policy settings to manage PINs for Windows Hello for Business.   -## Group Policy settings for Passport +## Group Policy settings for Windows Hello for Business The following table lists the Group Policy settings that you can configure for Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. @@ -138,9 +145,13 @@ The following table lists the Group Policy settings that you can configure for H -## MDM policy settings for Passport +## MDM policy settings for Windows Hello for Business + +The following table lists the MDM policy settings that you can configure for Windows Hello for Business use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkId=692070). + +>[!IMPORTANT] +>Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP. -The following table lists the MDM policy settings that you can configure for Windows Hello for Business use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkId=692070). @@ -284,8 +295,8 @@ The following table lists the MDM policy settings that you can configure for Win
    Policy
    -**Note**   -If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. +>[!NOTE]   +> If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN.   ## Prerequisites @@ -311,12 +322,12 @@ You’ll need this software to set Windows Hello for Business policies in your e Azure AD subscription

    @@ -349,12 +360,12 @@ Configuration Manager and MDM provide the ability to manage Windows Hello for Bu Azure AD provides the ability to register devices with your enterprise and to provision Windows Hello for Business for organization accounts. -Active Directory provides the ability to authorize users and devices using keys protected by Windows Hello for Business if domain controllers are running Windows 10 and the Windows Hello for Business provisioning service in Windows 10 AD FS. ## Windows Hello for BYOD -Windows Hello can be managed on personal devices that your employees use for work purposes using MDM. On personal devices, users can create a personal Windows Hello PIN for unlocking the device and a separate work PIN for access to work resources. -The work PIN is managed using the same Windows Hello for Business policies that you can use to manage Windows Hello for Business on organization-owned devices. The personal PIN is managed separately using DeviceLock policy. DeviceLock policy can be used to control length, complexity, history, and expiration requirements and can be configured using the [Policy configuration service provider](http://go.microsoft.com/fwlink/p/?LinkID=623244). +Windows Hello can be managed on personal devices that your employees use for work purposes using MDM. On personal devices, users can create a personal Windows Hello PIN for unlocking the device and used this PIN for access to work resources. + +The PIN is managed using the same Windows Hello for Business policies that you can use to manage Windows Hello for Business on organization-owned devices. The PIN can also be managed using DeviceLock policy. DeviceLock policy can be used to control length, complexity, history, and expiration requirements and can be configured using the [Policy configuration service provider](https://go.microsoft.com/fwlink/p/?LinkID=623244). ## Related topics diff --git a/windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md index 25f0fba560..6099d183c9 100644 --- a/windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md +++ b/windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The following are important factors in the implementation of your Windows Firewall with Advanced Security design plan: diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index f10f0d6cfe..bae0757612 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -21,19 +21,16 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure. | [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | | [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. | | [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. | -| [Device Guard deployment guide](device-guard-deployment-guide.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | | [Protect derived domain credentials with Credential Guard](credential-guard.md) | Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. | -| [Protect your enterprise data using enterprise data protection (EDP)](protect-enterprise-data-using-edp.md) | With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. | +| [Protect Remote Desktop credentials with Remote Credential Guard](remote-credential-guard.md) | Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that's requesting the connection. | +| [Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) | With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. | | [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) | Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. | +|[Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) |Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies. | | [VPN profile options](vpn-profile-options.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. | | [Windows security baselines](windows-security-baselines.md) | Learn why you should use security baselines in your organization. | | [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. | -<<<<<<< HEAD | [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. | | [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) | This topic lists new and updated topics in the Keep Windows 10 secure documentation for [Windows 10 and Windows 10 Mobile](../index.md). | -======= -| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. | ->>>>>>> refs/remotes/origin/master   ## Related topics diff --git a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md index a1d2220641..8670def085 100644 --- a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md @@ -106,13 +106,13 @@ Some systems may have multiple TPMs and the active TPM may be toggled in the BIO ## Turn on or turn off the TPM -Normally, the TPM is turned on as part of the TPM initialization process. You do not normally need to turn the TPM on or off. However, if necessary you can do so by using the TPM MMC. +Normally, the TPM is turned on as part of the TPM initialization process. You do not normally need to turn the TPM on or off. However, if necessary you can do so by using the TPM MMC. This option is only available with TPM 1.2 and does not apply to TPM 2.0. ### Turn on the TPM If the TPM has been initialized but has never been used, or if you want to use the TPM after you have turned it off, you can use the following procedure to turn on the TPM. -**To turn on the TPM** +**To turn on the TPM (TPM 1.2 Only)** 1. Open the TPM MMC (tpm.msc). 2. In the **Action** pane, click **Turn TPM On** to display the **Turn on the TPM Security Hardware** page. Read the instructions on this page. @@ -125,7 +125,7 @@ If the TPM has been initialized but has never been used, or if you want to use t If you want to stop using the services that are provided by the TPM, you can use the TPM MMC to turn off the TPM. If you have the TPM owner password, physical access to the computer is not required to turn off the TPM. If you do not have the TPM owner password, you must have physical access to the computer to turn off the TPM. -**To turn off the TPM** +**To turn off the TPM (TPM 1.2 only)** 1. Open the TPM MMC (tpm.msc). 2. In the **Action** pane, click **Turn TPM Off** to display the **Turn off the TPM security hardware** page. @@ -156,13 +156,7 @@ Membership in the local Administrators group, or equivalent, is the minimum requ Clearing the TPM resets it to factory defaults and turns it off. You will lose all created keys and data that is protected by those keys.   -4. In the **Clear the TPM security hardware** dialog box, select one of the following methods to enter your password and clear the TPM: - - If you have the removable storage device with your saved TPM owner password, insert it, and click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, use **Browse** to navigate to the .tpm file that is saved on your removable storage device. Click **Open**, and then click **Clear TPM**. - - If you do not have the removable storage device with your saved password, click **I want to enter the owner password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and click **Clear TPM**. - - If you do not know your TPM owner password, click **I don't have the TPM owner password**, and follow the instructions that are provided to clear the TPM without entering the password. - >**Note:**  If you have physical access to the computer, you can clear the TPM and perform a limited number of management tasks without entering the TPM owner password. -   - The status of your TPM is displayed under **Status** in TPM MMC. +4. You will be prompted to restart the computer. During the restart, you will be prompted by the BIOS or UEFI to press a button to confirm you wish to clear the TPM. ## Use the TPM cmdlets diff --git a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md index 3d0ace0785..11d5fe781d 100644 --- a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS +localizationpriority: high --- # Install digital certificates on Windows 10 Mobile @@ -24,7 +25,7 @@ Certificates in Windows 10 Mobile are primarily used for the following purposes **Warning**   -In Windows 10, Version 1607, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. [Learn more about this known issue in Version 1607](http://go.microsoft.com/fwlink/p/?LinkId=786764) +In Windows 10, Version 1607, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. [Learn more about this known issue in Version 1607](https://go.microsoft.com/fwlink/p/?LinkId=786764) ## Install certificates using Microsoft Edge @@ -37,7 +38,7 @@ The Windows 10 Mobile certificate installer supports .cer, .p7b, .pem, and .pfx ## Install certificates using mobile device management (MDM) Windows 10 Mobile supports root, CA, and client certificate to be configured via MDM. Using MDM, an administrator can directly add, delete, or query root and CA certificates, and configure the device to enroll a client certificate with a certificate enrollment server that supports Simple Certificate Enrollment Protocol (SCEP). SCEP enrolled client certificates are used by Wi-Fi, VPN, email, and browser for certificate-based client authentication. An MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. -> **Warning:**  Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certificate profile to support S/MIME on Windows 10 Mobile. For instructions on creating a PFX certificate profile in Microsoft Intune, see [Enable access to company resources using certificate profiles with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=718216). +> **Warning:**  Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certificate profile to support S/MIME on Windows 10 Mobile. For instructions on creating a PFX certificate profile in Microsoft Intune, see [Enable access to company resources using certificate profiles with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkID=718216).   **Process of installing certificates using MDM** diff --git a/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md b/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md index f0e196b799..c0577fe786 100644 --- a/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md +++ b/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md @@ -4,6 +4,7 @@ description: Microsoft Device Guard is a feature set that consists of both hardw keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy +localizationpriority: high author: brianlic-msft --- diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index d724b1862d..ef95089b35 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -8,17 +8,19 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Investigate Windows Defender Advanced Threat Protection alerts **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - Alerts in Windows Defender ATP indicate possible security breaches on endpoints in your organization. There are three alert severity levels, described in the following table. @@ -43,17 +45,39 @@ Details displayed about the alert include: - When the alert was last observed - Alert description - Recommended actions -- The potential scope of breach +- The incident graph - The indicators that triggered the alert -![A detailed view of an alert when clicked](images/alert-details.png) - Alerts attributed to an adversary or actor display a colored tile with the actor name. Click on the actor's name to see a threat intelligence profile of the actor, including a brief overview of the actor, their interests or targets, tools, tactics, and processes (TTPs) as well as areas where it's active worldwide. You will also see a set of recommended actions to take. Some actor profiles include a link to download a more comprehensive threat intelligence report. +![A detailed view of an alert when clicked](images/alert-details.png) + +## Incident graph +The incident graph provides a visual representation of where an alert was seen, events that triggered the alert, and which other machines are affected by the event. It provides an illustrated alert footprint on the original machine and expands to show the footprint of each alert event on other machines. + +You can click the circles on the incident graph to expand the nodes and view the associated events or files related to the alert. + +## Alert spotlight +The alert spotlight feature helps ease investigations by highlighting alerts related to a specific machine and events. You can highlight an alert and its related events in the machine timeline to increase your focus during an investigation. + +You can click on the machine link from the alert view to see the alerts related to the machine. + + + > [!NOTE] + > This shortcut is not available from the Incident graph machine links. + +Alerts related to the machine are displayed under the **Alerts related to this machine** section. +Clicking on an alert row takes you the to the date in which the alert was flagged on **Machine timeline**. This eliminates the need to manually filter and drag the machine timeline marker to when the alert was seen on that machine. + +You can also choose to highlight an alert from the **Alerts related to this machine** or from the **Machine timeline** section to see the correlation between the alert and other events that occurred on the machine. Right-click on any alert from either section and select **Mark related events**. This highlights alerts and events that are related and helps differentiate between the other alerts listed in the timeline. Highlighted events are displayed in all filtering modes whether you choose to view the timeline by **Detections**, **Behaviours**, or **Verbose**. + +You can also remove the highlight by right-clicking a highlighted alert and selecting **Unmark related events**. + + ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index fd75059fff..4e52c15a2e 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -1,23 +1,25 @@ --- title: Investigate Windows Defender Advanced Threat Protection domains description: Use the investigation options to see if machines and servers have been communicating with malicious domains. -keywords: investigate domain, domain, malicious domain, windows defender atp, alert, URL +keywords: investigate domain, domain, malicious domain, windows defender atp, alert, URL search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Investigate a domain associated with a Windows Defender ATP alert **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. You can see information from the following sections in the URL view: diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index 5dfb3959f9..51e68f1fee 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -8,16 +8,18 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Investigate a file associated with a Windows Defender ATP alert **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. You can get information from the following sections in the file view: @@ -62,11 +64,13 @@ Use the deep analysis feature to investigate the details of any file, usually du In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender ATP backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. -> **Note**  Only files from Windows 10 can be automatically collected. +> [!NOTE] +> Only files from Windows 10 can be automatically collected. -You can also manually submit a sample through the [Malware Protection Center Portal](https://www.microsoft.com/en-us/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 machine, and wait for **Submit for deep analysis** button to become available. +You can also manually submit a sample through the [Malware Protection Center Portal](https://www.microsoft.com/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 machine, and wait for **Submit for deep analysis** button to become available. -> **Note**  Due to backend processing flows in the Malware Protection Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Windows Defender ATP. +> [!NOTE] +> Due to backend processing flows in the Malware Protection Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Windows Defender ATP. When the sample is collected, Windows Defender ATP runs the file in is a secure environment and creates a detailed report of observed behaviors and associated artifacts, such as files dropped on machines, communication to IPs, and registry modifications. @@ -84,7 +88,8 @@ When the sample is collected, Windows Defender ATP runs the file in is a secure A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done. -> **Note**  Depending on machine availability, sample collection time can vary. There is a 3-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file. +> [!NOTE] +> Depending on machine availability, sample collection time can vary. There is a 3-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file. ## View deep analysis report @@ -121,10 +126,11 @@ HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection Value = 0 - block sample collection Value = 1 - allow sample collection ``` -5. Change the organizational unit through the Group Policy. See [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md). +5. Change the organizational unit through the Group Policy. For more information, see [Configure with Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md). 6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). -> **Note**  If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. +> [!NOTE] +> If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index e1427b0400..381ee7be12 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -8,17 +8,18 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Investigate an IP address associated with a Windows Defender ATP alert **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - - Examine possible communication between your machines and external internet protocol (IP) addresses. Identifying all machines in the organization that communicated with a suspected or known malicious IP address, such as Command and Control (C2) servers, helps determine the potential scope of breach, associated files, and infected machines. @@ -43,7 +44,8 @@ The **Communication with IP in organization** section provides a chronological v Details about the IP address are displayed, including: registration details (if available), reverse IPs (for example, domains), prevalence of machines in the organization that communicated with this IP Address (during selectable time period), and the machines in the organization that were observed communicating with this IP address. -> **Note**  Search results will only be returned for IP addresses observed in communication with machines in the organization. +> [!NOTE] +> Search results will only be returned for IP addresses observed in communication with machines in the organization. Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the IP address, the file associated with the communication and the last date observed. diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index 4778e194e5..fb34c03d1f 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -8,17 +8,19 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Investigate machines in the Windows Defender ATP Machines view **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting telemetry in your network. Use the Machines view in these two main scenarios: @@ -37,7 +39,8 @@ The Machines view contains the following columns: - **Active Alerts** - the number of alerts reported by the machine by severity - **Active malware detections** - the number of active malware detections reported by the machine -> **Note**  The **Active alerts** and **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> [!NOTE] +> The **Active alerts** and **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. Click any column header to sort the view in ascending or descending order. @@ -55,7 +58,8 @@ You can filter the view by the following time periods: - 30 days - 6 months -> **Note**  When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period. +> [!NOTE] +> When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period. The threat category filter lets you filter the view by the following categories: @@ -65,7 +69,7 @@ The threat category filter lets you filter the view by the following categories: - Threat - Low severity -See the [Investigate machines with active alerts](dashboard-windows-defender-advanced-threat-protection.md#investigate-machines-with-active-malware-detections) topic for a description of each category. +For more information on the description of each category see, [Investigate machines with active alerts](dashboard-windows-defender-advanced-threat-protection.md#investigate-machines-with-active-malware-detections). You can also download a full list of all the machines in your organization, in CSV format. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) to download the entire list as a CSV file. @@ -100,13 +104,14 @@ You'll see an aggregated view of alerts, a short description of the alert, detai This feature also enables you to selectively drill down into a behavior or event that occurred within a given time period. You can view the temporal sequence of events that occurred on a machine over a specified time period. +You can also use the [Alerts spotlight](investigate-alerts-windows-defender-advanced-threat-protection.md#alerts-spotlight) feature to see the correlation between alerts and events on a specific machine. + ![The timeline shows an interactive history of the alerts seen on a machine](images/timeline.png) Use the search bar to look for specific alerts or files associated with the machine. You can also filter by: -- Signed or unsigned files - Detections mode: displays Windows ATP Alerts and detections - Behaviors mode: displays "detections" and selected events of interest - Verbose mode: displays "behaviors" (including "detections"), and all reported events diff --git a/windows/keep-secure/isolated-domain-gpos.md b/windows/keep-secure/isolated-domain-gpos.md index b7f6c3b921..745da6642b 100644 --- a/windows/keep-secure/isolated-domain-gpos.md +++ b/windows/keep-secure/isolated-domain-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 All of the devices in the isolated domain are added to the group CG\_DOMISO\_IsolatedDomain. You must create multiple GPOs to align with this group, one for each Windows operating system that must have different rules or settings to implement the basic isolated domain functionality that you have in your isolated domain. This group is granted Read and Apply Group Policy permissions on all the GPOs described in this section. diff --git a/windows/keep-secure/isolated-domain.md b/windows/keep-secure/isolated-domain.md index 3d23484bf9..43e1461c41 100644 --- a/windows/keep-secure/isolated-domain.md +++ b/windows/keep-secure/isolated-domain.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The isolated domain is the primary zone for trusted devices. The devices in this zone use connection security and firewall rules to control the communications that can be sent between devices in the zone. diff --git a/windows/keep-secure/isolating-apps-on-your-network.md b/windows/keep-secure/isolating-apps-on-your-network.md index 09367196c5..c8adf77620 100644 --- a/windows/keep-secure/isolating-apps-on-your-network.md +++ b/windows/keep-secure/isolating-apps-on-your-network.md @@ -12,7 +12,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 When you add new devices to your network, you may want to customize your Windows Firewall configuration to isolate the network access of the new Windows Store apps that run on them. Developers who build Windows Store apps can declare certain app capabilities that enable different classes of network access. A developer can decide what kind of network access the app requires and configure this capability for the app. When the app is installed on a device, appropriate firewall rules are automatically created to enable access. You can then customize the firewall configuration to further fine-tune this access if they desire more control over the network access for the app. diff --git a/windows/keep-secure/link-the-gpo-to-the-domain.md b/windows/keep-secure/link-the-gpo-to-the-domain.md index ab224211e6..ba14d60b0e 100644 --- a/windows/keep-secure/link-the-gpo-to-the-domain.md +++ b/windows/keep-secure/link-the-gpo-to-the-domain.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you create the GPO and configure it with security group filters and WMI filters, you must link the GPO to the container in Active Directory that contains all of the target devices. diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index 718b2e22ce..d707f81431 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -8,20 +8,22 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Manage Windows Defender Advanced Threat Protection alerts **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - Windows Defender ATP notifies you of detected, possible attacks or breaches through alerts. A summary of new alerts is displayed in the **Dashboard**, and you can access all alerts in the **Alerts queue** menu. -See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-windows-defender-advanced-threat-protection-alerts) topic for more details on how to investigate alerts. +For more information on how to investigate alerts see, [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-windows-defender-advanced-threat-protection-alerts). Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the top of the alert to access the Manage Alert menu and manage alerts. @@ -55,7 +57,7 @@ You can resolve an alert by changing the status of the alert to **Resolved**. Th ![You can resolve an alert as valid, valid - allowed, or false alarm](images/resolve-alert.png) -The comments and change of status are recorded in the [Comments and history window](#view-history-and-comments). +The comments and change of status are recorded in the Comments and history window. ![The comments window will display a history of status changes](images/comments.png) @@ -86,7 +88,8 @@ The context of the rule lets you tailor the queue to ensure that only alerts you 1. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the heading of an existing alert. 2. Choose the context for suppressing the alert. -> **Note**  You cannot create a custom or blank suppression rule. You must start from an existing alert. +> [!NOTE] +> You cannot create a custom or blank suppression rule. You must start from an existing alert. **See the list of suppression rules:** @@ -95,7 +98,8 @@ The context of the rule lets you tailor the queue to ensure that only alerts you ![Click the settings icon and then Suppression rules to create and modify rules](images/suppression-rules.png) -> **Note**  You can also click **See rules** in the confirmation window that appears when you suppress an alert. +> [!NOTE] +> You can also click **See rules** in the confirmation window that appears when you suppress an alert. The list of suppression rules shows all the rules that users in your organization have created. Each rule shows: diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index d5eb1a60e3..71b7ad88c9 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile author: jdeckerMS +localizationpriority: high --- # Manage identity verification using Windows Hello for Business @@ -17,19 +18,20 @@ author: jdeckerMS In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. -> **Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +>[!NOTE] +> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. Hello addresses the following problems with passwords: - Passwords can be difficult to remember, and users often reuse passwords on multiple sites. - Server breaches can expose symmetric network credentials. -- Passwords can be subject to [replay attacks](http://go.microsoft.com/fwlink/p/?LinkId=615673). -- Users can inadvertently expose their passwords due to [phishing attacks](http://go.microsoft.com/fwlink/p/?LinkId=615674). +- Passwords can be subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). +- Users can inadvertently expose their passwords due to [phishing attacks](https://go.microsoft.com/fwlink/p/?LinkId=615674). Hello lets users authenticate to: - a Microsoft account. - an Active Directory account. -- a Microsoft Azure Active Directory (AD) account. -- Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](http://go.microsoft.com/fwlink/p/?LinkId=533889) authentication +- a Microsoft Azure Active Directory (Azure AD) account. +- Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](https://go.microsoft.com/fwlink/p/?LinkId=533889) authentication After an initial two-step verification of the user during enrollment, Hello is set up on the user's device and the user is asked to set a gesture, which can be a biometric, such as a fingerprint, or a PIN. The user provides the gesture to verify their identity. Windows then uses Hello to authenticate users and help them to access protected resources and services. @@ -40,26 +42,30 @@ As an administrator in an enterprise or educational organization, you can create ## The difference between Windows Hello and Windows Hello for Business -- Individuals can create a PIN or biometric gesture on their personal devices for convenient sign-in. This use of Hello provides a layer of protection by being unique to the device on which it is set up, however it is not backed by key-based or certificate-based authentication. +- Individuals can create a PIN or biometric gesture on their personal devices for convenient sign-in. This use of Hello provides a layer of protection by being unique to the device on which it is set up, however it is not backed by certificate-based authentication. - Windows Hello for Business, which is configured by Group Policy or MDM policy, uses key-based or certificate-based authentication. +- Currently Active Directory accounts using Windows Hello are not backed by key-based or certificate-based authentication. Support for key-based or certificate-based authentication is on the roadmap for a future release. + ## Benefits of Windows Hello Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. You may wonder [how a PIN can help protect a device better than a password](why-a-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. -In Windows 10, Hello replaces passwords. The Hello provisioning process creates two cryptographic keys bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identify provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. In addition, during the registration process, the attestation claim is produced for every identity provider to cryptographically prove that the Hello keys are tied to TPM. During registration, when the attestation claim is not presented to the identity provider, the identity provider must assume that the Hello key is created in software. +In Windows 10, Hello replaces passwords. The Hello provisioning process creates a cryptographic key pair bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identify provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. In addition, during the registration process, the attestation claim is produced for every identity provider to cryptographically prove that the Hello keys are tied to TPM. During registration, when the attestation claim is not presented to the identity provider, the identity provider must assume that the Hello key is created in software. ![how authentication works in windows hello](images/authflow.png) Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. -Hello helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Hello credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are generated within isolated environments of TPMs. + +Hello helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Hello credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are protected by TPMs. Hello also enables Windows 10 Mobile devices to be used as [a remote credential](prepare-people-to-use-microsoft-passport.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Hello on the user’s Windows 10 Mobile device. Because users carry their phone with them, Hello makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. -> **Note:**  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. +> [!NOTE] +>  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.   ## How Windows Hello for Business works: key points @@ -71,8 +77,8 @@ Hello also enables Windows 10 Mobile devices to be used as [a remote credential - Private key never leaves a device. The authenticating server has a public key that is mapped to the user account during the registration process. - PIN entry and biometric gesture both trigger Windows 10 to verify the user's identity and authenticate using Hello keys or certificates. - Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. -- Certificates are added to the Hello container and are protected by the Hello gesture. -- Windows Update behavior: After a reboot is required by Windows Update, the last interactive user is automatically signed on without any user gesture and the session is locked so the user's lock screen apps can run. +- Certificate private keys can be protected by the Hello container and the Hello gesture. + ## Comparing key-based and certificate-based authentication @@ -85,21 +91,21 @@ When identity providers such as Active Directory or Azure AD enroll a certificat ## Learn more -[Introduction to Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy +[Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy -[What's new in Active Directory Domain Services (AD DS) in Windows Server Technical Preview](http://go.microsoft.com/fwlink/p/?LinkId=708533) +[What's new in Active Directory Domain Services (AD DS) in Windows Server Technical Preview](https://go.microsoft.com/fwlink/p/?LinkId=708533) -[Windows Hello face authentication](http://go.microsoft.com/fwlink/p/?LinkId=626024) +[Windows Hello face authentication](https://go.microsoft.com/fwlink/p/?LinkId=626024) -[Biometrics hardware guidelines](http://go.microsoft.com/fwlink/p/?LinkId=626995) +[Biometrics hardware guidelines](https://go.microsoft.com/fwlink/p/?LinkId=626995) -[Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](http://go.microsoft.com/fwlink/p/?LinkId=533890) +[Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](https://go.microsoft.com/fwlink/p/?LinkId=533890) -[Windows 10: The End Game for Passwords and Credential Theft?](http://go.microsoft.com/fwlink/p/?LinkId=533891) +[Windows 10: The End Game for Passwords and Credential Theft?](https://go.microsoft.com/fwlink/p/?LinkId=533891) -[Authenticating identities without passwords through Microsoft Passport](http://go.microsoft.com/fwlink/p/?LinkId=616778) +[Authenticating identities without passwords through Microsoft Passport](https://go.microsoft.com/fwlink/p/?LinkId=616778) -[Microsoft Passport guide](http://go.microsoft.com/fwlink/p/?LinkId=691928) +[Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928) ## Related topics diff --git a/windows/keep-secure/manage-tpm-commands.md b/windows/keep-secure/manage-tpm-commands.md index 0620207ec5..c4b6611da4 100644 --- a/windows/keep-secure/manage-tpm-commands.md +++ b/windows/keep-secure/manage-tpm-commands.md @@ -40,7 +40,7 @@ The following procedures describe how to manage the TPM command lists. You must 5. Click **Enabled**, and then click **Show**. 6. For each command that you want to block, click **Add**, enter the command number, and then click **OK**. - >**Note:**  For a list of commands, see the [Trusted Platform Module (TPM) Specifications](http://go.microsoft.com/fwlink/p/?linkid=139770). + >**Note:**  For a list of commands, see the [Trusted Platform Module (TPM) Specifications](https://go.microsoft.com/fwlink/p/?linkid=139770).   7. After you have added numbers for each command that you want to block, click **OK** twice. 8. Close the Local Group Policy Editor. diff --git a/windows/keep-secure/manage-tpm-lockout.md b/windows/keep-secure/manage-tpm-lockout.md index 61c94cc77e..f59a117ee3 100644 --- a/windows/keep-secure/manage-tpm-lockout.md +++ b/windows/keep-secure/manage-tpm-lockout.md @@ -19,17 +19,22 @@ This topic for the IT professional describes how to manage the lockout feature f The TPM will lock itself to prevent tampering or malicious attacks. TPM lockout often lasts for a variable amount of time or until the computer is turned off. While the TPM is in lockout mode, it generally returns an error message when it receives commands that require an authorization value. One exception is that the TPM always allows the owner at least one attempt to reset the TPM lockout when it is in lockout mode. -TPM ownership is commonly taken the first time BitLocker Drive Encryption is turned on for the computer. In this case, the TPM owner authorization password is saved with the BitLocker recovery key. When the BitLocker recovery key is saved to a file, BitLocker also saves a TPM owner password file (.tpm) with the TPM owner password hash value. When the BitLocker recovery key is printed, the TPM owner password is printed at the same time. You can also save your TPM owner password hash value to Active Directory Domain Services (AD DS) if your organization's Group Policy settings are configured to do so. +TPM ownership is taken upon first boot by Windows. By default, Windows does not retain the TPM owner password. In some cases, encryption keys are protected by a TPM by requiring a valid authorization value to access the key. A common example is configuring BitLocker Drive Encryption to use the TPM plus PIN key protector. In this scenario, the user must type the correct PIN during the boot process to access the volume encryption key protected by the TPM. To prevent malicious users or software from discovering authorization values, TPMs implement protection logic. The protection logic is designed to slow or stop responses from the TPM if it detects that an entity might be trying to guess authorization values. -The industry standards from the Trusted Computing Group (TCG) specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 and TPM 2.0 chips. TPM manufacturers implement different protection mechanisms and behavior. The general guidance is for the TPM chip to take exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when they mistype an authorization value that is sent to the TPM. This can prevent them from using the TPM for a period of time. +**TPM 1.2** +The industry standards from the Trusted Computing Group (TCG) specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 and TPM 2.0 chips. TPM 1.2 devices implement different protection mechanisms and behavior. In general, the TPM chip takes exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when they mistype an authorization value that is sent to the TPM. This can prevent them from using the TPM for a period of time. -If your TPM has entered lockout mode or is responding slowly to commands, you can reset the lockout value by using the following procedures. Resetting the TPM lockout requires the TPM owner’s authorization. +**TPM 2.0** + TPM 2.0 devices have standardized lockout behavior which is configured by Windows. TPM 2.0 devices have a maximum count threshold and a healing time. Windows configures the maximum count to be 32 and the healing time to be 2 hours. This means that every continuous two hours of powered on operation without an event which increases the counter will cause the counter to decrease by 1. + +If your TPM has entered lockout mode or is responding slowly to commands, you can reset the lockout value by using the following procedures. Resetting the TPM lockout requires the TPM owner’s authorization. This value is no longer retained by default starting with Windows 10 version 1607. ## Reset the TPM lockout by using the TPM MMC +**Note:** This procedure is only available if you have configured Windows to retain the TPM Owner Password. By default, this password is not available in Windows 10 starting with version 1607. -The following procedure explains the steps to reset the TPM lockout by using the TPM MMC. +The following procedure explains the steps to reset the TPM lockout by using the TPM MMC. **To reset the TPM lockout** @@ -71,4 +76,4 @@ For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell ## Additional resources -For more info about TPM, see [TPM technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). \ No newline at end of file +For more info about TPM, see [TPM technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). diff --git a/windows/keep-secure/mandatory-settings-for-wip.md b/windows/keep-secure/mandatory-settings-for-wip.md index 56b79bc283..0e1345c2ae 100644 --- a/windows/keep-secure/mandatory-settings-for-wip.md +++ b/windows/keep-secure/mandatory-settings-for-wip.md @@ -6,27 +6,26 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security +localizationpriority: high --- # Mandatory tasks and settings required to turn on Windows Information Protection (WIP) **Applies to:** -- Windows 10 Insider Preview -- Windows 10 Mobile Preview - -[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] +- Windows 10, version 1607 +- Windows 10 Mobile This list provides all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. >**Important**
    -All sections provided for more info appear in either the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-edp-policy-using-intune.md) or [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md), based on the tool you're using in your enterprise. +All sections provided for more info appear in either the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) or [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md), based on the tool you're using in your enterprise. |Task |Description | |------------------------------------|--------------------------| |Add at least one app rule in the **App Rules** area in your WIP policy. |You must have at least one app rule specified in the **App Rules** area of your WIP policy. For more info about where this area is and how to add an app rule, see the **Add individual apps to your Protected App list** section of the policy creation topics.| -|Pick your WIP protection level. |You must choose the level of protection level you want to apply to your WIP-protected content, including Override, Silent, or Block. For more info about where this area is and how to decide on your protection level, see the **Manage the EDP protection level for your enterprise data** section of the policy creation topics.| +|Pick your WIP protection level. |You must choose the level of protection level you want to apply to your WIP-protected content, including Override, Silent, or Block. For more info about where this area is and how to decide on your protection level, see the **Manage the WIP protection level for your enterprise data** section of the policy creation topics.| |Specify your corporate identity. |You must specify your corporate identity, usually expressed as your primary Internet domain (for example, contoso.com). For more info about where this area is and what it means, see the **Define your enterprise-managed corporate identity** section of the policy creation topics. | |Specify your Enterprise Network Domain Names. |You must specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. For more info about where this area is and how to add your suffixes, see the table that appears in the **Choose where apps can access enterprise data** section of the policy creation topics. | |Specify your Enterprise IPv4 or IPv6 Ranges. |Specify the addresses for a valid IPv4 or IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries. For more info about where this area is and what it means, see the table that appears in the **Define your enterprise-managed corporate identity** section of the policy creation topics. | -|Include your Data Recovery Agent (DRA) certificate. |This certificate makes sure that any of your WIP-encrypted data can be decrypted, even if the security keys are lost. For more info about where this area is and what it means, see the **Create and verify an Encrypting File System (EFS) DRA certificate for EDP** section of the policy creation topics. | \ No newline at end of file +|Include your Data Recovery Agent (DRA) certificate. |This certificate makes sure that any of your WIP-encrypted data can be decrypted, even if the security keys are lost. For more info about where this area is and what it means, see the **Create and verify an Encrypting File System (EFS) DRA certificate** section of the policy creation topics. | \ No newline at end of file diff --git a/windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md b/windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md index 3187e17371..49dc1620f6 100644 --- a/windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md +++ b/windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you finish reviewing the existing Windows Firewall with Advanced Security deployment goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design. diff --git a/windows/keep-secure/microsoft-accounts.md b/windows/keep-secure/microsoft-accounts.md index 910e6fac1f..6bea7ac9aa 100644 --- a/windows/keep-secure/microsoft-accounts.md +++ b/windows/keep-secure/microsoft-accounts.md @@ -98,7 +98,7 @@ Although the Microsoft account was designed to serve consumers, you might find s - **Integrated social media services**: - Contact information and status for your users’ friends and associates automatically stay up-to-date from sites such as Hotmail, Outlook, Facebook, Twitter, and LinkedIn. Users can also access and share photos, documents, and other files from sites such as SkyDrive, Facebook, and Flickr. + Contact information and status for your users’ friends and associates automatically stay up-to-date from sites such as Hotmail, Outlook, Facebook, Twitter, and LinkedIn. Users can also access and share photos, documents, and other files from sites such as OneDrive, Facebook, and Flickr. ### Managing the Microsoft account in the domain diff --git a/windows/keep-secure/microsoft-passport-and-password-changes.md b/windows/keep-secure/microsoft-passport-and-password-changes.md index ff90865f5e..128f1ffe29 100644 --- a/windows/keep-secure/microsoft-passport-and-password-changes.md +++ b/windows/keep-secure/microsoft-passport-and-password-changes.md @@ -7,8 +7,9 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS +localizationpriority: high --- -# Microsoft Passport and password changes +# Windows Hello and password changes **Applies to** - Windows 10 diff --git a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md index 78dcefde4d..3e4fbfbedf 100644 --- a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md +++ b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS +localizationpriority: high --- # Windows Hello errors during PIN creation @@ -16,11 +17,11 @@ author: jdeckerMS - Windows 10 - Windows 10 Mobile -When you set up Windows Hello in Windows 10, you may get an error during the **Create a work PIN** step. This topic lists some of the error codes with recommendations for mitigating the problem. If you get an error code that is not listed here, contact Microsoft Support. +When you set up Windows Hello in Windows 10, you may get an error during the **Create a PIN** step. This topic lists some of the error codes with recommendations for mitigating the problem. If you get an error code that is not listed here, contact Microsoft Support. ## Where is the error code? -The following image shows an example of an error during **Create a work PIN**. +The following image shows an example of an error during **Create a PIN**. ![](images/pinerror.png) @@ -30,8 +31,8 @@ When a user encounters an error when creating the work PIN, advise the user to t 1. Try to create the PIN again. Some errors are transient and resolve themselves. 2. Sign out, sign in, and try to create the PIN again. 3. Reboot the device and then try to create the PIN again. -4. Unjoin the device from Azure Active Directory (Azure AD), rejoin, and then try to create the PIN again. To unjoin a desktop PC, go to **Settings** > **System** > **About** and select **Disconnect from organization**. To unjoin a device running Windows 10 Mobile, you must [reset the device](http://go.microsoft.com/fwlink/p/?LinkId=715697). -5. On mobile devices, if you are unable to setup a PIN after multiple attempts, reset your device and start over. For help on how to reset your phone go to [Reset my phone](http://go.microsoft.com/fwlink/p/?LinkId=715697). +4. Unjoin the device from Azure Active Directory (Azure AD), rejoin, and then try to create the PIN again. To unjoin a desktop PC, go to **Settings** > **System** > **About** and select **Disconnect from organization**. To unjoin a device running Windows 10 Mobile, you must [reset the device](https://go.microsoft.com/fwlink/p/?LinkId=715697). +5. On mobile devices, if you are unable to setup a PIN after multiple attempts, reset your device and start over. For help on how to reset your phone go to [Reset my phone](https://go.microsoft.com/fwlink/p/?LinkId=715697). If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance. @@ -83,7 +84,7 @@ If the error occurs again, check the error code against the following table to s - + @@ -98,7 +99,7 @@ If the error occurs again, check the error code against the following table to s - + diff --git a/windows/keep-secure/microsoft-passport-guide.md b/windows/keep-secure/microsoft-passport-guide.md index b78b6f94f7..d4bd6e4d33 100644 --- a/windows/keep-secure/microsoft-passport-guide.md +++ b/windows/keep-secure/microsoft-passport-guide.md @@ -8,6 +8,7 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: security author: challum +localizationpriority: high --- # Microsoft Passport guide @@ -15,7 +16,10 @@ author: challum **Applies to** - Windows 10 -This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10 operating system. It highlights specific capabilities of these technologies that help mitigate threats from conventional credentials and provides guidance about how to design and deploy these technologies as part of your Windows 10 rollout. +This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10, version 1511 operating system. It highlights specific capabilities of these technologies that help mitigate threats from conventional credentials and provides guidance about how to design and deploy these technologies as part of your Windows 10 rollout. + +>[!NOTE] +>For information about Windows Hello for Business in Windows 10, version 1607, see [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md). A fundamental assumption about information security is that a system can identify who’s using it. In identifying a user, the system can decide whether the user has identified himself or herself appropriately (a process known as authentication), and then determine what that properly authenticated user should be able to do (a process known as authorization). The overwhelming majority of computer systems deployed throughout the world depend on user credentials as a means of making authentication and authorization decisions, and that means that these systems depend on reusable, user-created passwords for their security. The oft-cited maxim that authentication can involve “something you know, something you have, or something you are” neatly highlights the issue: a reusable password is an authentication factor all by itself, so anyone who knows the password can impersonate the user who owns it. @@ -41,7 +45,7 @@ Most security is a tradeoff between convenience and security: the more secure a **Password complexity** -If the major risk to passwords is that an attacker might guess them through brute-force analysis, it might seem reasonable to require users to include a broader character set in their passwords or make them longer, but as a practical matter, password length and complexity requirements have two negative side effects. First, they encourage password reuse. Estimates by [Herley, Florêncio, and van Oorschot](http://go.microsoft.com/fwlink/p/?LinkId=627392) calculate that the stronger a password is, the more likely it is to be reused. Because users put more effort into the creation and memorization of strong passwords, they are much more likely to use the same credential across multiple systems. Second, adding length or character set complexity to passwords does not necessarily make them more difficult to guess. For example, P@ssw0rd1 is nine characters long and includes uppercase and lowercase letters, numbers, and special characters, but it’s easily guessed by many of the common password-cracking tools now available on the Internet. These tools can attack passwords by using a pre-computed dictionary of common passwords, or they can start with a base word such as password, and then apply common character substitutions. A completely random eight-character password might therefore actually take longer to guess than P@ssw0rd123. +If the major risk to passwords is that an attacker might guess them through brute-force analysis, it might seem reasonable to require users to include a broader character set in their passwords or make them longer, but as a practical matter, password length and complexity requirements have two negative side effects. First, they encourage password reuse. Estimates by [Herley, Florêncio, and van Oorschot](https://go.microsoft.com/fwlink/p/?LinkId=627392) calculate that the stronger a password is, the more likely it is to be reused. Because users put more effort into the creation and memorization of strong passwords, they are much more likely to use the same credential across multiple systems. Second, adding length or character set complexity to passwords does not necessarily make them more difficult to guess. For example, P@ssw0rd1 is nine characters long and includes uppercase and lowercase letters, numbers, and special characters, but it’s easily guessed by many of the common password-cracking tools now available on the Internet. These tools can attack passwords by using a pre-computed dictionary of common passwords, or they can start with a base word such as password, and then apply common character substitutions. A completely random eight-character password might therefore actually take longer to guess than P@ssw0rd123. **Password expiration** @@ -101,11 +105,11 @@ Microsoft Passport offers four significant advantages over the current state of **It’s flexible** Microsoft Passport offers unprecedented flexibility. Although the format and use of reusable passwords are fixed, Microsoft Passport gives both administrators and users options to manage authentication. First and foremost, Microsoft Passport works with both biometric identifiers and PINs, so users’ credentials are protected even on devices that don’t support biometrics. Users can even use their phone to release their credentials instead of a PIN or biometric gesture on the main device. Microsoft Passport seamlessly takes advantage of the hardware of the devices in use; as users upgrade to newer devices, Microsoft Passport is ready to use them, and organizations can upgrade existing devices by adding biometric sensors where appropriate. -Microsoft Passport offers flexibility in the datacenter, too. To deploy it, in some modes you must add Windows Server 2016 Technical Preview domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Microsoft Passport build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport on your network. The choice of which users you should enable for Microsoft Passport use is completely up to you: you choose the policies and devices to support and which authentication factors you want users to have access to. This makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding strong credential protection to users who don’t currently have it or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems (described in the [Design a Microsoft Passport deployment](#design) section). +Microsoft Passport offers flexibility in the datacenter, too. To deploy it, in some modes you must add Windows Server 2016 domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Microsoft Passport build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport on your network. The choice of which users you should enable for Microsoft Passport use is completely up to you: you choose the policies and devices to support and which authentication factors you want users to have access to. This makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding strong credential protection to users who don’t currently have it or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems (described in the [Design a Microsoft Passport deployment](#design) section). **It’s standardized** -Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end. The future lies with open, interoperable systems that allow secure authentication across a variety of devices, LOBs, and external applications and websites. To this end, a group of industry players formed the Fast IDentity Online Alliance (FIDO), a nonprofit organization intended to address the lack of interoperability among strong authentication devices as well as the problems users face when they have to create and remember multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services. This new standard for security devices and browser plug ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security. For more information, see the [FIDO Alliance website](http://go.microsoft.com/fwlink/p/?LinkId=627393). +Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end. The future lies with open, interoperable systems that allow secure authentication across a variety of devices, LOBs, and external applications and websites. To this end, a group of industry players formed the Fast IDentity Online Alliance (FIDO), a nonprofit organization intended to address the lack of interoperability among strong authentication devices as well as the problems users face when they have to create and remember multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services. This new standard for security devices and browser plug ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security. For more information, see the [FIDO Alliance website](https://go.microsoft.com/fwlink/p/?LinkId=627393). In 2013, Microsoft joined the FIDO Alliance. FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong passwordless authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: passwordless (known as the Universal Authentication Framework \[UAF\]) and 2nd Factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals to combine the best parts of the U2F and UAF FIDO 1.0 standards. Microsoft is actively contributing to the proposals, and Windows 10 is a reference implementation of these concepts. In addition to supporting those protocols, the Windows implementation covers other aspects of the end-to-end experience that the specification does not cover, including user interface to, storage of, and protection for users’ device keys and the tokens issued after authentication; supporting administrator policies; and providing deployment tools. Microsoft expects to continue working with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. @@ -177,7 +181,7 @@ Containers can contain several types of key material: - *Secure/Multipurpose Internet Mail Extensions (S/MIME) keys and certificates*, which a certification authority (CA) generates. The keys associated with the user’s S/MIME certificate can be stored in a Microsoft Passport container so they’re available to the user whenever the container is unlocked. - The *IDP key*. These keys can be either symmetric or asymmetric, depending on which IDP you use. A single container may contain zero or more IDP keys, with some restrictions (for example, the enterprise container can contain zero or one IDP keys). IDP keys are stored in the container as illustrated in Figure 3. For certificate-based Microsoft Passport for Work, when the container is unlocked, applications that require access to the IDP key or key pair can request access. IDP keys are used to sign or encrypt authentication requests or tokens sent from this machine to the IDP. IDP keys are typically long lived but could have a shorter lifetime than the authentication key. Microsoft accounts, Active Directory accounts, and Azure AD accounts all require the use of asymmetric key pairs. The device generates public and private keys, registers the public key with the IDP (which stores it for later verification), and securely stores the private key. For enterprises, the IDP keys can be generated in two ways: -- The IDP key pair can be associated with an enterprise CA through the Windows Network Device Enrollment Service (NDES), described more fully in [Network Device Enrollment Service Guidance](http://go.microsoft.com/fwlink/p/?LinkId=733947). In this case, Microsoft Passport requests a new certificate with the same key as the certificate from the existing PKI. This option lets organizations that have an existing PKI continue to use it where appropriate. Given that many applications, such as popular virtual private network systems, require the use of certificates, when you deploy Microsoft Passport in this mode, it allows a faster transition away from user passwords while still preserving certificate-based functionality. This option also allows the enterprise to store additional certificates in the protected container. +- The IDP key pair can be associated with an enterprise CA through the Windows Network Device Enrollment Service (NDES), described more fully in [Network Device Enrollment Service Guidance](https://go.microsoft.com/fwlink/p/?LinkId=733947). In this case, Microsoft Passport requests a new certificate with the same key as the certificate from the existing PKI. This option lets organizations that have an existing PKI continue to use it where appropriate. Given that many applications, such as popular virtual private network systems, require the use of certificates, when you deploy Microsoft Passport in this mode, it allows a faster transition away from user passwords while still preserving certificate-based functionality. This option also allows the enterprise to store additional certificates in the protected container. - The IDP can generate the IDP key pair directly, which allows quick, lower-overhead deployment of Microsoft Passport in environments that don’t have or need a PKI. **How keys are protected** @@ -239,7 +243,7 @@ The major benefit of this approach is that it provides uniform protection for al The downside to this approach is its complexity. Smaller organizations may find that managing the rollout of a new operating system across all devices is beyond the scope of their experience and capability. For these organizations, users can self-upgrade, and new users may end up with Windows 10 because they get new devices when they join. Larger organizations, especially those that are highly decentralized or have operations across many physical sites, may have more deployment knowledge and resources but face the challenge of coordinating rollout efforts across a larger user base and footprint. -For more information about desktop deployment of Windows 10, visit the [Windows 10 TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=626581). +For more information about desktop deployment of Windows 10, visit the [Windows 10 TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=626581). One key aspect of this deployment strategy is how to get Windows 10 in users’ hands. Because different organizations have wildly differing strategies to refresh hardware and software, there’s no one-size-fits-all strategy. For example, some organizations pursue a coordinated strategy that puts new desktop operating systems in users’ hands every 2–3 years on existing hardware, supplementing with new hardware only where and when required. Others tend to replace hardware and deploy whatever version of the Windows client operating system ships on the purchased devices. In both cases, there are typically separate deployment cycles for servers and server operating systems, and the desktop and server cycles may or may not be coordinated. @@ -303,7 +307,7 @@ Table 1. Deployment requirements for Microsoft Passport @@ -333,7 +337,7 @@ Note that the current release of Windows 10 supports the Azure AD–only (RTM) **Select policy settings** -Another key aspect of Microsoft Passport for Work deployment involves the choice of which policy settings to apply to the enterprise. There are two parts to this choice: which policies you deploy to manage Microsoft Passport itself and which policies you deploy to control device management and registration. A complete guide to selecting effective policies is beyond the scope of this guide, but one example reference that may be useful is [Mobile device management capabilities in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733877). +Another key aspect of Microsoft Passport for Work deployment involves the choice of which policy settings to apply to the enterprise. There are two parts to this choice: which policies you deploy to manage Microsoft Passport itself and which policies you deploy to control device management and registration. A complete guide to selecting effective policies is beyond the scope of this guide, but one example reference that may be useful is [Mobile device management capabilities in Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=733877). ## Implement Microsoft Passport @@ -362,7 +366,7 @@ As of the initial release of Windows 10, you can control the following settings - You can define the complexity and length of the PIN that users generate at registration. - You can control whether Windows Hello use is enabled in your organization. -These settings can be implemented through GPOs or through configuration service providers (CSPs) in MDM systems, so you have a familiar and flexible set of tools you can use to apply them to exactly the users you want. (For details about the Microsoft Passport for Work CSP, see [PassportForWork CSP)](http://go.microsoft.com/fwlink/p/?LinkId=733876). +These settings can be implemented through GPOs or through configuration service providers (CSPs) in MDM systems, so you have a familiar and flexible set of tools you can use to apply them to exactly the users you want. (For details about the Microsoft Passport for Work CSP, see [PassportForWork CSP)](https://go.microsoft.com/fwlink/p/?LinkId=733876). ## Roadmap diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 1bc9344b78..8fa747d356 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -8,39 +8,109 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: iaanw +localizationpriority: high --- # Minimum requirements for Windows Defender ATP **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - There are some minimum requirements for onboarding your network and endpoints. ## Minimum requirements ### Network and data storage and configuration requirements - - - - -When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: in either a European or United States datacenter. +When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: either in a European or United States datacenter. > **Notes**   - You cannot change your data storage location after the first-time setup. - Review the [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) for more information on where and how Microsoft stores your data. ### Endpoint hardware and software requirements -Endpoints on your network must be running Windows 10 Insider Preview Build 14332 or later. The hardware requirements for Windows Defender ATP on endpoints is the same as those for Windows 10 Insider Preview Build 14332 or later. +The Windows Defender ATP agent only supports the following editions of Windows 10: -> **Note**  Endpoints that are running Windows Server and mobile versions of Windows are not supported. +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education -Internet connectivity on endpoints is also required. See [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) for additional proxy configuration settings. +Endpoints on your network must be running one of these editions. + +The hardware requirements for Windows Defender ATP on endpoints is the same as those for the supported editions. + +> [!NOTE] +> Endpoints that are running Windows Server and mobile versions of Windows are not supported. + +#### Internet connectivity +Internet connectivity on endpoints is required. + +SENSE can utilize up to 5MB daily of bandwidth to communicate with the Windows Defender ATP cloud service and report cyber data. + +> [!NOTE] +> SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. + +For more information on additional proxy configuration settings see, [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) . Before you configure endpoints, the telemetry and diagnostics service must be enabled. The service is enabled by default in Windows 10, but if it has been disabled you can turn it on by following the instructions in the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section. +### Telemetry and diagnostics settings +You must ensure that the telemetry and diagnostics service is enabled on all the endpoints in your organization. +By default, this service is enabled, but it's good practice to check to ensure that you'll get telemetry from them. +**Use the command line to check the Windows 10 telemetry and diagnostics service startup type**: + +1. Open an elevated command-line prompt on the endpoint: + + a. Go to **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command, and press **Enter**: + + ```text + sc qc diagtrack + ``` + +If the service is enabled, then the result should look like the following screenshot: + +![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + +If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the service to automatically start. + + + +**Use the command line to set the Windows 10 telemetry and diagnostics service to automatically start:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Go to **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command, and press **Enter**: + + ```text + sc config diagtrack start=auto + ``` + +3. A success message is displayed. Verify the change by entering the following command, and press **Enter**: + + ```text + sc qc diagtrack + ``` + +## Windows Defender signature updates are configured +The Windows Defender ATP agent depends on Windows Defender’s ability to scan files and provide information about them. If Windows Defender is not the active antimalware in your organization, you may need to configure the signature updates. For more information see [Configure Windows Defender in Windows 10](windows-defender-in-windows-10.md). + +When Windows Defender is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender goes on passive mode. For more information, see the **Compatibility** section in the [Windows Defender in Windows 10 topic](windows-defender-in-windows-10.md# compatibility-with-windows-defender-advanced-threat-protection). + +## Windows Defender Early Launch Antimalware (ELAM) driver is enabled +If you're running Windows Defender as the primary antimalware product on your endpoints, the Windows Defender ATP agent will successfully onboard. + +If you're running a third-party antimalware client and use Mobile Device Management solutions or System Center Configuration Manager (current branch) version 1606, you'll need to ensure that the Windows Defender ELAM driver is enabled. For more information on how to validate and enable the Windows Defender ELAM driver see, [Ensure the Windows Defender ELAM driver is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-windows-defender-elam-driver-is-enabled). diff --git a/windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md b/windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md index 95ab7cda01..d2ed73907e 100644 --- a/windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md +++ b/windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 You must reconfigure your copied GPO so that it contains the correct security group and WMI filters for its new role. If you are creating the GPO for the isolated domain, use the [Block members of a group from applying a GPO](#to-block-members-of-a-group-from-applying-a-gpo) procedure to prevent members of the boundary and encryption zones from incorrectly applying the GPOs for the main isolated domain. diff --git a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..2f8775683c --- /dev/null +++ b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md @@ -0,0 +1,7 @@ + --- + redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection + --- + +# Monitor the Windows Defender Advanced Threat Protection onboarding + +This page has been redirected to [Configure endpoints](https://technet.microsoft.com/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection) \ No newline at end of file diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index 942dfa02ee..9205bb0153 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -8,19 +8,22 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: iaanw +localizationpriority: high --- # Onboard and set up Windows Defender Advanced Threat Protection **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - You need to onboard to Windows Defender ATP before you can use the service. + ## In this section Topic | Description :---|:--- diff --git a/windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md b/windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md index f29f5afbb7..420518e4ca 100644 --- a/windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md +++ b/windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Procedures in this guide that refer to GPOs for earlier versions of the Windows operating system instruct you to work with the IP Security Policy section in the Group Policy Management Console (GPMC). diff --git a/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md b/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md index e179647bac..bbecb7b8ad 100644 --- a/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md +++ b/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Most of the procedures in this guide instruct you to use Group Policy settings for Windows Firewall with Advanced Security. diff --git a/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md b/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md index 2d848ec539..9712af0076 100644 --- a/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md +++ b/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To open a GPO to Windows Firewall diff --git a/windows/keep-secure/open-windows-firewall-with-advanced-security.md b/windows/keep-secure/open-windows-firewall-with-advanced-security.md index cda993d4ad..8f20a73c1c 100644 --- a/windows/keep-secure/open-windows-firewall-with-advanced-security.md +++ b/windows/keep-secure/open-windows-firewall-with-advanced-security.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This procedure shows you how to open the Windows Firewall with Advanced Security console. diff --git a/windows/keep-secure/optimize-applocker-performance.md b/windows/keep-secure/optimize-applocker-performance.md index ff8f099f2d..5282b92618 100644 --- a/windows/keep-secure/optimize-applocker-performance.md +++ b/windows/keep-secure/optimize-applocker-performance.md @@ -20,7 +20,7 @@ This topic for IT professionals describes how to optimize AppLocker policy enfor AppLocker policies can be implemented by organization unit (OU) using Group Policy. If so, your Group Policy infrastructure should be optimized and retested for performance when AppLocker policies are added to existing Group Policy Objects (GPOs) or new GPOs are created, as you do with adding any policies to your GPOs. -For more info, see the [Optimizing Group Policy Performance](http://go.microsoft.com/fwlink/p/?LinkId=163238) article in TechNet Magazine. +For more info, see the [Optimizing Group Policy Performance](https://go.microsoft.com/fwlink/p/?LinkId=163238) article in TechNet Magazine. ### AppLocker rule limitations diff --git a/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md b/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md index f915647f15..89b5072658 100644 --- a/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md +++ b/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md @@ -4,6 +4,7 @@ description: This article describes how to create a code signing certificate for keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy +localizationpriority: high author: brianlic-msft --- diff --git a/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md b/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md new file mode 100644 index 0000000000..0f98929851 --- /dev/null +++ b/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md @@ -0,0 +1,58 @@ + +--- +title: Override Process Mitigation Options to help enforce app-related security policies (Windows 10) +description: How to use Group Policy to override individual Process Mitigation Options settings and to help enforce specific app-related security policies. +keywords: Process Mitigation Options, Mitigation Options, Group Policy Mitigation Options +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: security +ms.sitesec: library +--- + + +# Override Process Mitigation Options to help enforce app-related security policies + +**Applies to:** + +- Windows 10, version 1607 +- Windows Server 2016 + +Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies. + +**To modify Process Mitigation Options** + +1. Open your Group Policy editor and go to the **Administrative Templates\System\Mitigation Options\Process Mitigation Options** setting. + + ![Group Policy editor: Process Mitigation Options with setting enabled and Show button active](images/gp-process-mitigation-options.png) + +2. Click **Enabled**, and then in the **Options** area, click **Show** to open the **Show Contents** box, where you’ll be able to add your apps and the appropriate bit flag values, as shown in the [Setting the bit field](#setting-the-bit-field) and [Example](#example) sections of this topic. + + **Important**
    For each app you want to include, you must include: + + - **Value name.** The app file name, including the extension. For example, iexplore.exe. + - **Value.** A bit field with a series of bit flags in particular positions. Bits can be set to 0 (where the setting is forced off), 1 (where the setting is forced on), or ? (where the setting retains the previous, existing value). + + **Note**
    Setting bit flags in positions not specified here to anything other than ? might cause undefined behavior. + + ![Group Policy editor: Process Mitigation Options with Show Contents box and example text](images/gp-process-mitigation-options-show.png) + +## Setting the bit field +Here’s a visual representation of the bit flag locations for the various Process Mitigation Options settings: + +![Visual representation of the bit flag locations for the Process Mitigation Options settings](images/gp-process-mitigation-options-bit-flag-image.png) + +Where the bit flags are read from right to left and are defined as: + +|Flag |Bit location |Setting |Details | +|-----|--------------|--------|--------| +|A |0 |`PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE (0x00000001)` |Turns on Data Execution Prevention (DEP) for child processes. | +|B |1 |`PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE (0x00000002)` |Turns on DEP-ATL thunk emulation for child processes. DEP-ATL thunk emulation lets the system intercept non-executable (NX) faults that originate from the Active Template Library (ATL) thunk layer, and then emulate and handle the instructions so the process can continue to run. | +|C |2 |`PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE (0x00000004)` |Turns on Structured Exception Handler Overwrite Protection (SEHOP) for child processes. SEHOP helps to block exploits that use the Structured Exception Handler (SEH) overwrite technique. | +|D |8 |`PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON (0x00000100)` |Uses the force Address Space Layout Randomization (ASLR) setting to act as though an image base collision happened at load time, forcibly rebasing images that aren’t dynamic base compatible. Images without the base relocation section won’t be loaded if relocations are required. | +|E |15 |`PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON (0x00010000)` |Turns on the bottom-up randomization policy, which includes stack randomization options and causes a random location to be used as the lowest user address. | +|F |16 |`PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF (0x00020000)` |Turns off the bottom-up randomization policy, which includes stack randomization options and causes a random location to be used as the lowest user address. | + +## Example +If you want to turn on the **PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE** and **PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON** settings, turn off the **PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF** setting, and leave everything else as the default values, you’d want to type a value of `???????????????0???????1???????1`. + + diff --git a/windows/keep-secure/overview-create-edp-policy.md b/windows/keep-secure/overview-create-edp-policy.md index 02e9e28ec7..74ca414ed7 100644 --- a/windows/keep-secure/overview-create-edp-policy.md +++ b/windows/keep-secure/overview-create-edp-policy.md @@ -1,36 +1,5 @@ --- title: Create an enterprise data protection (EDP) policy (Windows 10) description: Microsoft Intune and System Center Configuration Manager Technical Preview version 1605 or later helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. -ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -author: eross-msft ---- - -# Create an enterprise data protection (EDP) policy -**Applies to:** - -- Windows 10 Insider Preview -- Windows 10 Mobile Preview - -[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -Microsoft Intune and System Center Configuration Manager Technical Preview version 1605 or later helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. - -## In this section -|Topic |Description | -|------|------------| -|[Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) |Intune helps you create and deploy your EDP policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. | -|[Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |System Center Configuration Manager Technical Preview version 1605 or later helps you create and deploy your EDP policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. | -  - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/overview-create-wip-policy +--- \ No newline at end of file diff --git a/windows/keep-secure/overview-create-wip-policy.md b/windows/keep-secure/overview-create-wip-policy.md new file mode 100644 index 0000000000..f0ae686b47 --- /dev/null +++ b/windows/keep-secure/overview-create-wip-policy.md @@ -0,0 +1,26 @@ +--- +title: Create a Windows Information Protection (WIP) policy (Windows 10) +description: Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: eross-msft +localizationpriority: high +--- + +# Create a Windows Information Protection (WIP) policy +**Applies to:** + +- Windows 10, version 1607 +- Windows 10 Mobile + +Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. + +## In this section +|Topic |Description | +|------|------------| +|[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Intune helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | +|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |System Center Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | +|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. | \ No newline at end of file diff --git a/windows/keep-secure/passport-event-300.md b/windows/keep-secure/passport-event-300.md index 51e13a8d72..25c9b86986 100644 --- a/windows/keep-secure/passport-event-300.md +++ b/windows/keep-secure/passport-event-300.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS +localizationpriority: high --- # Event ID 300 - Windows Hello successfully created @@ -34,7 +35,7 @@ This is a normal condition. No further action is required. ## Related topics -[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) diff --git a/windows/keep-secure/plan-for-applocker-policy-management.md b/windows/keep-secure/plan-for-applocker-policy-management.md index 96d65e5c32..ba66c70d42 100644 --- a/windows/keep-secure/plan-for-applocker-policy-management.md +++ b/windows/keep-secure/plan-for-applocker-policy-management.md @@ -64,13 +64,13 @@ AppLocker event log is located in the following path: **Applications and Service 2. **MSI and Script**. Contains events for all files affected by the Windows Installer and script rule collections (.msi, .msp, .ps1, .bat, .cmd, .vbs, and .js). 3. **Packaged app-Deployment** or **Packaged app-Execution**, contains events for all Universal Windows apps affected by the packaged app and packed app installer rule collection (.appx). -Collecting these events in a central location can help you maintain your AppLocker policy and troubleshoot rule configuration problems. Event collection technologies such as those available in Windows allow administrators to subscribe to specific event channels and have the events from source computers aggregated into a forwarded event log on a Windows Server operating system collector. For more info about setting up an event subscription, see [Configure Computers to Collect and Forward Events](http://go.microsoft.com/fwlink/p/?LinkId=145012). +Collecting these events in a central location can help you maintain your AppLocker policy and troubleshoot rule configuration problems. Event collection technologies such as those available in Windows allow administrators to subscribe to specific event channels and have the events from source computers aggregated into a forwarded event log on a Windows Server operating system collector. For more info about setting up an event subscription, see [Configure Computers to Collect and Forward Events](https://go.microsoft.com/fwlink/p/?LinkId=145012). ### Policy maintenance As new apps are deployed or existing apps are updated by the software publisher, you will need to make revisions to your rule collections to ensure that the policy is current. -You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. For more info about Advanced Group Policy Management, see [Advanced Group Policy Management Overview](http://go.microsoft.com/fwlink/p/?LinkId=145013) (http://go.microsoft.com/fwlink/p/?LinkId=145013). +You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. For more info about Advanced Group Policy Management, see [Advanced Group Policy Management Overview](https://go.microsoft.com/fwlink/p/?LinkId=145013) (https://go.microsoft.com/fwlink/p/?LinkId=145013). >**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior.   @@ -100,7 +100,7 @@ A file could be blocked for three reasons: - There may be an existing rule that was created for the file that is too restrictive. - A deny rule, which cannot be overridden, is explicitly blocking the file. -Before editing the rule collection, first determine what rule is preventing the file from running. You can troubleshoot the problem by using the **Test-AppLockerPolicy** Windows PowerShell cmdlet. For more info about troubleshooting an AppLocker policy, see [Testing and Updating an AppLocker Policy](http://go.microsoft.com/fwlink/p/?LinkId=160269) (http://go.microsoft.com/fwlink/p/?LinkId=160269). +Before editing the rule collection, first determine what rule is preventing the file from running. You can troubleshoot the problem by using the **Test-AppLockerPolicy** Windows PowerShell cmdlet. For more info about troubleshooting an AppLocker policy, see [Testing and Updating an AppLocker Policy](https://go.microsoft.com/fwlink/p/?LinkId=160269) (https://go.microsoft.com/fwlink/p/?LinkId=160269). ## Next steps diff --git a/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md b/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md index 1fa912d181..77613b4101 100644 --- a/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md +++ b/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md @@ -99,7 +99,7 @@ In addition to your domain model, you should also find out whether your organiza >**Important:**  Including auditing within your organization's security plan also makes it possible to budget your resources on the areas where auditing can achieve the most positive results.   -For additional details about how to complete each of these steps and how to prepare a detailed threat model, download the [IT Infrastructure Threat Modeling Guide](http://go.microsoft.com/fwlink/p/?LinkId=163432). +For additional details about how to complete each of these steps and how to prepare a detailed threat model, download the [IT Infrastructure Threat Modeling Guide](https://go.microsoft.com/fwlink/p/?LinkId=163432). ### Data and resources @@ -144,7 +144,7 @@ Security and auditing requirements and audit event volume can vary considerably - If the computers are servers, desktop computers, or portable computers. - The important applications the computers run, such as Exchange Server, SQL Server, or Forefront Identity Manager. - >**Note:**  If the server applications (including Exchange Server and SQL Server) have audit settings. For more information about auditing in Exchange Server, see the [Exchange 2010 Security Guide](http://go.microsoft.com/fwlink/p/?linkid=128052). For more information about auditing in SQL Server 2008, see [Auditing (Database Engine)](http://go.microsoft.com/fwlink/p/?LinkId=163434). For SQL Server 2012, see [SQL Server Audit (Database Engine)](http://technet.microsoft.com/library/cc280386.aspx). + >**Note:**  If the server applications (including Exchange Server and SQL Server) have audit settings. For more information about auditing in Exchange Server, see the [Exchange 2010 Security Guide](https://go.microsoft.com/fwlink/p/?linkid=128052). For more information about auditing in SQL Server 2008, see [Auditing (Database Engine)](https://go.microsoft.com/fwlink/p/?LinkId=163434). For SQL Server 2012, see [SQL Server Audit (Database Engine)](http://technet.microsoft.com/library/cc280386.aspx).   - The operating system versions. @@ -260,7 +260,7 @@ In the majority of cases, these attempts will be legitimate and a network needs >**Note:**  There is no failure event for logoff activity because failed logoffs (such as when a system abruptly shuts down) do not generate an audit record. Logoff events are not 100 percent reliable. For example, the computer can be turned off without a proper logoff and shutdown, and a logoff event is not generated.   -- Logon/Logoff\\[Audit Special Logon](audit-special-logon.md). A special logon has administrator-equivalent rights and can be used to elevate a process to a higher level. It is recommended to track these types of logons. For more information about this feature, see [article 947223](http://go.microsoft.com/fwlink/p/?linkid=120183) in the Microsoft Knowledge Base. +- Logon/Logoff\\[Audit Special Logon](audit-special-logon.md). A special logon has administrator-equivalent rights and can be used to elevate a process to a higher level. It is recommended to track these types of logons. For more information about this feature, see [article 947223](https://go.microsoft.com/fwlink/p/?linkid=120183) in the Microsoft Knowledge Base. - Object Access\\[Audit Certification Services](audit-certification-services.md). This policy setting allows you to track and monitor a wide variety of activities on a computer that hosts Active Directory Certificate Services (AD CS) role services to ensure that only authorized users are performing or attempting to perform these tasks, and that only authorized or desired tasks are being performed. - Object Access\\[Audit File System](audit-file-system.md) and Object Access\\[Audit File Share](audit-file-share.md). These policy settings are described in the previous section. - Object Access\\[Audit Handle Manipulation](audit-handle-manipulation.md). This policy setting and its role in providing "reason for access" audit data is described in the previous section. @@ -336,7 +336,7 @@ Configuration\\Administrative Templates\\Windows Components\\Event Log Service\\ - **Retain old events**. This policy setting controls event log behavior when the log file reaches its maximum size. When this policy setting is enabled and a log file reaches its maximum size, new events are not written to the log and are lost. When this policy setting is disabled and a log file reaches its maximum size, new events overwrite old events. - **Backup log automatically when full**. This policy setting controls event log behavior when the log file reaches its maximum size and takes effect only if the **Retain old events** policy setting is enabled. If you enable these policy settings, the event log file is automatically closed and renamed when it is full. A new file is then started. If you disable or do not configure this policy setting and the **Retain old events** policy setting is enabled, new events are discarded and the old events are retained. -In addition, a growing number of organizations are being required to store archived log files for a number of years. You should consult with regulatory compliance officers in your organization to determine whether such guidelines apply to your organization. For more information, see the [IT Compliance Management Guide](http://go.microsoft.com/fwlink/p/?LinkId=163435). +In addition, a growing number of organizations are being required to store archived log files for a number of years. You should consult with regulatory compliance officers in your organization to determine whether such guidelines apply to your organization. For more information, see the [IT Compliance Management Guide](https://go.microsoft.com/fwlink/p/?LinkId=163435). ## Deploying the security audit policy diff --git a/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md b/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md index 2715141f20..0790236e3f 100644 --- a/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md +++ b/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md @@ -4,6 +4,7 @@ description: To help you plan and begin the initial test stages of a deployment keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy +localizationpriority: high author: brianlic-msft --- @@ -15,7 +16,7 @@ author: brianlic-msft This topic provides a roadmap for planning and getting started on the Device Guard deployment process, with links to topics that provide additional detail. Planning for Device Guard deployment involves looking at both the end-user and the IT pro impact of your choices. Use the following steps to guide you. -**Planning** +## Planning 1. **Review requirements, especially hardware requirements for VBS**. Review the virtualization-based security (VBS) features described in [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). Then you can assess your end-user systems to see how many support the VBS features you are interested in, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). @@ -32,7 +33,7 @@ This topic provides a roadmap for planning and getting started on the Device Gua 4. **Identify LOB applications that are currently unsigned**. Although requiring signed code (through code integrity policies) protects against many threats, your organization might use unsigned LOB applications, for which the process of signing might be difficult. You might also have applications that are signed, but you want to add a secondary signature to them. If so, identify these applications, because you will need to create a catalog file for them. For a basic description of catalog files, see the table in [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md). For more background information about catalog files, see [Reviewing your applications: application signing and catalog files](requirements-and-deployment-planning-guidelines-for-device-guard.md#reviewing-your-applications-application-signing-and-catalog-files). -**Getting started on the deployment process** +## Getting started on the deployment process 1. **Optionally, create a signing certificate for code integrity policies**. As you deploy code integrity policies, you might need to sign catalog files or code integrity policies internally. To do this, you will either need a publicly issued code signing certificate (that you purchase) or an internal CA. If you choose to use an internal CA, you will need to create a code signing certificate. For more information, see [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md). diff --git a/windows/keep-secure/planning-certificate-based-authentication.md b/windows/keep-secure/planning-certificate-based-authentication.md index 69e599b812..ab5b21c69b 100644 --- a/windows/keep-secure/planning-certificate-based-authentication.md +++ b/windows/keep-secure/planning-certificate-based-authentication.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Sometimes a device cannot join an Active Directory domain, and therefore cannot use Kerberos V5 authentication with domain credentials. However, the device can still participate in the isolated domain by using certificate-based authentication. diff --git a/windows/keep-secure/planning-domain-isolation-zones.md b/windows/keep-secure/planning-domain-isolation-zones.md index 208265eefb..a18fb27051 100644 --- a/windows/keep-secure/planning-domain-isolation-zones.md +++ b/windows/keep-secure/planning-domain-isolation-zones.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have the required information about your network, Active Directory, and client and server devices, you can use that information to make decisions about the isolation zones you want to use in your environment. diff --git a/windows/keep-secure/planning-gpo-deployment.md b/windows/keep-secure/planning-gpo-deployment.md index 050a5550f7..abdff4b8ca 100644 --- a/windows/keep-secure/planning-gpo-deployment.md +++ b/windows/keep-secure/planning-gpo-deployment.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 You can control which GPOs are applied to devices in Active Directory in a combination of three ways: diff --git a/windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md b/windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md index fff34a12c7..0718187682 100644 --- a/windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md +++ b/windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have decided on the best logical design of your isolation environment for the network and device security requirements, you can start the implementation plan. diff --git a/windows/keep-secure/planning-isolation-groups-for-the-zones.md b/windows/keep-secure/planning-isolation-groups-for-the-zones.md index b4f667a50b..0c4488940a 100644 --- a/windows/keep-secure/planning-isolation-groups-for-the-zones.md +++ b/windows/keep-secure/planning-isolation-groups-for-the-zones.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Isolation groups in Active Directory are how you implement the various domain and server isolation zones. A device is assigned to a zone by adding its device account to the group which represents that zone. diff --git a/windows/keep-secure/planning-network-access-groups.md b/windows/keep-secure/planning-network-access-groups.md index 4d9b002e7c..929c583624 100644 --- a/windows/keep-secure/planning-network-access-groups.md +++ b/windows/keep-secure/planning-network-access-groups.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 A network access group (NAG) is used to identify users and devices that have permission to access an isolated server. The server is configured with firewall rules that allow only network connections that are authenticated as originating from a device, and optionally a user, whose accounts are members of its NAG. A member of the isolated domain can belong to as many NAGs as required. diff --git a/windows/keep-secure/planning-server-isolation-zones.md b/windows/keep-secure/planning-server-isolation-zones.md index 12688b93c9..9995c0e5fc 100644 --- a/windows/keep-secure/planning-server-isolation-zones.md +++ b/windows/keep-secure/planning-server-isolation-zones.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Sometimes a server hosts data that is sensitive. If your servers host data that must not be compromised, you have several options to help protect that data. One was already addressed: adding the server to the encryption zone. Membership in that zone prevents the server from being accessed by any devices that are outside the isolated domain, and encrypts all network connections to server. diff --git a/windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md b/windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md index 4fcbd977dc..fdcf972088 100644 --- a/windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md +++ b/windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have identified your requirements, and have the information about the network layout and devices available, you can begin to design the GPO settings and rules that will enable you to enforce your requirements on the devices. diff --git a/windows/keep-secure/planning-the-gpos.md b/windows/keep-secure/planning-the-gpos.md index b22f0497cd..84b3750822 100644 --- a/windows/keep-secure/planning-the-gpos.md +++ b/windows/keep-secure/planning-the-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 When you plan the GPOs for your different isolation zones, you must complete the layout of the required zones and their mappings to the groups that link the devices to the zones. diff --git a/windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md b/windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md index 1801d2a86a..8423e4b94f 100644 --- a/windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md +++ b/windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you collect information about your environment and decide on a design by following the guidance in the [Windows Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md), you can begin to plan the deployment of your design. With the completed design and the information in this topic, you can determine which tasks to perform to deploy Windows Firewall with Advanced Security in your organization. diff --git a/windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md b/windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md index c800eca94d..736612379f 100644 --- a/windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md +++ b/windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have gathered the relevant information in the previous sections, and understand the basics of the designs as described earlier in this guide, you can select the design (or combination of designs) that meet your needs. diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index 6363ce613d..8c9f2086ff 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -8,18 +8,19 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: DulceMV +localizationpriority: high --- # Windows Defender Advanced Threat Protection portal overview **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - - Enterprise security teams can use the Windows Defender ATP portal to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches. You can use the [Windows Defender ATP portal](https://securitycenter.windows.com/) to: @@ -37,19 +38,20 @@ When you open the portal, you’ll see the main areas of the application: ![Windows Defender Advanced Threat Protection portal](images/portal-image.png) -> **Note**  Malware related detections will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> [!NOTE] +> Malware related detections will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section. Area | Description :---|:--- (1) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information. -(2) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Endpoint Management**. +(2) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Enpoint Management**. **Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. **Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts. **Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. -**Preferences setup**| Shows the settings you selected and lets you update your industry preferences and retention policy period. -**Endpoint Management**| Allows you to download the onboarding configuration package. +**Preferences setup**| Shows the settings you selected and lets you update your industry preferences and retention policy period. +**Enpoint Management**| Allows you to download the onboarding configuration package. (3) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view. (4) Search | Search for machines, files, external IP Addresses, or domains across endpoints. The drop-down combo box allows you to select the entity type. diff --git a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md index 85f3ea6a19..f6419c6ced 100644 --- a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md +++ b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS +localizationpriority: high --- # Prepare people to use Windows Hello @@ -22,7 +23,7 @@ After enrollment in Hello, users should use their gesture (such as a PIN or fing Although the organization may require users to change their Active Directory or Azure Active Directory (AD) account password at regular intervals, changes to their passwords have no effect on Hello. -People who are currently using virtual smart cards for authentication can use their virtual smart card to verify their identity when they set up Hello. +People who are currently using virtual or physical smart cards for authentication can use their virtual smart card to verify their identity when they set up Hello. ## On devices owned by the organization @@ -34,13 +35,13 @@ Next, they select a way to connect. Tell the people in your enterprise which opt ![choose how you'll connect](images/connect.png) -They sign in, and are then asked to verify their identity. People have options to choose from, such as a text message, phone call, or authentication app. After verification, they create their PIN. The **Create a work PIN** screen displays any complexity requirements that you have set, such as minimum length. +They sign in, and are then asked to verify their identity. People have options to choose from, such as a text message, phone call, or authentication app. After verification, they create their PIN. The **Create a PIN** screen displays any complexity requirements that you have set, such as minimum length. After Hello is set up, people use their PIN to unlock the device, and that will automatically log them on. ## On personal devices -People who want to access work resources on their personal devices can add a work or school account in **Settings** > **Accounts** > **Work or school**, and then sign in with work credentials. The person selects the method for receiving the verification code, such as text message or email. The verification code is sent and the person then enters the verification code. After verification, the person enters and confirms new PIN. The person can access any token-based resource using this device without being asked for credentials. (This work account gesture doesn't affect the device unlock PIN.) +People who want to access work resources on their personal devices can add a work or school account in **Settings** > **Accounts** > **Work or school**, and then sign in with work credentials. The person selects the method for receiving the verification code, such as text message or email. The verification code is sent and the person then enters the verification code. After verification, the person enters and confirms new PIN. The person can access any token-based resource using this device without being asked for credentials. People can go to **Settings** > **Accounts** > **Work or school**, select the work account, and then select **Unjoin** to remove the account from their device. @@ -50,16 +51,23 @@ If your policy allows it, people can use biometrics (fingerprint, iris, and faci ![sign in to windows, apps, and services using fingerprint or face](images/hellosettings.png) -## Use a phone to sign in to a PC +## Use a phone to sign in to a PC or VPN If your enterprise enables phone sign-in, users can pair a phone running Windows 10 Mobile to a PC running Windows 10 and then use an app on the phone to sign in to the PC using their Windows Hello credentials. +> [!NOTE] +> Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. +   **Prerequisites:** -- The PC must be joined to the Active Directory domain or Azure AD cloud domain. -- The PC must have Bluetooth connectivity. -- The phone must be joined to the Azure AD cloud domain, or the user must have added a work account to their personal phone. -- The **Microsoft Authenticator** app must be installed on the phone. + +- Both phone and PC must be running Windows 10, version 1607. +- The PC must be running Windows 10 Pro, Enterprise, or Education +- Both phone and PC must have Bluetooth. +- The **Microsoft Authenticator** app must be installed on the phone. +- The PC must be joined to an Active Directory domain that is connected to an Azure Active Directory (Azure AD) domain, or the PC must be joined to Azure AD. +- The phone must be joined to Azure AD or have a work account added. +- The VPN configuration profile must use certificate-based authentication. **Pair the PC and phone** @@ -75,11 +83,18 @@ If your enterprise enables phone sign-in, users can pair a phone running Windows **Sign in to PC using the phone** -1. Open the **Microsoft Authenticator** app and tap the name of the PC to sign in to. + +1. Open the **Microsoft Authenticator** app, choose your account, and tap the name of the PC to sign in to. > **Note: **  The first time that you run the **Microsoft Authenticator** app, you must add an account. + + ![select a device](images/phone-signin-device-select.png)   2. Enter the work PIN that you set up when you joined the phone to the cloud domain or added a work account. +**Connect to VPN** + +You simply connect to VPN as you normally would. If the phone's certificates are being used, a notification will be pushed to the phone asking if you approve. If you click **allow** in the notification, you will be prompted for your PIN. After you enter your PIN, the VPN session will connect. + ## Related topics [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) @@ -97,3 +112,5 @@ If your enterprise enables phone sign-in, users can pair a phone running Windows [Event ID 300 - Windows Hello successfully created](passport-event-300.md) [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) + + diff --git a/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md index c30af5a4c1..31c04c1c61 100644 --- a/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -120,7 +120,7 @@ For a TPM to be usable by BitLocker, it must contain an endorsement key, which i An endorsement key can be created at various points in the TPM’s lifecycle, but needs to be created only once for the lifetime of the TPM. If an endorsement key does not exist for the TPM, it must be created before TPM ownership can be taken. -For more information about the TPM and the TCG, see the Trusted Computing Group: Trusted Platform Module (TPM) Specifications (). +For more information about the TPM and the TCG, see the Trusted Computing Group: Trusted Platform Module (TPM) Specifications (). ## Non-TPM hardware configurations diff --git a/windows/keep-secure/procedures-used-in-this-guide.md b/windows/keep-secure/procedures-used-in-this-guide.md index d19699b94b..7374820ed8 100644 --- a/windows/keep-secure/procedures-used-in-this-guide.md +++ b/windows/keep-secure/procedures-used-in-this-guide.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The procedures in this section appear in the checklists found earlier in this document. They should be used only in the context of the checklists in which they appear. They are presented here in alphabetical order. diff --git a/windows/keep-secure/protect-devices-from-unwanted-network-traffic.md b/windows/keep-secure/protect-devices-from-unwanted-network-traffic.md index a24379dacf..f4134b9ce9 100644 --- a/windows/keep-secure/protect-devices-from-unwanted-network-traffic.md +++ b/windows/keep-secure/protect-devices-from-unwanted-network-traffic.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Although network perimeter firewalls provide important protection to network resources from external threats, there are network threats that a perimeter firewall cannot protect against. Some attacks might successfully penetrate the perimeter firewall, and at that point what can stop it? Other attacks might originate from inside the network, such as malware that is brought in on portable media and run on a trusted device. Portable device are often taken outside the network and connected directly to the Internet, without adequate protection between the device and security threats. diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index 9e052274d5..3f8df3ef51 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -1,92 +1,5 @@ --- title: Protect your enterprise data using enterprise data protection (EDP) (Windows 10) description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. -ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032 -keywords: EDP, Enterprise Data Protection -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -author: eross-msft ---- - -# Protect your enterprise data using enterprise data protection (EDP) -**Applies to:** - -- Windows 10 Insider Preview -- Windows 10 Mobile Preview - -[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. - -Enterprise data protection (EDP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. EDP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. - -## Prerequisites -You’ll need this software to run EDP in your enterprise: - -|Operating system | Management solution | -|-----------------|---------------------| -|Windows 10 Insider Preview | Microsoft Intune
    -OR-
    System Center Configuration Manager Technical Preview version 1605 or later
    -OR-
    Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634.aspx) documentation.| - -## How EDP works -EDP helps address your everyday challenges in the enterprise. Including: - -- Helping to prevent enterprise data leaks, even on employee-owned devices that can't be locked down. - -- Reducing employee frustrations because of restrictive data management policies on enterprise-owned devices. - -- Helping to maintain the ownership and control of your enterprise data. - -- Helping control the network and data access and data sharing for apps that aren’t enterprise aware. - -### EDP-protection modes -You can set EDP to 1 of 4 protection and management modes: - -|Mode|Description| -|----|-----------| -|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.| -|Override |EDP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459). | -|Silent |EDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.| -|Off |EDP is turned off and doesn't help to protect or audit your data.

    After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives. | -

    **Note**
    For more info about setting your EDP-protection modes, see either [Create an enterprise data protection (EDP) policy using Intune](create-edp-policy-using-intune.md) or [Create and deploy an enterprise data protection (EDP) policy using Configuration Manager](create-edp-policy-using-sccm.md), depending on your management solution. - -## Why use EDP? -EDP gives you a new way to manage data policy enforcement for apps and documents, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune). - -- **Change the way you think about data policy enforcement.** As an enterprise admin, you need to maintain compliance in your data policy and data access. EDP helps make sure that your enterprise data is protected on both corporate and employee-owned devices, even when the employee isn’t using the device. When employees create content on an enterprise-protected device, they can choose to save it as a work document. If it's a work document, it becomes locally-maintained as enterprise data. - -- **Manage your enterprise documents, apps, and encryption modes.** - - - **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using an EDP-protected device, EDP encrypts the data on the device. - - - **Using allowed apps.** Managed apps (apps that you've included on the protected apps list in your EDP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if EDP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - - - **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your **Protected App** list, the app is trusted with enterprise data. All apps that aren’t on this list are blocked from accessing your enterprise network resources and your EDP-protected data.

    - You don’t have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in the **Protected App** list. - - - **Deciding your level of data access.** EDP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your **Protected App** list. - - - **Continuous data encryption.** EDP helps protect enterprise data on local files and on removable media.

    - Apps such as Microsoft Word work with EDP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens EDP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies EDP to the new document. - - - **Helping prevent accidental data disclosure to public spaces.** EDP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your **Protected App** list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your **Protected Apps** list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the cloud, while maintaining the encryption. - - - **Helping prevent accidental data disclosure to removable media.** EDP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t. - -- **Remove access to enterprise data from enterprise-protected devices.** EDP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable.

    **Note**
    System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. - -## Current limitations with EDP -EDP is still in development and is not yet integrated with Azure Rights Management. This means that while you can deploy an EDP-configured policy to a protected device, that protection is restricted to a single user on the device. Additionally, the EDP-protected data must be stored on NTFS, FAT, or ExFAT file systems. - -Use the following table to identify the scenarios that require Azure Rights Management, the behavior when Azure Rights Management is not used with EDP, and the recommended workarounds. - -|EDP scenario |Without Azure Rights Management |Workaround | -|-------------|--------------------------------|-----------| -|Saving enterprise data to USB drives |Data in the new location remains encrypted, but becomes inaccessible on other devices or for other users. For example, the file won't open or the file opens, but doesn't contain readable text. |Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.

    We strongly recommend educating employees about how to limit or eliminate the need for this decryption. | -|Synchronizing data to other services or public cloud storage |Synchronized files aren't protected on additional services or as part of public cloud storage. |Stop the app from synchronizing or don't add the app to your **Protected App** list.

    For more info about adding apps to the **Protected App** list, see either the [Create an enterprise data protection (EDP) policy using Intune](create-edp-policy-using-intune.md) or the [Create and deploy an enterprise data protection (EDP) policy using Configuration Manager](create-edp-policy-using-sccm.md) topic, depending on your management solution. - -## Next steps -After deciding to use EDP in your enterprise, you need to: - -- [Create an enterprise data protection (EDP) policy](overview-create-edp-policy.md) \ No newline at end of file +redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip +--- \ No newline at end of file diff --git a/windows/keep-secure/protect-enterprise-data-using-wip.md b/windows/keep-secure/protect-enterprise-data-using-wip.md new file mode 100644 index 0000000000..b6d01bc4cc --- /dev/null +++ b/windows/keep-secure/protect-enterprise-data-using-wip.md @@ -0,0 +1,139 @@ +--- +title: Protect your enterprise data using Windows Information Protection (WIP) (Windows 10) +description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. +ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032 +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, DLP, data loss prevention, data leakage protection +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: eross-msft +localizationpriority: high +--- + +# Protect your enterprise data using Windows Information Protection (WIP) +**Applies to:** + +- Windows 10, version 1607 +- Windows 10 Mobile + +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + +With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. + +Windows Information Protection (WIP), previously known as enterprise data protection (EDP), helps to protect against this potential data leakage without otherwise interfering with the employee experience. WIP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. Finally, another data protection technology, Azure Rights Management also works alongside WIP to extend data protection for data that leaves the device, such as when email attachments are sent from an enterprise aware version of a rights management mail client. + +## Prerequisites +You’ll need this software to run WIP in your enterprise: + +|Operating system | Management solution | +|-----------------|---------------------| +|Windows 10, version 1607 | Microsoft Intune
    -OR-
    System Center Configuration Manager
    -OR-
    Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634.aspx) documentation.| + +## What is enterprise data control? +Effective collaboration means that you need to share data with others in your enterprise. This sharing can be from one extreme where everyone has access to everything without any security, all the way to the other extreme where people can’t share anything and it’s all highly secured. Most enterprises fall somewhere in between the two extremes, where success is balanced between providing the necessary access with the potential for improper data disclosure. + +As an admin, you can address the question of who gets access to your data by using access controls, such as employee credentials. However, just because someone has the right to access your data doesn’t guarantee that the data will remain within the secured locations of the enterprise. This means that while access controls are a great start, they’re not enough. + +In the end, all of these security measures have one thing in common: employees will tolerate only so much inconvenience before looking for ways around the security restrictions. For example, if you don’t allow employees to share files through a protected system, employees will turn to an outside app that more than likely lacks security controls. + +### Using data loss prevention systems +To help address this security insufficiency, company’s developed data loss prevention (also known as DLP) systems. Data loss prevention systems require: +- **A set of rules about how the system can identify and categorize the data that needs to be protected.** For example, a rule set might contain a rule that identifies credit card numbers and another rule that identifies Social Security numbers. + +- **A way to scan company data to see whether it matches any of your defined rules.** Currently, Microsoft Exchange Server and Exchange Online provide this service for email in transit, while Microsoft SharePoint and SharePoint Online provide this service for content stored in document libraries. + +- **The ability to specify what happens when data matches a rule, including whether employees can bypass enforcement.** For example, in Microsoft SharePoint and SharePoint Online, the Microsoft data loss prevention system lets you warn your employees that shared data includes sensitive info, and to share it anyway (with an optional audit log entry). + +Unfortunately, data loss prevention systems have their own problems. For example, the more detailed the rule set, the more false positives are created, leading employees to believe that the rules slow down their work and need to be bypassed in order to remain productive, potentially leading to data being incorrectly blocked or improperly released. Another major problem is that data loss prevention systems must be widely implemented to be effective. For example, if your company uses a data loss prevention system for email, but not for file shares or document storage, you might find that your data leaks through the unprotected channels. But perhaps the biggest problem with data loss preventions systems is that it provides a jarring experience that interrupts the employees’ natural workflow by blocking some operations (such as sending a message with an attachment that the system tags as sensitive) while allowing others, often according to subtle rules that the employee doesn’t see and can’t understand. + +### Using information rights management systems +To help address the potential data loss prevention system problems, company’s developed information rights management (also known as IRM) systems. Information rights management systems embed protection directly into documents, so that when an employee creates a document, he or she determines what kind of protection to apply. For example, an employee can choose to stop the document from being forwarded, printed, shared outside of the organization, and so on. + +After the type of protection is set, the creating app encrypts the document so that only authorized people can open it, and even then, only in compatible apps. After an employee opens the document, the app becomes responsible for enforcing the specified protections. Because protection travels with the document, if an authorized person sends it to an unauthorized person, the unauthorized person won’t be able to read or change it. However, for this to work effectively information rights management systems require you to deploy and set up both a server and client environment. And, because only compatible clients can work with protected documents, an employees’ work might be unexpectedly interrupted if he or she attempts to use a non-compatible app. + +### And what about when an employee leaves the company or unenrolls a device? +Finally, there’s the risk of data leaking from your company when an employee leaves or unenrolls a device. Previously, you would simply erase all of the corporate data from the device, along with any other personal data on the device. + +## Benefits of WIP +WIP provides: +- Obvious separation between personal and corporate data, without requiring employees to switch environments or apps. + +- Additional data protection for existing line-of-business apps without a need to update the apps. + +- Ability to wipe corporate data from devices while leaving personal data alone. + +- Use of audit reports for tracking issues and remedial actions. + +- Integration with your existing management system (Microsoft Intune, System Center Configuration Manager, or your current mobile device management (MDM) system) to configure, deploy, and manage WIP for your company. + +## Why use WIP? +WIP gives you a new way to manage data policy enforcement for apps and documents, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune). + +- **Change the way you think about data policy enforcement.** As an enterprise admin, you need to maintain compliance in your data policy and data access. WIP helps make sure that your enterprise data is protected on both corporate and employee-owned devices, even when the employee isn’t using the device. When employees create content on an enterprise-protected device, they can choose to save it as a work document. If it's a work document, it becomes locally-maintained as enterprise data. + +- **Manage your enterprise documents, apps, and encryption modes.** + + - **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using a WIP-protected device, WIP encrypts the data on the device. + + - **Using allowed apps.** Managed apps (apps that you've included on the Allowed Apps list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Block**, your employees can copy and paste from one protected app to another allowed app, but not to personal apps. Imagine an HR person wants to copy a job description from an allowed app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. + + - **Managed apps and restrictions.** With WIP you can control which apps can access and use your enterprise data. After adding an app to your allowed apps list, the app is trusted with enterprise data. All apps not on this list are blocked from accessing your enterprise data, depending on your WIP management-mode. + + You don’t have to modify line-of-business apps that never touch personal data to list them as allowed apps; just include them in the allowed apps list. + + - **Deciding your level of data access.** WIP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your allowed apps list. + + - **Data encryption at rest.** WIP helps protect enterprise data on local files and on removable media. + + Apps such as Microsoft Word work with WIP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens WIP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies WIP to the new document. + + - **Helping prevent accidental data disclosure to public spaces.** WIP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your allowed apps list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your allowed apps list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the business cloud, while maintaining the encryption locally. + + - **Helping prevent accidental data disclosure to removable media.** WIP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t. + +- **Remove access to enterprise data from enterprise-protected devices.** WIP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can use Microsoft Intune to unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable. + > **Note**
    System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. + +## How WIP works +WIP helps address your everyday challenges in the enterprise. Including: + +- Helping to prevent enterprise data leaks, even on employee-owned devices that can't be locked down. + +- Reducing employee frustrations because of restrictive data management policies on enterprise-owned devices. + +- Helping to maintain the ownership and control of your enterprise data. + +- Helping control the network and data access and data sharing for apps that aren’t enterprise aware + +### Enterprise scenarios +WIP currently addresses these enterprise scenarios: +- You can encrypt enterprise data on employee-owned and corporate-owned devices. + +- You can remotely wipe enterprise data off managed computers, including employee-owned computers, without affecting the personal data. + +- You can select specific apps that can access enterprise data, called "allowed apps" that are clearly recognizable to employees. You can also block non-protected apps from accessing enterprise data. + +- Your employees won't have their work otherwise interrupted while switching between personal and enterprise apps while the enterprise policies are in place. Switching environments or signing in multiple times isn’t required. + +### WIP-protection modes +Enterprise data is automatically encrypted after it’s loaded on a device from an enterprise source or if an employee marks the data as corporate. Then, when the enterprise data is written to disk, WIP uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity. + +Your WIP policy includes a list of trusted apps that are allowed to access and process corporate data. This list of apps is implemented through the [AppLocker](applocker-overview.md) functionality, controlling what apps are allowed to run and letting the Windows operating system know that the apps can edit corporate data. Apps included on this list don’t have to be modified to open corporate data because their presence on the list allows Windows to determine whether to grant them access. However, new for Windows 10, app developers can use a new set of application programming interfaces (APIs) to create *enlightened* apps that can use and edit both enterprise and personal data. A huge benefit to working with enlightened apps is that dual-use apps, like Microsoft Word, can be used with less concern about encrypting personal data by mistake because the APIs allow the app to determine whether data is owned by the enterprise or if it’s personally owned. + +You can set your WIP policy to use 1 of 4 protection and management modes: + +|Mode|Description| +|----|-----------| +|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.| +|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkID=746459). | +|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| +|Off |WIP is turned off and doesn't help to protect or audit your data.

    After you turn off WIP, an attempt is made to decrypt any closed WIP-tagged files on the locally attached drives.

    **Note**
    For more info about setting your WIP-protection modes, see either [Create a Windows Information Protection (WIP) policy using Intune](create-wip-policy-using-intune.md) or [Create and deploy a Windows Information Protection (WIP) policy using Configuration Manager](create-wip-policy-using-sccm.md), depending on your management solution. | + +## Turn off WIP +You can turn off all Windows Information Protection and restrictions, reverting to where you were pre-WIP, with no data loss. However, turning off WIP isn't recommended. If you choose to turn it off, you can always turn it back on, but WIP won't retain your decryption and policies info. + +## Next steps +After deciding to use WIP in your enterprise, you need to: + +- [Create a Windows Information Protection (WIP) policy](overview-create-wip-policy.md) diff --git a/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index 61313be105..0ebb719b2e 100644 --- a/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -123,7 +123,7 @@ Windows 10 supports features to help prevent sophisticated low-level malware li - The first TPM specification, version 1.2, was published in February 2005 by the TCG and standardized under ISO / IEC 11889 standard. - The latest TPM specification, referred to as TPM 2.0, was released in April 2014 and has been approved by the ISO/IEC Joint Technical Committee (JTC) as ISO/IEC 11889:2015. - Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Microsoft Passport, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=733948). + Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Microsoft Passport, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=733948). Windows 10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows 10 supports only TPM 2.0. TPM 2.0 is required for device health attestation. @@ -183,7 +183,7 @@ Windows 10 supports features to help prevent sophisticated low-level malware li HVCI uses virtualization-based security to isolate Code Integrity, the only way kernel memory can become executable is through a Code Integrity verification. This means that kernel memory pages can never be Writable and Executable (W+X) and executable code cannot be directly modified. - >**Note:**  Device Guard devices that run Kernel Mode Code Integrity with virtualization-based security must have compatible drivers. For additional information, please read the [Driver compatibility with Device Guard in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=691612) blog post. + >**Note:**  Device Guard devices that run Kernel Mode Code Integrity with virtualization-based security must have compatible drivers. For additional information, please read the [Driver compatibility with Device Guard in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=691612) blog post.   The Device Guard Code Integrity feature lets organizations control what code is trusted to run into the Windows kernel and what applications are approved to run in user mode. It’s configurable by using a policy. Device Guard Code Integrity policy is a binary file that Microsoft recommends you sign. The signing of the Code Integrity policy aids in the protection against a malicious user with Administrator privileges trying to modify or remove the current Code Integrity policy. @@ -198,7 +198,7 @@ Windows 10 supports features to help prevent sophisticated low-level malware li Windows 10 takes measurements of the UEFI firmware and each of the Windows and antimalware components are made as they load during the boot process. Additionally, they are taken and measured sequentially, not all at once. When these measurements are complete, their values are digitally signed and stored securely in the TPM and cannot be changed unless the system is reset. - For more information, see [Secured Boot and Measured Boot: Hardening Early Boot Components Against Malware](http://go.microsoft.com/fwlink/p/?LinkId=733950). + For more information, see [Secured Boot and Measured Boot: Hardening Early Boot Components Against Malware](https://go.microsoft.com/fwlink/p/?LinkId=733950). During each subsequent boot, the same components are measured, which allows comparison of the measurements against an expected baseline. For additional security, the values measured by the TPM can be signed and transmitted to a remote server, which can then perform the comparison. This process, called *remote device health attestation*, allows the server to verify health status of the Windows device. @@ -216,7 +216,7 @@ The following Windows 10 services are protected with virtualization-based secur - **Credential Guard** (LSA Credential Isolation): prevents pass-the-hash attacks and enterprise credential theft that happens by reading and dumping the content of lsass memory - **Device Guard** (Hyper-V Code Integrity): Device Guard uses the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Windows kernel itself, which lets the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. -- **Other isolated services**: for example, on Windows Server Technical Preview 2016, there is the vTPM feature that allows you to have encrypted virtual machines (VMs) on servers. +- **Other isolated services**: for example, on Windows Server 2016, there is the vTPM feature that allows you to have encrypted virtual machines (VMs) on servers. >**Note:**  Virtualization-based security is only available with Windows 10 Enterprise. Virtualization-based security requires devices with UEFI (2.3.1 or higher) with Secure Boot enabled, x64 processor with Virtualization Extensions and SLAT enabled. IOMMU, TPM 2.0. and support for Secure Memory overwritten are optional, but recommended.   @@ -245,7 +245,7 @@ The trust decision to execute code is performed by using Hyper-V Code Integrity, Hyper-V Code Integrity is a feature that validates the integrity of a driver or system file each time it is loaded into memory. Code integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with Administrator privileges. On x64-based versions of Windows 10 kernel-mode drivers must be digitally signed. ->**Note:**  Independently of activation of Device Guard Policy, [Windows 10 by default raises the bar for what runs in the kernel](http://go.microsoft.com/fwlink/p/?LinkId=691613). Windows 10 drivers must be signed by Microsoft, and more specifically, by the WHQL (Windows Hardware Quality Labs) portal. Additionally, starting in October 2015, the WHQL portal will only accept driver submissions, including both kernel and user mode driver submissions, that have a valid Extended Validation (“EV”) Code Signing Certificate. +>**Note:**  Independently of activation of Device Guard Policy, [Windows 10 by default raises the bar for what runs in the kernel](https://go.microsoft.com/fwlink/p/?LinkId=691613). Windows 10 drivers must be signed by Microsoft, and more specifically, by the WHQL (Windows Hardware Quality Labs) portal. Additionally, starting in October 2015, the WHQL portal will only accept driver submissions, including both kernel and user mode driver submissions, that have a valid Extended Validation (“EV”) Code Signing Certificate.   With Device Guard in Windows 10, organizations are now able to define their own Code Integrity policy for use on x64 systems running Windows 10 Enterprise. Organizations have the ability to configure the policy that determines what is trusted to run. These include drivers and system files, as well as traditional desktop applications and scripts. The system is then locked down to only run applications that the organization trusts. @@ -325,7 +325,7 @@ For more information on device health attestation, see the [Detect an unhealthy ### Hardware requirements -The following table details the hardware requirements for both virtualization-based security services and the health attestation feature. For more information, see [Minimum hardware requirements](http://go.microsoft.com/fwlink/p/?LinkId=733951). +The following table details the hardware requirements for both virtualization-based security services and the health attestation feature. For more information, see [Minimum hardware requirements](https://go.microsoft.com/fwlink/p/?LinkId=733951).

    0x80090031 NTE_AUTHENTICATION_IGNOREDReboot the device. If the error occurs again after rebooting, [reset the TPM]( http://go.microsoft.com/fwlink/p/?LinkId=619969) or run [Clear-TPM](http://go.microsoft.com/fwlink/p/?LinkId=629650)Reboot the device. If the error occurs again after rebooting, [reset the TPM]( https://go.microsoft.com/fwlink/p/?LinkId=619969) or run [Clear-TPM](https://go.microsoft.com/fwlink/p/?LinkId=629650)
    0x80090035
    0x801C000E Registration quota reached

    Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](http://go.microsoft.com/fwlink/p/?LinkId=626933).

    Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](https://go.microsoft.com/fwlink/p/?LinkId=626933).
    0x801C000F

    Azure AD subscription
    • Azure AD subscription
      • -
    • [Azure AD Connect](http://go.microsoft.com/fwlink/p/?LinkId=616792)
      • +
    • [Azure AD Connect](https://go.microsoft.com/fwlink/p/?LinkId=616792)
    • A few Windows Server 2016 Technical Preview domain controllers on-site
    • A management solution, such as Configuration Manager, Group Policy, or MDM
    • Active Directory Certificate Services (AD CS) without Network Device Enrollment Service (NDES)
      • @@ -318,7 +322,7 @@ Table 1. Deployment requirements for Microsoft Passport

      Intune
    • Azure AD subscription
      • -
    • [Azure AD Connect](http://go.microsoft.com/fwlink/p/?LinkId=616792)
      • +
    • [Azure AD Connect](https://go.microsoft.com/fwlink/p/?LinkId=616792)
    • AD CS with NDES
    • Configuration Manager (current branch) or Configuration Manager 2016 Technical Preview for domain-joined certificate enrollment, or InTune for non-domain-joined devices, or a non-Microsoft MDM service that supports Passport for Work
    @@ -475,7 +475,7 @@ The TPM has an embedded unique cryptographic key called the endorsement key. The The endorsement key public key is generally used for sending securely sensitive parameters, such as when taking possession of the TPM that contains the defining hash of the owner password. The EK private key is used when creating secondary keys like AIKs. -The endorsement key acts as an identity card for the TPM. For more information, see [Understand the TPM endorsement key](http://go.microsoft.com/fwlink/p/?LinkId=733952). +The endorsement key acts as an identity card for the TPM. For more information, see [Understand the TPM endorsement key](https://go.microsoft.com/fwlink/p/?LinkId=733952). The endorsement key is often accompanied by one or two digital certificates: @@ -573,7 +573,7 @@ The Health Attestation Service provides the following information to an MDM solu - Safe Mode boot, DEP enablement, test signing enablement - Device TPM has been provisioned with a trusted endorsement certificate -For completeness of the measurements, see [Health Attestation CSP](http://go.microsoft.com/fwlink/p/?LinkId=733949). +For completeness of the measurements, see [Health Attestation CSP](https://go.microsoft.com/fwlink/p/?LinkId=733949). The following table presents some key items that can be reported back to MDM depending on the type of Windows 10-based device. @@ -662,7 +662,7 @@ Today’s access control technology, in most cases, focuses on ensuring that the The remote device health attestation process uses measured boot data to verify the health status of the device. The health of the device is then available for an MDM solution like Intune. ->**Note:**  For the latest information on Intune and Windows 10 features support, see the [Microsoft Intune blog](http://go.microsoft.com/fwlink/p/?LinkId=691614) and [What's new in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733956). +>**Note:**  For the latest information on Intune and Windows 10 features support, see the [Microsoft Intune blog](https://go.microsoft.com/fwlink/p/?LinkId=691614) and [What's new in Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=733956).   The figure below shows how the Health Attestation Service is expected to work with Microsoft’s cloud-based Intune MDM service. @@ -679,9 +679,9 @@ Windows 10 has an MDM client that ships as part of the operating system. This e ### Third-party MDM server support -Third-party MDM servers can manage Windows 10 by using the MDM protocol. The built-in management client is able to communicate with a compatible server that supports the OMA-DM protocol to perform enterprise management tasks. For additional information, see [Azure Active Directory integration with MDM](http://go.microsoft.com/fwlink/p/?LinkId=733954). +Third-party MDM servers can manage Windows 10 by using the MDM protocol. The built-in management client is able to communicate with a compatible server that supports the OMA-DM protocol to perform enterprise management tasks. For additional information, see [Azure Active Directory integration with MDM](https://go.microsoft.com/fwlink/p/?LinkId=733954). ->**Note:**  MDM servers do not need to create or download a client to manage Windows 10. For more information, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=733955). +>**Note:**  MDM servers do not need to create or download a client to manage Windows 10. For more information, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=733955).   The third-party MDM server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows 10 users. @@ -689,7 +689,7 @@ The third-party MDM server will have the same consistent first-party user experi This management infrastructure makes it possible for IT pros to use MDM-capable products like Intune, to manage health attestation, Device Guard, or Windows Defender on Windows 10-based devices, including BYODs that aren’t domain joined. IT pros will be able to manage and configure all of the actions and settings they are familiar with customizing by using Intune with Intune Endpoint Protection on down-level operating systems. Admins that currently only manage domain joined devices through Group Policy will find it easy to transition to managing Windows 10-based devices by using MDM because many of the settings and actions are shared across both mechanisms. -For more information on how to manage Windows 10 security and system settings with an MDM solution, see [Custom URI settings for Windows 10 devices](http://go.microsoft.com/fwlink/p/?LinkId=733953). +For more information on how to manage Windows 10 security and system settings with an MDM solution, see [Custom URI settings for Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=733953). ### Conditional access control @@ -710,7 +710,7 @@ When a user requests access to an Office 365 service from a supported device pla When a user enrolls, the device is registered with Azure AD, and enrolled with a compatible MDM solution like Intune. ->**Note**  Microsoft is working with third-party MDM ISVs to support automated MDM enrollment and policy based access checks. Steps to turn on auto-MDM enrollment with Azure AD and Intune are explained in the [Windows 10, Azure AD And Microsoft Intune: Automatic MDM Enrollment Powered By The Cloud!](http://go.microsoft.com/fwlink/p/?LinkId=691615) blog post. +>**Note**  Microsoft is working with third-party MDM ISVs to support automated MDM enrollment and policy based access checks. Steps to turn on auto-MDM enrollment with Azure AD and Intune are explained in the [Windows 10, Azure AD And Microsoft Intune: Automatic MDM Enrollment Powered By The Cloud!](https://go.microsoft.com/fwlink/p/?LinkId=691615) blog post.   When a user enrolls a device successfully, the device becomes trusted. Azure AD provides single-sign-on to access company applications and enforces conditional access policy to grant access to a service not only the first time the user requests access, but every time the user requests to renew access. @@ -732,7 +732,7 @@ To get to a compliant state, the Windows 10-based device needs to: - Register with Azure AD. - Be compliant with the device policies set by the MDM solution. ->**Note:**  At the present time, conditional access policies are selectively enforced on users on iOS and Android devices. For more information, see the [Azure AD, Microsoft Intune and Windows 10 – Using the cloud to modernize enterprise mobility!](http://go.microsoft.com/fwlink/p/?LinkId=691616) blog post. +>**Note:**  At the present time, conditional access policies are selectively enforced on users on iOS and Android devices. For more information, see the [Azure AD, Microsoft Intune and Windows 10 – Using the cloud to modernize enterprise mobility!](https://go.microsoft.com/fwlink/p/?LinkId=691616) blog post.   ### Cloud and on-premises apps conditional access control @@ -740,14 +740,14 @@ Conditional access control is a powerful policy evaluation engine built into Azu IT pros can configure conditional access control policies for cloud SaaS applications secured by Azure AD and even on-premises applications. Access rules in Azure AD leverage the conditional access engine to check device health and compliance state reported by a compatible MDM solution like Intune in order to determine whether to allow access. -For more information about conditional access, see [Azure Conditional Access Preview for SaaS Apps.](http://go.microsoft.com/fwlink/p/?LinkId=524807) +For more information about conditional access, see [Azure Conditional Access Preview for SaaS Apps.](https://go.microsoft.com/fwlink/p/?LinkId=524807) ->**Note:**  Conditional access control is an Azure AD Premium feature that's also available with EMS. If you don't have an Azure AD Premium subscription, you can get a trial from the [Microsoft Azure](http://go.microsoft.com/fwlink/p/?LinkId=691617) site. +>**Note:**  Conditional access control is an Azure AD Premium feature that's also available with EMS. If you don't have an Azure AD Premium subscription, you can get a trial from the [Microsoft Azure](https://go.microsoft.com/fwlink/p/?LinkId=691617) site.   For on-premises applications there are two options to enable conditional access control based on a device's compliance state: -- For on-premises applications that are published through the Azure AD Application Proxy, you can configure conditional access control policies as you would for cloud applications. For more details, see the [Azure AD Conditional Access preview updated: Now supports On-Premises and Custom LOB apps](http://go.microsoft.com/fwlink/p/?LinkId=691618) blog post. -- Additionally, Azure AD Connect will sync device compliance information from Azure AD to on-premises AD. ADFS on Windows Server Technical Preview 2016 will support conditional access control based on a device's compliance state. IT pros will configure conditional access control policies in ADFS that use the device's compliance state reported by a compatible MDM solution to secure on-premises applications. +- For on-premises applications that are published through the Azure AD Application Proxy, you can configure conditional access control policies as you would for cloud applications. For more details, see the [Azure AD Conditional Access preview updated: Now supports On-Premises and Custom LOB apps](https://go.microsoft.com/fwlink/p/?LinkId=691618) blog post. +- Additionally, Azure AD Connect will sync device compliance information from Azure AD to on-premises AD. ADFS on Windows Server 2016 will support conditional access control based on a device's compliance state. IT pros will configure conditional access control policies in ADFS that use the device's compliance state reported by a compatible MDM solution to secure on-premises applications. ![figure 13](images/hva-fig12-conditionalaccess12.png) @@ -768,7 +768,7 @@ The following process describes how Azure AD conditional access works: 13. If the device is compliant and the user is authorized, an access token is generated. 14. User can access the corporate managed asset. -For more information about Azure AD join, see the [Azure AD & Windows 10: Better Together for Work or School](http://go.microsoft.com/fwlink/p/?LinkId=691619) white paper. +For more information about Azure AD join, see the [Azure AD & Windows 10: Better Together for Work or School](https://go.microsoft.com/fwlink/p/?LinkId=691619) white paper. Conditional access control is a topic that many organizations and IT pros may not know as well as they should. The different attributes that describe a user, a device, compliance, and context of access are very powerful when used with a conditional access engine. Conditional access control is an essential step that helps organizations secure their environment. @@ -822,4 +822,4 @@ Health attestation is a key feature of Windows 10 that includes client and clou - [Protect derived domain credentials with Credential Guard](credential-guard.md) - [Device Guard deployment guide](device-guard-deployment-guide.md) -- [Trusted Platform Module technology overview](http://go.microsoft.com/fwlink/p/?LinkId=733957) +- [Trusted Platform Module technology overview](https://go.microsoft.com/fwlink/p/?LinkId=733957) diff --git a/windows/keep-secure/remote-credential-guard.md b/windows/keep-secure/remote-credential-guard.md new file mode 100644 index 0000000000..575cb5f7f2 --- /dev/null +++ b/windows/keep-secure/remote-credential-guard.md @@ -0,0 +1,103 @@ +--- +title: Protect Remote Desktop credentials with Remote Credential Guard (Windows 10) +description: Remote Credential Guard helps to secure your Remote Desktop credentials by never sending them to the target device. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: brianlic-msft +--- +# Protect Remote Desktop credentials with Remote Credential Guard + +**Applies to** +- Windows 10 +- Windows Server 2016 + +Introduced in Windows 10, version 1607, Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that's requesting the connection. It also provides single sign on experiences for Remote Desktop sessions. If the target device is compromised, your credentials are not exposed because both credential and credential derivatives are never sent to the target device. + +You can use Remote Credential Guard in the following ways: + +- Administrator credentials are highly privileged and must be protected. By using Remote Credential Guard to connect, you can be assured that your credentials are not passed over the network to the target device. + +- Helpdesk employees in your organization must connect to domain-joined devices that could be compromised. With Remote Credential Guard, the helpdesk employee can use RDP to connect to the target device without compromising their credentials to malware. + +Use the following diagrams to help understand how Remote Credential Guard works and what it helps protect against. + +![Remote Credential Guard](images/remote-credential-guard.png) + +## Hardware and software requirements + +The Remote Desktop client and server must meet the following requirements in order to use Remote Credential Guard: + +- They must be joined to an Active Directory domain + - Both devices must either joined to the same domain or the Remote Desktop server must be joined to a domain with a trust relationship to the client device's domain. +- They must use Kerberos authentication. +- They must be running at least Windows 10, version 1607 or Windows Server 2016. +- The Remote Desktop classic Windows app is required. The Remote Desktop Universal Windows Platform app doesn't support Remote Credential Guard. + + +## Enable Remote Credential Guard + +You must enable Remote Credential Guard on the target device by using the registry. + +1. Open Registry Editor. +2. Enable Remote Credential Guard: + - Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa. + - Add a new DWORD value named **DisableRestrictedAdmin**. Set the value of this registry setting to 0 to turn on Remote Credential Guard. +3. Close Registry Editor. + +You can add this by running the following from an elevated command prompt: + +``` +reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD +``` + +## Using Remote Credential Guard + +You can use Remote Credential Guard on the client device by setting a Group Policy or by using a parameter with Remote Desktop Connection. + +### Turn on Remote Credential Guard by using Group Policy + +1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Credentials Delegation**. +2. Double-click **Restrict delegation of credentials to remote servers**. +3. In the **Use the following restricted mode** box: + - If you want to require either [Restricted Admin mode](http://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Remote Credential Guard, choose **Require Remote Credential Guard**. In this configuration, Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Remote Credential Guard cannot be used. + + > **Note:** Neither Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server. + + - If you want to allow Remote Credential Guard, choose **Prefer Remote Credential Guard**. +4. Click **OK**. + + ![Remote Credential Guard Group Policy](images/remote-credential-guard-gp.png) + +5. Close the Group Policy Management Console. + +6. From a command prompt, run **gpupdate.exe /force** to ensure that the Group Policy object is applied. + + +### Use Remote Credential Guard with a parameter to Remote Desktop Connection + +If you don't use Group Policy in your organization, you can add the remoteGuard parameter when you start Remote Desktop Connection to turn on Remote Credential Guard for that connection. + +``` +mstsc.exe /remoteGuard +``` + + +## Considerations when using Remote Credential Guard + +- Remote Credential Guard does not include device claims. For example, if you’re trying to access a file server from the remote and the file server requires device claim, access will be denied. + +- Remote Credential Guard cannot be used to connect to a device that is joined to Azure Active Directory. + +- Remote Desktop Credential Guard only works with the RDP protocol. + +- No credentials are sent to the target device, but the target device still acquires the Kerberos Service Tickets on its own. + +- Remote Desktop Gateway is not compatible with Remote Credential Guard. + +- You cannot used saved credentials or credentials that are different than yours. You must use the credentials of the user who is logged into the device. + +- Both the client and the server must be joined to the same domain or the domains must have a trust relationship. + +- The server and client must authenticate using Kerberos. \ No newline at end of file diff --git a/windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md b/windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md index 890eaf1d99..42da77aa05 100644 --- a/windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md +++ b/windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The use of authentication in the previously described goal ([Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)) enables a device in the isolated domain to block traffic from untrusted devices. However, it does not prevent an untrusted device from eavesdropping on the network traffic shared between two trusted devices, because by default network packets are not encrypted. diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index 444e4cc534..13b3f05f42 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -4,6 +4,7 @@ description: To help you plan a deployment of Microsoft Device Guard, this artic keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy +localizationpriority: high author: brianlic-msft --- @@ -22,7 +23,9 @@ This article describes the following: - [Reviewing your applications: application signing and catalog files](#reviewing-your-applications-application-signing-and-catalog-files) - [Code integrity policy formats and signing](#code-integrity-policy-formats-and-signing) -The information in this article provides a foundation for [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). +The information in this article is intended for IT professionals, and provides a foundation for [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). + +>**Note**  If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx). ## Hardware, firmware, and software requirements for Device Guard @@ -55,7 +58,7 @@ The following tables provide more information about the hardware, firmware, and The following tables describes additional hardware and firmware requirements, and the improved security that is available when those requirements are met. -### 2015 Additional Qualification Requirements for Device Guard (Windows 10, version 1507 and Windows 10, version 1511) +### 2015 Additional Qualification Requirements for Device Guard (starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4) | Protections for Improved Security - requirement | Description | |---------------------------------------------|----------------------------------------------------| @@ -63,7 +66,7 @@ The following tables describes additional hardware and firmware requirements, an
    -### 2016 Additional Qualification Requirements for Device Guard (Windows 10, version 1607) +### 2016 Additional Qualification Requirements for Device Guard (starting with Windows 10, version 1607, and Windows Server 2016) > **Important**  The following tables list requirements for improved security, beyond the level of protection described in the preceding tables. You can use Device Guard with hardware, firmware, and software that do not support the following protections for improved security. As your systems meet more requirements, more protections become available to them. diff --git a/windows/keep-secure/requirements-to-use-applocker.md b/windows/keep-secure/requirements-to-use-applocker.md index 6389eb2755..60ac319a63 100644 --- a/windows/keep-secure/requirements-to-use-applocker.md +++ b/windows/keep-secure/requirements-to-use-applocker.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security +localizationpriority: high author: brianlic-msft --- @@ -32,7 +33,7 @@ The following table show the on which operating systems AppLocker features are s | Version | Can be configured | Can be enforced | Available rules | Notes | | - | - | - | - | - | -| Windows 10| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| You can use the [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) to configure AppLocker policies on any edition of Windows 10. You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise and Windows Server 2016 Technical Preview. | +| Windows 10| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| You can use the [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) to configure AppLocker policies on any edition of Windows 10. You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise and Windows Server 2016. | | Windows Server 2012 R2| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| | | Windows 8.1| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| Only the Enterprise edition supports AppLocker| | Windows RT 8.1| No| No| N/A|| diff --git a/windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md b/windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md index 049625343b..fa2225b9c4 100644 --- a/windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md +++ b/windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Domain isolation (as described in the previous goal [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)) prevents devices that are members of the isolated domain from accepting network traffic from untrusted devices. However, some devices on the network might host sensitive data that must be additionally restricted to only those users and computers that have a business requirement to access the data. diff --git a/windows/keep-secure/restrict-access-to-only-trusted-devices.md b/windows/keep-secure/restrict-access-to-only-trusted-devices.md index d2b47a2dbe..dc34b9ac84 100644 --- a/windows/keep-secure/restrict-access-to-only-trusted-devices.md +++ b/windows/keep-secure/restrict-access-to-only-trusted-devices.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Your organizational network likely has a connection to the Internet. You also likely have partners, vendors, or contractors who attach devices that are not owned by your organization to your network. Because you do not manage those devices, you cannot trust them to be free of malicious software, maintained with the latest security updates, or in any way in compliance with your organization's security policies. These untrustworthy devices both on and outside of your physical network must not be permitted to access your organization's devices except where it is truly required. diff --git a/windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md b/windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md index 85d7267abb..57d1bc1e9d 100644 --- a/windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md +++ b/windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have configured the IPsec connection security rules that force client devices to authenticate their connections to the isolated server, you must configure the rules that restrict access to only those devices or users who have been identified through the authentication process as members of the isolated server’s access group. diff --git a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md index 9e6debeb0f..2234eebd86 100644 --- a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md +++ b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md @@ -1,13 +1,14 @@ --- -title: Run a scan from the command line in Windows Defender in Windows 10 (Windows 10) -description: IT professionals can run a scan using the command line in Windows Defender in Windows 10. -keywords: scan, command line, mpcmdrun, defender +title: Learn how to run a scan from command line in Windows Defender (Windows 10) +description: Windows Defender utility enables IT professionals to use command line to run antivirus scans. +keywords: run windows defender scan, run antivirus scan from command line, run windows defender scan from command line, mpcmdrun, defender search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: mjcaparas --- @@ -19,19 +20,19 @@ author: mjcaparas IT professionals can use a command-line utility to run a Windows Defender scan. -The utility is available in _%Program Files%\Windows Defender\MpCmdRun.exe_ +The utility is available in _%Program Files%\Windows Defender\MpCmdRun.exe_. This utility can be handy when you want to automate the use of Windows Defender. -**To run a full system scan from the command line** +**To run a quick scan from the command line** 1. Click **Start**, type **cmd**, and press **Enter**. 2. Navigate to _%ProgramFiles%\Windows Defender_ and enter the following command, and press **Enter**: ``` -C:\Program Files\Windows Defender\mpcmdrun.exe -scan -scantype 2 +C:\Program Files\Windows Defender\mpcmdrun.exe -scan -scantype 1 ``` -The full scan will start. When the scan completes, you'll see a message indicating that the scan is finished. +The quick scan will start. When the scan completes, you'll see a message indicating that the scan is finished. The utility also provides other commands that you can run: @@ -43,12 +44,12 @@ MpCmdRun.exe [command] [-options] Command | Description :---|:--- \- ? / -h | Displays all available options for the tool -\-Scan [-ScanType #] [-File [-DisableRemediation] [-BootSectorScan]][-Timeout ] | Scans for malicious softare +\-Scan [-ScanType #] [-File [-DisableRemediation] [-BootSectorScan]][-Timeout ] | Scans for malicious software \-Trace [-Grouping #] [-Level #]| Starts diagnostic tracing \-GetFiles | Collects support information \-RemoveDefinitions [-All] | Restores the installed signature definitions to a previous backup copy or to the original default set of signatures -\-AddDynamicSignature [-Path] | Loads a dyanmic signature +\-AddDynamicSignature [-Path] | Loads a dynamic signature \-ListAllDynamicSignature [-Path] | Lists the loaded dynamic signatures \-RemoveDynamicSignature [-SignatureSetID] | Removes a dynamic signature -\-EnableIntegrityServices | Enables integrity services -\-SubmitSamples | Submit all sample requests \ No newline at end of file +
    +The command-line utility provides detailed information on the other commands supported by the tool. diff --git a/windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md index fa9c66bfb4..c6875dfdd6 100644 --- a/windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md +++ b/windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md @@ -12,7 +12,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 IKEv2 offers the following: @@ -40,7 +40,7 @@ You can use IKEv2 as a virtual private network (VPN) tunneling protocol that sup - [Troubleshooting](#troubleshooting) ->**Note:**  This topic includes sample Windows PowerShell cmdlets. For more info, see [How to Run a Windows PowerShell Cmdlet](http://go.microsoft.com/fwlink/p/?linkid=230693). +>**Note:**  This topic includes sample Windows PowerShell cmdlets. For more info, see [How to Run a Windows PowerShell Cmdlet](https://go.microsoft.com/fwlink/p/?linkid=230693). ## Prerequisites diff --git a/windows/keep-secure/security-considerations-for-applocker.md b/windows/keep-secure/security-considerations-for-applocker.md index f7c0df0eab..c959f1bfd0 100644 --- a/windows/keep-secure/security-considerations-for-applocker.md +++ b/windows/keep-secure/security-considerations-for-applocker.md @@ -40,6 +40,8 @@ AppLocker can only control VBScript, JScript, .bat files, .cmd files, and Window AppLocker rules either allow or prevent an application from launching. AppLocker does not control the behavior of applications after they are launched. Applications could contain flags passed to functions that signal AppLocker to circumvent the rules and allow another .exe or .dll to be loaded. In practice, an application that is allowed by AppLocker could use these flags to bypass AppLocker rules and launch child processes. You must thoroughly examine each application before allowing them to run by using AppLocker rules. >**Note:**  Two flags that illustrate this condition are `SANDBOX_INERT`, which can be passed to `CreateRestrictedToken`, and `LOAD_IGNORE_CODE_AUTHZ_LEVEL`, which can be passed to `LoadLibraryEx`. Both of these flags signal AppLocker to circumvent the rules and allow a child .exe or .dll to be loaded. + +You can block the Windows Subsystem for Linux by blocking LxssManager.dll.   ## Related topics diff --git a/windows/keep-secure/server-isolation-gpos.md b/windows/keep-secure/server-isolation-gpos.md index 149730d1a5..e0075d930f 100644 --- a/windows/keep-secure/server-isolation-gpos.md +++ b/windows/keep-secure/server-isolation-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Each set of devices that have different users or devices accessing them require a separate server isolation zone. Each zone requires one GPO for each version of Windows running on devices in the zone. The Woodgrove Bank example has an isolation zone for their devices that run SQL Server. The server isolation zone is logically considered part of the encryption zone. Therefore, server isolation zone GPOs must also include rules for encrypting all isolated server traffic. Woodgrove Bank copied the encryption zone GPOs to serve as a starting point, and renamed them to reflect their new purpose. diff --git a/windows/keep-secure/server-isolation-policy-design-example.md b/windows/keep-secure/server-isolation-policy-design-example.md index 4d38ed4c99..f6ddc73bf4 100644 --- a/windows/keep-secure/server-isolation-policy-design-example.md +++ b/windows/keep-secure/server-isolation-policy-design-example.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This design example continues to use the fictitious company Woodgrove Bank, as described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section and the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section. diff --git a/windows/keep-secure/server-isolation-policy-design.md b/windows/keep-secure/server-isolation-policy-design.md index a2397773da..de45c1b7c7 100644 --- a/windows/keep-secure/server-isolation-policy-design.md +++ b/windows/keep-secure/server-isolation-policy-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 In the server isolation policy design, you assign servers to a zone that allows access only to users and devices that authenticate as members of an approved network access group (NAG). diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index 81d0358abb..a5df900c1d 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -8,17 +8,19 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: DulceMV +localizationpriority: high --- # Windows Defender Advanced Threat Protection settings **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - Use the **Settings** menu ![Settings icon](images/settings.png) to configure the time zone, suppression rules, and view license information. ## Time zone settings @@ -52,7 +54,7 @@ To set the time zone: 3. The time zone indicator changes to **Timezone:Local**. Click it again to change back to **Timezone:UTC**. ## Suppression rules -The suppression rules control what alerts are suppressed. You can suppress alerts so that certain activities are not flagged as suspicious. See [Suppress alerts](manage-alerts-windows-defender-advanced-threat-protection.md#suppress-alerts). +The suppression rules control what alerts are suppressed. You can suppress alerts so that certain activities are not flagged as suspicious. For more information see, [Suppress alerts](manage-alerts-windows-defender-advanced-threat-protection.md#suppress-alerts). ## License Click the license link in the **Settings** menu to view the license agreement information for Windows Defender ATP. diff --git a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md index b6b9fd71e5..b60489c882 100644 --- a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md @@ -21,7 +21,7 @@ PCR\[N\] = HASHalg( PCR\[N\] || ArgumentOfExtend ) The existing value is concatenated with the argument of the TPM Extend operation. The resulting concatenation is then used as input to the associated hashing algorithm, which computes a digest of the input. This computed digest becomes the new value of the PCR. -The [TCG PC Client Specific Platform TPM Profile for TPM 2.0](http://go.microsoft.com/fwlink/p/?LinkId=746577) defines the inclusion of at least one PCR bank with 24 registers. The only way to reset the first 16 PCRs is to reset the TPM itself. This restriction helps ensure that the value of those PCRs can only be modified via the TPM Extend operation. +The [TCG PC Client Specific Platform TPM Profile for TPM 2.0](https://go.microsoft.com/fwlink/p/?LinkId=746577) defines the inclusion of at least one PCR bank with 24 registers. The only way to reset the first 16 PCRs is to reset the TPM itself. This restriction helps ensure that the value of those PCRs can only be modified via the TPM Extend operation. Some TPM PCRs are used as checksums of log events. The log events are extended in the TPM as the events occur. Later, an auditor can validate the logs by computing the expected PCR values from the log and comparing them to the PCR values of the TPM. Since the first 16 TPM PCRs cannot be modified arbitrarily, a match between an expected PCR value in that range and the actual TPM PCR value provides assurance of an unmodified log. diff --git a/windows/keep-secure/testing-scenarios-for-edp.md b/windows/keep-secure/testing-scenarios-for-edp.md index e2187af349..3d16ef00df 100644 --- a/windows/keep-secure/testing-scenarios-for-edp.md +++ b/windows/keep-secure/testing-scenarios-for-edp.md @@ -1,49 +1,5 @@ --- title: Testing scenarios for enterprise data protection (EDP) (Windows 10) description: We've come up with a list of suggested testing scenarios that you can use to test enterprise data protection (EDP) in your company. -ms.assetid: 53db29d2-d99d-4db6-b494-90e2b3962ca2 -keywords: EDP, Enterprise Data Protection -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -author: eross-msft ---- - -# Testing scenarios for enterprise data protection (EDP) -**Applies to:** - -- Windows 10 Insider Preview -- Windows 10 Mobile Preview - -[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -We've come up with a list of suggested testing scenarios that you can use to test enterprise data protection (EDP) in your company. - -## Testing scenarios -You can try any of the processes included in these scenarios, but you should focus on the ones that you might encounter in your organization. - -|Scenario |Processes | -|---------|----------| -|Automatically encrypt files from enterprise apps |
    1. Start an unmodified (for example, EDP-unaware) line-of-business app that's on your **Protected Apps** list and then create, edit, write, and save files.
    2. Make sure that all of the files you worked with from the EDP-unaware app are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.
    3. Open File Explorer and make sure your modified files are appearing with a **Lock** icon.

      **Note**
      Some file types, like .exe and .dll, along with some file paths, like `%windir%` and `%programfiles%`, are excluded from automatic encryption.

    | -|Block enterprise data from non-enterprise apps |
    1. Start an app that doesn't appear on your **Protected Apps** list, and then try to open an enterprise-encrypted file.

      The app shouldn't be able to access the file.

    2. Try double-clicking or tapping on the enterprise-encrypted file.

      If your default app association is an app not on your **Protected Apps** list, you should get an **Access Denied** error message.

    | -|Copy and paste from enterprise apps to non-enterprise apps |
    1. Copy (CTRL+C) content from an app on your **Protected Apps** list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your **Protected Apps** list.

      You should see an EDP-related warning box, asking you to click either **Got it** or **Cancel**.

    2. Click **Cancel**.

      The content isn't pasted into the non-enterprise app.

    3. Repeat Step 1, but this time click **Got it**, and try to paste the content again.

      The content is pasted into the non-enterprise app.

    4. Try copying and pasting content between apps on your **Protected Apps** list.

      The content should copy and paste between apps without any warning messages.

    | -|Drag and drop from enterprise apps to non-enterprise apps |
    1. Drag content from an app on your **Protected Apps** list, and then try to drop the content into an app that doesn't appear on your **Protected Apps** list.

      You should see an EDP-related warning box, asking you to click either **Drag Anyway** or **Cancel**.

    2. Click **Cancel**.

      The content isn't dropped into the non-enterprise app.

    3. Repeat Step 1, but this time click **Drag Anyway**, and try to drop the content again.

      The content is dropped into the non-enterprise app.

    4. Try dragging and dropping content between apps on your **Protected Apps** list.

      The content should move between the apps without any warning messages.

    | -|Share between enterprise apps and non-enterprise apps |
    1. Open an app on your **Protected Apps** list, like Microsoft Photos, and try to share content with an app that doesn't appear on your **Protected Apps** list, like Facebook.

      You should see an EDP-related warning box, asking you to click either **Share Anyway** or **Cancel**.

    2. Click **Cancel**.

      The content isn't shared into Facebook.

    3. Repeat Step 1, but this time click **Share Anyway**, and try to share the content again.

      The content is shared into Facebook.

    4. Try sharing content between apps on your **Protected Apps** list.

      The content should share between the apps without any warning messages.

    | -|Use the **Encrypt to** functionality |
    1. Open File Explorer on the desktop, right-click a decrypted file, and then click **Encrypt to** from the **Encrypt to** menu.

      EDP should encrypt the file to your Enterprise Identity.

    2. Make sure that the newly encrypted file has a **Lock** icon.
    3. In the **Encrypted to** column of File Explorer on the desktop, look for the enterprise ID value.
    4. Right-click the encrypted file, and then click **Not encrypted** from the **Encrypt to** menu.

      The file should be decrypted and the **Lock** icon should disappear.

    | -|Verify that Windows system components can use EDP |
    1. Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps.
    2. Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.
    3. Open File Explorer and make sure your modified files are appearing with a **Lock** icon
    4. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the **Protected Apps** list.

      **Note**
      Most Windows-signed components like Windows Explorer (when running in the user’s context), should have access to enterprise data.

      A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your **Protected Apps** list.

    | -|Use EDP on FAT/exFAT systems |
    1. Start an app that uses the FAT or exFAT file system and appears on your **Protected Apps** list.
    2. Create, edit, write, save, and move files.

      Basic file and folder operations like copy, move, rename, delete, and so on, should work properly on encrypted files.

    3. Try copying and moving files or folders between apps that use NTFS, FAT and exFAT file systems.
    | -|Use EDP on NTFS systems |
    1. Start an app that uses the NTFS file system and appears on your **Protected Apps** list.
    2. Create, edit, write, save, and move files.

      Basic file and folder operations like copy, move, rename, delete, and so on, should work properly on encrypted files.

    3. Try copying and moving files or folders between apps that use NTFS, FAT and exFAT file systems.
    | -|Unenroll client devices from EDP |
    • Unenroll a device from EDP by going to **Settings**, click **Accounts**, click **Work**, click the name of the device you want to unenroll, and then click **Remove**.

      The device should be removed and all of the enterprise content for that managed account should be gone.

      **Important**
      Unenrolling a device revokes and erases all of the enterprise data for the managed account.

    | -|Verify that app content is protected when a Windows 10 Mobile phone is locked |
    • Check that protected app data doesn't appear on the **Lock** screen of a Windows 10 Mobile phone
    | - -  - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/testing-scenarios-for-wip +--- \ No newline at end of file diff --git a/windows/keep-secure/testing-scenarios-for-wip.md b/windows/keep-secure/testing-scenarios-for-wip.md new file mode 100644 index 0000000000..45737291cf --- /dev/null +++ b/windows/keep-secure/testing-scenarios-for-wip.md @@ -0,0 +1,166 @@ +--- +title: Testing scenarios for Windows Information Protection (WIP) (Windows 10) +description: A list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company. +ms.assetid: 53db29d2-d99d-4db6-b494-90e2b3962ca2 +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: eross-msft +localizationpriority: high +--- + +# Testing scenarios for Windows Information Protection (WIP) +**Applies to:** + +- Windows 10, version 1607 +- Windows 10 Mobile + +We've come up with a list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company. + +## Testing scenarios +You can try any of the processes included in these scenarios, but you should focus on the ones that you might encounter in your organization. + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ScenarioProcesses
    Encrypt and decrypt files using File Explorer.For desktop:

    +

      +
    1. Open File Explorer, right-click a work document, and then click Work from the File Ownership menu.
      Make sure the file is encrypted by right-clicking the file again, clicking Advanced from the General tab, and then clicking Details from the Compress or Encrypt attributes area. The file should show up under the heading, This enterprise domain can remove or revoke access: <your_enterprise_identity>. For example, contoso.com.
      2. +
    2. In File Explorer, right-click the same document, and then click Personal from the File Ownership menu.
      Make sure the file is decrypted by right-clicking the file again, clicking Advanced from the General tab, and then verifying that the Details button is unavailable.
      3. +
    + For mobile:

    +

      +
    1. Open the File Explorer app, browse to a file location, click the elipsis (...), and then click Select to mark at least one file as work-related.
      2. +
    2. Click the elipsis (...) again, click File ownership from the drop down menu, and then click Work.
      Make sure the file is encrypted, by locating the Briefcase icon next to the file name.
      3. +
    3. Select the same file, click File ownership from the drop down menu, and then click Personal.
      Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
      4. +
    +
    Create work documents in enterprise-allowed apps.For desktop:

    +

      +
    • Start an unenlightened but allowed app, such as a line-of-business app, and then create a new document, saving your changes.
      Make sure the document is encrypted to your Enterprise Identity. This might take a few minutes and require you to close and re-open the file.

      Important
      Certain file types like .exe and .dll, along with certain file paths, such as %windir% and %programfiles% are excluded from automatic encryption.

      For more info about your Enterprise Identity and adding apps to your allowed apps list, see either [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) or [Create a Windows Information Protection (WIP) policy using Microsoft System Center Configuration Manager](create-wip-policy-using-sccm.md), based on your deployment system.

      • +
    + For mobile:

    +

      +
    1. Start an allowed mobile app, such as Word Mobile, create a new document, and then save your changes as Work to a local, work-related location.
      Make sure the document is encrypted, by locating the Briefcase icon next to the file name.
      2. +
    2. Open the same document and attempt to save it to a non-work-related location.
      WIP should stop you from saving the file to this location.
      3. +
    3. Open the same document one last time, make a change to the contents, and then save it again using the Personal option.
      Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
      4. +
    +
    Block enterprise data from non-enterprise apps. +
      +
    1. Start an app that doesn't appear on your allowed apps list, and then try to open a work-encrypted file.
      The app shouldn't be able to access the file.
      2. +
    2. Try double-clicking or tapping on the work-encrypted file.
      If your default app association is an app not on your allowed apps list, you should get an Access Denied error message.
      3. +
    +
    Copy and paste from enterprise apps to non-enterprise apps. +
      +
    1. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.
      You should see a WIP-related warning box, asking you to click either Change to personal or Keep at work.
      2. +
    2. Click Keep at work.
      The content isn't pasted into the non-enterprise app.
      3. +
    3. Repeat Step 1, but this time click Change to personal, and try to paste the content again.
      The content is pasted into the non-enterprise app.
      4. +
    4. Try copying and pasting content between apps on your allowed apps list.
      The content should copy and paste between apps without any warning messages.
      5. +
    +
    Drag and drop from enterprise apps to non-enterprise apps. +
      +
    1. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.
      You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
      2. +
    2. Click Keep at work.
      The content isn't dropped into the non-enterprise app.
      3. +
    3. Repeat Step 1, but this time click Change to personal, and try to drop the content again.
      The content is dropped into the non-enterprise app.
      4. +
    4. Try dragging and dropping content between apps on your allowed apps list.
      The content should move between the apps without any warning messages.
      5. +
    +
    Share between enterprise apps and non-enterprise apps. +
      +
    1. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.
      You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
      2. +
    2. Click Keep at work.
      The content isn't shared into Facebook.
      3. +
    3. Repeat Step 1, but this time click Change to personal, and try to share the content again.
      The content is shared into Facebook.
      4. +
    4. Try sharing content between apps on your allowed apps list.
      The content should share between the apps without any warning messages.
      5. +
    +
    Verify that Windows system components can use WIP. +
      +
    1. Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps.
      Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.
      2. +
    2. Open File Explorer and make sure your modified files are appearing with a Lock icon.
      3. +
    3. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.

      Note
      Most Windows-signed components like File Explorer (when running in the user’s context), should have access to enterprise data.

      A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.

      4. +
    +
    Use WIP on NTFS, FAT, and exFAT systems. +
      +
    1. Start an app that uses the FAT or exFAT file system (for example a SD card or USB flash drive), and appears on your allowed apps list.
      2. +
    2. Create, edit, write, save, copy, and move files.
      Basic file and folder operations like copy, move, rename, delete, and so on, should work properly on encrypted files.
      3. +
    +
    Verify your shared files can use WIP. +
      +
    1. Download a file from a protected file share, making sure the file is encrypted by locating the Briefcase icon next to the file name.
      2. +
    2. Open the same file, make a change, save it and then try to upload it back to the file share. Again, this should work without any warnings.
      3. +
    3. Open an app that doesn't appear on your allowed apps list and attempt to access a file on the WIP-enabled file share.
      The app shouldn't be able to access the file share.
      4. +
    +
    Verify your cloud resources can use WIP. +
      +
    1. Add both Internet Explorer 11 and Microsoft Edge to your allowed apps list.
      2. +
    2. Open SharePoint (or another cloud resource that's part of your policy) and access a WIP-enabled resource by using both IE11 and Microsoft Edge.
      Both browsers should respect the enterprise and personal boundary.
      3. +
    3. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.
      IE11 shouldn't be able to access the sites.

      Note
      Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as Work.

      4. +
    +
    Verify your Virtual Private Network (VPN) can be auto-triggered. +
      +
    1. Set up your VPN network to start based on the WIPModeID setting.
      For specific info about how to do this, see the [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-wip-policy-using-intune.md) topic.
      2. +
    2. Start an app from your allowed apps list.
      The VPN network should automatically start.
      3. +
    3. Disconnect from your network and then start an app that isn't on your allowed apps list.
      The VPN shouldn't start and the app shouldn't be able to access your enterprise network.
      4. +
    +
    Unenroll client devices from WIP. +
      +
    • Unenroll a device from WIP by going to Settings, click Accounts, click Work, click the name of the device you want to unenroll, and then click Remove.
      The device should be removed and all of the enterprise content for that managed account should be gone.

      Important
      On desktop devices, the data isn't removed and can be recovered, so you must make sure they content is marked as Revoked and that access is denied for the employee. On mobile devices, the data is removed.

      • +
    +
    Verify that app content is protected when a Windows 10 Mobile phone is locked. +
      +
    • Check that protected app data doesn't appear on the Lock screen of a Windows 10 Mobile phone.
      • +
    +
    \ No newline at end of file diff --git a/windows/keep-secure/tpm-fundamentals.md b/windows/keep-secure/tpm-fundamentals.md index 6969c89924..92a6fe9b1d 100644 --- a/windows/keep-secure/tpm-fundamentals.md +++ b/windows/keep-secure/tpm-fundamentals.md @@ -195,5 +195,5 @@ You can fix this by clearing the TPM. - [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) - [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) - [Schema Extensions for Windows Server 2008 R2 to support AD DS backup of TPM information from Windows 8 clients](ad-ds-schema-extensions-to-support-tpm-backup.md) -- [TPM WMI providers](http://go.microsoft.com/fwlink/p/?LinkId=93478) +- [TPM WMI providers](https://go.microsoft.com/fwlink/p/?LinkId=93478) - [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) diff --git a/windows/keep-secure/tpm-recommendations.md b/windows/keep-secure/tpm-recommendations.md index 81b6385faf..acf27319d7 100644 --- a/windows/keep-secure/tpm-recommendations.md +++ b/windows/keep-secure/tpm-recommendations.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security +localizationpriority: high author: brianlic-msft --- @@ -14,7 +15,7 @@ author: brianlic-msft **Applies to** - Windows 10 - Windows 10 Mobile -- Windows Server 2016 Technical Preview +- Windows Server 2016 - Windows 10 IoT Core (IoT Core) This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. @@ -83,7 +84,7 @@ For more info, see [fTPM: A Firmware-based TPM 2.0 Implementation](http://resear ## Is there any importance for TPM for consumer? -For end consumers, TPM is behind the scenes but still very relevant for Hello, Passport and in the future, many other key features in Windows 10. It offers the best Passport experience, helps encrypt passwords, secures streaming high quality 4K content and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. +For end consumers, TPM is behind the scenes but still very relevant for Hello, Passport and in the future, many other key features in Windows 10. It offers the best Passport experience, helps encrypt passwords, and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. ## TPM 2.0 Compliance for Windows 10 @@ -104,7 +105,7 @@ For end consumers, TPM is behind the scenes but still very relevant for Hello, P - TPM is optional on IoT Core. -### Windows Server 2016 Technical Preview +### Windows Server 2016 - TPM is optional for Windows Server SKUs unless the SKU meets the additional qualification (AQ) criteria for the Host Guardian Services scenario in which case TPM 2.0 is required. diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index b9baeb947e..7e351ee5aa 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -7,58 +7,49 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: iaanw +author: mjcaparas +localizationpriority: high --- # Troubleshoot Windows Defender Advanced Threat Protection onboarding issues **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] +You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues. +This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the endpoints. -You might need to troubleshoot the Windows Defender Advanced Threat Protection onboarding process if you encounter issues. -This page provides detailed steps for troubleshooting endpoints that aren't reporting correctly, and common error codes encountered during onboarding. +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, it might indicate an endpoint onboarding or connectivity problem. -## Endpoints are not reporting to the service correctly +## Troubleshoot onboarding when deploying with Group Policy +Deployment with Group Policy is done by running the onboarding script on the endpoints. The Group Policy console does not indicate if the deployment has succeeded or not. -If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or connectivity problem. +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, you can check the output of the script on the endpoints. For more information, see [Troubleshoot onboarding when deploying with a script on the endpoint](#troubleshoot-onboarding-when-deploying-with-a-script-on-the-endpoint). -Go through the following verification topics to address this issue: +If the script completes successfully, see [Troubleshoot onboarding issues on the endpoint](#troubleshoot-onboarding-issues-on-the-endpoint) for additional errors that might occur. -- [Ensure the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) -- [Ensure the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) -- [Ensure the telemetry and diagnostics service is enabled](#Ensure-that-telemetry-and-diagnostics-service-is-enabled) -- [Ensure the endpoint has an Internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) +## Troubleshoot onboarding issues when deploying with System Center Configuration Manager +When onboarding endpoints using the following versions of System Center Configuration Manager: +- System Center 2012 Configuration Manager +- System Center 2012 R2 Configuration Manager +- System Center Configuration Manager (current branch) version 1511 +- System Center Configuration Manager (current branch) version 1602 -### Ensure the endpoint is onboarded successfully -If the endpoints aren't reporting correctly, you might need to check that the Windows Defender ATP service was successfully onboarded onto the endpoint. +Deployment with the above-mentioned versions of System Center Configuration Manager is done by running the onboarding script on the endpoints. You can track the deployment in the Configuration Manager Console. -**Check the onboarding state in Registry**: +If the deployment fails, you can check the output of the script on the endpoints. For more information, see [Troubleshoot onboarding when deploying with a script on the endpoint](#troubleshoot-onboarding-when-deploying-with-a-script-on-the-endpoint). -1. Click **Start**, type **Run**, and press **Enter**. +If the onboarding completed successfully but the endpoints are not showing up in the **Machines view** after an hour, see [Troubleshoot onboarding issues on the endpoint](#troubleshoot-onboarding-issues-on-the-endpoint) for additional errors that might occur. -2. From the **Run** dialog box, type **regedit** and press **Enter**. - -4. In the **Registry Editor** navigate to the Status key under: - - ```text -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection -``` - -5. Check the **OnboardingState** value is set to **1**. - - ![Image of OnboardingState status in Registry Editor](images/onboardingstate.png) - -If the **OnboardingState** value is not set to **1**, you can use Event Viewer to review errors on the endpoint. - -If you configured your endpoints with a deployment tool that required a script, you can check the event viewer for the onboarding script results. -
    -**Check the result of the script**: +## Troubleshoot onboarding when deploying with a script on the endpoint +**Check the result of the script on the endpoint**: 1. Click **Start**, type **Event Viewer**, and press **Enter**. 2. Go to **Windows Logs** > **Application**. @@ -66,25 +57,82 @@ If you configured your endpoints with a deployment tool that required a script, 3. Look for an event from **WDATPOnboarding** event source. If the script fails and the event is an error, you can check the event ID in the following table to help you troubleshoot the issue. -> **Note**  The following event IDs are specific to the onboarding script only. +> [!NOTE] +> The following event IDs are specific to the onboarding script only. Event ID | Error Type | Resolution steps :---|:---|:--- -5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection``` -10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```. Verify that the script was ran as an administrator. -15 | Failed to start SENSE service |Check the service status (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). +5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```. +10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically
    ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```.
    Verify that the script was ran as an administrator. +15 | Failed to start SENSE service |Check the service status (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). +15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender ELAM driver, see [Ensure the Windows Defender ELAM driver is enabled](#ensure-the-windows-defender-elam-driver-is-enabled) for instructions. 30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). -35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location ```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```. The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer].(event-error-codes-windows-defender-advanced-threat-protection.md). -40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). +35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location
    ```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.
    The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). +40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). +65 | Insufficient privileges| Run the script again with administrator privileges. + +## Troubleshoot onboarding issues using Microsoft Intune +You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue. + +Use the following tables to understand the possible causes of issues while onboarding: + +- Microsoft Intune error codes and OMA-URIs table +- Known issues with non-compliance table +- Mobile Device Management (MDM) event logs table + +If none of the event logs and troubleshooting steps work, download the Local script from the **Endpoint Management** section of the portal, and run it in an elevated command prompt. + +**Microsoft Intune error codes and OMA-URIs**: + +Error Code Hex | Error Code Dec | Error Description | OMA-URI | Possible cause and troubleshooting steps +:---|:---|:---|:---|:--- +0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding
    Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields.

    **Troubleshooting steps:**
    Check the event IDs in the [View agent onboarding errors in the endpoint event log](#view-agent-onboarding-errors-in-the-endpoint-event-log) section.

    Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx). + | | | Onboarding
    Offboarding
    SampleSharing | **Possible cause:** Windows Defender ATP Policy registry key does not exist or the OMA DM client doesn't have permissions to write to it.

    **Troubleshooting steps:** Ensure that the following registry key exists: ```HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.

    If it doesn't exist, open an elevated command and add the key. + | | | SenseIsRunning
    OnboardingState
    OrgId | **Possible cause:** An attempt to remediate by read-only property. Onboarding has failed.

    **Troubleshooting steps:** Check the troubleshooting steps in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](#troubleshoot-windows-defender-advanced-threat-protection-onboarding-issues).

    Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx). + | | | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU.

    Currently is supported platforms: Enterprise, Education, and Professional.
    Server is not supported. + 0x87D101A9 | -2016345687 |Syncml(425): The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU.

    Currently is supported platforms: Enterprise, Education, and Professional.
    -**Use Event Viewer to identify and adress onboarding errors**: +**Known issues with non-compliance** + +The following table provides information on issues with non-compliance and how you can address the issues. + +Case | Symptoms | Possible cause and troubleshooting steps +:---|:---|:--- +1 | Machine is compliant by SenseIsRunning OMA-URI. But is non-compliant by OrgId, Onboarding and OnboardingState OMA-URIs. | **Possible cause:** Check that user passed OOBE after Windows installation or upgrade. During OOBE onboarding couldn't be completed but SENSE is running already.

    **Troubleshooting steps:** Wait for OOBE to complete. +2 | Machine is compliant by OrgId, Onboarding, and OnboardingState OMA-URIs, but is non-compliant by SenseIsRunning OMA-URI. | **Possible cause:** Sense service's startup type is set as "Delayed Start". Sometimes this causes the Microsoft Intune server to report the machine as non-compliant by SenseIsRunning when DM session occurs on system start.

    **Troubleshooting steps:** The issue should automatically be fixed within 24 hours. +3 | Machine is non-compliant | **Troubleshooting steps:** Ensure that Onboarding and Offboarding policies are not deployed on the same machine at same time. + +
    +**Mobile Device Management (MDM) event logs** + +View the MDM event logs to troubleshoot issues that might arise during onboarding: + +Log name: Microsoft\Windows\DeviceManagement-EnterpriseDiagnostics-Provider + +Channel name: Admin + +ID | Severity | Event description | Troubleshooting steps +:---|:---|:---|:--- +1819 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Set Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3). | Windows Defender ELAM driver needs to be enabled see, [Ensure the Windows Defender ELAM driver is enabled](#ensure-the-windows-defender-elam-driver-is-enabled) for instructions. + +## Troubleshoot onboarding issues on the endpoint +If the deployment tools used does not indicate an error in the onboarding process, but endpoints are still not appearing in the machines view an hour, go through the following verification topics to check if an error occurred with the Windows Defender ATP agent: +- [View agent onboarding errors in the endpoint event log](#view-agent-onboarding-errors-in-the-endpoint-event-log) +- [Ensure the telemetry and diagnostics service is enabled](#ensure-the-telemetry-and-diagnostics-service-is-enabled) +- [Ensure the service is set to start](#ensure-the-service-is-set-to-start) +- [Ensure the endpoint has an Internet connection](#ensure-the-endpoint-has-an-internet-connection) +- [Ensure the Windows Defender ELAM driver is enabled](#ensure-the-windows-defender-elam-driver-is-enabled) + + +### View agent onboarding errors in the endpoint event log 1. Click **Start**, type **Event Viewer**, and press **Enter**. 2. In the **Event Viewer (Local)** pane, expand **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE**. - > **Note**  SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. + > [!NOTE] + > SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. 3. Select **Operational** to load the log. @@ -98,101 +146,16 @@ Event ID | Error Type | Resolution steps Event ID | Message | Resolution steps :---|:---|:--- -5 | Windows Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection). -6 | Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-windows-defender-advanced-threat-protection.md#manual). -7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection), then run the entire onboarding process again. -15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection). +5 | Windows Defender Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection). +6 | Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-windows-defender-advanced-threat-protection.md#manual). +7 | Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection), then run the entire onboarding process again. +15 | Windows Defender Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection). 25 | Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: _variable_ | Contact support. - - -### Ensure the Windows Defender ATP service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows Defender ATP service is set to automatically start and is running on the endpoint. - -You can use the SC command line program for checking and managing the startup type and running state of the service. - -**Check the Windows Defender ATP service startup type from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start**, type **cmd**, and press **Enter**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command, and press **Enter**: - - ```text - sc qc sense - ``` - -If the the service is running, then the result should look like the following screenshot: - - ![Result of the sq query sense command](images/sc-query-sense-autostart.png) - -If the service ```START_TYPE``` is not set to ```AUTO_START```, then you'll need to set the service to automatically start. - -**Change the Windows Defender ATP service startup type from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start**, type **cmd**, and press **Enter**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command, and press **Enter**: - - ```text - sc config sense start=auto - ``` - -3. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ```text - sc qc sense - ``` - -**Check the Windows Defender ATP service is running from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start**, type **cmd**, and press **Enter**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command, and press **Enter**: - - ```text - sc query sense - ``` - -If the service is running, the result should look like the following screenshot: - -![Result of the sc query sense command](images/sc-query-sense-running.png) - -If the service **STATE** is not set to **RUNNING**, then you'll need to start it. - -**Start the Windows Defender ATP service from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start**, type **cmd**, and press **Enter**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command, and press **Enter**: - - ```text - sc start sense - ``` - -3. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ```text - sc qc sense - ``` +
    +There are additional components on the endpoint that the Windows Defender ATP agent depends on to function properly. If there are no onboarding related errors in the Windows Defender ATP agent event log, proceed with the following steps to ensure that the additional components are configured correctly. ### Ensure the telemetry and diagnostics service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is set to automatically start and is running on the endpoint. The service may have been disabled by other programs or user configuration changes. - +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is set to automatically start and is running on the endpoint. The service might have been disabled by other programs or user configuration changes. First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't). @@ -212,12 +175,11 @@ First, you should check that the service is set to start automatically when Wind sc qc diagtrack ``` -If the service is enabled, then the result should look like the following screenshot: + If the service is enabled, then the result should look like the following screenshot: -![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) - -If the ```START_TYPE``` is not set to ```AUTO_START```, then you'll need to set the service to automatically start. + ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + If the `START_TYPE` is not set to `AUTO_START`, then you'll need to set the service to automatically start. **Use the command line to set the Windows 10 telemetry and diagnostics service to automatically start:** @@ -240,109 +202,13 @@ If the ```START_TYPE``` is not set to ```AUTO_START```, then you'll need to set sc qc diagtrack ``` -**Use the Windows Services console to check the Windows 10 telemetry and diagnostics service startup type**: +4. Start the service. -1. Open the services console: - - a. Click **Start** and type **services**. - - b. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Check the **Startup type** column - the service should be set as **Automatic**. - -If the startup type is not set to **Automatic**, you'll need to change it so the service starts when the endpoint does. - - -**Use the Windows Services console to set the Windows 10 telemetry and diagnostics service to automatically start:** - -1. Open the services console: - - a. Click **Start** and type **services**. - - b. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Right-click on the entry and click **Properties**. - -4. On the **General** tab, change the **Startup type:** to **Automatic**, as shown in the following image. Click OK. - - ![Select Automatic to change the startup type in the Properties dialog box for the service](images/windefatp-utc-console-autostart.png) - -### Ensure the service is running - -**Use the command line to check the Windows 10 telemetry and diagnostics service is running**: - -1. Open an elevated command-line prompt on the endpoint: - - a. **Click **Start** and type **cmd**.** - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command, and press **Enter**: - - ```text - sc query diagtrack - ``` - -If the service is running, the result should look like the following screenshot: - -![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) - -If the service **STATE** is not set to **RUNNING**, then you'll need to start it. - - -**Use the command line to start the Windows 10 telemetry and diagnostics service:** - -1. Open an elevated command-line prompt on the endpoint: - - a. **Click **Start** and type **cmd**.** - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command, and press **Enter**: - - ```text - sc start diagtrack - ``` - -3. A success message is displayed. Verify the change by entering the following command, and press **Enter**: - - ```text - sc query diagtrack - ``` - -**Use the Windows Services console to check the Windows 10 telemetry and diagnostics service is running**: - -1. Open the services console: - - a. Click **Start** and type **services**. - - b. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Check the **Status** column - the service should be marked as **Running**. - -If the service is not running, you'll need to start it. - - -**Use the Windows Services console to start the Windows 10 telemetry and diagnostics service:** - -1. Open the services console: - - a. Click **Start** and type **services**. - - b. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Right-click on the entry and click **Start**, as shown in the following image. - -![Select Start to start the service](images/windef-utc-console-start.png) + a. In the command prompt, type the following command and press **Enter**: + ```text + sc start diagtrack + ``` ### Ensure the endpoint has an Internet connection @@ -352,90 +218,103 @@ WinHTTP is independent of the Internet browsing proxy settings and other user co To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls) topic. -If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. +If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. -## Troubleshoot onboarding issues using Microsoft Intune -You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue. +### Ensure the Windows Defender ELAM driver is enabled +If your endpoints are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. -Use the following tables to understand the possible causes of issues while onboarding: +**Check the ELAM driver status:** -- Microsoft Intune error codes and OMA-URIs table -- Known issues with non-compliance table -- Mobile Device Management (MDM) event logs table +1. Open a command-line prompt on the endpoint: -If none of the event logs and troubleshooting steps work, download the Local script from the **Endpoint Management** section of the portal, and run it in an elevated command prompt. + a. Click **Start**, type **cmd**, and select **Command prompt**. -**Microsoft Intune error codes and OMA-URIs**: +2. Enter the following command, and press Enter: + ``` + sc qc WdBoot + ``` + If the ELAM driver is enabled, the output will be: -Error Code Hex | Error Code Dec | Error Description | OMA-URI | Possible cause and troubleshooting steps -:---|:---|:---|:---|:--- -0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding
    Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields.

    **Troubleshooting steps:**
    Check the event IDs in the [Ensure the endpoint is onboarded successfully](#ensure-the-endpoint-is-onboarded-successfully) section.

    Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120%28v=vs.85%29.aspx). - | | | Onboarding
    Offboarding
    SampleSharing | **Possible cause:** Windows Defender ATP Policy registry key does not exist or the OMA DM client doesn't have permissions to write to it.

    **Troubleshooting steps:** Ensure that the following registry key exists: ```HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.

    If it doesn't exist, open an elevated command and add the key. - | | | SenseIsRunning
    OnboardingState
    OrgId | **Possible cause:** An attempt to remediate by read-only property. Onboarding has failed.

    **Troubleshooting steps:** Check the troubleshooting steps in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](#troubleshoot-windows-defender-advanced-threat-protection-onboarding-issues).

    Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120%28v=vs.85%29.aspx). - | | | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU.

    Currently is supported platforms: Enterprise, Education, and Professional.
    Server is not supported. - 0x87D101A9 | -2016345687 |Syncml(425): The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU.

    Currently is supported platforms: Enterprise, Education, and Professional. + ``` + [SC] QueryServiceConfig SUCCESS -
    -**Known issues with non-compliance** + SERVICE_NAME: WdBoot + TYPE : 1 KERNEL_DRIVER + START_TYPE : 0 BOOT_START + ERROR_CONTROL : 1 NORMAL + BINARY_PATH_NAME : \SystemRoot\system32\drivers\WdBoot.sys + LOAD_ORDER_GROUP : Early-Launch + TAG : 0 + DISPLAY_NAME : Windows Defender Boot Driver + DEPENDENCIES : + SERVICE_START_NAME : + ``` + If the ELAM driver is disabled the output will be: + ``` + [SC] QueryServiceConfig SUCCESS -The following table provides information on issues with non-compliance and how you can address the issues. + SERVICE_NAME: WdBoot + TYPE : 1 KERNEL_DRIVER + START_TYPE : 0 DEMAND_START + ERROR_CONTROL : 1 NORMAL + BINARY_PATH_NAME : \SystemRoot\system32\drivers\WdBoot.sys + LOAD_ORDER_GROUP : _Early-Launch + TAG : 0 + DISPLAY_NAME : Windows Defender Boot Driver + DEPENDENCIES : + SERVICE_START_NAME : + ``` -Case | Symptoms | Possible cause and troubleshooting steps -:---|:---|:--- -1 | Machine is compliant by SenseIsRunning OMA-URI. But is non-compliant by OrgId, Onboarding and OnboardingState OMA-URIs. | **Possible cause:** Check that user passed OOBE after Windows installation or upgrade. During OOBE onboarding couldn't be completed but SENSE is running already.

    **Troubleshooting steps:** Wait for OOBE to complete. -2 | Machine is compliant by OrgId, Onboarding, and OnboardingState OMA-URIs, but is non-compliant by SenseIsRunning OMA-URI. | **Possible cause:** Sense service's startup type is set as "Delayed Start". Sometimes this causes the Microsoft Intune server to report the machine as non-compliant by SenseIsRunning when DM session occurs on system start.

    **Troubleshooting steps:** The issue should automatically be fixed within 24 hours. -3 | Machine is non-compliant | **Troubleshooting steps:** Ensure that Onboarding and Offboarding policies are not deployed on the same machine at same time. +#### Enable the ELAM driver -
    -**Mobile Device Management (MDM) event logs** +1. Open an elevated PowerShell console on the endpoint: -View the MDM event logs to troubleshoot issues that might arise during onboarding: + a. Click **Start**, type **powershell**. -Log name: Microsoft\Windows\DeviceManagement-EnterpriseDiagnostics-Provider + b. Right-click **Command prompt** and select **Run as administrator**. -Channel name: Admin +2. Run the following PowerShell cmdlet: -ID | Severity | Event description | Description -:---|:---|:---|:--- -1801 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Get Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3) | Windows Defender ATP has failed to get specific node's value.
    TokenName: Contains node name that caused the error.
    Result: Error details. -1802 | Information | Windows Defender Advanced Threat Protection CSP: Get Node's Value complete. NodeId: (%1), TokenName: (%2), Result: (%3) | Windows Defender ATP has completed to get specific node's value.
    TokenName: Contains node name

    Result: Error details or succeeded. -1819 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Set Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3). | Windows Defender ATP has completed to get specific node's value.

    TokenName: Contains node name that caused the error

    Result: Error details. -1820 | Information | Windows Defender Advanced Threat Protection CSP: Set Nod's Value complete. NodeId: (%1), TokenName: (%2), Result: (%3). | Windows Defender ATP has completed to get specific node's value.

    TokenName: Contains node name

    Result: Error details or succeeded. + ```text + 'Set-ExecutionPolicy -ExecutionPolicy Bypass’ + ``` +3. Run the following PowerShell script: + + ```text + Add-Type @' + using System; + using System.IO; + using System.Runtime.InteropServices; + using Microsoft.Win32.SafeHandles; + using System.ComponentModel; + + public static class Elam{ + [DllImport("Kernel32", CharSet=CharSet.Auto, SetLastError=true)] + public static extern bool InstallELAMCertificateInfo(SafeFileHandle handle); + + public static void InstallWdBoot(string path) + { + Console.Out.WriteLine("About to call create file on {0}", path); + var stream = File.Open(path, FileMode.Open, FileAccess.Read, FileShare.Read); + var handle = stream.SafeFileHandle; + + Console.Out.WriteLine("About to call InstallELAMCertificateInfo on handle {0}", handle.DangerousGetHandle()); + if (!InstallELAMCertificateInfo(handle)) + { + Console.Out.WriteLine("Call failed."); + throw new Win32Exception(Marshal.GetLastWin32Error()); + } + Console.Out.WriteLine("Call successful."); + } + } + '@ + + $driverPath = $env:SystemRoot + "\System32\Drivers\WdBoot.sys" + [Elam]::InstallWdBoot($driverPath) + ``` - ## Related topics - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) - [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index 8340e9dcc0..150079eaff 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -8,16 +8,18 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Troubleshoot Windows Defender Advanced Threat Protection **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - This section addresses issues that might arise as you use the Windows Defender Advanced Threat service. ### Server error - Access is denied due to invalid credentials @@ -39,9 +41,11 @@ U.S. region: - sevillefeedback-prd.trafficmanager.net - sevillesettings-prd.trafficmanager.net - threatintel-cus-prd.cloudapp.net -- threatintel-eus-prd.cloudapp.net - - +- threatintel-eus-prd.cloudapp.net +- winatpauthorization.windows.com +- winatpfeedback.windows.com +- winatpmanagement.windows.com +- winatponboarding.windows.com EU region: @@ -52,7 +56,10 @@ EU region: - sevillesettings-prd.trafficmanager.net - threatintel-neu-prd.cloudapp.net - threatintel-weu-prd.cloudapp.net - +- winatpauthorization.windows.com +- winatpfeedback.windows.com +- winatpmanagement.windows.com +- winatponboarding.windows.com ### Windows Defender ATP service shows event or error logs in the Event Viewer diff --git a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md index e60c0f663c..df382bc1fe 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md +++ b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: jasesso --- @@ -316,8 +317,8 @@ Description of the error.

    To troubleshoot this event:

    1. Run the scan again.
      2. -
    2. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
      3. -
    3. Contact Microsoft Technical Support. +
    4. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
      5. +
    5. Contact Microsoft Technical Support.

    @@ -1013,8 +1014,40 @@ Result code associated with threat status. Standard HRESULT values. Description of the error.
    Signature Version: <Definition version>
    Engine Version: <Antimalware Engine version>
    - +

    NOTE: +

    Whenever Windows Defender, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services which the malware might have changed:

    +The above context applies to the following client and server versions: + + + + + + + + + + + + + +
    Operating systemOperating system version
    +

    Client Operating System

    +    		 +

    Windows Vista (Service Pack 1, or Service Pack 2), Windows 7 and later

    +
    +

    Server Operating System

    +    		 +

    Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2016

    +

    + @@ -1258,8 +1291,8 @@ Description of the error.

     

    If this event persists:

    1. Run the scan again.
      2. -
    2. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
      3. -
    3. Contact Microsoft Technical Support. +
    4. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
      5. +
    5. Contact Microsoft Technical Support.

    @@ -1472,13 +1505,13 @@ Description of the error.
  • Update the definitions. Either:
    1. Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

      Or,

      2. -
    2. Download the latest definitions from the Microsoft Malware Protection Center. -

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      +
    3. Download the latest definitions from the Microsoft Malware Protection Center. +

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

  • Review the entries in the %Windir%\WindowsUpdate.log file for more information about this error.
    • -
  • Contact Microsoft Technical Support. +
  • Contact Microsoft Technical Support.

    • @@ -1575,12 +1608,12 @@ Description of the error.
  • Update the definitions. Either:
    1. Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

      Or,

      2. -
    2. Download the latest definitions from the Microsoft Malware Protection Center. -

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      +
    3. Download the latest definitions from the Microsoft Malware Protection Center. +

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

    • -
  • Contact Microsoft Technical Support. +
  • Contact Microsoft Technical Support.

    • @@ -1631,10 +1664,10 @@ Description of the error.

    To troubleshoot this event:

    1. Restart the computer and try again.
      2. -
    2. Download the latest definitions from the Microsoft Malware Protection Center. -

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      +
    3. Download the latest definitions from the Microsoft Malware Protection Center. +

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      4. -
    4. Contact Microsoft Technical Support. +
    5. Contact Microsoft Technical Support.

    @@ -2290,7 +2323,7 @@ Description of the error.

    User action:

    -

    The real-time protection feature has restarted. If this event happens again, contact Microsoft Technical Support.

    +

    The real-time protection feature has restarted. If this event happens again, contact Microsoft Technical Support.

    @@ -2466,7 +2499,7 @@ or Hang -
  • If it fails in the same way, look up the error code by accessing the Microsoft Support Site and entering the error number in the Search box, and contact Microsoft Technical Support.
    • +
  • If it fails in the same way, look up the error code by accessing the Microsoft Support Site and entering the error number in the Search box, and contact Microsoft Technical Support.

    • @@ -2480,8 +2513,8 @@ or Hang

    To troubleshoot this event:

    1. Run the scan again.
      2. -
    2. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
      3. -
    3. Contact Microsoft Technical Support. +
    4. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
      5. +
    5. Contact Microsoft Technical Support.

    @@ -2663,6 +2696,7 @@ Description of the error. + ## Windows Defender client error codes If Windows Defender experiences any issues it will usually give you an error code to help you troubleshoot the issue. Most often an error means there was a problem installing an update. This section provides the following information about Windows Defender client errors. @@ -2720,8 +2754,8 @@ Use the information in these tables to help troubleshoot Windows Defender error
  • Update the definitions. Either:
    1. Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

      Or,

      2. -
    2. Download the latest definitions from the Microsoft Malware Protection Center. -

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      +
    3. Download the latest definitions from the Microsoft Malware Protection Center. +

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

    • @@ -2963,8 +2997,8 @@ article.

  • Update the definitions. Either:
    1. Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

      Or,

      2. -
    2. Download the latest definitions from the Microsoft Malware Protection Center. -

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      +
    3. Download the latest definitions from the Microsoft Malware Protection Center. +

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

    • diff --git a/windows/keep-secure/trusted-platform-module-overview.md b/windows/keep-secure/trusted-platform-module-overview.md index e7b6e784ff..8b0098f582 100644 --- a/windows/keep-secure/trusted-platform-module-overview.md +++ b/windows/keep-secure/trusted-platform-module-overview.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security +localizationpriority: high author: brianlic-msft --- diff --git a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md index ff626bb1de..5973f94f6f 100644 --- a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md +++ b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md @@ -22,33 +22,38 @@ The TPM Services Group Policy settings are located at: **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** -| Setting | Windows 10 | Windows Server 2012 R2, Windows 8.1 and Windows RT | Windows Server 2012, Windows 8 and Windows RT | Windows Server 2008 R2 and Windows 7 | Windows Server 2008 and Windows Vista | -| - | - | - | - | - | - | -| [Turn on TPM backup to Active Directory Domain Services](#bkmk-tpmgp-addsbu) | X| X| X| X| X| -| [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc)| X| X| X| X| X| -| [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) | X| X| X| X| X| -| [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) | X| X| X| X| X| -| [Configure the level of TPM owner authorization information available to the operating system](#bkmk-tpmgp-oauthos)| X| X| X||| -| [Standard User Lockout Duration](#bkmk-tpmgp-suld)| X| X| X||| -| [Standard User Individual Lockout Threshold](#bkmk-tpmgp-suilt)| X| X| X||| -| [Standard User Total Lockout Threshold](#bkmk-tpmgpsutlt)| X| X| X|||| -  +| Setting | Windows 10, version 1607 | Windows 10, version 1511 and Windows 10, version 1507 | Windows Server 2012 R2, Windows 8.1 and Windows RT | Windows Server 2012, Windows 8 and Windows RT | Windows Server 2008 R2 and Windows 7 | Windows Server 2008 and Windows Vista | +| - | - | - | - | - | - | - | +| [Turn on TPM backup to Active Directory Domain Services](#bkmk-tpmgp-addsbu) | | X| X| X| X| X| +| [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc)| X| X| X| X| X| X| +| [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) | X| X| X| X| X| X| +| [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) | X| X| X| X| X| X| +| [Configure the level of TPM owner authorization information available to the operating system](#bkmk-tpmgp-oauthos)| | X| X| X||| +| [Standard User Lockout Duration](#bkmk-tpmgp-suld)| X| X| X| X||| +| [Standard User Individual Lockout Threshold](#bkmk-tpmgp-suilt)| X| X| X| X||| +| [Standard User Total Lockout Threshold](#bkmk-tpmgpsutlt)| X| X| X| X|||| + ### Turn on TPM backup to Active Directory Domain Services This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of TPM owner information. ->**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -  +>[!NOTE] +>This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + + TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can be run only by the TPM owner. This hash authorizes the TPM to run these commands. ->**Important:**  To back up TPM owner information from a computer running Windows 10, Windows 8.1, or Windows 8, you might need to first set up appropriate schema extensions and access control settings on the domain so that the AD DS backup can succeed. Windows Server 2012 R2 and Windows Server 2012 include the required schema extensions by default. For more information, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). -  -The TPM cannot be used to provide enhanced security features for BitLocker Drive Encryption and other applications without first setting an owner. To take ownership of the TPM with an owner password, on a local computer at the command prompt, type **tpm.msc** to open the TPM Management Console and select the action to **Initialize TPM**. If the TPM owner information is lost or is not available, limited TPM management is possible by running **tpm.msc**. +>[!IMPORTANT] +>To back up TPM owner information from a computer running Windows 10, version 1507, Windows 10, version 1511, Windows 8.1, or Windows 8, you might need to first set up appropriate schema extensions and access control settings on the domain so that the AD DS backup can succeed. Windows Server 2012 R2 and Windows Server 2012 include the required schema extensions by default. For more information, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). This functionality is discontinued starting with Windows 10, version 1607. If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. When this policy setting is enabled, a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds. If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS. +>[!NOTE] +> The **Turn on TPM backup to Active Directory Domain Services** is not available in the Windows 10, version 1607 and Windows Server 2016 and later versions of the ADMX files. + + ### Configure the list of blocked TPM commands This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands that are blocked by Windows. @@ -99,10 +104,10 @@ This policy setting configures how much of the TPM owner authorization informati There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**. - **Full**   This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. -- **Delegated**   This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. When you use this setting, we recommend using external or remote storage for the full TPM owner authorization value—for example, backing up the value in Active Directory Domain Services (AD DS). +- **Delegated**   This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. This is the default setting in Windows. - **None**   This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization cannot be stored locally. Using this setting might cause issues with some TPM-based applications. ->**Note:**  If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value is automatically backed up to AD DS when it is changed. +>**Note:**  If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid.   **Registry information** @@ -132,8 +137,6 @@ authorization to the TPM.   The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption. -The number of authorization failures that a TPM allows and how long it stays locked vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time, with fewer authorization failures, depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require that the system is on so enough clock cycles elapse before the TPM exits the lockout mode. - This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. For each standard user, two thresholds apply. Exceeding either threshold prevents the user from sending a command that requires authorization to the TPM. Use the following policy settings to set the lockout duration: @@ -176,8 +179,6 @@ For each standard user two thresholds apply. Exceeding either threshold will pre The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption.. -The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. - An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. If you do not configure this policy setting, a default value of 9 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. diff --git a/windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md b/windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md index 758bffcd66..618894db96 100644 --- a/windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md +++ b/windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To enable Windows Firewall and configure its default behavior, use the Windows Firewall with Advanced Security node in the Group Policy Management console. diff --git a/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md b/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md index e81dff792a..0ab40df034 100644 --- a/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md +++ b/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: iaanw --- @@ -23,7 +24,8 @@ For a list of the cmdlets and their functions and available parameters, see the PowerShell cmdlets are most useful in Windows Server environments that don't rely on a graphical user interface (GUI) to configure software. -> **Note:**  PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [System Center Configuration Manager](https://technet.microsoft.com/en-us/library/gg682129.aspx), [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), or [Windows Defender Group Policy ADMX templates](https://support.microsoft.com/en-us/kb/927367). +> [!NOTE] +> PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [System Center Configuration Manager](https://technet.microsoft.com/en-us/library/gg682129.aspx), [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), or [Windows Defender Group Policy ADMX templates](https://support.microsoft.com/en-us/kb/927367). PowerShell is typically installed under the folder _%SystemRoot%\system32\WindowsPowerShell_. @@ -32,7 +34,8 @@ PowerShell is typically installed under the folder _%SystemRoot%\system32\Window 1. Click **Start**, type **powershell**, and press **Enter**. 2. Click **Windows PowerShell** to open the interface. - > **Note:**  You may need to open an administrator-level version of PowerShell. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. + > [!NOTE] + > You may need to open an administrator-level version of PowerShell. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. 3. Enter the command and parameters. To open online help for any of the cmdlets type the following: @@ -41,3 +44,7 @@ To open online help for any of the cmdlets type the following: Get-Help -Online ``` Omit the `-online` parameter to get locally cached help. + +## Related topics + +- [Windows Defender in Windows 10](windows-defender-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index 717abdaec8..2f238a4d6d 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -8,17 +8,19 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Use the Windows Defender Advanced Threat Protection portal **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - A typical security breach investigation requires a member of a security operations team to: 1. View an alert on the **Dashboard** or **Alerts queue** @@ -41,6 +43,6 @@ Topic | Description [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)| Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) | Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. -[Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between your machines and external internet protocol (IP) addresses. +[Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between your machines and external Internet protocol (IP) addresses. [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) | Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. diff --git a/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md b/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md index e2e57dd1bd..3aabc0a07e 100644 --- a/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 ## Group Policy settings There are 10 Group Policy settings that can be configured for User Account Control (UAC). The table lists the default for each of the policy settings, and the following sections explain the different UAC policy settings and provide recommendations. These policy settings are located in **Security Settings\\Local Policies\\Security Options** in the Local Security Policy snap-in. For more information about each of the Group Policy settings, see the Group Policy description. For information about the registry key settings, see [Registry key settings](#registry-key-settings). diff --git a/windows/keep-secure/user-account-control-overview.md b/windows/keep-secure/user-account-control-overview.md index 32edfe0160..66f1abdc16 100644 --- a/windows/keep-secure/user-account-control-overview.md +++ b/windows/keep-secure/user-account-control-overview.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: operate ms.sitesec: library ms.pagetype: security +localizationpriority: high author: brianlic-msft --- @@ -13,7 +14,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. diff --git a/windows/keep-secure/verify-that-network-traffic-is-authenticated.md b/windows/keep-secure/verify-that-network-traffic-is-authenticated.md index 44e4ba7803..88ab773159 100644 --- a/windows/keep-secure/verify-that-network-traffic-is-authenticated.md +++ b/windows/keep-secure/verify-that-network-traffic-is-authenticated.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have configured your domain isolation rule to request, rather than require, authentication, you must confirm that the network traffic sent by the devices on the network is being protected by IPsec authentication as expected. If you switch your rules to require authentication before all of the devices have received and applied the correct GPOs, or if there are any errors in your rules, then communications on the network can fail. By first setting the rules to request authentication, any network connections that fail authentication can continue in clear text while you diagnose and troubleshoot. @@ -25,7 +25,7 @@ In these procedures, you confirm that the rules you deployed are working correct - **Encryption zone.** Similar to the main isolation zone, after you confirm that the network traffic to zone members is properly authenticated and encrypted, you must convert your zone rules from request mode to require mode. ->**Note:**  In addition to the steps shown in this procedure, you can also use network traffic capture tools such as Microsoft Network Monitor, which can be downloaded from . Network Monitor and similar tools allow you to capture, parse, and display the network packets received by the network adapter on your device. Current versions of these tools include full support for IPsec. They can identify encrypted network packets, but they cannot decrypt them. +>**Note:**  In addition to the steps shown in this procedure, you can also use network traffic capture tools such as Microsoft Network Monitor, which can be downloaded from . Network Monitor and similar tools allow you to capture, parse, and display the network packets received by the network adapter on your device. Current versions of these tools include full support for IPsec. They can identify encrypted network packets, but they cannot decrypt them.   diff --git a/windows/keep-secure/vpn-profile-options.md b/windows/keep-secure/vpn-profile-options.md index 5ad97a8461..90c8e2aa2d 100644 --- a/windows/keep-secure/vpn-profile-options.md +++ b/windows/keep-secure/vpn-profile-options.md @@ -7,6 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking author: jdeckerMS +localizationpriority: high --- # VPN profile options @@ -51,9 +52,16 @@ A VPN profile configured with LockDown secures the device to only allow network - Only one VPN LockDown profile is allowed on a device. > **Note:**  For inbox VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) tunnel type.   +## Learn about VPN and the Conditional Access Framework in Azure Active Directory + +- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 1)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/12/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn/) +- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 2)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/14/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-2/) +- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 3)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/15/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-3/) +- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 4)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/16/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-4/) + ## Learn more -- [Learn how to configure VPN connections in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/vpn-connections-in-microsoft-intune) -- [VPNv2 configuration service provider (CSP) reference](http://go.microsoft.com/fwlink/p/?LinkId=617588) -- [How to Create VPN Profiles in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=618028) +- [Learn how to configure VPN connections in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/vpn-connections-in-microsoft-intune) +- [VPNv2 configuration service provider (CSP) reference](https://go.microsoft.com/fwlink/p/?LinkId=617588) +- [How to Create VPN Profiles in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=618028) diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index d254ddcb1a..4fb387f147 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS +localizationpriority: high --- # Why a PIN is better than a password @@ -29,7 +30,7 @@ Even you can't use that PIN anywhere except on that specific device. If you want A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server. When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server. -> **Note:**  For details on how Hello uses asymetric key pairs for authentication, see [Microsoft Passport guide](http://go.microsoft.com/fwlink/p/?LinkId=691928). +> **Note:**  For details on how Hello uses asymetric key pairs for authentication, see [Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928).   ## PIN is backed by hardware @@ -69,7 +70,7 @@ If you only had a biometric sign-in configured and, for any reason, were unable ## Related topics -[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md)   \ No newline at end of file diff --git a/windows/keep-secure/windows-10-mobile-security-guide.md b/windows/keep-secure/windows-10-mobile-security-guide.md index 16389caf95..85ff61bf41 100644 --- a/windows/keep-secure/windows-10-mobile-security-guide.md +++ b/windows/keep-secure/windows-10-mobile-security-guide.md @@ -1,254 +1,167 @@ --- title: Windows 10 Mobile security guide (Windows 10) -description: This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. +description: This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. ms.assetid: D51EF508-699E-4A68-A7CD-91D821A97205 keywords: data protection, encryption, malware resistance, smartphone, device, Windows Store ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, mobile +localizationpriority: high author: AMeeus --- - # Windows 10 Mobile security guide -**Applies to** -- Windows 10 Mobile +*Applies to Windows 10 Mobile, version 1511 and Windows Mobile, version 1607* -This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. +>This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. -## Overview +Smartphones now serve as a primary productivity tool for business workers and, just like desktops or laptops, need to be secured against malware and data theft. Protecting these devices can be challenging due to the wide range of device operating systems and configurations and the fact that many employees use their own personal devices. IT needs to secure corporate assets on every device, but also ensure the privacy of the user’s personal apps and data. +Windows 10 Mobile addresses these security concerns directly, whether workers are using personal or corporate-owned devices. It uses the same security technologies as the Windows 10 operating system to help protect against known and emerging security threats across the spectrum of attack vectors. These technologies include: +- **Windows Hello for Business** Enhanced identity and access control features ensure that only authorized users can access corporate data and resources. Windows Hello simplifies multifactor authentication (MFA) deployment and use, offering PIN, companion device, and biometric authentication methods. +- **Windows Information Protection** Automatic data separation keeps corporate information from being shared with personal data and apps. +- **Malware resistance** Multi-layered protections built into the device hardware, startup processes, and app platform help reduce the threat of malware that can compromise employee devices. -Windows 10 Mobile is specifically designed for smartphones and small tablets. It uses the same security technologies as the Windows 10 operating system to help protect against known and emerging security threats across the spectrum of attack vectors. Several broad categories of security work went into Windows 10 Mobile: +This guide helps IT administrators better understand the security features in Windows 10 Mobile, which can be used to improve protection against unauthorized access, data leakage, and malware. -- **Identity and access control.** Microsoft has greatly enhanced identity and access control features to simplify and improve the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). (Windows Hello requires either a specialized illuminated infrared \[IR\] camera for facial recognition and iris detection or a finger print reader that supports the Windows Biometric Framework.) -- **Data protection.** Confidential data is better protected from compromise than ever before. Windows 10 Mobile uses several data-protection technologies and delivers them in a user-friendly and IT-manageable way. -- **Malware resistance.**Windows 10 Mobile helps protect critical system resources and apps to reduce the threat of malware, including support for enterprise-grade secure hardware and Secure Boot. -- **App platform security.** The Windows 10 Mobile enterprise-grade secure app platform provides multiple layers of security. For example, Windows Store checks all apps for malware to help prevent malware from reaching devices. +**In this article:** +- Windows Hello for Business +- Windows Information Protection +- Malware resistance -In addition, AppContainer application isolation helps prevent any malicious app from compromising other apps. +## Windows Hello -This guide explains each of these technologies and how they help protect your Windows 10 Mobile devices. +Windows 10 Mobile includes Windows Hello, a simple, yet powerful, multifactor authentication solution that confirms a user’s identity before allowing access to corporate confidential information and resources. Multifactor authentication is a more secure alternative to password-based device security. Users dislike having to enter long, complex passwords – particularly on a mobile device touch screen – that corporate policy requires they change frequently. This leads to poor security practices like password reuse, written down passwords, or weak password creation. -## Identity and access control +Windows Hello offers a simple, cost-effective way to deploy multifactor authentication across your organization. Unlike smart cards, it does not require public key infrastructure or the implementation of additional hardware. Workers use a PIN, a companion device (like Microsoft Band), or biometrics to validate their identity for accessing corporate resources on their Azure Active Directory (Azure AD) registered Windows 10 Mobile device. -A fundamental component of security is the notion that a user has a unique identity and that that identity is either allowed or denied access to resources. This notion is traditionally known as access control, which has three parts: -- **Identification.** The user (subject) asserts a unique identity to the computer system for the purpose of accessing a resource (object), such as a file or an app. -- **Authentication.** Authentication is the process of proving the asserted identity and verifying that the subject is indeed the subject. -- **Authorization.** The system compares the authenticated subject’s access rights against the object’s permissions and either allows or denies the requested access. +Because Windows Hello is supported across all Windows 10 devices, organizations can uniformly implement multifactor authentication across their environment. Deploying Windows Hello on Windows 10 Mobile devices does require Azure AD (sold separately), but you can use Azure AD Connect to synchronize with your on-premises Active Directory services. -The way an operating system implements these components makes a difference in preventing attackers from accessing corporate data. Only users who prove their identities and are authorized to access that data can access it. In security, however, there are varying degrees of identity proof and many different requirements for authorization limits. The access control flexibility most corporate environments need presents a challenge for any operating system. Table 1 lists typical Windows access control challenges and the solutions that Windows 10 Mobile offers. +Windows Hello supports iris scan, fingerprint, and facial recognition-based authentication for devices that have biometric sensors. -Table 1. Windows 10 Mobile solutions for typical access control challenges - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Access control challengeWindows 10 Mobile solutions

    Organizations frequently use passwords to authenticate users and provide access to business applications or the corporate network, because more trustworthy authentication alternatives are too complex and costly to deploy.

    Windows Hello provides biometrics to identify the user and unlock the device that closely integrates with Microsoft Passport to identify, authenticate, and authorize users to access the corporate network or applications from their Windows 10 Mobile device with supporting biometric hardware.

    When an organization uses smart cards, it must purchase a smart card reader, smart cards, and smart card management software. These solutions are complex and costly to implement; they also tend to delay mobile productivity.

    Windows Hello with Microsoft Passport enables a simple and cost-effective MFA deployment across the organization, enhancing the business’ security stance.

    Mobile device users must enter their password on a touch keyboard. Entering complex passwords in this way is error prone and less efficient than a keyboard.

    Windows Hello helps enable iris scan, fingerprint, and facial recognition-based authentication for devices that have biometric sensors. These biometric identification options are more convenient and more efficient than password-based logon.

    Users dislike the need to enter long, complex passwords to log on to corporate services, especially passwords that must change frequently. This frustration often leads to password reuse, passwords written on notepads, and weak password composition.

    Microsoft Passport allows users to sign in once and gain access to corporate resources without having to re-enter complex passwords. Authentication credentials are bound to the device through a built-in Trusted Platform Module (TPM) and cannot be removed.

    -  -The following sections describe these challenges and solutions in more detail. +>**Note:** When Windows 10 first shipped, it included **Microsoft Passport** and **Windows Hello**, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the **Windows Hello** name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. -### Microsoft Passport +### Secured credentials -Microsoft Passport provides strong MFA, fully integrated into Windows devices, to replace passwords. To authenticate, the user must have a Microsoft Azure Active Directory (Azure AD)–registered device and either a PIN or Windows Hello biometric gesture to unlock the device. Microsoft Passport is conceptually similar to a smart card but more flexible, as it doesn’t require a public key infrastructure or the implementation of additional hardware and supports biometric identification. +Windows Hello eliminates the use of passwords for login, reducing the risk that an attacker will steal and reuse a user’s credentials. Windows 10 Mobile devices are required to have a Trusted Platform Module (TPM), a microchip that enables advanced security features. The TPM creates encryption keys that are “wrapped” with the TPM’s own storage root key, which is itself stored within the TPM to prevent credentials from being compromised. Encryption keys created by the TPM can only be decrypted by the same TPM, which protects the key material from attackers who want to capture and reuse it. -Microsoft Passport offers three significant advantages over the previous state of Windows authentication: it’s more flexible, it’s based on industry standards, and it more effectively mitigates risks. -### It's effective +To compromise Windows Hello credentials, an attacker would need access to the physical device, and then find a way to spoof the user’s biometric identity or guess his or her PIN. All of this would have to be accomplished before TPM brute-force resistance capabilities lock the mobile device, the theft-protection mechanism kicks in, or the user or corporate administrator remotely wipes the device. With TPM-based protection, an attacker’s window of opportunity for compromising a user’s credentials is greatly reduced. -Microsoft Passport eliminates the use of passwords for logon and so reduces the risk that an attacker will steal and reuse a user’s credentials. User key material, which includes the user’s private key, is available only on the device that generated it. The key material is protected with the TPM, which protects the key material from attackers who want to capture and reuse it. It is a Windows Hardware Certification Program requirement that every Windows 10 Mobile device include a TPM. +### Support for biometrics -To compromise a Microsoft Passport credential that the TPM protects, an attacker must have access to the physical device, and then find a way to spoof the user’s biometrics identity or guess his or her PIN—and all of this must be done before TPM brute-force resistance capabilities lock the mobile device, the theft-protection mechanism kicks in, or the user or corporate administrator remotely wipes the device. This technology greatly reduces an attacker’s window of opportunity for compromising a user’s credentials. +Biometrics help prevent credential theft and make it easier for users to login to their devices. Users always have their biometric identity with them – there is nothing to forget, lose, or leave behind. Attackers would need to have both access to the user’s device and be able to impersonate the user’s biometric identity to gain access to corporate resources, which is far more difficult than stealing a password. -### It's flexible +Windows Hello supports three biometric sensor scenarios: +- **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology. +- **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. +- **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. -Microsoft Passport offers unprecedented flexibility along with enterprise-grade security. +>Users must create an unlock PIN while they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. -Most importantly, Microsoft Passport works with biometrics or PINs and gives you options beyond long, complex passwords. Instead of users memorizing and retyping often-changed passwords, Microsoft Passport enables PIN- and biometrics-based identification through Windows Hello to identify users more securely. +All three of these biometric factors – face, finger, and iris – are unique to an individual. To capture enough data to uniquely identify an individual, a biometric scanner might initially capture images in multiple conditions or with additional details. For example, an iris scanner will capture images of both eyes or both eyes with and without eyeglasses or contact lenses. -The Windows 10 Mobile device that the user logs on to is an authentication factor, as well. The credentials used and the private key on the device are device specific and bound to the device’s TPM. +Spoofing biometric data is often a big concern in enterprise environments. Microsoft employs several anti-spoofing techniques in Windows 10 Mobile that verify the trustworthiness of the biometric device, as well as guard against intentional collision with stored biometric measurements. These techniques help improve the false-acceptance rate (the rate at which spoofed biometric data is accepted as authentic) while maintaining the overall usability and manageability of MFA. -In the future, Microsoft Passport will also enable people to use Windows 10 Mobile devices as a remote credential when signing in to PCs running Windows 10. Users will use their PINs or biometrics to unlock their phones, and their phones will unlock their PCs. Phone sign-in with Microsoft Passport will make implementing MFA for scenarios where the user’s credentials must be physically separate from the PC the user is signing in to less costly and complex than other solutions. Phone sign-in will also make it easier for users and IT pros because users can use their phones to sign in to any corporate device instead of enrolling a user credential on each. +The biometric image collected at enrollment is converted into an algorithmic form that cannot be converted back into the original image. Only the algorithmic form is kept; the actual biometric image is removed from the device after conversion. Windows 10 Mobile devices both encrypt the algorithmic form of the biometric data and bind the encrypted data to the device, both of which help prevent someone from removing the data from the phone. As a result, the biometric information that Windows Hello uses is a local gesture and doesn’t roam among the user’s devices. -With Microsoft Passport, you gain flexibility in the data center, too. To deploy it for Windows 10 Mobile devices, you must set up Azure AD, but you don’t have to replace or remove your existing Active Directory environment. Using Azure AD Connect, organizations can synchronize these two directory services. Microsoft Passport builds on and adds to your existing infrastructure and allows you to federate with Azure AD. +### Companion devices -Microsoft Passport is also supported on the desktop, giving organizations a uniform way to implement strong authentication on all devices. This flexibility makes it simpler for Microsoft Passport to supplement existing smart card or token deployments for on-premises Windows PC scenarios, adding MFA to mobile devices and users who don’t currently have it for extra protection of sensitive resources or systems that these mobile devices access. +A Windows Hello companion device enables a physical device, like a wearable, to serve as a factor for validating the user’s identity before granting them access to their credentials. For instance, when the user has physical possession of a companion device they can easily, possibly even automatically, unlock their PC and authenticate with apps and websites. This type of device can be useful for smartphones or tablets that don’t have integrated biometric sensors or for industries where users need a faster, more convenient sign-in experience, such as retail. -### It's standardized +In some cases, the companion device for Windows Hello enables a physical device, like a phone, wearable, or other types of device to store all of the user’s credentials. Storage of the credentials on a mobile device makes it possible to use them on any supporting device, like a kiosk or family PC, and eliminates the need to enroll Windows Hello on each device. Companion devices also help enable organizations to meet regulatory requirements, such as Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS 140-2). -Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end: the future lies with open, interoperable systems that allow secure authentication across a variety of devices, line-of-business (LOB) apps, and external applications and websites. To this end, a group of industry players formed the Fast Identity Online (FIDO) Alliance. The FIDO Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices as well as the problems users face in creating and remembering multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to authenticate users of online services securely. This new standard can allow any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms using a standardized set of interfaces and protocols. -In 2014, Microsoft joined the board of the FIDO Alliance. FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards and of course new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. +### Standards-based approach -### Windows Hello +The Fast Identity Online (FIDO) Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices and the problems users face in creating and remembering multiple user names and passwords. FIDO standards help reduce reliance on passwords to authenticate users of online services securely, allowing any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms. -Windows Hello is the new biometric framework for Windows 10. Because biometric identification is built directly into the operating system, it allows you to use your iris, face, or fingerprint to unlock your mobile device. Windows Hello unlocks Microsoft Passport credentials, which enable authentication to resources or relying parties such as software-as-a-service applications like Microsoft Office 365. -Windows Hello supports three biometric sensor options that are suitable for enterprise scenarios: +In 2014, Microsoft joined the board of the FIDO Alliance. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards. Microsoft has contributed Windows Hello technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for both enterprises and consumers. -- **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology. -- **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. -- **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. -> **Note:**  Users must create an unlock PIN before they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. -  -All three of these biometric factors—the face, the finger, and the iris—are unique to an individual. To capture enough data to uniquely identify an individual, a biometric scanner might initially capture images in multiple conditions or with additional details. For example, an iris scanner will capture images of both eyes; or both with and without eyeglasses or contact lenses. +## Windows Information Protection -Spoofing biometric data is often a big concern in enterprise environments. Microsoft employs several anti-spoofing techniques in Windows 10 Mobile that verify the trustworthiness of the biometric device as well as guard against intentional collision with stored biometric measurements. These techniques help improve the false-acceptance rate (the rate at which spoofed biometric data is accepted as authentic) while maintaining the overall usability and manageability of MFA. +Enterprises have seen huge growth in the convergence of personal and corporate data storage. Personal data is frequently stored on corporate devices and vice versa. This fluidity increases the potential for sensitive corporate data to be accidentally compromised. -The biometric image collected at enrollment is converted into an algorithmic form that cannot be converted back into the original image. Only the algorithmic form is kept; the actual biometric image is removed from the device after conversion. Windows 10 Mobile devices both encrypt the algorithmic form of the biometric data and bind the encrypted data to the device, both of which help prevent someone from removing the data from the phone. As a result, the biometric information that Windows Hello uses is a local gesture and doesn’t roam among the user’s devices. +Inadvertent disclosure is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. It’s easy to imagine that an employee using work email on their personal phone could unintentionally save an attachment containing sensitive company information to personal cloud storage, which could be shared with unauthorized people. This accidental sharing of corporate data is just one example of the challenges common to using mobile devices in the workplace. To prevent this type of data leakage, most solutions require users to login with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity. -Windows Hello offers several major benefits. First, it helps to address the problems of credential theft and sharing because an attacker must obtain the mobile phone and impersonate the user’s biometric identity, which is more difficult than stealing a device unlock password. Second, the use of biometrics gives users an authenticator that’s always with them—there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, enterprise-grade secure method for logging on to their Windows 10 Mobile device. Finally, there’s nothing additional to deploy, because Microsoft built Windows Hello support directly into the operating system. All you need is a device that includes a supported biometric sensor. +Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data secure and personal data private. Because corporate data is always protected, users cannot inadvertently copy it or share it with unauthorized users or apps. Key features include: +- Automatically tag personal and corporate data. +- Protect data while it’s at rest on local or removable storage. +- Control which apps can access corporate data. +- Control which apps can access a virtual private network (VPN) connection. +- Prevent users from copying corporate data to public locations. +- Help ensure business data is inaccessible when the device is in a locked state. -The device that senses the biometric factors must report the data to Windows Hello quickly and accurately. For this reason, Microsoft determines which factors and devices are trustworthy and accurate prior to their inclusion in Windows Hello. For more information, see [Windows 10 specifications](http://go.microsoft.com/fwlink/p/?LinkId=722908). +### Enlightened apps -## Data protection +Third-party data loss protection solutions usually require developers to wrap their apps. However, Windows Information Protection builds this intelligence right into Windows 10 Mobile so most apps require nothing extra to prevent inappropriate corporate data sharing. -Windows 10 Mobile continues to provide solutions that help protect information against unauthorized access and disclosure. +Windows Information Protection classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data will be encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default. +When you do not want all data encrypted by default – because it would create a poor user experience – developers should consider enlightening apps by adding code and compiling them using the Windows Information Protection application programming interfaces. The most likely candidates for enlightenment are apps that: +- Don’t use common controls for saving files. +- Don’t use common controls for text boxes. +- Work on personal and enterprise data simultaneously (e.g., contact apps that display personal and enterprise data in a single view or a browser that displays personal and enterprise web pages on tabs within a single instance). -### Device encryption -Windows 10 Mobile uses device encryption, based on BitLocker technology, to encrypt all internal storage, including operating system and data storage partitions. The user can activate device encryption, or the IT department can activate and enforce encryption for company-managed devices through MDM tools. When device encryption is turned on, all data stored on the phone is encrypted automatically. A Windows 10 Mobile device with encryption turned on helps protect the confidentiality of data stored if the device is lost or stolen. The combination of Windows Hello lock and data encryption makes it extremely difficult for an unauthorized party to retrieve sensitive information from the device. +In many cases, most apps don’t require enlightenment for them to use Windows Information Protection. Simply adding them to the allow list is the only step you need to take. Line-of-Business (LOB) apps are a good example of where this works well because they only handle corporate data. -You can customize how device encryption works to meet your unique security requirements. Device encryption even enables you to define your own cipher suite. For example, you can specify the algorithm and key size that Windows 10 Mobile uses for data encryption, which Transport Layer Security (TLS) cipher suites are permitted, and whether Federal Information Processing Standard (FIPS) policy is enabled. Table 2 lists the policies you can change to customize device encryption on Windows 10 Mobile devices. +**When is app enlightenment required?** +- **Required** + - App needs to work with both personal and enterprise data. +- **Recommended** + - App handles only corporate data, but needs to modify a file (such as a configuration file) in order to launch, uninstall itself, update etc. Without enlightenment you wouldn’t be able to properly revoke these apps. + - App needs to access enterprise data, while protection under lock is activated. +- **Not required** + - App handles only corporate data + - App handles only personal data -Table 2. Windows 10 cryptography policies - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Area namePolicy nameDescription

    Cryptography

    Allow FIPS Algorithm Policy

    Enable or disable the FIPS policy. A restart is needed to enforce this policy. The default value is disabled.

    BitLocker

    Encryption Method

    Configures the BitLocker Drive Encryption Method and cipher strength. The default value is AES-CBC 128-bit. If the device cannot use the value specified, it will use another one.

    Cryptography

    TLS Cipher Suite

    This policy contains a list of the cryptographic cipher algorithms allowed for Secure Sockets Layer connections.

    -  -For a complete list of policies available, see [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkId=733963). +### Data leakage control -### Enterprise data protection +To configure Windows Information Protection in a Mobile Device Management (MDM) solution that supports it, simply add authorized apps to the allow list. When a device running Windows 10 Mobile enrolls in the MDM solution, unauthorized apps will not have access to enterprise data. -Enterprises have seen huge growth in the convergence of personal and corporate data storage. Personal data is frequently stored on corporate devices and vice versa. This situation increases the potential for compromise of sensitive corporate data. +Windows Information Protection works seamlessly until users try to access enterprise data with or paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but Window Information Protection can block users from copying enterprise data from an authorized app to an unauthorized app. Likewise, it will block users from using an unauthorized app to open a file that contains enterprise data. -One growing risk is authorized users’ accidental disclosure of sensitive data—a risk that is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. One example is common among organizations: an employee connects his or her personal phone to the company’s Microsoft Exchange Server instance for email. He or she uses the phone to work on email that includes attachments with sensitive data. When sending the email, the user accidentally copies a supplier. Content protection is only as strong as the weakest link, and in this example, the unintended sharing of sensitive data with unauthorized people might not have been prevented with standard data encryption. +The extent to which users will be prevented from copying and pasting data from authorized apps to unauthorized apps or locations on the web depends on which protection level is set: +- **Block.** Windows Information Protection blocks users from completing the operation. +- **Override.** Windows Information Protection notifies users that the operation is inappropriate but allows them to override the policy, although it logs the operation in the audit log. +- **Audit.** Windows Information Protection does not block or notify users but logs the operation in the audit log. +- **Off.** Windows Information Protection does not block or notify users and does not log operations in the audit log. -In Windows 10 Mobile, enterprise data protection (EDP) helps separate personal and enterprise data and prevent data leakage. Key features include its ability to: +### Data separation -- Automatically tag personal and corporate data. -- Protect data while it’s at rest on local or removable storage. -- Control which apps can access corporate data. -- Control which apps can access a virtual private network (VPN) connection. -- Prevent users from copying corporate data to public locations. +Most third-party solutions require an app wrapper that directs enterprise data into a password-protected container and keeps personal data outside the container. Depending on the implementation, this may require two different versions of the same apps to be running on the device: one for personal data and another for enterprise data. -> **Note:**  EDP is currently being tested in select customer evaluation programs. For more information about EDP, see [Enterprise data protection overview](../whats-new/edp-whats-new-overview.md). -  -### Enlightenment +Windows Information Protection provides data separation without requiring a container or special version of an app to access business or personal data. There is no separate login required to see your corporate data or open your corporate applications. Windows Information Protection identifies enterprise data and encrypts it to only enterprise use. Data separation is automatic and seamless. -Third-party data loss protection solutions usually require developers to wrap their apps. In contrast, EDP puts the intelligence in Windows 10 Mobile so that it doesn’t require wrappers. As a result, most apps require nothing extra to work with EDP. +### Encryption -EDP can enforce policy without the need for an app to change. This means that an app that always handles business data (such as an LOB app) can be added to the allowed list and will always encrypt all data that it handles. However, if the app does not use common controls, cut and paste operations from this app to a non-enterprise app will silently fail. In addition, if the app needs to handle personal data, this data will also be encrypted. -Therefore, to improve the user experience, in some cases, developers should enlighten their apps by adding code to and compiling them to use the EDP application programming interfaces. Those cases include apps that: -- Don’t use common controls for saving files. -- Don’t use common controls for text boxes. -- Work on personal and enterprise data simultaneously (for example, contact apps that display personal and enterprise data in a single view; a browser that displays personal and enterprise web pages on tabs within a single instance). +Windows 10 Mobile uses device encryption, based on BitLocker technology, to encrypt all internal storage, including operating systems and data storage partitions. The user can activate device encryption, or the IT department can activate and enforce encryption for company-managed devices through MDM tools. When device encryption is turned on, all data stored on the phone is encrypted automatically. A Windows 10 Mobile device with encryption turned on helps protect the confidentiality of data stored – even if the device is lost or stolen. The combination of Windows Hello lock and data encryption makes it extremely difficult for an unauthorized party to retrieve sensitive information from the device. -Figure 1 summarizes when an app might require enlightenment to work with EDP. Microsoft Word is a good example. Not only can Word access personal and enterprise data simultaneously, but it can also transmit enterprise data (for example, email attachments containing enterprise data). +You can customize how device encryption works to meet your unique security requirements. Device encryption even enables you to define your own cipher suite. For example, you can specify the algorithm and key size that Windows 10 Mobile uses for data encryption, which Transport Layer Security (TLS) cipher suites are permitted, and whether Federal Information Processing Standard (FIPS) policy is enabled. The list below shows the policies you can change to customize device encryption on Windows 10 Mobile devices. +- Cryptography + - Allow FIPS Algorithm: This policy enables or disable the FIPS policy. A restart is needed to enforce this policy. The default value is disabled. + - TLS Cipher Suite: This policy contains a list of the cryptographic cipher algorithms allowed for Secure Sockets Layer connections. +- BitLocker + - Encryption Method: Configures the BitLocker Drive Encryption Method and cipher strength. The default value is AES-CBC 128-bit. If the device cannot use the value specified, it will use another one. -In any case, most apps don’t require enlightenment for them to use EDP protection. Simply adding them to the EDP allow list is all you must do. Because unenlightened apps cannot automatically tag data as personal or enterprise, if they are in an EDP policy, they treat all data as enterprise data. An LOB app is a good example. Adding an LOB app to an EDP policy protects all data that the app handles. Another example is a legacy app that cannot be updated, which you can add to an EDP policy and use without even being aware that EDP exists. +To help make the device even more secured against outside interference, Windows 10 Mobile also now includes protection-under-lock. That means that encryption keys are removed from memory whenever a device is locked. Apps are unable to access sensitive data while the device is in a locked state, so hackers and malware have no way to find and co-opt keys. Everything is locked up tight with the TPM until the user unlocks the device with Windows Hello. -![figure 1](images/mobile-security-guide-fig1.png) +### Government Certifications -Figure 1. When is enlightenment required? - -### Data leakage control - -To configure EDP in an MDM solution that supports it, add authorized apps to the EDP allow list. When a device running Windows 10 Mobile enrolls in the MDM solution, apps that this policy doesn’t authorize won’t have access to enterprise data. - -EDP works seamlessly until users try to access enterprise data with or try to paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but EDP blocks users from copying enterprise data from an authorized app to an unauthorized app. Likewise, EDP blocks users from using an unauthorized app to open a file that contains enterprise data. -In addition, users cannot copy and paste data from authorized apps to unauthorized apps or locations on the Web without triggering one of the EDP protection levels: -- **Block.** EDP blocks users from completing the operation. -- **Override.** EDP notifies users that the operation is inappropriate but allows them to override the policy, although it logs the operation in the audit log. -- **Audit.** EDP does not block or notify users but logs the operation in the audit log. -- **Off.** EDP does not block or notify users and does not log operations in the audit log. - -### Data separation - -As the name suggests, data separation separates personal from enterprise data. Most third-party solutions require an app wrapper, and from here, enterprise data goes in a container while personal data is outside the container. Often, people must use two different apps for the same purpose: one for personal data and another for enterprise data. - -EDP provides the same data separation but neither uses containers nor requires a special version of an app to access business data, and then a second instance of it to access personal data. There are no containers, partitions, or special folders to physically separate personal and business data. Instead, Windows 10 Mobile is the access control broker, identifying enterprise data because it’s encrypted to the enterprise. Therefore, EDP provides data separation by virtue of encrypting enterprise data. - -### Visual cues - -In Windows 10 Mobile, visual cues indicate the status of EDP to users (see Figure 2): - -- **Start screen.** On the Start screen, apps that an EDP policy manages display a visual cue. -- **Files.** In File Explorer, a visual cue indicates whether a file or folder contains enterprise data and is therefore encrypted. -For example, Erwin is an employee at Fabrikam. He opens Microsoft Edge from the Start screen and sees that the tile indicates that an EDP policy manages the browser. Erwin opens the Fabrikam sales website and downloads a spreadsheet. In File Explorer, Erwin sees that the file he downloaded has a visual cue which indicates that it’s encrypted and contains enterprise data. When Erwin tries to paste data from that spreadsheet into an app that no EDP policy manages (for example, his Twitter app), Erwin might see a message that allows him to override protection while logging the action, depending on the protection level configured in the EDP policy. - -![figure 2](images/mobile-security-guide-fig2.png) - -Figure 2. Visual cues in EDP +Windows 10 Mobile supports both [FIPS 140 standards](http://csrc.nist.gov/groups/STM/cavp/validation.html) for cryptography and [Common Criteria](https://www.niap-ccevs.org/Product/Compliant.cfm?pid=10694) The FIPS 140 certification validates the effectiveness of the cryptographic algorithms used in Windows 10 Mobile. Microsoft has also received Common Criteria certification for Windows 10 Mobile running on Lumia 950, 950 XL, 550, 635, as well as Surface Pro 4, giving customers assurance that securety functionality is implemented properly. ## Malware resistance -Just as software has automated so much of our lives, malware has automated attacks on our devices. Those attacks are relentless. Malware is constantly changing, and when it infects a device, it can be difficult to detect and remove. -The best way to fight malware is to prevent the infection from happening. Windows 10 Mobile provides strong malware resistance because it takes advantage of secured hardware and protects both the startup process and the core operating system architecture. - -Table 3 lists specific malware threats and the mitigation that Windows 10 Mobile provides. - -Table 3. Threats and Windows 10 Mobile mitigations +The best way to fight malware is prevention. Windows 10 Mobile provides strong malware resistance through secured hardware, startup process defenses, core operating system architecture, and application-level protections. +The table below outlines how Windows 10 Mobile mitigates specific malware threats. --++ - + @@ -266,11 +179,11 @@ Table 3. Threats and Windows 10 Mobile mitigations - + - + @@ -291,249 +204,164 @@ Table 3. Threats and Windows 10 Mobile mitigations
    ThreatWindows 10 Mobile mitigationWindows 10 Mobile mitigation

    An app infects other apps or the operating system with malware.

    All Windows 10 Mobile apps run inside an AppContainer that isolates them from all other processes and sensitive operating system components. Apps cannot access any resources outside their AppContainer.

    All Windows 10 Mobile apps run inside an AppContainer that isolates them from all other processes and sensitive operating system components. Apps cannot access any resources outside their AppContainer.

    An unauthorized app or malware attempts to start on the device.

    All Windows 10 Mobile apps must come from Windows Store or Windows Store for Business. Device Guard enforces administrative policies to select exactly which apps are allowed to run.

    All Windows 10 Mobile apps must come from Windows Store or Windows Store for Business. Device Guard enforces administrative policies to select exactly which apps are allowed to run.

    User-level malware exploits a vulnerability in the system or an application and owns the device.
    -  -> **Note:**  Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [http://www.uefi.org/specsandtesttools](http://go.microsoft.com/fwlink/p/?LinkId=722912). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed. -  -The following sections describe these improvements in more detail. -### Enterprise-grade secure hardware +>**Note:** The Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [www.uefi.org/specs]( http://www.uefi.org/specs). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed. -Taking full advantage of Windows 10 Mobile security features requires advancements in hardware-based security. These advances include UEFI with Secure Boot, TPM, and biometric sensors (hardware dependent). +### UEFI with Secure Boot -### UEFI with Secure Boot +When a Windows 10 Mobile device starts, it begins the process of loading the operating system by locating the bootloader in the device’s storage system. Without safeguards in place, the phone might simply hand control over to the bootloader without even determining whether it’s a trusted operating system or malware. -When a Windows 10 Mobile device starts, it begins the process of loading the operating system by locating the bootloader in the device’s storage system. Without safeguards in place, the phone might simply hand control over to the bootloader without even determining whether it’s a trusted operating system or malware. +UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also helps to ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the mobile phone. + +UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the mobile phone’s manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection against firmware-based malware that loads before Windows 10 Mobile and to try and hide its malicious behavior from the operating system. Firmware-based malware of this nature is typically called bootkits. -UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also help ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the mobile phone. -UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the mobile phone’s manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection against firmware-based malware that loads before Windows 10 Mobile and can successfully hide its malicious behavior from Windows 10 Mobile. Firmware-based malware of this nature is typically called a bootkit. When a mobile device with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that no one has modified it after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing. -All Windows 10 Mobile devices always have Secure Boot enabled. In addition, they trust only the Windows operating system signature. -Neither Windows 10 Mobile, apps, or even malware can change the UEFI configuration. For more information about UEFI with Secure Boot, read [Protecting the pre-OS environment with UEFI](http://go.microsoft.com/fwlink/p/?LinkId=722909). +All Windows 10 Mobile devices always have Secure Boot enabled. In addition, they trust only the Windows operating system signature. Neither Windows 10 Mobile, apps, or even malware can change the UEFI configuration. For more information about UEFI with Secure Boot, read [Protecting the pre-OS environment with UEFI](http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx) -### Trusted Platform Module +### Trusted Platform Module -A Trusted Platform Module is a tamper-resistant cryptographic module that enhances the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a PC, tablet, or mobile phone. A trusted computing platform is specially designed to work with the TPM to support privacy and security scenarios that software alone cannot achieve. It is a Windows 10 Mobile device hardware certification requirement to include a TPM in every Windows 10 Mobile device. +A Trusted Platform Module (TPM) is a tamper-resistant cryptographic module that enhances the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a PC, tablet, or smartphone. A trusted computing platform is specially designed to work with the TPM to support privacy and security scenarios that software alone cannot achieve. A TPM is required to receive Windows 10 Mobile device hardware certification. -A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, if you create a key in a TPM with the property that no one can export that key from the TPM, the key absolutely cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling reliable report of the software used to start a platform. +A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, if you create a key in a TPM with the property that no one can export that key from the TPM, the key absolutely cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling a reliable report of the software used to start a platform. -The following list describes key functionality that a TPM provides in Windows 10 Mobile: -- **Manage cryptographic keys.** A TPM can create, store, and permit the use of keys in defined ways. Windows 10 Mobile uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and various other keys. -- **Safeguard and report integrity measurements.**Windows 10 Mobile uses the TPM to record and help protect integrity-related measurements of select hardware and Windows boot components for the Measured Boot feature. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the device’s TPM. From here, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 Mobile device. -- **Prove a TPM is really a TPM.** Managing cryptographic keys and measuring integrity are so central to protecting privacy and security that a TPM must differentiate itself from malware that masquerades as a TPM. +The following list describes key functionality that a TPM provides in Windows 10 Mobile: +- **Managing cryptographic keys.** A TPM can create, store, and permit the use of keys in defined ways. Windows 10 Mobile uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and various other keys. +- **Safeguarding and reporting integrity measurements.** Windows 10 Mobile uses the TPM to record and help protect integrity-related measurements of select hardware and Windows boot components for the Measured Boot feature. In this scenario, Measured Boot measures each component – from firmware up through the drivers – and then stores those measurements in the device’s TPM. From here, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 Mobile device. +- **Proving a TPM is really a TPM.** Managing cryptographic keys and measuring integrity are so central to protecting privacy and security that a TPM must differentiate itself from malware masquerading as a TPM. -Windows 10 Mobile supports TPM implementations that comply with the 2.0 standard. The TPM 2.0 standard includes several improvements that make it superior to the 1.2 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard appeared in the early 2000s, the security community considered these algorithms cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that certain geographies or industries may prefer. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. -Many people assume that original equipment manufacturers (OEMs) must implant a TPM in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 Mobile supports only firmware TPM that complies with the 2.0 standard. Windows does not differentiate between discrete and firmware-based solutions because both must meet the same implementation and security requirements; therefore, any Windows 10 feature that can take advantage of TPM can be used with Windows 10 Mobile. +Windows 10 Mobile supports TPM implementations that comply with the 2.0 standard. The TPM 2.0 standard includes several improvements that make it superior to the 1.2 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. When the TPM 1.2 standard appeared in the early 2000s, the security community considered these algorithms cryptographically strong. Since then, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection, as well as the ability to plug-in algorithms that certain geographies or industries may prefer. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. -> **Note:**  Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [Minimum hardware requirements](http://go.microsoft.com/fwlink/p/?LinkId=733964). -  -Several Windows 10 Mobile security features require TPM: -- Virtual smart cards -- Measured Boot -- Health attestation (requires TPM 2.0 or later) -Still other features will use the TPM if it is available. For example, Microsoft Passport does not require TPM but uses it if it’s available. Organizations can configure policy to require TPM for Microsoft Passport. +Many assume that original equipment manufacturers (OEMs) must implant a TPM in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 Mobile supports only firmware TPM that complies with the 2.0 standard. Windows does not differentiate between discrete and firmware-based solutions because both must meet the same implementation and security requirements. Therefore, any Windows 10 feature that can take advantage of TPM can be used with Windows 10 Mobile. -### Biometrics +>Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [minimum hardware requirements](https://technet.microsoft.com/library/dn915086.aspx) -Windows 10 Mobile makes biometrics a core security feature. Microsoft has fully integrated biometrics into the Windows 10 Mobile security components, not just tacked it on top of the platform (as was the case in previous versions of Windows). This is a big change. Earlier biometric implementations were largely front-end methods that simplified authentication. Under the hood, the system used biometrics to access a password, which it then used for authentication behind the scenes. Biometrics may have provided convenience but not necessarily enterprise-grade authentication. -Microsoft has been evangelizing the importance of enterprise-grade biometric sensors to the OEMs that create Windows 10 Mobile devices. These facial-recognition and iris-scanning sensors are fully supported by MFA features such as Microsoft Passport and Windows Hello. -In the future, Microsoft expects OEMs to produce even more advanced enterprise-grade biometric sensors and to continue to integrate them into mobile devices. As a result, biometrics will become a commonplace authentication method as part of an MFA system. +Several Windows 10 Mobile security features require TPM: +- Virtual smart cards +- Measured Boot +- Health attestation (requires TPM 2.0 or later) -### Enterprise-grade secure Windows startup +Still other features will use the TPM if it is available. For example, Windows Hello does not require TPM but uses it if it’s available. Organizations can configure policy to require TPM for Windows Hello. -UEFI with Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the devices, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. +### Biometrics -### Trusted Boot +Windows 10 Mobile makes biometrics a core security feature. Microsoft has fully integrated biometrics into the Windows 10 Mobile security components, not just tacked it on top of the platform (as was the case in previous versions of Windows). This is a big change. Earlier biometric implementations were largely front-end methods that simplified authentication. Under the hood, the system used biometrics to access a password, which it then used for authentication behind the scenes. Biometrics may have provided convenience, but not necessarily enterprise-grade authentication. -When UEFI with Secure Boot verifies that it trusts the bootloader and starts Windows 10 Mobile, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (for example, signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, and startup files. +Microsoft has been evangelizing the importance of enterprise-grade biometric sensors to the OEMs that create Windows 10 Mobile devices. These facial-recognition and iris-scanning sensors are fully supported by Windows Hello. -If someone has modified a file (for example, if malware has tampered with it or it has been corrupted), Trusted Boot will detect the problem and attempt to automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay. +In the future, Microsoft expects OEMs to produce even more advanced enterprise-grade biometric sensors and to continue integrating them into mobile devices. As a result, biometrics will become a commonplace authentication method as part of an MFA system. -### Measured Boot +### Trusted Boot -The biggest challenge with rootkits and bootkits in earlier versions of Windows was that they could frequently be undetectable to the client. Because they often started before Windows defenses and the antimalware solution—and they had system-level privileges—rootkits and bootkits could completely disguise themselves while continuing to access system resources. Although UEFI with Secure Boot and Trusted Boot could prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (for example, if someone compromised the signature used to sign a boot component, such as a non-Microsoft driver, and used it to sign a malicious one). -Windows 10 Mobile implements the Measured Boot feature, which uses the TPM hardware component to record a series of measurements for critical startup-related components, including firmware, Windows boot components, and drivers. Because Measured Boot uses the hardware-based security capabilities of TPM, which isolates and protects the measurement data against malware attacks, the log data is well protected against even sophisticated attacks. -Measured Boot focuses on acquiring the measurement data and protecting it against tampering. You must couple it, however, with a service that can analyze the data to determine device health and provide a more complete security service. The next section introduces just such a service. +UEFI with Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the device, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. -### Device health attestation +When UEFI with Secure Boot verifies that it trusts the bootloader and starts Windows 10 Mobile, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (e.g., signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, and startup files. -Device health attestation is new feature in Windows 10 Mobile that helps prevent low-level malware infections. Device health attestation uses a device’s TPM and firmware to measure the critical security properties of the device’s BIOS and Windows startup processes. These measurements are made in such a way that even on a system infected with kernel-level malware or a rootkit, an attacker is unlikely to spoof the properties. -You can integrate Device health attestation with Microsoft Intune or non-Microsoft MDM solutions and combine these hardware-measured security properties with other device properties to gain an overall view of the device’s health and compliance state. From there, you can use this integration in a variety of scenarios, from detecting jailbroken devices to monitoring device compliance, generating compliance reports, alerting users or administrators, initiating corrective action on the device, and managing conditional access to resources such as Office 365. +### Measured Boot -### Conditional Access +In earlier versions of Windows, the biggest challenge with rootkits and bootkits was that they could frequently be undetectable to the client. Because they often started before Windows defenses and the antimalware solution – and they had system-level privileges – rootkits and bootkits could completely disguise themselves while continuing to access system resources. Although UEFI with Secure Boot and Trusted Boot could prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (e.g., if someone compromised the signature used to sign a boot component, such as a non-Microsoft driver, and used it to sign a malicious one). -The example that follows shows how Windows 10 protective measures integrate and work with Intune and non-Microsoft MDM solutions. It demonstrates how the phone security architecture in Windows 10 Mobile helps you monitor and verify compliance and how the security and trust rooted in the device hardware protect corporate resources end to end. +Windows 10 Mobile implements the Measured Boot feature, which uses the TPM hardware component to record a series of measurements for critical startup-related components, including firmware, Windows boot components, and drivers. Because Measured Boot uses the hardware-based security capabilities of TPM, which isolates and protects the measurement data against malware attacks, the log data is well protected against even sophisticated attacks. -When a user turns on a phone: -1. The Secure Boot feature in Windows 10 Mobile helps protect the startup sequence, allows the device to boot into a defined and trusted configuration, and loads a factory-trusted boot loader. -2. Windows 10 Mobile Trusted Boot takes control when the Secure Boot process is complete, verifying the digital signature of the Windows kernel and the components that are loaded and executed during the startup process. -3. In parallel to steps 1 and 2, the phone’s TPM runs independently in a hardware-protected security zone (isolated from the boot execution path, which monitors boot activities). It creates a protected, tamper-evident audit trail, signed with a secret that only the TPM can access. -4. Devices that a Device health attestation-enabled MDM solution manage send a copy of this audit trail to the Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. -5. HAS reviews the audit trails, issues an encrypted and signed report, and forwards it to the device. -6. From your Device health attestation-enabled MDM solution, you can review the report in a protected, tamper-resistant, and tamper-evident communication channel to assess whether the device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with the organization’s security needs and policies. -Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider implementing a Device health attestation-enabled MDM system like Intune that takes advantage of the Windows 10 Mobile cloud-based health attestation server feature to detect and block devices infected with advanced malware. +Measured Boot focuses on acquiring the measurement data and protecting it against tampering. To provide more complete security, it must be coupled with a service that can analyze the data to determine device health. -## App platform security +### Device Health Attestation -Applications built for Windows are designed to be secure and free of defects, but the reality is that human error can create vulnerabilities in code. When malicious users and software identify such vulnerabilities, they may attempt to manipulate data in memory in the hope that they can compromise the system and take control. +Device Health Attestation (DHA) is a new feature in Windows 10 Mobile that helps prevent low-level malware infections. DHA uses a device’s TPM and firmware to measure the critical security properties of the device’s BIOS and Windows startup processes. These measurements are made in such a way that even on a system infected with kernel-level malware or a rootkit, an attacker is unlikely to spoof the properties. -To mitigate these risks, Windows 10 Mobile includes a series of improvements to make it more difficult for malware to compromise the device. Windows 10 Mobile even enables organizations to choose which apps are allowed to run on mobile devices. In addition, it includes improvements that can dramatically reduce the likelihood that newly discovered vulnerabilities can be successful exploited. It takes detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level. +You can use DHA with Microsoft Intune (sold separately) or a third-party MDM solution to combine hardware-measured security properties with other device properties and gain an overall view of the device’s health and compliance state. This integration can be useful in a variety of scenarios, including detecting jailbroken devices, monitoring device compliance, generating compliance reports, alerting users or administrators, initiating corrective action on the device, and managing conditional access to resources such as Office 365. -### Device Guard +The example that follows shows how Windows 10 protective measures integrate and work with Intune and third-party MDM solutions. It demonstrates how the phone security architecture in Windows 10 Mobile can help you monitor and verify compliance and how the security and trust rooted in the device hardware can protect end-to-end corporate resources. -Device Guard is a feature set that consists of both hardware and software system integrity-hardening features. These features revolutionize Windows operating system security by moving the entire operating system to a trust-nothing model. +When a user turns a phone on: +1. The Secure Boot feature in Windows 10 Mobile helps protect the startup sequence, allows the device to boot into a defined and trusted configuration, and loads a factory-trusted boot loader. +2. Windows 10 Mobile Trusted Boot takes control when the Secure Boot process is complete, verifying the digital signature of the Windows kernel and the components that are loaded and executed during the startup process. +3. In parallel to steps 1 and 2, the phone’s TPM runs independently in a hardware-protected security zone (isolated from the boot execution path, which monitors boot activities). It creates a protected, tamper-evident audit trail, signed with a secret that only the TPM can access. +4. Devices that are DHA-enabled send a copy of this audit trail to the Microsoft Health Attestation service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. +5. HAS reviews the audit trails, issues an encrypted and signed report, and forwards it to the device. +6. From your DHA-enabled MDM solution, you can review the report in a protected, tamper-resistant, and tamper-evident communication channel to assess whether the device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with the organization’s security needs and policies. +Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider implementing a DHA-enabled MDM system like Intune. It can take advantage of the Windows 10 Mobile cloud-based health attestation server feature to detect and block devices infected with advanced malware. -All apps on Windows 10 Mobile must be digitally signed and come from Windows Store or a trusted enterprise store. Device Guard implements policies that further restrict this. By default, Device Guard supports all apps from Windows Store. You can create policies that define the apps that can and cannot run on the Windows 10 Mobile device. If the app doesn’t have a digital signature or is prevented by policy, or it does not come from a trusted store, it will not run on Windows 10 Mobile. +### Device Guard -Advanced hardware features (described earlier in the [Enterprise-grade secure hardware](#secure-hardware) section) drive these security offerings. By integrating these hardware features further into the core operating system, Windows 10 Mobile can use them in new ways. To deliver this additional security, Device Guard requires UEFI with Secure Boot. +Device Guard is a feature set that consists of both hardware and software system integrity–hardening features. These features revolutionize Windows operating system security by moving the entire operating system to a trust-nothing model. -### AppContainer +All apps on Windows 10 Mobile must be digitally signed and come from Windows Store or a trusted enterprise store. Device Guard implements policies that further restrict this. By default, Device Guard supports all apps from Windows Store. You can create policies that define the apps that can and cannot run on the Windows 10 Mobile device. If the app does not have a digital signature, is prevented by policy, or does not come from a trusted store, it will not run on Windows 10 Mobile. -The Windows 10 Mobile security model is based on the principle of least privilege and uses isolation to achieve it. Every app and even portions of the operating system itself run inside their own isolated sandbox called an AppContainer—a secured isolation boundary within which an app and its processes can run. Each AppContainer is defined and implemented through a security policy. +Advanced hardware features, described above, drive these security offerings. By integrating these hardware features further into the core operating system, Windows 10 Mobile can use them in new ways. To deliver this additional security, Device Guard requires UEFI with Secure Boot. -The security policy of a specific AppContainer defines the operating system capabilities that apps have access to from within the AppContainer. A capability is a Windows 10 Mobile device resource such as geographical location information, camera, microphone, networking, and sensors. +### Address Space Layout Randomization -A set of default permissions are granted to all AppContainers, including access to a unique, isolated storage location. In addition, access to other capabilities can be declared within the app code itself. Access to additional capabilities and privileges cannot be requested at run time, as can be done with traditional desktop applications. +One of the most common techniques used by attackers to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data reside, and overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. -The AppContainer concept is advantageous for the following reasons: - -- **Attack surface reduction.** Apps can access only those capabilities that are declared in the application code and needed to perform their functions. -- **User consent and control.** Capabilities that apps use are automatically published to the app details page in the Windows Store. App access to capabilities that may expose sensitive information automatically prompt the user to acknowledge and provide consent. -- **App isolation.** Communication between Windows apps is tightly controlled. Apps are isolated from one another and can communicate only by using predefined communications channels and data types. - -Apps receive the minimal privileges they need to perform their legitimate tasks. This means that even if a malicious attacker exploits an app, the potential damage is limited because the app cannot elevate its privileges and is contained within its AppContainer. Windows Store displays the permissions that the app requires along with the app’s age rating and publisher. - -The combination of Device Guard and AppContainer help to prevent unauthorized apps from running. In the event malware slips into the app ecosystem, the AppContainer helps to constrain the app and limit potential damage. The Windows 10 Mobile trust-nothing model doesn’t assume that any component is perfect, however, potential vulnerabilities in apps, AppContainers, and Windows 10 Mobile itself could give an attacker a chance to compromise a system. For this reason, we need redundant vulnerability mitigations. The next several topics describe some of the redundant mitigations in Windows 10 Mobile. - -### Address Space Layout Randomization -One of the most common techniques attackers use to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data reside, and then overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. - -Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. +Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. The below diagram illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. ![figure 3](images/mobile-security-guide-figure3.png) -Figure 3. ASLR at work +Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, applying it across the entire system rather than only in specific apps. With 64bit system and application processes that can take advantage of a vastly increased memory space, it is even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization becomes increasingly unique across devices, adding additional degrees of difficulty for repurposing successful exploits to another system. -Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, making it even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, making it even more difficult for a successful exploit that works on one system to work reliably on another. Microsoft also holistically applied ASLR across the entire system in Windows 10 Mobile rather than it working only on specific apps. +### Data Execution Prevention -### Data Execution Prevention +Malware depends on its ability to insert a malicious payload into memory with the hope that an unsuspecting user will execute it later. While ASLR makes that more difficult, Windows 10 Mobile extends that protection to prevent malware from running if written to an area that you have allocated solely for the storage of information. Data Execution Prevention (DEP) substantially reduces the range of memory that malicious code can use for its benefit. DEP uses the **No execute** bit on modern CPUs to mark blocks of memory as read-only so that malware can’t use those blocks to execute malicious code. All Windows 10 and Windows 10 Mobile devices support DEP. -Malware depends on its ability to put a malicious payload into memory with the hope that an unsuspecting user will execute it later. ASLR makes that much more difficult. - -Extending that protection, it would be great if you could prevent malware from running if it wrote to an area that you have allocated solely for the storage of information. Data Execution Prevention (DEP) does exactly that, substantially reducing the range of memory that malicious code can use for its benefit. DEP uses the **No execute** bit on modern CPUs to mark blocks of memory as read only so that malware can’t use those blocks to execute malicious code. All Windows 10 and Windows 10 Mobile devices support DEP. - -### Windows heap +### Windows heap The heap is a location in memory that Windows uses to store dynamic application data. Microsoft continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that an attacker could use. -Windows 10 Mobile has several important improvements to the security of the heap over previous versions of Windows: +Windows 10 Mobile has made several important improvements to the security of the heap over previous versions of Windows: +- Internal data structures that the heap uses are better protected against memory corruption. +- Heap memory allocations have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 Mobile adds a random offset to the address of a newly allocated heap, making the allocation much less predictable. +- Windows 10 Mobile uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 Mobile responds by instantly terminating the app. -- Internal data structures that the heap uses are better protected against memory corruption. -- Heap memory allocations have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 Mobile adds a random offset to the address of a newly allocated heap, which makes the allocation much less predictable. -- Windows 10 Mobile uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 Mobile responds by instantly terminating the app. +### Memory reservations -### Memory reservations +Microsoft reserves the lowest 64 KB of process memory for the operating system. Apps are no longer allowed to allocate that portion of the memory, making it more difficult for malware to overwrite critical system data structures in memory. -Microsoft reserves the lowest 64 KB of process memory for the operating system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory. +### Control Flow Guard -### Control Flow Guard +When Windows loads applications into memory, it allocates space to those applications based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships among the code locations are well known – they are written in the code itself. However, until Windows 10 Mobile, the operating system didn’t enforce the flow among these locations, giving attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. -When Windows loads applications into memory, it allocates space to those applications based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships among the code locations are well known—they are written in the code itself—but until Windows 10 Mobile, the operating system didn’t enforce the flow among these locations, giving attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. -Windows 10 Mobile mitigates this kind of threat through the Control Flow Guard (CFG) feature. When a trusted application that its creator compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If CFG doesn’t trust the location, it immediately terminates the application as a potential security risk. +Windows 10 Mobile mitigates this kind of threat through Control Flow Guard (CFG). When a trusted application that its creator compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If CFG doesn’t trust the location, it immediately terminates the application as a potential security risk. -You cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when he or she compiles the application. Consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. Of course, browsers are a key entry point for attacks; thus Microsoft Edge and other Windows features take full advantage of CFG. +You cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when he or she compiles the application. Because browsers are a key entry point for attacks, Microsoft Edge takes full advantage of CFG. -### Protected processes +### Protected Processes -In general, preventing a computer security incident is more cost-effective than repairing the damage an incident can cause. For malware in particular, most security controls are designed to prevent an attack from being initially successful. The reasoning is that if malware cannot infect the system, the system is immune to malware. +Unfortunately, no device is immune to malware. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, additional malware controls are required. +If malware is running on a system, you need to limit what it can do Protected Processes prevents untrusted processes from tampering with those that have been specially signed. Protected Processes defines levels of trust for processes: it prevents less trusted processes from interacting with and therefore attacking more trusted processes. Windows 10 Mobile uses Protected Processes broadly throughout the operating system. -Unfortunately, no device is immune to malware. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, it cannot be the only type of malware control. +### AppContainer -The key security scenario is to assume that malware is running on a system but limit what it can do. Windows 10 Mobile has security controls and design features in place to reduce compromise from existing malware infections. Protected Processes is one such feature. +The Windows 10 Mobile security model is based on the principle of least privilege and uses isolation to achieve it. Every app and even portions of the operating system itself run inside their own isolated sandbox called an AppContainer – a secured isolation boundary within which an app and its processes can run. Each AppContainer is defined and implemented through a security policy. -With Protected Processes, Windows 10 Mobile prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes: it prevents less trusted processes from interacting with and therefore attacking more trusted processes. Windows 10 Mobile uses Protected Processes more broadly across the operating system. +The security policy of a specific AppContainer defines the operating system capabilities that apps have access to from within the AppContainer, such as geographical location information, camera, microphone, networking, or sensors. -### Store for Business +A set of default permissions are granted to all AppContainers, including access to a unique, isolated storage location. Access to other capabilities can be declared within the app code itself. Unlike traditional desktop applications, access to additional capabilities and privileges cannot be requested at run time. -Store for Business allows IT pros to find, acquire, distribute, and manage apps for their organization. The model provides flexible ways to distribute apps, depending on the size of your organization, and does not require additional infrastructure in some scenarios. +The AppContainer concept is advantageous because it provides: +- **Attack surface reduction.** Apps can access only those capabilities that are declared in the application code and needed to perform their functions. +- **User consent and control.** Capabilities that apps use are automatically published to the app details page in the Windows Store. App access to capabilities that may expose sensitive information automatically prompt the user to acknowledge and provide consent. +- **App isolation.** Communication between Windows apps is tightly controlled. Apps are isolated from one another and can communicate only by using predefined communication channels and data types. -UWP apps are inherently more secure than typical applications because they are sandboxed, which restricts the app’s risk of compromise or tampering with in a way that would put the system, data, and other applications at risk. Windows Store can further reduce the likelihood that malware will infect devices by reviewing all applications that enter the Windows Store ecosystem before making them available. Store for Business extends this concept by enabling you to distribute custom LOB apps, and even some Windows Store apps, to Windows 10 Mobile devices through the same Windows Store infrastructure. +Apps receive the minimal privileges they need to perform their legitimate tasks. This means that even if a malicious attacker exploits an app, the potential damage is limited because the app cannot elevate its privileges and is contained within its AppContainer. Windows Store displays the permissions that the app requires along with the app’s age rating and publisher. -Regardless of how users acquire UWP apps, they can use them with increased confidence. UWP apps run in an AppContainer sandbox with limited privileges and capabilities. For example, the apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. +The combination of Device Guard and AppContainer help to prevent unauthorized apps from running. In the event malware slips into the app ecosystem, the AppContainer helps to constrain the app and limit potential damage. The Windows 10 Mobile trust-nothing model doesn’t assume that any component is perfect. However, potential vulnerabilities in apps, AppContainers, and Windows 10 Mobile itself could give an attacker a chance to compromise a system. For this reason, redundant vulnerability mitigations are needed. The next several topics describe some of the redundant mitigations in Windows 10 Mobile. -In addition, all UWP apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is significantly limited and should be contained within the sandbox. Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. +### Microsoft Edge -The Windows Store app-distribution process and the app sandboxing capabilities of Windows 10 Mobile can dramatically reduce the likelihood that users encounter malicious apps on the system. +The web browser is a critical component of any security strategy. It is the user’s interface to the Internet, an environment teeming with malicious sites and potentially dangerous content. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. -For more information about Store for Business, see [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md). +Windows 10 Mobile includes Microsoft Edge, an entirely new web browser that goes beyond browsing with features like Reading View. Microsoft Edge is more secure than previous Microsoft web browsers in several ways: +- **Microsoft Edge on Windows 10 Mobile does not support extensions.** Microsoft Edge has built-in PDF viewing capability. +- **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. +- **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design. -### App management +## Summary -An enterprise typically exerts some configuration and control over the apps installed on devices. In this way, the organization accomplishes several business goals, such managing software licenses, ensuring mandatory app deployment on required devices, and preventing the installation of unacceptable apps on corporate devices. +Windows 10 Mobile provides security on personal and corporate-owned devices to protect against unauthorized access, data leakage, and malware threats. All of the features covered in this paper – multifactor authentication, data separation, and malware resistance – are seamlessly incorporated into the operating system. This means enterprises are protected without compromising the productivity and ease of use that drives users to bring mobile devices into the workplace. -An important component in delivering on these goals is Store for Business, which builds on the Windows Store infrastructure that Microsoft hosts and enables you to deploy Windows Store apps across your Windows 10-based devices. Store for Business is both powerful and highly flexible. It allows you to extend and customize features without having to stand up new on-premises infrastructure. It supports and integrates with your existing MDM service but doesn’t require one. (Ask your MDM service vendor about integration with Store for Business.) You can configure Store for Business for a wide variety of scenarios, including online and offline licensing and different app-distribution options. For a more detailed description of the available Store for Business scenarios, see [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md). +## Revision History -A web-based portal for IT pros simplifies Windows 10 Mobile app deployment. The familiar look of Windows Store was used to design the Store for Business experience. It showcases apps relevant to business use, hand-selected and sorted by category. The store can use Azure AD accounts for all users, linking them to a single, unique organizational identity. +November 2015 Updated for Windows 10 Mobile (version 1511) -Another key benefit is licensing. Store for Business enables you to track and manage licenses for all UWP apps. You can easily determine which users have installed specific apps, track remaining licenses left, and acquire new licenses directly through the web interface. Those new licenses are added within Store for Business and do not require complex export and import processes. As long as your clients are online and have Internet connectivity, the licensing scenario with Store for Business is a great improvement over manual licensing tasks. +July 2016 Updated for Windows 10 Mobile Anniversary Update (version 1607) -Store for Business allows you to find the right apps for your users, acquire them, manage app licenses, and distribute apps to individuals. The best way to understand Store for Business is to look at the steps involved in a common scenario: delivering apps to Windows 10 Mobile users without an MDM—specifically, deploying apps to Windows 10 Mobile users. In this scenario, you identify several apps that must be on each mobile device that are currently available for free in the Windows Store (for example, a VPN app for your Dell SonicWALL solution) and some internally developed LOB apps. - -### The IT side - -You begin the app deployment process by preparing the private store and the apps before your users receive their new Windows 10 Mobile devices. - -First, you open [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) and use an Azure AD account to log in. This account is linked to the company’s unique organizational identity and must have an Azure AD tenant. In addition, the account must have Azure AD Enterprise Admin permissions if this is the first time you’re using Store for Business. You can delegate later access through permissions within Store for Business. -Next, you locate and acquire any apps you want to deploy to the mobile devices, adding the apps and licenses to the organization’s inventory. - -Along with existing Windows Store apps, you can use Store for Business to manage custom LOB apps that are developed for your organization. First, you grant permission for a trusted app developer to submit the apps. You and the developer submit these apps through the [Windows Dev Center](http://go.microsoft.com/fwlink/p/?LinkId=722911), and they must be digitally signed with a trusted certificate. These apps are not published to the retail Windows Store catalog and are not visible to anyone outside the organization. - -You can deliver the apps through a private store within Windows Store. The next step, then, is for you to mark the app to be available in the private store, which you do through the Store for Business web portal. - -Alternatively, you can choose one of two other app-distribution options in Store for Business web portal: -- Assign the app to people in your organization by selecting one or more Azure AD identities -- Add the app to the organization’s private store, and allow all users to discover and install it. -For details about app distribution, see [Distribute apps using your private store](../manage/distribute-apps-from-your-private-store.md). - -The IT process for preparing Store for Business for app deployment is shown in Figure 4. - -![figure 4](images/mobile-security-guide-figure4.png) - -Figure 4. The IT process for Store for Business - -For details about the process of distributing apps through Store for Business, see [Find and acquire apps](../manage/find-and-acquire-apps-overview.md). - -### The user side - -After you have prepared Store for Business, the user side of the process takes over. This side of the process is designed to be user friendly, with the primary app deployment method—through Store for Business—streamlined and straightforward. This process doesn’t require an MDM system or any on-premises infrastructure. In fact, the user never sees the “for Business” label, just the familiar Windows Store. - -1. The user opens the Windows Store app on his or her Windows 10 Mobile device. - -2. The same Windows Store interface appears, with the addition of the private store you created. The private store appears as a new page, similar to Games and Music. The interface integrates the public Windows Store with the organization’s private store, which contains curated apps. - -3. The user simply selects and installs apps as usual. - -If the user wants to make a private purchase of apps, music, movies, or TV shows with his or her Microsoft account, that’s an option, as well. The user pays for and owns his or her purchase, independent of the company. This flexibility enables hybrid scenarios for devices in many bring your own device environments. - -### Microsoft Edge - -Windows 10 Mobile includes critical improvements designed to thwart attacks and malware. The environment is now more resistant to malware thanks to significant improvements to SmartScreen Filters. Internet browsing is a safer experience thanks to Microsoft Edge, a completely new browser. - -Windows 10 Mobile includes Microsoft Edge, an entirely new web browser that goes beyond browsing with features like Reading View. Microsoft Edge is more secure than previous Microsoft web browsers in several ways: -- **Microsoft Edge does not support non-Microsoft binary extensions.** Microsoft Edge supports Flash content and PDF viewing by default through built-in extensions but includes no non-Microsoft binary extensions, such as ActiveX controls or Java. -- **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. -- **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design. - -The web browser is a critical component of any security strategy, and for good reason: it is the user’s interface to the Internet, an environment teeming with malicious sites and nefarious content. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. - -## Related topics - - -[Windows 10 security overview](windows-10-security-guide.md) - -[Windows 10 Mobile and MDM](../manage/windows-10-mobile-and-mdm.md) - -[Windows 10 and Windows 10 Mobile](../index.md) - -[Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) - -[Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md) diff --git a/windows/keep-secure/windows-10-security-guide.md b/windows/keep-secure/windows-10-security-guide.md index bb757267bb..5ad7eddc7a 100644 --- a/windows/keep-secure/windows-10-security-guide.md +++ b/windows/keep-secure/windows-10-security-guide.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: high author: challum --- @@ -17,14 +18,14 @@ author: challum This guide provides a detailed description of the most important security improvements in the Windows 10 operating system, with links to more detailed articles about many of its security features. Wherever possible, specific recommendations are provided to help you implement and configure Windows 10 security features. -## Introduction +#### Introduction Windows 10 is designed to protect against known and emerging security threats across the spectrum of attack vectors. Three broad categories of security work went into Windows 10: - [**Identity and access control**](#identity) features have been greatly expanded to both simplify and enhance the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). Another new feature is Credential Guard, which uses virtualization-based security (VBS) to help protect the Windows authentication subsystems and users’ credentials. - [**Information protection**](#information) that guards information at rest, in use, and in transit. In addition to BitLocker and BitLocker To Go for protection of data at rest, Windows 10 includes file-level encryption with Enterprise Data Protection that performs data separation and containment and, when combined with Rights Management services, can keep data encrypted when it leaves the corporate network. Windows 10 can also help keep data secure by using virtual private networks (VPNs) and Internet Protocol Security. - [**Malware resistance**](#malware) includes architectural changes that can isolate critical system and security components from threats. Several new features in Windows 10 help reduce the threat of malware, including VBS, Device Guard, Microsoft Edge, and an entirely new version of Windows Defender. In addition, the many antimalware features from the Windows 8.1 operating system— including AppContainers for application sandboxing and numerous boot-protection features, such as Trusted Boot—have been carried forward and improved in Windows 10. -## Identity and access control +## Identity and access control Traditionally, access control is a process that has three components: - **Identification** - when a user asserts a unique identity to the computer system for the purpose of gaining access to a resource, such as a file or a printer. In some definitions, the user is called the subject and the resource is the object. @@ -73,14 +74,14 @@ Table 1. Windows 10 solutions to typical access control challenges   The sections that follow describe these challenges and solutions in more detail. -**Microsoft Passport** +### Microsoft Passport Microsoft Passport provides strong two-factor authentication (2FA), fully integrated into Windows, and replaces passwords with the combination of an enrolled device and either a PIN or Windows Hello. Microsoft Passport is conceptually similar to smart cards but more flexible. Authentication is performed by using an asymmetric key pair instead of a string comparison (for example, password), and the user’s key material can be secured by using hardware. Unlike smart cards, Microsoft Passport does not require the extra infrastructure components required for smart card deployment. In particular, you do not need public key infrastructure (PKI). If you already use PKI – for example, in secure email or VPN authentication – you can use the existing infrastructure with Microsoft Passport. Microsoft Passport combines the major advantages of smart card technology – deployment flexibility for virtual smart cards and robust security for physical smart cards – without any of their drawbacks. Microsoft Passport offers three significant advantages over the current state of Windows authentication: It’s more flexible, it’s based on industry standards, and it effectively mitigates risks. The sections that follow look at each of these advantages in more detail. -**It’s flexible** +#### It’s flexible Microsoft Passport offers unprecedented flexibility. Although the format and use of passwords and smart cards is fixed, Microsoft Passport gives both administrators and users options to manage authentication. First and foremost, Microsoft Passport works with biometric sensors and PINs. Next, you can use your PC or even your phone as one of the factors to authenticate on your PC. Finally, your user credentials can come from your PKI infrastructure, or Windows can create the credential itself. @@ -88,21 +89,19 @@ Microsoft Passport gives you options beyond long, complex passwords. Instead of With Microsoft Passport, you gain flexibility in the data center, too. To deploy it, you must add Windows Server 2016 domain controllers to your Active Directory environment, but you do not have to replace or remove your existing Active Directory servers: Microsoft Passport builds on and adds to your existing infrastructure. You can either add on premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport to your network. The choice of which users to enable for Microsoft Passport use is completely up to you – you choose which items to protect and which authentication factors you want to support. This flexibility makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding 2FA to users who do not currently have it, or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems. -**It’s standardized** +#### It’s standardized Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end: The future lies with open, interoperable systems that allow secure authentication across a variety of devices, line of business (LOB) apps, and external applications and websites. To this end, a group of industry players formed FIDO, the Fast IDentity Online Alliance. The FIDO Alliance is a nonprofit organization intended to address the lack of interoperability among strong authentication devices, as well as the problems users face when they need to create and remember multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services. This new standard for security devices and browser plug ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security. -In 2014, Microsoft joined the board of the [FIDO Alliance](http://go.microsoft.com/fwlink/p/?LinkId=626934). FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards, and of course, on new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. +In 2014, Microsoft joined the board of the [FIDO Alliance](https://go.microsoft.com/fwlink/p/?LinkId=626934). FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards, and of course, on new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. -**It’s effective** +#### It’s effective Microsoft Passport effectively mitigates two major security risks. First, it eliminates the use of passwords for logon and so reduces the risk that a nefarious attacker will steal and reuse the user’s credentials. User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Second, because Microsoft Passport uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. To compromise a Microsoft Passport credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. This sets the bar magnitudes of order higher than password phishing attacks. -### - -**Windows Hello** +### Windows Hello Windows Hello is the name given to the new biometric sign-in option for Microsoft Passport. Because biometric authentication is built directly into the operating system, Windows Hello allows users to unlock their devices by using their face or fingerprint. From here, authentication to the devices and resources is enabled through a combination of the user’s unique biometric identifier and the device itself. @@ -116,7 +115,7 @@ Windows Hello supports two biometric sensor options that are suitable for enterp Windows Hello offers several major benefits. First, it addresses the problems of credential theft and sharing, because an attacker must obtain the device and impersonate the user’s biometric identity, which is more difficult than stealing a password or PIN. Second, the use of biometrics gives users an authenticator that’s always with them – there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, secure method for logging in to all their Windows devices. Finally, there’s nothing additional to deploy or manage. Because Windows Hello support is built directly into the operating system, there are no additional drivers to deploy. -**Brute-force attack resistance** +### Brute-force attack resistance A brute-force attack is the process used to break into a device simply by guessing a user’s password, PIN, or even his or her biometric identity over and over until the attacker gets it right. Over the last several versions of Windows, Microsoft has added features that dramatically reduce the chances that such an attack would succeed. @@ -125,7 +124,7 @@ Windows 8.1 and Windows 10 support an even more powerful – but optional – If you’re interested in learning how to configure brute-force protection, use a test Windows 10 PC on which BitLocker protection is enabled for the system drive, and then print the BitLocker recovery key to ensure that you have it available. Then, open the Local Group Policy Editor by running **gpedit.msc**, and go to Computer Configuration\\Windows Settings\\Security Settings\\Security Options. Open the policy **Interactive Login: Machine Account Lockout Threshold**, and set the value to **5**, as shown in Figure 1. -![figure 1](images/security-fig1-invalidaccess.png) +![Machine lockout threshold](images/security-fig1-invalidaccess.png "Machine lockout threshold") Figure 1. Set the number of invalid access attempts prior to lockout @@ -187,92 +186,105 @@ Table 2. Data Protection in Windows 10 and Windows 7 -  + The sections that follow describe these improvements in more detail. -**Prepare for drive and file encryption** +### Prepare for drive and file encryption The best type of security measures are transparent to the user during implementation and use. Every time there is a possible delay or difficulty because of a security feature, there is strong likelihood that users will try to bypass security. This situation is especially true for data protection, and that’s a scenario that organizations need to avoid. Whether you’re planning to encrypt entire volumes, removable devices, or individual files, Windows 10 meets your needs by providing streamlined, usable solutions. In fact, you can take several steps in advance to prepare for data encryption and make the deployment quick and smooth. -**TPM pre-provisioning** +#### TPM pre-provisioning In Windows 7, preparing the TPM for use offered a couple of challenges: -- You can turn on the TPM in the BIOS, which requires someone to either go into the BIOS settings to turn it on or to install a driver to turn it on from within Windows. -- When you enable the TPM, it may require one or more restarts. + +* You can turn on the TPM in the BIOS, which requires someone to either go into the BIOS settings to turn it on or to install a driver to turn it on from within Windows. +* When you enable the TPM, it may require one or more restarts. + Basically, it was a big hassle. If IT staff were provisioning new PCs, they could handle all of this, but if you wanted to add BitLocker to devices that were already in users’ hands, those users would have struggled with the technical challenges and would either call IT for support or simply leave BitLocker disabled. + Microsoft includes instrumentation in Windows 10 that enables the operating system to fully manage the TPM. There is no need to go into the BIOS, and all scenarios that required a restart have been eliminated. -**Deploy hard drive encryption** +### Deploy hard drive encryption BitLocker is capable of encrypting entire hard drives, including both system and data drives. BitLocker pre-provisioning can drastically reduce the time required to provision new PCs with BitLocker enabled. With Windows 10, administrators can turn on BitLocker and the TPM from within the Windows Preinstallation Environment before they install Windows or as part of an automated deployment task sequence without any user interaction. Combined with Used Disk Space Only encryption and a mostly empty drive (because Windows is not yet installed), it takes only a few seconds to enable BitLocker. With earlier versions of Windows, administrators had to enable BitLocker after Windows had been installed. Although this process could be automated, BitLocker would need to encrypt the entire drive, a process that could take anywhere from several hours to more than a day depending on drive size and performance, which significantly delayed deployment. Microsoft has improved this process through multiple features in Windows 10. -**Device encryption** +#### Device encryption Beginning in Windows 8.1, Windows automatically enables BitLocker device encryption on devices that support InstantGo. With Windows 10, Microsoft offers device encryption support on a much broader range of devices, including those that are InstantGo. Microsoft expects that most devices in the future will pass the testing requirements, which makes device encryption pervasive across modern Windows devices. Device encryption further protects the system by transparently implementing device-wide data encryption. Unlike a standard BitLocker implementation, device encryption is enabled automatically so that the device is always protected. The following list outlines how this happens: -- When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, device encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). -- If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials. -- If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** Group Policy setting, and select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed. -- Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed. + +* When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, device encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). +* If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials. +* If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** Group Policy setting, and select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed. +* Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed. + Microsoft recommends that device encryption be enabled on any systems that support it, but the automatic device encryption process can be prevented by changing the following registry setting: -- **Subkey**: HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker -- **Value**: PreventDeviceEncryption equal to True (1) -- **Type**: REG\_DWORD +- **Subkey**: HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker +- **Value**: PreventDeviceEncryption equal to True (1) +- **Type**: REG\_DWORD + Administrators can manage domain-joined devices that have device encryption enabled through Microsoft BitLocker Administration and Monitoring (MBAM). In this case, device encryption automatically makes additional BitLocker options available. No conversion or encryption is required, and MBAM can manage the full BitLocker policy set if any configuration changes are required. -**Used Disk Space Only encryption** +#### Used Disk Space Only encryption BitLocker in earlier Windows versions could take a long time to encrypt a drive, because it encrypted every byte on the volume (including parts that did not have data). That is still the most secure way to encrypt a drive, especially if a drive has previously contained confidential data that has since been moved or deleted, in which case traces of the confidential data could remain on portions of the drive marked as unused. But why encrypt a new drive when you can simply encrypt the data as it is being written? To reduce encryption time, BitLocker in Windows 10 lets users choose to encrypt just their data. Depending on the amount of data on the drive, this option can reduce encryption time by more than 99 percent. Exercise caution when encrypting only used space on an existing volume on which confidential data may have already been stored in an unencrypted state, however, because those sectors can be recovered through disk-recovery tools until they are overwritten by new encrypted data. In contrast, encrypting only used space on a brand-new volume can significantly decrease deployment time without the security risk because all new data will be encrypted as it is written to the disk. -**Encrypted hard drive support** +#### Encrypted hard drive support SEDs have been available for years, but Microsoft couldn’t support their use with some earlier versions of Windows because the drives lacked important key management features. Microsoft worked with storage vendors to improve the hardware capabilities, and now BitLocker supports the next generation of SEDs, which are called encrypted hard drives. Encrypted hard drives provide onboard cryptographic capabilities to encrypt data on drives, which improves both drive and system performance by offloading cryptographic calculations from the PC’s processor to the drive itself and rapidly encrypting the drive by using dedicated, purpose-built hardware. If you plan to use whole-drive encryption with Windows 10, Microsoft recommends that you investigate hard drive manufacturers and models to determine whether any of their encrypted hard drives meet your security and budget requirements. -For more information about encrypted hard drives, see [Encrypted Hard Drive](http://go.microsoft.com/fwlink/p/?LinkId=733880). +For more information about encrypted hard drives, see [Encrypted Hard Drive](https://go.microsoft.com/fwlink/p/?LinkId=733880). -**Preboot information protection** +### Preboot information protection An effective information protection implementation, like most security controls, considers usability as well as security. Users typically prefer a simple security experience. In fact, the more transparent a security solution becomes, the more likely users are to conform to it. It is crucial that organizations protect information on their PCs regardless of the state of the computer or the intent of users. This protection should not be cumbersome to users. One undesirable and previously commonplace situation is when the user is prompted for input during preboot, and then again during Windows logon. Challenging users for input more than once should be avoided. Windows 10 can enable a true SSO experience from the preboot environment on modern devices and in some cases even on older devices when robust information protection configurations are in place. The TPM in isolation is able to securely protect the BitLocker encryption key while it is at rest, and it can securely unlock the operating system drive. When the key is in use and thus in memory, a combination of hardware and Windows capabilities can secure the key and prevent unauthorized access through cold-boot attacks. Although other countermeasures like PIN-based unlock are available, they are not as user-friendly; depending on the devices’ configuration they may not offer additional security when it comes to key protection. For more information about how to configure BitLocker for SSO, see [BitLocker Countermeasures](bitlocker-countermeasures.md). -**Manage passwords and PINs** +### Manage passwords and PINs When BitLocker is enabled on a system drive and the PC has a TPM, you can choose to require that users type a PIN before BitLocker will unlock the drive. Such a PIN requirement can prevent an attacker who has physical access to a PC from even getting to the Windows logon, which makes it virtually impossible for the attacker to access or modify user data and system files. + Requiring a PIN at startup is a useful security feature because it acts as a second authentication factor (a second “something you know”). This configuration comes with some costs, however. One of the most significant is the need to change the PIN regularly. In enterprises that used BitLocker with Windows 7 and the Windows Vista operating system, users had to contact systems administrators to update their BitLocker PIN or password. This requirement not only increased management costs but made users less willing to change their BitLocker PIN or password on a regular basis. Windows 10 users can update their BitLocker PINs and passwords themselves, without administrator credentials. Not only will this feature reduce support costs, but it could improve security, too, because it encourages users to change their PINs and passwords more often. In addition, InstantGo devices do not require a PIN for startup: They are designed to start infrequently and have other mitigations in place that further reduce the attack surface of the system. For more information about how startup security works and the countermeasures that Windows 10 provides, see [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md). -**Configure Network Unlock** +### Configure Network Unlock Some organizations have location-specific data security requirements. This is most common in environments where high-value data is stored on PCs. The network environment may provide crucial data protection and enforce mandatory authentication; therefore, policy states that those PCs should not leave the building or be disconnected from the corporate network. Safeguards like physical security locks and geofencing may help enforce this policy as reactive controls. Beyond these, a proactive security control that grants data access only when the PC is connected to the corporate network is necessary. Network Unlock enables BitLocker-protected PCs to start automatically when connected to a wired corporate network on which Windows Deployment Services runs. Anytime the PC is not connected to the corporate network, a user must type a PIN to unlock the drive (if PIN-based unlock is enabled). Network Unlock requires the following infrastructure: -- Client PCs that have Unified Extensible Firmware Interface (UEFI) firmware version 2.3.1 or later, which supports Dynamic Host Configuration Protocol (DHCP) -- A server running Windows Server 2012 with the Windows Deployment Services role -- A server with the DHCP server role installed -For more information about how to configure Network Unlock, see [BitLocker: How to enable Network Unlock](http://go.microsoft.com/fwlink/p/?LinkId=733905). -**Microsoft BitLocker Administration and Monitoring** -Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage and support BitLocker and BitLocker To Go. MBAM 2.5 with Service Pack 1, the latest version, has the following key features: -- Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. -- Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. -- Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. -- Reduces the workload on the help desk to assist end users with BitLocker recovery requests. -- Enables end users to recover encrypted devices independently by using the Self-Service Portal. -- Enables security officers to easily audit access to recovery key information. -- Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. -- Enforces the BitLocker encryption policy options that you set for your enterprise. -- Integrates with existing management tools, such as System Center Configuration Manager. -- Offers an IT-customizable recovery user experience. -- Supports Windows 10. -For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](http://go.microsoft.com/fwlink/p/?LinkId=626935) on the MDOP TechCenter. +* Client PCs that have Unified Extensible Firmware Interface (UEFI) firmware version 2.3.1 or later, which supports Dynamic Host Configuration Protocol (DHCP) +* A server running Windows Server 2012 with the Windows Deployment Services role +* A server with the DHCP server role installed + +For more information about how to configure Network Unlock, see [BitLocker: How to enable Network Unlock](https://go.microsoft.com/fwlink/p/?LinkId=733905). + +### Microsoft BitLocker Administration and Monitoring + +>>>>>>> refs/remotes/origin/master +Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage and support BitLocker and BitLocker To Go. MBAM 2.5 with Service Pack 1, the latest version, has the following key features: + +* Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. +* Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. +* Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. +* Reduces the workload on the help desk to assist end users with BitLocker recovery requests. +* Enables end users to recover encrypted devices independently by using the Self-Service Portal. +* Enables security officers to easily audit access to recovery key information. +* Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. +* Enforces the BitLocker encryption policy options that you set for your enterprise. +* Integrates with existing management tools, such as System Center Configuration Manager. +* Offers an IT-customizable recovery user experience. +* Supports Windows 10. + +For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](https://go.microsoft.com/fwlink/p/?LinkId=626935) on the MDOP TechCenter. ## Malware resistance @@ -334,24 +346,26 @@ The sections that follow describe these improvements in more detail. **SMB hardening improvements for SYSVOL and NETLOGON connections** -In Windows 10 and Windows Server 2016 Technical Preview, client connections to the Active Directory Domain Services default SYSVOL and NETLOGON shares on domain controllers now require Server Message Block (SMB) signing and mutual authentication (such as Kerberos). +In Windows 10 and Windows Server 2016, client connections to the Active Directory Domain Services default SYSVOL and NETLOGON shares on domain controllers now require Server Message Block (SMB) signing and mutual authentication (such as Kerberos). - **What value does this change add?** This change reduces the likelihood of man-in-the-middle attacks. - **What works differently?** If SMB signing and mutual authentication are unavailable, a Windows 10 or Windows Server 2016 computer won’t process domain-based Group Policy and scripts. -> **Note:** The registry values for these settings aren’t present by default, but the hardening rules still apply until overridden by Group Policy or other registry values. +>[!NOTE] +>The registry values for these settings aren’t present by default, but the hardening rules still apply until overridden by Group Policy or other registry values. -For more information on these security improvements, (also referred to as UNC hardening), see [Microsoft Knowledge Base article 3000483](http://go.microsoft.com/fwlink/p/?LinkId=789216) and [MS15-011 & MS15-014: Hardening Group Policy](http://go.microsoft.com/fwlink/p/?LinkId=789215). +For more information on these security improvements, (also referred to as UNC hardening), see [Microsoft Knowledge Base article 3000483](https://go.microsoft.com/fwlink/p/?LinkId=789216) and [MS15-011 & MS15-014: Hardening Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=789215). -**Secure hardware** +#### Secure hardware Although Windows 10 is designed to run on almost any hardware capable of running Windows 8, Windows 7, or Windows Vista, taking full advantage of Windows 10 security requires advancements in hardware-based security, including UEFI with Secure Boot, CPU virtualization features (for example, Intel VT-x), CPU memory-protection features (for example, Intel VT-d), TPM, and biometric sensors. -**UEFI with Secure Boot** +#### UEFI with Secure Boot When a PC starts, it begins the process of loading the operating system by locating the bootloader on the PC’s hard drive. Without safeguards in place, the PC may simply hand control over to the bootloader without even determining whether it is a trusted operating system or malware. UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the device. + UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the PC’s hardware manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection from firmware bootkits. Thus, UEFI is the first link in the chain of trust. UEFI with Secure Boot became a hardware requirement starting with Windows 8 devices. If a PC supports UEFI, it must be enabled by default. It is possible to disable the Secure Boot feature on many devices, but Microsoft strongly discourages doing so because it dramatically reduces the security of the startup process. @@ -359,32 +373,36 @@ UEFI with Secure Boot became a hardware requirement starting with Windows 8 dev When a PC with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that it has not been modified after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing. All Windows 8 certified PCs must meet several requirements related to Secure Boot: -- They must have Secure Boot enabled by default. -- They must trust Microsoft’s certification authority (CA) and thus any bootloader Microsoft has signed. -- They must allow the user to add signatures and hashes to the UEFI database. -- They must allow the user to completely disable Secure Boot (although administrators can restrict this). + +* They must have Secure Boot enabled by default. +* They must trust Microsoft’s certification authority (CA) and thus any bootloader Microsoft has signed. +* They must allow the user to add signatures and hashes to the UEFI database. +* They must allow the user to completely disable Secure Boot (although administrators can restrict this). This behavior doesn’t limit the choice of operating system. In fact, users typically have three options for running non-Microsoft operating systems: -- **Use an operating system with a Microsoft-signed bootloader.** Microsoft offers a service to sign non-Microsoft bootloaders so that they can be used on the device. In this case, a signature from the Microsoft third-party UEFI -CA is used to sign the non-Microsoft bootloader, and the signature itself is added to the UEFI database. Several non-Microsoft operating systems, including several varieties of Linux, have had their bootloaders signed by Microsoft so that they can take advantage of the Secure Boot capability. For more information about the Microsoft third-party UEFI signing policy, read [Microsoft UEFI CA Signing policy updates](http://go.microsoft.com/fwlink/p/?LinkId=626936) and [Pre-submission testing for UEFI submissions](http://go.microsoft.com/fwlink/p/?LinkId=626937). - **Note**   - PCs configured to use Device Guard boot only a secured version of Windows and do not permit a third-party bootloader. For more information, see the [Device Guard](#device-guard) section of this document. -   -- **Configure UEFI to trust a non–Microsoft-signed bootloader or hashes.** Some Certified For Windows 8 or later PCs allow users to add noncertified bootloaders through a signature or hashes sent to the UEFI database, which allows them to run any operating system without Microsoft signing it. -- **Turn off Secure Boot.**Windows 8 certified PCs allow users to turn off Secure Boot so they can run unsigned operating systems. In this mode, the behavior is identical to PCs that have BIOS: The PC simply runs the bootloader without any verification. Microsoft strongly recommends that Secure Boot remain enabled whenever the device starts so that it can help prevent bootkit infections. +- **Use an operating system with a Microsoft-signed bootloader.** Microsoft offers a service to sign non-Microsoft bootloaders so that they can be used on the device. In this case, a signature from the Microsoft third-party UEFI +CA is used to sign the non-Microsoft bootloader, and the signature itself is added to the UEFI database. Several non-Microsoft operating systems, including several varieties of Linux, have had their bootloaders signed by Microsoft so that they can take advantage of the Secure Boot capability. For more information about the Microsoft third-party UEFI signing policy, read [Microsoft UEFI CA Signing policy updates](https://go.microsoft.com/fwlink/p/?LinkId=626936) and [Pre-submission testing for UEFI submissions](https://go.microsoft.com/fwlink/p/?LinkId=626937). - **Note**   - With Windows 10, original equipment manufacturers (OEMs) have the ability to ship built-to-order PCs that lock down UEFI Secure Boot so that it cannot be disabled and allows only the operating system of the customer’s choice to start on the device. + >[!NOTE]  + >PCs configured to use Device Guard boot only a secured version of Windows and do not permit a third-party bootloader. For more information, see the [Device Guard](#device-guard) section of this document.   -Windows, apps, and even malware cannot change the UEFI configuration. Instead, users must be physically present to manually boot a PC into a UEFI shell, and then change UEFI firmware settings. For more information about UEFI Secure Boot, read [Protecting the pre-OS environment with UEFI](http://go.microsoft.com/fwlink/p/?LinkId=626938). -**Virtualization-based security** +- **Configure UEFI to trust a non–Microsoft-signed bootloader or hashes.** Some Certified For Windows 8 or later PCs allow users to add noncertified bootloaders through a signature or hashes sent to the UEFI database, which allows them to run any operating system without Microsoft signing it. +- **Turn off Secure Boot.**Windows 8 certified PCs allow users to turn off Secure Boot so they can run unsigned operating systems. In this mode, the behavior is identical to PCs that have BIOS: The PC simply runs the bootloader without any verification. Microsoft strongly recommends that Secure Boot remain enabled whenever the device starts so that it can help prevent bootkit infections. + +>[!NOTE]   +>With Windows 10, original equipment manufacturers (OEMs) have the ability to ship built-to-order PCs that lock down UEFI Secure Boot so that it cannot be disabled and allows only the operating system of the customer’s choice to start on the device. +   +Windows, apps, and even malware cannot change the UEFI configuration. Instead, users must be physically present to manually boot a PC into a UEFI shell, and then change UEFI firmware settings. For more information about UEFI Secure Boot, read [Protecting the pre-OS environment with UEFI](https://go.microsoft.com/fwlink/p/?LinkId=626938). + +#### Virtualization-based security One of the most powerful changes to Windows 10 is virtual-based security. Virtual-based security (VBS) takes advantage of advances in PC virtualization to change the game when it comes to protecting system components from compromise. VBS is able to isolate some of the most sensitive security components of Windows 10. These security components aren’t just isolated through application programming interface (API) restrictions or a middle-layer: They actually run in a different virtual environment and are isolated from the Windows 10 operating system itself. VBS and the isolation it provides is accomplished through the novel use of the Hyper V hypervisor. In this case, instead of running other operating systems on top of the hypervisor as virtual guests, the hypervisor supports running the VBS environment in parallel with Windows and enforces a tightly limited set of interactions and access between the environments. Think of the VBS environment as a miniature operating system: It has its own kernel and processes. Unlike Windows, however, the VBS environment runs a micro-kernel and only two processes called trustlets: + - **Local Security Authority (LSA)** enforces Windows authentication and authorization policies. LSA is a well-known security component that has been part of Windows since 1993. Sensitive portions of LSA are isolated within the VBS environment and are protected by a new feature called Credential Guard. - **Hypervisor-enforced code integrity** verifies the integrity of kernel-mode code prior to execution. This is a part of the [Device Guard](#device-guard) feature described later in this document. VBS provides two major improvements in Windows 10 security: a new trust boundary between key Windows system components and a secure execution environment within which they run. A trust boundary between key Windows system components is enabled though the VBS environment’s use of platform virtualization to isolate the VBS environment from the Windows operating system. Running the VBS environment and Windows operating system as guests on top of Hyper-V and the processor’s virtualization extensions inherently prevents the guests from interacting with each other outside the limited and highly structured communication channels between the trustlets within the VBS environment and Windows operating system. @@ -393,23 +411,25 @@ VBS acts as a secure execution environment because the architecture inherently p The VBS architecture is illustrated in Figure 2. -![figure 2](images/security-fig2-vbsarchitecture.png) +![Example of VBS architecture](images/security-fig2-vbsarchitecture-redo.png "Example of VBS architecture") Figure 2. The VBS architecture Note that VBS requires a system that includes: -- Windows 10 Enterprise Edition -- A-64-bit processor -- UEFI with Secure Boot -- Second-Level Address Translation (SLAT) technologies (for example, Intel Extended Page Tables \[EPT\], AMD Rapid Virtualization Indexing \[RVI\]) -- Virtualization extensions (for example, Intel VT-x, AMD RVI) -- I/O memory management unit (IOMMU) chipset virtualization (Intel VT-d or AMD-Vi) -- TPM 2.0 -**Trusted Platform Module** +* Windows 10 Enterprise Edition +* A 64-bit processor +* UEFI with Secure Boot +* Second-Level Address Translation (SLAT) technologies (for example, Intel Extended Page Tables \[EPT\], AMD Rapid Virtualization Indexing \[RVI\]) +* Virtualization extensions (for example, Intel VT-x, AMD RVI) +* I/O memory management unit (IOMMU) chipset virtualization (Intel VT-d or AMD-Vi) +* TPM 2.0 + +#### Trusted Platform Module A TPM is a tamper-resistant cryptographic module designed to enhance the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a personal computer, tablet, or phone. The computing platform is specially designed to work with the TPM to support privacy and security scenarios that cannot be achieved through software alone. A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, a key created in a TPM with the property that it can never be exported from the TPM really means the key cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling reliable report of the software used to start a platform. The functionality a TPM provides includes: + - **Cryptographic key management.** Create, store, and permit the use of keys in defined ways. - **Safeguarding and reporting integrity measurements.** Software used to boot the platform can be recorded in the TPM and used to establish trust in the software running on the platform. - **Prove a TPM is really a TPM.** The TPM’s capabilities are so central to protecting privacy and security that a TPM needs to be able to differentiate itself from malware that masquerades as a TPM. @@ -417,95 +437,112 @@ The functionality a TPM provides includes: Microsoft combined this small list of TPM benefits with Windows 10 and other hardware security technologies to provide practical security and privacy benefits. Among other functions, Windows 10 uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and the many other keys that the TPM is used to generate. Windows 10 also uses the TPM to securely record and protect integrity-related measurements of select hardware and Windows boot components for the [Measured Boot](#measure-boot) feature described later in this document. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the PC’s TPM. From there, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 PC. + Windows 10 supports TPM implementations that comply with either the 1.2 or 2.0 standards. Several improvements have been made in the TPM 2.0 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard was created in the early 2000s, these algorithms were considered cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that may be preferred in certain geographies or industries. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. TPM is usually assumed to be implanted in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 supports both discrete and firmware TPM that complies with the 2.0 standard (1.2 can only be discrete). Windows does not differentiate between discrete and firmware-based solutions because they must meet the same requirements; therefore, any Windows feature that can take advantage of TPM can use either implementation. -**Note**   -Microsoft will not initially require new Windows 10 PCs to include TPM support. Microsoft will require systems to include a TPM 2.0 beginning one year from the launch of Windows 10, however, to give manufacturers enough time to incorporate this critical functionality and to give IT pros enough time to determine which benefits they will leverage. +>[!NOTE]  +>Microsoft will not initially require new Windows 10 PCs to include TPM support. Microsoft will require systems to include a TPM 2.0 beginning one year from the launch of Windows 10, however, to give manufacturers enough time to incorporate this critical functionality and to give IT pros enough time to determine which benefits they will leverage.   Several Windows 10 security features require TPM: -- Virtual smart cards -- Measured Boot -- Health attestation (requires TPM 2.0 or later) -- InstantGo (requires TPM 2.0 or later) +* Virtual smart cards +* Measured Boot +* Health attestation (requires TPM 2.0 or later) +* InstantGo (requires TPM 2.0 or later) Other Windows 10 security features like BitLocker may take advantage of TPM if it is available but do not require it to work. An example of this is Microsoft Passport. All of these features are covered in this document. -**Biometrics** +#### Biometrics You read in the [Windows Hello](#windows-hello) section of this document that Windows 10 has built-in support for biometric hardware. Windows has included some amount of built-in biometric support since the Windows XP operating system, so what’s different about this in Windows 10? + Windows 10 makes biometrics a core security feature. Biometrics is fully integrated into the Windows 10 security components, not just tacked on as an extra part of a larger scheme. This is a big change. Earlier biometric implementations were largely front-end methods to simplify authentication. Under the hood, biometrics was used to access a password, which was then used for authentication behind the scenes. Biometrics may have provided convenience but not necessarily enterprise-grade authentication. + Microsoft has evangelized the importance of enterprise-grade biometric sensors to the OEMs that create Windows PCs and peripherals. Many OEMs already ship systems that have integrated fingerprint sensors and are transitioning from swipe-based to touch-based sensors. Facial-recognition sensors were already available when Windows 10 launched and are becoming more commonplace as integrated system components. + In the future, Microsoft expects OEMs to produce even more enterprise-grade biometric sensors and to continue to integrate them into systems as well as provide separate peripherals. As a result, biometrics will become a commonplace authentication method as part of an MFA system. -**Secure Windows startup** +#### Secure Windows startup UEFI Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the devices, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. -**Trusted Boot** +#### Trusted Boot When UEFI Secure Boot verifies that the bootloader is trusted and starts Windows, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (for example, signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM component. + If a file has been modified (for example, if malware has tampered with it or it has been corrupted), Trusted Boot will detect the problem and automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay. -**Early Launch Antimalware** +#### Early Launch Antimalware Malware that targeted previous versions of Windows often attempted to start before the antimalware solution. To do this, some types of malware would update or replace a non-Microsoft–related driver that starts during the Windows startup process. The malicious driver would then use its system access privileges to modify critical parts of the system and disguise its presence so it could not be detected when the antimalware solution later started. + Early Launch Antimalware (ELAM) is part of the Trusted Boot feature set and is designed to enable the antimalware solution to start before all non-Microsoft drivers and apps. ELAM checks the integrity of non-Microsoft drivers to determine whether the drivers are trustworthy. Because Windows needs to start as fast as possible, ELAM cannot be a complicated process of checking the driver files against known malware signatures; doing so would delay startup too much. Instead, ELAM has the simple task of examining every boot driver and determining whether it is on the list of trusted drivers. If malware modifies a boot-related driver, ELAM will detect the change, and Windows will prevent the driver from starting, thus blocking driver-based rootkits. ELAM also allows the registered antimalware provider to scan drivers that are loaded after the boot process is complete. + The design is simple but effective. ELAM is a component of a full-featured antimalware solution, and it helps prevent malicious drivers and apps from starting before the rest of the antimalware solution starts later during the boot process. Indeed, ELAM runs only for a few seconds each time a PC starts. Windows Defender in Windows 10 supports ELAM, as does Microsoft System Center 2012 Endpoint Protection and several non-Microsoft antimalware apps. + If you want to learn how to configure ELAM, you can use Group Policy settings to configure how ELAM responds to potentially malicious boot drivers. In the Group Policy Management Editor, go to Computer Configuration\\Administrative Templates\\System\\Early Launch Antimalware, and enable the **Boot-Start Driver Initialization Policy** setting. Now, you can select which driver classifications ELAM loads. When you select the **Good Only** setting, it provides the highest level of security, but test it thoroughly to ensure that it does not prevent users with healthy PCs from starting. -### - -**Measured Boot** +#### Measured Boot The biggest challenge with rootkits and bootkits in earlier versions of Windows is that they can frequently be undetectable to the client. Because they often start before Windows defenses and the antimalware solution and they have system-level privileges, rootkits and bootkits can completely disguise themselves while continuing to access system resources. Although UEFI Secure Boot and Trusted Boot can prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (for example, if UEFI with Secure Boot is disabled or if the signature used to sign a boot component, such as a non-Microsoft driver, has been compromised and is used to sign a malicious one). + Windows 10 implements the Measured Boot feature, which uses the TPM hardware component built into newer PCs to record a series of measurements for critical startup-related components, including firmware, Windows boot components, drivers, and even the ELAM driver. Because Measured Boot leverages the hardware-based security capabilities of TPM, which isolates and protects the measurement data from malware attacks, the log data is well protected against even sophisticated attacks. Measured Boot focuses on acquiring the measurement data and protecting it from tampering. It must be coupled with a service that can analyze the data to determine device health and provide a more complete security service. The next section introduces just such a service. -**Verify device compliance for conditional access to corporate resources** +#### Verify device compliance for conditional access to corporate resources Measured Boot itself does not prevent malware from loading during the startup process – that is the job of Secure Boot, Device Guard, and ELAM. Instead, Measured Boot provides a TPM-protected audit log that allows a trusted remote health attestation service to evaluate the PC’s startup components, state, and overall configuration. If the health attestation service detects that the PC loaded an untrustworthy component and is therefore out of compliance, the service can block the PC’s access to specific network resources or the entire network. You can even couple a health attestation service with a management system to facilitate conditional access capabilities that can initiate the quarantine and remediation processes to fix an infected PC and return it to a compliant state. -![figure 3](images/security-fig3-healthattestation.png) +![Health Attestation in Windows 10](images/security-fig3-healthattestation.png "Health Attestation in Windows 10") Figure 3. Health Attestation in Windows 10 Figure 3 illustrates the following process for device compliance verification and conditional access implementation: 1. The PC uses the TPM to record measurements of the bootloader, boot drivers, and ELAM driver. The TPM prevents anyone from tampering with these measurements, so even if malware is successfully loaded, it will not be able to modify the measurements. These measurements are signed with an Attestation Identity Key (AIK) that is stored in the TPM. Because the TPM hardware has signed the measurements, malware cannot modify them without being detected. + 2. Health Attestation is not enabled by default and requires an enrollment with a mobile device management (MDM) server in order to enable it. If it is enabled, the health attestation client will contact a remote server, called a health attestation server. Microsoft provides a cloud-based Windows Health Attestation service that can help evaluate the health of a device. The health attestation client sends the signed measurements, the device’s TPM boot log, and an AIK certificate (if present), which lets the health attestation server verify that the key used to sign the measurements was issued to a trusted TPM. + 3. The health attestation server analyzes the measurements and boot log and creates a statement of device health. This statement is encrypted to help ensure the confidentiality of the data. + 4. A management system, such as an MDM server, can request that an enrolled device present a statement of device health. Windows 10 supports both Microsoft and non-Microsoft MDM server requests for device health. To prevent theft of device health statements and reuse from other devices, an MDM server sends the enrolled device a “number used only once” (nonce) request along with this request for the device health statement. + 5. The enrolled device digitally signs the nonce with its AIK (which is stored in the TPM) and sends the MDM server the encrypted statement of device health, the digitally signed nonce, and a signed boot counter, which asserts that the device has not been restarted since it obtained the statement of health. + 6. The MDM server can send the same data to the health attestation server. The server decrypts the statement of health, asserts that the boot counter in the statement matches the boot counter that was sent to the MDM server, and compiles a list of health attributes. + 7. The health attestation server sends this list of health attributes back to the MDM server. The MDM server now enforces access and compliance policies if configured to do so. + For a list of data points that the health attestation server verifies, along with a description of the data, see the [HealthAttestation CSP article on MSDN](http://go.microsoft.com/fwlink/p/?LinkId=626940). + The management system’s implementation determines which attributes within the statement of device health are evaluated when assessing a device’s health. Broadly speaking, the management server receives information about how the device booted, what kind of policy is enforced on the device, and how data on the device is secured. Depending on the implementation, the management server may add checks that go beyond what the statement of device health provides—for example, Windows patch level and other device attributes. + Based on these data points, the management server can determine whether the client is healthy and grant it access to either a limited quarantine network or to the full network. Individual network resources, such as servers, can also grant or deny access based on whether the remote attestation client were able to retrieve a valid health certification from the remote attestation server. + Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider the implementation of a management system, like Microsoft Intune, or any management solutions that take advantage of the Windows 10 cloud-based Health Attestation Server feature to detect and block devices that have been infected with advanced malware from network resources. -## Secure the Windows core +### Secure the Windows core Applications built for Windows are designed to be secure and free of defects, but the reality is that as long as human beings are writing code, vulnerabilities will continue to crop up. When identified, malicious users and software may attempt to exploit vulnerabilities by manipulating data in memory in the hope that they can bootstrap a successful exploit. + To mitigate these risks, Windows 10 includes core improvements to make it more difficult for malware to perform buffer overflow, heap spraying, and other low-level attacks and even which code is allowed to run on the PC. In addition, these improvements dramatically reduce the likelihood that newly discovered vulnerabilities result in a successful exploit. It takes detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level. -### - -**Device Guard** +#### Device Guard Today’s security threat landscape is more aggressive than ever before. Modern malicious attacks are focused on revenue generation, intellectual property theft, and targeted system degradation resulting in financial loss. Many of these nefarious attackers are sponsored by nation states that have ulterior motives and large cyber-terrorism budgets. These threats can enter a company through something as simple as an email and can permanently damage the organization’s reputation for securing employee and customer data and intellectual property, not to mention having a significant financial impact. The Windows 10 operating system introduces several new security features that help mitigate a large percentage of today’s known threats. It is estimated that more than 300,000 new malware variants are discovered daily. Unfortunately, companies currently use an ancient method to discover this infectious software and prevent its use. In fact, current PCs trust everything that runs until antimalware signatures determine whether a threat exists; then, the antimalware software attempts to clean the PC, often after the malicious software’s effect has already occurred. This signature-based system focuses on reacting to an infection and then ensuring that that particular infection does not happen again. In this model, the system that drives malware detection relies on the discovery of malicious software; only then can a signature be provided to the client to remediate it, which implies that a computer has often already been infected. The time between detection of the malware and a client being issued a signature could mean the difference between losing data and staying safe. In addition to antimalware solutions, “app control” or “whitelisting” technologies are available, including AppLocker. These perform single-instance or blanket allow or deny rules for running applications. In Windows 10, these types of solutions are most effective when deployed alongside the Windows 10 Device Guard feature. + Device Guard breaks the current model of detection first-block later and allows only trusted applications to run, period. This methodology is consistent with the successful prevention strategy for mobile phone security. With Device Guard, Microsoft has changed how the Windows operating system handles untrusted applications, which makes its defenses difficult for malware to penetrate. This new prevention versus detection model will provide Windows clients with the necessary security for modern threats and, when implemented, mitigates many of today’s threats from day one. -**Device Guard overview** +#### Device Guard overview Device Guard is a feature set that consists of both hardware and software system integrity hardening features. These features revolutionize the Windows operating system’s security by taking advantage of new VBS options to protect the system core and the processes and drivers running in kernel mode—the trust-nothing model you see in mobile device operating systems. A key feature used with Device Guard is *configurable code integrity*, which allows your organization to choose exactly which software from trusted software publishers is allowed to run code on your client machines—exactly what has made mobile phone security on some platforms, such as Windows Mobile, so successful. Trusted applications are those signed directly (in other words, binaries) or indirectly by using a signed file that lists the hash values for application binaries that are considered trustworthy. In addition, Device Guard offers organizations a way to sign existing LOB applications so that they can trust their own code without the requirement that the application be rebuilt or packaged. Also, this same method of signing can provide organizations a way to trust non-Microsoft applications, including those that may not have been signed directly. Device Guard with configurable code integrity, Credential Guard, and AppLocker present the most complete security defense that any Microsoft product has ever been able to offer a Windows client. @@ -525,7 +562,7 @@ To deliver this additional security, Device Guard has the following hardware and Along with these new features, some components of Device Guard are existing tools or technologies that have been included in this strategic security offering to provide customers with the most secure Windows operating system possible. Device Guard is intended as a set of client security features to be used in conjunction with the other threat-resistance features available in the Windows operating system, some of which are mentioned in this guide. -**Configurable code integrity** +#### Configurable code integrity The Windows operating system consists of two operating modes: user mode and kernel mode. The base of the operating system runs within the kernel mode, which is where the Windows operating system directly interfaces with hardware resources. User mode is primarily responsible for running applications and brokering information to and from the kernel mode for hardware resource requests. For example, when an application running in user mode needs additional memory, the user mode process must request the resources from the kernel, not directly from RAM. @@ -533,33 +570,32 @@ Code integrity is the component of the Windows operating system that verifies th Historically, most malware has been unsigned. Simply by deploying code integrity policies, organizations will immediately protect themselves against unsigned malware, which is estimated to be responsible for the vast majority of current attacks. By using code integrity policies, an enterprise can also select exactly which binaries are allowed to run in both user mode and kernel mode based on the signer, binary hash, or both. When completely enforced, it makes user mode in Windows function like some mobile platforms, trusting and running only specific applications or specific signatures. This feature alone fundamentally changes security in an enterprise. This additional security is *not* limited to Windows apps and does *not* require an application rewrite to be compatible with your existing and possibly unsigned applications. You can run configurable code integrity independent of Device Guard, thus making it available to devices that don’t meet Device Guard hardware requirements. -**Hardware security features and VBS** +#### Hardware security features and VBS The core functionality and protection of Device Guard starts at the hardware level. Devices that have processors equipped with SLAT technologies and virtualization extensions, such as Intel VT x and AMD V, will be able to take advantage of a VBS environment that dramatically enhances Windows security by isolating critical Windows services from the operating system itself. This isolation is necessary, because you must assume that the operating system kernel will be compromised, and you need assurance that some processes will remain secure. -Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to protect all kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can’t happen in the first place. +Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can't happen in the first place. + Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard protects credentials by running the Windows authentication service known as LSA, and then storing the user’s derived credentials (for example, NTLM hashes; Kerberos tickets) within the same VBS environment that Device Guard uses to protect its HVCI service. By isolating the LSA service and the user’s derived credentials from both user mode and kernel mode, an attacker that has compromised the operating system core will still be unable to tamper with authentication or access derived credential data. Credential Guard prevents pass-the-hash and ticket types of attacks, which are central to the success of nearly every major network breach you’ve read about, which makes Credential Guard one of the most impactful and important features to deploy within your environment. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#dgwithcg) section. -**Device Guard with AppLocker** +#### Device Guard with AppLocker Although AppLocker is not considered a new Device Guard feature, you can use it to complement configurable code integrity functionality when enforced code integrity cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which you could use code integrity policies alongside AppLocker rules. As a best practice, enforce code integrity policies at the most restrictive level possible for your organization, and then use AppLocker to fine-tune the restrictions to an even lower level. -**Note**   -One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit which universal applications from the Windows Store users can install on a device. Microsoft has already validated universal applications from the Windows Store as trustworthy to run, but an organization may not want to allow specific universal applications to run in its environment. You could use an AppLocker rule to enforce such a stance. +>[!NOTE]   +>One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit which universal applications from the Windows Store users can install on a device. Microsoft has already validated universal applications from the Windows Store as trustworthy to run, but an organization may not want to allow specific universal applications to run in its environment. You could use an AppLocker rule to enforce such a stance. In another example, you could enable a configurable code integrity policy to allow users to run all the apps from a specific publisher. To do so, you would add the publisher’s signature to the policy. If your organization decides that only specific apps from that publisher should be allowed to run, you would add the signature for the publisher to the configurable code integrity policy, and then use AppLocker to determine which specific apps can run.   AppLocker and Device Guard can run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, Microsoft recommends that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. -### - -**Device Guard with Credential Guard** +#### Device Guard with Credential Guard Although Credential Guard isn’t a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against derived credential theft. Similar to virtualization-based protection of kernel mode through the Device Guard HVCI service, Credential Guard leverages hypervisor technology to protect the Windows authentication service (the LSA) and users’ derived credentials. This mitigation is targeted at preventing the use of pass-the-hash and pass-the-ticket techniques. Because Credential Guard uses VBS, it is decisive in its ability to prevent pass-the-hash and pass-the-ticket attacks from occurring on Windows 10 devices. Microsoft recognizes, however, that most organizations will have a blend of Windows versions running in their environments. Mitigations for devices not capable of running Credential Guard on both the client side and the server side are available to help with this scenario. Microsoft will be releasing details to TechNet regarding these additional mitigations in the near future. -**Unified manageability through Device Guard** +#### Unified manageability through Device Guard You can easily manage Device Guard features through the familiar enterprise and client-management tools that IT pros use every day. Use the following management tools to enable and manage Device Guard: - **Group Policy.**Windows 10 provides an administrative template that you can use to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings with your existing Group Policy objects, which makes it simple to implement Device Guard features. In addition to the code integrity and hardware-based security features, Group Policy can help you manage your catalog files. @@ -568,19 +604,19 @@ You can easily manage Device Guard features through the familiar enterprise and - **Windows PowerShell.** You use Windows PowerShell primarily to create and service code integrity policies. These policies represent the most impactful component of Device Guard. These options provide the same experience you’re used to for management of your existing enterprise management solutions. -**Address Space Layout Randomization** +#### Address Space Layout Randomization One of the most common techniques used to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data have been placed, and then overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 4 illustrates how ASLR works by showing how the locations of different critical Windows components can change in memory between restarts. -![image 4](images/security-fig4-aslr.png) +![ASLR at work](images/security-fig4-aslr.png "ASLR at work") Figure 4. ASLR at work Although the ASLR implementation in Windows 7 was effective, it wasn’t applied holistically across the operating system, and the level of entropy (cryptographic randomization) wasn’t always at the highest possible level. To decrease the likelihood that sophisticated attacks such as heap spraying could succeed in the Windows 8 operating system, Microsoft applied ASLR holistically across the system and increased the level of entropy many times. The ASLR implementation in Windows 8 and Windows 10 is greatly improved over Windows 7, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, which makes it even more difficult for malware to predict where Windows 10 stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, which makes it even more difficult for a successful exploit that works on one system to work reliably on another. -**Data Execution Prevention** +#### Data Execution Prevention Malware depends on its ability to put a malicious payload into memory with the hope that it will be executed later, and ASLR will make that much more difficult. Wouldn’t it be great if you could prevent malware from running if it wrote to an area that has been allocated solely for the storage of information? @@ -597,11 +633,11 @@ If you want to see which apps use DEP, complete these steps: You can now see which processes have DEP enabled. Figure 5 shows the processes running on a Windows 10 PC with a single process that does not support DEP. -![figure 5](images/security-fig5-dep.png) +![Processes with DEP enabled in Windows 10](images/security-fig5-dep.png "Processes with DEP enabled in Windows 10") Figure 5. Processes on which DEP has been enabled in Windows 10 -**Windows Heap** +#### Windows Heap The *heap* is a location in memory that Windows uses to store dynamic application data. Windows 10 continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that could be used as part of an attack. @@ -612,17 +648,19 @@ Windows 10 has several important improvements to the security of the heap over Windows 10 resolves known heap attacks that could be used to compromise a PC running previous versions of Windows. -**Memory reservations** +#### Memory reservations The lowest 64 KB of process memory is reserved for the system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory. -**Control Flow Guard** +#### Control Flow Guard When applications are loaded into memory, they are allocated space based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships between the code locations are well known—they are written in the code itself—but previous to Windows 10, the flow between these locations was not enforced, which gives attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. + This kind of threat is mitigated in Windows 10 through the Control Flow Guard (CFG) feature. When a trusted application that was compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If the location is not trusted, the application is immediately terminated as a potential security risk. + An administrator cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when the application is compiled. Administrators should consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. Of course, browsers are a key entry point for attacks; thus Microsoft Edge, IE, and other Windows features take full advantage of CFG. -**Protected Processes** +#### Protected Processes Benjamin Franklin once said that "an ounce of prevention is worth a pound of cure." His wisdom directly applies to PC security. Most security controls are designed to prevent the initial infection point. The reasoning is that if malware cannot infect the system, the system is immune to malware. @@ -632,12 +670,12 @@ The key security scenario is to assume that malware is running on a system but l With Protected Processes, Windows 10 prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes. Less trusted processes are prevented from interacting with and therefore attacking more trusted processes. Windows 10 uses Protected Processes more broadly across the operating system, and for the first time, you can put antimalware solutions into the protected process space, which helps make the system and antimalware solutions less susceptible to tampering by malware that does manage to get on the system. -## Secure the Windows desktop +### Secure the Windows desktop -Windows 10 includes critical improvements to the Windows core and the desktop environment, where attacks and malware most frequently enter. The desktop environment is now more resistant to malware thanks to significant improvements to Windows Defender and SmartScreen Filters. Internet browsing is a safer experience because of Microsoft Edge, a completely new browser. The Windows Store reduces the likelihood that malware will infect devices by ensuring that all applications that enter the Windows Store ecosystem have been thoroughly reviewed before being made available. Universal Windows applications are inherently more secure than typical applications because they are sandboxed. Sandboxing restricts the application’s risk of being compromised or tampered with in a way that would put the system, data, and other applications at risk. +Windows 10 includes critical improvements to the Windows core and the desktop environment, where attacks and malware most frequently enter. The desktop environment is now more resistant to malware thanks to significant improvements to Windows Defender and SmartScreen Filters. Internet browsing is a safer experience because of Microsoft Edge, a completely new browser. The Windows Store reduces the likelihood that malware will infect devices by ensuring that all applications that enter the Windows Store ecosystem have been thoroughly reviewed before being made available. Universal Windows apps are inherently more secure than typical applications because they are sandboxed. Sandboxing restricts the application’s risk of being compromised or tampered with in a way that would put the system, data, and other applications at risk. The sections that follow describe Windows 10 improvements to application security in more detail. -**Microsoft Edge and Internet Explorer 11** +### Microsoft Edge and Internet Explorer 11 Browser security is a critical component of any security strategy, and for good reason: The browser is the user’s interface to the Internet, an environment that is quite literally overwhelmed with malicious sites and content waiting to attack. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. @@ -652,45 +690,49 @@ Microsoft includes an entirely new browser, Microsoft Edge, in Windows 10. Micr In addition to Microsoft Edge, Microsoft includes IE11 in Windows 10 primarily for backwards-compatibility with websites and binary extensions that do not work with Microsoft Edge. It should not be configured as the primary browser but rather as an optional or automatic switchover, as shown in Figure 6. -![figure 6](images/security-fig6-edge2.png) +![Configure Windows 10 for backwards-compatibility with IE11](images/security-fig6-edge2.png "Configure Windows 10 for backwards-compatibility with IE11") Figure 6. Configure Windows 10 to switch from Microsoft Edge to IE11 for backwards-compatibility. Microsoft’s recommendation is to use Microsoft Edge as the primary web browser because it provides compatibility with the modern web and the best possible security. For sites that require IE11 compatibility, including those that require binary extensions and plug ins, enable Enterprise mode and use the Enterprise Mode Site List to define which sites have the dependency. When configured, when users use Microsoft Edge and it identifies a site that requires IE11, they will automatically be switched to IE11. -**The SmartScreen Filter** +### The SmartScreen Filter Recent versions of Windows have many effective techniques to prevent malware from installing itself without the user’s knowledge. To work around those restrictions, malware attacks often use social engineering techniques to trick users into running software. For example, malware known as a Trojan horse pretends to be something useful, such as a utility, but carries an additional, malicious payload. + Starting with Windows Internet Explorer 8, the SmartScreen Filter has helped protect users from both malicious applications and nefarious websites by using the SmartScreen Filter’s application and URL reputation services. The SmartScreen Filter in Internet Explorer would check URLs and newly downloaded apps against an online reputation service that Microsoft maintained. If the app or URL were not known to be safe, SmartScreen Filter would warn the user or even prevent the app or URL from loading, depending on how systems administrators had configured Group Policy settings. + For Windows 10, Microsoft further developed the SmartScreen Filter by integrating its app reputation abilities into the operating system itself, which allows the filter to protect users regardless of the web browser they are using or the path that the app uses to arrive on the device (for example, email, USB flash drive). The first time a user runs an app that originates from the Internet, even if the user copied it from another PC, the SmartScreen Filter checks the reputation of the application by using digital signatures and other factors against a service that Microsoft maintains. If the app lacks a reputation or is known to be malicious, the SmartScreen Filter warns the user or blocks execution entirely, depending on how the administrator has configured Group Policy (see Figure 7). -![figure 7](images/security-fig7-smartscreenfilter.png) +![SmartScreen Filter at work in Windows 10](images/security-fig7-smartscreenfilter.png "SmartScreen Filter at work in Windows 10") Figure 7. The SmartScreen Filter at work in Windows 10 By default, users have the option to bypass SmartScreen Filter protection so that it will not prevent a user from running a legitimate app. You can use Control Panel or Group Policy settings to disable the SmartScreen Filter or to completely prevent users from running apps that the SmartScreen Filter does not recognize. The Control Panel settings are shown in Figure 8. -![figure 8](images/security-fig8-smartscreenconfig.png) +![SmartScreen configuration options](images/security-fig8-smartscreenconfig.png "SmartScreen configuration options") Figure 8. The Windows SmartScreen configuration options in Control Panel -If you want to try the SmartScreen Filter, use Windows 7 to download this simulated (but not dangerous) malware file:[freevideo.exe](http://go.microsoft.com/fwlink/p/?LinkId=626943). Save it to your computer, and then run it from Windows Explorer. As shown in Figure 9, Windows runs the app without much warning. In Windows 7, you might receive a warning message about the app not having a certificate, but you can easily bypass it. +If you want to try the SmartScreen Filter, use Windows 7 to download this simulated (but not dangerous) malware file:[freevideo.exe](https://go.microsoft.com/fwlink/p/?LinkId=626943). Save it to your computer, and then run it from Windows Explorer. As shown in Figure 9, Windows runs the app without much warning. In Windows 7, you might receive a warning message about the app not having a certificate, but you can easily bypass it. -![figure 9](images/security-fig9-windows7allow.png) +![Windows 7 allows the app to run](images/security-fig9-windows7allow.png "Windows 7 allows the app to run") Figure 9. Windows 7 allows the app to run Now, repeat the test on a computer running Windows 10 by copying the file to a Windows 10 PC or by downloading the file again and saving it to your local computer. Run the file directly from File Explorer, and the SmartScreen Filter will warn you before it allows it to run. Microsoft’s data shows that for a vast majority of users, that extra warning is enough to save them from a malware infection. -**Universal Windows apps** +### Universal Windows apps The good news is that the download and use of Universal Windows apps or even Windows Classic applications (Win32) from the Windows Store will dramatically reduce the likelihood that you encounter malware on your PC because all apps go through a careful screening process before being made available in the store. Apps that organizations build and distribute through sideloading processes will need to be reviewed internally to ensure that they meet organizational security requirements. Regardless of how users acquire Universal Windows apps, they can use them with increased confidence. Unlike Windows Classic applications, which can run with elevated privileges and have potentially sweeping access to the system and data, Universal Windows apps run in an AppContainer sandbox with limited privileges and capabilities. For example, Universal Windows apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. + In addition, all Universal Windows apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is severely limited and should be contained within the sandbox. The Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. + In the end, the Windows Store app distribution process and the app sandboxing capabilities of Windows 10 will dramatically reduce the likelihood that users encounter malicious apps on the system. -**Windows Defender** +### Windows Defender Antimalware software, also generically called virus scanners, antivirus, and a host of other names, has been around for a long time. Microsoft shipped its first program in this category, Microsoft Anti-Virus, in 1993 for MS DOS 6.0. At the time, the approach of running a standalone MS DOS program to locate and remove viruses was sufficient. @@ -719,9 +761,9 @@ Figure 10. Windows Defender opt-in settings in Windows 10 Of course, system administrators have centralized control of all Windows Defender settings through Group Policy. The Windows Defender configuration settings are shown under Computer Configuration/Windows Components/Windows Defender, as shown in Figure 11. -![figure 11](images/security-fig11-defendersettings.png) +![Windows Defender settings in Group Policy](images/security-fig11-defendersettings.png "Windows Defender settings in Group Policy") -Figure 11. Windows Defender settings in Group Policy– the sample submission options are listed under MAPS +Figure 11. Windows Defender settings in Group Policy – the sample submission options are listed under MAPS **Tamper proofing** is the safeguarding of Windows Defender itself against malware attacks. Malware creators assume that antimalware software is implemented on most PCs. Many malware creators choose to overcome that obstacle by designing malware that modifies the antimalware software in some way, such as disabling real-time scanning or by hiding specific processes. Some malware goes as far as completely disabling the antimalware software while making it appear fully functional to the user. @@ -729,11 +771,12 @@ Windows Defender is designed to resist tampering; it uses several security techn **Empowerment of IT security professionals** means that Windows Defender gives IT pros the tools and configuration options necessary to make it an enterprise-class antimalware solution. It has numerous enterprise-level features that put it on par with the top products in this category: -- Integration with centralized management software, including Microsoft Intune, System Center Configuration Manager, and Microsoft System Center Operations Manager. Unlike Windows 8.1, no additional client is necessary, because Windows Defender is now integrated into Windows and only a management layer needs to be added. -- Windows Defender supports the Open Mobile Alliance Device Management standard for centralized management by many non-Microsoft device management solutions. -- It includes integrated classic command-line and Windows PowerShell cmdlet support. -- Support for Windows Management Instrumentation reporting and application management is built in. -- Full integration with Group Policy offers complete IT configuration management. + +* Integration with centralized management software, including Microsoft Intune, System Center Configuration Manager, and Microsoft System Center Operations Manager. Unlike Windows 8.1, no additional client is necessary, because Windows Defender is now integrated into Windows and only a management layer needs to be added. +* Windows Defender supports the Open Mobile Alliance Device Management standard for centralized management by many non-Microsoft device management solutions. +* It includes integrated classic command-line and Windows PowerShell cmdlet support. +* Support for Windows Management Instrumentation reporting and application management is built in. +* Full integration with Group Policy offers complete IT configuration management. In addition, Windows Defender now integrates the Windows Defender Offline Tool, which formerly required the creation of a bootable, standalone version of Windows Defender into the Windows Recovery Environment. This simplifies the process of remediating low-level malware infections, which may prove difficult to detect and remove with the antimalware solution running on the Windows desktop. You can update signatures for this environment automatically from within the Windows Defender Offline experience. @@ -746,16 +789,16 @@ Another security threat that customers face particularly in consumer and bring y Whenever non-Microsoft real-time protection is in an inoperable state (for example, disabled, expired) for 24 hours, Windows Defender automatically turns on to ensure that the device is protected. Windows attempts to help the user remediate the issue with the non-Microsoft antimalware solution by notifying him or her as early as 5 days before the software expires. If the solution expires, Windows enables Windows Defender and continues to remind the user to renew the non-Microsoft solution. When the user updates or reactivates the solution, Windows Defender is automatically disabled. In the end, the goal is to make sure that an operable antimalware solution is running at all times. -## Conclusion +#### Conclusion Windows 10 is the culmination of many years of effort from Microsoft, and its impact from a security perspective will be significant. Many of us still remember the years of Windows XP, when the attacks on the Windows operating system, applications, and data increased in volume and matured into serious threats. With the existing platforms and security solutions that you’ve likely deployed, you’re better defended than ever. But as attackers have become more advanced, there is no doubt that they have exceeded your ability to defend your organization and users. Evidence of this fact can be found in the news virtually every day as yet another major organization falls victim. Microsoft specifically designed Windows 10 to address these modern threats and tactics from the most advanced adversaries. It can truly change the game for your organization, and it can restore your advantage against those would like to make you their next victim. ## Related topics -[Windows 10 Specifications](http://go.microsoft.com/fwlink/p/?LinkId=625077 ) +[Windows 10 Specifications](https://go.microsoft.com/fwlink/p/?LinkId=625077 ) -[HealthAttestation CSP](http://go.microsoft.com/fwlink/p/?LinkId=626940 ) +[HealthAttestation CSP](https://go.microsoft.com/fwlink/p/?LinkId=626940 ) -[Making Windows 10 More Personal and More Secure with Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=626945) +[Making Windows 10 More Personal and More Secure with Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=626945) [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index bae239bf1c..4d3345f8a1 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -8,18 +8,21 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Windows Defender Advanced Threat Protection **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) +>For more info about Windows 10 Enterprise Edition features and functionality, see [Windows 10 Enterprise edition](https://www.microsoft.com/WindowsForBusiness/buy). -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service, built into Windows 10 that enables enterprise customers detect, investigate, and respond to advanced threats on their networks. +Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service that enables enterprise customers to detect, investigate, and respond to advanced threats on their networks. Windows Defender ATP uses the following combination of technology built into Windows 10 and Microsoft's robust cloud service: @@ -63,7 +66,7 @@ detect sophisticated cyber-attacks, providing: - Behavior-based, cloud-powered, advanced attack detection - Finds the attacks that made it past all other defenses (post breach detection),provides actionable, correlated alerts for known and unknown adversaries trying to hide their activities on endpoints. + Finds the attacks that made it past all other defenses (post breach detection), provides actionable, correlated alerts for known and unknown adversaries trying to hide their activities on endpoints. - Rich timeline for forensic investigation and mitigation @@ -78,10 +81,12 @@ detect sophisticated cyber-attacks, providing: Topic | Description :---|:--- [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender ATP such as network and data storage configuration, and endpoint hardware and software requirements, and deployment channels. -[Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)| Learn about how Windows Defender ATP collects and handles information and where data is stored. +[Assign user access to the Windows Defender ATP portal](assign-portal-access-windows-defender-advanced-threat-protection.md)| Before users can access the portal, they'll need to be granted specific roles in Azure Active Directory. +[Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. [Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise. [Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. [Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP. [Review events and errors on endpoints with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)| Review events and errors associated with event IDs to determine if further troubleshooting steps are required. +[Windows Defender compatibility](defender-compatibility-windows-defender-advanced-threat-protection.md) | Learn about how Windows Defender works in conjunction with Windows Defender ATP. diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md new file mode 100644 index 0000000000..8abf7c0806 --- /dev/null +++ b/windows/keep-secure/windows-defender-block-at-first-sight.md @@ -0,0 +1,127 @@ +--- +title: Enable the Block at First Sight feature to detect malware within seconds +description: In Windows 10 the Block at First Sight feature determines and blocks new malware variants in seconds. You can enable the feature with Group Policy. +keywords: scan, BAFS, malware, first seen, first sight, cloud, MAPS, defender +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +--- + +# Block at First Sight + +**Applies to** + +- Windows 10, version 1607 + +**Audience** + +- Network administrators + +Block at First Sight is a feature of Windows Defender cloud protection that provides a way to detect and block new malware within seconds. + +It is enabled by default when certain pre-requisite settings are also enabled. In most cases, these pre-requisite settings are also enabled by default, so the feature is running without any intervention. + +## How it works + +When a Windows Defender client encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean. + +If the cloud backend is unable to make a determination, the file will be locked by Windows Defender while a copy is uploaded to the cloud. Only after the cloud has received the file will Windows Defender release the lock and let the file run. The cloud will perform additional analysis to reach a determination, blocking all future encounters of that file. + +In many cases this process can reduce the response time to new malware from hours to seconds. + +> [!NOTE] +> Suspicious file downloads requiring additional backend processing to reach a determination will be locked by Windows Defender on the first machine where the file is encountered, until it is finished uploading to the backend. Users will see a longer "Running security scan" message in the browser while the file is being uploaded. This might result in what appear to be slower download times for some files. + + +## Confirm Block at First Sight is enabled + +Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work. Usually, these settings are already enabled in most default Windows Defender deployments in enterprise networks. + +> [!IMPORTANT] +> There is no specific individual setting in System Center Configuration Manager to enable Block at First Sight. It is enabled by default when the pre-requisite settings are configured correctly. + +### Confirm Block at First Sight is enabled with Group Policy + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender > MAPS** and configure the following Group Policies: + + 1. Double-click the **Join Microsoft MAPS** setting and ensure the option is set to **Enabled**. Click **OK**. + + 1. Double-click the **Send file samples when further analysis is required** setting and ensure the option is set to **Enabled** and the additional options are either of the following: + + 1. Send safe samples (1) + + 1. Send all samples (3) + + > [!WARNING] + > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature will not function. + + 1. Click **OK**. + +1. In the **Group Policy Management Editor**, expand the tree to **Windows components > Windows Defender > Real-time Protection**: + + 1. Double-click the **Scan all downloaded files and attachments** setting and ensure the option is set to **Enabled**. Click **OK**. + + 1. Double-click the **Turn off real-time protection** setting and ensure the option is set to **Disabled**. Click **OK**. + +If you had to change any of the settings, you should re-deploy the Group Policy Object across your network to ensure all endpoints are covered. + + +### Confirm Block at First Sight is enabled with Windows Settings + +> [!NOTE] +> If the pre-requisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. + +You can confirm that Block at First Sight is enabled in Windows Settings. The feature is automatically enabled, as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. + +**Confirm Block at First Sight is enabled on individual clients** + +1. Open Windows Defender settings: + + a. Open the Windows Defender app and click **Settings**. + + b. On the main Windows Settings page, click **Update & Security** and then **Windows Defender**. + +2. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. + +## Disable Block at First Sight + +> [!WARNING] +> Disabling the Block at First Sight feature will lower the protection state of the endpoint and your network. + +> [!NOTE] +> You cannot disable Block at First Sight with System Center Configuration Manager + +You may choose to disable the Block at First Sight feature if you want to retain the pre-requisite settings without using Block at First Sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network. + +**Disable Block at First Sight with Group Policy** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree through **Windows components > Windows Defender > MAPS**. + +1. Double-click the **Configure the ‘Block at First Sight’ feature** setting and set the option to **Disabled**. + + > [!NOTE] + > Disabling the Block at First Sight feature will not disable or alter the pre-requisite group policies. + + +## Related topics + +- [Windows Defender in Windows 10](windows-defender-in-windows-10.md) + + diff --git a/windows/keep-secure/windows-defender-enhanced-notifications.md b/windows/keep-secure/windows-defender-enhanced-notifications.md new file mode 100644 index 0000000000..e70fede4fd --- /dev/null +++ b/windows/keep-secure/windows-defender-enhanced-notifications.md @@ -0,0 +1,46 @@ +--- +title: Configure enhanced notifications for Windows Defender +description: In Windows 10, you can enable advanced notifications for endpoints throughout your enterprise network. +keywords: notifications, defender, endpoint, management, admin +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +--- + +# Configure enhanced notifications for Windows Defender in Windows 10 + +**Applies to:** + +- Windows 10, version 1607 + +In Windows 10, application notifications about malware detection and remediation by Windows Defender are more robust, consistent, and concise. + +Notifications will appear on endpoints when manually triggered and scheduled scans are completed and threats are detected. These notifications will also be seen in the **Notification Center**, and a summary of scans and threat detections will also appear at regular time intervals. + +You can enable and disable enhanced notifications in Windows Settings. + +## Disable notifications + +You can disable enhanced notifications on individual endpoints in Windows Settings. + +**Use Windows Settings to disable enhanced notifications on individual endpoints** + +1. Open the **Start** menu and click or type **Settings**. + +1. Click **Update & Security** and then **Windows Defender**. Scroll to the bottom of the settings page until you see the **Enhanced notifications** section. + +1. Toggle the setting between **On** and **Off**. + +![Windows Defender enhanced notifications](images/defender/enhanced-notifications.png) + + + + +## Related topics + +- [Windows Defender in Windows 10](windows-defender-in-windows-10.md) diff --git a/windows/keep-secure/windows-defender-in-windows-10.md b/windows/keep-secure/windows-defender-in-windows-10.md index 0f5d4d28f0..7ad3e53061 100644 --- a/windows/keep-secure/windows-defender-in-windows-10.md +++ b/windows/keep-secure/windows-defender-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: jasesso --- @@ -31,6 +32,23 @@ Windows Defender provides the most protection when cloud-based protection is ena - Reports and report management When you enable endpoint protection for your clients, it will install an additional management layer on Windows Defender to manage the in-box Windows Defender agent. While the client user interface will still appear as Windows Defender, the management layer for Endpoint Protection will be listed in the **Add/Remove Programs** control panel, though it will appear as if the full product is installed. + + +### Compatibility with Windows Defender Advanced Threat Protection + +Windows Defender Advanced Threat Protection (ATP) is an additional service that helps enterprises to detect, investigate, and respond to advanced persistent threats on their network. + +See the [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) topics for more information about the service. + +If you are enrolled in Windows Defender ATP, and you are not using Windows Defender as your real-time protection service on your endpoints, Windows Defender will automatically enter into a passive mode. + +In passive mode, Windows Defender will continue to run (using the *msmpeng.exe* process), and will continue to be updated, however there will be no Windows Defender user interface, scheduled scans won’t run, and Windows Defender will not provide real-time protection from malware. + +You can [configure updates for Windows Defender](configure-windows-defender-in-windows-10.md), however you can't move Windows Defender into the normal active mode if your endpoints have an up-to-date third-party product providing real-time protection from malware. + +If you uninstall the other product, and choose to use Windows Defender to provide protection to your endpoints, Windows Defender will automatically return to its normal active mode. + +   ### Minimum system requirements @@ -48,37 +66,14 @@ For more information about what's new in Windows Defender in Windows 10, see [W ## In this section - ---- - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md)

    IT professionals can manage Windows Defender on Windows 10 endpoints in their organization using Active Directory or WSUS, apply updates to endpoints, and manage scans using:

    -
      -
    • Group Policy Settings
      • -
    • Windows Management Instrumentation (WMI)
      • -
    • PowerShell
      • -

    [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md)

    IT professionals can configure definition updates and cloud-based protection in Windows Defender in Windows 10 through Active Directory and WSUS.

    [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md)

    IT professionals can review information about event IDs in Windows Defender for Windows 10 and see any relevant action they can take.

    -  -  -  +Topic | Description +:---|:--- +[Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md)|Use Active Directory or Windows Server Update Services to manage and deploy updates to endpoints on your network. Configure and run special scans, including archive and email scans. +[Configure updates for Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md)|Configure definition updates and cloud-based protection with Active Directory and Windows Server Update Services. +[Windows Defender Offline in Windows 10](windows-defender-offline.md)|Manually run an offline scan directly from winthin Windows without having to download and create bootable media. +[Use PowerShell cmdlets for Windows Defender](use-powershell-cmdlets-windows-defender-for-windows-10.md)|Run scans and configure Windows Defender options with Windows PowerShell cmdlets in Windows 10. +[Enable the Block at First Sight feature in Windows 10](windows-defender-block-at-first-sight.md)|Use the Block at First Sight feature to leverage the Windows Defender cloud. +[Configure enhanced notifications for Windows Defender in Windows 10](windows-defender-enhanced-notifications.md)|Enable or disable enhanced notifications on endpoints running Windows Defender for greater details about threat detections and removal. +[Run a Windows Defender scan from the command line](run-cmd-scan-windows-defender-for-windows-10.md)|Use the command-line utility to run a Windows Defender scan. +[Detect and block Potentially Unwanted Applications with Windows Defender](enable-pua-windows-defender-for-windows-10.md)|Use the Potentially Unwanted Application (PUA) feature in Managed Windows Defender to identify and block unwanted software during download and install time. +[Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md)|Review event IDs in Windows Defender for Windows 10 and take the appropriate actions. diff --git a/windows/keep-secure/windows-defender-offline.md b/windows/keep-secure/windows-defender-offline.md new file mode 100644 index 0000000000..a90a308ed7 --- /dev/null +++ b/windows/keep-secure/windows-defender-offline.md @@ -0,0 +1,182 @@ +--- +title: Windows Defender Offline in Windows 10 +description: You can use Windows Defender Offline straight from the Windows Defender client. You can also manage how it is deployed in your network. +keywords: scan, defender, offline +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +--- + +# Windows Defender Offline in Windows 10 + +**Applies to:** + +- Windows 10, version 1607 + +Windows Defender Offline is an antimalware scanning tool that lets you boot and run a scan from a trusted environment. The scan runs from outside the normal Windows kernel so it can target malware that attempts to bypass the Windows shell, such as viruses and rootkits that infect or overwrite the master boot record (MBR). + +In Windows 10, Windows Defender Offline can be run with one click directly from the Windows Defender client. In previous versions of Windows, a user had to install Windows Defender Offline to bootable media, restart the endpoint, and load the bootable media. + +## Pre-requisites and requirements + +Windows Defender Offline in Windows 10 has the same hardware requirements as Windows 10. + +For more information about Windows 10 requirements, see the following topics: + +- [Minimum hardware requirements](https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx) + +- [Hardware component guidelines](https://msdn.microsoft.com/library/windows/hardware/dn915049(v=vs.85).aspx) + +> [!NOTE] +> Windows Defender Offline is not supported on machines with ARM processors, or on Windows Server Stock Keeping Units. + +To run Windows Defender Offline from the endpoint, the user must be logged in with administrator privileges. + +## Windows Defender Offline updates + +Windows Defender Offline uses the most up-to-date signature definitions available on the endpoint; it's updated whenever Windows Defender is updated with new signature definitions. Depending on your setup, this is usually though Microsoft Update or through the [Microsoft Malware Protection Center](https://www.microsoft.com/security/portal/definitions/adl.aspx). + +> [!NOTE] +> Before running an offline scan, you should attempt to update the definitions on the endpoint. You can either force an update via Group Policy or however you normally deploy updates to endpoints, or you can manually download and install the latest updates from the [Microsoft Malware Protection Center](https://www.microsoft.com/security/portal/definitions/adl.aspx). + +For information on setting up Windows Defender updates, see the [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) topic. + +## Usage scenarios + +In Windows 10, version 1607, you can manually force an offline scan. Alternatively, if Windows Defender determines that Windows Defender Offline needs to run, it will prompt the user on the endpoint. The need to perform an offline scan will also be revealed in System Center Configuration Manager, if you're using it to manage your endpoints. + +The prompt can occur via a notification, similar to the following: + +![Windows notification showing the requirement to run Windows Defender Offline](images/defender/notification.png) + +The user will also be notified within the Windows Defender client: + +![Windows Defender showing the requirement to run Windows Defender Offline](images/defender/client.png) + +In Configuration Manager, you can identify the status of endpoints by navigating to **Monitoring > Overview > Security > Endpoint Protection Status > System Center Endpoint Protection Status**. Windows Defender Offline scans are indicated under **Malware remediation status** as **Offline scan required**. + +![System Center Configuration Manager indicating a Windows Defender Offline scan is required](images/defender/sccm-wdo.png) + +## Manage notifications + + +You can suppress Windows Defender Offline notifications with Group Policy. + +> [!NOTE] +> Changing these settings will affect *all* notifications from Windows Defender. Disabling notifications will mean the endpoint user will not see any messages about any threats detected, removed, or if additional steps are required. + +**Use Group Policy to suppress Windows Defender notifications:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender > Client Interface**. + +1. Double-click the **Suppress all notifications** setting and set the option to **Enabled**. Click **OK**. This will disable all notifications shown by the Windows Defender client. + +## Configure Windows Defender Offline settings + +You can use Windows Management Instrumentation to enable and disable certain features in Windows Defender Offline. For example, you can use `Set-MpPreference` to change the `UILockdown` setting to disable and enable notifications. + +For more information about using Windows Management Instrumentation to configure Windows Defender Offline, including configuration parameters and options, see the following topics: + +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/windows/desktop/dn439477(v=vs.85).aspx) + +- [Windows Defender MSFT_MpPreference class](https://msdn.microsoft.com/en-us/library/windows/desktop/dn455323(v=vs.85).aspx) + +For more information about notifications in Windows Defender, see the [Configure enhanced notifications in Windows Defender](windows-defender-enhanced-notifications.md)] topic. + +## Run a scan + +Windows Defender Offline uses up-to-date threat definitions to scan the endpoint for malware that might be hidden. In Windows 10, version 1607, you can manually force an offline scan using Windows Update and Security settings. + +> [!NOTE] +> Before you use Windows Defender Offline, make sure you save any files and shut down running programs. The Windows Defender Offline scan takes about 15 minutes to run. It will restart the endpoint when the scan is complete. + +You can set up a Windows Defender Offline scan with the following: + +- Windows Update and Security settings + +- Windows Defender + +- Windows Management Instrumentation + +- Windows PowerShell + +- Group Policy + +> [!NOTE] +> The scan is performed outside of the usual Windows operating environment. The user interface will appear different to a normal scan performed by Windows Defender. After the scan is completed, the endpoint will be restarted and Windows will load normally. + +**Run Windows Defender Offline from Windows Settings:** + +1. Open the **Start** menu and click or type **Settings**. + +1. Click **Update & Security** and then **Windows Defender**. Scroll to the bottom of the settings page until you see the **Windows Defender Offline** section. + +1. Click **Scan offline**. + + ![Windows Defender Offline setting](images/defender/settings-wdo.png) + +1. Follow the prompts to continue with the scan. You might be warned that you'll be signed out of Windows and that the endpoint will restart. + +**Run Windows Defender Offline from Windows Defender:** + +1. Open the **Start** menu, type **windows defender**, and press **Enter** to open the Windows Defender client. + +1. On the **Home** tab click **Download and Run**. + + ![Windows Defender home tab showing the Download and run button](images/defender/download-wdo.png) + +1. Follow the prompts to continue with the scan. You might be warned that you'll be signed out of Windows and that the endpoint will restart. + + +**Use Windows Management Instrumentation to configure and run Windows Defender Offline:** + +Use the `MSFT_MpWDOScan` class (part of the Windows Defender Windows Management Instrumentation provider) to run a Windows Defender Offline scan. + +The following Windows Management Instrumentation script snippet will immediately run a Windows Defender Offline scan, which will cause the endpoint to restart, run the offline scan, and then restart and boot into Windows. + +```WMI +wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpWDOScan call Start +``` + +For more information about using Windows Management Instrumentation to run a scan in Windows Defender, including configuration parameters and options, see the following topics: + +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/windows/desktop/dn439477(v=vs.85).aspx) + +- [MSFT_MpWDOScan class article](https://msdn.microsoft.com/library/windows/desktop/mt622458(v=vs.85).aspx) + +**Run Windows Defender Offline using PowerShell:** + +Use the PowerShell parameter `Start-MpWDOScan` to run a Windows Defender Offline scan. + +For more information on available cmdlets and optios, see the [Use PowerShell cmdlets to configure and run Windows Defender](use-powershell-cmdlets-windows-defender-for-windows-10.md) topic. + +## Review scan results + +Windows Defender Offline scan results will be listed in the main Windows Defender user interface after performing the scan. + +1. Open the **Start** menu, type **windows defender**, and press **Enter** to open the Windows Defender client. + +1. Go to the **History** tab. + +1. Select **All detected items**. + +1. Click **View details**. + +Any detected items will display. Items that are detected by Windows Defender Offline will be listed as **Offline** in the **Detection source**: + +![Windows Defender detection source showing as Offline](images/defender/detection-source.png) + +## Related topics + +- [Windows Defender in Windows 10](windows-defender-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index 23f9e3d1c0..9b54a7e5a7 100644 --- a/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -12,7 +12,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The Windows Firewall with Advanced Security Administration with Windows PowerShell Guide provides essential scriptlets for automating Windows Firewall with Advanced Security management. It is designed for IT pros, system administrators, IT managers, and others who use and need to automate Windows Firewall with Advanced Security management in Windows. @@ -624,37 +624,37 @@ New-NetFirewallRule –DisplayName “Inbound Secure Bypass Rule" –Direction I For more information about Windows PowerShell concepts, see the following topics. -- [Windows PowerShell Getting Started Guide](http://go.microsoft.com/fwlink/p/?linkid=113440) +- [Windows PowerShell Getting Started Guide](https://go.microsoft.com/fwlink/p/?linkid=113440) -- [Windows PowerShell User Guide](http://go.microsoft.com/fwlink/p/?linkid=113441) +- [Windows PowerShell User Guide](https://go.microsoft.com/fwlink/p/?linkid=113441) -- [Windows PowerShell About Help Topics](http://go.microsoft.com/fwlink/p/?linkid=113206) +- [Windows PowerShell About Help Topics](https://go.microsoft.com/fwlink/p/?linkid=113206) -- [about\_Functions](http://go.microsoft.com/fwlink/p/?linkid=113231) +- [about\_Functions](https://go.microsoft.com/fwlink/p/?linkid=113231) -- [about\_Functions\_Advanced](http://go.microsoft.com/fwlink/p/?linkid=144511) +- [about\_Functions\_Advanced](https://go.microsoft.com/fwlink/p/?linkid=144511) -- [about\_Execution\_Policies](http://go.microsoft.com/fwlink/p/?linkid=135170) +- [about\_Execution\_Policies](https://go.microsoft.com/fwlink/p/?linkid=135170) -- [about\_Foreach](http://go.microsoft.com/fwlink/p/?linkid=113229) +- [about\_Foreach](https://go.microsoft.com/fwlink/p/?linkid=113229) -- [about\_Objects](http://go.microsoft.com/fwlink/p/?linkid=113241) +- [about\_Objects](https://go.microsoft.com/fwlink/p/?linkid=113241) -- [about\_Properties](http://go.microsoft.com/fwlink/p/?linkid=113249) +- [about\_Properties](https://go.microsoft.com/fwlink/p/?linkid=113249) -- [about\_While](http://go.microsoft.com/fwlink/p/?linkid=113275) +- [about\_While](https://go.microsoft.com/fwlink/p/?linkid=113275) -- [about\_Scripts](http://go.microsoft.com/fwlink/p/?linkid=144310) +- [about\_Scripts](https://go.microsoft.com/fwlink/p/?linkid=144310) -- [about\_Signing](http://go.microsoft.com/fwlink/p/?linkid=113268) +- [about\_Signing](https://go.microsoft.com/fwlink/p/?linkid=113268) -- [about\_Throw](http://go.microsoft.com/fwlink/p/?linkid=145153) +- [about\_Throw](https://go.microsoft.com/fwlink/p/?linkid=145153) -- [about\_PSSessions](http://go.microsoft.com/fwlink/p/?linkid=135181) +- [about\_PSSessions](https://go.microsoft.com/fwlink/p/?linkid=135181) -- [about\_Modules](http://go.microsoft.com/fwlink/p/?linkid=144311) +- [about\_Modules](https://go.microsoft.com/fwlink/p/?linkid=144311) -- [about\_Command\_Precedence](http://go.microsoft.com/fwlink/p/?linkid=113214) +- [about\_Command\_Precedence](https://go.microsoft.com/fwlink/p/?linkid=113214)   diff --git a/windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md b/windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md index 5dabaedf02..9cfe29f6c0 100644 --- a/windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md +++ b/windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 You can use the Windows Firewall with Advanced Security MMC snap-in with devices running at least Windows Vista or Windows Server 2008 to help protect the devices and the data that they share across a network. diff --git a/windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md b/windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md index acc229bd6a..47830f44c9 100644 --- a/windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md +++ b/windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Windows Firewall with Advanced Security is a host firewall that helps secure the device in two ways. First, it can filter the network traffic permitted to enter the device from the network, and also control what network traffic the device is allowed to send to the network. Second, Windows Firewall with Advanced Security supports IPsec, which enables you to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that cannot authenticate cannot communicate with your device. By using IPsec, you can also require that specific network traffic be encrypted to prevent it from being read or intercepted while in transit between devices. diff --git a/windows/keep-secure/windows-firewall-with-advanced-security.md b/windows/keep-secure/windows-firewall-with-advanced-security.md index 51c6967315..4433aaf633 100644 --- a/windows/keep-secure/windows-firewall-with-advanced-security.md +++ b/windows/keep-secure/windows-firewall-with-advanced-security.md @@ -12,7 +12,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This is an overview of the Windows Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features. diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index c6eee85e2d..ca368e846f 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -8,6 +8,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: jdeckerMS +localizationpriority: high --- # Windows Hello biometrics in the enterprise @@ -77,8 +78,8 @@ To allow facial recognition, you must have devices with integrated special infra - [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - [Microsoft Passport guide](microsoft-passport-guide.md) -- [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) -- [PassportforWork CSP](http://go.microsoft.com/fwlink/p/?LinkId=708219) +- [Prepare people to use Windows Hello for Work](prepare-people-to-use-microsoft-passport.md) +- [PassportforWork CSP](https://go.microsoft.com/fwlink/p/?LinkId=708219)   diff --git a/windows/keep-secure/windows-security-baselines.md b/windows/keep-secure/windows-security-baselines.md index d9f379c2a6..ee48d1325c 100644 --- a/windows/keep-secure/windows-security-baselines.md +++ b/windows/keep-secure/windows-security-baselines.md @@ -5,6 +5,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security +localizationpriority: high author: brianlic-msft --- @@ -12,7 +13,10 @@ author: brianlic-msft Microsoft is dedicated to provide our customers with a secure operating system, such as Windows 10 and Windows Server, as well as secure apps, such as Microsoft Edge. In addition to the security assurance of its products, Microsoft also enables you to have fine control of your environments by providing various configuration capabilities. Even though Windows and Windows Server are designed to be secure out-of-the-box, a large number of organizations still want more granular control of their security configurations. To navigate these large number of controls, organizations need guidance for configuring various security features. Microsoft provides this guidance in the form of security baselines. -We recommend implementing an industry-standard configuration that is broadly known and well-tested, such as a Microsoft security baseline, as opposed to creating one yourself. This helps increase flexibility and reduce costs. +We recommend implementing an industry-standard configuration that is broadly known and well-tested, such as a Microsoft security baseline, as opposed to creating one yourself. This helps increase flexibility and reduce costs. + + > [!NOTE] + > Microsoft Security Compliance Manager 4.0 is available from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=53353). ## What are security baselines? @@ -31,28 +35,29 @@ In modern organizations, the security threat landscape is constantly evolving. I To help faster deployments and increase the ease of managing Windows, Microsoft provides customers with security baselines that are available in formats that can be consumed, such as Group Policy Objects backups. - ## How can you use security baselines? +## How can you use security baselines? You can use security baselines to: - Ensure that user and device configuration settings are compliant with the baseline. - Set configuration settings. For example, you can use Group Policy, System Center Configuration Manager, or Microsoft Intune to configure a device with the setting values specified in the baseline. - ## Where can I get the security baselines? +## Where can I get the security baselines? Here's a list of security baselines that are currently available. - > **Note:** If you want to know what has changed with each security baseline, or if you want to stay up-to-date on what’s happening with them, check out the [Microsoft Security Guidance](http://blogs.technet.microsoft.com/secguide) blog. + > [!NOTE] + > If you want to know what has changed with each security baseline, or if you want to stay up-to-date on what’s happening with them, check out the [Microsoft Security Guidance](http://blogs.technet.microsoft.com/secguide) blog. ### Windows 10 security baselines - - [Windows 10, Version 1511 security baseline](http://go.microsoft.com/fwlink/p/?LinkID=799381) - - [Windows 10, Version 1507 security baseline](http://go.microsoft.com/fwlink/p/?LinkID=799380) + - [Windows 10, Version 1511 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799381) + - [Windows 10, Version 1507 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799380) ### Windows Server security baselines - - [Windows Server 2012 R2 security baseline](http://go.microsoft.com/fwlink/p/?LinkID=799382) + - [Windows Server 2012 R2 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799382) ## How can I monitor security baseline deployments? diff --git a/windows/keep-secure/wip-enterprise-overview.md b/windows/keep-secure/wip-enterprise-overview.md new file mode 100644 index 0000000000..2b0b45fd93 --- /dev/null +++ b/windows/keep-secure/wip-enterprise-overview.md @@ -0,0 +1,5 @@ +--- +title: Windows Information Protection overview (Windows 10) +description: Conceptual info about Windows Information Protection (WIP), formerly known as Windows Information Protection (WIP). +redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip +--- diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index 2f6b01a357..19a65a7a57 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -3,6 +3,7 @@ ## [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) ## [Manage corporate devices](manage-corporate-devices.md) ### [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) +### [Manage Windows 10 and Windows Store tips, tricks, and suggestions](manage-tips-and-suggestions.md) ### [New policies for Windows 10](new-policies-for-windows-10.md) ### [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) ### [Changes to Group Policy settings for Windows 10 Start](changes-to-start-policies-in-windows-10.md) @@ -15,6 +16,7 @@ ### [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) ### [Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) ### [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +## [Create mandatory user profiles](mandatory-user-profile.md) ## [Lock down Windows 10](lock-down-windows-10.md) ### [Lockdown features from Windows Embedded 8.1 Industry](lockdown-features-windows-10.md) ### [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) @@ -34,9 +36,128 @@ ## [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) ## [Configure devices without MDM](configure-devices-without-mdm.md) ## [Windows 10 servicing options](introduction-to-windows-10-servicing.md) -## [Application development for Windows as a service](application-development-for-windows-as-a-service.md) +## [Application Virtualization (App-V) for Windows](appv-for-windows.md) +### [Getting Started with App-V](appv-getting-started.md) +#### [What's new in App-V](appv-about-appv.md) +##### [Release Notes for App-V](appv-release-notes-for-appv-for-windows.md) +#### [Evaluating App-V](appv-evaluating-appv.md) +#### [High Level Architecture for App-V](appv-high-level-architecture.md) +### [Planning for App-V](appv-planning-for-appv.md) +#### [Preparing Your Environment for App-V](appv-preparing-your-environment.md) +##### [App-V Prerequisites](appv-prerequisites.md) +##### [App-V Security Considerations](appv-security-considerations.md) +#### [Planning to Deploy App-V](appv-planning-to-deploy-appv.md) +##### [App-V Supported Configurations](appv-supported-configurations.md) +##### [App-V Capacity Planning](appv-capacity-planning.md) +##### [Planning for High Availability with App-V](appv-planning-for-high-availability-with-appv.md) +##### [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md) +##### [Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md) +##### [Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md) +##### [Planning for Using App-V with Office](appv-planning-for-using-appv-with-office.md) +##### [Planning to Use Folder Redirection with App-V](appv-planning-folder-redirection-with-appv.md) +#### [App-V Planning Checklist](appv-planning-checklist.md) +### [Deploying App-V](appv-deploying-appv.md) +#### [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) +##### [About Client Configuration Settings](appv-client-configuration-settings.md) +##### [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) +##### [How to Install the Sequencer](appv-install-the-sequencer.md) +#### [Deploying the App-V Server](appv-deploying-the-appv-server.md) +##### [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) +##### [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) +##### [How to Deploy the App-V Databases by Using SQL Scripts](appv-deploy-appv-databases-with-sql-scripts.md) +##### [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md) +##### [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md) +##### [How to install the Management Server on a Standalone Computer and Connect it to the Database ](appv-install-the-management-server-on-a-standalone-computer.md) +##### [About App-V Reporting](appv-reporting.md) +##### [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](appv-install-the-reporting-server-on-a-standalone-computer.md) +#### [App-V Deployment Checklist](appv-deployment-checklist.md) +#### [Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md) +#### [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) +### [Operations for App-V](appv-operations.md) +#### [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md) +##### [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md) +##### [How to Modify an Existing Virtual Application Package](appv-modify-an-existing-virtual-application-package.md) +##### [How to Create and Use a Project Template](appv-create-and-use-a-project-template.md) +##### [How to Create a Package Accelerator](appv-create-a-package-accelerator.md) +##### [How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md) +#### [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) +##### [About App-V Dynamic Configuration](appv-dynamic-configuration.md) +##### [How to Connect to the Management Console ](appv-connect-to-the-management-console.md) +##### [How to Add or Upgrade Packages by Using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md) +##### [How to Configure Access to Packages by Using the Management Console ](appv-configure-access-to-packages-with-the-management-console.md) +##### [How to Publish a Package by Using the Management Console ](appv-publish-a-packages-with-the-management-console.md) +##### [How to Delete a Package in the Management Console ](appv-delete-a-package-with-the-management-console.md) +##### [How to Add or Remove an Administrator by Using the Management Console](appv-add-or-remove-an-administrator-with-the-management-console.md) +##### [How to Register and Unregister a Publishing Server by Using the Management Console](appv-register-and-unregister-a-publishing-server-with-the-management-console.md) +##### [How to Create a Custom Configuration File by Using the App-V Management Console](appv-create-a-custom-configuration-file-with-the-management-console.md) +##### [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console](appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md) +##### [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](appv-customize-virtual-application-extensions-with-the-management-console.md) +##### [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console ](appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md) +#### [Managing Connection Groups](appv-managing-connection-groups.md) +##### [About the Connection Group Virtual Environment](appv-connection-group-virtual-environment.md) +##### [About the Connection Group File](appv-connection-group-file.md) +##### [How to Create a Connection Group](appv-create-a-connection-group.md) +##### [How to Create a Connection Group with User-Published and Globally Published Packages](appv-create-a-connection-group-with-user-published-and-globally-published-packages.md) +##### [How to Delete a Connection Group](appv-delete-a-connection-group.md) +##### [How to Publish a Connection Group](appv-publish-a-connection-group.md) +##### [How to Make a Connection Group Ignore the Package Version](appv-configure-connection-groups-to-ignore-the-package-version.md) +##### [How to Allow Only Administrators to Enable Connection Groups](appv-allow-administrators-to-enable-connection-groups.md) +#### [Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) +##### [How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md) +##### [How to Enable Only Administrators to Publish Packages by Using an ESD](appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md) +#### [Using the App-V Client Management Console](appv-using-the-client-management-console.md) +#### [Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) +##### [How to Convert a Package Created in a Previous Version of App-V](appv-convert-a-package-created-in-a-previous-version-of-appv.md) +#### [Maintaining App-V](appv-maintaining-appv.md) +##### [How to Move the App-V Server to Another Computer](appv-move-the-appv-server-to-another-computer.md) +#### [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) +##### [How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help ](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md) +##### [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md) +##### [How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md) +##### [How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) +##### [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) +##### [How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) +##### [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) +##### [How to Sequence a Package by Using Windows PowerShell ](appv-sequence-a-package-with-powershell.md) +##### [How to Create a Package Accelerator by Using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md) +##### [How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md) +##### [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md) +### [Troubleshooting App-V](appv-troubleshooting.md) +### [Technical Reference for App-V](appv-technical-reference.md) +#### [Performance Guidance for Application Virtualization](appv-performance-guidance.md) +#### [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) +#### [Viewing App-V Server Publishing Metadata](appv-viewing-appv-server-publishing-metadata.md) +#### [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md) +## [User Experience Virtualization (UE-V) for Windows](uev-for-windows.md) +### [Get Started with UE-V](uev-getting-started.md) +#### [What's New in UE-V for Windows 10, version 1607](uev-whats-new-in-uev-for-windows.md) +#### [User Experience Virtualization Release Notes](uev-release-notes-1607.md) +#### [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) +### [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) +#### [Deploy Required UE-V Features](uev-deploy-required-features.md) +#### [Deploy UE-V for use with Custom Applications](uev-deploy-uev-for-custom-applications.md) +### [Administering UE-V](uev-administering-uev.md) +#### [Manage Configurations for UE-V](uev-manage-configurations.md) +##### [Configuring UE-V with Group Policy Objects](uev-configuring-uev-with-group-policy-objects.md) +##### [Configuring UE-V with System Center Configuration Manager](uev-configuring-uev-with-system-center-configuration-manager.md) +##### [Administering UE-V with Windows PowerShell and WMI](uev-administering-uev-with-windows-powershell-and-wmi.md) +###### [Managing the UE-V Service and Packages with Windows PowerShell and WMI](uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md) +###### [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md) +#### [Working with Custom UE-V Templates and the UE-V Template Generator](uev-working-with-custom-templates-and-the-uev-generator.md) +#### [Manage Administrative Backup and Restore in UE-V](uev-manage-administrative-backup-and-restore.md) +#### [Changing the Frequency of UE-V Scheduled Tasks](uev-changing-the-frequency-of-scheduled-tasks.md) +#### [Migrating UE-V Settings Packages](uev-migrating-settings-packages.md) +#### [Using UE-V with Application Virtualization Applications](uev-using-uev-with-application-virtualization-applications.md) +### [Troubleshooting UE-V](uev-troubleshooting.md) +### [Technical Reference for UE-V](uev-technical-reference.md) +#### [Sync Methods for UE-V](uev-sync-methods.md) +#### [Sync Trigger Events for UE-V](uev-sync-trigger-events.md) +#### [Synchronizing Microsoft Office with UE-V](uev-synchronizing-microsoft-office-with-uev.md) +#### [Application Template Schema Reference for UE-V](uev-application-template-schema-reference.md) +#### [Security Considerations for UE-V](uev-security-considerations.md) ## [Windows Store for Business](windows-store-for-business.md) ### [Sign up and get started](sign-up-windows-store-for-business-overview.md) +####[Windows Store for Business overview](windows-store-for-business-overview.md) #### [Prerequisites for Windows Store for Business](prerequisites-windows-store-for-business.md) #### [Sign up for Windows Store for Business](sign-up-windows-store-for-business.md) #### [Roles and permissions in the Windows Store for Business](roles-and-permissions-windows-store-for-business.md) @@ -51,7 +172,7 @@ #### [Distribute apps with a management tool](distribute-apps-with-management-tool.md) #### [Distribute offline apps](distribute-offline-apps.md) ### [Manage apps](manage-apps-windows-store-for-business-overview.md) -#### [App inventory managemement for Windows Store for Business](app-inventory-managemement-windows-store-for-business.md) +#### [App inventory managemement for Windows Store for Business](app-inventory-management-windows-store-for-business.md) #### [Manage app orders in Windows Store for Business](manage-orders-windows-store-for-business.md) #### [Manage access to private store](manage-access-to-private-store.md) #### [Manage private store settings](manage-private-store-settings.md) diff --git a/windows/manage/acquire-apps-windows-store-for-business.md b/windows/manage/acquire-apps-windows-store-for-business.md index 5f68e8e296..3840db35c7 100644 --- a/windows/manage/acquire-apps-windows-store-for-business.md +++ b/windows/manage/acquire-apps-windows-store-for-business.md @@ -6,6 +6,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Acquire apps in Windows Store for Business diff --git a/windows/manage/add-unsigned-app-to-code-integrity-policy.md b/windows/manage/add-unsigned-app-to-code-integrity-policy.md index d453da171a..a0c9e5ac70 100644 --- a/windows/manage/add-unsigned-app-to-code-integrity-policy.md +++ b/windows/manage/add-unsigned-app-to-code-integrity-policy.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store, security author: TrudyHa +localizationpriority: high --- # Add unsigned app to code integrity policy diff --git a/windows/manage/administrative-tools-in-windows-10.md b/windows/manage/administrative-tools-in-windows-10.md index cc42197767..0166bbda73 100644 --- a/windows/manage/administrative-tools-in-windows-10.md +++ b/windows/manage/administrative-tools-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: medium --- # Administrative Tools in Windows 10 @@ -30,23 +31,23 @@ If the content that is linked to a tool in the following list doesn't provide th   -- [Component Services]( http://go.microsoft.com/fwlink/p/?LinkId=708489) -- [Computer Management](http://go.microsoft.com/fwlink/p/?LinkId=708490) -- [Defragment and Optimize Drives](http://go.microsoft.com/fwlink/p/?LinkId=708488) -- [Disk Cleanup](http://go.microsoft.com/fwlink/p/?LinkID=698648) -- [Event Viewer](http://go.microsoft.com/fwlink/p/?LinkId=708491) -- [iSCSI Initiator](http://go.microsoft.com/fwlink/p/?LinkId=708492) -- [Local Security Policy](http://go.microsoft.com/fwlink/p/?LinkId=708493) -- [ODBC Data Sources]( http://go.microsoft.com/fwlink/p/?LinkId=708494) -- [Performance Monitor](http://go.microsoft.com/fwlink/p/?LinkId=708495) -- [Print Management](http://go.microsoft.com/fwlink/p/?LinkId=708496) -- [Resource Monitor](http://go.microsoft.com/fwlink/p/?LinkId=708497) -- [Services](http://go.microsoft.com/fwlink/p/?LinkId=708498) -- [System Configuration](http://go.microsoft.com/fwlink/p/?LinkId=708499) -- [System Information]( http://go.microsoft.com/fwlink/p/?LinkId=708500) -- [Task Scheduler](http://go.microsoft.com/fwlink/p/?LinkId=708501) -- [Windows Firewall with Advanced Security](http://go.microsoft.com/fwlink/p/?LinkId=708503) -- [Windows Memory Diagnostic]( http://go.microsoft.com/fwlink/p/?LinkId=708507) +- [Component Services]( https://go.microsoft.com/fwlink/p/?LinkId=708489) +- [Computer Management](https://go.microsoft.com/fwlink/p/?LinkId=708490) +- [Defragment and Optimize Drives](https://go.microsoft.com/fwlink/p/?LinkId=708488) +- [Disk Cleanup](https://go.microsoft.com/fwlink/p/?LinkID=698648) +- [Event Viewer](https://go.microsoft.com/fwlink/p/?LinkId=708491) +- [iSCSI Initiator](https://go.microsoft.com/fwlink/p/?LinkId=708492) +- [Local Security Policy](https://go.microsoft.com/fwlink/p/?LinkId=708493) +- [ODBC Data Sources]( https://go.microsoft.com/fwlink/p/?LinkId=708494) +- [Performance Monitor](https://go.microsoft.com/fwlink/p/?LinkId=708495) +- [Print Management](https://go.microsoft.com/fwlink/p/?LinkId=708496) +- [Resource Monitor](https://go.microsoft.com/fwlink/p/?LinkId=708497) +- [Services](https://go.microsoft.com/fwlink/p/?LinkId=708498) +- [System Configuration](https://go.microsoft.com/fwlink/p/?LinkId=708499) +- [System Information]( https://go.microsoft.com/fwlink/p/?LinkId=708500) +- [Task Scheduler](https://go.microsoft.com/fwlink/p/?LinkId=708501) +- [Windows Firewall with Advanced Security](https://go.microsoft.com/fwlink/p/?LinkId=708503) +- [Windows Memory Diagnostic]( https://go.microsoft.com/fwlink/p/?LinkId=708507)   diff --git a/windows/manage/app-inventory-managemement-windows-store-for-business.md b/windows/manage/app-inventory-managemement-windows-store-for-business.md index ca7d24b2a2..1dedc043ff 100644 --- a/windows/manage/app-inventory-managemement-windows-store-for-business.md +++ b/windows/manage/app-inventory-managemement-windows-store-for-business.md @@ -2,6 +2,7 @@ title: App inventory management for Windows Store for Business (Windows 10) description: You can manage all apps that you've acquired on your Inventory page. ms.assetid: 44211937-801B-4B85-8810-9CA055CDB1B2 +redirect_url: https://technet.microsoft.com/itpro/windows/manage/app-inventory-management-windows-store-for-business ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -9,224 +10,3 @@ ms.pagetype: store author: TrudyHa --- -# App inventory management for Windows Store for Business - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -You can manage all apps that you've acquired on your **Inventory** page. - -The **Inventory** page in Windows Store for Business shows all apps in your inventory. This includes all apps that you've acquired from Store for Business, and the line-of-business (LOB) apps that you've accepted into your inventory. After LOB apps are submitted to your organization, you'll see a notification on your **Inventory** page. On the **New line-of-business apps** page, you can accept, or reject the LOB apps. For more information on LOB apps, see [Working with line-of-business apps](working-with-line-of-business-apps.md). - -All of these apps are treated the same once they are in your inventory and you can perform app lifecycle tasks for them: distribute apps, add apps to private store, review license details, and reclaim app licenses. - -![Image shows Inventory page in Windows Store for Business with status status options for an app.](images/wsfb-inventoryaddprivatestore.png) - -Store for Business shows this info for each app in your inventory: - -- Name - -- Access to actions for the app - -- Last modified date - -- Supported devices - -- Private store status - -### Find apps in your inventory - -There are a couple of ways to find specific apps, or groups of apps in your inventory. - -**Search** - Use the Search box to search for an app. - -**Refine** - Use **Refine** to scope your list of apps by one or more of these app attributes: - -- **License** - Online or offline licenses. For more info, see [Apps in Windows Store for Business](apps-in-windows-store-for-business.md#licensing-model). - -- **Platforms** - Lists the devices that apps in your inventory were originally written to support. This list is cumulative for all apps in your inventory. - -- **Source** - **Store**, for apps acquired from Store for Business, or LOB, for line-of-business apps. - -- **Private store** - **In private store**, or **Not in private store**, depending on whether or not you've added the app to your private store. - -### Manage apps in your inventory - -Each app in the Store for Business has an online, or an offline license. For more information on Store for Business licensing model, see [Apps in the Windows Store for Business](apps-in-windows-store-for-business.md#licensing-model). There are different actions you can take depending on the app license type. They're summarized in this table. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ActionOnline-licensed appOffline-licensed app

    Assign to employees

    X

    Add to private store

    X

    Remove from private store

    X

    View license details

    X

    View product details

    X

    X

    Download for offline use

    X

    - -  - -The actions in the table are how you distribute apps, and manage app licenses. We'll cover those in the next sections. Working with offline-licensed apps has different steps. For more information on distributing offline-licensed apps, see [Distribute offline apps](distribute-offline-apps.md). - -### Distribute apps - -For online-licensed apps, there are a couple of ways to distribute apps from your inventory: - -- Assign apps to people in your organization. - -- Add apps to your private store, and let people in your organization install the app. - -If you use a management tool that supports Store for Business, you can distribute apps with your management tool. Once it is configured to work with Store for Business, your managment tool will have access to all apps in your inventory. For more information, see [Distribute apps with a management tool](distribute-apps-with-management-tool.md). - -Once an app is in your private store, people in your org can install the app on their devices. For more information, see [Distribute apps using your private store](distribute-apps-from-your-private-store.md). - -**To make an app in inventory available in your private store** - -1. Sign in to the [Store for Business](http://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Inventory**. -3. Click **Refine**, and then choose **Online**. Store for Business will update the list of apps on the **Inventory** page. -4. From an app in **Inventory**, click the ellipses under **Action**, and then choose **Add to private store**. - -The value under Private store for the app will change to pending. It will take approximately twelve hours before the app is available in the private store. - -Employees can claim apps that admins added to the private store by doing the following. - -**To claim an app from the private store** - -1. Sign in to your computer with your Azure Active Directory (AD) credentials, and start the Windows Store app. -2. Click the private store tab. -3. Click the app you want to install, and then click **Install**. - -Another way to distribute apps is by assigning them to people in your organization. - -If you decide that you don't want an app available for employees to install on their own, you can remove it from your private store. - -**To remove an app from the private store** - -1. Sign in to the [Store for Business](http://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Inventory**. -3. Find an app, click the ellipses under **Action**, and then choose **Remove from private store**, and then click **Remove**. - -The app will still be in your inventory, but your employees will not have access to the app from your private store. - -**To assign an app to an employee** - -1. Sign in to the [Store for Business](http://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Inventory**. -3. Find an app, click the ellipses under **Action**, and then choose **Assign to people**. -4. Type the email address for the employee that you're assigning the app to, and click **Confirm**. - -Employees will receive an email with a link that will install the app on their device. Click the link to start the Windows Store app, and then click **Install**. Also, in the Windows Store app, they can find the app under **My Library**. - -### Manage app licenses - -For each app in your inventory, you can view and manage license details. This give you another way to assign apps to people in your organization. It also allows you to reclaim app licenses after they've been assigned to people, or claimed by people in your organization. - -**To view license details** - -1. Sign in to [Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=691845) - -2. Click **Manage**, and then choose **Inventory**. - -3. Click the ellipses for an app, and then choose **View license details**. - - ![Image showing Inventory page in Windows Store for Business.](images/wsfb-inventory-viewlicense.png) - - You'll see the names of people in your organization who have installed the app and are using one of the licenses. - - ![Image showing assigned licenses for an app.](images/wsfb-licensedetails.png) - - On **Assigned licenses**, you can do several things: - - - Assign the app to other people in your organization. - - - Reclaim app licenses. - - - View app details. - - - Add the app to your private store, if it is not in the private store. - - You can assign the app to more people in your organization, or reclaim licenses. - - **To assign an app to more people** - - - Click **Assign to people**, type the email address for the employee that you're assigning the app to, and click **Assign**. - - ![Image showing Assign to people dialog for assigning app licenses to people in your organization.](images/wsfb-licenseassign.png) - - Store for Business updates the list of assigned licenses. - - **To reclaim licenses** - - - Choose the person you want to reclaim the license from, click **Reclaim licenses**, and then click **Reclaim licenses**. - - ![Image showing Assign to people dialog for reclaiming app licenses from people in your organization.](images/wsfb-licensereclaim.png) - - Store for Business updates the list of assigned licenses. - -### Download offline-licensed app - -Offline licensing is a new feature in Windows 10 and allows apps to be deployed to devices that are not connected to the Internet. This means organizations can deploy apps when users or devices do not have connectivity to the Store. - -You can download offline-licensed apps from your inventory. You'll need to download these items: - -- App metadata - -- App package - -- App license - -- App framework - -For more information about online and offline licenses, see [Apps in the Windows Store for Business](apps-in-windows-store-for-business.md#licensing-model). - -For more information about downloading offline-licensed apps, see [Download offline apps](distribute-offline-apps.md). - -  - -  - - - - - diff --git a/windows/manage/app-inventory-management-windows-store-for-business.md b/windows/manage/app-inventory-management-windows-store-for-business.md new file mode 100644 index 0000000000..ec263eede3 --- /dev/null +++ b/windows/manage/app-inventory-management-windows-store-for-business.md @@ -0,0 +1,228 @@ +--- +title: App inventory management for Windows Store for Business (Windows 10) +description: You can manage all apps that you've acquired on your Inventory page. +ms.assetid: 44211937-801B-4B85-8810-9CA055CDB1B2 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: store +author: TrudyHa +--- + +# App inventory management for Windows Store for Business + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +You can manage all apps that you've acquired on your **Inventory** page. + +The **Inventory** page in Windows Store for Business shows all apps in your inventory. This includes all apps that you've acquired from Store for Business, and the line-of-business (LOB) apps that you've accepted into your inventory. After LOB apps are submitted to your organization, you'll see a notification on your **Inventory** page. On the **New line-of-business apps** page, you can accept, or reject the LOB apps. For more information on LOB apps, see [Working with line-of-business apps](working-with-line-of-business-apps.md). The inventory page includes apps acquired by all people in your organization with the Store for Business Admin role. + +All of these apps are treated the same once they are in your inventory and you can perform app lifecycle tasks for them: distribute apps, add apps to private store, review license details, and reclaim app licenses. + +![Image shows Inventory page in Windows Store for Business with status status options for an app.](images/wsfb-inventoryaddprivatestore.png) + +Store for Business shows this info for each app in your inventory: + +- Name +- Access to actions for the app +- Last modified +- Available licenses +- Private store status + +The last modified date tracks changes about the app as an item in your inventory. The last modified date changes when one of the following happens: +- First purchase (the date you acquire the app from Windows Store for Business) +- Purchase additional licenses +- Assign license +- Reclaim license +- Refund order (applies to purchased apps, not free apps) + +The last modified date does not correspond to when an app was last updated in the Store. It tracks activity for that app, as an item in your inventory. + +### Find apps in your inventory + +There are a couple of ways to find specific apps, or groups of apps in your inventory. + +**Search** - Use the Search box to search for an app. + +**Refine** - Use **Refine** to scope your list of apps by one or more of these app attributes: + +- **License** - Online or offline licenses. For more info, see [Apps in Windows Store for Business](apps-in-windows-store-for-business.md#licensing-model). + +- **Platforms** - Lists the devices that apps in your inventory were originally written to support. This list is cumulative for all apps in your inventory. + +- **Source** - **Store**, for apps acquired from Store for Business, or LOB, for line-of-business apps. + +- **Private store** - **In private store**, or **Not in private store**, depending on whether or not you've added the app to your private store. + +### Manage apps in your inventory + +Each app in the Store for Business has an online, or an offline license. For more information on Store for Business licensing model, see [Apps in the Windows Store for Business](apps-in-windows-store-for-business.md#licensing-model). There are different actions you can take depending on the app license type. They're summarized in this table. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ActionOnline-licensed appOffline-licensed app

    Assign to employees

    X

    Add to private store

    X

    Remove from private store

    X

    View license details

    X

    View product details

    X

    X

    Download for offline use

    X

    + +  + +The actions in the table are how you distribute apps, and manage app licenses. We'll cover those in the next sections. Working with offline-licensed apps has different steps. For more information on distributing offline-licensed apps, see [Distribute offline apps](distribute-offline-apps.md). + +### Distribute apps + +For online-licensed apps, there are a couple of ways to distribute apps from your inventory: + +- Assign apps to people in your organization. + +- Add apps to your private store, and let people in your organization install the app. + +If you use a management tool that supports Store for Business, you can distribute apps with your management tool. Once it is configured to work with Store for Business, your managment tool will have access to all apps in your inventory. For more information, see [Distribute apps with a management tool](distribute-apps-with-management-tool.md). + +Once an app is in your private store, people in your org can install the app on their devices. For more information, see [Distribute apps using your private store](distribute-apps-from-your-private-store.md). + +**To make an app in inventory available in your private store** + +1. Sign in to the [Store for Business](http://businessstore.microsoft.com). +2. Click **Manage**, and then choose **Inventory**. +3. Click **Refine**, and then choose **Online**. Store for Business will update the list of apps on the **Inventory** page. +4. From an app in **Inventory**, click the ellipses under **Action**, and then choose **Add to private store**. + +The value under Private store for the app will change to pending. It will take approximately twelve hours before the app is available in the private store. + +Employees can claim apps that admins added to the private store by doing the following. + +**To claim an app from the private store** + +1. Sign in to your computer with your Azure Active Directory (AD) credentials, and start the Windows Store app. +2. Click the private store tab. +3. Click the app you want to install, and then click **Install**. + +Another way to distribute apps is by assigning them to people in your organization. + +If you decide that you don't want an app available for employees to install on their own, you can remove it from your private store. + +**To remove an app from the private store** + +1. Sign in to the [Store for Business](http://businessstore.microsoft.com). +2. Click **Manage**, and then choose **Inventory**. +3. Find an app, click the ellipses under **Action**, and then choose **Remove from private store**, and then click **Remove**. + +The app will still be in your inventory, but your employees will not have access to the app from your private store. + +**To assign an app to an employee** + +1. Sign in to the [Store for Business](http://businessstore.microsoft.com). +2. Click **Manage**, and then choose **Inventory**. +3. Find an app, click the ellipses under **Action**, and then choose **Assign to people**. +4. Type the email address for the employee that you're assigning the app to, and click **Confirm**. + +Employees will receive an email with a link that will install the app on their device. Click the link to start the Windows Store app, and then click **Install**. Also, in the Windows Store app, they can find the app under **My Library**. + +### Manage app licenses + +For each app in your inventory, you can view and manage license details. This give you another way to assign apps to people in your organization. It also allows you to reclaim app licenses after they've been assigned to people, or claimed by people in your organization. + +**To view license details** + +1. Sign in to [Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=691845) + +2. Click **Manage**, and then choose **Inventory**. + +3. Click the ellipses for an app, and then choose **View license details**. + + ![Image showing Inventory page in Windows Store for Business.](images/wsfb-inventory-viewlicense.png) + + You'll see the names of people in your organization who have installed the app and are using one of the licenses. + + ![Image showing assigned licenses for an app.](images/wsfb-licensedetails.png) + + On **Assigned licenses**, you can do several things: + + - Assign the app to other people in your organization. + + - Reclaim app licenses. + + - View app details. + + - Add the app to your private store, if it is not in the private store. + + You can assign the app to more people in your organization, or reclaim licenses. + + **To assign an app to more people** + + - Click **Assign to people**, type the email address for the employee that you're assigning the app to, and click **Assign**. + + ![Image showing Assign to people dialog for assigning app licenses to people in your organization.](images/wsfb-licenseassign.png) + + Store for Business updates the list of assigned licenses. + + **To reclaim licenses** + + - Choose the person you want to reclaim the license from, click **Reclaim licenses**, and then click **Reclaim licenses**. + + ![Image showing Assign to people dialog for reclaiming app licenses from people in your organization.](images/wsfb-licensereclaim.png) + + Store for Business updates the list of assigned licenses. + +### Download offline-licensed app + +Offline licensing is a new feature in Windows 10 and allows apps to be deployed to devices that are not connected to the Internet. This means organizations can deploy apps when users or devices do not have connectivity to the Store. + +You can download offline-licensed apps from your inventory. You'll need to download these items: + +- App metadata + +- App package + +- App license + +- App framework + +For more information about online and offline licenses, see [Apps in the Windows Store for Business](apps-in-windows-store-for-business.md#licensing-model). + +For more information about downloading offline-licensed apps, see [Download offline apps](distribute-offline-apps.md). \ No newline at end of file diff --git a/windows/manage/application-development-for-windows-as-a-service.md b/windows/manage/application-development-for-windows-as-a-service.md index dedc91d3cd..080fccc711 100644 --- a/windows/manage/application-development-for-windows-as-a-service.md +++ b/windows/manage/application-development-for-windows-as-a-service.md @@ -1,12 +1,13 @@ --- title: Application development for Windows as a service (Windows 10) -description: In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. +description: Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds. ms.assetid: 28E0D103-B0EE-4B14-8680-6F30BD373ACF ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, servicing -author: greg-lindsay +author: jdeckerMS +redirect_url: https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service --- # Application development for Windows as a service @@ -14,7 +15,7 @@ author: greg-lindsay **Applies to** - Windows 10 - Windows 10 Mobile -- Windows 10 IoT Core (IoT Core) +- Windows 10 IoT Core In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. Additionally, new releases must be made available on a continual basis, and must be deployable with minimal impact on users. Microsoft designed Windows 10 to meet these requirements by implementing a new approach to innovation, development, and delivery called [Windows as a service (WaaS)](introduction-to-windows-10-servicing.md). The key to enabling significantly shorter product cycles while maintaining high quality levels is an innovative community-centric approach to testing that Microsoft has implemented for Windows 10. The community, known as Windows Insiders, is comprised of millions of users around the world. When Windows Insiders opt in to the community, they test many builds over the course of a product cycle and provide feedback to Microsoft through an iterative methodology called flighting. @@ -25,6 +26,7 @@ Builds distributed as flights provide the Windows engineering team with signific Although Microsoft releases flight builds to Windows Insiders, Microsoft will publish two types of Windows 10 releases broadly to the public on an ongoing basis: **Feature updates** install the latest new features, experiences, and capabilities on devices that are already running Windows 10. Because feature updates contain an entire copy of Windows, they are also what customers use to install Windows 10 on existing devices running Windows 7 or Windows 8.1, and on new devices where no operating system is installed. Microsoft expects to publish an average of one to two new feature updates per year. + **Quality updates** deliver security issue resolutions and other important bug fixes. Quality updates will be provided to improve each feature currently in support, on a cadence of one or more times per month. Microsoft will continue publishing quality updates on Update Tuesday (sometimes referred to as Patch Tuesday). Additionally, Microsoft may publish additional quality updates for Windows 10 outside the Update Tuesday process when required to address customer needs. During Windows 10 development, Microsoft streamlined the Windows product engineering and release cycle so that we can deliver the features, experiences, and functionality customers want, more quickly than ever. We also created new ways to deliver and install feature updates and quality updates that simplify deployments and on-going management, broaden the base of employees who can be kept current with the latest Windows capabilities and experiences, and lower total cost of ownership. Hence we have implemented new servicing options – referred to as Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB) – that provide pragmatic solutions to keep more devices more current in enterprise environments than was previously possible. @@ -45,7 +47,7 @@ The traditional approach for supporting apps has been to release a new app versi In the Windows as a service model, Microsoft is making a commitment to maintaining the compatibility of the underlying OS. This means Microsoft will make a concerted effort to ensure that there are no breaking changes that impact the app ecosystem negatively. In this scenario, when there is a release of a Windows build, most apps (those with no kernel dependencies) will continue to work. -In view of this change, Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds. Our mutual customers are better served by an application lifecycle approach. This means when an application version is released it will be supported for a certain period of time irrespective of however many Windows builds are released in the interim. The ISV makes a commitment to provide support for that specific version of the app as long as it is supported in the lifecycle. Microsoft follows a similar lifecycle approach for Windows that can be referenced [here](http://go.microsoft.com/fwlink/?LinkID=780549). +In view of this change, Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds. Our mutual customers are better served by an application lifecycle approach. This means when an application version is released it will be supported for a certain period of time irrespective of however many Windows builds are released in the interim. The ISV makes a commitment to provide support for that specific version of the app as long as it is supported in the lifecycle. Microsoft follows a similar lifecycle approach for Windows that can be referenced [here](https://go.microsoft.com/fwlink/?LinkID=780549). This approach will reduce the burden of maintaining an app schedule that aligns with Windows releases. ISV partners should be free to release features or updates at their own cadence. We feel that our partners can keep their customer base updated with the latest app updates independent of a Windows release. In addition, our customers do not have to seek an explicit support statement whenever a Windows build is released. Here is an example of a support statement that covers how an app may be supported across different versions of the OS: @@ -60,7 +62,7 @@ In the following sections, you will find additional information about the steps We understand that compatibility matters to developers. ISVs and developers want to ensure their apps will run as expected on all supported versions of the Windows OS. Consumers and businesses have a key investment here—they want to ensure that the apps they have paid for will continue to work. We know that compatibility is the primary criteria for purchase decisions. Apps that are well written based on best practices will lead to much less code churn when a new Windows version is released and will reduce fragmentation—these apps have a reduced engineering investment to maintain, and a faster time to market. -In the Windows 7 timeframe, compatibility was very much a reactive approach. In Windows 8 we started looking at this differently, working within Windows to ensure that compatibility was by design rather than an afterthought. +In the Windows 7 timeframe, compatibility was very much a reactive approach. In Windows 8, we started looking at this differently, working within Windows to ensure that compatibility was by design rather than an afterthought. Windows 10 is the most compatible-by-design version of the OS to date. Here are some key ways we accomplished this: - **App telemetry**: This helps us understand app popularity in the Windows ecosystem to inform compatibility testing. - **ISV partnerships**: Work directly with external partners to provide them with data and help fix issues that our users experience. @@ -68,15 +70,15 @@ Windows 10 is the most compatible-by-design version of the OS to date. Here are - **Communication**: Tighter control over API changes and improved communication. - **Flighting and feedback loop**: Windows insiders receive flighted builds that help improve our ability to find compatibility issues before a final build is released to customers. This feedback process not only exposes bugs, but ensures we are shipping features our users want. -## Microsoft uses data to make Windows 10 better +## Best practices for app compatibility Microsoft uses diagnostic and usage data to identify and troubleshoot problems, improve our products and services, and provide our users with personalized experiences. The usage data we collect also extends to the apps that PCs in the Windows ecosystem are running. Based on what our customers use, we build our list to test these apps, devices, and drivers against new versions of the Windows OS. Windows 10 has been the most compatible version of Windows to-date, with over 90% compatibility against thousands of popular apps. The Windows Compatibility team commonly reaches out to our ISV partners to provide feedback if issues are discovered, so that we can partner together on solutions. Ideally, we’d like our common customers to be able to update Windows seamlessly and without losing functionality in either their OS or the apps they depend on for their productivity or entertainment. The following sections contain some best practices Microsoft recommends so you can ensure your apps are compatible with Windows 10. -**Windows version check** +### Windows version check -The OS version has been incremented with Windows 10. This means that the internal version number has been changed to 10.0. As in the past, we go to great lengths to maintain application and device compatibility after an OS version change. For most app categories (without any kernel dependencies) the change will not negatively impact app functionality, and existing apps will continue to work fine on Windows 10. +The OS version has been incremented with Windows 10. This means that the internal version number has been changed to 10.0. As in the past, we go to great lengths to maintain application and device compatibility after an OS version change. For most app categories (without any kernel dependencies), the change will not negatively impact app functionality, and existing apps will continue to work fine on Windows 10. The manifestation of this change is app-specific. This means any app that specifically checks for the OS version will get a higher version number, which can lead to one or more of the following situations: - App installers might not be able to install the app, and apps might not be able to start. @@ -87,20 +89,21 @@ Some apps perform a version check and simply pass a warning to users. However, t - If the app is dependent on specific API functionality, ensure you target the correct API version. - Ensure you detect the change via APISet or another public API, and do not use the version as a proxy for some feature or fix. If there are breaking changes and a proper check is not exposed, then that is a bug. - Ensure the app does NOT check for version in odd ways, such as via the registry, file versions, offsets, kernel mode, drivers, or other means. If the app absolutely needs to check the version, use the GetVersion APIs, which should return the major, minor, and build number. -- If you are using the [GetVersion](http://go.microsoft.com/fwlink/?LinkID=780555) API, remember that the behavior of this API has changed since Windows 8.1. +- If you are using the [GetVersion](https://go.microsoft.com/fwlink/?LinkID=780555) API, remember that the behavior of this API has changed since Windows 8.1. If you own apps such as antimalware or firewall apps, you should work through your usual feedback channels and via the Windows Insider program. -**Undocumented APIs** +### Undocumented APIs + Your apps should not call undocumented Windows APIs, or take dependency on specific Windows file exports or registry keys. This can lead to broken functionality, data loss, and potential security issues. If there is functionality your app requires that is not available, this is an opportunity to provide feedback through your usual feedback channels and via the Windows Insider program. -**Develop Universal Windows Platform (UWP) and Centennial apps** +### Develop Universal Windows Platform (UWP) and Centennial apps -We encourage all Win32 app ISVs to develop [Universal Windows Platform (UWP)](http://go.microsoft.com/fwlink/?LinkID=780560) and, specifically, [Centennial](http://go.microsoft.com/fwlink/?LinkID=780562) apps moving forward. There are great benefits to developing these app packages rather than using traditional Win32 installers. UWP apps are also supported in the [Windows Store](http://go.microsoft.com/fwlink/?LinkID=780563), so it’s easier for you to update your users to a consistent version automatically, lowering your support costs. +We encourage all Win32 app ISVs to develop [Universal Windows Platform (UWP)](https://go.microsoft.com/fwlink/?LinkID=780560) and, specifically, [Centennial](https://go.microsoft.com/fwlink/?LinkID=780562) apps moving forward. There are great benefits to developing these app packages rather than using traditional Win32 installers. UWP apps are also supported in the [Windows Store](https://go.microsoft.com/fwlink/?LinkID=780563), so it’s easier for you to update your users to a consistent version automatically, lowering your support costs. -If your Win32 app types do not work with the Centennial model, we highly recommend that you use the right installer and ensure this is fully tested. An installer is your user or customer’s first experience with your app, so ensure that this works well. All too often, this doesn’t work well or it hasn’t been fully tested for all scenarios. The [Windows App Certification Kit](http://go.microsoft.com/fwlink/?LinkID=780565) can help you test the install and uninstall of your Win32 app and help you identify use of undocumented APIs, as well as other basic performance-related best-practice issues, before your users do. +If your Win32 app types do not work with the Centennial model, we highly recommend that you use the right installer and ensure this is fully tested. An installer is your user or customer’s first experience with your app, so ensure that this works well. All too often, this doesn’t work well or it hasn’t been fully tested for all scenarios. The [Windows App Certification Kit](https://go.microsoft.com/fwlink/?LinkID=780565) can help you test the install and uninstall of your Win32 app and help you identify use of undocumented APIs, as well as other basic performance-related best-practice issues, before your users do. -**Best pratcices:** +**Best practices:** - Use installers that work for both 32-bit and 64-bit versions of Windows. - Design your installers to run on multiple scenarios (user or machine level). - Keep all Windows redistributables in the original packaging – if you repackage these, it’s possible that this will break the installer. @@ -112,8 +115,8 @@ Windows OS flighting refers to the interim builds available to Windows Insiders If your app is in the Store, you can flight your app via the Store, which means that your app will be available for our Windows Insider population to install. Users can install your app and you can receive preliminary feedback on your app before you release it to the general population. The follow sections outline the steps for testing your apps against Windows flighted builds. -**Step 1: Become a Windows Insider and participate in flighting** -As a [Windows Insider,](http://go.microsoft.com/fwlink/p/?LinkId=521639) you can help shape the future of Windows—your feedback will help us improve features and functionality in the platform. This is a vibrant community where you can connect with other enthusiasts, join forums, trade advice, and learn about upcoming Insider-only events. +### Step 1: Become a Windows Insider and participate in flighting +As a [Windows Insider,](https://go.microsoft.com/fwlink/p/?LinkId=521639) you can help shape the future of Windows—your feedback will help us improve features and functionality in the platform. This is a vibrant community where you can connect with other enthusiasts, join forums, trade advice, and learn about upcoming Insider-only events. Since you’ll have access to preview builds of Windows 10, Windows 10 Mobile, and the latest Windows SDK and Emulator, you’ll have all the tools at your disposal to develop great apps and explore what's new in the Universal Windows Platform and the Windows Store. @@ -127,7 +130,7 @@ Before you become a Windows Insider, please note that participation is intended - Know what an ISO file is and how to use it. - Aren't installing it on their everyday computer or device. -**Step 2: Test your scenarios** +### Step 2: Test your scenarios Once you have updated to a flighted build, the following are some sample test cases to help you get started on testing and gathering feedback. For most of these tests, ensure you cover both x86 and AMD64 systems. **Clean install test:** On a clean install of Windows 10, ensure your app is fully functional. If your app fails this test and the upgrade test, then it’s likely that the issue is caused by underlying OS changes or bugs in the app. @@ -149,12 +152,12 @@ If after investigation, the former is the case, be sure to use the Windows Insid - Sensors (accelerometer, fusion, and so on) - Camera -**Step 3: Provide feedback** +### Step 3: Provide feedback Let us know how your app is performing against flighted builds. As you discover issues with your app during testing, please log bugs via the partner portal if you have access, or through your Microsoft representative. We encourage this information so that we can build a quality experience for our users together. -**Step 4: Register on Windows 10** -The [Ready for Windows 10](http://go.microsoft.com/fwlink/?LinkID=780580) website is a directory of software that supports Windows 10. It’s intended for IT administrators at companies and organizations worldwide that are considering Windows 10 for their deployments. IT administrators can check the site to see whether software deployed in their enterprise is supported in Windows 10. +### Step 4: Register on Windows 10 +The [Ready for Windows 10](https://go.microsoft.com/fwlink/?LinkID=780580) website is a directory of software that supports Windows 10. It’s intended for IT administrators at companies and organizations worldwide that are considering Windows 10 for their deployments. IT administrators can check the site to see whether software deployed in their enterprise is supported in Windows 10. ## Related topics [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md) diff --git a/windows/manage/apps-in-windows-store-for-business.md b/windows/manage/apps-in-windows-store-for-business.md index dec7d4ca5f..f74b81160c 100644 --- a/windows/manage/apps-in-windows-store-for-business.md +++ b/windows/manage/apps-in-windows-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Apps in Windows Store for Business @@ -50,7 +51,7 @@ Apps that you acquire from the Store for Business only work on Windows 10-based Some apps are free, and some apps charge a price. Currently, you can pay for apps with a credit card. We'll be adding more payment options over time. -Some apps which are available to consumers in the Windows Store might not be available to organizations in the Windows Store for Business. App developers can opt-out their apps, and they also need to meet eligibility requirements for Windows Store for Business. For more information, read this info on [Organizational licensing options](https://msdn.microsoft.com/en-us/windows/uwp/publish/organizational-licensing). +Some apps which are available to consumers in the Windows Store might not be available to organizations in the Windows Store for Business. App developers can opt-out their apps, and they also need to meet eligibility requirements for Windows Store for Business. For more information, read this info on [Organizational licensing options](https://msdn.microsoft.com/windows/uwp/publish/organizational-licensing). **Note**
    We are still setting up the catalog of apps for Windows Store for Business. If you are searching for an app and it isn’t available, please check again in a couple of days. diff --git a/windows/manage/appv-about-appv.md b/windows/manage/appv-about-appv.md new file mode 100644 index 0000000000..ef43aeed3d --- /dev/null +++ b/windows/manage/appv-about-appv.md @@ -0,0 +1,54 @@ +--- +title: What's new in App-V for Windows 10 (Windows 10) +description: Information about what's new in App-V for Windows 10. +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# What's new in App-V + +**Applies to** +- Windows 10, version 1607 + +Microsoft Application Virtualization (App-V) enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. + +Application Virtualization (App-V) for Windows 10, version 1607, includes these new features and capabilities compared to App-V 5.1. See [App-V release notes](appv-release-notes-for-appv-for-windows.md) for more information about the App-V for Windows 10, version 1607 release. + + +## App-V is now a feature in Windows 10 + +With Windows 10, version 1607 and later releases, Application Virtualization (App-V) is included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. + +For information about earlier versions of App-V, see [MDOP Information Experience](https://technet.microsoft.com/itpro/mdop/index). + +The changes in App-V for Windows 10, version 1607 impact already existing implementations of App-V in the following ways: + +- The App-V client is installed on user devices automatically with Windows 10, version 1607, and no longer has to be deployed separately. Performing an in-place upgrade to Windows 10, version 1607, on user devices automatically installs the App-V client. + +- The App-V application sequencer is available from the [Windows 10 Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). In previous releases of App-V, the application sequencer was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new application sequencer to create new virtualized applications, existing virtualized applications will continue to work. + +>**Note**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. + +For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md) and [Migrating to App-V for Windows 10 from a previous version](appv-migrating-to-appv-from-a-previous-version.md). + +>**Important** +You can upgrade your existing App-V installation to Windows 10, version 1607 from App-V versions 5.0 SP2 and higher only. If you are using a previous version of App-V, you’ll need to upgrade from that version to App-V 5.0 SP2 before you upgrade to Windows 10, version 1607. + +  +## Support for System Center + +App-V supports System Center 2016 and System Center 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager. + + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[Release Notes for App-V](appv-release-notes-for-appv-for-windows.md) diff --git a/windows/manage/appv-accessibility.md b/windows/manage/appv-accessibility.md new file mode 100644 index 0000000000..34a3ab0a09 --- /dev/null +++ b/windows/manage/appv-accessibility.md @@ -0,0 +1,4 @@ +--- +title: Accessibility for App-V (Windows 10) +redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-getting-started +--- diff --git a/windows/manage/appv-accessing-the-client-management-console.md b/windows/manage/appv-accessing-the-client-management-console.md new file mode 100644 index 0000000000..d6ad0b2b1a --- /dev/null +++ b/windows/manage/appv-accessing-the-client-management-console.md @@ -0,0 +1,4 @@ +--- +title: How to access the client management console (Windows 10) +redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-using-the-client-management-console +--- diff --git a/windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md new file mode 100644 index 0000000000..af573415ac --- /dev/null +++ b/windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md @@ -0,0 +1,39 @@ +--- +title: How to Add or Remove an Administrator by Using the Management Console (Windows 10) +description: How to Add or Remove an Administrator by Using the Management Console +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Add or Remove an Administrator by Using the Management Console + +**Applies to** +- Windows 10, version 1607 + +Use the following procedures to add or remove an administrator on the Microsoft Application Virtualization (App-V) server. + +**To add an administrator using the Management Console** + +1. Open the Microsoft Application Virtualization (App-V) Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of Access Directory (AD) users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) server. + +2. To add a new administrator, click **Add Administrator** Type the name of the administrator that you want to add in the **Active Directory Name** field. Ensure you provide the associated user account domain name. For example, **Domain** \\ **UserName**. + +3. Select the account that you want to add and click **Add**. The new account is displayed in the list of server administrators. + +**To remove an administrator using the Management Console** + +1. Open the Microsoft Application Virtualization (App-V) Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of AD users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) server. + +2. Right-click the account to be removed from the list of administrators and select **Remove**. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md new file mode 100644 index 0000000000..5a7ba35ca9 --- /dev/null +++ b/windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md @@ -0,0 +1,48 @@ +--- +title: How to Add or Upgrade Packages by Using the Management Console (Windows 10) +description: How to Add or Upgrade Packages by Using the Management Console +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Add or Upgrade Packages by Using the Management Console + +**Applies to** +- Windows 10, version 1607 + +You can the following procedure to add or upgrade a package to the App-V Management Console. To upgrade a package that already exists in the Management Console, use the following steps and import the upgraded package using the same package **Name**. + +**To add a package to the Management Console** + +1. Click the **Packages** tab in the navigation pane of the Management Console display. + + The console displays the list of packages that have been added to the server along with status information about each package. When a package is selected, detailed information about the package is displayed in the **PACKAGES** pane. + + Click the **Ungrouped** drop-down list box and specify how the packages are to be displayed in the console. You can also click the associated column header to sort the packages. + +2. To specify the package you want to add, click **Add or Upgrade Packages**. + +3. Type the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **http://server.1234/file.appv**, and then click **Add**. + + **Important**   + You must select a package with the **.appv** file name extension. + +   + +4. The page displays the status message **Adding <Packagename>**. Click **IMPORT STATUS** to check the status of a package that you have imported. + + Click **OK** to add the package and close the **Add Package** page. If there was an error during the import, click **Detail** on the **Package Import** page for more information. The newly added package is now available in the **PACKAGES** pane. + +5. Click **Close** to close the **Add or Upgrade Packages** page. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-administering-appv-with-powershell.md b/windows/manage/appv-administering-appv-with-powershell.md new file mode 100644 index 0000000000..877ce78083 --- /dev/null +++ b/windows/manage/appv-administering-appv-with-powershell.md @@ -0,0 +1,136 @@ +--- +title: Administering App-V by Using Windows PowerShell (Windows 10) +description: Administering App-V by Using Windows PowerShell +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Administering App-V by Using Windows PowerShell + +**Applies to** +- Windows 10, version 1607 + +Microsoft Application Virtualization (App-V) provides Windows PowerShell cmdlets, which can help administrators perform various App-V tasks. The following sections provide more information about using Windows PowerShell with App-V. + +## How to administer App-V by using Windows PowerShell + + +Use the following Windows PowerShell procedures to perform various App-V tasks. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameDescription

    [How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md)

    Describes how to install the Windows PowerShell cmdlets and find cmdlet help and examples.

    [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md)

    Describes how to manage the client package lifecycle on a stand-alone computer by using Windows PowerShell.

    [How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md)

    Describes how to manage connection groups by using Windows PowerShell.

    [How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md)

    Describes how to modify the client by using Windows PowerShell.

    [How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md)

    Describes how to apply a user configuration file by using Windows PowerShell.

    [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md)

    Describes how to apply a deployment configuration file by using Windows PowerShell.

    [How to Sequence a Package by Using Windows PowerShell](appv-sequence-a-package-with-powershell.md)

    Describes how to create a new package by using Windows PowerShell.

    [How to Create a Package Accelerator by Using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md)

    Describes how to create a package accelerator by using Windows PowerShell. You can use package accelerators automatically sequence large, complex applications.

    [How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)

    Describes how to enable the computer running the App-V to send reporting information.

    [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md)

    Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.

    [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) +

    Describes how to use Windows PowerShell to configure a client after you deploy the App-V management and publishing servers, and add the required packages and connection groups.

    + +  + +**Important**   +Make sure that any script you execute with your App-V packages matches the execution policy that you have configured for Windows PowerShell. + +  + +## Windows PowerShell Error Handling + + +Use the following table for information about Windows PowerShell error handling for App-V. + + ++++ + + + + + + + + + + + + + + + + +
    EventAction

    Using the RollbackOnError attribute with embedded scripts

    When you use the RollbackOnError attribute with embedded scripts, the attribute is ignored for the following events:

    +
      +

    • Removing a package

      • +

    • Unpublishing a package

      • +

    • Terminating a virtual environment

      • +

    • Terminating a process

      • +

    Package name contains $

    If a package name contains the character ( $ ), you must use a single-quote ( ' ), for example,

    +

    Add-AppvClientPackage 'Contoso$App.appv'

    + +  + +## Have a suggestion for App-V? + + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-administering-virtual-applications-with-the-management-console.md b/windows/manage/appv-administering-virtual-applications-with-the-management-console.md new file mode 100644 index 0000000000..a110cd87b5 --- /dev/null +++ b/windows/manage/appv-administering-virtual-applications-with-the-management-console.md @@ -0,0 +1,115 @@ +--- +title: Administering App-V Virtual Applications by Using the Management Console (Windows 10) +description: Administering App-V Virtual Applications by Using the Management Console +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Administering App-V Virtual Applications by Using the Management Console + +**Applies to** +- Windows 10, version 1607 + +Use the Microsoft Application Virtualization (App-V) management server to manage packages, connection groups, and package access in your environment. The server publishes application icons, shortcuts, and file type associations to authorized computers that run the App-V client. One or more management servers typically share a common data store for configuration and package information. + +The management server uses Active Directory Domain Services (AD DS) groups to manage user authorization and has SQL Server installed to manage the database and data store. + +Because the management servers stream applications to end users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. The management server consists of the following components: + +- Management Server – Use the management server to manage packages and connection groups. + +- Publishing Server – Use the publishing server to deploy packages to computers that run the App-V client. + +- Management Database - Use the management database to manage the package access and to publish the server’s synchronization with the management server. + +## Management Console tasks + + +The most common tasks that you can perform with the App-V Management console are: + +- [How to Connect to the Management Console](appv-connect-to-the-management-console.md) + +- [How to Add or Upgrade Packages by Using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md) + +- [How to Configure Access to Packages by Using the Management Console](appv-configure-access-to-packages-with-the-management-console.md) + +- [How to Publish a Package by Using the Management Console](appv-publish-a-packages-with-the-management-console.md) + +- [How to Delete a Package in the Management Console](appv-delete-a-package-with-the-management-console.md) + +- [How to Add or Remove an Administrator by Using the Management Console](appv-add-or-remove-an-administrator-with-the-management-console.md) + +- [How to Register and Unregister a Publishing Server by Using the Management Console](appv-register-and-unregister-a-publishing-server-with-the-management-console.md) + +- [How to Create a Custom Configuration File by Using the App-V Management Console](appv-create-a-custom-configuration-file-with-the-management-console.md) + +- [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console](appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md) + +- [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](appv-customize-virtual-application-extensions-with-the-management-console.md) + +- [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md) + +The main elements of the App-V Management Console are: + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
    Management Console tabDescription

    Packages tab

    Use the PACKAGES tab to add or upgrade packages.

    Connection Groups tab

    Use the CONNECTION GROUPS tab to manage connection groups.

    Servers tab

    Use the SERVERS tab to register a new server.

    Administrators tab

    Use the ADMINISTRATORS tab to register, add, or remove administrators in your App-V environment.

    + +  + +**Important**   +JavaScript must be enabled on the browser that opens the Web Management Console. + +  + +## Have a suggestion for App-V? + + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Other resources for this App-V deployment + + +- [Application Virtualization (App-V) overview](appv-for-windows.md) + +- [Operations for App-V](appv-operations.md) + +  + +  + + + + + diff --git a/windows/manage/appv-allow-administrators-to-enable-connection-groups.md b/windows/manage/appv-allow-administrators-to-enable-connection-groups.md new file mode 100644 index 0000000000..8241c5edef --- /dev/null +++ b/windows/manage/appv-allow-administrators-to-enable-connection-groups.md @@ -0,0 +1,60 @@ +--- +title: How to Allow Only Administrators to Enable Connection Groups (Windows 10) +description: How to Allow Only Administrators to Enable Connection Groups +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Allow Only Administrators to Enable Connection Groups + +**Applies to** +- Windows 10, version 1607 + +You can configure the App-V client so that only administrators (not end users) can enable or disable connection groups. In earlier versions of App-V, you could not prevent end users from performing these tasks. + +**Note**
    +This feature is supported starting in App-V 5.0 SP3. + +Use one of the following methods to allow only administrators to enable or disable connection groups. + + ++++ + + + + + + + + + + + + + + + + +
    MethodSteps

    Group Policy setting

    Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node:

    +

    Computer Configuration > Administrative Templates > System > App-V > Publishing

    Windows PowerShell cmdlet

    Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.

    +

    Parameter values:

    +
      +

    • 0 - False

      • +

    • 1 - True

      • +
    +

    Example: Set-AppvClientConfiguration -RequirePublishAsAdmin 1

    + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/manage/appv-application-publishing-and-client-interaction.md b/windows/manage/appv-application-publishing-and-client-interaction.md new file mode 100644 index 0000000000..b99eb36f43 --- /dev/null +++ b/windows/manage/appv-application-publishing-and-client-interaction.md @@ -0,0 +1,1287 @@ +--- +title: Application Publishing and Client Interaction (Windows 10) +description: Application Publishing and Client Interaction +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Application Publishing and Client Interaction + +**Applies to** +- Windows 10, version 1607 + +This article provides technical information about common App-V client operations and their integration with the local operating system. + +## App-V package files created by the Sequencer + + +The Sequencer creates App-V packages and produces a virtualized application. The sequencing process creates the following files: + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FileDescription

    .appv

      +

    • The primary package file, which contains the captured assets and state information from the sequencing process.

      • +

    • Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.

      • +

    .MSI

    Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform.

    _DeploymentConfig.XML

    File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V client.

    _UserConfig.XML

    File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V client.

    Report.xml

    Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations.

    .CAB

    Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package.

    .appvt

    Optional: Sequencer template file used to retain commonly reused Sequencer settings.

    + +For information about sequencing, see [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). + +## What’s in the appv file? + + +The appv file is a container that stores XML and non-XML files together in a single entity. This file is built from the AppX format, which is based on the Open Packaging Conventions (OPC) standard. + +To view the appv file contents, make a copy of the package, and then rename the copied file to a ZIP extension. + +The appv file contains the following folder and files, which are used when creating and publishing a virtual application: + +| Name | Type | Description | +| - | - | - | +| Root | File folder | Directory that contains the file system for the virtualized application that is captured during sequencing. | +| [Content_Types].xml | XML File | List of the core content types in the appv file (e.g. DLL, EXE, BIN). | +| AppxBlockMap.xml | XML File | Layout of the appv file, which uses File, Block, and BlockMap elements that enable location and validation of files in the App-V package.| +| AppxManifest.xml | XML File | Metadata for the package that contains the required information for adding, publishing, and launching the package. Includes extension points (file type associations and shortcuts) and the names and GUIDs associated with the package.| +| FilesystemMetadata.xml | XML File | List of the files captured during sequencing, including attributes (e.g., directories, files, opaque directories, empty directories,and long and short names). | +| PackageHistory.xml | XML File | Information about the sequencing computer (operating system version, Internet Explorer version, .Net Framework version) and process (upgrade, package version).| +| Registry.dat | DAT File | Registry keys and values captured during the sequencing process for the package.| +| StreamMap.xml | XML File | List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process.| + +  + +## App-V client data storage locations + +The App-V client performs tasks to ensure that virtual applications run properly and work like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. + +| Name | Location | Description | +| - | - | - | +| Package Store | %ProgramData%\App-V| Default location for read only package files| +| Machine Catalog | %ProgramData%\Microsoft\AppV\Client\Catalog| Contains per-machine configuration documents| +| User Catalog | %AppData%\Microsoft\AppV\Client\Catalog| Contains per-user configuration documents| +| Shortcut Backups | %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups| Stores previous integration points that enable restore on package unpublish| +| Copy on Write (COW) Roaming | %AppData%\Microsoft\AppV\Client\VFS| Writeable roaming location for package modification| +| Copy on Write (COW) Local | %LocalAppData%\Microsoft\AppV\Client\VFS| Writeable non-roaming location for package modification| +| Machine Registry | HKLM\Software\Microsoft\AppV| Contains package state information, including VReg for machine or globally published packages (Machine hive)| +| User Registry | HKCU\Software\Microsoft\AppV| Contains user package state information including VReg| +| User Registry Classes | HKCU\Software\Classes\AppV| Contains additional user package state information| + +Additional details for the table are provided in the section below and throughout the document. + +### Package store + +The App-V Client manages the applications assets mounted in the package store. This default storage location is `%ProgramData%\App-V`, but you can configure it during or after setup by using the `Set-AppVClientConfiguration` Windows PowerShell cmdlet, which modifies the local registry (`PackageInstallationRoot` value under the `HKLM\Software\Microsoft\AppV\Client\Streaming` key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named for the Package GUID and Version GUID. + +Example of a path to a specific application: + +``` syntax +C:\ProgramData\App-V\PackGUID\VersionGUID +``` + +To change the default location of the package store during setup, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). + +### Shared Content Store + +If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information, see [Shared Content Store in Microsoft App-V 5.0 - Behind the Scenes](https://blogs.technet.microsoft.com/appv/2013/07/22/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes/). + +> [!NOTE] +> The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. + +  + +### Package catalogs + +The App-V Client manages the following two file-based locations: + +- **Catalogs (user and machine).** + +- **Registry locations** - depends on how the package is targeted for publishing. There is a Catalog (data store) for the computer, and a catalog for each individual user. The Machine Catalog stores global information applicable to all users or any user, and the User Catalog stores information applicable to a specific user. The Catalog is a collection of Dynamic Configurations and manifest files; there is discrete data for both file and registry per package version.  + +### Machine catalog + + ++++ + + + + + + + + + + + + + + + + + + + + + + +

    Description

    Stores package documents that are available to users on the machine, when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

    +

    If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (e.g., the package directory is in a shared disk location).

    +

    If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.

    Default storage location

    %programdata%\Microsoft\AppV\Client\Catalog\

    +

    This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.

    Files in the machine catalog

      +

    • Manifest.xml

      • +

    • DeploymentConfiguration.xml

      • +

    • UserManifest.xml (Globally Published Package)

      • +

    • UserDeploymentConfiguration.xml (Globally Published Package)

      • +

    Additional machine catalog location, used when the package is part of a connection group

    The following location is in addition to the specific package location mentioned above:

    +

    %programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID

    Additional files in the machine catalog when the package is part of a connection group

      +

    • PackageGroupDescriptor.xml

      • +

    • UserPackageGroupDescriptor.xml (globally published Connection Group)

      • +
    + +  + +### User catalog + + ++++ + + + + + + + + + + + + + + + + + + + + + + +

    Description

    Created during the publishing process. Contains information used for publishing the package, and also used at launch to ensure that a package is provisioned to a specific user. Created in a roaming location and includes user-specific publishing information.

    +

    When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

    +

    For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.

    Default storage location

    appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID

    Files in the user catalog

      +

    • UserManifest.xml

      • +

    • DynamicConfiguration.xml or UserDeploymentConfiguration.xml

      • +

    Additional user catalog location, used when the package is part of a connection group

    The following location is in addition to the specific package location mentioned above:

    +

    appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID

    Additional file in the machine catalog when the package is part of a connection group

    UserPackageGroupDescriptor.xml

    + +  + +### Shortcut backups + +During the publishing process, the App-V Client backs up any shortcuts and integration points to `%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups.` This backup enables the restoration of these integration points to the previous versions when the package is unpublished. + +### Copy on Write files + +The Package Store contains a pristine copy of the package files that have been streamed from the publishing server. During normal operation of an App-V application, the user or service may require changes to the files. These changes are not made in the package store in order to preserve your ability to repair the application, which removes these changes. These locations, called Copy on Write (COW), support both roaming and non-roaming locations. The location where the modifications are stored depends where the application has been programmed to write changes to in a native experience. + +### COW roaming + +The COW Roaming location described above stores changes to files and directories that are targeted to the typical %AppData% location or \\Users\\*<username>*\\AppData\\Roaming location. These directories and files are then roamed based on the operating system settings. + +### COW local + +The COW Local location is similar to the roaming location, but the directories and files are not roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (e.g. Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the logged on users. The non-**S** location stores user based changes. + +## Package registry + + +Before an application can access the package registry data, the App-V Client must make the package registry data available to the applications. The App-V Client uses the real registry as a backing store for all registry data. + +When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at `%ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat`. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. + +**Registry.dat from Package Store** > **%ProgramData%\Microsoft\AppV\Client\Vreg\\{VersionGuid}.dat** +  + +When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY`. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location `HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User`. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. + +### Package registry staging vs. connection group registry staging + +When connection groups are present, the previous process of staging the registry holds true, but instead of having one hive file to process, there are more than one. The files are processed in the order in which they appear in the connection group XML, with the first writer winning any conflicts. + +The staged registry persists the same way as in the single package case. Staged user registry data remains for the connection group until it is disabled; staged machine registry data is removed on connection group removal. + +### Virtual registry + +The purpose of the virtual registry (VREG) is to provide a single merged view of the package registry and the native registry to applications. It also provides copy-on-write (COW) functionality – that is any changes made to the registry from the context of a virtual process are made to a separate COW location. This means that the VREG must combine up to three separate registry locations into a single view based on the populated locations in the registry COW -> package -> native. When a request is made for a registry data it will locate in order until it finds the data it was requesting. Meaning if there is a value stored in a COW location it will not proceed to other locations, however, if there is no data in the COW location it will proceed to the Package and then Native location until it finds the appropriate data. + +### Registry locations + +There are two package registry locations and two connection group locations where the App-V Client stores registry information, depending on whether the Package is published individually or as part of a connection group. There are three COW locations for packages and three for connection groups, which are created and managed by the VREG. Settings for packages and connection groups are not shared: + +**Single Package VReg:** + + ++++ + + + + + + + + + + + + + + + + + + +

    Location

    Description

    COW

      +

    • Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)

      • +

    • User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes

      • +

    • User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non elevated process)

      • +

    Package

      +

    • Machine Registry\Client\Packages\PkgGUID\Versions\VerGuid\Registry\Machine

      • +

    • User Registry Classes\Client\Packages\PkgGUID\Versions\VerGUID\Registry

      • +

    Native

      +

    • Native application registry location

      • +
    + +  + +  + +**Connection Group VReg:** + + ++++ + + + + + + + + + + + + + + + + + + +

    Location

    Description

    COW

      +

    • Machine Registry\Client\PackageGroups\GrpGUID\REGISTRY (only elevate process can write)

      • +

    • User Registry\Client\PackageGroups\GrpGUID\REGISTRY (Anything written to HKCU except Software\Classes

      • +

    • User Registry Classes\Client\PackageGroups\GrpGUID\REGISTRY

      • +

    Package

      +

    • Machine Registry\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

      • +

    • User Registry Classes\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

      • +

    Native

      +

    • Native application registry location

      • +
    + +  + +  + +There are two COW locations for HKLM; elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first. + +### Pass-through keys + +Pass-through keys enable an administrator to configure certain keys so they can only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key `HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry`. Any key that appears under this multi-string value (and their children) will be treated as pass-through. + +The following locations are configured as pass-through locations by default: + +- HKEY\_CURRENT\_USER\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel + +- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel + +- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT + +- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\services\\eventlog\\Application + +- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger + +- HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings + +- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib + +- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies + +- HKEY\_CURRENT\_USER\\SOFTWARE\\Policies + +The purpose of Pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI based applications. It is recommend that administers do not modify any of the default pass-through keys, but in some instances, based on application behavior may require adding additional pass-through keys. + +## App-V package store behavior + + +App-V manages the Package Store, which is the location where the expanded asset files from the appv file are stored. By default, this location is stored at %ProgramData%\\App-V, and is limited in terms of storage capabilities only by free disk space. The package store is organized by the GUIDs for the package and version as mentioned in the previous section. + +### Add packages + +App-V Packages are staged upon addition to the computer with the App-V Client. The App-V Client provides on-demand staging. During publishing or a manual Add-AppVClientPackage, the data structure is built in the package store (c:\\programdata\\App-V\\{PkgGUID}\\{VerGUID}). The package files identified in the publishing block defined in the StreamMap.xml are added to the system and the top level folders and child files staged to ensure proper application assets exist at launch. + +### Mounting packages + +Packages can be explicitly loaded using the Windows PowerShell `Mount-AppVClientPackage` or by using the **App-V Client UI** to download a package. This operation completely loads the entire package into the package store. + +### Streaming packages + +The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: `HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Streaming`. Policies are set using the Windows PowerShell cmdlet `Set-AppvClientConfiguration`. The following policies apply to Streaming: + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    PolicyDescription

    AllowHighCostLaunch

    Allows streaming over 3G and cellular networks

    AutoLoad

    Specifies the Background Load setting:

    +

    0 - Disabled

    +

    1 – Previously Used Packages only

    +

    2 – All Packages

    PackageInstallationRoot

    The root folder for the package store in the local machine

    PackageSourceRoot

    The root override where packages should be streamed from

    SharedContentStoreMode

    Enables the use of Shared Content Store for VDI scenarios

    + +  + +  + +These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors around streaming packages that must be explained: + +- Background Streaming + +- Optimized Streaming + +- Stream Faults + +### Background streaming + +The Windows PowerShell cmdlet `Get-AppvClientConfiguration` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with the cmdlet Set-AppvClientConfiguration or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can be disabled all together (value=0) or enabled for all packages (value=2), whether they have been launched. + +### Optimized streaming + +App-V packages can be configured with a primary feature block during sequencing. This setting allows the sequencing engineer to monitor launch files for a specific application, or applications, and mark the blocks of data in the App-V package for streaming at first launch of any application in the package. + +### Stream faults + +After the initial stream of any publishing data and the primary feature block, requests for additional files perform stream faults. These blocks of data are downloaded to the package store on an as-needed basis. This allows a user to download only a small part of the package, typically enough to launch the package and run normal tasks. All other blocks are downloaded when a user initiates an operation that requires data not currently in the package store. + +### Package upgrades + +App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are similar to the package publish operation, as each version will be created in its own PackageRoot location: `%ProgramData%\App-V\{PkgGUID}\{newVerGUID}`. The upgrade operation is optimized by creating hard links to identical- and streamed-files from other versions of the same package. + +### Package removal + +The behavior of the App-V Client when packages are removed depends on the method used for removal. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the Windows PowerShell cmdlet `Remove-AppVClientPackge` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. + +## Roaming registry and data + + +App-V is able to provide a near-native experience when roaming, depending on how the application being used is written. By default, App-V roams AppData that is stored in the roaming location, based on the roaming configuration of the operating system. Other locations for storage of file-based data do not roam from computer to computer, since they are in locations that are not roamed. + +### Roaming requirements and user catalog data storage + +App-V stores data, which represents the state of the user’s catalog, in the form of: + +- Files under %appdata%\\Microsoft\\AppV\\Client\\Catalog + +- Registry settings under `HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages` + +Together, these files and registry settings represent the user’s catalog, so either both must be roamed, or neither must be roamed for a given user. App-V does not support roaming %AppData%, but not roaming the user’s profile (registry), or vice versa. + +> [!NOTE] +> The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under `HKEY_CURRENT_USER` is missing or mismatched with the data in %appdata%. + +  + +### Registry-based data + +App-V registry roaming falls into two scenarios, as shown in the following table. + + ++++ + + + + + + + + + + + + + + + + +
    ScenarioDescription

    Applications that are run as standard users

    When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:

    +
      +

    • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages\\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE

      • +

    • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\REGISTRY\USER\\{UserSID}\SOFTWARE

      • +
    +

    The locations are enabled for roaming based on the operating system settings.

    Applications that are run with elevation

    When an application is launched with elevation:

    +
      +

    • HKLM data is stored in the HKLM hive on the local computer

      • +

    • HKCU data is stored in the User Registry location

      • +
    +

    In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:

    +
      +

    • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\{UserSID}\REGISTRY\MACHINE\SOFTWARE

      • +

    • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\Registry\User\\{UserSID}\SOFTWARE

      • +
    + +  + +### App-V and folder redirection + +App-V supports folder redirection of the roaming AppData folder (%AppData%). When the virtual environment is started, the roaming AppData state from the user’s roaming AppData directory is copied to the local cache. Conversely, when the virtual environment is shut down, the local cache that is associated with a specific user’s roaming AppData is transferred to the actual location of that user’s roaming AppData directory. + +A typical package has several locations mapped in the user’s backing store for settings in both AppData\\Local and AppData\\Roaming. These locations are the Copy on Write locations that are stored per user in the user’s profile, and that are used to store changes made to the package VFS directories and to protect the default package VFS. + +The following table shows local and roaming locations, when folder redirection has not been implemented. + +| VFS directory in package | Mapped location of backing store | +| - | - | +| ProgramFilesX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\ProgramFilesX86 | +| SystemX86 | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\SystemX86 | +| Windows | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\Windows | +| appv\_ROOT | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\appv_ROOT| +| AppData | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\AppData | + +The following table shows local and roaming locations, when folder redirection has been implemented for %AppData%, and the location has been redirected (typically to a network location). + +| VFS directory in package | Mapped location of backing store | +| - | - | +| ProgramFilesX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\ProgramFilesX86 | +| SystemX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\SystemX86 | +| Windows | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\Windows | +| appv_ROOT | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\appv\_ROOT | +| AppData | \\Fileserver\users\Local\roaming\Microsoft\AppV\Client\VFS\\<GUID>\AppData | +  + +The current App-V Client VFS driver cannot write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are: + +1. During publishing or virtual environment startup, the App-V Client detects the location of the AppData directory. + +2. If the roaming AppData path is local or ino AppData\\Roaming location is mapped, nothing happens. + +3. If the roaming AppData path is not local, the VFS AppData directory is mapped to the local AppData directory. + +This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The detailed steps of this process are: + +1. App-V application is shut down, which shuts down the virtual environment. + +2. The local cache of the roaming AppData location is compressed and stored in a ZIP file. + +3. A timestamp at the end of the ZIP packaging process is used to name the file. + +4. The timestamp is recorded in the registry: HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime as the last known AppData timestamp. + +5. The folder redirection process is called to evaluate and initiate the ZIP file uploaded to the roaming AppData directory. + +The timestamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: + +1. The user starts the virtual environment by starting an application. + +2. The application’s virtual environment checks for the most recent time stamped ZIP file, if present. + +3. The registry is checked for the last known uploaded timestamp, if present. + +4. The most recent ZIP file is downloaded unless the local last known upload timestamp is greater than or equal to the timestamp from the ZIP file. + +5. If the local last known upload timestamp is earlier than that of the most recent ZIP file in the roaming AppData location, the ZIP file is extracted to the local temp directory in the user’s profile. + +6. After the ZIP file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. + +7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. + +This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: + +1. During repair, detect if the path to the user’s roaming AppData directory is not local. + +2. Map the non-local roaming AppData path targets are recreated the expected roaming and local AppData locations. + +3. Delete the timestamp stored in the registry, if present. + +This process will re-create both the local and network locations for AppData and remove the registry record of the timestamp. + +## App-V client application lifecycle management + + +In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers via the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of Windows PowerShell commands initiated on the computer running the App-V Client. + +This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/en-us/download/details.aspx?id=38177). + +The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured (after the client is enabled) with Windows PowerShell commands. See [App-V Client Configuration Settings: Windows PowerShell](appv-client-configuration-settings.md#app-v-client-configuration-settings-windows-powershell). + +### Publishing refresh + +The publishing refresh process is comprised of several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process at user logon, machine startup, and at scheduled intervals. The configuration of the client during setup listed above is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following Windows PowerShell cmdlets: + +- **Add-AppVPublishingServer:** Configures the client with an App-V Publishing Server that provides App-V packages. + +- **Set-AppVPublishingServer:** Modifies the current settings for the App-V Publishing Server. + +- **Set-AppVClientConfiguration:** Modifies the currents settings for the App-V Client. + +- **Sync-AppVPublishingServer:** Initiates an App-V Publishing Refresh process manually. This is also utilized in the scheduled tasks created during configuration of the publishing server. + +The focus of the following sections is to detail the operations that occur during different phases of an App-V Publishing Refresh. The topics include: + +- Adding an App-V Package + +- Publishing an App-V Package + +### Adding an App-V package + +Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the `Add-AppVClientPackage` cmdlet in Windows PowerShell, except during the publishing refresh add process, the configured publishing server is contacted and passes a high-level list of applications back to the client to pull more detailed information and not a single package add operation. The process continues by configuring the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following is a detailed workflow of the process, assuming the package is configured for Fault Streaming. + +**How to add an App-V package** + +1. Manual initiation via Windows PowerShell or Task Sequence initiation of the Publishing Refresh process. + + 1. The App-V Client makes an HTTP connection and requests a list of applications based on the target. The Publishing refresh process supports targeting machines or users. + + 2. The App-V Publishing Server uses the identity of the initiating target, user or machine, and queries the database for a list of entitled applications. The list of applications is provided as an XML response, which the client uses to send additional requests to the server for more information on a per package basis. + +2. The Publishing Agent on the App-V Client performs all actions below serialized. + + Evaluate any connection groups that are unpublished or disabled, since package version updates that are part of the connection group cannot be processed. + +3. Configure the packages by identifying an Add or Update operations. + + 1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server. + + 2. The package file is opened and the AppXManifest.xml and StreamMap.xml are downloaded to the Package Store. + + 3. Completely stream publishing block data defined in the StreamMap.xml. Stores the publishing block data in the Package Store\\PkgGUID\\VerGUID\\Root. + + - Icons: Targets of extension points. + + - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, directly accessed or via file types. + + - Scripts: Download scripts directory for use throughout the publishing process. + + 4. Populate the Package store: + + 1. Create sparse files on disk that represent the extracted package for any directories listed. + + 2. Stage top level files and directories under root. + + 3. All other files are created when the directory is listed as sparse on disk and streamed on demand. + + 5. Create the machine catalog entries. Create the Manifest.xml and DeploymentConfiguration.xml from the package files (if no DeploymentConfiguration.xml file in the package a placeholder is created). + + 6. Create location of the package store in the registry HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog + + 7. Create the Registry.dat file from the package store to %ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat + + 8. Register the package with the App-V Kernal Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV + + 9. Invoke scripting from the AppxManifest.xml or DeploymentConfig.xml file for Package Add timing. + +4. Configure Connection Groups by adding and enabling or disabling. + +5. Remove objects that are not published to the target (user or machine). + + > [!NOTE] + > This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published). + +   + +6. Invoke background load mounting based on client configuration. + +7. Packages that already have publishing information for the machine or user are immediately restored. + + > [!NOTE]    + > This condition occurs as a product of removal without unpublishing with background addition of the package. + +   + +This completes an App-V package add of the publishing refresh process. The next step is publishing the package to the specific target (machine or user). + +![package add file and registry data](images/packageaddfileandregistrydata.png) + +### Publishing an App-V package + +During the Publishing Refresh operation, the specific publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. The following are the detailed steps. + +**How to publish and App-V package** + +1. Package entries are added to the user catalog + + 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the User Catalog + + 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the Machine Catalog + +2. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV + +3. Perform integration tasks. + + 1. Create extension points. + + 2. Store backup information in the user’s registry and roaming profile (Shortcut Backups). + + **Note**   + This enables restore extension points if the package is unpublished. + +   + + 3. Run scripts targeted for publishing timing. + +Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the machine and users catalog information above for details. + +![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) + +### Application launch + +After the Publishing Refresh process, the user launches and subsequently re-launches an App-V application. The process is very simple and optimized to launch quickly with a minimum of network traffic. The App-V Client checks the path to the user catalog for files created during publishing. After rights to launch the package are established, the App-V Client creates a virtual environment, begins streaming any necessary data, and applies the appropriate manifest and deployment configuration files during virtual environment creation. With the virtual environment created and configured for the specific package and application, the application starts. + +**How to launch App-V applications** + +1. User launches the application by clicking on a shortcut or file type invocation. + +2. The App-V Client verifies existence in the User Catalog for the following files + + - UserDeploymentConfiguration.xml + + - UserManifest.xml + +3. If the files are present, the application is entitled for that specific user and the application will start the process for launch. There is no network traffic at this point. + +4. Next, the App-V Client checks that the path for the package registered for the App-V Client service is found in the registry. + +5. Upon finding the path to the package store, the virtual environment is created. If this is the first launch, the Primary Feature Block downloads if present. + +6. After downloading, the App-V Client service consumes the manifest and deployment configuration files to configure the virtual environment and all App-V subsystems are loaded. + +7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. + + ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) + +### Upgrading an App-V package + +The App-V package upgrade process differs from the older versions of App-V. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time as the package store and catalogs are updated with the new resources. The only process specific to the addition of new version resources is storage optimization. During an upgrade, only the new files are added to the new version store location and hard links are created for unchanged files. This reduces the overall storage by only presenting the file on one disk location and then projecting it into all folders with a file location entry on the disk. The specific details of upgrading an App-V Package are as follows: + +**How to upgrade an App-V package** + +1. The App-V Client performs a Publishing Refresh and discovers a newer version of an App-V Package. + +2. Package entries are added to the appropriate catalog for the new version + + 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the user catalog at appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID + + 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the machine catalog at %programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID + +3. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV + +4. Perform integration tasks. + + 1. Integrate extensions points (EP) from the Manifest and Dynamic Configuration files. + + 2. File based EP data is stored in the AppData folder utilizing Junction Points from the package store. + + 3. Version 1 EPs already exist when a new version becomes available. + + 4. The extension points are switched to the Version 2 location in machine or user catalogs for any newer or updated extension points. + +5. Run scripts targeted for publishing timing. + +6. Install Side by Side assemblies as required. + +### Upgrading an in-use App-V package + +If you try to upgrade a package that is in use by an end user, the upgrade task is placed in a pending state. The upgrade will run later, according to the following rules: + +| Task type | Applicable rule | +| - | - | +| User-based task, e.g., publishing a package to a user | The pending task will be performed after the user logs off and then logs back on. | +| Globally based task, e.g., enabling a connection group globally | The pending task will be performed when the computer is shut down and then restarted. | + +When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows: + +| User-based or globally based task | Where the registry key is generated | +| - | - | +| User-based tasks | HKEY\_CURRENT\_USER\Software\Microsoft\AppV\Client\PendingTasks | +| Globally based tasks | HKEY\_LOCAL\_MACHINE\Software\Microsoft\AppV\Client\PendingTasks | + +The following operations must be completed before users can use the newer version of the package: + +| Task | Details | +| - | - | +| Add the package to the computer | This task is computer specific and you can perform it at any time by completing the steps in the Package Add section above. | +| Publish the package | See the Package Publishing section above for steps. This process requires that you update extension points on the system. End users cannot be using the application when you complete this task. | + +Use the following example scenarios as a guide for updating packages. + +| Scenario | Requirements | +| - | - | +| App-V package is not in use when you try to upgrade | None of the following components of the package can be in use: virtual application, COM server, or shell extensions.

    The administrator publishes a newer version of the package and the upgrade works the next time a component or application inside the package is launched. The new version of the package is streamed and ran. | +| App-V package is in use when the administrator publishes a newer version of the package | The upgrade operation is set to pending by the App-V Client, which means that it is queued and carried out later when the package is not in use.

    If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur.

    If the package has shell extensions, which are permanently loaded by Windows Explorer, the user cannot be logged in. Users must log off and the log back in to initiate the App-V package upgrade.| + +  +### Global vs user publishing + +App-V Packages can be published in one of two ways; User which entitles an App-V package to a specific user or group of users and Global which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: + +- **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. + +- **User published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via Windows PowerShell commands). + +### Removing an App-V package + +Removing App-V applications in a Full Infrastructure is an unpublish operation, and does not perform a package removal. The process is the same as the publish process above, but instead of adding the removal process reverses the changes that have been made for App-V Packages. + +### Repairing an App-V package + +The repair operation is very simple but may affect many locations on the machine. The previously mentioned Copy on Write (COW) locations are removed, and extension points are de-integrated and then re-integrated. Please review the COW data placement locations by reviewing where they are registered in the registry. This operation is done automatically and there is no administrative control other than initiating a Repair operation from the App-V Client Console or via Windows PowerShell (Repair-AppVClientPackage). + +## Integration of App-V packages + + +The App-V Client and package architecture provides specific integration with the local operating system during the addition and publishing of packages. Three files define the integration or extension points for an App-V Package: + +- AppXManifest.xml: Stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. + +- DeploymentConfig.xml: Provides configuration information of computer and user based integration extension points. + +- UserConfig.xml: A subset of the Deploymentconfig.xml that only provides user- based configurations and only targets user-based extension points. + +### Rules of integration + +When App-V applications are published to a computer with the App-V Client, some specific actions take place as described in the list below: + +- Global Publishing: Shortcuts are stored in the All Users profile location and other extension points are stored in the registry in the HKLM hive. + +- User Publishing: Shortcuts are stored in the current user account profile and other extension points are stored in the registry in the HKCU hive. + +- Backup and Restore: Existing native application data and registry (such as FTA registrations) are backed up during publishing. + + 1. App-V packages are given ownership based on the last integrated package where the ownership is passed to the newest published App-V application. + + 2. Ownership transfers from one App-V package to another when the owning App-V package is unpublished. This will not initiate a restore of the data or registry. + + 3. Restore the backed up data when the last package is unpublished or removed on a per extension point basis. + +### Extension points + +The App-V publishing files (manifest and dynamic configuration) provide several extension points that enable the application to integrate with the local operating system. These extension points perform typical application installation tasks, such as placing shortcuts, creating file type associations, and registering components. As these are virtualized applications that are not installed in the same manner a traditional application, there are some differences. The following is a list of extension points covered in this section: + +- Shortcuts + +- File Type Associations + +- Shell Extensions + +- COM + +- Software Clients + +- Application capabilities + +- URL Protocol Handler + +- AppPath + +- Virtual Application + +### Shortcuts + +The short cut is one of the basic elements of integration with the OS and is the interface for direct user launch of an App-V application. During the publishing and unpublishing of App-V applications. + +From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section similar to the following: + +``` syntax + + + [{Common Desktop}]\Adobe Reader.lnk + [{AppVPackageRoot}]\Reader\AcroRd32.exe + [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\SC_Reader.ico + + + 1 + [{AppVPackageRoot}]\Reader\AcroRd32.exe + + +``` + +As mentioned previously, the App-V shortcuts are placed by default in the user’s profile based on the refresh operation. Global refresh places shortcuts in the All Users profile and user refresh stores them in the specific user’s profile. The actual executable is stored in the Package Store. The location of the ICO file is a tokenized location in the App-V package. + +### File type associations + +The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files as represented in the example below: + +``` syntax + + + + .xdp + AcroExch.XDPDoc + application/vnd.adobe.xdp+xml + + + AcroExch.XDPDoc + Adobe Acrobat XML Data Package File + 65536 + [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\XDPFile_8.ico + + Read + + [{AppVPackageRoot}]\Reader\AcroRd32.exe + Open + "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" + + + [{AppVPackageRoot}]\Reader\AcroRd32.exe + Printto + "[{AppVPackageRoot}]\Reader\AcroRd32.exe" /t "%1" "%2" "%3" "%4" + + + [{AppVPackageRoot}]\Reader\AcroRd32.exe + Read + Open with Adobe Reader + "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" + + + + + +``` + +**Note**   +In this example: + +- `.xdp` is the extension + +- `AcroExch.XDPDoc` is the ProgId value (which points to the adjoining ProgId) + +- `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable + +  + +### Shell extensions + +Shell extensions are embedded in the package automatically during the sequencing process. When the package is published globally, the shell extension gives users the same functionality as if the application were locally installed. The application requires no additional setup or configuration on the client to enable the shell extension functionality. + +**Requirements for using shell extensions:** + +- Packages that contain embedded shell extensions must be published globally. + +- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: + + - The version of the application is 64-bit. + + - The Sequencer is running on a 64-bit computer. + + - The package is being delivered to a 64-bit App-V client computer. + +The following table displays the supported shell extensions. + +| Handler | Description | +| - | - | +| Context menu handler | Adds menu items to the context menu. It is called before the context menu is displayed. | +| Drag-and-drop handler | Controls the action upon right-click drag-and-drop and modifies the context menu that appears. | +| Drop target handler | Controls the action after a data object is dragged-and-dropped over a drop target such as a file.| +| Data object handler| Controls the action after a file is copied to the clipboard or dragged-and-dropped over a drop target. It can provide additional clipboard formats to the drop target.| +| Property sheet handler| Replaces or adds pages to the property sheet dialog box of an object.| +| Infotip handler| Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse- hover.| +| Column handler| Allows creating and displaying custom columns in Windows Explorer *Details view*. It can be used to extend sorting and grouping.| +| Preview handler| Enables a preview of a file to be displayed in the Windows Explorer Preview Pane.| + +  + +### COM + +The App-V Client supports publishing applications with support for COM integration and virtualization. COM integration allows the App-V Client to register COM objects on the local operating system and virtualization of the objects. For the purposes of this document, the integration of COM objects requires additional detail. + +App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and in-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes off, Isolated, and Integrated. The integrated mode is configured for either the out-of-process or in-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (deploymentconfig.xml or userconfig.xml). + +For details on App-V integration, see [Microsoft Application Virtualization 5.0 Integration](https://blogs.technet.microsoft.com/appv/2013/01/03/microsoft-application-virtualization-5-0-integration). + +### Software clients and application capabilities + +App-V supports specific software clients and application capabilities extension points that enable virtualized applications to be registered with the software client of the operating system. This enables users to select default programs for operations like email, instant messaging, and media player. This operation is performed in the control panel with the Set Program Access and Computer Defaults, and configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. + +Example of software client registration of an App-V based mail client. + +``` syntax + + + + + + + Mozilla Thunderbird + Mozilla Thunderbird + [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 + + + "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /SetAsDefaultAppGlobal + "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /HideShortcuts + "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /ShowShortcuts + + 1 + + + + [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe + "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -mail + + [{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll + + Thunderbird URL + 2 + [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 + + [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe + "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -osint -compose "%1" + + + + + + + +``` + +**Note**   +In this example: + +- `` is the overall Software Clients setting to integrate Email clients + +- `` is the flag to set a particular Email client as the default Email client + +- `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration + +  + +### URL Protocol handler + +Applications do not always specifically called virtualized applications utilizing file type invocation. For, example, in an application that supports embedding a mailto: link inside a document or web page, the user clicks on a mailto: link and expects to get their registered mail client. App-V supports URL Protocol handlers that can be registered on a per-package basis with the local operating system. During sequencing, the URL protocol handlers are automatically added to the package. + +For situations where there is more than one application that could register the specific URL Protocol handler, the dynamic configuration files can be utilized to modify the behavior and suppress or disable this feature for an application that should not be the primary application launched. + +### AppPath + +The AppPath extension point supports calling App-V applications directly from the operating system. This is typically accomplished from the Run or Start Screen, depending on the operating system, which enables administrators to provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable. It therefore avoids modifying the system path environment variable on all systems, as it is accomplished during publishing. + +The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: [App Paths - A Virtual Application Extension in App-V 5.0](https://blogs.technet.microsoft.com/virtualworld/2012/12/12/app-paths-a-virtual-application-extension-in-app-v-5-0/). + +### Virtual application + +This subsystem provides a list of applications captured during sequencing which is usually consumed by other App-V components. Integration of extension points belonging to a particular application can be disabled using dynamic configuration files. For example, if a package contains two applications, it is possible to disable all extension points belonging to one application, in order to allow only integration of extension points of other application. + +### Extension point rules + +The extension points described above are integrated into the operating system based on how the packages has been published. Global publishing places extension points in public machine locations, where user publishing places extension points in user locations. For example a shortcut that is created on the desktop and published globally will result in the file data for the shortcut (%Public%\\Desktop) and the registry data (HKLM\\Software\\Classes). The same shortcut would have file data (%UserProfile%\\Desktop) and registry data (HKCU\\Software\\Classes). + +Extension points are not all published the same way, where some extension points will require global publishing and others require sequencing on the specific operating system and architecture where they are delivered. Below is a table that describes these two key rules. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Virtual ExtensionRequires target OS SequencingRequires Global Publishing

    Shortcut

    File Type Association

    URL Protocols

    X

    AppPaths

    X

    COM Mode

    Software Client

    X

    Application Capabilities

    X

    X

    Context Menu Handler

    X

    X

    Drag-and-drop Handler

    X

    Data Object Handler

    X

    Property Sheet Handler

    X

    Infotip Handler

    X

    Column Handler

    X

    Shell Extensions

    X

    Browser Helper Object

    X

    X

    Active X Object

    X

    X

    + +  + +## Dynamic configuration processing + + +Deploying App-V packages to one machine or user is very simple. However, as organizations deploy AppV applications across business lines and geographic and political boundaries, the ability to sequence an application one time with one set of settings becomes impossible. App-V was designed for this scenario, as it captures specific settings and configurations during sequencing in the Manifest file, but also supports modification with Dynamic Configuration files. + +App-V dynamic configuration allows for specifying a policy for a package either at the machine level or at the user level. The Dynamic Configuration files enable sequencing engineers to modify the configuration of a package, post-sequencing, to address the needs of individual groups of users or machines. In some instances it may be necessary to make modifications to the application to provide proper functionality within the App-V environment. For example, it may be necessary to make modifications to the \_\*config.xml files to allow certain actions to be performed at a specified time during the execution of the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. + +App-V Packages contain the Manifest file inside of the appv package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow the publishing of an application to different desktops or users with different extension points. The two Dynamic Configuration Files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. + +### Example for dynamic configuration files + +The example below shows the combination of the Manifest, Deployment Configuration and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only and not to be a complete description of the specific categories available in each of the files. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760). + +**Manifest** + +``` syntax + + + [{Common Programs}]\7-Zip\7-Zip File Manager.lnk + [{AppVPackageRoot}]\7zFM.exe + [{AppVPackageRoot}]\7zFM exe.O.ico + + +``` + +**Deployment Configuration** + +``` syntax + + + + + + + + + + +``` + +**User Configuration** + +``` syntax + + + + + [{Desktop}]\7-Zip\7-Zip File Manager.lnk + [{AppVPackageRoot}]\7zFM.exe + [{AppVPackageRoot}]\7zFM exe.O.ico + + + + + + + + [{Desktop}]\7-Zip\7-Zip File Manager.lnk + [{AppVPackageRoot}]\7zFM.exe + [{AppVPackageRoot}]\7zFM.exe.O.ico + + + [{Common Programs}]\7-Zip\7-Zip File Manager.Ink + [{AppVPackageRoot}]\7zFM.exe + [{AppVPackageRoot)]\7zFM.exe.O.ico + + + + + + + + + + + + +``` + +## Side-by-side assemblies + + +App-V supports the automatic packaging of side-by-side (SxS) assemblies during sequencing and deployment on the client during virtual application publishing. App-V supports capturing SxS assemblies during sequencing for assemblies not present on the sequencing machine. And for assemblies consisting of Visual C++ (Version 8 and newer) and/or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they were not installed during monitoring. The Side by Side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in deployed App-V applications to clients missing the required SxS assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. + +Side by Side Assembly support in App-V has the following features. + +- Automatic captures of SxS assembly during Sequencing, regardless of whether the assembly was already installed on the sequencing workstation. + +- The App-V Client automatically installs required SxS assemblies to the client computer at publishing time when they are not present. + +- The Sequencer reports the VC run-time dependency in Sequencer reporting mechanism. + +- The Sequencer allows opting to not package the assemblies that are already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. + +### Automatic publishing of SxS assemblies + +During publishing of an App-V package with SxS assemblies the App-V Client will check for the presence of the assembly on the machine. If the assembly does not exist, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the Side by Side assembly installations that are part of the base packages, as the connection group does not contain any information about assembly installation. + +> [!NOTE] +> Unpublishing or removing a package with an assembly does not remove the assemblies for that package. + +  + +## Client logging + + +The App-V client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer, under Applications and Services Logs\\Microsoft\\AppV\\Client. + +There are three specific categories of events recorded described below. + +**Admin**: Logs events for configurations being applied to the App-V Client, and contains the primary warnings and errors. + +**Operational**: Logs the general App-V execution and usage of individual components creating an audit log of the App-V operations that have been completed on the App-V Client. + +**Virtual Application**: Logs virtual application launches and use of virtualization subsystems. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md new file mode 100644 index 0000000000..c12c85996f --- /dev/null +++ b/windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -0,0 +1,41 @@ +--- +title: How to Apply the Deployment Configuration File by Using Windows PowerShell (Windows 10) +description: How to Apply the Deployment Configuration File by Using Windows PowerShell +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Apply the Deployment Configuration File by Using Windows PowerShell + +**Applies to** +- Windows 10, version 1607 + +The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V client before the package has been published. The file configures the default settings for package for all users on the computer running the App-V client. This section describes the steps used to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: + +**c:\\Packages\\Contoso\\MyApp.appv** + +**c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** + +**To Apply the Deployment Configuration File Using Windows PowerShell** + +- To specify a new default set of configurations for all users who will run the package on a specific computer, in a Windows PowerShell console, type the following: + + `Add-AppVClientPackage -Path c:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration c:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml` + + **Note**
    + This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: + + `Set-AppVClientPackage -Name Myapp -Path c:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration c:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml` + +   +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-apply-the-user-configuration-file-with-powershell.md b/windows/manage/appv-apply-the-user-configuration-file-with-powershell.md new file mode 100644 index 0000000000..7874045e20 --- /dev/null +++ b/windows/manage/appv-apply-the-user-configuration-file-with-powershell.md @@ -0,0 +1,40 @@ +--- +title: How to Apply the User Configuration File by Using Windows PowerShell (Windows 10) +description: How to Apply the User Configuration File by Using Windows PowerShell +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Apply the User Configuration File by Using Windows PowerShell + +**Applies to** +- Windows 10, version 1607 + +The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. + +Use the following procedure to specify a user-specific configuration file. The following procedure is based on the example: + +**c:\\Packages\\Contoso\\MyApp.appv** + +**To apply a user Configuration file** + +1. To add the package to the computer using the Windows PowerShell console, type the following command: + + `Add-AppVClientPackage c:\Packages\Contoso\MyApp.appv` + +2. Use the following command to publish the package to the user and specify the updated the dynamic user configuration file: + + `Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath c:\Packages\Contoso\config.xml` + + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-capacity-planning.md b/windows/manage/appv-capacity-planning.md new file mode 100644 index 0000000000..bf7e512509 --- /dev/null +++ b/windows/manage/appv-capacity-planning.md @@ -0,0 +1,952 @@ +--- +title: App-V Capacity Planning (Windows 10) +description: App-V Capacity Planning +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# App-V Capacity Planning + +**Applies to** +- Windows Server 2016 + +The following recommendations can be used as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V infrastructure. + +>**Important**   +Use the information in this section only as a general guide for planning your App-V deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary. + +  + +## Determine the Project Scope + + +Before you design the App-V infrastructure, determine the project’s scope. The scope consists of determining which applications will be available virtually and to also identify the target users, and their locations. This information will help determine what type of App-V infrastructure should be implemented. Decisions about the scope of the project must be based on the specific needs of your organization. + + ++++ + + + + + + + + + + + + + + + + +
    TaskMore Information

    Determine Application Scope

    Depending on the applications to be virtualized, the App-V infrastructure can be set up in different ways. The first task is to define what applications you want to virtualize.

    Determine Location Scope

    Location scope refers to the physical locations (for example, enterprise-wide or a specific geographic location) where you plan to run the virtualized applications. It can also refer to the user population (for example, a single department) who will run the virtual applications. You should obtain a network map that includes the connection paths as well as available bandwidth to each location and the number of users using virtualized applications and the WAN link speed.

    + +## Determine Which App-V Infrastructure is Required + +You can also manage your App-V environment using an Electronic Software Distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md). + +- **Standalone Model** - The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V in Standalone Mode consists of the sequencer and the client; no additional components are required. Applications are prepared for virtualization using a process called sequencing. For more information see, [Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md). The stand-alone model is recommended for the following scenarios: + + - With disconnected remote users who cannot connect to the App-V infrastructure. + + - When you are running a software management system, such as System Center 2012 Configuration Manager. + + - When network bandwidth limitations inhibit electronic software distribution. + +- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V Full Infrastructure Model consists of one or more App-V management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for App-V Server Deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios: + + >**Important**   + The App-V full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V Supported Configurations](appv-supported-configurations.md). + +   + + - When you want to use the Management Server to publish the application to target computers. + + - For rapid provisioning of applications to target computers. + + - When you want to use App-V reporting. + +## End-to-end Server Sizing Guidance + + +The following section provides information about end-to-end App-V sizing and planning. For more specific information, refer to the subsequent sections. + +**Note**   +Round trip response time on the client is the time taken by the computer running the App-V client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server. + +  + +- 20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time. (<3 seconds) + +- A single management server can support up to 50 publishing servers for package metadata refreshes in an acceptable round trip time. (<5 seconds) + +## App-V Management Server Capacity Planning Recommendations + + +The App-V publishing servers require the management server for package refresh requests and package refresh responses. The management server then sends the information to the management database to retrieve information. For more information about App-V management server supported configurations see [App-V Supported Configurations](appv-supported-configurations.md). + +**Note**   +The default refresh time on the App-V publishing server is ten minutes. + +  + +When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors influence the round trip response time on the publishing server: + +1. Number of publishing servers making simultaneous requests. + +2. Number of connection groups configured on the management server. + +3. Number of access groups configured on the management server. + +The following table displays more information about each factor that impacts round trip time. + +**Note**   +Round trip response time is the time taken by the computer running the App-V publishing server to receive a successful package metadata update from the management server. + +  + + ++++ + + + + + + + + + + + + + + + + + + + + +
    Factors impacting round trip response timeMore Information

    The number of publishing servers simultaneously requesting package metadata refreshes.

    +
      +

    • A single management server can respond to up to 320 publishing servers requesting publishing metadata simultaneously.

      • +

    • Round trip response time for 320 pub servers is ~40 seconds.

      • +

    • For <50 publishing servers requesting metadata simultaneously, the round trip response time is <5 seconds.

      • +

    • From 50 to 320 publishing servers, the response time increases linearly (approximately 2x).

      • +

    The number of connection groups configured on the management server.

    +

    +
      +

    • For up to 100 connection groups, there is no significant change in the round trip response time on the publishing server.

      • +

    • For 100 - 400 connection groups, there is a minor linear increase in the round trip response time.

      • +

    The number of access groups configured on the management server.

    +

    +
      +

    • For up to 40 access groups, there is a linear (approximately 3x) increase in the round trip response time on the publishing server.

      • +
    + +  + +The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-Vmanagement server. + + ++++++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ScenarioVariationNumber of connection groupsNumber of access groupsNumber of publishing serversNetwork connection type publishing server / management serverRound trip response time on the publishing server (in seconds)CPU utilization on management server

    Publishing servers simultaneously contacting management server for publishing metadata.

    Number of publishing servers

    +
      +

    • 0

      • +

    • 0

      • +

    • 0

      • +

    • 0

      • +

    • 0

      • +

    • 0

      • +

    +
      +

    • 1

      • +

    • 1

      • +

    • 1

      • +

    • 1

      • +

    • 1

      • +

    • 1

      • +

    +
      +

    • 50

      • +

    • 100

      • +

    • 200

      • +

    • 300

      • +

    • 315

      • +

    • 320

      • +

    +
      +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    +
      +

    • 5

      • +

    • 10

      • +

    • 19

      • +

    • 32

      • +

    • 30

      • +

    • 37

      • +

    +
      +

    • 17

      • +

    • 17

      • +

    • 17

      • +

    • 15

      • +

    • 17

      • +

    • 15

      • +

    Publishing metadata contains connection groups

    Number of connection groups

    +
      +

    • 10

      • +

    • 50

      • +

    • 100

      • +

    • 150

      • +

    • 300

      • +

    • 400

      • +

    +
      +

    • 1

      • +

    • 1

      • +

    • 1

      • +

    • 1

      • +

    • 1

      • +

    • 1

      • +

    +
      +

    • 100

      • +

    • 100

      • +

    • 100

      • +

    • 100

      • +

    • 100

      • +

    • 100

      • +

    +
      +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    +
      +

    • 10

      • +

    • 11

      • +

    • 11

      • +

    • 16

      • +

    • 22

      • +

    • 25

      • +

    +
      +

    • 17

      • +

    • 19

      • +

    • 22

      • +

    • 19

      • +

    • 20

      • +

    • 20

      • +

    Publishing metadata contains access groups

    Number of access groups

    +
      +

    • 0

      • +

    • 0

      • +

    • 0

      • +

    • 0

      • +

    +
      +

    • 1

      • +

    • 10

      • +

    • 20

      • +

    • 40

      • +

    +
      +

    • 100

      • +

    • 100

      • +

    • 100

      • +

    • 100

      • +

    +
      +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    +
      +

    • 10

      • +

    • 43

      • +

    • 153

      • +

    • 535

      • +

    +
      +

    • 17

      • +

    • 26

      • +

    • 24

      • +

    • 24

      • +
    + +  + +The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example: Transactions/sec is ~30, batch requests ~200, and user connects ~6. + +Using a geographically distributed deployment, where the management server & publishing servers utilize a slow link network between them, the round trip response time on the publishing servers is within acceptable time limits (<5 seconds), even for 100 simultaneous requests on a single management server. + + ++++++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ScenarioVariationNumber of connection groupsNumber of access groupsNumber of publishing serversNetwork connection type publishing server / management serverRound trip response time on the publishing server (in seconds)CPU utilization on management server

    Network connection between the publishing server and management server

    1.5 Mbps Slow link Network

    +
      +

    • 0

      • +

    • 0

      • +

    +
      +

    • 1

      • +

    • 1

      • +

    +
      +

    • 50

      • +

    • 100

      • +

    +
      +

    • 1.5Mbps Cable DSL

      • +

    • 1.5Mbps Cable DSL

      • +

    +
      +

    • 4

      • +

    • 5

      • +

    +
      +

    • 1

      • +

    • 2

      • +

    Network connection between the publishing server and management server

    LAN / WIFI Network

    +
      +

    • 0

      • +

    • 0

      • +

    +
      +

    • 1

      • +

    • 1

      • +

    +
      +

    • 100

      • +

    • 200

      • +

    +
      +

    • Wifi

      • +

    • Wifi

      • +

    +
      +

    • 11

      • +

    • 20

      • +

    +
      +

    • 15

      • +

    • 17

      • +
    + +  + +Whether the management server and publishing servers are connected over a slow link network, or a high speed network, the management server can handle approximately 15,000 package refresh requests in 30 minutes. + +## App-V Reporting Server Capacity Planning Recommendations + + +App-V clients send reporting data to the reporting server. The reporting server then records the information in the Microsoft SQL Server database and returns a successful notification back to the computer running App-V client. For more information about App-V Reporting Server supported configurations see [App-V Supported Configurations](appv-supported-configurations.md). + +**Note**   +Round trip response time is the time taken by the computer running the App-V client to send the reporting information to the reporting server and receive a successful notification from the reporting server. + +  + + ++++ + + + + + + + + + + + + + + + + + + + + +
    ScenarioSummary

    Multiple App-V clients send reporting information to the reporting server simultaneously.

    +
      +

    • Round trip response time from the reporting server is 2.6 seconds for 500 clients.

      • +

    • Round trip response time from the reporting server is 5.65 seconds for 1000 clients.

      • +

    • Round trip response time increases linearly depending on number of clients.

      • +

    Requests per second processed by the reporting server.

    +

    +
      +

    • A single reporting server and a single database, can process a maximum of 139 requests per second. The average is 121 requests/second.

      • +

    • Using two reporting servers reporting to the same Microsoft SQL Server database, the average requests/second is similar to a single reporting server = ~127, with a max of 278 requests/second.

      • +

    • A single reporting server can process 500 concurrent/active connections.

      • +

    • A single reporting server can process a maximum 1500 concurrent connections.

      • +

    Reporting Database.

    +

    +
      +

    • Lock contention on the computer running Microsoft SQL Server is the limiting factor for requests/second.

      • +

    • Throughput and response time are independent of database size.

      • +
    + +  + +**Calculating random delay**: + +The random delay specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between **0** and **ReportingRandomDelay** and will wait the specified duration before sending data. + +Random delay = 4 \* number of clients / average requests per second. + +Example: For 500 clients, with 120 requests per second, the Random delay is, 4 \* 500 / 120 = ~17 minutes. + +## App-V Publishing Server Capacity Planning Recommendations + + +Computers running the App-V client connect to the App-V publishing server to send a publishing refresh request and to receive a response. Round trip response time is measured on the computer running the App-V client. Processor time is measured on the publishing server. For more information about App-V Publishing Server supported configurations see [App-V Supported Configurations](appv-supported-configurations.md). + +**Important**   +The following list displays the main factors to consider when setting up the App-V publishing server: + +- The number of clients connecting simultaneously to a single publishing server. + +- The number of packages in each refresh. + +- The available network bandwidth in your environment between the client and the App-V publishing server. + +  + + ++++ + + + + + + + + + + + + + + + + + + + + +
    ScenarioSummary

    Multiple App-V clients connect to a single publishing server simultaneously.

    +
      +

    • A publishing server running dual core processors can respond to at most 5000 clients requesting a refresh simultaneously.

      • +

    • For 5000-10000 clients, the publishing server requires a minimum quad core.

      • +

    • For 10000-20000 clients, the publishing server should have dual quad cores for more efficient response times.

      • +

    • A publishing server with a quad core can refresh up to 10000 packages within 3 seconds. (Supporting 10000 simultaneous clients)

      • +

    Number of packages in each refresh.

    +

    +
      +

    • Increasing number of packages will increase response time by ~40% (up to 1000 packages).

      • +

    Network between the App-V client and the publishing server.

    +

    +
      +

    • Across a slow network (1.5 Mbps bandwidth), there is a 97% increase in response time compared to LAN (up to 1000 users).

      • +
    + +  + +**Note**   +The publishing server CPU usage is always high during the time interval when it has to process simultaneous requests (>90% in most cases). The publishing server can handle ~1500 client requests in 1 second. + +  + + ++++++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ScenarioVariationNumber of App-V clientsNumber of packagesProcessor configuration on the publishing serverNetwork connection type publishing server / App-V clientRound trip time on the App-V client (in seconds)CPU utilization on publishing server (in %)

    App-V client sends publishing refresh request & receives response, each request containing 120 packages

    Number of clients

    +
      +

    • 100

      • +

    • 1000

      • +

    • 5000

      • +

    • 10000

      • +

    +
      +

    • 120

      • +

    • 120

      • +

    • 120

      • +

    • 120

      • +

    +
      +

    • Dual Core

      • +

    • Dual Core

      • +

    • Quad Core

      • +

    • Quad Core

      • +

    +
      +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    +
      +

    • 1

      • +

    • 2

      • +

    • 2

      • +

    • 3

      • +

    +
      +

    • 100

      • +

    • 99

      • +

    • 89

      • +

    • 77

      • +

    Multiple packages in each refresh

    Number of packages

    +
      +

    • 1000

      • +

    • 1000

      • +

    +
      +

    • 500

      • +

    • 1000

      • +

    +
      +

    • Quad Core

      • +

    • Quad Core

      • +

    +
      +

    • LAN

      • +

    • LAN

      • +

    +
      +

    • 2

      • +

    • 3

      • +

    +
      +

    • 92

      • +

    • 91

      • +

    Network between client and publishing server

    1.5 Mbps Slow link network

    +
      +

    • 100

      • +

    • 500

      • +

    • 1000

      • +

    +
      +

    • 120

      • +

    • 120

      • +

    • 120

      • +

    +
      +

    • Quad Core

      • +

    • Quad Core

      • +

    • Quad Core

      • +

    +
      +

    • 1.5 Mbps Intra-Continental Network

      • +

    +
      +

    • 3

      • +

    • 10 (with 0.2% failure rate)

      • +

    • 17 (with 1% failure rate)

      • +

    + +  + +## App-V Streaming Capacity Planning Recommendations + + +Computers running the App-V client stream the virtual application package from the streaming server. Round trip response time is measured on the computer running the App-V client, and is the time taken to stream the entire package. + +**Important**   +The following list identifies the main factors to consider when setting up the App-V streaming server: + +- The number of clients streaming application packages simultaneously from a single streaming server. + +- The size of the package being streamed. + +- The available network bandwidth in your environment between the client and the streaming server. + +  + + ++++ + + + + + + + + + + + + + + + + + + + + +
    ScenarioSummary

    Multiple App-V clients stream applications from a single streaming server simultaneously.

    +
      +

    • If the number of clients simultaneously streaming from the same server increases, there is a linear relationship with the package download/streaming time.

      • +

    Size of the package being streamed.

    +

    +
      +

    • The package size has a significant impact on the streaming/download time only for larger packages with a size ~ 1GB. For package sizes ranging from 3 MB to 100 MB, the streaming time ranges from 20 seconds to 100 seconds, with 100 simultaneous clients.

      • +

    Network between the App-V client and the streaming server.

    +

    +
      +

    • Across a slow network (1.5 Mbps bandwidth), there is a 70-80% increase in response time compared to LAN (up to 100 users).

      • +
    + +  + +The following table displays sample values for each of the factors in the previous list: + + ++++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ScenarioVariationNumber of App-V clientsSize of each packageNetwork connection type streaming server / App-V clientRound trip time on the App-V client (in seconds)

    Multiple App-V clients streaming virtual application packages from a streaming server.

    Number of clients.

    +
      +

    • 100

      • +

    • 200

      • +

    • 1000

      • +

      • +

    • 100

      • +

    • 200

      • +

    • 1000

      • +

    +
      +

    • 3.5 MB

      • +

    • 3.5 MB

      • +

    • 3.5 MB

      • +

      • +

    • 5 MB

      • +

    • 5 MB

      • +

    • 5 MB

      • +

    +
      +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

      • +

    • LAN

      • +

    • LAN

      • +

    • LAN

      • +

    +
      +

    • 29

      • +

    • 39

      • +

    • 391

      • +

      • +

    • 35

      • +

    • 68

      • +

    • 461

      • +

    Size of each package being streamed.

    Size of each package.

    +
      +

    • 100

      • +

    • 200

      • +

      • +

    • 100

      • +

    • 200

      • +

    +
      +

    • 21 MB

      • +

    • 21 MB

      • +

      • +

    • 109

      • +

    • 109

      • +

    +
      +

    • LAN

      • +

    • LAN

      • +

      • +

    • LAN

      • +

    • LAN

      • +

    +

    33

    +

    83

    +

    +

    100

    +

    160

    Network connection between client and App-V streaming server.

    1.5 Mbps Slow link network.

    +
      +

    • 100

      • +

      • +

    • 100

      • +

    +
      +

    • 3.5 MB

      • +

      • +

    • 5 MB

      • +

    +
      +

    • 1.5 Mbps Intra-Continental Network

      • +

    +

    102

    +

    +

    121

    + +  + +Each App-V streaming server should be able to handle a minimum of 200 clients concurrently streaming virtualized applications. + +**Note**   +The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions. + +  + +For example, an average user can stream a 100 MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real world environments streaming demand is not uniformly distributed, you will need to understand the approximate peak streaming requirements present in your environment in order to properly size the number of required streaming servers. + +The number of clients a streaming server can support can be significantly increased and the peak streaming requirements reduced if you pre-cache your applications. You can also increase the number of clients a streaming server can support by using on-demand streaming delivery and stream optimized packages. + +## Combining App-V Server Roles + + +Discounting scaling and fault-tolerance requirements, the minimum number of servers needed for a location with connectivity to Active Directory is one. This server will host the management server, management server service, and Microsoft SQL Server roles. Server roles, therefore, can be arranged in any desired combination since they do not conflict with one another. + +Ignoring scaling requirements, the minimum number of servers necessary to provide a fault-tolerant implementation is four. The management server, and Microsoft SQL Server roles support being placed in fault-tolerant configurations. The management server service can be combined with any of the roles, but remains a single point of failure. + +Although there are a number of fault-tolerance strategies and technologies available, not all are applicable to a given service. Additionally, if App-V roles are combined, certain fault-tolerance options may no longer apply due to incompatibilities. + +## Have a suggestion for App-V? + + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[App-V Supported Configurations](appv-supported-configurations.md) + +[Planning for High Availability with App-V](appv-planning-for-high-availability-with-appv.md) + +[Planning to Deploy App-V](appv-planning-to-deploy-appv.md) + +  + +  + + + + + diff --git a/windows/manage/appv-client-configuration-settings.md b/windows/manage/appv-client-configuration-settings.md new file mode 100644 index 0000000000..59e07c520f --- /dev/null +++ b/windows/manage/appv-client-configuration-settings.md @@ -0,0 +1,115 @@ +--- +title: About Client Configuration Settings (Windows 10) +description: About Client Configuration Settings +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# About Client Configuration Settings + +**Applies to** +- Windows 10, version 1607 + +The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists the App-V Client configuration settings and explains their uses. You can use Windows PowerShell to modify the client configuration settings. For more information about using Windows PowerShell and App-V see [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md). + +You can use Group Policy to configure App-V client settings by using the Group Policy Management Console under **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. + +## App-V Client Configuration Settings: Windows PowerShell + +The following table provides information about App-V client configuration settings that can be configured through Windows PowerShell cmdlets: + +| Windows PowerShell cmdlet or cmdlets,
    **Option**
    Type | Description | Disabled Policy State Keys and Values | +|------------|------------|------------|------------| +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-PackageInstallationRoot**
    String | Specifies directory where all new applications and updates will be installed. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-PackageSourceRoot**
    String | Overrides source location for downloading package content. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-AllowHighCostLaunch**
    True (enabled); False (Disabled state) | This setting controls whether virtualized applications are launched on Windows 10 machines connected via a metered network connection (For example, 4G). | 0 | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReestablishmentRetries**
    Integer (0-99) | Specifies the number of times to retry a dropped session. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReestablishmentInterval**
    Integer (0-3600) | Specifies the number of seconds between attempts to reestablish a dropped session. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-LocationProvider**
    String | Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-CertFilterForClientSsl**
    String | Specifies the path to a valid certificate in the certificate store. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-VerifyCertificateRevocationList**
    True(enabled); False(Disabled state) | Verifies Server certificate revocation status before steaming using HTTPS. | 0 | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-SharedContentStoreMode**
    True(enabled); False(Disabled state) | Specifies that streamed package contents will be not be saved to the local hard disk. | 0 | +| Set-AppvPublishingServer

    **-Name**
    String | Displays the name of publishing server. | Policy value not written (same as Not Configured) | +| Set-AppvPublishingServer

    **-URL**
    String | Displays the URL of publishing server. | Policy value not written (same as Not Configured) | +| Set-AppvPublishingServer

    **-GlobalRefreshEnabled**
    True(enabled); False(Disabled state) | Enables global publishing refresh (Boolean) | False | +| Set-AppvPublishingServer

    **-GlobalRefreshOnLogon**
    True(enabled); False(Disabled state) | Triggers a global publishing refresh on logon. ( Boolean) | False | +| Set-AppvPublishingServer

    **-GlobalRefreshInterval**
    Integer (0-744) | Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. | 0 | +| Set-AppvPublishingServer

    **-GlobalRefreshIntervalUnit**
    0 for hour, 1 for day | Specifies the interval unit (Hour 0-23, Day 0-31). | 1 | +| Set-AppvPublishingServer

    **-UserRefreshEnabled**
    True(enabled); False(Disabled state) | Enables user publishing refresh (Boolean) | False | +| Set-AppvPublishingServer

    **-UserRefreshOnLogon**
    True(enabled); False(Disabled state) | Triggers a user publishing refresh onlogon. ( Boolean)Word count (with spaces): 60 | False | +| Set-AppvPublishingServer

    **-UserRefreshInterval**
    Word count (with spaces): 85Integer (0-744 Hours) | Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. | 0 | +| Set-AppvPublishingServer

    **-UserRefreshIntervalUnit**
    0 for hour, 1 for day | Specifies the interval unit (Hour 0-23, Day 0-31). | 1 | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-MigrationMode**
    True(enabled state); False (disabled state) | Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created using a previous version of App-V. | | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnablePackageScripts**
    True(enabled); False(Disabled state) | Enables scripts defined in the package manifest of configuration files that should run. | | +| Set-AppvClientConfiguration

    **-RoamingFileExclusions**
    String | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS='desktop;my pictures' | | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-RoamingRegistryExclusions**
    String | Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-IntegrationRootUser**
    String | Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\\Microsoft\\AppV\\Client\\Integration. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-IntegrationRootGlobal**
    String | Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\\Microsoft\\AppV\\Client\\Integration | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-VirtualizableExtensions**
    String | A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command line parameter will be added, and the application will run virtually. For more information about the **RunVirtual** parameter, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md). | Policy value not written | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingEnabled**
    True (enabled); False (Disabled state) | Enables the client to return information to a reporting server. | False | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingServerURL**
    String | Specifies the location on the reporting server where client information is saved. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingDataCacheLimit**
    Integer \[0-1024\] | Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingDataBlockSize**
    Integer \[1024 - Unlimited\] | Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingStartTime**
    Integer (0 – 23) | Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
    **Note** You should configure this setting to a time when computers running the App-V client are least likely to be offline. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingInterval**
    Integer | Specifies the retry interval that the client will use to resend data to the reporting server. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingRandomDelay**
    Integer \[0 - ReportingRandomDelay\] | Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and **ReportingRandomDelay** and will wait the specified duration before sending data. This can help to prevent collisions on the server. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnableDynamicVirtualization
    **1 (Enabled), 0 (Disabled) | Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. | | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnablePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | Enables the publishing refresh progress bar for the computer running the App-V Client. | | +| Sync-AppvPublishingServer

    **-HidePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | Hides the publishing refresh progress bar. | | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ProcessesUsingVirtualComponents**
    String | Specifies a list of process paths (that may contain wildcards), which are candidates for using dynamic virtualization (supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. | Empty string. | + +## App-V Client Configuration Settings: Registry Keys + +The following table provides information about App-V client configuration settings that can be configured through the registry: + +| **Setting name**
    Type | Registry Key Value | Disabled Policy State Keys and Values | +|---------------------------|---------------------|---------------------------------------| +| **PackageInstallationRoot**
    String | Streaming\\PackageInstallationRoot | Policy value not written (same as Not Configured) | +| **PackageSourceRoot**
    String | Streaming\\PackageSourceRoot | Policy value not written (same as Not Configured) | +| **AllowHighCostLaunch**
    True (enabled); False (Disabled state) | Streaming\\AllowHighCostLaunch | 0 | +| **ReestablishmentRetries**
    Integer (0-99) | Streaming\\ReestablishmentRetries | Policy value not written (same as Not Configured) | +| **ReestablishmentInterval**
    Integer (0-3600) | Streaming\\ReestablishmentInterval | Policy value not written (same as Not Configured) | +| **LocationProvider**
    String | Streaming\\LocationProvider | Policy value not written (same as Not Configured) | +| **CertFilterForClientSsl**
    String | Streaming\\CertFilterForClientSsl | Policy value not written (same as Not Configured) | +| **VerifyCertificateRevocationList**
    True(enabled); False(Disabled state) | Streaming\\VerifyCertificateRevocationList | 0 | +| **SharedContentStoreMode**
    True(enabled); False(Disabled state) | Streaming\\SharedContentStoreMode | 0 | +| **Name**
    String | Publishing\\Servers{serverId}\\FriendlyName | Policy value not written (same as Not Configured) | +| **URL**
    String | Publishing\\Servers{serverId}\\URL | Policy value not written (same as Not Configured) | +| **GlobalRefreshEnabled**
    True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\GlobalEnabled | False | +| **GlobalRefreshOnLogon**
    True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\GlobalLogonRefresh | False | +| **GlobalRefreshInterval**
    Integer (0-744) | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshInterval | 0 | +| **GlobalRefreshIntervalUnit**
    0 for hour, 1 for day | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshIntervalUnit | 1 | +| **UserRefreshEnabled**
    True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\UserEnabled | False | +| **UserRefreshOnLogon**
    True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\UserLogonRefresh | False | +| **UserRefreshInterval**
    Word count (with spaces): 85Integer (0-744 Hours) | Publishing\\Servers{serverId}\\UserPeriodicRefreshInterval | 0 | +| **UserRefreshIntervalUnit**
    0 for hour, 1 for day | Publishing\\Servers{serverId}\\UserPeriodicRefreshIntervalUnit | 1 | +| **MigrationMode**
    True(enabled state); False (disabled state) | Coexistence\\MigrationMode | | +| **EnablePackageScripts**
    True(enabled); False(Disabled state) | \\Scripting\\EnablePackageScripts | | +| **RoamingFileExclusions**
    String | | | +| **RoamingRegistryExclusions**
    String | Integration\\RoamingReglstryExclusions | Policy value not written (same as Not Configured) | +| **IntegrationRootUser**
    String | Integration\\IntegrationRootUser | Policy value not written (same as Not Configured) | +| **IntegrationRootGlobal**
    String | Integration\\IntegrationRootGlobal | Policy value not written (same as Not Configured) | +| **VirtualizableExtensions**
    String | Integration\\VirtualizableExtensions | Policy value not written | +| **ReportingEnabled**
    True (enabled); False (Disabled state) | Reporting\\EnableReporting | False | +| **ReportingServerURL**
    String | Reporting\\ReportingServer | Policy value not written (same as Not Configured) | +| **ReportingDataCacheLimit**
    Integer \[0-1024\] | Reporting\\DataCacheLimit | Policy value not written (same as Not Configured) | +| **ReportingDataBlockSize**
    Integer \[1024 - Unlimited\] | Reporting\\DataBlockSize | Policy value not written (same as Not Configured) | +| **ReportingStartTime**
    Integer (0 – 23) | Reporting\\ StartTime | Policy value not written (same as Not Configured) | +| **ReportingInterval**
    Integer | Reporting\\RetryInterval | Policy value not written (same as Not Configured) | +| **ReportingRandomDelay**
    Integer \[0 - ReportingRandomDelay\] | Reporting\\RandomDelay | Policy value not written (same as Not Configured) | +| **EnableDynamicVirtualization
    **1 (Enabled), 0 (Disabled) | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Virtualization | | +| **EnablePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Publishing | | +| **HidePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | | | +| **ProcessesUsingVirtualComponents**
    String | Virtualization\\ProcessesUsingVirtualComponents | Empty string. | + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) + diff --git a/windows/manage/appv-configure-access-to-packages-with-the-management-console.md b/windows/manage/appv-configure-access-to-packages-with-the-management-console.md new file mode 100644 index 0000000000..c01d1ba74b --- /dev/null +++ b/windows/manage/appv-configure-access-to-packages-with-the-management-console.md @@ -0,0 +1,66 @@ +--- +title: How to Configure Access to Packages by Using the Management Console (Windows 10) +description: How to Configure Access to Packages by Using the Management Console +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Configure Access to Packages by Using the Management Console + +**Applies to** +- Windows 10, version 1607 + +Before you deploy an App-V virtualized package, you must configure the Active Directory Domain Services (AD DS) security groups that will be allowed to access and run the applications. The security groups may contain computers or users. Entitling a package to a computer group publishes the package globally to all computers in the group. + +Use the following procedure to configure access to virtualized packages. + +**To grant access to an App-V package** + +1. Find the package you want to configure: + + 1. Open the App-V Management console. + + 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. + +2. Provision a security group for the package: + + 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. + + 2. Using the format **mydomain** \\ **groupname**, type the name or part of the name of an Active Directory group object, and click **Check**. + + **Note**   + Ensure that you provide an associated domain name for the group that you are searching for. + +   + +3. To grant access to the package, select the desired group and click **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. + +4. + + To accept the default configuration settings and close the **AD ACCESS** page, click **Close**. + + To customize configurations for a specific group, click the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To configure the custom configurations, click **EDIT**. After you grant access, click **Close**. + +**To remove access to an App-V package** + +1. Find the package you want to configure: + + 1. Open the App-V Management console. + + 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. + +2. Select the group you want to remove, and click **DELETE**. + +3. To close the **AD ACCESS** page, click **Close**. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md b/windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md new file mode 100644 index 0000000000..d0dd6dc5b9 --- /dev/null +++ b/windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md @@ -0,0 +1,63 @@ +--- +title: How to Make a Connection Group Ignore the Package Version (Windows 10) +description: How to Make a Connection Group Ignore the Package Version +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Make a Connection Group Ignore the Package Version + +**Applies to** +- Windows 10, version 1607 + +Application Virtualization (App-V) lets you configure a connection group to use any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create. + +You can configure a connection group to accept any version of a package, which enables you to upgrade the package without having to disable the connection group: + +- If the connection group has access to multiple versions of a package, the latest version is used. + +- If the connection group contains an optional package that has an incorrect version, the package is ignored and won’t block the connection group’s virtual environment from being created. + +- If the connection group contains a non-optional package that has an incorrect version, the connection group’s virtual environment cannot be created. + +## To make a connection group ignore the package version by using the App-V Server Management Console + +1. In the Management Console, select **CONNECTION GROUPS**. + +2. Select the correct connection group from the Connection Groups library. + +3. Click **EDIT** in the CONNECTED PACKAGES pane. + +4. Select **Use Any Version** check box next to the package name, and click **Apply**. + +For more about adding or upgrading packages, see [How to Add or Upgrade Packages by Using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md). + +## To make a connection group ignore the package version from the App-V client on a stand-alone computer + +1. Create the connection group XML document. + +2. For the package to be upgraded, set the **Package** tag attribute **VersionID** to an asterisk (*). + +3. Use the following cmdlet to add the connection group, and include the path to the connection group XML document: + + `Add-AppvClientConnectionGroup` + +4. When you upgrade a package, use the following cmdlets to remove the old package, add the upgraded package, and publish the upgraded package: + + - RemoveAppvClientPackage + - Add-AppvClientPackage + - Publish-AppvClientPackage + +For more information, see [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md). + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md b/windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md new file mode 100644 index 0000000000..14b25e2912 --- /dev/null +++ b/windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md @@ -0,0 +1,65 @@ +--- +title: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server (Windows 10) +description: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server + +**Applies to** +- Windows 10, version 1607 + +Deploying packages and connection groups using the App-V publishing server is helpful because it offers single-point management and high scalability. + +Use the following steps to configure the App-V client to receive updates from the publishing server. + +**Note**
    +For the following procedures the management server was installed on a computer named **MyMgmtSrv**, and the publishing server was installed on a computer named **MyPubSrv**. + +  + +**To configure the App-V client to receive updates from the publishing server** + +1. Deploy the App-V management and publishing servers, and add the required packages and connection groups. For more information about adding packages and connection groups, see [How to Add or Upgrade Packages by Using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md) and [How to Create a Connection Group](appv-create-a-connection-group.md). + +2. To open the management console click the following link, open a browser and type the following: http://MyMgmtSrv/AppvManagement/Console.html in a web browser, and import, publish, and entitle all the packages and connection groups which will be necessary for a particular set of users. + +3. On the computer running the App-V client, open an elevated Windows PowerShell command prompt, and run the following command: + + `Add-AppvPublishingServer -Name ABC -URL http://MyPubSrv/AppvPublishing` + + This command will configure the specified publishing server. You should see output similar to the following: + + ``` + Id                        : 1 + SetByGroupPolicy          : False + Name                      : ABC + URL                       : http:// MyPubSrv/AppvPublishing + GlobalRefreshEnabled      : False + GlobalRefreshOnLogon      : False + GlobalRefreshInterval     : 0 + GlobalRefreshIntervalUnit : Day + UserRefreshEnabled        : True + UserRefreshOnLogon        : True + UserRefreshInterval       : 0 + UserRefreshIntervalUnit   : Day + ``` + +4. On the computer running the App-V client, open a Windows PowerShell command prompt, and type the following command: + + `Sync-AppvPublishingServer -ServerId 1` + + The command will query the publishing server for the packages and connection groups that need to be added or removed for this particular client based on the entitlements for the packages and connection groups as configured on the management server. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-connect-to-the-management-console.md b/windows/manage/appv-connect-to-the-management-console.md new file mode 100644 index 0000000000..47da73bf11 --- /dev/null +++ b/windows/manage/appv-connect-to-the-management-console.md @@ -0,0 +1,30 @@ +--- +title: How to Connect to the Management Console (Windows 10) +description: How to Connect to the Management Console +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# How to Connect to the Management Console + +**Applies to** +- Windows 10, version 1607 + +Use the following procedure to connect to the App-V Management Console. + +**To connect to the App-V Management Console** + +1. Open Internet Explorer browser and type the address for the App-V Management server. For example, **http://\<_management server name_\>:\<_management service port number_\>/console.html**. + +2. To view different sections of the console, click the desired section in the navigation pane. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +- [Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-connection-group-file.md b/windows/manage/appv-connection-group-file.md new file mode 100644 index 0000000000..a523cd8c6d --- /dev/null +++ b/windows/manage/appv-connection-group-file.md @@ -0,0 +1,267 @@ +--- +title: About the Connection Group File (Windows 10) +description: About the Connection Group File +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# About the Connection Group File + +**Applies to** +- Windows 10, version 1607 + +**In this topic:** + +- [Connection group file purpose and location](#bkmk-cg-purpose-loc) + +- [Structure of the connection group XML file](#bkmk-define-cg-5-0sp3) + +- [Configuring the priority of packages in a connection group](#bkmk-config-pkg-priority-incg) + +- [Supported virtual application connection configurations](#bkmk-va-conn-configs) + +## Connection group file purpose and location + + + ++++ + + + + + + + + + + + + + + +

    Connection group purpose

    A connection group is an App-V feature that enables you to group packages together to create a virtual environment in which the applications in those packages can interact with each other.

    +

    Example: You want to use plug-ins with Microsoft Office. You can create a package that contains the plug-ins, and create another package that contains Office, and then add both packages to a connection group to enable Office to use those plug-ins.

    How the connection group file works

    When you apply an App-V connection group file, the packages that are enumerated in the file will be combined at runtime into a single virtual environment. Use the Microsoft Application Virtualization (App-V) connection group file to configure existing App-V connection groups.

    Example file path

    %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups\{6CCC7575-162E-4152-9407-ED411DA138F4}\{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}.

    + +  + +## Structure of the connection group XML file + + +**In this section:** + +- [Parameters that define the connection group](#bkmk-params-define-cg) + +- [Parameters that define the packages in the connection group](#bkmk-params-define-pkgs-incg) + +- [App-V example connection group XML file](#bkmk-50sp3-exp-cg-xml) + +### Parameters that define the connection group + +The following table describes the parameters in the XML file that define the connection group itself, not the packages. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription

    Schema name

    Name of the schema.

    +

    If you want to use the “optional packages” and “use any version” features that are described in this table, you must specify the following schema in the XML file:

    +

    xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"

    AppConnectionGroupId

    Unique GUID identifier for this connection group. The connection group state is associated with this identifier. Specify this identifier only when you create the connection group.

    +

    You can create a new GUID by typing: [Guid]::NewGuid().

    VersionId

    Version GUID identifier for this version of the connection group.

    +

    When you update a connection group (for example, by adding or updating a new package), you must update the version GUID to reflect the new version.

    DisplayName

    Display name of the connection group.

    Priority

    Optional priority field for the connection group.

    +

    “0” - indicates the highest priority.

    +

    If a priority is required, but has not been configured, the package will fail because the correct connection group to use cannot be determined.

    + +  + +### Parameters that define the packages in the connection group + +In the <Packages> section of the connection group XML file, you list the member packages in the connection group by specifying each package’s unique package identifier and version identifier, as described in the following table. The first package in the list has the highest precedence. + + ++++ + + + + + + + + + + + + + + + + + + + + +
    FieldDescription

    PackageId

    Unique GUID identifier for this package. This GUID doesn’t change when newer versions of the package are published.

    VersionId

    Unique GUID identifier for the version of the package.

    +

    If you specify “*” for the package version, the GUID of the latest available package version is dynamically inserted.

    IsOptional

    Parameter that enables you to make a package optional within the connection group. Valid entries are:

    +
      +

    • “true” – package is optional in the connection group

      • +

    • “false” – package is required in the connection group

      • +
    +
    + +  + +### App-V example connection group XML file + +The following example connection group XML file shows examples of the fields in the previous tables. + +``` + + + + + + +``` + +## Configuring the priority of packages in a connection group + + +Package precedence is configured using the package list order. The first package in the document has the highest precedence. Subsequent packages in the list have descending priority. + +Package precedence is the resolution for otherwise inevitable resource collisions during virtual environment initialization. For example, if two packages that are opening in the same virtual environment define the same registry DWORD value, the package with the highest precedence determines the value that is set. + +You can use the connection group file to configure each connection group by using the following methods: + +- Specify runtime priorities for connection groups. To edit priority by using the App-V Management Console, click the connection group and then click **Edit**. + + **Note**   + Priority is required only if the package is associated with more than one connection group. + +   + +- Specify package precedence within the connection group. + +The priority field is required when a running virtual application initiates from a native application request, for example, Microsoft Windows Explorer. The App-V client uses the priority to determine which connection group virtual environment the application should run in. This situation occurs if a virtual application is part of multiple connection groups. + +If a virtual application is opened using another virtual application the virtual environment of the original virtual application will be used. The priority field is not used in this case. + +**Example:** + +The virtual application Microsoft Outlook is running in virtual environment **XYZ**. When you open an attached Microsoft Word document, a virtualized version Microsoft Word opens in the virtual environment **XYZ**, regardless of the virtualized Microsoft Word’s associated connection groups or runtime priorities. + +## Supported virtual application connection configurations + +The following application connection configurations are supported. + +- **An. exe file and plug-in (.dll)**. For example, you might want to distribute Microsoft Office to all users, but distribute a Microsoft Excel plug-in to only a subset of users. + + Enable the connection group for the appropriate users. Update each package individually as required. + +- **An. exe file and a middleware application**. You might have an application that requires a middleware application, or several applications that all depend on the same middleware runtime version. + + All computers that require one or more of the applications receive the connection groups with the application and middleware application runtime. You can optionally combine multiple middleware applications into a single connection group. + + + + + + + + + + + + + + + + + + + + + + +
    ExampleExample description

    Virtual application connection group for the financial division

      +

    • Middleware application 1

      • +

    • Middleware application 2

      • +

    • Middleware application 3

      • +

    • Middleware application runtime

      • +

    Virtual application connection group for HR division

      +

    • Middleware application 5

      • +

    • Middleware application 6

      • +

    • Middleware application runtime

      • +
    + +- **An. exe file and an .exe file**. You might have an application that relies on another application, and you want to keep the packages separate for operational efficiencies, licensing restrictions, or rollout timelines. + + For example, if you are deploying Microsoft Lync 2010, you can use three packages: + - Microsoft Office 2010 + - Microsoft Communicator 2007 + - Microsoft Lync 2010

    + + You can manage the deployment using the following connection groups: + - Microsoft Office 2010 and Microsoft Communicator 2007 + - Microsoft Office 2010 and Microsoft Lync 2010

    + + When the deployment has completed, you can either create a single new Microsoft Office 2010 + Microsoft Lync 2010 package, or keep and maintain them as separate packages and deploy them by using a connection group. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/manage/appv-connection-group-virtual-environment.md b/windows/manage/appv-connection-group-virtual-environment.md new file mode 100644 index 0000000000..78339b6533 --- /dev/null +++ b/windows/manage/appv-connection-group-virtual-environment.md @@ -0,0 +1,111 @@ +--- +title: About the Connection Group Virtual Environment (Windows 10) +description: About the Connection Group Virtual Environment +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# About the Connection Group Virtual Environment + +**Applies to** +- Windows 10, version 1607 + +**In this topic:** + +- [How package priority is determined](#bkmk-pkg-priority-deter) + +- [Merging identical package paths into one virtual directory in connection groups](#bkmk-merged-root-ve-exp) + +## How package priority is determined + + +The virtual environment and its current state are associated with the connection group, not with the individual packages. If an App-V package is removed from the connection group, the state that existed as part of the connection group will not migrate with the package. + +If the same package is a part of two different connection groups, you have to indicate which connection group App-V should use. For example, you might have two packages in a connection group that each define the same registry DWORD value. + +The connection group that is used is based on the order in which a package appears inside the **AppConnectionGroup** XML document: + +- The first package has the highest precedence. + +- The second package has the second highest precedence. + +Consider the following example section: + +``` syntax + +``` + +Assume that same DWORD value ABC (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region) is defined in the first and third package, such as: + +- Package 1 (A8731008-4523-4713-83A4-CD1363907160): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5 + +- Package 3 (04220DCA-EE77-42BE-A9F5-96FD8E8593F2): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=10 + +Since Package 1 appears first, the AppConnectionGroup's virtual environment will have the single DWORD value of 5 (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5). This means that the virtual applications in Package 1, Package 2, and Package 3 will all see the value 5 when they query for HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region. + +Other virtual environment resources are resolved similarly, but the usual case is that the collisions occur in the registry. + +## Merging identical package paths into one virtual directory in connection groups + + +If two or more packages in a connection group contain identical directory paths, the paths are merged into a single virtual directory inside the connection group virtual environment. This merging of paths allows an application in one package to access files that are in a different package. + +When you remove a package from a connection group, the applications in that removed package are no longer able to access files in the remaining packages in the connection group. + +The order in which App-V looks up a file’s name in the connection group is specified by the order in which the App-V packages are listed in the connection group manifest file. + +The following example shows the order and relationship of a file name lookup in a connection group for **Package A** and **Package B**. + + ++++ + + + + + + + + + + + + + + + + +
    Package APackage B

    C:\Windows\System32

    C:\Windows\System32

    C:\AppTest

    C:\AppTest

    + +  + +In the example above, when a virtualized application tries to find a specific file, Package A is searched first for a matching file path. If a matching path is not found, Package B is searched, using the following mapping rules: + +- If a file named **test.txt** exists in the same virtual folder hierarchy in both application packages, the first matching file is used. + +- If a file named **bar.txt** exists in the virtual folder hierarchy of one application package, but not in the other, the first matching file is used. + +## Have a suggestion for App-V? + + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[Managing Connection Groups](appv-managing-connection-groups.md) + +  + +  + + + + + diff --git a/windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md b/windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md new file mode 100644 index 0000000000..bb5c9776c7 --- /dev/null +++ b/windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md @@ -0,0 +1,64 @@ +--- +title: How to Convert a Package Created in a Previous Version of App-V (Windows 10) +description: How to Convert a Package Created in a Previous Version of App-V +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Convert a Package Created in a Previous Version of App-V + +**Applies to** +- Windows 10, version 1607 + +You can use the package converter utility to upgrade virtual application packages that have been created with previous versions of App-V. + +> [!NOTE] +> If you are running a computer with a 64-bit architecture, you must use the x86 version of Windows PowerShell. + +The package converter can only directly convert packages that were created by using the App-V 4.5 sequencer or later. Packages that were created using a version prior to App-V 4.5 must be upgraded to at least App-V 4.5 before conversion. + +The following information provides direction for converting existing virtual application packages. + +> [!IMPORTANT] +> You must configure the package converter to always save the package ingredients file to a secure location and directory. A secure location is accessible only by an administrator. Additionally, when you deploy the package, you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion process. + +## App-V 4.6 installation folder is redirected to virtual file system root + +When you convert packages from App-V 4.6 to App-V for Windows 10, the App-V for Windows 10 package can access the hardcoded drive that you were required to use when you created 4.6 packages. The drive letter will be the drive you selected as the installation drive on the 4.6 sequencing machine. (The default drive letter is Q:\\.) + +**Technical Details:** The App-V package converter will save the App-V 4.6 installation root folder and short folder names in the FilesystemMetadata.xml file in the Filesystem element. When the App-V for Windows 10 client creates the virtual process, it will map requests from the App-V 4.6 installation root to the virtual file system root. + +## Getting started + +1. Install the App-V Sequencer on a computer in your environment. For information about how to install the Sequencer, see [How to Install the Sequencer](appv-install-the-sequencer.md). + +2. The following cmdlets are available: + + - **Test-AppvLegacyPackage** – This cmdlet is designed to check packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet will not parse the **.sft** file or do any in depth validation. For information about options and basic functionality for this cmdlet, using Windows PowerShell, type `Test-AppvLegacyPackage -?`. + + - **ConvertFrom-AppvLegacyPackage** – To convert an existing package, type `ConvertFrom-AppvLegacyPackage c:\contentStore c:\convertedPackages`. In this command, `c:\contentStore` represents the location of the existing package and `c:\convertedPackages` is the output directory to which the resulting App-V for Windows 10 virtual application package file will be saved. By default, if you do not specify a new name, the old package name will be used. + + Additionally, the package converter optimizes performance of packages in App-V for Windows 10 by setting the package to stream fault the App-V package.  This is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default. + + > [!NOTE] + > Before you specify the output directory, you must create the output directory. + +### Advanced Conversion Tips + +- Piping - Windows PowerShell supports piping. Piping allows you to call `dir c:\contentStore\myPackage | Test-AppvLegacyPackage`. In this example, the directory object that represents `myPackage` will be given as input to the `Test-AppvLegacyPackage` command and bound to the `-Source` parameter. Piping like this is especially useful when you want to batch commands together; for example, `dir .\ | Test-AppvLegacyPackage | ConvertFrom-AppvLegacyAppvPackage -Target .\ConvertedPackages`. This piped command would test the packages and then pass those objects on to actually be converted. You can also apply a filter on packages without errors or only specify a directory which contains an **.sprj** file or pipe them to another cmdlet that adds the filtered package to the server or publishes them to the App-V client. + +- Batching - The Windows PowerShell command enables batching. More specifically, the cmdlets support taking a string\[\] object for the `-Source` parameter which represents a list of directory paths. This allows you to enter `$packages = dir c:\contentStore` and then call `ConvertFrom-AppvLegacyAppvPackage-Source $packages -Target c:\ConvertedPackages` or to use piping and call `dir c:\ContentStore | ConvertFrom-AppvLegacyAppvPackage -Target C:\ConvertedPackages`. + +- Other functionality - Windows PowerShell has other built-in functionality for features such as aliases, piping, lazy-binding, .NET object, and many others. All of these are usable in Windows PowerShell and can help you create advanced scenarios for the Package Converter. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +- [Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md b/windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md new file mode 100644 index 0000000000..467da82dda --- /dev/null +++ b/windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md @@ -0,0 +1,86 @@ +--- +title: How to Create a Connection Group with User-Published and Globally Published Packages (Windows 10) +description: How to Create a Connection Group with User-Published and Globally Published Packages +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Create a Connection Group with User-Published and Globally Published Packages + +**Applies to** +- Windows 10, version 1607 + +You can create user-entitled connection groups that contain both user-published and globally published packages, using either of the following methods: + +- [How to use Windows PowerShell cmdlets to create user-entitled connection groups](#how-to-use-powershell-cmdlets-to-create-user-entitled-connection-groups) + +- [How to use the App-V Server to create user-entitled connection groups](#how-to-use-the-app-v-server-to-create-user-entitled-connection-groups) + +## What to know before you start: + + ++++ + + + + + + + + + + + + + + + + +
    Unsupported scenarios and potential issuesResult

    You cannot include user-published packages in globally entitled connection groups.

    The connection group will fail.

    If you publish a package globally and then create a user-published connection group in which you’ve made that package non-optional, you can still run Unpublish-AppvClientPackage <package> -global to unpublish the package, even when that package is being used in another connection group.

    If any other connection groups are using that package, the package will fail in those connection groups.

    +

    To avoid inadvertently unpublishing a non-optional package that is being used in another connection group, we recommend that you track the connection groups in which you’ve used a non-optional package.

    + +  + +## How to use Windows PowerShell cmdlets to create user-entitled connection groups + +1. Add and publish packages by using the following commands: + + ``` + Add-AppvClientPackage + Add-AppvClientPackage + Publish-AppvClientPackage -PackageId  -VersionId -Global + Publish-AppvClientPackage -PackageId -VersionId  + ``` + +2. Create the connection group XML file. For more information, see [About the Connection Group File](appv-connection-group-file.md). + +3. Add and publish the connection group by using the following commands: + + ``` + Add-AppvClientConnectionGroup + Enable-AppvClientConnectionGroup -GroupId  -VersionId + ``` + +## How to use the App-V Server to create user-entitled connection groups + +1. Open the App-V Management Console. + +2. Follow the instructions in [How to Publish a Package by Using the Management Console](appv-publish-a-packages-with-the-management-console.md) to publish packages globally and to the user. + +3. Follow the instructions in [How to Create a Connection Group](appv-create-a-connection-group.md) to create the connection group, and add the user-published and globally published packages. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/manage/appv-create-a-connection-group.md b/windows/manage/appv-create-a-connection-group.md new file mode 100644 index 0000000000..3bbc7aa888 --- /dev/null +++ b/windows/manage/appv-create-a-connection-group.md @@ -0,0 +1,50 @@ +--- +title: How to Create a Connection Group (Windows 10) +description: How to Create a Connection Group +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Create a Connection Group + +**Applies to** +- Windows 10, version 1607 + +Use these steps to create a connection group by using the App-V Management Console. To use Windows PowerShell to create connection groups, see [How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md). + +When you place packages in a connection group, their package root paths are merged. If you remove packages, only the remaining packages maintain the merged root. + +**To create a connection group** + +1. In the App-V Management Console, select **CONNECTION GROUPS** to display the Connection Groups library. + +2. Select **ADD CONNECTION GROUP** to create a new connection group. + +3. In the **New Connection Group** pane, type a description for the group. + +4. Click **EDIT** in the **CONNECTED PACKAGES** pane to add a new application to the connection group. + +5. In the **PACKAGES Entire Library** pane, select the application to be added, and click the arrow to add the application. + + To remove an application, select the application to be removed in the **PACKAGES IN** pane and click the arrow. + + To reprioritize the applications in your connection group, use the arrows in the **PACKAGES IN** pane. + + **Important**
    + By default, the Active Directory Domain Services access configurations that are associated with a specific application are not added to the connection group. To transfer the Active Directory access configuration, select **ADD PACKAGE ACCESS TO GROUP ACCESS**, which is located in the **PACKAGES IN** pane. + +6. After adding all the applications and configuring Active Directory access, click **Apply**. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) + +[Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md b/windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md new file mode 100644 index 0000000000..82eb3a5165 --- /dev/null +++ b/windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md @@ -0,0 +1,40 @@ +--- +title: How to Create a Custom Configuration File by Using the App-V Management Console (Windows 10) +description: How to Create a Custom Configuration File by Using the App-V Management Console +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Create a Custom Configuration File by Using the App-V Management Console + +**Applies to** +- Windows 10, version 1607 + +You can use a dynamic configuration to customize an App-V package for a specific user. However, you must first create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use the files. Creation of the file is an advanced manual operation. For general information about dynamic user configuration files, see, [About App-V Dynamic Configuration](appv-dynamic-configuration.md). + +Use the following procedure to create a Dynamic User Configuration file by using the App-V Management console. + +**To create a Dynamic User Configuration file** + +1. Right-click the name of the package that you want to view and select **Edit active directory access** to view the configuration that is assigned to a given user group. Alternatively, select the package, and click **Edit**. + +2. Using the list of **AD Entities with Access**, select the AD group that you want to customize. Select **Custom** from the drop-down list, if it is not already selected. A link named **Edit** will be displayed. + +3. Click **Edit**. The Dynamic User Configuration that is assigned to the AD Group will be displayed. + +4. Click **Advanced**, and then click **Export Configuration**. Type in a filename and click **Save**. Now you can edit the file to configure a package for a user. + + **Note**   + To export a configuration while running on Windows Server, you must disable "IE Enhanced Security Configuration". If this is enabled and set to block downloads, you cannot download anything from the App-V Server. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-create-a-package-accelerator-with-powershell.md b/windows/manage/appv-create-a-package-accelerator-with-powershell.md new file mode 100644 index 0000000000..fb7b1a1129 --- /dev/null +++ b/windows/manage/appv-create-a-package-accelerator-with-powershell.md @@ -0,0 +1,49 @@ +--- +title: How to Create a Package Accelerator by Using Windows PowerShell (Windows 10) +description: How to Create a Package Accelerator by Using Windows PowerShell +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Create a Package Accelerator by Using Windows PowerShell + +**Applies to** +- Windows 10, version 1607 + +App-V package accelerators automatically sequence large, complex applications. Additionally, when you apply an App-V package accelerator, you are not always required to manually install an application to create the virtualized package. + +**To create a package accelerator** + +1. Install the App-V sequencer. For more information about installing the sequencer see [How to Install the Sequencer](appv-install-the-sequencer.md). + +2. To open a Windows PowerShell console, click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. Use the **New-AppvPackageAccelerator** cmdlet. + +3. To create a package accelerator, make sure that you have the .appv package to create an accelerator from, the installation media or installation files, and optionally a read me file for consumers of the accelerator to use. The following parameters are required to use the package accelerator cmdlet: + + - **InstalledFilesPath** - specifies the application installation path. + + - **Installer** – specifies the path to the application installer media + + - **InputPackagePath** – specifies the path to the .appv package + + - **Path** – specifies the output directory for the package. + + The following example displays how you can create a package accelerator with an .appv package and the installation media: + + **New-AppvPackageAccelerator -InputPackagePath <path to the .appv file> -Installer <path to the installer executable> -Path <directory of the output path>** + + An additional optional parameter that can be used with the **New-AppvPackageAccelerator** cmdlet is as follows: + + - **AcceleratorDescriptionFile** - specifies the path to user created package accelerator instructions. The package accelerator instructions are **.txt** or **.rtf** description files that will be packaged with the package created using the package accelerator. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/manage/appv-create-a-package-accelerator.md b/windows/manage/appv-create-a-package-accelerator.md new file mode 100644 index 0000000000..690438f968 --- /dev/null +++ b/windows/manage/appv-create-a-package-accelerator.md @@ -0,0 +1,78 @@ +--- +title: How to Create a Package Accelerator (Windows 10) +description: How to Create a Package Accelerator +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Create a Package Accelerator + +**Applies to** +- Windows 10, version 1607 + +App-V package accelerators automatically generate new virtual application packages. + +>**Note**  You can use Windows PowerShell to create a package accelerator. For more information see [How to Create a Package Accelerator by Using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md). + +Use the following procedure to create a package accelerator. + +>**Important** +> - Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V Package Accelerator is applied. +> - Before you begin the following procedure, perform the following: + - Copy the virtual application package that you will use to create the package accelerator locally to the computer running the sequencer. + - Copy all required installation files associated with the virtual application package to the computer running the sequencer. +> - The App-V Sequencer does not grant any license rights to the software application you are using to create the Package Accelerator. You must abide by all end user license terms for the application you are using. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using App-V Sequencer. + +## To create a package accelerator + +1. To start the App-V sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. + +2. To start the App-V **Create Package Accelerator** wizard, in the App-V sequencer console, click **Tools** / **Create Accelerator**. + +3. On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.appv file). + + **Tip**
    + Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer. + + Click **Next**. + +4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files. + + **Tip**
    + Copy the folder that contains the required installation files to the computer running the Sequencer. + +5. If the application is already installed on the computer running the sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location. + +6. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page. + + **Note**
    + You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard. + +7. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the package accelerator. Select only files that are required for the application to run successfully, and then click **Next**. + +8. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package. + + If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**. + +9. On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**. + +10. On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory. + +11. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**. + + **Important**
    + To help ensure that the package accelerator is as secure as possible, and so that the publisher can be verified when the package accelerator is applied, you should always digitally sign the package accelerator. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) + +[How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md) diff --git a/windows/manage/appv-create-a-virtual-application-package-package-accelerator.md b/windows/manage/appv-create-a-virtual-application-package-package-accelerator.md new file mode 100644 index 0000000000..4cae334e5e --- /dev/null +++ b/windows/manage/appv-create-a-virtual-application-package-package-accelerator.md @@ -0,0 +1,78 @@ +--- +title: How to Create a Virtual Application Package Using an App-V Package Accelerator (Windows 10) +description: How to Create a Virtual Application Package Using an App-V Package Accelerator +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Create a Virtual Application Package Using an App-V Package Accelerator + +**Applies to** +- Windows 10, version 1607 + +Use the following procedure to create a virtual application package with the App-V Package Accelerator. + +> **Important**  The App-V Sequencer does not grant any license rights to the software application that you use to create the Package Accelerator. You must abide by all end user license terms for the application that you use. It is your responsibility to make sure that the software application’s license terms allow you to create a Package Accelerator with the App-V Sequencer. + +**To create a virtual application package with an App-V Package Accelerator** + +1. Be sure that the required Package Accelerator has been copied locally to the computer that runs the App-V Sequencer. Also copy all required installation files for the package to a local folder on the computer that runs the Sequencer. This is the folder that you have to specify in step 6 of this procedure. + +2. To start the App-V Sequencer, on the computer that runs the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. + +3. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**. + +4. To specify the package accelerator that will be used to create the new virtual application package, click **Browse** on the **Select Package Accelerator** page. Click **Next**. + + > **Important**  If the publisher of the package accelerator cannot be verified and does not contain a valid digital signature, then before you click **Run**, you must confirm that you trust the source of the package accelerator. Confirm your choice in the **Security Warning** dialog box. + +5. On the **Guidance** page, review the publishing guidance information that is displayed in the information pane. This information was added when the Package Accelerator was created and it contains guidance about how to create and publish the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**. + +6. On the **Select Installation Files** page, click **Make New Folder** to create a local folder that contains all required installation files for the package, and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer that runs the Sequencer, click **Browse** to select the folder. + + Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**. + + > **Note**  You can specify the following types of supported installation files: + > - Windows Installer files (**.msi**) + > - Cabinet files (.cab) + > - Compressed files with a .zip file name extension + > - The actual application files + > The following file types are not supported: **.msp** and **.exe** files. If you specify an **.exe** file, you must extract the installation files manually. + +7. If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page. + +8. On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**. + +9. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB. + +10. To create the package, click **Create**. After the package is created, click **Next**. + +11. On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements. + + If you select **Configure Software**, the following items can be configured using the Sequencer as part of this step: + + - **Load Package**. The Sequencer loads the files that are associated with the package. It can take several seconds to an hour to decode the package. + + - **Run Each Program**. Optionally run the programs that are contained in the package. This step is helpful to complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at once, select at least one program, and then click **Run All**. To run specific programs, select the program or programs that you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**. + + - **Save Package**. The Sequencer saves the package. + + - **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block. + + If you do not want to configure the applications, click **Skip this step**, and then click **Next**. + +12. On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**. + + The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about how to modify a package, see [How to Modify an Existing Virtual Application Package](appv-modify-an-existing-virtual-application-package.md). + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-create-and-use-a-project-template.md b/windows/manage/appv-create-and-use-a-project-template.md new file mode 100644 index 0000000000..c6a0be63bb --- /dev/null +++ b/windows/manage/appv-create-and-use-a-project-template.md @@ -0,0 +1,55 @@ +--- +title: How to Create and Use a Project Template (Windows 10) +description: How to Create and Use a Project Template +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Create and Use a Project Template + +**Applies to** +- Windows 10, version 1607 + +You can use an App-V project template to save commonly applied settings associated with an existing virtual application package. These settings can then be applied when you create new virtual application packages in your environment. Using a project template can streamline the process of creating virtual application packages. + +> **Note**  You can, and often should apply an App-V project template during a package upgrade. For example, if you sequenced an application with a custom exclusion list, it is recommended that an associated template is created and saved for later use while upgrading the sequenced application. + +App-V project templates differ from App-V Application Accelerators because App-V Application Accelerators are application-specific, and App-V project templates can be applied to multiple applications. + +Use the following procedures to create and apply a new template. + +**To create a project template** + +1. To start the App-V sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. + + > **Note**  If the virtual application package is currently open in the App-V Sequencer console, skip to step 3 of this procedure. + +2. To open the existing virtual application package that contains the settings you want to save with the App-V project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**. + +3. In the App-V Sequencer console, to save the template file, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V project template. Click Save. + + The new App-V project template is saved in the folder you specified. + +**To apply a project template** + +> **Important**  Creating a virtual application package using a project template in conjunction with a Package Accelerator is not supported. + +1. To start the App-V sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. + +2. To create or upgrade a new virtual application package by using an App-V project template, click **File** / **New From Template**. + +3. To select the project template that you want to use, browse to the directory where the project template is saved, select the project template, and then click **Open**. + + Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-creating-and-managing-virtualized-applications.md b/windows/manage/appv-creating-and-managing-virtualized-applications.md new file mode 100644 index 0000000000..861034a883 --- /dev/null +++ b/windows/manage/appv-creating-and-managing-virtualized-applications.md @@ -0,0 +1,214 @@ +--- +title: Creating and Managing App-V Virtualized Applications (Windows 10) +description: Creating and Managing App-V Virtualized Applications +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Creating and Managing App-V Virtualized Applications + +**Applies to** +- Windows 10, version 1607 + +After you have properly deployed the Microsoft Application Virtualization (App-V) sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. + +**Note**   +For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx). + +**Note** +The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. + +## Sequencing an application + + +You can use the App-V Sequencer to perform the following tasks: + +- Create virtual packages that can be deployed to computers running the App-V client. + +- Upgrade existing packages. You can expand an existing package onto the computer running the sequencer and then upgrade the application to create a newer version. + +- Edit configuration information associated with an existing package. For example, you can add a shortcut or modify a file type association. + + **Note**   + You must create shortcuts and save them to an available network location to allow roaming. If a shortcut is created and saved in a private location, the package must be published locally to the computer running the App-V client. +  +- Convert existing virtual packages. + +The sequencer uses the **%TMP% \\ Scratch** or **%TEMP% \\ Scratch** directory and the **Temp** directory to store temporary files during sequencing. On the computer that runs the sequencer, you should configure these directories with free disk space equivalent to the estimated application installation requirements. Configuring the temp directories and the Temp directory on different hard drive partitions can help improve performance during sequencing. + +When you use the sequencer to create a new virtual application, the following listed files are created. These files comprise the App-V package. + +- .msi file. This Windows Installer (.msi) file is created by the sequencer and is used to install the virtual package on target computers. + +- Report.xml file. In this file, the sequencer saves all issues, warnings, and errors that were discovered during sequencing. It displays the information after the package has been created. You can us this report for diagnosing and troubleshooting. + +- .appv file. This is the virtual application file. + +- Deployment configuration file. The deployment configuration file determines how the virtual application will be deployed to target computers. + +- User configuration file. The user configuration file determines how the virtual application will run on target computers. + +**Important**   +You must configure the %TMP% and %TEMP% folders that the package converter uses to be a secure location and directory. A secure location is only accessible by an administrator. Additionally, when you sequence the package you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion and monitoring process.  + +The **Options** dialog box in the sequencer console contains the following tabs: + +- **General**. Use this tab to enable Microsoft Updates to run during sequencing. Select **Append Package Version to Filename** to configure the sequence to add a version number to the virtualized package that is being sequenced. Select **Always trust the source of Package Accelerators** to create virtualized packages using a package accelerator without being prompted for authorization. + + **Important**   + Package Accelerators created using App-V 4.6 are not supported by App-V.   + +- **Parse Items**. This tab displays the associated file path locations that will be parsed or tokenized into in the virtual environment. Tokens are useful for adding files using the **Package Files** tab in **Advanced Editing**. + +- **Exclusion Items**. Use this tab to specify which folders and directories should not be monitored during sequencing. To add local application data that is saved in the Local App Data folder in the package, click **New** and specify the location and the associated **Mapping Type**. This option is required for some packages. + +App-V supports applications that include Microsoft Windows Services. If an application includes a Windows service, the Service will be included in the sequenced virtual package as long as it is installed while being monitored by the sequencer. If a virtual application creates a Windows service when it initially runs, then later, after installation, the application must be run while the sequencer is monitoring so that the Windows Service will be added to the package. Only Services that run under the Local System account are supported. Services that are configured for AutoStart or Delayed AutoStart are started before the first virtual application in a package runs inside the package’s Virtual Environment. Windows Services that are configured to be started on demand by an application are started when the virtual application inside the package starts the Service via API call. + +[How to Sequence a New Application with App-V](appv-sequence-a-new-application.md) + +## App-V shell extension support + + +App-V supports shell extensions. Shell extensions will be detected and embedded in the package during sequencing. + +Shell extensions are embedded in the package automatically during the sequencing process. When the package is published, the shell extension gives users the same functionality as if the application were locally installed. + +**Requirements for using shell extensions:** + +- Packages that contain embedded shell extensions must be published globally. The application requires no additional setup or configuration on the client to enable the shell extension functionality. + +- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: + + - The version of the application is 64-bit. + + - The Sequencer is running on a 64-bit computer. + + - The package is being delivered to a 64-bit App-V client computer. + +The following table lists the supported shell extensions: + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    HandlerDescription

    Context menu handler

    Adds menu items to the context menu. It is called before the context menu is displayed.

    Drag-and-drop handler

    Controls the action where right-click, drag and drop and modifies the context menu that appears.

    Drop target handler

    Controls the action after a data object is dragged and dropped over a drop target such as a file.

    Data object handler

    Controls the action after a file is copied to the clipboard or dragged and dropped over a drop target. It can provide additional clipboard formats to the drop target.

    Property sheet handler

    Replaces or adds pages to the property sheet dialog box of an object.

    Infotip handler

    Allows retrieving flags and infotip information for an item and displaying it inside a pop-up tooltip upon mouse hover.

    Column handler

    Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping.

    Preview handler

    Enables a preview of a file to be displayed in the Windows Explorer Preview pane.

    + +## Copy on Write (CoW) file extension support + +Copy on write (CoW) file extensions allow App-V to dynamically write to specific locations contained in the virtual package while it is being used. + +The following table displays the file types that can exist in a virtual package under the VFS directory, but cannot be updated on the computer running the App-V client. All other files and directories can be modified. + +| File Type | | | | | | +|------------ |------------- |------------- |------------ |------------ |------------ | +| .acm | .asa | .asp | .aspx | .ax | .bat | +| .cer | .chm | .clb | .cmd | .cnt | .cnv | +| .com | .cpl | .cpx | .crt | .dll | .drv | +| .esc | .exe | .fon | .grp | .hlp | .hta | +| .ime | .inf | .ins | .isp | .its | .js | +| .jse | .lnk | .msc | .msi | .msp | .mst | +| .mui | .nls | .ocx | .pal | .pcd | .pif | +| .reg | .scf | .scr | .sct | .shb | .shs | +| .sys | .tlb | .tsp | .url | .vb | .vbe | +| .vbs | .vsmacros | .ws | .wsf | .wsh | | + + +## Modifying an existing virtual application package + + +You can use the sequencer to modify an existing package. The computer on which you do this should match the chip architecture of the computer you used to create the application. For example, if you initially sequenced a package using a computer running a 64-bit operating system, you should modify the package using a computer running a 64-bit operating system. + +[How to Modify an Existing Virtual Application Package](appv-modify-an-existing-virtual-application-package.md) + +## Creating a project template + + +A .appvt file is a project template that can be used to save commonly applied, customized settings. You can then more easily use these settings for future sequencings. + +App-V project templates differ from App-V Application Accelerators because App-V Application Accelerators are application-specific, and App-V project templates can be applied to multiple applications. Additionally, you cannot use a project template when you use a Package Accelerator to create a virtual application package. The following general settings are saved with an App-V project template: + +A template can specify and store multiple settings as follows: + +- **Advanced Monitoring Options**. Enables Microsoft Update to run during monitoring. Saves allow local interaction option settings + +- **General Options**. Enables the use of **Windows Installer**, **Append Package Version to Filename**. + +- **Exclusion Items.** Contains the Exclusion pattern list. + +[How to Create and Use a Project Template](appv-create-and-use-a-project-template.md) + +## Creating a package accelerator + + +**Note**   +Package accelerators created using a previous version of App-V must be recreated using App-V. + +You can use App-V package accelerators to automatically generate a new virtual application packages. After you have successfully created a package accelerator, you can reuse and share the package accelerator. + +In some situations, to create the package accelerator, you might have to install the application locally on the computer that runs the sequencer. In such cases, you should first try to create the package accelerator with the installation media. If multiple missing files are required, you should install the application locally to the computer that runs the sequencer, and then create the package accelerator. + +After you have successfully created a Package Accelerator, you can reuse and share the Package Accelerator. Creating App-V Package Accelerators is an advanced task. Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V Package Accelerator is applied. + +[How to Create a Package Accelerator](appv-create-a-package-accelerator.md) + +[How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md) + +## Sequencer error reporting + + +The App-V Sequencer can detect common sequencing issues during sequencing. The **Installation Report** page at the end of the sequencing wizard displays diagnostic messages categorized into **Errors**, **Warnings**, and **Info** depending on the severity of the issue. + +You can also find additional information about sequencing errors using the Windows Event Viewer. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +- [Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md b/windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md new file mode 100644 index 0000000000..09c76c884b --- /dev/null +++ b/windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md @@ -0,0 +1,39 @@ +--- +title: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console (Windows 10) +description: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console + +**Applies to** +- Windows 10, version 1607 + +Use the following procedure to customize the virtual application extensions for an Active Directory (AD) group. + +**To customize virtual applications extensions for an AD group** + +1. To view the package that you want to configure, open the App-V Management Console. To view the configuration that is assigned to a given user group, select the package, and right-click the package name and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. + +2. To customize an AD group, you can find the group from the list of **AD Entities with Access**. Then, using the drop-down box in the **Assigned Configuration** pane, select **Custom**, and then click **EDIT**. + +3. To disable all extensions for a given application, clear **ENABLE**. + + To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane, and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane, and select **Remove Shortcut**. To edit an existing shortcut, right-click the application, and select **Edit Shortcut**. + +4. To view any other application extensions, click **Advanced**, and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions that are associated with the package using the configuration file. + +5. To edit additional application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog, click **Overwrite** to complete the process. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-delete-a-connection-group.md b/windows/manage/appv-delete-a-connection-group.md new file mode 100644 index 0000000000..a81a30d908 --- /dev/null +++ b/windows/manage/appv-delete-a-connection-group.md @@ -0,0 +1,33 @@ +--- +title: How to Delete a Connection Group (Windows 10) +description: How to Delete a Connection Group +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Delete a Connection Group + +**Applies to** +- Windows 10, version 1607 + +Use the following procedure to delete an existing App-V connection group. + +**To delete a connection group** + +1. Open the App-V Management Console and select **CONNECTION GROUPS**. + +2. Right-click the connection group to be removed, and select **delete**. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) + +[Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/manage/appv-delete-a-package-with-the-management-console.md b/windows/manage/appv-delete-a-package-with-the-management-console.md new file mode 100644 index 0000000000..93cd94b4f0 --- /dev/null +++ b/windows/manage/appv-delete-a-package-with-the-management-console.md @@ -0,0 +1,31 @@ +--- +title: How to Delete a Package in the Management Console (Windows 10) +description: How to Delete a Package in the Management Console +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Delete a Package in the Management Console + +**Applies to** +- Windows 10, version 1607 + +Use the following procedure to delete an App-V package. + +**To delete a package in the Management Console** + +1. To view the package you want to delete, open the App-V Management Console and select **Packages**. Select the package to be removed. + +2. Click or right-click the package. Select **Delete** to remove the package. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md b/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md new file mode 100644 index 0000000000..6a2ab10a6a --- /dev/null +++ b/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md @@ -0,0 +1,186 @@ +--- +title: How to Deploy the App-V Databases by Using SQL Scripts (Windows 10) +description: How to Deploy the App-V Databases by Using SQL Scripts +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Deploy the App-V Databases by Using SQL Scripts + +**Applies to** +- Windows Server 2016 + +Use the following instructions to use SQL scripts, rather than the Windows Installer, to: + +- Install the App-V databases + +- Upgrade the App-V databases to a later version + +>**Note** +> If you have already deployed an App-V 5.0 SP3 database or later, the SQL scripts are not required to upgrade to App-V for Windows. + +## How to install the App-V databases by using SQL scripts + +1. Before you install the database scripts, review and keep a copy of the App-V license terms. By running the database scripts, you are agreeing to the license terms. If you do not accept them, you should not use this software. + +2. Copy the **appv\_server\_setup.exe** from the App-V release media to a temporary location. + +3. From a command prompt, run **appv\_server\_setup.exe** and specify a temporary location for extracting the database scripts. + + Example: appv\_server\_setup.exe /layout c:\\__ + +4. Browse to the temporary location that you created, open the extracted **DatabaseScripts** folder, and review the appropriate readme.txt file for instructions: + + | Database | Location of readme.txt file to use + | - | - | + | Management database | ManagementDatabase subfolder | + | Reporting database | ReportingDatabase subfolder | + +> [!CAUTION] +> The readme.txt file in the ManagementDatabase subfolder is out of date. The information in the updated readme files below is the most current and should supersede the readme information provided in the **DatabaseScripts** folders. + +> [!IMPORTANT] +> The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3. +> The Permissions.sql script should be updated according to **Step 2** in [KB article 3031340](https://support.microsoft.com/kb/3031340). **Step 1** is not required for versions of App-V later than App-V 5.0 SP3. + +### Updated management database README file content + +``` syntax +*********************************************************************************************************** +Before you install and use the Application Virtualization Database Scripts, you must: + +- Review the license terms. +- Print and retain a copy of the license terms for your records. + +By running the App-V you agree to such license terms. If you do not accept them, do not use the software. +*********************************************************************************************************** + +Steps to install "AppVManagement" schema in SQL SERVER. + +## PREREQUISITES: + + 1. Review the installation package. The following files MUST exist: + + SQL files + --------- + Database.sql + CreateTables.sql + CreateStoredProcs.sql + UpdateTables.sql + Permissions.sql + + 2. Ensure the target SQL Server instance and SQL Server Agent service are running. + + 3. If you are not running the scripts directly on the server, ensure the + necessary SQL Server client software is installed and available from + the specified location. Specifically, the "osql" command must be supported for these scripts to run. + +## PREPARATION: + + 1. Review the database.sql file and modify as necessary. Although the + defaults are likely sufficient, it is suggested that the following + settings be reviewed: + + DATABASE - ensure name is satisfactory - default is "AppVManagement". + + 2. Review the Permissions.sql file and provide all the necessary account information + for setting up read and write access on the database. Note: Default settings in the file will not work. + +## INSTALLATION: + + 1. Run the database.sql against the "master" database. Your user + credential must have the ability to create databases. + This script will create the database. + + 2. Run the following scripts against the "AppVManagement" database using the + same account as above in order. + + CreateTables.sql + CreateStoredProcs.sql + UpdateTables.sql + Permissions.sql + +``` + +### Updated reporting database README file content + +``` syntax +*********************************************************************************************************** +Before you install and use the Application Virtualization Database Scripts, you must: + +- Review the license terms. +- Print and retain a copy of the license terms for your records. + +By running the App-V you agree to such license terms. If you do not accept them, do not use the software. +*********************************************************************************************************** + +Steps to install "AppVReporting" schema in SQL SERVER. + +## PREREQUISITES: + + 1. Review the installation package. The following files MUST exist: + + SQL files + --------- + Database.sql + UpgradeDatabase.sql + CreateTables.sql + CreateReportingStoredProcs.sql + CreateStoredProcs.sql + CreateViews.sql + Permissions.sql + ScheduleReportingJob.sql + + 2. Ensure the target SQL Server instance and SQL Server Agent service are running. + + 3. If you are not running the scripts directly on the server, ensure the + necessary SQL Server client software is installed and executable from + the location you have chosen. Specifically, the "osql" command must be supported for these scripts to run. + +## PREPARATION: + + 1. Review the database.sql file and modify as necessary. Although the + defaults are likely sufficient, it is suggested that the following + settings be reviewed: + + DATABASE - ensure name is satisfactory - default is "AppVReporting". + + 2. Review the Permissions.sql file and provide all the necessary account information + for setting up read and write access on the database. Note: Default settings + in the file will not work. + + 3. Review the ScheduleReportingJob.sql file and make sure that the stored proc schedule + time is acceptable. The default stored proc schedule time is at 12.01 AM (line 84). + If this time is not suitable, you can change this to a more suitable time. The time is in the format HHMMSS. + +## INSTALLATION: + + 1. Run the database.sql against the "master" database. Your user + credential must have the ability to create databases. + This script will create the database. + + 2. If upgrading the database, run UpgradeDatabase.sql This will upgrade database schema. + + 2. Run the following scripts against the "AppVReporting" database using the + same account as above in order. + + CreateTables.sql + CreateReportingStoredProcs.sql + CreateStoredProcs.sql + CreateViews.sql + Permissions.sql + ScheduleReportingJob.sql +``` + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +- [Deploying the App-V Server](appv-deploying-the-appv-server.md) +- [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) diff --git a/windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md b/windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md new file mode 100644 index 0000000000..d74a347576 --- /dev/null +++ b/windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md @@ -0,0 +1,44 @@ +--- +title: How to deploy App-V Packages Using Electronic Software Distribution (Windows 10) +description: How to deploy App-V Packages Using Electronic Software Distribution +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# How to deploy App-V packages using electronic software distribution + +**Applies to** +- Windows 10, version 1607 + +You can use an electronic software distribution (ESD) system to deploy App-V virtual applications to App-V clients. + +For component requirements and options for using an ESD to deploy App-V packages, see [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md). + +Use one of the following methods to publish packages to App-V client computers with an ESD: + +| Method | Description | +| - | - | +| Functionality provided by a third-party ESD | Use the functionality in a third-party ESD.| +| Stand-alone Windows Installer | Install the application on the target client computer by using the associated Windows Installer (.msi) file that is created when you initially sequence an application. The Windows Installer file contains the associated App-V package file information used to configure a package and copies the required package files to the client. | +| Windows PowerShell | Use Windows PowerShell cmdlets to deploy virtualized applications. For more information about using Windows PowerShell and App-V, see [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md).| + +  + +**To deploy App-V packages by using an ESD** + +1. Install the App-V Sequencer on a computer in your environment. For more information about installing the sequencer, see [How to Install the Sequencer](appv-install-the-sequencer.md). + +2. Use the App-V Sequencer to create virtual application. For information about creating a virtual application, see [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md). + +3. After you create the virtual application, deploy the package by using your ESD solution. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +- [Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-deploy-the-appv-server-with-a-script.md b/windows/manage/appv-deploy-the-appv-server-with-a-script.md new file mode 100644 index 0000000000..ddc30926a2 --- /dev/null +++ b/windows/manage/appv-deploy-the-appv-server-with-a-script.md @@ -0,0 +1,445 @@ +--- +title: How to Deploy the App-V Server Using a Script (Windows 10) +description: How to Deploy the App-V Server Using a Script +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Deploy the App-V Server Using a Script + +**Applies to** +- Windows Server 2016 + +In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. + +**To install the App-V server using a script** + +Use the following lists and tables for more information about installing the App-V server using the command line. + +> **Note**  The information in the following lists and tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. + +## How to use common parameters + +## To install the Management server and Management database on a local machine + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /MANAGEMENT_DB_NAME + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use the following parameters: + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_CUSTOM_SQLINSTANCE +- /MANAGEMENT_DB_NAME + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/MANAGEMENT_SERVER
    +/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
    +/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
    +/MANAGEMENT_WEBSITE_PORT="8080"
    +/DB_PREDEPLOY_MANAGEMENT
    +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/MANAGEMENT_DB_NAME="AppVManagement" + +## To install the Management server using an existing Management database on a local machine + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL +- /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /EXISTING_MANAGEMENT_DB_NAME + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL +- /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE +- /EXISTING_MANAGEMENT_DB_NAME + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/MANAGEMENT_SERVER
    +/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
    +/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
    +/MANAGEMENT_WEBSITE_PORT="8080"
    +/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
    +/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName"
    +/EXISTING_MANAGEMENT_DB_NAME ="AppVManagement" + +## To install the Management server using an existing Management database on a remote machine + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME +- /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /EXISTING_MANAGEMENT_DB_NAME + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME +- /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE +- /EXISTING_MANAGEMENT_DB_NAME + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/MANAGEMENT_SERVER
    +/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
    +/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
    +/MANAGEMENT_WEBSITE_PORT="8080"
    +/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME="SqlServermachine.domainName"
    +/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName"
    +/EXISTING_MANAGEMENT_DB_NAME ="AppVManagement" + +## To install the Management database and the Management Server on the same computer + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_SERVER_MACHINE_USE_LOCAL +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_CUSTOM_SQLINSTANCE +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_SERVER_MACHINE_USE_LOCAL +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/DB_PREDEPLOY_MANAGEMENT
    +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/MANAGEMENT_DB_NAME="AppVManagement"
    +/MANAGEMENT_SERVER_MACHINE_USE_LOCAL
    +/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" + +## To install the Management database on a different computer than the Management server + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_CUSTOM_SQLINSTANCE +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/DB_PREDEPLOY_MANAGEMENT
    +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/MANAGEMENT_DB_NAME="AppVManagement"
    +/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount"
    +/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" + +## To install the Publishing server + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /PUBLISHING_SERVER +- /PUBLISHING_MGT_SERVER +- /PUBLISHING_WEBSITE_NAME +- /PUBLISHING_WEBSITE_PORT + +### Example + +/appv_server_setup.exe /QUIET
    +/PUBLISHING_SERVER
    +/PUBLISHING_MGT_SERVER="http://ManagementServerName:ManagementPort"
    +/PUBLISHING_WEBSITE_NAME="Microsoft AppV Publishing Service"
    +/PUBLISHING_WEBSITE_PORT="8081" + +## To install the Reporting server and Reporting database on a local machine + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /REPORTING _SERVER +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_SQLINSTANCE_USE_DEFAULT +- /REPORTING _DB_NAME + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /REPORTING _SERVER +- /REPORTING _ADMINACCOUNT +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_CUSTOM_SQLINSTANCE +- /REPORTING _DB_NAME + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/REPORTING_SERVER
    +/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
    +/REPORTING_WEBSITE_PORT="8082"
    +/DB_PREDEPLOY_REPORTING
    +/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/REPORTING_DB_NAME="AppVReporting" + +## To install the Reporting server using an existing Reporting database on a local machine + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /REPORTING _SERVER +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL +- /EXISTING_REPORTING_DB_SQLINSTANCE_USE_DEFAULT +- /EXISTING_REPORTING_DB_NAME + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /REPORTING _SERVER +- /REPORTING _ADMINACCOUNT +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL +- /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE +- /EXISTING_REPORTING _DB_NAME + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/REPORTING_SERVER
    +/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
    +/REPORTING_WEBSITE_PORT="8082"
    +/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
    +/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/EXITING_REPORTING_DB_NAME="AppVReporting" + +## To install the Reporting server using an existing Reporting database on a remote machine + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /REPORTING _SERVER +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME +- /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT +- /EXISTING_REPORTING _DB_NAME + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /REPORTING _SERVER +- /REPORTING _ADMINACCOUNT +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME +- /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE +- /EXISTING_REPORTING _DB_NAME + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/REPORTING_SERVER
    +/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
    +/REPORTING_WEBSITE_PORT="8082"
    +/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME="SqlServerMachine.DomainName"
    +/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/EXITING_REPORTING_DB_NAME="AppVReporting" + +## To install the Reporting database on the same computer as the Reporting server + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /DB_PREDEPLOY_REPORTING +- /REPORTING_DB_SQLINSTANCE_USE_DEFAULT +- /REPORTING_DB_NAME +- /REPORTING_SERVER_MACHINE_USE_LOCAL +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_CUSTOM_SQLINSTANCE +- /REPORTING _DB_NAME +- /REPORTING_SERVER_MACHINE_USE_LOCAL +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/DB_PREDEPLOY_REPORTING
    +/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/REPORTING_DB_NAME="AppVReporting"
    +/REPORTING_SERVER_MACHINE_USE_LOCAL
    +/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" + +## To install the Reporting database on a different computer than the Reporting server + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_SQLINSTANCE_USE_DEFAULT +- /REPORTING _DB_NAME +- /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_CUSTOM_SQLINSTANCE +- /REPORTING _DB_NAME +- /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +### Example for using a custom instance of Microsoft SQL Server: + +Using a custom instance of Microsoft SQL Server example:
    +/appv_server_setup.exe /QUIET
    +/DB_PREDEPLOY_REPORTING
    +/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/REPORTING_DB_NAME="AppVReporting"
    +/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount"
    +/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" + +## Parameter definitions + +- [General parameters](#parameter-definitions-for-general-parameters) +- [Management Server installation parameters](#parameter-definitions-for-management-server-installation-parameters) +- [Management Server Database parameters](#parameter-definitions-for-the-management-server-database) +- [Publishing Server installation parameters](#parameter-definitions-for-publishing-server-installation-parameters) +- [Reporting Server parameters](#parameter-definitions-for-reporting-server) +- [Parameters for using an existing Reporting Server database](#parameters-for-using-an-existing-reporting-server-database) +- [Reporting Server database installation parameters](#parameter-definitions-for-reporting-server-database-installation) +- [Parameters for using an existing Management Server database](#parameters-for-using-an-existing-management-server-database) + +### Parameter definitions for general parameters + +| Parameter | Description | +|-----------|-------------| +| /QUIET | Specifies silent install. | +| /UNINSTALL | Specifies an uninstall. | +| /LAYOUT | Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected. | +| /LAYOUTDIR | Specifies the layout directory. Takes a string. For example, /LAYOUTDIR="C:\Application Virtualization Server" | +| /INSTALLDIR | Specifies the installation directory. Takes a string. E.g. /INSTALLDIR="C:\Program Files\Application Virtualization\Server" | +| /MUOPTIN | Enables Microsoft Update. No value is expected | +| /ACCEPTEULA | Accepts the license agreement. This is required for an unattended installation. Example usage: **/ACCEPTEULA** or **/ACCEPTEULA=1**. | + +### Parameter definitions for Management Server installation parameters + +| Parameter | Description | +|-----------|-------------| +| /MANAGEMENT_SERVER | Specifies that the management server will be installed. No value is expected | +| /MANAGEMENT_ADMINACCOUNT | Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: **/MANAGEMENT_ADMINACCOUNT="mydomain\admin"**. If **/MANAGEMENT_SERVER** is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, **/MANAGEMENT_ADMINACCOUNT="mydomain\admin"**. | +| /MANAGEMENT_WEBSITE_NAME | Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME="Microsoft App-V Management Service" | +| /MANAGEMENT_WEBSITE_PORT | Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82. | + +### Parameter definitions for the Management Server Database + +| Parameter | Description | +|-----------|-------------| +| /DB\_PREDEPLOY\_MANAGEMENT | Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected | +| /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance should be used. No value is expected. | +| /MANAGEMENT_DB_CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: **/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER"**. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored. | +| /MANAGEMENT_DB_NAME | Specifies the name of the new management database that should be created. Example usage: **/MANAGEMENT_DB_NAME="AppVMgmtDB"**. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored. | +| /MANAGEMENT_SERVER_MACHINE_USE_LOCAL | Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. | +| /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT | Specifies the machine account of the remote machine that the management server will be installed on. Example usage: **/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="domain\computername"** | +| /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT | Indicates the Administrator account that will be used to install the management server. Example usage: **/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT ="domain\alias"** | + +### Parameter definitions for Publishing Server installation parameters + +| Parameter | Description | +|-----------|-------------| +| /PUBLISHING_SERVER | Specifies that the Publishing Server will be installed. No value is expected | +| /PUBLISHING_MGT_SERVER | Specifies the URL to Management Service the Publishing server will connect to. Example usage: **http://<management server name>:<Management server port number>**. If /PUBLISHING_SERVER is not used, this parameter will be ignored | +| /PUBLISHING_WEBSITE_NAME | Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME="Microsoft App-V Publishing Service" | +| /PUBLISHING_WEBSITE_PORT | Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83 | + +### Parameter definitions for Reporting Server + +| Parameter | Description | +|-----------|-------------| +| /REPORTING_SERVER | Specifies that the Reporting Server will be installed. No value is expected | +| /REPORTING_WEBSITE_NAME | Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService" | +| /REPORTING_WEBSITE_PORT | Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82 | + +   + +### Parameters for using an existing Reporting Server database + +| Parameter | Description | +|-----------|-------------| +| /EXISTING\_REPORTING\_DB_SQL_SERVER_USE_LOCAL | Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected. | +| /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME | Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME="mycomputer1" | +| /EXISTING_REPORTING_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. | +| /EXISTING_REPORTING_DB_CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER" | +| /EXISTING_REPORTING_DB_NAME | Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_NAME="AppVReporting" | + +### Parameter definitions for Reporting Server database installation + +| Parameter | Description | +|-----------|-------------| +| /DB\_PREDEPLOY\_REPORTING | Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected | +| /REPORTING_DB_SQLINSTANCE_USE_DEFAULT | Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER" | +| /REPORTING_DB_NAME | Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB" | +| /REPORTING_SERVER_MACHINE_USE_LOCAL | Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. | +| /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT | Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername" | +| /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT | Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias" | + +### Parameters for using an existing Management Server database + +| Parameter | Description | +|-----------|-------------| +| /EXISTING\_MANAGEMENT\_DB_SQL_SERVER_USE_LOCAL | Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. | +| /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME | Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME="mycomputer1" | +| /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. | +| /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that will be used. Example usage **/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE="AppVManagement"**. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. | +| /EXISTING_MANAGEMENT_DB_NAME | Specifies the name of the existing management database that should be used. Example usage: **/EXISTING_MANAGEMENT_DB_NAME="AppVMgmtDB"**. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. | + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Deploying the App-V Server](appv-deploying-the-appv-server.md) diff --git a/windows/manage/appv-deploy-the-appv-server.md b/windows/manage/appv-deploy-the-appv-server.md new file mode 100644 index 0000000000..2f9977d7b8 --- /dev/null +++ b/windows/manage/appv-deploy-the-appv-server.md @@ -0,0 +1,124 @@ +--- +title: How to Deploy the App-V Server (Windows 10) +description: How to Deploy the App-V Server in App-V for Windows 10 +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# How to Deploy the App-V Server (new installation) + +**Applies to** +- Windows Server 2016 + +>**Important**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. + +**Before you start:** + +- Ensure that you’ve installed required software. See [App-V Prerequisites](appv-prerequisites.md). + +- Review the server section of [App-V security considerations](appv-security-considerations.md). + +- Specify a port where each component will be hosted. + +- Add firewall rules to allow incoming requests to access the specified ports. + +- If you use SQL scripts, instead of the Windows Installer, to set up the Management database or Reporting database, you must run the SQL scripts before installing the Management Server or Reporting Server. See [How to Deploy the App-V Databases by Using SQL Scripts](appv-deploy-appv-databases-with-sql-scripts.md). + +**To install the App-V server** + +1. Download the App-V server components. All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from: + + - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215) You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site. + + - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home). + +2. Copy the App-V server installation files to the computer on which you want to install it. + +3. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. + +4. Review and accept the license terms, and choose whether to enable Microsoft updates. + +5. On the **Feature Selection** page, select all of the following components. + + | Component | Description | + | - | - | + | Management server | Provides overall management functionality for the App-V infrastructure. | + | Management database | Facilitates database predeployments for App-V management. | + | Publishing server | Provides hosting and streaming functionality for virtual applications. | + | Reporting server | Provides App-V reporting services. | + | Reporting database | Facilitates database predeployments for App-V reporting. | + +6. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line. + +7. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below. + + | Method | What you need to do | + | - | - | + | You are using a custom Microsoft SQL Server instance. | Select **Use the custom instance**, and type the name of the instance.
    Use the format **INSTANCENAME**. The assumed installation location is the local computer.
    Not supported: A server name using the format **ServerName**\\**INSTANCE**.| + | You are using a custom database name. | Select **Custom configuration** and type the database name.
    The database name must be unique, or the installation will fail.| + +8. On the **Configure** page, accept the default value **Use this local computer**. + + >**Note** If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. + +9. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. + + | Method | What you need to do | + | - | - | + | You are using a custom Microsoft SQL Server instance. | Select **Use the custom instance**, and type the name of the instance.
    Use the format **INSTANCENAME**. The assumed installation location is the local computer.
    Not supported: A server name using the format **ServerName**\\**INSTANCE**.| + | You are using a custom database name. | Select **Custom configuration** and type the database name.
    The database name must be unique, or the installation will fail.| + + +10. On the **Configure** page, accept the default value: **Use this local computer**. + + >**Note** + > If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. + + +11. On the **Configure** (Management Server Configuration) page, specify the following: + + | Item to configure | Description and examples | + | - | - | + | Type the AD group with sufficient permissions to manage the App-V environment. | Example: MyDomain\MyUser

    After installation, you can add users or groups on the management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups to perform this action.| + | **Website name**: Specify the custom name that will be used to run the publishing service.
    | If you do not have a custom name, do not make any changes.| + |**Port binding**: Specify a unique port number that will be used by App-V. | Example: **12345**
    Ensure that the port specified is not being used by another website. | + +12. On the **Configure Publishing Server Configuration** page, specify the following: + + | Item to configure | Description and examples | + | - | - | + | Specify the URL for the management service. | Example: http://localhost:12345 | + | **Website name**: Specify the custom name that will be used to run the publishing service.| If you do not have a custom name, do not make any changes. | + | **Port binding**: Specify a unique port number that will be used by App-V. | Example: 54321
    Ensure that the port specified is not being used by another website. | + +13. On the **Reporting Server** page, specify the following: + + | Item to configure | Description and examples | + | - | - | + | **Website name**: Specify the custom name that will be used to run the Reporting Service. | If you do not have a custom name, do not make any changes. | + | **Port binding**: Specify a unique port number that will be used by App-V. | Example: 55555
    Ensure that the port specified is not being used by another website. | + +14. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. + +15. To verify that the setup completed successfully, open a web browser, and type the following URL: + + **http://\<_Management server machine name_\>:\<_Management service port number_\>/console.html**. + + Example: **http://localhost:12345/console.html**. If the installation succeeded, the App-V Management console is displayed with no errors. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +- [Deploying App-V](appv-deploying-appv.md) + +- [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md) + +- [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md) + +- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) diff --git a/windows/manage/appv-deploying-appv.md b/windows/manage/appv-deploying-appv.md new file mode 100644 index 0000000000..53ad22d7a7 --- /dev/null +++ b/windows/manage/appv-deploying-appv.md @@ -0,0 +1,50 @@ +--- +title: Deploying App-V (Windows 10) +description: Deploying App-V +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# Deploying App-V for Windows 10 + +**Applies to** +- Windows 10, version 1607 + +App-V supports a number of different deployment options. Review this topic for information about the tasks that you must complete at different stages in your deployment. + +## App-V Deployment Information + + +- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) + + This section describes how to install the App-V sequencer, which is used to virtualize applications, and how to enable the App-V client, which runs on target computers to facilitate virtualized packages. + +- [Deploying the App-V Server](appv-deploying-the-appv-server.md) + + This section provides information about installing the App-V management, publishing, database and reporting severs. + +- [App-V Deployment Checklist](appv-deployment-checklist.md) + + This section provides a deployment checklist that can be used to assist with installing App-V. + +## Other Resources for Deploying App-V + + +- [Application Virtualization (App-V) overview](appv-for-windows.md) + +- [Getting Started with App-V](appv-getting-started.md) + +- [Planning for App-V](appv-planning-for-appv.md) + +- [Operations for App-V](appv-operations.md) + +- [Troubleshooting App-V](appv-troubleshooting.md) + +- [Technical Reference for App-V](appv-technical-reference.md) + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md new file mode 100644 index 0000000000..dcf42974b4 --- /dev/null +++ b/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md @@ -0,0 +1,295 @@ +--- +title: Deploying Microsoft Office 2010 by Using App-V (Windows 10) +description: Deploying Microsoft Office 2010 by Using App-V +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Deploying Microsoft Office 2010 by Using App-V + +**Applies to** +- Windows 10, version 1607 + +You can create Office 2010 packages for Microsoft Application Virtualization (App-V) using one of the following methods: + +- Application Virtualization (App-V) Sequencer + +- Application Virtualization (App-V) Package Accelerator + +## App-V support for Office 2010 + + +The following table shows the App-V versions, methods of Office package creation, supported licensing, and supported deployments for Office 2010. + + ++++ + + + + + + + + + + + + + + + + + + + + +
    Supported itemLevel of support

    Package creation

      +

    • Sequencing

      • +

    • Package Accelerator

      • +

    • Office Deployment Kit

      • +

    Supported licensing

    Volume Licensing

    Supported deployments

      +

    • Desktop

      • +

    • Personal VDI

      • +

    • RDS

      • +
    + +  + +## Creating Office 2010 App-V using the sequencer + + +Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V. Microsoft has provided a detailed recipe through a Knowledge Base article. To create an Office 2010 package on App-V, refer to the following link for detailed instructions: + +[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069) + +## Creating Office 2010 App-V packages using package accelerators + + +Office 2010 App-V packages can be created through package accelerators. Microsoft has provided package accelerators for creating Office 2010 on Windows 10, Windows 8 and Windows 7. To create Office 2010 packages on App-V using Package accelerators, refer to the following pages to access the appropriate package accelerator: + +- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](https://gallery.technet.microsoft.com/App-V-50-Package-a29410db) + +- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](https://gallery.technet.microsoft.com/App-V-50-Package-e7ef536b) + +For detailed instructions on how to create virtual application packages using App-V package accelerators, see [How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md). + +## Deploying the Microsoft Office package for App-V + + +You can deploy Office 2010 packages by using any of the following App-V deployment methods: + +- System Center Configuration Manager + +- App-V server + +- Stand-alone through Windows PowerShell commands + +## Office App-V package management and customization + + +Office 2010 packages can be managed like any other App-V packages through known package management mechanisms. No special instructions are needed, for example, to add, publish, unpublish, or remove Office packages. + +## Microsoft Office integration with Windows + + +The following table provides a full list of supported integration points for Office 2010. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Extension PointDescriptionOffice 2010

    Lync meeting Join Plug-in for Firefox and Chrome

    User can join Lync meetings from Firefox and Chrome

    Sent to OneNote Print Driver

    User can print to OneNote

    Yes

    OneNote Linked Notes

    OneNote Linked Notes

    Send to OneNote Internet Explorer Add-In

    User can send to OneNote from IE

    Firewall Exception for Lync and Outlook

    Firewall Exception for Lync and Outlook

    MAPI Client

    Native apps and add-ins can interact with virtual Outlook through MAPI

    SharePoint Plugin for Firefox

    User can use SharePoint features in Firefox

    Mail Control Panel Applet

    User gets the mail control panel applet in Outlook

    Yes

    Primary Interop Assemblies

    Support managed add-ins

    Office Document Cache Handler

    Allows Document Cache for Office applications

    Outlook Protocol Search handler

    User can search in outlook

    Yes

    Active X Controls:

    For more information on ActiveX controls, refer to [ActiveX Control API Reference](https://msdn.microsoft.com/library/office/ms440037(v=office.14).aspx).

       Groove.SiteClient

    Active X Control

       PortalConnect.PersonalSite

    Active X Control

       SharePoint.openDocuments

    Active X Control

       SharePoint.ExportDatabase

    Active X Control

       SharePoint.SpreadSheetLauncher

    Active X Control

       SharePoint.StssyncHander

    Active X Control

       SharePoint.DragUploadCtl

    Active X Control

       SharePoint.DragDownloadCtl

    Active X Control

       Sharpoint.OpenXMLDocuments

    Active X Control

       Sharepoint.ClipboardCtl

    Active X control

       WinProj.Activator

    Active X Control

       Name.NameCtrl

    Active X Control

       STSUPld.CopyCtl

    Active X Control

       CommunicatorMeetingJoinAx.JoinManager

    Active X Control

       LISTNET.Listnet

    Active X Control

       OneDrive Pro Browser Helper

    Active X Control]

    OneDrive Pro Icon Overlays

    Windows explorer shell icon overlays when users look at folders OneDrive Pro folders

    + +  + +## Additional resources + + +**Office 2013 App-V Packages Additional Resources** + +[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://support.microsoft.com/en-us/kb/2772509) + +**Office 2010 App-V Packages** + +[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/en-us/download/details.aspx?id=38399) + +[Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/en-us/kb/2828619) + +[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069) + +**Connection Groups** + +[Managing Connection Groups](appv-managing-connection-groups.md) + +[Connection groups on the App-V team blog](https://blogs.technet.microsoft.com/gladiatormsft/tag/connection-groups/) + +**Dynamic Configuration** + +[About App-V Dynamic Configuration](appv-dynamic-configuration.md) + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md b/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md new file mode 100644 index 0000000000..90cdcd48d7 --- /dev/null +++ b/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md @@ -0,0 +1,780 @@ +--- +title: Deploying Microsoft Office 2013 by Using App-V (Windows 10) +description: Deploying Microsoft Office 2013 by Using App-V +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Deploying Microsoft Office 2013 by Using App-V + +**Applies to** +- Windows 10, version 1607 + +Use the information in this article to use Microsoft Application Virtualization (App-V), or later versions, to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md). To successfully deploy Office 2013 with App-V, you need to be familiar with Office 2013 and App-V. + +This topic contains the following sections: + +- [What to know before you start](#bkmk-before-you-start) + +- [Creating an Office 2013 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) + +- [Publishing the Office package for App-V](#bkmk-pub-pkg-office) + +- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) + +## What to know before you start + + +Before you deploy Office 2013 by using App-V, review the following planning information. + +### Supported Office versions and Office coexistence + +Use the following table to get information about supported versions of Office and about running coexisting versions of Office. + + ++++ + + + + + + + + + + + + + + + + +
    Information to reviewDescription

    [Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#bkmk-office-vers-supp-appv)

      +

    • Supported versions of Office

      • +

    • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

      • +

    • Office licensing options

      • +

    [Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#bkmk-plan-coexisting)

    Considerations for installing different versions of Office on the same computer

    + +  + +### Packaging, publishing, and deployment requirements + +Before you deploy Office by using App-V, review the following requirements. + + ++++ + + + + + + + + + + + + + + + + + + + + +
    TaskRequirement

    Packaging

      +

    • All of the Office applications that you want to deploy to users must be in a single package.

      • +

    • In App-V and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

      • +

    • If you are deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project).

      • +

    Publishing

      +

    • You can publish only one Office package to each client computer.

      • +

    • You must publish the Office package globally. You cannot publish to the user.

      • +

    Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

    +
      +

    • Office 365 ProPlus

      • +

    • Visio Pro for Office 365

      • +

    • Project Pro for Office 365

      • +

    You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx).

    +

    You don’t use shared computer activation if you’re deploying a volume licensed product, such as:

    +
      +

    • Office Professional Plus 2013

      • +

    • Visio Professional 2013

      • +

    • Project Professional 2013

      • +
    + +  + +### Excluding Office applications from a package + +The following table describes the recommended methods for excluding specific Office applications from a package. + + ++++ + + + + + + + + + + + + + + + + +
    TaskDetails

    Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

      +

    • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

      • +

    • For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#BKMK_ExcludeAppElement).

      • +

    Modify the DeploymentConfig.xml file

      +

    • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

      • +

    • For more information, see [Disabling Office 2013 applications](#bkmk-disable-office-apps).

      • +
    + +  + +## Creating an Office 2013 package for App-V with the Office Deployment Tool + + +Complete the following steps to create an Office 2013 package for App-V or later. + +**Important**   +In App-V and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. + +  + +### Review prerequisites for using the Office Deployment Tool + +The computer on which you are installing the Office Deployment Tool must have: + + ++++ + + + + + + + + + + + + + + + + +
    PrerequisiteDescription

    Prerequisite software

    .Net Framework 4

    Supported operating systems

      +

    • 64-bit version of Windows 8 or later

      • +

    • 64-bit version of Windows 7

      • +
    + +  + +**Note**   +In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing. + +  + +### Create Office 2013 App-V Packages Using Office Deployment Tool + +You create Office 2013 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2013 App-V package with Volume Licensing or Subscription Licensing. + +Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the Office 2013 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers. + +### Download the Office Deployment Tool + +Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: + +1. Download the [Office 2013 Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778). + +2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. + + Example: \\\\Server\\Office2013 + +3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. + +### Download Office 2013 applications + +After you download the Office Deployment Tool, you can use it to get the latest Office 2013 applications. After getting the Office applications, you create the Office 2013 App-V package. + +The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. + +1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: + + 1. Open the sample XML file in Notepad or your favorite text editor. + + 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following is a basic example of the configuration.xml file: + + ``` syntax + + + + + + + + + + + ``` + + **Note**
    + The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. + + The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. For more information, see [Customizable attributes and elements of the XML file](#customizable-attributes-and-elements-of-the-XML-file), later in this topic. + + After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. + +2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details: + + ``` syntax + \\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml + ``` + + In the example: + + + + + + + + + + + + + + + + + + + + + + + + +

    \\server\Office2013

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    setup.exe

    is the Office Deployment Tool.

    /download

    downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.

    \\server\Office2013\Customconfig.xml

    passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2013.

    + +#### Customizable attributes and elements of the XML file + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Input and descriptionExample

    Add element:
    Specifies the products and languages to include in the package.

    N/A

    OfficeClientEdition (attribute of Add element):
    Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

    OfficeClientEdition="32"

    +

    OfficeClientEdition="64"

    Product element:
    Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.

    Product ID ="O365ProPlusRetail "

    +

    Product ID ="VisioProRetail"

    +

    Product ID ="ProjectProRetail"

    +

    Product ID ="ProPlusVolume"

    +

    Product ID ="VisioProVolume"

    +

    Product ID = "ProjectProVolume"

    Language element:
    Specifies the language supported in the applications.

    Language ID="en-us"

    Version (attribute of Add element):
    Optional. Specifies a build to use for the package. Defaults to latest advertised build (as defined in v32.CAB at the Office source).

    15.1.2.3

    SourcePath (attribute of Add element):
    Specifies the location in which the applications will be saved to.

    Sourcepath = "\\Server\Office2013”

    + +   + +### Convert the Office applications into an App-V package + +After you download the Office 2013 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2013 App-V package. Complete the steps that correspond to your licensing model. + +**Summary of what you’ll need to do:** + +- Create the Office 2013 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8, and Windows 10 computers. + +- Create an Office App-V package for either Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. + + The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
    Product IDVolume LicensingSubscription Licensing

    Office 2013

    ProPlusVolume

    O365ProPlusRetail

    Office 2013 with Visio 2013

    ProPlusVolume

    +

    VisioProVolume

    O365ProPlusRetail

    +

    VisioProRetail

    Office 2013 with Visio 2013 and Project 2013

    ProPlusVolume

    +

    VisioProVolume

    +

    ProjectProVolume

    O365ProPlusRetail

    +

    VisioProRetail

    +

    ProjectProRetail

    + +#### How to convert the Office applications into an App-V package + +1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: + + - **SourcePath**: Point to the Office applications downloaded earlier. + + - **ProductID**: Specify the type of licensing, as shown in the following examples: + - Subscription Licensing: + ``` + + + + + + + + + + + ``` + In this example, the following changes were made to create a package with Subscription licensing: + + **SourcePath** is the path, which was changed to point to the Office applications that were downloaded earlier.
    + **Product ID** for Office was changed to `O365ProPlusRetail`.
    + **Product ID** for Visio was changed to `VisioProRetail`. + + - Volume Licensing + ``` + + + + + + + + + + + ``` + In this example, the following changes were made to create a package with Volume licensing: + + **SourcePath** is the path, which was changed to point to the Office applications that were downloaded earlier.
    + **Product ID** for Office was changed to `ProPlusVolume`.
    + **Product ID** for Visio was changed to `VisioProVolume`. + + - **ExcludeApp** (optional): Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath. + + - **PACKAGEGUID** (optional): By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server. + + An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users. + + **Note**  Even if you use unique package IDs, you can still deploy only one App-V package to a single device. + +2. Use the /packager command to convert the Office applications to an Office 2013 App-V package. + + For example: + + ``` syntax + \\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml \\server\share\Office2013AppV + ``` + + In the example: + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    \\server\Office2013

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    setup.exe

    is the Office Deployment Tool.

    /packager

    creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.

    \\server\Office2013\Customconfig.xml

    passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

    \\server\share\Office2013AppV

    specifies the location of the newly created Office App-V package.

    + + After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: + **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files.
    + **WorkingDir** + + **Note**  To troubleshoot any issues, see the log files in the %temp% directory (default). + +3. Verify that the Office 2013 App-V package works correctly: + + 1. Publish the Office 2013 App-V package, which you created globally, to a test computer, and verify that the Office 2013 shortcuts appear. + + 2. Start a few Office 2013 applications, such as Excel or Word, to ensure that your package is working as expected. + +## Publishing the Office package for App-V + + +Use the following information to publish an Office package. + +### Methods for publishing Office App-V packages + +Deploy the App-V package for Office 2013 by using the same methods you use for any other package: + +- System Center Configuration Manager + +- App-V Server + +- Stand-alone through Windows PowerShell commands + +### Publishing prerequisites and requirements + + ++++ + + + + + + + + + + + + + + + + +
    Prerequisite or requirementDetails

    Enable Windows PowerShell scripting on the App-V clients

    To publish Office 2013 packages, you must run a script.

    +

    Package scripts are disabled by default on App-V clients. To enable scripting, run the following Windows PowerShell command:

    +
    Set-AppvClientConfiguration –EnablePackageScripts 1

    Publish the Office 2013 package globally

    Extension points in the Office App-V package require installation at the computer level.

    +

    When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

    + +  + +### How to publish an Office package + +Run the following command to publish an Office package globally: + +- `Add-AppvClientPackage | Publish-AppvClientPackage –global` + +- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. + +## Customizing and managing Office App-V packages + + +To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. + +- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) + +- [Disabling Office 2013 applications](#bkmk-disable-office-apps) + +- [Disabling Office 2013 shortcuts](#bkmk-disable-shortcuts) + +- [Managing Office 2013 package upgrades](#bkmk-manage-office-pkg-upgrd) + +- [Managing Office 2013 licensing upgrades](#bkmk-manage-office-lic-upgrd) + +- [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project) + +### Enabling Office plug-ins by using connection groups + +Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. + +**To enable plug-ins for Office App-V packages** + +1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a Windows PowerShell cmdlet. + +2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. + +3. Create an App-V package that includes the desired plug-ins. + +4. Add a Connection Group through App-V server, System Center Configuration Manager, or a Windows PowerShell cmdlet. + +5. Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created. + + **Important**  The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2013 App-V package first, and then add the plug-in App-V package. + +6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2013 App-V package. + +7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2013 App-V package has. + + Since the Office 2013 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2013 App-V package you published. + +8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. + +9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. + +10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2013 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. + +11. After you successfully publish both packages and enable the Connection Group, start the target Office 2013 application and verify that the plug-in you published and added to the connection group works as expected. + +### Disabling Office 2013 applications + +You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2013 App-V package has been published, you will save the changes, add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. + +**Note**   +To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](http://technet.microsoft.com/library/jj219426.aspx). + +  + +**To disable an Office 2013 application** + +1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." + +2. Search for the Office application you want to disable, for example, Access 2013. + +3. Change the value of "Enabled" from "true" to "false." + +4. Save the Deployment Configuration File. + +5. Add the Office 2013 App-V Package with the new Deployment Configuration File. + + ``` syntax + + + InfoPath Filler 2013 + + + + + + + Lync 2013 + + + + + + + Access 2013 + + + + + ``` + +6. Re-add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. + +### Disabling Office 2013 shortcuts + +You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. + +**To disable shortcuts for Office 2013 applications** + +1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. + +2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. + + ``` syntax + Shortcuts + + --> + + + + + [{Common Programs}]\Microsoft Office 2013\Access 2013.lnk + [{AppvPackageRoot}])office15\MSACCESS.EXE + [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico + + + Microsoft.Office.MSACCESS.EXE.15 + true + Build a professional app quickly to manage data. + l + [{AppVPackageRoot}]\officel5\MSACCESS.EXE + + ``` + +3. Save the Deployment Configuration File. + +4. Republish Office 2013 App-V Package with new Deployment Configuration File. + +Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. + +### Managing Office 2013 package upgrades + +To upgrade an Office 2013 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2013 package, perform the following steps. + +**How to upgrade a previously deployed Office 2013 package** + +1. Create a new Office 2013 package through the Office Deployment Tool that uses the most recent Office 2013 application software. The most recent Office 2013 bits can always be obtained through the download stage of creating an Office 2013 App-V Package. The newly created Office 2013 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. + + **Note**   + Office App-V packages have two Version IDs: + + - An Office 2013 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. + + - A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2013 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2013 package. + +   + +2. Globally publish the newly created Office 2013 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2013 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. + +3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. + +### Managing Office 2013 licensing upgrades + +If a new Office 2013 App-V Package has a different license than the Office 2013 App-V Package currently deployed. For instance, the Office 2013 package deployed is a subscription based Office 2013 and the new Office 2013 package is Volume Licensing based, the following instructions must be followed to ensure smooth licensing upgrade: + +**How to upgrade an Office 2013 License** + +1. Unpublish the already deployed Office 2013 Subscription Licensing App-V package. + +2. Remove the unpublished Office 2013 Subscription Licensing App-V package. + +3. Restart the computer. + +4. Add the new Office 2013 App-V Package Volume Licensing. + +5. Publish the added Office 2013 App-V Package with Volume Licensing. + +An Office 2013 App-V Package with your chosen licensing will be successfully deployed. + +### Deploying Visio 2013 and Project 2013 with Office + +This section describes the requirements and options for deploying Visio 2013 and Project 2013 with Office. + +- **To package and publish Visio 2013 and Project 2013 with Office**: Include Visio 2013 and Project 2013 in the same package with Office. If you aren’t deploying Office, you can create a package that contains Visio and/or Project. + +- **To deploy Visio 2013 and Project 2013 to specific users**: Use one of the following methods: + + ++++ + + + + + + + + + + + + + + + + +
    GoalMethod

    Create two different packages and deploy each one to a different group of users

    Create and deploy the following packages:

    +
      +

    • A package that contains only Office - deploy to computers whose users need only Office.

      • +

    • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

      • +

    If you want only one package for the whole organization, or if you have users who share computers:

    Follows these steps:

    +
      +

    1. Create a package that contains Office, Visio, and Project.

      2. +

    2. Deploy the package to all users.

      3. +

    3. Use [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) to prevent specific users from using Visio and Project.

      4. +
    + +## Additional resources + + +**Office 2013 App-V Packages Additional Resources** + +[Office 2013 Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778) + +[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://support.microsoft.com/en-us/kb/2772509) + +**Office 2010 App-V Packages** + +[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/download/details.aspx?id=38399) + +[Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/en-us/kb/2828619) + +[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069) + +**Connection Groups** + +[Managing Connection Groups](appv-managing-connection-groups.md) + +[Connection groups on the App-V team blog](https://blogs.technet.microsoft.com/gladiatormsft/tag/connection-groups/) + +**Dynamic Configuration** + +[About App-V Dynamic Configuration](appv-dynamic-configuration.md) + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md new file mode 100644 index 0000000000..77314ded8e --- /dev/null +++ b/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md @@ -0,0 +1,54 @@ +--- +title: Deploying App-V Packages by Using Electronic Software Distribution (ESD) +description: Deploying App-V Packages by Using Electronic Software Distribution (ESD) +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Deploying App-V Packages by Using Electronic Software Distribution (ESD) + +**Applies to** +- Windows 10, version 1607 + +You can deploy App-V packages using an Electronic Software Distribution (ESD) solution. For information about planning to deploy App-V packages with an ESD, see [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md). + +To deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to Application Management in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682125.aspx#BKMK_Appv) + +## How to deploy virtualized packages using an ESD + + +Describes the methods you can use to deploy App-V packages by using an ESD. + +[How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md) + +## How to Enable Only Administrators to Publish Packages by Using an ESD + + +Explains how to configure the App-V client to enable only administrators to publish and unpublish packages when you’re using an ESD. + +[How to Enable Only Administrators to Publish Packages by Using an ESD](appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md) + +## Have a suggestion for App-V? + + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Other resources for using an ESD and App-V + + +Use the following link for more information about [App-V and Citrix Integration](https://www.microsoft.com/en-us/download/details.aspx?id=40885). + +[Operations for App-V](appv-operations.md) + +  + +  + + + + + diff --git a/windows/manage/appv-deploying-the-appv-sequencer-and-client.md b/windows/manage/appv-deploying-the-appv-sequencer-and-client.md new file mode 100644 index 0000000000..ca8397a1fe --- /dev/null +++ b/windows/manage/appv-deploying-the-appv-sequencer-and-client.md @@ -0,0 +1,96 @@ +--- +title: Deploying the App-V Sequencer and Configuring the Client (Windows 10) +description: Deploying the App-V Sequencer and Configuring the Client +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Deploying the App-V Sequencer and Configuring the Client + +**Applies to** +- Windows 10, version 1607 + +The App-V Sequencer and client enable administrators to virtualize and run virtualized applications. + +## Enable the client + +The App-V client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and to double-click file types, so that they can start a virtualized application. The client can also obtain the virtual application content from the management server. + +> [!NOTE] +> In Windows 10, version 1607, App-V is included with the operating system. You only need to enable it. + +[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) + +## Client Configuration Settings + +The App-V client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. For information about client settings that you can configure through Windows PowerShell or through the registry, see [About Client Configuration Settings](appv-client-configuration-settings.md). + +## Configure the client by using the ADMX template and Group Policy + +You can use Group Policy to configure the client settings for the App-V client and the Remote Desktop Services client. + +To manage the ADMX template, perform the following steps on the computer that you will use to manage Group Policy. This is typically the Domain Controller. + +1. Save the **.admx** file to the following directory: **Windows \\ PolicyDefinitions** + +2. Save the **.adml** file to the following directory: **Windows \\ PolicyDefinitions \\ ** + +After you have completed the preceding steps, you can use Group Policy to configure the client settings by using the Group Policy Management Console under **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. + +## Understanding Shared Content Store mode for App-V clients + +The App-V Shared Content Store (SCS) mode enables the SCS App-V clients to run virtualized applications without saving any of the associated package data locally. All required virtualized package data is transmitted across the network; therefore, you should only use the SCS mode in environments with a fast connection. Both the Remote Desktop Services (RDS) and the standard version of the App-V client are supported with SCS mode. + +> [!IMPORTANT] +> If the App-V client is configured to run in the SCS mode, the location where the App-V packages are streamed from must be available, otherwise, the virtualized package will fail. Additionally, we do not recommend deployment of virtualized applications to computers that run the App-V client in the SCS mode across the internet. + +Additionally, the SCS is not a physical location that contains virtualized packages. It is a mode that allows the App-V client to stream the required virtualized package data across the network. + +The SCS mode is helpful in the following scenarios: + +- Virtual desktop infrastructure (VDI) deployments + +- Remote Desktop Services deployments + +To use SCS in your environment, you must configure the App-V client to run in SCS mode (it will not use SCS mode by default). + +There might be cases when the administrator pre-loads some virtual applications on the computer that runs the App-V client in SCS mode. This can be accomplished with Windows PowerShell commands to add, publish, and mount the package. For example, if a package is pre-loaded on all computers, the administrator could add, publish, and mount the package by using Windows PowerShell commands. The package would not stream across the network because it would be locally stored. + +### Configure the Group Policy setting for the SCS Mode for App-V clients + +Use the following steps to locate and configure the Group Policy setting for the SCS Mode for App-V clients. + +1. In the Group Policy Management Console, navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V** > **Streaming**. + +2. Enable the **Set the Shared Content Mode (SCS) mode** setting. + +### Configure an individual client to use the SCS mode + +To configure the App-V client to run in SCS mode, on the client, enter the following Windows PowerShell command: + +``` +Set-AppvClientConfiguration -SharedContentStoreMode 1 +``` + +## Deploy the Sequencer + +The Sequencer is a tool that is used to convert standard applications into virtual packages for deployment to computers that run the App-V client. The Sequencer helps provide a simple and predictable conversion process with minimal changes to prior sequencing workflows. In addition, the Sequencer allows users to more easily configure applications to enable connections of virtualized applications. + +For a list of changes in the App-V Sequencer, see [What's new in App-V](appv-about-appv.md#bkmk-seqimprove). + +To deploy the sequencer, see [How to Install the Sequencer](appv-install-the-sequencer.md). + +## App-V Client and Sequencer logs + + +You can use the App-V Sequencer log information to help troubleshoot the Sequencer installation and operational events while using App-V. The Sequencer-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Sequencer-related events: + +**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V**. Sequencer-related events are prepended with **AppV\_Sequencer**. Client-related events are prepended with **AppV\_Client**. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-deploying-the-appv-server.md b/windows/manage/appv-deploying-the-appv-server.md new file mode 100644 index 0000000000..7cfca2fe26 --- /dev/null +++ b/windows/manage/appv-deploying-the-appv-server.md @@ -0,0 +1,112 @@ +--- +title: Deploying the App-V Server (Windows 10) +description: Deploying the App-V Server in App-V for Windows 10 +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# Deploying the App-V server + +**Applies to** +- Windows Server 2016 + +>**Note**
    If you plan to use the App-V server components in your deployment, note that they reference App-V 5.x. This is because the App-V server components have not changed in App-V for Windows 10. + +You can install the Application Virtualization (App-V) server components using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md). + +For information about deploying App-V for Windows 10, see [What's new in App-V](appv-about-appv.md). + +>**Important**
    Before you install and configure the App-V servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. + +## Download and install App-V server components + +>**Note**
    +If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. + +App-V offers the following five server components, each of which serves a specific purpose in an App-V environment. + +- **Management server.** Use the App-V management server and console to manage your App-V infrastructure. See [Administering App-V with the management console](appv-administering-virtual-applications-with-the-management-console.md) for more information about the management server. + + >**Note**
    If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you may want to take advantage of the reporting and streaming capabilities in App-V. + +- **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) for more information about the management database. + +- **Publishing server.** Use the App-V publishing server to host and stream virtual applications. The publishing server supports the HTTP and HTTPS protocols and does not require a database connection. See [How to install the App-V publishing server](appv-install-the-publishing-server-on-a-remote-computer.md) for more information about configuring the publishing server. + +- **Reporting server.** Use the App-V reporting server to generate reports that help you manage your App-V infrastructure. The reporting server requires a connection to the reporting database. See [About App-V reporting](appv-reporting.md) for more information about the reporting capabilities in App-V. + +- **Reporting database.** Use the App-V reporting database to facilitate database pre-deployments for App-V reporting. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) for more information about the reporting database. + +All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from: + +- The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215) You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site. + +- The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home). + +In large organizations, you might want to install more than one instance of the server components to get: + +- Fault tolerance for situations when one of the servers is unavailable. + +- High availability to balance server requests. We recommend using a network load balancer to achieve this. + +- Scalability to support a high load. For example, you can install additional servers behind a network load balancer. + +## App-V standalone deployment +The App-V standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are installed on a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V components. Therefore, you should not use this strategy for larger deployments. + +- [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) + +- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) + +## App-V Server distributed deployment +The distributed deployment topology can support a large App-V client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V server components are deployed across multiple computers, based on the structure and requirements of the organization. + +- [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md) + +- [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md) + +- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) + +- [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md) + +- [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md) + +## Using an Enterprise Software Distribution (ESD) solution and App-V +You can also deploy packages by using an ESD. The full capabilities for integration will vary depending on the ESD that you use. + +>**Note**
    The App-V reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality. + +[Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) + +## App-V Server logs +You can use App-V server log information to help troubleshoot the server installation and operational events while using App-V. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events: + +**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V** + +Associated setup logs are saved in the following directory: + +**%temp%** + +## App-V reporting +App-V reporting allows App-V clients to collect data and then send it back to be stored in a central repository. You can use this information to get a better view of the virtual application usage within your organization. The following list displays some of the types of information the App-V client collects: + +- Information about the computer that runs the App-V client. + +- Information about virtualized packages on a specific computer that runs the App-V client. + +- Information about package open and shutdown for a specific user. + +The reporting information will be maintained until it is successfully sent to the reporting server database. After the data is in the database, you can use Microsoft SQL Server Reporting Services to generate any necessary reports. + +If you want to retrieve report information, you must use Microsoft SQL Server Reporting Services (SSRS) which is available with Microsoft SQL. SSRS is not installed when you install the App-V reporting server and it must be deployed separately to generate the associated reports. + +For more information, see [About App-V Reporting](appv-reporting.md) and [How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md). + +## Other resources for the App-V server +- [Deploying App-V](appv-deploying-appv.md) + +## Have a suggestion for App-V? +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file diff --git a/windows/manage/appv-deployment-checklist.md b/windows/manage/appv-deployment-checklist.md new file mode 100644 index 0000000000..cf1f4cf23e --- /dev/null +++ b/windows/manage/appv-deployment-checklist.md @@ -0,0 +1,78 @@ +--- +title: App-V Deployment Checklist (Windows 10) +description: App-V Deployment Checklist +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# App-V Deployment Checklist + +**Applies to** +- Windows 10, version 1607 + +This checklist can be used to help you during an App-V deployment. + +>**Note**
    +This checklist outlines the recommended steps and items to consider when deploying App-V features. We recommend that you copy this checklist into a spreadsheet program and customize it for your use. + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    TaskReferencesNotes
    Checklist box

    Complete the planning phase to prepare the computing environment for App-V deployment.

    [App-V Planning Checklist](appv-planning-checklist.md)

    Checklist box

    Review the App-V supported configurations information.

    [App-V Supported Configurations](appv-supported-configurations.md)

    Checklist box

    Run App-V Setup to deploy the required App-V features for your environment.

    +
    +Note   +

    Keep track of the names of the servers and associated URLs created during installation. This information will be used throughout the installation process.

    +
    +
    +  +

    +
      +

    • [How to Install the Sequencer](appv-install-the-sequencer.md)

      • +

    • [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)

      • +

    • [How to Deploy the App-V Server](appv-deploy-the-appv-server.md)

      • +

    + +## Have a suggestion for App-V? + + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Deploying App-V](appv-deploying-appv.md) diff --git a/windows/manage/appv-dynamic-configuration.md b/windows/manage/appv-dynamic-configuration.md new file mode 100644 index 0000000000..410da69b63 --- /dev/null +++ b/windows/manage/appv-dynamic-configuration.md @@ -0,0 +1,745 @@ +--- +title: About App-V Dynamic Configuration (Windows 10) +description: About App-V Dynamic Configuration +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# About App-V Dynamic Configuration + +**Applies to** +- Windows 10, version 1607 + +You can use the dynamic configuration to customize an App-V package for a user. Use the following information to create or edit an existing dynamic configuration file. + +When you edit the dynamic configuration file it customizes how an App-V package will run for a user or group. This helps to provide a more convenient method for package customization by removing the need to re-sequence packages using the desired settings, and provides a way to keep package content and custom settings independent. + +## Advanced: Dynamic Configuration + + +Virtual application packages contain a manifest that provides all the core information for the package. This information includes the defaults for the package settings and determines settings in the most basic form (with no additional customization). If you want to adjust these defaults for a particular user or group, you can create and edit the following files: + +- User Configuration file + +- Deployment configuration file + +The previous .xml files specify package settings and allow for packages to be customized without directly affecting the packages. When a package is created, the sequencer automatically generates default deployment and user configuration .xml files using the package manifest data. Therefore, these automatically generated configuration files simply reflect the default settings that the package innately as from how things were configured during sequencing. If you apply these configuration files to a package in the form generated by the sequencer, the packages will have the same default settings that came from their manifest. This provides you with a package-specific template to get started if any of the defaults must be changed. + +**Note**   +The following information can only be used to modify sequencer generated configuration files to customize packages to meet specific user or group requirements. + +  + +### Dynamic Configuration file contents + +All of the additions, deletions, and updates in the configuration files need to be made in relation to the default values specified by the package's manifest information. Review the following table: + + +++ + + + + + + + + + + + +

    User Configuration .xml file

    Deployment Configuration .xml file

    Package Manifest

    + +  + +The previous table represents how the files will be read. The first entry represents what will be read last, therefore, its content takes precedence. Therefore, all packages inherently contain and provide default settings from the package manifest. If a deployment configuration .xml file with customized settings is applied, it will override the package manifest defaults. If a user configuration .xml file with customized settings is applied prior to that, it will override both the deployment configuration and the package manifest defaults. + +The following list displays more information about the two file types: + +- **User Configuration File (UserConfig)** – Allows you to specify or modify custom settings for a package. These settings will be applied for a specific user when the package is deployed to a computer running the App-V client. + +- **Deployment Configuration File (DeploymentConfig)** – Allows you to specify or modify the default settings for a package. These settings will be applied for all users when a package is deployed to a computer running the App-V client. + +To customize the settings for a package for a specific set of users on a computer or to make changes that will be applied to local user locations such as HKCU, the UserConfig file should be used. To modify the default settings of a package for all users on a machine or to make changes that will be applied to global locations such as HKEY\_LOCAL\_MACHINE and the all users folder, the DeploymentConfig file should be used. + +The UserConfig file provides configuration settings that can be applied to a single user without affecting any other users on a client: + +- Extensions that will be integrated into the native system per user:- shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients and COM + +- Virtual Subsystems:- Application Objects, Environment variables, Registry modifications, Services and Fonts + +- Scripts (User context only) + +The DeploymentConfig file provides configuration settings in two sections, one relative to the machine context and one relative to the user context providing the same capabilities listed in the UserConfig list above: + +- All UserConfig settings above + +- Extensions that can only be applied globally for all users + +- Virtual Subsystems that can be configured for global machine locations e.g. registry + +- Product Source URL + +- Scripts (Machine context only) + +- Controls to Terminate Child Processes + +### File structure + +The structure of the App-V Dynamic Configuration file is explained in the following section. + +### Dynamic User Configuration file + +**Header** - the header of a dynamic user configuration file is as follows: + +``` + + +``` + +The **PackageId** is the same value as exists in the Manifest file. + +**Body** - the body of the Dynamic User Configuration file can include all the app extension points that are defined in the Manifest file, as well as information to configure virtual applications. There are four subsections allowed in the body: + +**Applications** - All app-extensions that are contained in the Manifest file within a package are assigned with an Application ID, which is also defined in the manifest file. This allows you to enable or disable all the extensions for a given application within a package. The **Application ID** must exist in the Manifest file or it will be ignored. + +``` + + + + + + + … + +``` + +**Subsystems** - AppExtensions and other subsystems are arranged as subnodes under the : + +``` + + + .. + + .. + +``` + +Each subsystem can be enabled/disabled using the “**Enabled**” attribute. Below are the various subsystems and usage samples. + +**Extensions:** + +Some subsystems (Extension Subsystems) control Extensions. Those subsystems are:- shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients and COM + +Extension Subsystems can be enabled and disabled independently of the content.  Thus if Shortcuts are enabled, The client will use the shortcuts contained within the manifest by default. Each Extension Subsystem can contain an node. If this child element is present, the client will ignore the content in the Manifest file for that subsystem and only use the content in the configuration file. + +Example using the shortcuts subsystem: + +**Example 1**
    If the user defined this in either the dynamic or deployment config file: + +``` +                               +                                           +                                   +``` + +Content in the manifest will be ignored.    + +**Example 2**
    If the user defined only the following: + +                             `` + +Then the content in the Manifest will be integrated during publishing. + +**Example 3**
    If the user defines the following + +``` +                            +                                           +                               +``` + +Then all the shortcuts within the manifest will still be ignored. There will be no shortcuts integrated. + +The supported Extension Subsystems are: + +**Shortcuts:** This controls shortcuts that will be integrated into the local system. Below is a sample with 2 shortcuts: + +``` + + +   +     +       +         \[{Common Programs}\]\\Microsoft Contoso\\Microsoft ContosoApp Filler 2010.lnk +         \[{PackageRoot}\]\\Contoso\\ContosoApp.EXE +         \[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\inficon.exe +          +          +         ContosoApp.Filler.3 +         Fill out dynamic forms to gather and reuse information throughout the organization using Microsoft ContosoApp. +         0 +         1 +         \[{PackageRoot}\]\\Contoso\\ContosoApp.EXE +        +   +   +      +       \[{AppData}\]\\Microsoft\\Contoso\\Recent\\Templates.LNK +       \[{AppData}\]\\Microsoft\\Templates +        +        +        +        +        +       0 +       1 +        +      +   +   + +``` + +**File-Type Associations:** Associates File-types with programs to open by default as well as setup the context menu. (MIME types can also be setup using this susbsystem). Sample File-type Association is below: + +``` + + + + + + .docm + contosowordpad.DocumentMacroEnabled.12 + document + application/vnd.ms-contosowordpad.document.macroEnabled.12 + + wincontosowordpad.exe + + + contosowordpad.8 + + + + + + + true + + + + + + + + contosowordpad.DocumentMacroEnabled.12 + \[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\contosowordpadicon.exe,15 + Blah Blah Blah + \[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,9182 + \[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,1424 + 0 + + Open + + {e56fa627-c35f-4a01-9e79-7d36aed8225a} + Edit + &Edit + "\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /vu "%1" + + + {e56fa627-c35f-4a01-9e79-7d36aed8225a} + Open + &Open + "\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /n "%1" + + + mscontosowordpad + ShellSystem + \[SHELLNOOP\] + \[SetForeground\]\[ShellNewDatabase "%1"\] + + + + + + + + +``` + +**URL Protocols**: This controls the URL Protocols that are integrated into the local registry of the client machine e.g. “mailto:”. + +``` + + + + +   mailto +    +   \[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE,-9403 +   2 +   +   +   +   + +   +   +   2 +   +    +   open +    +   \[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE +   open +   \[{ProgramFilesX86}\\Microsoft Contoso\\Contoso\\contosomail.EXE" -c OEP.Note /m "%1" +   +   +   0 +   0 +   2 +     +   +   contosomail +   ShellSystem +   \[SHELLNOOP\] +   \[SetForeground\]\[ShellNewDatabase "%1"\] +   +   +   +   +   +   +   +   +``` + +**Software Clients**: Allows the app to register as an Email client, news reader, media player and makes the app visible in the Set Program Access and Computer Defaults UI. In most cases you should only need to enable and disable it. There is also a control to enable and disable the email client specifically if you want the other clients still enabled except for that client. + +``` + +   + +``` + +**AppPaths**: If an application for example contoso.exe is registered with an apppath name of “myapp”, it allows you type “myapp” under the run menu and it will open contoso.exe. + +``` + + + + +   \[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE +   contosomail.exe +   \[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE +   +   false +   + + + + +``` + +**COM**: Allows an Application register Local COM servers. Mode can be Integration, Isolated or Off. When Isol. + +` ` + +**Other Settings**: + +In addition to Extensions, other subsystems can be enabled/disabled and edited: + +**Virtual Kernel Objects**: + +` ` + +**Virtual Registry**: Used if you want to set a registry in the Virtual Registry within HKCU + +``` + + + + +   +   +   + +   +``` + +**Virtual File System** + +`       ` + +**Virtual Fonts** + +`       ` + +**Virtual Environment Variables** + +``` + + +         +         +         +        +         +          +          +``` + +**Virtual services** + +`       ` + +**UserScripts** – Scripts can be used to setup or alter the virtual environment as well as execute scripts at time of deployment or removal, before an application executes, or they can be used to “clean up” the environment after the application terminates. Please reference a sample User configuration file that is output by the sequencer to see a sample script. The Scripts section below provides more information on the various triggers that can be used. + +### Dynamic Deployment Configuration file + +**Header** - The header of a Deployment Configuration file is as follows: + +``` + +``` + +The **PackageId** is the same value as exists in the manifest file. + +**Body** - The body of the deployment configuration file includes two sections: + +- User Configuration section –allows the same content as the User Configuration file described in the previous section. When the package is published to a user, any appextensions configuration settings in this section will override corresponding settings in the Manifest within the package unless a user configuration file is also provided. If a UserConfig file is also provided, it will be used instead of the User settings in the deployment configuration file. If the package is published globally, then only the contents of the deployment configuration file will be used in combination with the manifest. + +- Machine Configuration section–contains information that can be configured only for an entire machine, not for a specific user on the machine. For example, HKEY\_LOCAL\_MACHINE registry keys in the VFS. + +``` + + +  .. + + +.. + +.. +     + +``` + +**User Configuration** - use the previous **Dynamic User Configuration file** section for information on settings that are provided in the user configuration section of the Deployment Configuration file. + +Machine Configuration - the Machine configuration section of the Deployment Configuration File is used to configure information that can be set only for an entire machine, not for a specific user on the computer. For example, HKEY\_LOCAL\_MACHINE registry keys in the Virtual Registry. There are four subsections allowed in under this element + +1. **Subsystems** - AppExtensions and other subsystems are arranged as subnodes under : + +``` + +   +   .. +   + .. + +``` + +The following section displays the various subsystems and usage samples. + +**Extensions**: + +Some subsystems (Extension Subsystems) control Extensions which can only apply to all users. The subsystem is application capabilities. Because this can only apply to all users, the package must be published globally in order for this type of extension to be integrated into the local system. The same rules for controls and settings that apply to the Extensions in the User Configuration also apply to those in the MachineConfiguration section. + +**Application Capabilities**: Used by default programs in windows operating system Interface. Allows an application to register itself as capable of opening certain file extensions, as a contender for the start menu internet browser slot, as capable of opening certain windows MIME types.  This extension also makes the virtual application visible in the Set Default Programs UI.: + +``` + +   +     +      +      \[{PackageRoot}\]\\LitView\\LitViewBrowser.exe +       +       LitView Browser +       SOFTWARE\\LitView\\Browser\\Capabilities +       +     +      +      @\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12345 +      @\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12346 +      0 +      Lit View E-Mail Client +       +        +        +        +       +       +        +        +       +      +        +       +       +    +     +   + + +``` + +**Other Settings**: + +In addition to Extensions, other subsystems can be edited: + +**Machine Wide Virtual Registry**: Used when you want to set a registry key in the virtual registry within HKEY\_Local\_Machine + +``` + + +   +      +     +   +   + + +``` + +**Machine Wide Virtual Kernel Objects** + +``` + + +     +   + +``` + +**ProductSourceURLOptOut**: Indicates whether the URL for the package can be modified globally through PackageSourceRoot (to support branch office scenarios). Default is false and the setting change takes effect on the next launch. + +``` + +   ..  +    +   .. + +``` + +**MachineScripts** – Package can be configured to execute scripts at time of deployment, publishing or removal. Please reference a sample deployment configuration file that is generated by the sequencer to see a sample script. The Scripts section below provides more information on the various triggers that can be used + +**TerminateChildProcess**:- An application executable can be specified, whose child processes will be terminated when the application exe process is terminated. + +``` + +   ..    +    +      +      +      +    +   .. + +``` + +### Scripts + +The following table describes the various script events and the context under which they can be run. + + ++++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Script Execution TimeCan be specified in Deployment ConfigurationCan be specified in User ConfigurationCan run in the Virtual Environment of the packageCan be run in the context of a specific applicationRuns in system/user context: (Deployment Configuration, User Configuration)

    AddPackage

    X

    (SYSTEM, N/A)

    PublishPackage

    X

    X

    (SYSTEM, User)

    UnpublishPackage

    X

    X

    (SYSTEM, User)

    RemovePackage

    X

    (SYSTEM, N/A)

    StartProcess

    X

    X

    X

    X

    (User, User)

    ExitProcess

    X

    X

    X

    (User, User)

    StartVirtualEnvironment

    X

    X

    X

    (User, User)

    TerminateVirtualEnvironment

    X

    X

    (User, User)

    + +  + +### Using multiple scripts on a single event trigger + +App-V supports the use of multiple scripts on a single event trigger for App-V packages, including packages that you convert from App-V 4.6 to App-V for Windows 10. To enable the use of multiple scripts, App-V uses a script launcher application, named ScriptRunner.exe, which is included in the App-V client. + +**How to use multiple scripts on a single event trigger:** + +For each script that you want to run, pass that script as an argument to the ScriptRunner.exe application. The application then runs each script separately, along with the arguments that you specify for each script. Use only one script (ScriptRunner.exe) per trigger. + +**Note**   +We recommended that you run the multi-script line from a command prompt first to make sure that all arguments are built correctly before adding them to the deployment configuration file. + +  + +**Example script and parameter descriptions** + +Using the following example file and table, modify the deployment or user configuration file to add the scripts that you want to run. + +``` syntax + + + ScriptRunner.exe + + -appvscript script1.exe arg1 arg2 –appvscriptrunnerparameters –wait –timeout=10 + -appvscript script2.vbs arg1 arg2 + -appvscript script3.bat arg1 arg2 –appvscriptrunnerparameters –wait –timeout=30 –rollbackonerror + + + + +``` + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
    Parameter in the example fileDescription

    Name of the event trigger for which you are running a script, such as adding a package or publishing a package.

    ScriptRunner.exe

    The script launcher application that is included in the App-V client.

    +
    +Note   +

    Although ScriptRunner.exe is included in the App-V client, the location of the App-V client must be in %path% or ScriptRunner will not run. ScriptRunner.exe is typically located in the C:\Program Files\Microsoft Application Virtualization\Client folder.

    +
    +
    +  +
    
+-appvscript script1.exe arg1 arg2 –appvscriptrunnerparameters –wait –timeout=10
+
+-appvscript script2.vbs arg1 arg2
+
+-appvscript script3.bat arg1 arg2 –appvscriptrunnerparameters –wait –timeout=30 -rollbackonerror
+

    -appvscript - Token that represents the actual script that you want to run.

    +

    script1.exe – Name of the script that you want to run.

    +

    arg1 arg2 – Arguments for the script that you want to run.

    +

    -appvscriptrunnerparameters – Token that represents the execution options for script1.exe

    +

    -wait – Token that informs ScriptRunner to wait for execution of script1.exe to complete before proceeding to the next script.

    +

    -timeout=x – Token that informs ScriptRunner to stop running the current script after x number of seconds. All other specified scripts will still run.

    +

    -rollbackonerror – Token that informs ScriptRunner to stop running all scripts that haven't yet run and to roll back an error to the App-V client.

    Waits for overall completion of ScriptRunner.exe.

    +

    Set the timeout value for the overall runner to be greater than or equal to the sum of the timeout values on the individual scripts.

    +

    If any individual script reported an error and rollbackonerror was set to true, then ScriptRunner would report the error to App-V client.

    + +  + +ScriptRunner will run any script whose file type is associated with an application installed on the computer. If the associated application is missing, or the script’s file type is not associated with any application on the computer, the script will not run. + +### Create a Dynamic Configuration file using an App-V Manifest file + +You can create the Dynamic Configuration file using one of three methods: either manually, using the App-V Management Console or sequencing a package, which will be generated with 2 sample files. + +For more information about how to create the file using the App-V Management Console see, [How to Create a Custom Configuration File by Using the App-V Management Console](appv-create-a-custom-configuration-file-with-the-management-console.md). + +To create the file manually, the information above in previous sections can be combined into a single file. We recommend you use files generated by the sequencer. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) + +[How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md b/windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md new file mode 100644 index 0000000000..bdf05bd7cd --- /dev/null +++ b/windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md @@ -0,0 +1,31 @@ +--- +title: How to Enable Only Administrators to Publish Packages by Using an ESD (Windows 10) +description: How to Enable Only Administrators to Publish Packages by Using an ESD +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Enable Only Administrators to Publish Packages by Using an ESD + +**Applies to** +- Windows 10, version 1607 + +Starting in App-V 5.0 SP3, you can configure the App-V client so that only administrators (not end users) can publish or unpublish packages. In earlier versions of App-V, you could not prevent end users from performing these tasks. + +**To enable only administrators to publish or unpublish packages** + +1. Navigate to the following Group Policy Object node: + + **Computer Configuration > Administrative Templates > System > App-V > Publishing**. + +2. Enable the **Require publish as administrator** Group Policy setting. + + To instead use Windows PowerShell to set this item, see [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#bkmk-admins-pub-pkgs). + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md new file mode 100644 index 0000000000..084189822a --- /dev/null +++ b/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md @@ -0,0 +1,89 @@ +--- +title: How to Enable Reporting on the App-V Client by Using Windows PowerShell (Windows 10) +description: How to Enable Reporting on the App-V Client by Using Windows PowerShell +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Enable Reporting on the App-V Client by Using Windows PowerShell + +**Applies to** +- Windows 10, version 1607 + +Use the following procedure to configure the App-V for reporting. + +**To configure the computer running the App-V client for reporting** + +1. Enable the App-V client. For more information, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). + +2. After you have enabled the App-V client, use the **Set-AppvClientConfiguration** cmdlet to configure appropriate Reporting Configuration settings: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    SettingDescription

    ReportingEnabled

    Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.

    ReportingServerURL

    Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>.

    +
    + Note   +

    This is the port number that was assigned during the Reporting Server setup

    +
    +
    +   +

    Reporting Start Time

    This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.

    ReportingRandomDelay

    Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.

    ReportingInterval

    Specifies the retry interval that the client will use to resend data to the reporting server.

    ReportingDataCacheLimit

    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.

    ReportingDataBlockSize

    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.

    + +   + +3. After the appropriate settings have been configured, the computer running the App-V client will automatically collect data and will send the data back to the reporting server. + + Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** cmdlet. + + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/manage/appv-enable-the-app-v-desktop-client.md b/windows/manage/appv-enable-the-app-v-desktop-client.md new file mode 100644 index 0000000000..7231debe95 --- /dev/null +++ b/windows/manage/appv-enable-the-app-v-desktop-client.md @@ -0,0 +1,53 @@ +--- +title: Enable the App-V in-box client (Windows 10) +description: How to enable the App-V in-box client installed with Windows 10. +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# Enable the App-V in-box client + +**Applies to** +- Windows 10, version 1607 + +The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. The client can also get virtual application content from the management server. + +With Windows 10, version 1607, the App-V client is installed automatically. You need to enable the client to allow user devices to access and run virtual applications. You can enable the client with the Group Policy editor or with Windows PowerShell. + +**To enable the App-V client with Group Policy:** + +1. Open the device’s **Group Policy Editor**. + +2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. + +3. Run **Enables App-V Client** and then select **Enabled** on the screen that appears. + +4. Restart the device. + +**To enable the App-V client with Windows PowerShell:** + +1. Open Windows PowerShell. + +2. Type `Enable-Appv` and press ENTER. + +3. Restart the device. + +4. To verify that the App-V client is enabled on the device, type `Get-AppvStatus` and press ENTER. + + +For information about configuring the App-V client, see: + +- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) + +- [How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) + +- [Using the client management console](appv-using-the-client-management-console.md) + +- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-evaluating-appv.md b/windows/manage/appv-evaluating-appv.md new file mode 100644 index 0000000000..c125dd8975 --- /dev/null +++ b/windows/manage/appv-evaluating-appv.md @@ -0,0 +1,53 @@ +--- +title: Evaluating App-V (Windows 10) +description: Evaluating App-V for Windows 10 +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Evaluating App-V + +**Applies to** +- Windows 10, version 1607 + +Before you deploy App-V into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V in a lab environment for evaluation purposes only. + +## Configure lab computers for App-V Evaluation + +Use the following links for information about setting up the App-V sequencer on a computer in your lab environment. + +### Installing the App-V Sequencer and Creating Packages + +Use the following links for information about setting up the App-V sequencer and creating packages in your lab environment. + +- [How to Install the Sequencer](appv-install-the-sequencer.md) + +- [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md) + +### Configuring the App-V Server + +Use the following links for information about setting up the App-V server in your lab environment. + +- [How to Deploy the App-V server](appv-deploy-the-appv-server.md) + +- [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) + +### Enabling the App-V Client + +Use the following links for more information about creating and managing virtualized packages in your lab environment. + +- [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) + +- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +- [Getting Started with App-V](appv-getting-started.md) diff --git a/windows/manage/appv-for-windows.md b/windows/manage/appv-for-windows.md new file mode 100644 index 0000000000..aa08aead59 --- /dev/null +++ b/windows/manage/appv-for-windows.md @@ -0,0 +1,63 @@ +--- +title: Application Virtualization (App-V) (Windows 10) +description: Application Virtualization (App-V) +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Application Virtualization (App-V) for Windows 10 overview + +**Applies to** +- Windows 10, version 1607 + +The topics in this section provide information and step-by-step procedures to help you administer App-V and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. + +[Getting Started with App-V](appv-getting-started.md) + +- [What's new in App-V](appv-about-appv.md) +- [Evaluating App-V](appv-evaluating-appv.md) +- [High Level Architecture for App-V](appv-high-level-architecture.md) + +[Planning for App-V](appv-planning-for-appv.md) + +- [Preparing Your Environment for App-V](appv-preparing-your-environment.md) +- [App-V Prerequisites](appv-prerequisites.md) +- [Planning to Deploy App-V](appv-planning-to-deploy-appv.md) +- [App-V Supported Configurations](appv-supported-configurations.md) +- [App-V Planning Checklist](appv-planning-checklist.md) + +[Deploying App-V](appv-deploying-appv.md) + +- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) +- [Deploying the App-V Server](appv-deploying-the-appv-server.md) +- [App-V Deployment Checklist](appv-deployment-checklist.md) +- [Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md) +- [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) + +[Operations for App-V](appv-operations.md) + +- [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md) +- [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) +- [Managing Connection Groups](appv-managing-connection-groups.md) +- [Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) +- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) +- [Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) +- [Maintaining App-V](appv-maintaining-appv.md) +- [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) + +[Troubleshooting App-V](appv-troubleshooting.md) + +[Technical Reference for App-V](appv-technical-reference.md) + +- [Performance Guidance for Application Virtualization](appv-performance-guidance.md) +- [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) +- [Viewing App-V Server Publishing Metadata](appv-viewing-appv-server-publishing-metadata.md) +- [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md) + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-getting-started.md b/windows/manage/appv-getting-started.md new file mode 100644 index 0000000000..9a7b624486 --- /dev/null +++ b/windows/manage/appv-getting-started.md @@ -0,0 +1,77 @@ +--- +title: Getting Started with App-V (Windows 10) +description: Getting Started with App-V for Windows 10 +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Getting Started with App-V for Windows 10 + +**Applies to** +- Windows 10, version 1607 + +Microsoft Application Virtualization (App-V) for Windows 10 enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. + +With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise). If you are new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. For information about what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). + +If you’re already using App-V, performing an in-place upgrade to Windows 10 on user devices automatically installs the App-V client and migrates users’ App-V applications and settings. For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md). + +>**Important** +You can upgrade your existing App-V installation to App-V for Windows from App-V versions 5.0 SP2 and higher only. If you are using an earlier version of App-V, you’ll need to upgrade from that version to App-V 5.0 SP2 before you upgrade. + +For information about previous versions of App-V, see [MDOP Information Experience](https://technet.microsoft.com/itpro/mdop/index). + +## Getting started with App-V for Windows 10 (new installations) + +To start using App-V to deliver virtual applications to users, you’ll need to download, enable, and install server- and client-side components. The following table provides information about the App-V for Windows 10 components and where to find them. + + + +| Component | What it does | Where to find it | +|------------|--|------| +| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

    **Note** If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from:

    - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site.

    - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).

    See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. +| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10, version 1607.

    For information about enabling the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | +| App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must be running the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). | + +For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md). + +If you are new to this product, we recommend that you read the documentation thoroughly. Before you deploy it to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For information about Microsoft training opportunities, see the [Microsoft Training Overview](https://www.microsoft.com/en-us/learning/default.aspx). + +## Getting started with App-V + + +- [What's new in App-V](appv-about-appv.md) + + Provides a high-level overview of App-V and how it can be used in your organization. + +- [Evaluating App-V](appv-evaluating-appv.md) + + Provides information about how you can best evaluate App-V for use in your organization. + +- [High Level Architecture for App-V](appv-high-level-architecture.md) + + Provides a description of the App-V features and how they work together. + +## Other resources for this product + + +- [Application Virtualization (App-V) overview](appv-for-windows.md) + +- [Planning for App-V](appv-planning-for-appv.md) + +- [Deploying App-V](appv-deploying-appv.md) + +- [Operations for App-V](appv-operations.md) + +- [Troubleshooting App-V](appv-troubleshooting.md) + +- [Technical Reference for App-V](appv-technical-reference.md) + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + diff --git a/windows/manage/appv-high-level-architecture.md b/windows/manage/appv-high-level-architecture.md new file mode 100644 index 0000000000..b44b2ca181 --- /dev/null +++ b/windows/manage/appv-high-level-architecture.md @@ -0,0 +1,84 @@ +--- +title: High Level Architecture for App-V (Windows 10) +description: High Level Architecture for App-V +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# High Level Architecture for App-V + +**Applies to** +- Windows 10, version 1607 + +Use the following information to help you simplify you Microsoft Application Virtualization (App-V) deployment. + +## Architecture Overview + + +A typical App-V implementation consists of the following elements. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
    ElementMore information

    App-V Management Server

    The App-V Management server provides overall management functionality for the App-V infrastructure. Additionally, you can install more than one instance of the management server in your environment which provides the following benefits:

    +
      +

    • Fault Tolerance and High Availability – Installing and configuring the App-V Management server on two separate computers can help in situations when one of the servers is unavailable or offline.

      +

      You can also help increase App-V availability by installing the Management server on multiple computers. In this scenario, a network load balancer should also be considered so that server requests are balanced.

      • +

    • Scalability – You can add additional management servers as necessary to support a high load, for example you can install multiple servers behind a load balancer.

      • +

    App-V Publishing Server

    The App-V publishing server provides functionality for virtual application hosting and streaming. The publishing server does not require a database connection and supports the following protocols:

    +
      +

    • HTTP, and HTTPS

      • +
    +

    You can also help increase App-V availability by installing the Publishing server on multiple computers. A network load balancer should also be considered so that server requests are balanced.

    App-V Reporting Server

    The App-V Reporting server enables authorized users to run and view existing App-V reports and ad hoc reports that can help them manage the App-V infrastructure. The Reporting server requires a connection to the App-V reporting database. You can also help increase App-V availability by installing the Reporting server on multiple computers. A network load balancer should also be considered so that server requests are balanced.

    App-V Client

    The App-V client enables packages created using App-V to run on target computers.

    + + +**Note**   +If you are using App-V with Electronic Software Distribution (ESD) you are not required to use the App-V Management server. However, you can still utilize the reporting and streaming functionality of App-V. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[Getting Started with App-V](appv-getting-started.md) + +  + +  + + + + + diff --git a/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md b/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md new file mode 100644 index 0000000000..77ee61220b --- /dev/null +++ b/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md @@ -0,0 +1,4 @@ +--- +title: How to Install the App-V Client for Shared Content Store Mode (Windows 10) +redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-sequencer-and-client +--- diff --git a/windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md new file mode 100644 index 0000000000..60cde870db --- /dev/null +++ b/windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md @@ -0,0 +1,145 @@ +--- +title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell (Windows 10) +description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell + +**Applies to** +- Windows Server 2016 + +Use the following Windows PowerShell procedure to convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by Microsoft SQL Server when running SQL scripts. + +Before attempting this procedure, you should read and understand the information and examples displayed in the following list: + +- **.INPUTS** – The account or accounts used to convert to SID format. This can be a single account name or an array of account names. + +- **.OUTPUTS** - A list of account names with the corresponding SID in standard and hexadecimal formats. + +- **Examples** - + + **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List**. + + **$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** + + **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200** + + \#> + +**To convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs)** + +1. Copy the following script into a text editor and save it as a Windows PowerShell script file, for example **ConvertToSIDs.ps1**. + +2. To open a Windows PowerShell console, click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. + + ``` syntax + <# + .SYNOPSIS + This Windows PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. + .DESCRIPTION + This is a Windows PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts. + .INPUTS + The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below. + .OUTPUTS + A list of account names with the corresponding SID in standard and hexadecimal formats + .EXAMPLE + .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List + .EXAMPLE + $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2") + .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200 + #> + + []() + + []() + function ConvertSIDToHexFormat + { +    param([System.Security.Principal.SecurityIdentifier]$sidToConvert) +    $sb = New-Object System.Text.StringBuilder +     [int] $binLength = $sidToConvert.BinaryLength +     [Byte[]] $byteArray = New-Object Byte[] $binLength +    $sidToConvert.GetBinaryForm($byteArray, 0) +    foreach($byte in $byteArray) +    { +    $sb.Append($byte.ToString("X2")) |Out-Null +    } +    return $sb.ToString() + } + [string[]]$myArgs = $args + if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0)) + { + [string]::Format("{0}====== Description ======{0}{0}" + + "  Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" + +                "  Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" + +                "  The output is written to the console in the format 'Account name    SID as string   SID as hexadecimal'{0}" + +                "  And can be written out to a file using standard Windows PowerShell redirection{0}" + +                "  Please specify user accounts in the format 'DOMAIN\username'{0}" + +                "  Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" + +                "  For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" + +                "{0}====== Arguments ======{0}" + +                "{0}  /?    Show this help message", [Environment]::NewLine) + { + else + {  +     #If an array was passed in, try to split it +     if($myArgs.Length -eq 1) +     { +         $myArgs = $myArgs.Split(' ') +     } + +     #Parse the arguments for account names +     foreach($accountName in $myArgs) +     {    +         [string[]] $splitString = $accountName.Split('\')  # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject +         if($splitString.Length -ne 2) +         { +             $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName) +             Write-Error -Message $message +             continue +         } +         #Convert any account names to SIDs +         try +         { +             [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1]) +             [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier])) +         } +         catch [System.Security.Principal.IdentityNotMappedException] +         { +             $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString()) +             Write-Error -Message $message +             continue +         } + +         #Convert regular SID to binary format used by SQL +         $hexSIDString = ConvertSIDToHexFormat $SID +         $SIDs = New-Object PSObject +         $SIDs | Add-Member NoteProperty Account $accountName +         $SIDs | Add-Member NoteProperty SID $SID.ToString() +         $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString + +         Write-Output $SIDs +     } + } + ``` + +3. Run the script you saved in step one of this procedure passing the accounts to convert as arguments. + + For example, + + **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** + + **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”** + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md new file mode 100644 index 0000000000..d4cf994c82 --- /dev/null +++ b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -0,0 +1,99 @@ +--- +title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services (Windows 10) +description: How to install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services + +**Applies to** +- Windows Server 2016 + +Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. + +>**Note**   +After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases. + +**To install the management database and the management server on separate computers** + +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. + +2. On the **Getting Started** page, review and accept the license terms, and click **Next**. + +3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. + +4. On the **Feature Selection** page, select the components you want to install by selecting the **Management Server Database** checkbox and click **Next**. + +5. On the **Installation Location** page, accept the default location and click **Next**. + +6. On the initial **Create New Management Server Database page**, accept the default selections if appropriate, and click **Next**. + + If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. + + If you are using a custom database name, then select **Custom configuration** and type the database name. + +7. On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. + + >**Note**   + If you plan to deploy the management server on the same computer you must select **Use this local computer**. Specify the user name for the management server **Install Administrator** using the following format: Domain\\AdministratorLoginName. Click **Next**. + +8. To start the installation, click **Install**. + +**To install the reporting database and the reporting server on separate computers** + +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. + +2. On the **Getting Started** page, review and accept the license terms, and click **Next**. + +3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. + +4. On the **Feature Selection** page, select the components you want to install by selecting the **Reporting Server Database** checkbox and click **Next**. + +5. On the **Installation Location** page, accept the default location and click **Next**. + +6. On the initial **Create New Reporting Server Database** page, accept the default selections if appropriate, and click **Next**. + + If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. + + If you are using a custom database name, then select **Custom configuration** and type the database name. + +7. On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: Domain\\MachineAccount. + + **Note**   + If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. Specify the user name for the reporting server **Install Administrator** using the following format: Domain\\AdministratorLoginName. Click **Next**. + +8. To start the installation, click **Install**. + +**To install the management and reporting databases using App-V database scripts** + +1. Copy the App-V server installation files to the computer on which you want to install it on. + +2. To extract the App-V database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: + + **appv\_server\_setup.exe** **/LAYOUT** **/LAYOUTDIR=”InstallationExtractionLocation”** + +3. After the extraction has been completed, to access the App-V database scripts and instructions readme file: + + - The App-V Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**. + + - The App-V Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**. + +4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. + + **Note**   + For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md).   + +5. Run the scripts on the computer running Microsoft SQL Server. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Deploying App-V](appv-deploying-appv.md) diff --git a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md new file mode 100644 index 0000000000..1c9adffb02 --- /dev/null +++ b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md @@ -0,0 +1,60 @@ +--- +title: How to install the Management Server on a Standalone Computer and Connect it to the Database (Windows 10) +description: How to install the Management Server on a Standalone Computer and Connect it to the Database +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to install the Management Server on a Standalone Computer and Connect it to the Database + +**Applies to** +- Windows Server 2016 + +Use the following procedure to install the management server on a standalone computer and connect it to the database. + +**To install the management server on a standalone computer and connect it to the database** + +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. + +2. On the **Getting Started** page, review and accept the license terms, and click **Next**. + +3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. + +4. On the **Feature Selection** page, select the **Management Server** checkbox and click **Next**. + +5. On the **Installation Location** page, accept the default location and click **Next**. + +6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**. + + >**Note**   + If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**. + +7. On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation + + Specify the **Website Name** that you want to use for the management service. Accept the default if you do not have a custom name. For the **Port Binding**, specify a unique port number to be used, for example **12345**. + +8. Click **Install**. + +9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings being displayed. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[Deploying App-V](appv-deploying-appv.md) + +  + +  + + + + + diff --git a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md new file mode 100644 index 0000000000..d28bc0298f --- /dev/null +++ b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md @@ -0,0 +1,85 @@ +--- +title: How to Install the Publishing Server on a Remote Computer (Windows 10) +description: How to Install the App-V Publishing Server on a Remote Computer +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Install the Publishing Server on a Remote Computer + +**Applies to** +- Windows Server 2016 + +Use the following procedure to install the publishing server on a separate computer. Before you perform the following procedure, ensure the database and management server are available. + +**To install the publishing server on a separate computer** + +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. + +2. On the **Getting Started** page, review and accept the license terms, and click **Next**. + +3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. + +4. On the **Feature Selection** page, select the **Publishing Server** checkbox and click **Next**. + +5. On the **Installation Location** page, accept the default location and click **Next**. + +6. On the **Configure Publishing Server Configuration** page, specify the following items: + + - The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**. + + - Specify the website name that you want to use for the publishing service. Accept the default if you do not have a custom name. + + - For the **Port Binding**, specify a unique port number that will be used by App-V, for example **54321**. + +7. On the **Ready to Install** page, click **Install**. + +8. After the installation is complete, the publishing server must be registered with the management server. In the App-V management console, use the following steps to register the server: + + 1. Open the App-V management server console. + + 2. In the left pane, select **Servers**, and then select **Register New Server**. + + 3. Type the name of this server and a description (if required) and click **Add**. + +9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed: + + ```syntax + + + + + + + + + + + + + + + + ``` + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[Deploying App-V](appv-deploying-appv.md) + +  + +  + + + + + diff --git a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md new file mode 100644 index 0000000000..10915488b0 --- /dev/null +++ b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -0,0 +1,57 @@ +--- +title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database (Windows 10) +description: How to install the App-V Reporting Server on a Standalone Computer and Connect it to the Database +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to install the Reporting Server on a Standalone Computer and Connect it to the Database + +**Applies to** +- Windows Server 2016 + +Use the following procedure to install the reporting server on a standalone computer and connect it to the database. + +> **Important**  Before performing the following procedure you should read and understand [About App-V Reporting](appv-reporting.md). + +**To install the reporting server on a standalone computer and connect it to the database** + +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. + +2. On the **Getting Started** page, review and accept the license terms, and click **Next**. + +3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. + +4. On the **Feature Selection** page, select the **Reporting Server** checkbox and click **Next**. + +5. On the **Installation Location** page, accept the default location and click **Next**. + +6. On the **Configure Existing Reporting Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL Server, for example **SqlServerMachine**. + + **Note**   + If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**. + +7. On the **Configure Reporting Server Configuration** page. + + - Specify the Website Name that you want to use for the Reporting Service. Leave the default unchanged if you do not have a custom name. + + - For the **Port binding**, specify a unique port number that will be used by App-V, for example **55555**. You should also ensure that the port specified is not being used by another website. + +8. Click **Install**. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[About App-V Reporting](appv-reporting.md) + +[Deploying App-V](appv-deploying-appv.md) + +[How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md) diff --git a/windows/manage/appv-install-the-sequencer.md b/windows/manage/appv-install-the-sequencer.md new file mode 100644 index 0000000000..a84655d47d --- /dev/null +++ b/windows/manage/appv-install-the-sequencer.md @@ -0,0 +1,61 @@ +--- +title: Install the App-V Sequencer (Windows 10) +description: Install the App-V Sequencer +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Install the App-V Sequencer + +**Applies to** +- Windows 10, version 1607 + +Use the App-V Sequencer to convert Win32 applications into virtual packages for deployment to user devices. Those devices must be running the App-V client to allow users to interact with virtual applications. + +The App-V Sequencer is included in the Windows 10 Assessment and Deployment Kit (Windows ADK). + +> [!NOTE] +> The computer that will run the sequencer must not have the App-V client enabled on it. As a best practice, choose a computer with the same hardware and software configurations as the computers that will run the virtual applications. The sequencing process is resource intensive, so make sure that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. + +To install the App-V Sequencer: + +1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). + +2. Click or press the **Get Windows ADK for Windows 10** button on the page to start the ADK installer. Make sure that **Microsoft Application Virtualization (App-V) Sequencer** is selected during the installation. + + ![Selecting APP-V features in ADK](images/app-v-in-adk.png) + +3. To open the Sequencer, from the **Start** menu, select **Microsoft Application Virtualization (App-V) Sequencer** . + +See [Creating and managing virtual applications](appv-creating-and-managing-virtualized-applications.md) and the [Application Virtualization Sequencing Guide](http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx) for information about creating virtual applications with the Sequencer. + +## Command-line options for installing the sequencer + +You can also use the command line to install the App-V sequencer. The following list displays information about options for installing the sequencer using the command line and **appv\_sequencer\_setup.exe**: + +| **Command** | **Description** | +|-------------------|------------------| +| /INSTALLDIR | Specifies the installation directory. | +| /Log | Specifies where the installation log will be saved, the default location is **%Temp%**. For example, **C:\\Logs\\ log.log**. | +| /q | Specifies a quiet or silent installation. | +| /Uninstall | Specifies the removal of the sequencer. | +| /ACCEPTEULA | Accepts the license agreement. This is required for an unattended installation. Example usage: **/ACCEPTEULA** or **/ACCEPTEULA=1**. | +| /LAYOUT | Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V. No value is expected. | +| /LAYOUTDIR | Specifies the layout directory. Requires a string value. Example usage:**/LAYOUTDIR=”C:\\Application Virtualization Client”**. | +| /? Or /h or /help | Displays associated help. | + +## To troubleshoot the App-V sequencer installation + +For more information regarding the sequencer installation, you can view the error log in the **%temp%** folder. To review the log files, click **Start**, type **%temp%**, and then look for the **appv\_ log**. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +- [Planning to Deploy App-V](appv-planning-to-deploy-appv.md) diff --git a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md new file mode 100644 index 0000000000..2c29e70fd9 --- /dev/null +++ b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -0,0 +1,176 @@ +--- +title: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help (Windows 10) +description: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help + +**Applies to** +- Windows 10, version 1607 + +What this topic covers: + +- [Requirements for using Windows PowerShell cmdlets](#bkmk-reqs-using-posh) + +- [Loading the Windows PowerShell cmdlets](#bkmk-load-cmdlets) + +- [Getting help for the Windows PowerShell cmdlets](#bkmk-get-cmdlet-help) + +- [Displaying the help for a Windows PowerShell cmdlet](#bkmk-display-help-cmdlet) + +## Requirements for using Windows PowerShell cmdlets + + +Review the following requirements for using the Windows PowerShell cmdlets: + + ++++ + + + + + + + + + + + + + + + + + + + + +
    RequirementDetails

    Users can run App-V Server cmdlets only if you grant them access by using one of the following methods:

      +

    • When you are deploying and configuring the App-V Server:

      +

      Specify an Active Directory group or individual user that has permissions to manage the App-V environment. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md).

      • +

    • After you’ve deployed the App-V Server:

      +

      Use the App-V Management console to add an additional Active Directory group or user. See [How to Add or Remove an Administrator by Using the Management Console](appv-add-or-remove-an-administrator-with-the-management-console.md).

      • +

    Cmdlets that require an elevated command prompt

      +

    • Add-AppvClientPackage

      • +

    • Remove-AppvClientPackage

      • +

    • Set-AppvClientConfiguration

      • +

    • Add-AppvClientConnectionGroup

      • +

    • Remove-AppvClientConnectionGroup

      • +

    • Add-AppvPublishingServer

      • +

    • Remove-AppvPublishingServer

      • +

    • Send-AppvClientReport

      • +

    • Set-AppvClientMode

      • +

    • Set-AppvClientPackage

      • +

    • Set-AppvPublishingServer

      • +

    Cmdlets that end users can run, unless you configure them to require an elevated command prompt

      +

    • Publish-AppvClientPackage

      • +

    • Unpublish-AppvClientPackage

      • +
    +

    To configure these cmdlets to require an elevated command prompt, use one of the following methods:

    +
      +

    • Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.

      +

      For more information, see:
      [How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md#bkmk-admin-only-posh-topic-cg)
      [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#bkmk-admins-pub-pkgs).

      • +

    • Enable the “Require publish as administrator” Group Policy setting for App-V Clients.

      +

      For more information, see [How to Publish a Package by Using the Management Console](appv-publish-a-packages-with-the-management-console.md#bkmk-admin-pub-pkg-only-posh)

      • +
    +
    + +  + +## Loading the Windows PowerShell cmdlets + + +To load the Windows PowerShell cmdlet modules: + +1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). + +2. Type one of the following commands to load the cmdlets for the module you want: + + ++++ + + + + + + + + + + + + + + + + + + + + +
    App-V componentCommand to type

    App-V Server

    Import-Module AppvServer

    App-V Sequencer

    Import-Module AppvSequencer

    App-V Client

    Import-Module AppvClient

    + +  + +## Getting help for the Windows PowerShell cmdlets + +Starting in App-V 5.0 SP3, cmdlet help is available in two formats: + +- **As a downloadable module**: To download the latest help after downloading the cmdlet module, open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE), and type one of the following commands: + + ++++ + + + + + + + + + + + + + + + + + + + + +
    App-V componentCommand to type

    App-V Server

    Update-Help -Module AppvServer

    App-V Sequencer

    Update-Help -Module AppvSequencer

    App-V Client

    Update-Help -Module AppvClient

    + +
    + +- **On TechNet as web pages**: See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx). + +## Displaying the help for a Windows PowerShell cmdlet + + +To display help for a specific Windows PowerShell cmdlet: + +1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). + +2. Type **Get-Help** <*cmdlet*>, for example, **Get-Help Publish-AppvClientPackage**. + + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-maintaining-appv.md b/windows/manage/appv-maintaining-appv.md new file mode 100644 index 0000000000..32dae30bb0 --- /dev/null +++ b/windows/manage/appv-maintaining-appv.md @@ -0,0 +1,49 @@ +--- +title: Maintaining App-V (Windows 10) +description: Maintaining App-V +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Maintaining App-V + +**Applies to** +- Windows 10, version 1607 + +After you have deployed App-V for Windows 10, you can use the following information to maintain the App-V infrastructure. + +## Moving the App-V server + +The App-V server connects to the App-V database. Therefore you can install the management component on any computer on the network and then connect it to the App-V database. + +[How to Move the App-V Server to Another Computer](appv-move-the-appv-server-to-another-computer.md) + +## Determine if an App-V Application is Running Virtualized + + +Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. + +Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V 5.1 and later, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. + +## Have a suggestion for App-V? + + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Other resources for maintaining App-V + + +[Operations for App-V](appv-operations.md) + +  + +  + + + + + diff --git a/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md b/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md new file mode 100644 index 0000000000..694708f484 --- /dev/null +++ b/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md @@ -0,0 +1,282 @@ +--- +title: How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell (Windows 10) +description: How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell + +**Applies to** +- Windows 10, version 1607 + + +The following sections explain how to perform various management tasks on a stand-alone client computer by using Windows PowerShell: + +- [To return a list of packages](#bkmk-return-pkgs-standalone-posh) + +- [To add a package](#bkmk-add-pkgs-standalone-posh) + +- [To publish a package](#bkmk-pub-pkg-standalone-posh) + +- [To publish a package to a specific user](#bkmk-pub-pkg-a-user-standalone-posh) + +- [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh) + +- [To unpublish an existing package](#bkmk-unpub-pkg-standalone-posh) + +- [To unpublish a package for a specific user](#bkmk-unpub-pkg-specfc-use) + +- [To remove an existing package](#bkmk-remove-pkg-standalone-posh) + +- [To enable only administrators to publish or unpublish packages](#bkmk-admins-pub-pkgs) + +- [Understanding pending packages (UserPending and GlobalPending)](#bkmk-understd-pend-pkgs) + +## To return a list of packages + + +Use the following information to return a list of packages that are entitled to a specific user: + +**Cmdlet**: Get-AppvClientPackage + +**Parameters**: -Name -Version -PackageID -VersionID + +**Example**: Get-AppvClientPackage –Name “ContosoApplication” -Version 2 + +## To add a package + + +Use the following information to add a package to a computer. + +**Important**   +This example only adds a package. It does not publish the package to the user or the computer. + +  + +**Cmdlet**: Add-AppvClientPackage + +**Example**: $Contoso = Add-AppvClientPackage \\\\path\\to\\appv\\package.appv + +## To publish a package + + +Use the following information to publish a package that has been added to a specific user or globally to any user on the computer. + + ++++ + + + + + + + + + + + + + + + + +
    Publishing methodCmdlet and example

    Publishing to the user

    Cmdlet: Publish-AppvClientPackage

    +

    Example: Publish-AppvClientPackage “ContosoApplication”

    Publishing globally

    Cmdlet: Publish-AppvClientPackage

    +

    Example: Publish-AppvClientPackage “ContosoApplication” -Global

    + +  + +## To publish a package to a specific user + + +**Note**   +You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. + +  + +An administrator can publish a package to a specific user by specifying the optional **–UserSID** parameter with the **Publish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID). + +To use this parameter: + +- You can run this cmdlet from the user or administrator session. + +- You must be logged in with administrative credentials to use the parameter. + +- The end user must be logged in. + +- You must provide the end user’s security identifier (SID). + +**Cmdlet**: Publish-AppvClientPackage + +**Example**: Publish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 + +## To add and publish a package + + +Use the following information to add a package to a computer and publish it to the user. + +**Cmdlet**: Add-AppvClientPackage + +**Example**: Add-AppvClientPackage \\\\path\\to\\appv\\package.appv | Publish-AppvClientPackage + +## To unpublish an existing package + + +Use the following information to unpublish a package which has been entitled to a user but not remove the package from the computer. + +**Cmdlet**: Unpublish-AppvClientPackage + +**Example**: Unpublish-AppvClientPackage “ContosoApplication” + +## To unpublish a package for a specific user + + +**Note**   +You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. + +  + +An administrator can unpublish a package for a specific user by using the optional **–UserSID** parameter with the **Unpublish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID). + +To use this parameter: + +- You can run this cmdlet from the user or administrator session. + +- You must be logged in with administrative credentials to use the parameter. + +- The end user must be logged in. + +- You must provide the end user’s security identifier (SID). + +**Cmdlet**: Unpublish-AppvClientPackage + +**Example**: Unpublish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 + +## To remove an existing package + + +Use the following information to remove a package from the computer. + +**Cmdlet**: Remove-AppvClientPackage + +**Example**: Remove-AppvClientPackage “ContosoApplication” + +**Note**   +App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](https://blogs.technet.microsoft.com/appv/2012/12/03/app-v-5-0-client-powershell-deep-dive/). + +  + +## To enable only administrators to publish or unpublish packages + +Starting in App-V 5.0 SP3, you can use the following cmdlet and parameter to enable only administrators (not end users) to publish or unpublish packages: + + ++++ + + + + + + + + + + +

    Cmdlet

    Set-AppvClientConfiguration

    Parameter

    -RequirePublishAsAdmin

    +

    Parameter values:

    +
      +

    • 0 - False

      • +

    • 1 - True

      • +
    +

    Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1

    + +  + +To use the App-V Management console to set this configuration, see [How to Publish a Package by Using the Management Console](appv-publish-a-packages-with-the-management-console.md). + +## Understanding pending packages (UserPending and GlobalPending) + + +**Starting in App-V 5.0 SP2**: If you run a Windows PowerShell cmdlet that affects a package that is currently in use, the task that you are trying to perform is placed in a pending state. For example, if you try to publish a package when an application in that package is being used, and then run **Get-AppvClientPackage**, the pending status appears in the cmdlet output as follows: + + ++++ + + + + + + + + + + + + + + + + +
    Cmdlet output itemDescription

    UserPending

    Indicates whether the listed package has a pending task that is being applied to the user:

    +
      +

    • True

      • +

    • False

      • +

    GlobalPending

    Indicates whether the listed package has a pending task that is being applied globally to the computer:

    +
      +

    • True

      • +

    • False

      • +
    + +  + +The pending task will run later, according to the following rules: + + ++++ + + + + + + + + + + + + + + + + +
    Task typeApplicable rule

    User-based task, e.g., publishing a package to a user

    The pending task will be performed after the user logs off and then logs back on.

    Globally based task, e.g., enabling a connection group globally

    The pending task will be performed when the computer is shut down and then restarted.

    + +For more information about pending tasks, see [Upgrading an in-use App-V package](appv-application-publishing-and-client-interaction.md#upgrading-an-in-use-app-v-package). + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) + +[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) + diff --git a/windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md b/windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md new file mode 100644 index 0000000000..3d52191607 --- /dev/null +++ b/windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md @@ -0,0 +1,139 @@ +--- +title: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell (Windows 10) +description: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell + +**Applies to** +- Windows 10, version 1607 + +An App-V connection group allows you to run all the virtual applications as a defined set of packages in a single virtual environment. For example, you can virtualize an application and its plug-ins by using separate packages, but run them together in a single connection group. + +A connection group XML file defines the connection group for the App-V client. For information about the connection group XML file and how to configure it, see [About the Connection Group File](appv-connection-group-file.md). + +This topic explains the following procedures: + +- [To add and publish the App-V packages in the connection group](#bkmk-add-pub-pkgs-in-cg) + +- [To add and enable the connection group on the App-V client](#bkmk-add-enable-cg-on-clt) + +- [To enable or disable a connection group for a specific user](#bkmk-enable-cg-for-user-poshtopic) + +- [To allow only administrators to enable connection groups](#bkmk-admin-only-posh-topic-cg) + +**To add and publish the App-V packages in the connection group** + +1. To add and publish the App-V packages to the computer running the App-V client, type the following command: + + Add-AppvClientPackage –path c:\\tmpstore\\quartfin.appv | Publish-AppvClientPackage + +2. Repeat **step 1** of this procedure for each package in the connection group. + +**To add and enable the connection group on the App-V client** + +1. Add the connection group by typing the following command: + + Add-AppvClientConnectionGroup –path c:\\tmpstore\\financ.xml + +2. Enable the connection group by typing the following command: + + Enable-AppvClientConnectionGroup –name “Financial Applications” + + When any virtual applications that are in the member packages are run on the target computer, they will run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group. + +**To enable or disable a connection group for a specific user** + +1. Review the parameter description and requirements: + + - The parameter enables an administrator to enable or disable a connection group for a specific user. + + - You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. + + - You can run this cmdlet from the user or administrator session. + + - You must be logged in with administrative credentials to use the parameter. + + - The end user must be logged in. + + - You must provide the end user’s security identifier (SID). + +2. Use the following cmdlets, and add the optional **–UserSID** parameter, where **-UserSID** represents the end user’s security identifier (SID): + + + + + + + + + + + + + + + + + + + + + + +
    CmdletExamples

    Enable-AppVClientConnectionGroup

    Enable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    Disable-AppVClientConnectionGroup

    Disable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    + +   + +**To allow only administrators to enable connection groups** + +1. Review the description and requirement for using this cmdlet: + + - Use this cmdlet and parameter to configure the App-V client to allow only administrators (not end users) to enable or disable connection groups. + + - You must be using at least App-V 5.0 SP3 to use this cmdlet. + +2. Run the following cmdlet and parameter: + + + + + + + + + + + + + + + + + + + + + +
    CmdletParameter and valuesExample

    Set-AppvClientConfiguration

    -RequirePublishAsAdmin

    +
      +

    • 0 - False

      • +

    • 1 - True

      • +

    Set-AppvClientConfiguration -RequirePublishAsAdmin 1

    + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + + +[Operations for App-V](appv-operations.md) + +[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/manage/appv-managing-connection-groups.md b/windows/manage/appv-managing-connection-groups.md new file mode 100644 index 0000000000..dad0496d45 --- /dev/null +++ b/windows/manage/appv-managing-connection-groups.md @@ -0,0 +1,83 @@ +--- +title: Managing Connection Groups (Windows 10) +description: Managing Connection Groups +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Managing Connection Groups + +**Applies to** +- Windows 10, version 1607 + +Connection groups enable the applications within a package to interact with each other in the virtual environment, while remaining isolated from the rest of the system. By using connection groups, administrators can manage packages independently and can avoid having to add the same application multiple times to a client computer. + +**Note**   +In some previous versions of App-V, connection groups were referred to as Dynamic Suite Composition. + +**In this section:** + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    [About the Connection Group Virtual Environment](appv-connection-group-virtual-environment.md)

    Describes the connection group virtual environment.

    [About the Connection Group File](appv-connection-group-file.md)

    Describes the connection group file.

    [How to Create a Connection Group](appv-create-a-connection-group.md)

    Explains how to create a new connection group.

    [How to Create a Connection Group with User-Published and Globally Published Packages](appv-create-a-connection-group-with-user-published-and-globally-published-packages.md)

    Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.

    [How to Delete a Connection Group](appv-delete-a-connection-group.md)

    Explains how to delete a connection group.

    [How to Publish a Connection Group](appv-publish-a-connection-group.md)

    Explains how to publish a connection group.

    [How to Make a Connection Group Ignore the Package Version](appv-configure-connection-groups-to-ignore-the-package-version.md)

    Explains how to configure a connection group to accept any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create.

    [How to Allow Only Administrators to Enable Connection Groups](appv-allow-administrators-to-enable-connection-groups.md)

    Explains how to configure the App-V client so that only administrators (not end users) can enable or disable connection groups.

    + +  + +## Have a suggestion for App-V? + + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Other resources for App-V connection groups + + +- [Operations for App-V](appv-operations.md) + +  + +  + + + + + diff --git a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md new file mode 100644 index 0000000000..ff212a6b60 --- /dev/null +++ b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md @@ -0,0 +1,258 @@ +--- +title: Migrating to App-V from a Previous Version (Windows 10) +description: Migrating to App-V for Windows 10 from a previous version +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Migrating to App-V from previous versions + +**Applies to** +- Windows 10, version 1607 + +To migrate from App-V 4.x to App-V for Windows 10, you must upgrade to App-V 5.x first. + +## Improvements to the App-V Package Converter + + +You can now use the package converter to convert App-V 4.6 packages that contain scripts, and registry information and scripts from source .osd files are now included in package converter output. + +You can also use the `–OSDsToIncludeInPackage` parameter with the `ConvertFrom-AppvLegacyPackage` cmdlet to specify which .osd files’ information is converted and placed within the new package. + + ++++ + + + + + + + + + + + + +
    New in App-V for Windows 10Prior to App-V for Windows 10

    New .xml files are created corresponding to the .osd files associated with a package; these files include the following information:

    +
      +

    • environment variables

      • +

    • shortcuts

      • +

    • file type associations

      • +

    • registry information

      • +

    • scripts

      • +
    +

    You can now choose to add information from a subset of the .osd files in the source directory to the package using the -OSDsToIncludeInPackage parameter.

    Registry information and scripts included in .osd files associated with a package were not included in package converter output.

    +

    The package converter would populate the new package with information from all of the .osd files in the source directory.

    + +  + +### Example conversion statement + +To understand the new process, review the following example `ConvertFrom-AppvLegacyPackage` package converter statement. + +**If the source directory (\\\\OldPkgStore\\ContosoApp) includes the following:** + +- ContosoApp.sft + +- ContosoApp.msi + +- ContosoApp.sprj + +- ContosoApp\_manifest.xml + +- X.osd + +- Y.osd + +- Z.osd + +**And you run this command:** + +``` syntax +ConvertFrom-AppvLegacyPackage –SourcePath \\OldPkgStore\ContosoApp\ +-DestinationPath \\NewPkgStore\ContosoApp\ +-OSDsToIncludeInPackage X.osd,Y.osd +``` + +**The following is created in the destination directory (\\\\NewPkgStore\\ContosoApp):** + +- ContosoApp.appv + +- ContosoApp.msi + +- ContosoApp\_DeploymentConfig.xml + +- ContosoApp\_UserConfig.xml + +- X\_Config.xml + +- Y\_Config.xml + +- Z\_Config.xml + +**In the above example:** + + ++++++ + + + + + + + + + + + + + + + + + + + + + + +
    These Source directory files……are converted to these Destination directory files……and will contain these itemsDescription
      +

    • X.osd

      • +

    • Y.osd

      • +

    • Z.osd

      • +
      +

    • X_Config.xml

      • +

    • Y_Config.xml

      • +

    • Z_Config.xml

      • +
      +

    • Environment variables

      • +

    • Shortcuts

      • +

    • File type associations

      • +

    • Registry information

      • +

    • Scripts

      • +

    Each .osd file is converted to a separate, corresponding .xml file that contains the items listed here in App-V deployment configuration format. These items can then be copied from these .xml files and placed in the deployment configuration or user configuration files as desired.

    +

    In this example, there are three .xml files, corresponding with the three .osd files in the source directory. Each .xml file contains the environment variables, shortcuts, file type associations, registry information, and scripts in its corresponding .osd file.

      +

    • X.osd

      • +

    • Y.osd

      • +
      +

    • ContosoApp.appv

      • +

    • ContosoApp_DeploymentConfig.xml

      • +

    • ContosoApp_UserConfig.xml

      • +
      +

    • Environment variables

      • +

    • Shortcuts

      • +

    • File type associations

      • +

    The information from the .osd files specified in the -OSDsToIncludeInPackage parameter are converted and placed inside the package. The converter then populates the deployment configuration file and the user configuration file with the contents of the package, just as App-V Sequencer does when sequencing a new package.

    +

    In this example, environment variables, shortcuts, and file type associations included in X.osd and Y.osd were converted and placed in the App-V package, and some of this information was also included in the deployment configuration and user configuration files. X.osd and Y.osd were used because they were included as arguments to the -OSDsToIncludeInPackage parameter. No information from Z.osd was included in the package, because it was not included as one of these arguments.

    + +  + +## Converting packages created using a prior version of App-V + + +Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses Windows PowerShell to convert packages and can help automate the process if you have many packages that require conversion. App-V packages created with App-V 5.x don't need to be converted. + + +**Important**   +After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful. + +  + +**What to know before you convert existing packages** + + ++++ + + + + + + + + + + + + + + + + + + + + +
    IssueWorkaround

    Virtual packages using DSC are not linked after conversion.

    Link the packages using connection groups. See [Managing Connection Groups](appv-managing-connection-groups.md).

    Environment variable conflicts are detected during conversion.

    Resolve any conflicts in the associated .osd file.

    Hard-coded paths are detected during conversion.

    Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it is recommended to re-sequence the package.

    + +  + +When converting a package check for failing files or shortcuts, locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path. + +**Note**   +It is recommended that you use the App-V sequencer for converting critical applications or applications that need to take advantage of features. See [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). + +If a converted package does not open after you convert it, it is also recommended that you re-sequence the application using the App-V sequencer. + +[How to Convert a Package Created in a Previous Version of App-V](appv-convert-a-package-created-in-a-previous-version-of-appv.md) + +## Migrating the App-V Server Full Infrastructure + + +There is no direct method to upgrade to a full App-V infrastructure. Use the information in the following section for information about upgrading the App-V server. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
    TaskMore Information

    Review prerequisites.

    [App-V Server prerequisite software](appv-prerequisites.md#app-v-server-prerequisite-software).

    Enable the App-V client.

    [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md).

    Install App-V Server.

    [How to Deploy the App-V Server](appv-deploy-the-appv-server.md).

    Migrate existing packages.

    See [Converting packages created using a prior version of App-V](#converting-packages-created-using-a-prior-version-of-app-v) earlier in this topic.

    + +## Have a suggestion for App-V? + + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Other resources for performing App-V migration tasks + +- [Operations for App-V](appv-operations.md) + +- [A simplified Microsoft App-V 5.1 Management Server upgrade procedure](https://blogs.technet.microsoft.com/appv/2015/09/23/a-simplified-microsoft-app-v-5-1-management-server-upgrade-procedure/) diff --git a/windows/manage/appv-modify-an-existing-virtual-application-package.md b/windows/manage/appv-modify-an-existing-virtual-application-package.md new file mode 100644 index 0000000000..5c84ac6d8d --- /dev/null +++ b/windows/manage/appv-modify-an-existing-virtual-application-package.md @@ -0,0 +1,172 @@ +--- +title: How to Modify an Existing Virtual Application Package (Windows 10) +description: How to Modify an Existing Virtual Application Package +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Modify an Existing Virtual Application Package + +**Applies to** +- Windows 10, version 1607 + +This topic explains how to: + +- [Update an application in an existing virtual application package](#bkmk-update-app-in-pkg) + +- [Modify the properties associated with an existing virtual application package](#bkmk-chg-props-in-pkg) + +- [Add a new application to an existing virtual application package](#bkmk-add-app-to-pkg) + +**Before you update a package:** + +- Ensure that you’ve installed the Microsoft Application Virtualization (App-V) Sequencer, which is required for modifying a virtual application package. To install the App-V Sequencer, see [How to Install the Sequencer](appv-install-the-sequencer.md). + +- Save the .appv file in a secure location and always trust the source before trying to open the package for editing. + +- The Managing Authority section is erroneously removed from the deployment configuration file when you update a package. Before starting the update, copy the Managing Authority section from the existing deployment configuration file, and then paste the copied section into the new configuration file after the conversion is complete. + +- If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured. + +**Update an application in an existing virtual application package** + +1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. + +2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. + +3. On the **Select Task** page, click **Update Application in Existing Package** > **Next**. + +4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application to update, and then click **Next**. + +5. On the **Prepare Computer** page, review the issues that could cause the application update to fail or cause the updated application to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. + + **Important**   + If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package. + +   + +6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. + +7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. + + **Note**   + The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. + +   + +8. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**. + +9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**. + + **Note**   + You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**. + +   + +10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it is saved. Click **Next**. + + To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful to identify the application version and provide other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. Click **Create**. + +11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. + +**Modify the properties associated with an existing virtual application package** + +1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. + +2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. + +3. On the **Select Task** page, click **Edit Package** > **Next**. + +4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application properties to modify, and then click **Edit**. + +5. In the App-V Sequencer console, perform any of the following tasks as needed: + + - Import and export the manifest file. + + - Enable or disable Browser Helper Objects. + + - Import or export a VFS file. + + - Import a directory into the virtual file system. + + - Import and export virtual registry keys. + + - View package properties. + + - View associated package files. + + - Edit registry settings. + + - Review additional package settings (except operating system file properties). + + - Set virtualized registry key state (override or merge). + + - Set virtualized folder state. + + - Add or edit shortcuts and file type associations. + + **Note**   + To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page. + +   + +6. When you finish changing the package properties, click **File** > **Save** to save the package. + +**Add a new application to an existing virtual application package** + +1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. + +2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. + +3. On the **Select Task** page, click **Add New Application** > **Next**. + +4. On the **Select Package** page, click **Browse** to locate the virtual application package to which you will add the application, and then click **Next**. + +5. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or cause the revised package to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. + + **Important**   + If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package. + +   + +6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. + +7. On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you finish the installation, select **I am finished installing** > **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this is a new location so that you don’t overwrite the existing version of the virtual application package. + + **Note**   + The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. + +   + +8. On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. + +9. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page. + +10. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 13 of this procedure. If you want to perform the following described customization, click **Customize**. + + If you are customizing, prepare the virtual package for streaming, and then click **Next**. Streaming improves the experience when the virtual application package is run on target computers. + +11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. + + **Note**   + You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**. + +   + +12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**. + + To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**. + +13. On the **Completion** page, click **Close**. The package is now available in the sequencer. + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-modify-client-configuration-with-powershell.md b/windows/manage/appv-modify-client-configuration-with-powershell.md new file mode 100644 index 0000000000..ef256839b0 --- /dev/null +++ b/windows/manage/appv-modify-client-configuration-with-powershell.md @@ -0,0 +1,36 @@ +--- +title: How to Modify Client Configuration by Using Windows PowerShell (Windows 10) +description: How to Modify Client Configuration by Using Windows PowerShell +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to Modify Client Configuration by Using Windows PowerShell + +**Applies to** +- Windows 10, version 1607 + +Use the following procedure to configure the App-V client configuration. + +1. To configure the client settings using Windows PowerShell, use the **Set-AppvClientConfiguration** cmdlet. For more information about installing Windows PowerShell, and a list of cmdlets see, [How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md). + +2. To modify the client configuration, open a Windows PowerShell Command prompt and run **Set-AppvClientConfiguration** with any required parameters. For example: + + `$config = Get-AppvClientConfiguration` + + `Set-AppcClientConfiguration $config` + + `Set-AppcClientConfiguration –Name1 MyConfig –Name2 “xyz”` + + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md b/windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md new file mode 100644 index 0000000000..5d1058e257 --- /dev/null +++ b/windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md @@ -0,0 +1,4 @@ +--- +title: How to Modify App-V Client Configuration Using the ADMX Template and Group Policy (Windows 10) +redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-sequencer-and-client +--- diff --git a/windows/manage/appv-move-the-appv-server-to-another-computer.md b/windows/manage/appv-move-the-appv-server-to-another-computer.md new file mode 100644 index 0000000000..f883d31e98 --- /dev/null +++ b/windows/manage/appv-move-the-appv-server-to-another-computer.md @@ -0,0 +1,34 @@ +--- +title: How to Move the App-V Server to Another Computer (Windows 10) +description: How to Move the App-V Server to Another Computer +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# How to move the App-V server to another computer + +**Applies to** +- Windows Server 2016 + +Use the following information to create a new management server console in your environment. + +## To create a new management server console + + +Follow these steps to create a new management server console: + +1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V server](appv-deploying-the-appv-server.md). + +2. After you have completed the installation, use the following link to connect it to the App-V database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md). + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Related topics + +[Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-operations.md b/windows/manage/appv-operations.md new file mode 100644 index 0000000000..d8fe8b05e6 --- /dev/null +++ b/windows/manage/appv-operations.md @@ -0,0 +1,77 @@ +--- +title: Operations for App-V (Windows 10) +description: Operations for App-V +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Operations for App-V + +**Applies to** +- Windows 10, version 1607 + +This section of the Microsoft Application Virtualization (App-V) Administrator’s Guide includes information about the various types of App-V administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. + +## Operations Information + + +- [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md) + + Describes how to create, modify, and convert virtualized packages. + +- [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) + + Describes how to use the App-V Management console to perform tasks such as sequencing an application, changing a package, using a project template, and using a package accelerator. + +- [Managing Connection Groups](appv-managing-connection-groups.md) + + Describes how connection groups enable virtualized applications to communicate with each other in the virtual environment; explains how to create, publish, and delete them; and describes how connection groups can help you better manage your virtualized applications. + +- [Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) + + Describes how to deploy App-V packages by using an ESD. + +- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) + + Describes how perform client configuration tasks using the client management console. + +- [Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) + + Provides instructions for migrating to App-V from a previous version. + +- [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) + + Describes the set of Windows PowerShell cmdlets available for administrators performing various App-V server tasks. + +## Have a suggestion for App-V? + + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Other Resources for App-V Operations + + +- [Application Virtualization (App-V) overview](appv-for-windows.md) + +- [Getting Started with App-V](appv-getting-started.md) + +- [Planning for App-V](appv-planning-for-appv.md) + +- [Deploying App-V](appv-deploying-appv.md) + +- [Troubleshooting App-V](appv-troubleshooting.md) + +- [Technical Reference for App-V](appv-technical-reference.md) + +  + +  + + + + + diff --git a/windows/manage/appv-performance-guidance.md b/windows/manage/appv-performance-guidance.md new file mode 100644 index 0000000000..e0a277bf9c --- /dev/null +++ b/windows/manage/appv-performance-guidance.md @@ -0,0 +1,738 @@ +--- +title: Performance Guidance for Application Virtualization (Windows 10) +description: Performance Guidance for Application Virtualization +author: MaggiePucciEvans +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Performance Guidance for Application Virtualization + +**Applies to** +- Windows 10, version 1607 + +Learn how to configure App-V for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. + +Implementing multiple methods can help you improve the end-user experience. However, your environment may not support all methods. + +You should read and understand the following information before reading this document. + +- [Application Virtualization (App-V) overview](appv-for-windows.md) + +- [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) + +- [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760) + +**Note**   +Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk * review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. + +Finally, this document will provide you with the information to configure the computer running App-V client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI). + +To help determine what information is relevant to your environment you should review each section’s brief overview and applicability checklist. + +## App-V in stateful\* non-persistent deployments + +This section provides information about an approach that helps ensure a user will have access to all virtual applications within seconds after logging in. This is achieved by uniquely addressing the often long-running App-V publishing refresh. As you will discover the basis of the approach, the fastest publishing refresh, is one that doesn’t have to actually do anything. A number of conditions must be met and steps followed to provide the optimal user experience. + +Use the information in the following section for more information: + +[Usage Scenarios](#bkmk-us) - As you review the two scenarios, keep in mind that these are the approach extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users and/or virtual applications packages. + +- Optimized for Performance – To provide the optimal experience, you can expect the base image to include some of the App-V virtual application package. This and other requirements are discussed. + +- Optimized for Storage – If you are concerned with the storage impact, following this scenario will help address those concerns. + +[Preparing your Environment](#bkmk-pe) + +- Steps to Prepare the Base Image – Whether in a non-persistent VDI or RDSH environment, only a few steps must be completed in the base image to enable this approach. + +- Use UE-V as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution. + +[User Experience Walk-through](#bkmk-uewt) + +- Walk-through – This is a step-by-step walk-through of the App-V and UE-V operations and the expectations users should have. + +- Outcome – This describes the expected results. + +[Impact to Package Lifecycle](#bkmk-plc) + +[Enhancing the VDI Experience through Performance Optimization/Tuning](#bkmk-evdi) + +### Applicability Checklist + +Deployment Environment + + ++++ + + + + + + + + + + +
    Checklist box

    Non-Persistent VDI or RDSH.

    Checklist box

    User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD).

    + +  + +Expected Configuration + + ++++ + + + + + + + + + + +
    Checklist box

    User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff.

    Checklist box

    App-V Shared Content Store (SCS) is configured or can be configured.

    + +  + +IT Administration + + ++++ + + + + + + +
    Checklist box

    Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups.

    + +  + +### Usage Scenarios + +As you review the two scenarios, keep in mind that these approach the extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users, virtual application packages, or both. + + ++++ + + + + + + + + + + + + +
    Optimized for PerformanceOptimized for Storage

    To provide the most optimal user experience, this approach leverages the capabilities of a UPM solution and requires additional image preparation and can incur some additional image management overhead.

    +

    The following describes many performance improvements in stateful non-persistent deployments. For more information, see [Sequencing Steps to Optimize Packages for Publishing Performance](#sequencing-steps-to-optimize-packages-for-publishing-performance) later in this topic.

    The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in very costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image.

    +

    The impact of this alteration is detailed in the [User Experience Walk-through](#bkmk-uewt) section of this document.

    + +  + +### Preparing your Environment + +The following table displays the required steps to prepare the base image and the UE-V or another UPM solution for the approach. + +**Prepare the Base Image** + + ++++ + + + + + + + + + + + + +
    Optimized for PerformanceOptimized for Storage

    +
      +

    • Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md).

      • +

    • Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

      • +

    • Configure for Shared Content Store (SCS) mode. For more information see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).

      • +

    • Configure Preserve User Integrations on Login Registry DWORD.

      • +

    • Pre-configure all user- and global-targeted packages for example, Add-AppvClientPackage.

      • +

    • Pre-configure all user- and global-targeted connection groups for example, Add-AppvClientConnectionGroup.

      • +

    • Pre-publish all global-targeted packages.

      +

      +

      Alternatively,

      +
        +

      • Perform a global publishing/refresh.

        • +

      • Perform a user publishing/refresh.

        • +

      • Un-publish all user-targeted packages.

        • +

      • Delete the following user-Virtual File System (VFS) entries.

        • +
      +

      AppData\Local\Microsoft\AppV\Client\VFS

      +

      AppData\Roaming\Microsoft\AppV\Client\VFS

      • +

    +
      +

    • Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md).

      • +

    • Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

      • +

    • Configure for Shared Content Store (SCS) mode. For more information see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).

      • +

    • Configure Preserve User Integrations on Login Registry DWORD.

      • +

    • Pre-configure all global-targeted packages for example, Add-AppvClientPackage.

      • +

    • Pre-configure all global-targeted connection groups for example, Add-AppvClientConnectionGroup.

      • +

    • Pre-publish all global-targeted packages.

      +

      • +
    + +  + +**Configurations** - For critical App-V Client configurations and for a little more context and how-to, review the following information: + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
    Configuration SettingWhat does this do?How should I use it?

    Shared Content Store (SCS) Mode

    +
      +

    • Configurable in Windows PowerShell with `Set-AppvClientConfiguration -SharedContentStoreMode 1`
      or configurable with Group Policy, as described in [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).

      • +

    When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM).

    +

    This helps to conserve local storage and minimize disk I/O per second (IOPS).

    This is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN.

    PreserveUserIntegrationsOnLogin

    +
      +

    • Configure in the Registry under HKEY_LOCAL_MACHINE \ Software \ Microsoft \ AppV \ Client \ Integration.

      • +

    • Create the DWORD value PreserveUserIntegrationsOnLogin with a value of 1.

      • +

    • Restart the App-V client service or restart the computer running the App-V Client.

      • +

    If you have not pre-configured (Add-AppvClientPackage) a specific package and this setting is not configured, the App-V Client will de-integrate* the persisted user integrations, then re-integrate*.

    +

    For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh.

    If you don’t plan to pre-configure every available user package in the base image, use this setting.

    MaxConcurrentPublishingRefresh

    +
      +

    • Configure in the Registry under HKEY_LOCAL_MACHINE \ Software \ Microsoft \ AppV \ Client \ Publishing.

      • +

    • Create the DWORD value MaxConcurrentPublishingrefresh with the desired maximum number of concurrent publishing refreshes.

      • +

    • The App-V client service and computer do not need to be restarted.

      • +

    This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit.

    Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync.

    +

    If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they log in could take an indeterminate amount of time.

    + +  + +### Configure UE-V solution for App-V Approach + +We recommend using User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. UE-V is optimized for RDS and VDI scenarios. + +For more information, see: + +- [User Experience Virtualization (UE-V) for Windows 10 overview](uev-for-windows.md) + +- [Get Started with UE-V](uev-getting-started.md) + +In essence all that is required is to enable the UE-V service and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](http://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information about UE-V templates, see [User Experience Virtualization (UE-V) for Windows 10 overview](uev-for-windows.md). + +**Note**   +Without performing an additional configuration step, User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default. + +UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user’s device will have the same set of applications installed to the same location and every .lnk file is valid for all the users’ devices. For example, UE-V would not currently support the following two scenarios, because the net result will be that the shortcut will be valid on one but not all devices. + +- If a user has an application installed on one device with .lnk files enabled and the same native application installed on another device to a different installation root with .lnk files enabled. + +- If a user has an application installed on one device but not another with .lnk files enabled. + +**Important**   +This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. + +  + +Using the Microsoft Registry Editor (regedit.exe), navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **UEV** \\ **Agent** \\ **Configuration** \\ **ExcludedFileTypes** and remove **.lnk** from the excluded file types. + +## Configure other User Profile Management (UPM) solutions for App-V Approach + +The expectation in a stateful environment is that a UPM solution is implemented and can support persistence of user data across sessions and between logins. + +The requirements for the UPM solution are as follows. + +To enable an optimized login experience, for example the App-V approach for the user, the solution must be capable of: + +- Persisting the below user integrations as part of the user profile/persona. + +- Triggering a user profile sync on login (or application start), which can guarantee that all user integrations are applied before publishing/refresh begin, or, + +- Attaching and detaching a user profile disk (UPD) or similar technology that contains the user integrations. + + **Note**   + App-V is supported when using UPD only when the entire profile is stored on the user profile disk. + + App-V packages are not supported when using UPD with selected folders stored in the user profile disk. The Copy on Write driver does not handle UPD selected folders. + +   + +- Capturing changes to the locations, which constitute the user integrations, prior to session logoff. + +With App-V when you add a publishing server (**Add-AppvPublishingServer**) you can configure synchronization, for example refresh during log on and/or after a specified refresh interval. In both cases a scheduled task is created. + +In previous versions of App-V, both scheduled tasks were configured using a VBScript that would initiate the user and global refresh. Starting with Hotfix Package 4 for Application Virtualization 5.0 SP2 the user refresh on log on was initiated by **SyncAppvPublishingServer.exe**. This change was introduced to provide UPM solutions a trigger process. This process delays the publish /refresh to allow the UPM solution to apply the user integrations. It will exit once the publishing/refresh is complete. + +### User Integrations + +Registry – HKEY\_CURRENT\_USER + +- Path - Software\\Classes + + Exclude: Local Settings, ActivatableClasses, AppX\* + +- Path - Software\\Microsoft\\AppV + +- Path- Software\\Microsoft\\Windows\\CurrentVersion\\App Paths + +### File Locations + +- Root – “Environment Variable” APPDATA + + Path – Microsoft\\AppV\\Client\\Catalog + +- Root – “Environment Variable” APPDATA + + Path – Microsoft\\AppV\\Client\\Integration + +- Root – “Environment Variable” APPDATA + + Path - Microsoft\\Windows\\Start Menu\\Programs + +- (To persist all desktop shortcuts, virtual and non-virtual) + + Root - “KnownFolder” {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}FileMask - \*.lnk + +### User Experience Walk-through + +This following is a step-by-step walk-through of the App-V and UPM operations and the expectations users should expect. + + ++++ + + + + + + + + + + + + +
    Optimized for PerformanceOptimized for Storage

    After implementing this approach in the VDI/RDSH environment, on first login,

    +
      +

    • (Operation) A user-publishing/refresh is initiated. (Expectation) If this is the first time a user has published virtual applications (e.g. non-persistent), this will take the usual duration of a publishing/refresh.

      • +

    • (Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state.

      • +
    +

    On subsequent logins:

    +
      +

    • (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.

      +

      (Expectation) There will be shortcuts present on the desktop, or in the start menu, which work immediately. When the publishing/refresh completes (i.e., package entitlements change), some may go away.

      • +

    • (Operation) Publishing/refresh will process un-publish and publish operations for changes in user package entitlements. (Expectation) If there are no entitlement changes, publishing1 will complete in seconds. Otherwise, the publishing/refresh will increase relative to the number and complexity* of virtual applications

      • +

    • (Operation) UPM solution will capture user integrations again at logoff. (Expectation) Same as previous.

      • +
    +

    ¹ The publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps.

    After implementing this approach in the VDI/RDSH environment, on first login,

    +
      +

    • (Operation) A user-publishing/refresh is initiated. (Expectation)

      +
        +

      • If this is the first time a user has published virtual applications (e.g., non-persistent), this will take the usual duration of a publishing/refresh.

        • +

      • First and subsequent logins will be impacted by pre-configuring of packages (add/refresh).

        +

        • +
      • +

    • (Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state

      • +
    +

    On subsequent logins:

    +
      +

    • (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.

      • +

    • (Operation) Add/refresh must pre-configure all user targeted applications. (Expectation)

      +
        +

      • This may increase the time to application availability significantly (on the order of 10’s of seconds).

        • +

      • This will increase the publishing refresh time relative to the number and complexity* of virtual applications.

        +

        • +
      • +

    • (Operation) Publishing/refresh will process un-publish and publish operations for changes to user package entitlements.

      • +
    + +  + + ++++ + + + + + + + + + + + + +
    OutcomeOutcome

    +
      +

    • Because the user integrations are entirely preserved, there will be no work for example, integration for the publishing/refresh to complete. All virtual applications will be available within seconds of login.

      • +

    • The publishing/refresh will process changes to the users entitled virtual applications which impacts the experience.

      • +

    Because the add/refresh must re-configure all the virtual applications to the VM, the publishing refresh time on every login will be extended.

    + +  + +### Impact to Package Life Cycle + +Upgrading a package is a crucial aspect of the package lifecycle. To help guarantee users have access to the appropriate upgraded (published) or downgraded (un-published) virtual application packages, it is recommended you update the base image to reflect these changes. To understand why review the following section: + +App-V 5.0 SP2 introduced the concept of pending states. In the past, + +- If an administrator changed entitlements or created a new version of a package (upgraded) and during a publishing/refresh that package was in-use, the un-publish or publish operation, respectively, would fail. + +- Now, if a package is in-use the operation will be pended. The un-publish and publish-pend operations will be processed on service restart or if another publish or un-publish command is issued. In the latter case, if the virtual application is in-use otherwise, the virtual application will remain in a pending state. For globally published packages, a restart (or service restart) often needed. + +In a non-persistent environment, it is unlikely these pended operations will be processed. The pended operations, for example tasks are captured under **HKEY\_CURRENT\_USER** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Client** \\ **PendingTasks**. Although this location is persisted by the UPM solution, if it is not applied to the environment prior to log on, it will not be processed. + +### Enhancing the VDI Experience through Performance Optimization Tuning + +The following section contains lists with information about Microsoft documentation and downloads that may be useful when optimizing your environment for performance. + + + +**.NET NGEN Blog (Highly Recommended)** + +- [How to speed up NGEN optimization](http://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx) + +**Windows Server and Server Roles** + +Server Performance Tuning Guidelines for + +- [Microsoft Windows Server 2012 R2](http://msdn.microsoft.com/library/windows/hardware/dn529133.aspx) + +- [Microsoft Windows Server 2012](http://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx) + +- [Microsoft Windows Server 2008 R2](http://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx) + +**Server Roles** + +- [Remote Desktop Virtualization Host](http://msdn.microsoft.com/library/windows/hardware/dn567643.aspx) + +- [Remote Desktop Session Host](http://msdn.microsoft.com/library/windows/hardware/dn567648.aspx) + +- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](http://msdn.microsoft.com/library/windows/hardware/dn567678.aspx) + +- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](http://technet.microsoft.com/library/jj134210.aspx) + +**Windows Client (Guest OS) Performance Tuning Guidance** + +- [Microsoft Windows 7](http://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx) + +- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx) + +- [Microsoft Windows 8](http://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf) + +- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx) + +## Sequencing Steps to Optimize Packages for Publishing Performance + +Several App-V features facilitate new scenarios or enable new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations. + + ++++++ + + + + + + + + + + + + + + + + +
    StepConsiderationBenefitsTradeoffs

    No Feature Block 1 (FB1, also known as Primary FB)

    No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch. If there are network limitations, FB1 will:

    +
      +

    • Reduce the number of stream faults and network bandwidth used when you launch an application for the first time.

      • +

    • Delay launch until the entire FB1 has been streamed.

      • +

    Stream faulting decreases the launch time.

    Virtual application packages with FB1 configured will need to be re-sequenced.

    + +  + +### Removing FB1 + +Removing FB1 does not require the original application installer. After completing the following steps, it is suggested that you revert the computer running the sequencer to a clean snapshot. + +**Sequencer UI** - Create a New Virtual Application Package. + +1. Complete the sequencing steps up to Customize -> Streaming. + +2. At the Streaming step, do not select **Optimize the package for deployment over slow or unreliable network**. + +3. If desired, move on to **Target OS**. + +**Modify an Existing Virtual Application Package** + +1. Complete the sequencing steps up to Streaming. + +2. Do not select **Optimize the package for deployment over a slow or unreliable network**. + +3. Move to **Create Package**. + +**Windows PowerShell** - Update an Existing Virtual Application Package. + +1. Open an elevated Windows PowerShell session. + +2. Import-module **appvsequencer**. + +3. **Update-AppvSequencerPackage** - **AppvPackageFilePath** + + "C:\\Packages\\MyPackage.appv" -Installer + + "C:\\PackageInstall\\PackageUpgrade.exe empty.exe" -OutputPath + + "C:\\UpgradedPackages" + + **Note**   + This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file. + +   + + ++++++ + + + + + + + + + + + + + + + + +
    StepConsiderationsBenefitsTradeoffs

    No SXS Install at Publish (Pre-Install SxS assemblies)

    Virtual Application packages do not need to be re-sequenced. SxS Assemblies can remain in the virtual application package.

    The SxS Assembly dependencies will not install at publishing time.

    SxS Assembly dependencies must be pre-installed.

    + +  + +### Creating a new virtual application package on the sequencer + +If, during sequencer monitoring, an SxS Assembly (such as a VC++ Runtime) is installed as part of an application’s installation, SxS Assembly will be automatically detected and included in the package. The administrator will be notified and will have the option to exclude the SxS Assembly. + +**Client Side**: + +When publishing a virtual application package, the App-V Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it is included in the package, a traditional Windows Insataller (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation will not occur. + + ++++++ + + + + + + + + + + + + + + + + +
    StepConsiderationsBenefitsTradeoffs

    Selectively Employ Dynamic Configuration files

    The App-V client must parse and process these Dynamic Configuration files.

    +

    Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file.

    +

    Numerous virtual application packages may already have User- or computer–specific dynamic configurations files.

    Publishing times will improve if these files are used selectively or not at all.

    Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files.

    + +  + +### Disabling a Dynamic Configuration by using Windows Powershell + +- For already published packages, you can use `Set-AppVClientPackage –Name Myapp –Path c:\Packages\Apps\MyApp.appv` without + + **-DynamicDeploymentConfiguration** parameter + +- Similarly, when adding new packages using `Add-AppVClientPackage –Path c:\Packages\Apps\MyApp.appv`, do not use the + + **-DynamicDeploymentConfiguration** parameter. + +For documentation on How to Apply a Dynamic Configuration, see: + +- [How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) + +- [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) + + ++++++ + + + + + + + + + + + + + + + + + + + + + + +
    StepConsiderationsBenefitsTradeoffs

    Account for Synchronous Script Execution during Package Lifecycle.

    If script collateral is embedded in the package, Add cmdlets may be significantly slower.

    +

    Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations.

    Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently.

    This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously.

    Remove Extraneous Virtual Fonts from Package.

    The majority of applications investigated by the App-V product team contained a small number of fonts, typically fewer than 20.

    Virtual Fonts impact publishing refresh performance.

    Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts.

    + +  + +### Determining what virtual fonts exist in the package + +- Make a copy of the package. + +- Rename Package\_copy.appv to Package\_copy.zip + +- Open AppxManifest.xml and locate the following: + + ``` + + + + + ``` + + **Note**  If there are fonts marked as **DelayLoad**, those will not impact first launch. + + +### Excluding virtual fonts from the package + +Use the dynamic configuration file that best suits the user scope – deployment configuration for all users on computer, user configuration for specific user or users. + +- Disable fonts with the deployment or user configuration. + +Fonts + +``` +--> + + ## How is telemetry data handled by Microsoft? ### Data collection -Windows 10 and Windows Server 2016 Technical Preview includes the Connected User Experience and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores telemetry events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology. +Windows 10 and Windows Server 2016 includes the Connected User Experience and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores telemetry events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology. 1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces. 2. Events are gathered using public operating system event logging and tracing APIs. @@ -151,7 +151,7 @@ The following table defines the endpoints for telemetry services: ### Data use and access -The principle of least privileged access guides access to telemetry data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). Microsoft may share business reports with OEMs and third party partners that include aggregated and anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. +The principle of least privileged access guides access to telemetry data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third party partners that include aggregated and anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. ### Retention @@ -160,7 +160,7 @@ Microsoft believes in and practices information minimization. We strive to gathe ## Telemetry levels -This section explains the different telemetry levels in Windows 10, Windows Server 2016 Technical Preview, and System Center. These levels are available on all desktop and mobile editions of Windows 10, with the exception of the **Security** level which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016 Technical Preview. +This section explains the different telemetry levels in Windows 10, Windows Server 2016, and System Center. These levels are available on all desktop and mobile editions of Windows 10, with the exception of the **Security** level which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. The telemetry data is categorized into four levels: @@ -172,7 +172,7 @@ The telemetry data is categorized into four levels: - **Full**. All data necessary to identify and help to fix problems, plus data from the **Security**, **Basic**, and **Enhanced** levels. -The levels are cumulative and are illustrated in the following diagram. Also, these levels apply to all editions of Windows Server 2016 Technical Preview. +The levels are cumulative and are illustrated in the following diagram. Also, these levels apply to all editions of Windows Server 2016. ![breakdown of telemetry levels and types of administrative controls](images/priv-telemetry-levels.png) @@ -180,7 +180,8 @@ The levels are cumulative and are illustrated in the following diagram. Also, th The Security level gathers only the telemetry info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windos IoT Core editions. -> **Note:**  If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. +> [!NOTE] +> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. Windows Server Update Services (WSUS) and System Center Configuration Manager functionality is not affected at this level, nor is telemetry data about Windows Server features or System Center gathered. @@ -192,14 +193,15 @@ The data gathered at this level includes: - **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address. - >**Note:**  You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716). + > [!NOTE] + > You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716).   - **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address. - **Note**   - This reporting can be turned off and no information is included if a customer is using third party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](disconnect-your-organization-from-microsoft.md#windows-defender). + > [!NOTE] + > This reporting can be turned off and no information is included if a customer is using third party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](disconnect-your-organization-from-microsoft.md#windows-defender). Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates. @@ -215,7 +217,7 @@ The Basic level gathers a limited set of data that’s critical for understandin The data gathered at this level includes: -- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Server 2016 Technical Preview in the ecosystem. Examples include: +- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Server 2016 in the ecosystem. Examples include: - Device attributes, such as camera resolution and display type @@ -300,11 +302,12 @@ IT pros can use various methods, including Group Policy and Mobile Device Manage We do not recommend that you turn off telemetry in your organization as valuable functionality may be impacted, but we recognize that in some scenarios this may be required. Use the steps in this section to do so for Windows, Windows Server, and System Center. ->**Important:**  These telemetry levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experience and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these telemetry levels. You should work with your app vendors to understand their telemetry policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses telemetry, see [Overview of Office Telemetry](http://technet.microsoft.com/library/jj863580.aspx). +> [!IMPORTANT] +> These telemetry levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experience and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these telemetry levels. You should work with your app vendors to understand their telemetry policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses telemetry, see [Overview of Office Telemetry](http://technet.microsoft.com/library/jj863580.aspx). You can turn on or turn off System Center telemetry gathering. The default is on and the data gathered at this level represents what is gathered by default when System Center telemetry is turned on. However, setting the operating system telemetry level to **Basic** will turn off System Center telemetry, even if the System Center telemetry switch is turned on. -The lowest telemetry setting level supported through management policies is **Security**. The lowest telemetry setting supported through the Settings UI is **Basic**. The default telemetry setting for Windows Server 2016 Technical Preview is **Enhanced**. +The lowest telemetry setting level supported through management policies is **Security**. The lowest telemetry setting supported through the Settings UI is **Basic**. The default telemetry setting for Windows Server 2016 is **Enhanced**. ### Configure the operating system telemetry level @@ -368,21 +371,22 @@ There are a few more settings that you can turn off that may send telemetry info - Turn off **Linguistic Data Collection** in **Settings** > **Privacy**. At telemetry levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary. - >**Note:**  Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information. + > [!NOTE] + > Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information. ## Additional resources FAQs -- [Cortana, Search, and privacy](http://windows.microsoft.com/en-us/windows-10/cortana-privacy-faq) -- [Windows 10 feedback, diagnostics, and privacy](http://windows.microsoft.com/en-us/windows-10/feedback-diagnostics-privacy-faq) -- [Windows 10 camera and privacy](http://windows.microsoft.com/en-us/windows-10/camera-privacy-faq) -- [Windows 10 location service and privacy](http://windows.microsoft.com/en-us/windows-10/location-service-privacy) -- [Microsoft Edge and privacy](http://windows.microsoft.com/en-us/windows-10/edge-privacy-faq) -- [Windows 10 speech, inking, typing, and privacy](http://windows.microsoft.com/en-us/windows-10/speech-inking-typing-privacy-faq) -- [Windows Hello and privacy](http://windows.microsoft.com/en-us/windows-10/windows-hello-privacy-faq) -- [Wi-Fi Sense](http://windows.microsoft.com/en-us/windows-10/wi-fi-sense-faq) -- [Windows Update Delivery Optimization](http://windows.microsoft.com/en-us/windows-10/windows-update-delivery-optimization-faq) +- [Cortana, Search, and privacy](https://privacy.microsoft.com/windows-10-cortana-and-privacy) +- [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy) +- [Windows 10 camera and privacy](https://privacy.microsoft.com/windows-10-camera-and-privacy) +- [Windows 10 location service and privacy](https://privacy.microsoft.com/windows-10-location-and-privacy) +- [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy) +- [Windows 10 speech, inking, typing, and privacy](https://privacy.microsoft.com/windows-10-speech-inking-typing-and-privacy-faq) +- [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy) +- [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense) +- [Windows Update Delivery Optimization](https://privacy.microsoft.com/windows-10-windows-update-delivery-optimization) Blogs @@ -390,11 +394,11 @@ Blogs Privacy Statement -- [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement) +- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) TechNet -- [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/en-us/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) +- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) Web Pages diff --git a/windows/manage/connect-to-remote-aadj-pc.md b/windows/manage/connect-to-remote-aadj-pc.md index 6d02435e5f..1c58be856c 100644 --- a/windows/manage/connect-to-remote-aadj-pc.md +++ b/windows/manage/connect-to-remote-aadj-pc.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices author: jdeckerMS +localizationpriority: medium --- # Connect to remote Azure Active Directory-joined PC @@ -24,7 +25,7 @@ From its release, Windows 10 has supported remote connections to PCs that are jo ## Set up - Both PCs (local and remote) must be running Windows 10, version 1607. Remote connection to an Azure AD-joined PC that is running earlier versions of Windows 10 is not supported. -- Ensure [Remote Credential Guard](https://tnstage.redmond.corp.microsoft.com/en-us/itpro/windows/keep-secure/remote-credential-guard?branch=bl-7475998), a new feature in Windows 10, version 1607, is turned off on the client PC. +- Ensure [Remote Credential Guard](../keep-secure/remote-credential-guard.md), a new feature in Windows 10, version 1607, is turned off on the client PC. - On the PC that you want to connect to: 1. Open system properties for the remote PC. 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. @@ -65,9 +66,9 @@ In organizations using only Azure AD, you can connect from an Azure AD-joined PC ## Related topics -[How to use Remote Desktop](http://windows.microsoft.com/en-us/windows-10/how-to-use-remote-desktop) +[How to use Remote Desktop](https://support.microsoft.com/instantanswers/ff521c86-2803-4bc0-a5da-7df445788eb9/how-to-use-remote-desktop) + -[Remote Desktop Connection: frequently asked questions](http://windows.microsoft.com/en-us/windows/remote-desktop-connection-faq#1TC=windows-8) (Windows 8.1 documentation, still applicable to Windows 10)   diff --git a/windows/manage/customize-and-export-start-layout.md b/windows/manage/customize-and-export-start-layout.md index 46e13d01b9..87f206380e 100644 --- a/windows/manage/customize-and-export-start-layout.md +++ b/windows/manage/customize-and-export-start-layout.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: high --- # Customize and export Start layout @@ -18,7 +19,7 @@ author: jdeckerMS **Looking for consumer information?** -- [Customize the Start menu](http://go.microsoft.com/fwlink/p/?LinkId=623630) +- [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) The easiest method for creating a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test computer and then export the layout. @@ -73,7 +74,7 @@ To prepare a Start layout for export, you simply customize the Start layout on a ## Export the Start layout -When you have the Start layout that you want your users to see, use the [Export-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet in Windows PowerShell to export the Start layout to an .xml file. +When you have the Start layout that you want your users to see, use the [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet in Windows PowerShell to export the Start layout to an .xml file. **To export the Start layout to an .xml file** @@ -85,7 +86,7 @@ When you have the Start layout that you want your users to see, use the [Export- In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml). - Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet does not append the file name extension, and the policy settings require the extension. + Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet does not append the file name extension, and the policy settings require the extension. Example of a layout file produced by `Export-StartLayout`: diff --git a/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md b/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md index acdd1656ab..d0d6b868e6 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: high --- # Customize Windows 10 Start and taskbar with Group Policy @@ -18,7 +19,7 @@ author: jdeckerMS **Looking for consumer information?** -- [Customize the Start menu](http://go.microsoft.com/fwlink/p/?LinkId=623630) +- [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) In Windows 10 Enterprise and Windows 10 Education, you can use a Group Policy Object (GPO) to deploy a customized Start and taskbar layout to users in a domain. No reimaging is required, and the layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. @@ -36,24 +37,24 @@ When a full Start layout is applied with this method, the users cannot pin, unpi Start and taskbar layout control using Group Policy is supported in Windows 10 Enterprise and Windows 10 Education, Version 1607. Start and taskbar layout control is not supported in Windows 10 Pro. -The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. In Group Policy, ADMX files are used to define Registry-based policy settings in the Administrative Templates category. To find out how to create a central store for Administrative Templates files, see [article 929841, written for Windows Vista and still applicable](http://go.microsoft.com/fwlink/p/?LinkId=691687) in the Microsoft Knowledge Base. +The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. In Group Policy, ADMX files are used to define Registry-based policy settings in the Administrative Templates category. To find out how to create a central store for Administrative Templates files, see [article 929841, written for Windows Vista and still applicable](https://go.microsoft.com/fwlink/p/?LinkId=691687) in the Microsoft Knowledge Base. ## How Start layout control works Three features enable Start and taskbar layout control: -- The [Export-StartLayout](http://go.microsoft.com/fwlink/p/?LinkID=620879) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. +- The [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkID=620879) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. **Note**   - To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. + To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. - [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. - In Group Policy, you use the **Start Layout** settings for the **Start Menu and Taskbar** administrative template to set a Start and taskbar layout from an .xml file when the policy is applied. **Note**   -To learn how customize Start to include your line-of-business apps when you deploy Windows 10, see [Customize the Windows 10 Start layout]( http://go.microsoft.com/fwlink/p/?LinkId=620863). +To learn how customize Start to include your line-of-business apps when you deploy Windows 10, see [Customize the Windows 10 Start layout]( https://go.microsoft.com/fwlink/p/?LinkId=620863).   @@ -68,7 +69,7 @@ The GPO can be configured from any computer on which the necessary ADMX and ADML The .xml file with the Start and taskbar layout must be located on shared network storage that is available to the users’ computers when they sign in and the users must have Read-only access to the file. If the file is not available at sign-in, Start and the taskbar are not customized during the session, and the user can make changes to Start. -For information about deploying GPOs in a domain, see [Working with Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=620889). +For information about deploying GPOs in a domain, see [Working with Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=620889). ## Use Group Policy to apply a customized Start layout on the local computer @@ -76,9 +77,9 @@ For information about deploying GPOs in a domain, see [Working with Group Policy You can use the Local Group Policy Editor to provide a customized Start and taskbar layout for any user who signs in on the local computer. To display the customized Start and taskbar layout for any user who signs in, configure **Start Layout** policy settings for the **Start Menu and Taskbar** administrative template. You can use the **Start Menu and Taskbar** administrative template in **User Configuration** or **Computer Configuration**. **Note**   -This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment), later in this topic. +This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment). -This procedure creates a Local Group Policy that applies to all users on the computer. To configure Local Group Policy that applies to a specific user or group on the computer, see [Step-by-Step Guide to Managing Multiple Local Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=620881). The guide was written for Windows Vista and the procedures still apply to Windows 10. +This procedure creates a Local Group Policy that applies to all users on the computer. To configure Local Group Policy that applies to a specific user or group on the computer, see [Step-by-Step Guide to Managing Multiple Local Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=620881). The guide was written for Windows Vista and the procedures still apply to Windows 10.   diff --git a/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md b/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md index de8f037cfe..cf6a6dab79 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: medium --- # Customize Windows 10 Start with mobile device management (MDM) @@ -18,7 +19,7 @@ author: jdeckerMS **Looking for consumer information?** -- [Customize the Start menu](http://go.microsoft.com/fwlink/p/?LinkId=623630) +- [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) In Windows 10 Enterprise and Windows 10 Education, you can use a mobile device management (MDM) policy to deploy a customized Start layout to users. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead. @@ -39,11 +40,11 @@ Two features enable Start layout control: - The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. **Note**   - To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. + To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet.   -- In MDM, you set the path to the .xml file that defines the Start layout using an OMA-URI setting, which is based on the [Policy configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkID=623244). +- In MDM, you set the path to the .xml file that defines the Start layout using an OMA-URI setting, which is based on the [Policy configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=623244). ## Create a policy for your customized Start layout @@ -138,7 +139,7 @@ This example uses Microsoft Intune to configure an MDM policy that applies a cus [Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -[Use Windows 10 custom policies to manage device settings with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=616316) +[Use Windows 10 custom policies to manage device settings with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkID=616316)   diff --git a/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index 28609ad6b0..aca87ef5cc 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: medium --- # Customize Windows 10 Start and taskbar with ICD and provisioning packages @@ -18,10 +19,13 @@ author: jdeckerMS **Looking for consumer information?** -- [Customize the Start menu](http://go.microsoft.com/fwlink/p/?LinkId=623630) +- [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) In Windows 10 Enterprise and Windows 10 Education, version 1607, you can use a provisioning package that you create with Windows Imaging and Configuration Designer (ICD) tool to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. +>[!IMPORTANT] +>If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. + **Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) ## How Start layout control works @@ -32,7 +36,7 @@ Three features enable Start and taskbar layout control: - The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. **Note**   - To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. + To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. - [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. @@ -42,7 +46,7 @@ Three features enable Start and taskbar layout control: ## Create a provisioning package that contains a customized Start layout -Use the [Imaging and Configuration Designer (ICD) tool](http://go.microsoft.com/fwlink/p/?LinkID=525483) included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that applies a customized Start and taskbar layout. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) +Use the [Imaging and Configuration Designer (ICD) tool](https://go.microsoft.com/fwlink/p/?LinkID=525483) included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that applies a customized Start and taskbar layout. [Install the ADK.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) > **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. @@ -60,7 +64,7 @@ When you build a provisioning package, you may include sensitive information in 6. Expand **Runtime settings** > **Start**, and click **StartLayout**. -7. Specify the path and file name of the Start layout .xml that you created with the [Export-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet. +7. Specify the path and file name of the Start layout .xml that you created with the [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet. 8. On the **File** menu, select **Save.** diff --git a/windows/manage/device-guard-signing-portal.md b/windows/manage/device-guard-signing-portal.md index 09c4d67158..e9dabd0581 100644 --- a/windows/manage/device-guard-signing-portal.md +++ b/windows/manage/device-guard-signing-portal.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store, security author: TrudyHa +localizationpriority: high --- # Device Guard signing diff --git a/windows/manage/diagnostics-for-mdm-devices.md b/windows/manage/diagnostics-for-mdm-devices.md deleted file mode 100644 index 32998541e9..0000000000 --- a/windows/manage/diagnostics-for-mdm-devices.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Diagnostics for Windows 10 devices (Windows 10) -description: Device Policy State log in Windows 10, Version 1607, collects info about policies. -keywords: ["mdm", "udiag", "device policy", "mdmdiagnostics"] -ms.prod: W10 -ms.mktglfcycl: manage -ms.sitesec: library -author: jdeckerMS ---- - -# Diagnostics for Windows 10 devices - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -(which SKUs?) - -(this isn't really MDM-managed only, is it? It can be done locally/email?) - -Two new diagnostic tools for Windows 10, version 1607, help IT administrators diagnose and resolve issues with remote devices enrolled in mobile device management (MDM): the [Device Policy State Log](#device-policy-state-log) and [UDiag](#udiag). Windows 10 for desktop editions and Windows 10 Mobile make it simple for users to export log files that you can then analyze with these tools. - -## Export management log files - -Go to **Settings > Accounts > Work access > Export your management log files**. - -![Export your management log files](images/export-mgt-desktop.png) - -- On desktop devices, the file is saved to C:/Users/Public/Public Documents/MDMDiagnostics/MDMDiagReport.xml -- On phones, the file is saved to *phone*/Documents/MDMDiagnostics/MDMDiagReport.xml - -The MDMDiagReport.xml can be used with [Device Policy State Log](#device-policy-state-log) and [UDiag](#udiag) to help you resolve issues. - -## Device Policy State Log - -The Device Policy State Log collects information on the state of policies applied to the device to help you determine which sources are applying policies or configurations to the device. Help desk personnel can use this log to diagnose and resolve issues with a remote device. - -After you obtain the management log file from the user's device, run the mdmReportGenerator.ps1 script on log to create report. (download mdmReportGenerator.ps1 and mdmDiagnoseHelpers.psm1) This PowerShell script asks you to enter the name of the management log file and a name for the report that it will create, as shown in the following example: - -![Enter file name for input and output](images/mdm-diag-report-powershell.png) - -The script produces the report in html format. There are two sections to the report, Configuration and Policy Information. - - The configuration section lists the GUID of the sources that are applying configurations to the device. - - ![Configuration source Exachange ActiveSync](images/config-source.png) - -The policy information section displays information about the specific policies that are being enforced and on the device. For each policy, you will see the Area grouping, the Policy name, its default and current value, and the configuration source. You can compare the configuration source GUID in the policy information section to the GUIDs in the configuration section to identify the source of the policy. - -![Policies applied by a configuration source](images/config-policy.png) - - -## UDiag - -The UDiag tool applies rules to Event Tracing for Windows (ETW) files to help determine the root cause of an issue. - -(download UDiag) - -To analyze MDMDiagReport.xml using UDiag -1. Open UDiag, and select Device Management. -2. Select your source for the log files ("cab of logs" or "directory of logs") - -Investigating log content, identifying patterns, and adding a root cause analysis to the database (Advanced users/providers) - -1. While at the 'Root Causes List' panel, click the 'Diagnose' button at the bottom. -2. You will then be brought to the Diagnosis panel where you can investigate and tag root causes from the content - - Evidence Groups: When a set of logs are loaded into UDiag, the contents are processed (e.g. ETW) and organized into evidence groups. - - Decision Tree View: This view shows the loaded decision tree for the current topic/topic area. When a decision node is selected, a user can modify the regular expression and add/edit/delete an RCA for that node. Any RCA matches found in the current log set will have an 'RCA' label that is either Red or Yellow. - - Evidence View: Selecting an evidence group loads its content into this evidence view. Use this view to investigate issues and determine root causes. Drag and drop lines from the Evidence View into the Decision Tree View, to build your root cause analysis pattern. ([Learn more about techniques for root cause analysis.](https://technet.microsoft.com/en-us/library/cc543298.aspx)) - - - - - - Can admin pull logs without user action? [DK] Yes via the diagnostic log CSP - - - - "Run PowerShell script to process the file" – is that the user doing it? How can this workflow work in an enterprise where employees aren't computer-savvy? [DK] This is intended to be done by the help desk guy. - - Where did (user|admin) get mdmReportGenerator.ps1? [DK] Publishing on DLC later this summer - - In Viewing the report, how does the admin make sense of the source GUIDs? [DK] Correlates the value in the table with the entries at the top of the page. - - UDiag – where does admin get this? [DK] Publishing on DLC later this summer - - Can admins create custom rule sets? [DK] Right now, no. but open to feedback on this. - - - -Link to [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120%28v=vs.85%29.aspx) - -[Diagnostics capability for devices managed by any MDM provider.](https://microsoft.sharepoint.com/teams/osg_core_ens/mgmt/OSMan Wiki/MDM Diagnostics - Generating and Processing Log files.aspx) - -[Redstone spec](https://microsoft.sharepoint.com/teams/specstore/_layouts/15/WopiFrame.aspx?sourcedoc=%7b7E8742A2-03A1-451C-BA07-F2573B044CBF%7d&file=DM%20-%20MDM%20Diagnostics-RS.docx&action=default&DefaultItemOpen=1) - -## Related topics - -[DiagnosticLog CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt219118.aspx) - -[Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120.aspx) \ No newline at end of file diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index f1077326eb..8a9777af29 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1,4 +1,4 @@ --- title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) -redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft +redirect_url: https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services --- \ No newline at end of file diff --git a/windows/manage/distribute-apps-from-your-private-store.md b/windows/manage/distribute-apps-from-your-private-store.md index 500ff0c7b4..828dc965f4 100644 --- a/windows/manage/distribute-apps-from-your-private-store.md +++ b/windows/manage/distribute-apps-from-your-private-store.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Distribute apps using your private store @@ -25,15 +26,13 @@ You can make an app available in your private store when you acquire the app, or 1. Sign in to the [Store for Business](https://businessstore.microsoft.com). -2. Click an app and then click **Get the app** to acquire the app for your organization. - -3. You'll have a few options for distributing the app -- choose **Add to your private store where all people in your organization can find and install it.** +2. Click an app, choose the license type, and then click **Get the app** to acquire the app for your organization. ![Image showing Distribute options for app in the Windows Store for Business.](images/wsfb-distribute.png) - It will take approximately twelve hours before the app is available in the private store. +Windows Store for Business add the app to your **Inventory**. Click **Manage**, **Inventory** for app distribution options. -**To make an app in inventory available in your private store** +**To make an app in Inventory available in your private store** 1. Sign in to the [Store for Business](https://businessstore.microsoft.com). diff --git a/windows/manage/distribute-apps-to-your-employees-windows-store-for-business.md b/windows/manage/distribute-apps-to-your-employees-windows-store-for-business.md index ffdae6061d..8863d87a80 100644 --- a/windows/manage/distribute-apps-to-your-employees-windows-store-for-business.md +++ b/windows/manage/distribute-apps-to-your-employees-windows-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Distribute apps to your employees from the Windows Store for Business diff --git a/windows/manage/distribute-apps-with-management-tool.md b/windows/manage/distribute-apps-with-management-tool.md index 102b4d6d01..891c3c0ccc 100644 --- a/windows/manage/distribute-apps-with-management-tool.md +++ b/windows/manage/distribute-apps-with-management-tool.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Distribute apps with a management tool diff --git a/windows/manage/distribute-offline-apps.md b/windows/manage/distribute-offline-apps.md index f6493b53b4..c1bc0b3a20 100644 --- a/windows/manage/distribute-offline-apps.md +++ b/windows/manage/distribute-offline-apps.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Distribute offline apps diff --git a/windows/manage/find-and-acquire-apps-overview.md b/windows/manage/find-and-acquire-apps-overview.md index 4b4aab57ea..30ca08ff48 100644 --- a/windows/manage/find-and-acquire-apps-overview.md +++ b/windows/manage/find-and-acquire-apps-overview.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Find and acquire apps @@ -39,6 +40,10 @@ Use the Windows Store for Business to find apps for your organization. You can a

    Store for Business has thousands of apps from many different categories.

    +

    [Acquire apps in the Windows Store for Business](acquire-apps-windows-store-for-business.md)

    +

    You can acquire apps from the Windows Store for Business for your employees.

    + +

    [Working with line-of-business apps](working-with-line-of-business-apps.md)

    Your company can make line-of-business (LOB) applications available through Store for Business. These apps are custom to your company – they might be internal business apps, or apps specific to your business or industry.

    diff --git a/windows/manage/group-policies-for-enterprise-and-education-editions.md b/windows/manage/group-policies-for-enterprise-and-education-editions.md index 748d4c7b86..40c5250e62 100644 --- a/windows/manage/group-policies-for-enterprise-and-education-editions.md +++ b/windows/manage/group-policies-for-enterprise-and-education-editions.md @@ -1,31 +1,34 @@ --- -title: Group Policies that apply only to Windows 10 Enterprise and Education Editions (Windows 10) -description: Use this topic to learn about Group Policy objects that apply only to Windows 10 Enterprise and Windows 10 Education. +title: Group Policy settings that apply only to Windows 10 Enterprise and Education Editions (Windows 10) +description: Use this topic to learn about Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: brianlic-msft +localizationpriority: high --- -# Group Policies that apply only to Windows 10 Enterprise and Education Editions +# Group Policy settings that apply only to Windows 10 Enterprise and Education Editions **Applies to** - Windows 10 -In Windows 10, version 1607, the following Group Policies apply only to Windows 10 Enterprise and Windows 10 Education. +In Windows 10, version 1607, the following Group Policy settings apply only to Windows 10 Enterprise and Windows 10 Education. | Policy name | Policy path | Comments | | --- | --- | --- | -| **Configure Spotlight on lock screen** | User Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight). Note that an additional **Cloud Content** policy, **Do not suggest third-party content in Windows spotlight**, does apply to Windows 10 Pro. | -| **Turn off all Windows Spotlight features** | User Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) | -| **Turn off Microsoft consumer features** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) | -| **Do not display the lock screen** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) | +| **Configure Spotlight on lock screen** | User Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](windows-spotlight.md). Note that an additional **Cloud Content** policy, **Do not suggest third-party content in Windows spotlight**, does apply to Windows 10 Pro. | +| **Turn off all Windows Spotlight features** | User Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](windows-spotlight.md) | +| **Turn off Microsoft consumer features** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](windows-spotlight.md) | +| **Do not display the lock screen** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](windows-spotlight.md) | | **Do not require CTRL+ALT+DEL**
    combined with
    **Turn off app notifications on the lock screen** | Computer Configuration > Administrative Templates > System > Logon
    and
    Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon | When both of these policy settings are enabled, the combination will also disable lock screen apps ([assigned access](set-up-a-device-for-anyone-to-use.md)) on Windows 10 Enterprise and Windows 10 Education only. These policy settings can be applied to Windows 10 Pro, but lock screen apps will not be disabled on Windows 10 Pro.

    **Important:** The description for **Interactive logon: Do not require CTRL+ALT+DEL** in the Group Policy Editor incorrectly states that it only applies to Windows 10 Enterprise and Education. The description will be corrected in a future release.| -| **Do not show Windows Tips** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) | -| **Force a specific default lock screen image** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) | +| **Do not show Windows Tips** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](windows-spotlight.md | +| **Force a specific default lock screen image** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](windows-spotlight.md) | | **Start layout** | User Configuration\Administrative Templates\Start Menu and Taskbar | For more info, see [Manage Windows 10 Start layout options and policies](windows-10-start-layout-options-and-policies.md) | -| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

    User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/en-us/kb/3135657). | +| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

    User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/kb/3135657). | +| **Only display the private store within the Windows Store app** | Computer Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Windows Store app

    User Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Windows Store app | For more info, see [Manage access to private store](manage-access-to-private-store.md) | +| **Don't search the web or display web results** | Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results | For more info, see [Cortana integration in your enterprise](manage-cortana-in-enterprise.md) | diff --git a/windows/manage/guidelines-for-assigned-access-app.md b/windows/manage/guidelines-for-assigned-access-app.md index 28999f16fa..2d776f2cf5 100644 --- a/windows/manage/guidelines-for-assigned-access-app.md +++ b/windows/manage/guidelines-for-assigned-access-app.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: high --- # Guidelines for choosing an app for assigned access (kiosk mode) @@ -23,7 +24,7 @@ The following guidelines may help you choose an appropriate Windows app for your ## General guidelines -- Windows apps must be provisioned or installed for the assigned access account before they can be selected as the assigned access app. [Learn how to provision and install apps](https://msdn.microsoft.com/en-us/library/windows/hardware/mt228170(v=vs.85).aspx#install_your_apps). +- Windows apps must be provisioned or installed for the assigned access account before they can be selected as the assigned access app. [Learn how to provision and install apps](https://msdn.microsoft.com/library/windows/hardware/mt228170.aspx#install_your_apps). - Updating a Windows app can sometimes change the Application User Model ID (AUMID) of the app. If this happens, you must update the assigned access settings to launch the updated app, because assigned access uses the AUMID to determine which app to launch. @@ -71,7 +72,7 @@ Check the guidelines published by your selected app and do the setup accordingly Assigned access in Windows 10 leverages the new lock framework. When an assigned access user signs in, the selected kiosk app is launched above lock . The kiosk app is actually running as an above lock screen app. -Follow the [best practices guidance for developing a kiosk app for assigned access](https://msdn.microsoft.com/en-us/library/windows/hardware/mt633799%28v=vs.85%29.aspx). +Follow the [best practices guidance for developing a kiosk app for assigned access](https://msdn.microsoft.com/library/windows/hardware/mt633799%28v=vs.85%29.aspx). ## Test your assigned access experience diff --git a/windows/manage/how-it-pros-can-use-configuration-service-providers.md b/windows/manage/how-it-pros-can-use-configuration-service-providers.md index e6ec60d6cd..26ab03140f 100644 --- a/windows/manage/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/manage/how-it-pros-can-use-configuration-service-providers.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: medium --- # Introduction to configuration service providers (CSPs) for IT pros @@ -18,12 +19,12 @@ author: jdeckerMS Configuration service providers (CSPs) expose device configuration settings in Windows 10. This topic is written for people who have no experience with CSPs. -The CSPs are documented on the [Hardware Dev Center](http://go.microsoft.com/fwlink/p/?LinkId=717390) because CSPs are used by mobile device management (MDM) service providers. This topic explains how IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 and Windows 10 Mobile in their organizations. +The CSPs are documented on the [Hardware Dev Center](https://go.microsoft.com/fwlink/p/?LinkId=717390) because CSPs are used by mobile device management (MDM) service providers. This topic explains how IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 and Windows 10 Mobile in their organizations. **Note**   The explanation of CSPs and CSP documentation also apply to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile. - [See what's new for CSPs in Windows 10, version 1607.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt299056(v=vs.85).aspx#whatsnew_1607) + [See what's new for CSPs in Windows 10, version 1607.](https://msdn.microsoft.com/library/windows/hardware/mt299056.aspx#whatsnew_1607) ## What is a CSP? @@ -32,9 +33,9 @@ A CSP is an interface in the client operating system between configuration setti Starting in Windows Mobile 5.0, CSPs were used to manage Windows mobile devices. In the Windows 10 platform, the management approach for both desktop and mobile devices converges, taking advantage of the same CSPs to configure and manage all devices running Windows 10. -Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](http://go.microsoft.com/fwlink/p/?LinkId=717438) contains the settings to create a Wi-Fi profile. +Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkId=717438) contains the settings to create a Wi-Fi profile. -CSPs are behind many of the management tasks and policies for Windows 10 in Microsoft Intune and non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkID=623244). +CSPs are behind many of the management tasks and policies for Windows 10 in Microsoft Intune and non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). ![how intune maps to csp](images/policytocsp.png) @@ -48,7 +49,7 @@ The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs via scripts and traditional enterprise management software such as Configuration Manager using Windows Management Instrumentation (WMI). The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. -[Learn how to use the WMI Bridge Provider with PowerShell.](http://go.microsoft.com/fwlink/p/?LinkId=761090) +[Learn how to use the WMI Bridge Provider with PowerShell.](https://go.microsoft.com/fwlink/p/?LinkId=761090) ## Why should you learn about CSPs? @@ -57,11 +58,11 @@ Generally, enterprises rely on Group Policy or MDM to configure and manage devic In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management, or you want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. -In addition, some of the topics in the [Windows 10 and Windows 10 Mobile](../index.md) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) which links to the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. +In addition, some of the topics in the [Windows 10 and Windows 10 Mobile](../index.md) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. ### CSPs in Windows Imaging and Configuration Designer (ICD) -You can use Windows Imaging and Configuration Designer (ICD) to create [provisioning packages](http://go.microsoft.com/fwlink/p/?LinkId=717466) to apply settings to devices during the out-of-box-experience (OOBE) and after devices are set up. You can use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows ICD are based on CSPs. +You can use Windows Imaging and Configuration Designer (ICD) to create [provisioning packages](https://go.microsoft.com/fwlink/p/?LinkId=717466) to apply settings to devices during the out-of-box-experience (OOBE) and after devices are set up. You can use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows ICD are based on CSPs. Many settings in Windows ICD will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image. @@ -71,20 +72,20 @@ Many settings in Windows ICD will display documentation for that setting in the ### CSPs in MDM -Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might simply be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](http://go.microsoft.com/fwlink/p/?LinkId=717390). +Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might simply be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). -When a CSP is available but is not explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](http://go.microsoft.com/fwlink/p/?LinkID=616316) to deploy settings. Intune documents [a partial list of settings](http://go.microsoft.com/fwlink/p/?LinkID=616317) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](http://go.microsoft.com/fwlink/p/?LinkId=717390) to locate that information. +When a CSP is available but is not explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](https://go.microsoft.com/fwlink/p/?LinkID=616316) to deploy settings. Intune documents [a partial list of settings](https://go.microsoft.com/fwlink/p/?LinkID=616317) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](https://go.microsoft.com/fwlink/p/?LinkId=717390) to locate that information. ### CSPs in Lockdown XML -Lockdown XML can be used to configure devices running Windows 10 Mobile. You can manually author a [Lockdown XML file](lockdown-xml.md) to make use of the configuration settings available through the [EnterpriseAssignedAccess configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkID=618601). +Lockdown XML can be used to configure devices running Windows 10 Mobile. You can manually author a [Lockdown XML file](lockdown-xml.md) to make use of the configuration settings available through the [EnterpriseAssignedAccess configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=618601). ## How do you use the CSP documentation? -All CSPs in Windows 10 are documented in the [Configuration service provider reference](http://go.microsoft.com/fwlink/p/?LinkId=717390). +All CSPs in Windows 10 are documented in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). -The [main CSP topic](http://go.microsoft.com/fwlink/p/?LinkId=717390) tells you which CSPs are supported on each edition of Windows 10, and links to the documentation for each individual CSP. +The [main CSP topic](https://go.microsoft.com/fwlink/p/?LinkId=717390) tells you which CSPs are supported on each edition of Windows 10, and links to the documentation for each individual CSP. ![csp per windows edition](images/csptable.png) @@ -92,11 +93,11 @@ The documentation for each CSP follows the same structure. After an introduction The full path to a specific configuration setting is represented by its Open Mobile Alliance - Uniform Resource Identifier (OMA-URI). The URI is relative to the devices’ root node (MSFT, for example). Features supported by a particular CSP can be set by addressing the complete OMA-URI path. -The following example shows the diagram for the [AssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=626608). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes and rectangular elements are settings or policies for which a value must be supplied. +The following example shows the diagram for the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes and rectangular elements are settings or policies for which a value must be supplied. ![assigned access csp tree](images/provisioning-csp-assignedaccess.png) -The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see it uses the [AssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=626608). +The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see it uses the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). ```XML ./Vendor/MSFT/AssignedAccess/KioskModeApp @@ -108,7 +109,7 @@ When an element in the diagram uses italic font, it indicates a placeholder for After the diagram, the documentation describes each element. For each policy or setting, the valid values are listed. -For example, in the [AssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=626608), the setting is **KioskModeApp**. The documentation tells you that the value for **KioskModeApp** is a JSON string that contains the user account name and Application User Model ID (AUMID) of the Kiosk mode app. +For example, in the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608), the setting is **KioskModeApp**. The documentation tells you that the value for **KioskModeApp** is a JSON string that contains the user account name and Application User Model ID (AUMID) of the Kiosk mode app. The documentation for most CSPs will also include an XML example. @@ -117,7 +118,7 @@ The documentation for most CSPs will also include an XML example. CSPs provide access to a number of settings useful to enterprises. This section introduces two CSPs that an enterprise might find particularly useful. -- [EnterpriseAssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=618601) +- [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601) The EnterpriseAssignedAccess configuration service provider allows IT administrators to configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app. @@ -131,7 +132,7 @@ CSPs provide access to a number of settings useful to enterprises. This section - Restricting access to the context menu. - Enabling or disabling tile manipulation. - Creating role-specific configurations. -- [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkID=623244) +- [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244) The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. @@ -155,67 +156,67 @@ CSPs provide access to a number of settings useful to enterprises. This section Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile Enterprise, or both: -- [ActiveSync CSP](http://go.microsoft.com/fwlink/p/?LinkId=723219) -- [Application CSP](http://go.microsoft.com/fwlink/p/?LinkId=723220) -- [AppLocker CSP](http://go.microsoft.com/fwlink/p/?LinkID=626609) -- [AssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=626608) -- [Bootstrap CSP](http://go.microsoft.com/fwlink/p/?LinkId=723224) -- [BrowserFavorite CSP](http://go.microsoft.com/fwlink/p/?LinkId=723428) -- [CellularSettings CSP](http://go.microsoft.com/fwlink/p/?LinkId=723427) -- [CertificateStore CSP](http://go.microsoft.com/fwlink/p/?LinkId=723225) -- [ClientCertificateInstall CSP](http://go.microsoft.com/fwlink/p/?LinkId=723226) -- [CM\_CellularEntries CSP](http://go.microsoft.com/fwlink/p/?LinkId=723426) -- [CM\_ProxyEntries CSP](http://go.microsoft.com/fwlink/p/?LinkId=723425) -- [CMPolicy CSP](http://go.microsoft.com/fwlink/p/?LinkId=723424) -- [Defender CSP](http://go.microsoft.com/fwlink/p/?LinkId=723227) -- [DevDetail CSP](http://go.microsoft.com/fwlink/p/?LinkId=723228) -- [DeviceInstanceService CSP](http://go.microsoft.com/fwlink/p/?LinkId=723275) -- [DeviceLock CSP](http://go.microsoft.com/fwlink/p/?LinkId=723370) -- [DeviceStatus CSP](http://go.microsoft.com/fwlink/p/?LinkId=723229) -- [DevInfo CSP](http://go.microsoft.com/fwlink/p/?LinkId=723230) -- [DiagnosticLog CSP](http://go.microsoft.com/fwlink/p/?LinkId=723231) -- [DMAcc CSP](http://go.microsoft.com/fwlink/p/?LinkId=723232) -- [DMClient CSP](http://go.microsoft.com/fwlink/p/?LinkId=723233) -- [Email2 CSP](http://go.microsoft.com/fwlink/p/?LinkId=723234) -- [EnterpriseAPN CSP](http://go.microsoft.com/fwlink/p/?LinkId=723235) -- [EnterpriseAppManagement CSP](http://go.microsoft.com/fwlink/p/?LinkId=723237) -- [EnterpriseAssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=618601) -- [EnterpriseDesktopAppManagement CSP](http://go.microsoft.com/fwlink/p/?LinkId=723236) -- [EnterpriseExt CSP](http://go.microsoft.com/fwlink/p/?LinkId=723423) -- [EnterpriseExtFileSystem CSP](http://go.microsoft.com/fwlink/p/?LinkID=703716) -- [EnterpriseModernAppManagement CSP](http://go.microsoft.com/fwlink/p/?LinkId=723257) -- [FileSystem CSP](http://go.microsoft.com/fwlink/p/?LinkId=723422) -- [HealthAttestation CSP](http://go.microsoft.com/fwlink/p/?LinkId=723258) -- [HotSpot CSP](http://go.microsoft.com/fwlink/p/?LinkId=723421) -- [Maps CSP](http://go.microsoft.com/fwlink/p/?LinkId=723420) -- [NAP CSP](http://go.microsoft.com/fwlink/p/?LinkId=723419) -- [NAPDEF CSP](http://go.microsoft.com/fwlink/p/?LinkId=723371) -- [NodeCache CSP]( http://go.microsoft.com/fwlink/p/?LinkId=723265) -- [PassportForWork CSP](http://go.microsoft.com/fwlink/p/?LinkID=692070) -- [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkID=623244) -- [PolicyManager CSP]( http://go.microsoft.com/fwlink/p/?LinkId=723418) -- [Provisioning CSP](http://go.microsoft.com/fwlink/p/?LinkId=723266) -- [Proxy CSP]( http://go.microsoft.com/fwlink/p/?LinkId=723372) -- [PXLOGICAL CSP](http://go.microsoft.com/fwlink/p/?LinkId=723374) -- [Registry CSP](http://go.microsoft.com/fwlink/p/?LinkId=723417) -- [RemoteFind CSP](http://go.microsoft.com/fwlink/p/?LinkId=723267) -- [RemoteWipe CSP](http://go.microsoft.com/fwlink/p/?LinkID=703714) -- [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkId=723375) -- [RootCATrustedCertificates CSP](http://go.microsoft.com/fwlink/p/?LinkId=723270) -- [SecurityPolicy CSP](http://go.microsoft.com/fwlink/p/?LinkId=723376) -- [Storage CSP](http://go.microsoft.com/fwlink/p/?LinkId=723377) -- [SUPL CSP](http://go.microsoft.com/fwlink/p/?LinkId=723378) -- [UnifiedWriteFilter CSP](http://go.microsoft.com/fwlink/p/?LinkId=723272) -- [Update CSP](http://go.microsoft.com/fwlink/p/?LinkId=723271) -- [VPN CSP](http://go.microsoft.com/fwlink/p/?LinkId=723416) -- [VPNv2 CSP](http://go.microsoft.com/fwlink/p/?LinkID=617588) -- [Wi-Fi CSP](http://go.microsoft.com/fwlink/p/?LinkID=71743) -- [WindowsLicensing CSP](http://go.microsoft.com/fwlink/p/?LinkId=723274) -- [WindowsSecurityAuditing CSP](http://go.microsoft.com/fwlink/p/?LinkId=723415) +- [ActiveSync CSP](https://go.microsoft.com/fwlink/p/?LinkId=723219) +- [Application CSP](https://go.microsoft.com/fwlink/p/?LinkId=723220) +- [AppLocker CSP](https://go.microsoft.com/fwlink/p/?LinkID=626609) +- [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608) +- [Bootstrap CSP](https://go.microsoft.com/fwlink/p/?LinkId=723224) +- [BrowserFavorite CSP](https://go.microsoft.com/fwlink/p/?LinkId=723428) +- [CellularSettings CSP](https://go.microsoft.com/fwlink/p/?LinkId=723427) +- [CertificateStore CSP](https://go.microsoft.com/fwlink/p/?LinkId=723225) +- [ClientCertificateInstall CSP](https://go.microsoft.com/fwlink/p/?LinkId=723226) +- [CM\_CellularEntries CSP](https://go.microsoft.com/fwlink/p/?LinkId=723426) +- [CM\_ProxyEntries CSP](https://go.microsoft.com/fwlink/p/?LinkId=723425) +- [CMPolicy CSP](https://go.microsoft.com/fwlink/p/?LinkId=723424) +- [Defender CSP](https://go.microsoft.com/fwlink/p/?LinkId=723227) +- [DevDetail CSP](https://go.microsoft.com/fwlink/p/?LinkId=723228) +- [DeviceInstanceService CSP](https://go.microsoft.com/fwlink/p/?LinkId=723275) +- [DeviceLock CSP](https://go.microsoft.com/fwlink/p/?LinkId=723370) +- [DeviceStatus CSP](https://go.microsoft.com/fwlink/p/?LinkId=723229) +- [DevInfo CSP](https://go.microsoft.com/fwlink/p/?LinkId=723230) +- [DiagnosticLog CSP](https://go.microsoft.com/fwlink/p/?LinkId=723231) +- [DMAcc CSP](https://go.microsoft.com/fwlink/p/?LinkId=723232) +- [DMClient CSP](https://go.microsoft.com/fwlink/p/?LinkId=723233) +- [Email2 CSP](https://go.microsoft.com/fwlink/p/?LinkId=723234) +- [EnterpriseAPN CSP](https://go.microsoft.com/fwlink/p/?LinkId=723235) +- [EnterpriseAppManagement CSP](https://go.microsoft.com/fwlink/p/?LinkId=723237) +- [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601) +- [EnterpriseDesktopAppManagement CSP](https://go.microsoft.com/fwlink/p/?LinkId=723236) +- [EnterpriseExt CSP](https://go.microsoft.com/fwlink/p/?LinkId=723423) +- [EnterpriseExtFileSystem CSP](https://go.microsoft.com/fwlink/p/?LinkID=703716) +- [EnterpriseModernAppManagement CSP](https://go.microsoft.com/fwlink/p/?LinkId=723257) +- [FileSystem CSP](https://go.microsoft.com/fwlink/p/?LinkId=723422) +- [HealthAttestation CSP](https://go.microsoft.com/fwlink/p/?LinkId=723258) +- [HotSpot CSP](https://go.microsoft.com/fwlink/p/?LinkId=723421) +- [Maps CSP](https://go.microsoft.com/fwlink/p/?LinkId=723420) +- [NAP CSP](https://go.microsoft.com/fwlink/p/?LinkId=723419) +- [NAPDEF CSP](https://go.microsoft.com/fwlink/p/?LinkId=723371) +- [NodeCache CSP]( https://go.microsoft.com/fwlink/p/?LinkId=723265) +- [PassportForWork CSP](https://go.microsoft.com/fwlink/p/?LinkID=692070) +- [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244) +- [PolicyManager CSP]( https://go.microsoft.com/fwlink/p/?LinkId=723418) +- [Provisioning CSP](https://go.microsoft.com/fwlink/p/?LinkId=723266) +- [Proxy CSP]( https://go.microsoft.com/fwlink/p/?LinkId=723372) +- [PXLOGICAL CSP](https://go.microsoft.com/fwlink/p/?LinkId=723374) +- [Registry CSP](https://go.microsoft.com/fwlink/p/?LinkId=723417) +- [RemoteFind CSP](https://go.microsoft.com/fwlink/p/?LinkId=723267) +- [RemoteWipe CSP](https://go.microsoft.com/fwlink/p/?LinkID=703714) +- [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkId=723375) +- [RootCATrustedCertificates CSP](https://go.microsoft.com/fwlink/p/?LinkId=723270) +- [SecurityPolicy CSP](https://go.microsoft.com/fwlink/p/?LinkId=723376) +- [Storage CSP](https://go.microsoft.com/fwlink/p/?LinkId=723377) +- [SUPL CSP](https://go.microsoft.com/fwlink/p/?LinkId=723378) +- [UnifiedWriteFilter CSP](https://go.microsoft.com/fwlink/p/?LinkId=723272) +- [Update CSP](https://go.microsoft.com/fwlink/p/?LinkId=723271) +- [VPN CSP](https://go.microsoft.com/fwlink/p/?LinkId=723416) +- [VPNv2 CSP](https://go.microsoft.com/fwlink/p/?LinkID=617588) +- [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkID=71743) +- [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkId=723274) +- [WindowsSecurityAuditing CSP](https://go.microsoft.com/fwlink/p/?LinkId=723415) ## Related topics -[What's new in MDM enrollment and management in Windows 10, version 1607](https://msdn.microsoft.com/en-us/library/windows/hardware/mt299056(v=vs.85).aspx#whatsnew_1607) +[What's new in MDM enrollment and management in Windows 10, version 1607](https://msdn.microsoft.com/library/windows/hardware/mt299056.aspx#whatsnew_1607) [Lock down Windows 10](lock-down-windows-10.md) diff --git a/windows/manage/images/app-v-in-adk.png b/windows/manage/images/app-v-in-adk.png new file mode 100644 index 0000000000..a36ef9f00f Binary files /dev/null and b/windows/manage/images/app-v-in-adk.png differ diff --git a/windows/manage/images/checklistbox.gif b/windows/manage/images/checklistbox.gif new file mode 100644 index 0000000000..44cf17b07b Binary files /dev/null and b/windows/manage/images/checklistbox.gif differ diff --git a/windows/manage/images/checklistdone.png b/windows/manage/images/checklistdone.png new file mode 100644 index 0000000000..7e53f74d0e Binary files /dev/null and b/windows/manage/images/checklistdone.png differ diff --git a/windows/manage/images/copy-to-change.png b/windows/manage/images/copy-to-change.png new file mode 100644 index 0000000000..21aa250c0c Binary files /dev/null and b/windows/manage/images/copy-to-change.png differ diff --git a/windows/manage/images/copy-to-path.png b/windows/manage/images/copy-to-path.png new file mode 100644 index 0000000000..1ef00fc86b Binary files /dev/null and b/windows/manage/images/copy-to-path.png differ diff --git a/windows/manage/images/copy-to.PNG b/windows/manage/images/copy-to.PNG new file mode 100644 index 0000000000..dad84cedc8 Binary files /dev/null and b/windows/manage/images/copy-to.PNG differ diff --git a/windows/manage/images/deploymentworkflow.png b/windows/manage/images/deploymentworkflow.png new file mode 100644 index 0000000000..b665a0bfea Binary files /dev/null and b/windows/manage/images/deploymentworkflow.png differ diff --git a/windows/manage/images/gp-branch.png b/windows/manage/images/gp-branch.png new file mode 100644 index 0000000000..997bcc830a Binary files /dev/null and b/windows/manage/images/gp-branch.png differ diff --git a/windows/manage/images/gp-exclude-drivers.png b/windows/manage/images/gp-exclude-drivers.png new file mode 100644 index 0000000000..0010749139 Binary files /dev/null and b/windows/manage/images/gp-exclude-drivers.png differ diff --git a/windows/manage/images/gp-feature.png b/windows/manage/images/gp-feature.png new file mode 100644 index 0000000000..b862d545d4 Binary files /dev/null and b/windows/manage/images/gp-feature.png differ diff --git a/windows/manage/images/gp-quality.png b/windows/manage/images/gp-quality.png new file mode 100644 index 0000000000..d7ff30172d Binary files /dev/null and b/windows/manage/images/gp-quality.png differ diff --git a/windows/manage/images/packageaddfileandregistrydata-global.png b/windows/manage/images/packageaddfileandregistrydata-global.png new file mode 100644 index 0000000000..775e290a36 Binary files /dev/null and b/windows/manage/images/packageaddfileandregistrydata-global.png differ diff --git a/windows/manage/images/packageaddfileandregistrydata-stream.png b/windows/manage/images/packageaddfileandregistrydata-stream.png new file mode 100644 index 0000000000..0e1205c62b Binary files /dev/null and b/windows/manage/images/packageaddfileandregistrydata-stream.png differ diff --git a/windows/manage/images/packageaddfileandregistrydata.png b/windows/manage/images/packageaddfileandregistrydata.png new file mode 100644 index 0000000000..603420e627 Binary files /dev/null and b/windows/manage/images/packageaddfileandregistrydata.png differ diff --git a/windows/manage/images/settings-table.png b/windows/manage/images/settings-table.png deleted file mode 100644 index 6b77ce6002..0000000000 Binary files a/windows/manage/images/settings-table.png and /dev/null differ diff --git a/windows/manage/images/spotlight2.png b/windows/manage/images/spotlight2.png new file mode 100644 index 0000000000..27401c1a2b Binary files /dev/null and b/windows/manage/images/spotlight2.png differ diff --git a/windows/manage/images/sysprep-error.png b/windows/manage/images/sysprep-error.png new file mode 100644 index 0000000000..aa004efbb6 Binary files /dev/null and b/windows/manage/images/sysprep-error.png differ diff --git a/windows/manage/images/twain.png b/windows/manage/images/twain.png new file mode 100644 index 0000000000..53cd5eadc7 Binary files /dev/null and b/windows/manage/images/twain.png differ diff --git a/windows/manage/images/uev-adk-select-uev-feature.png b/windows/manage/images/uev-adk-select-uev-feature.png new file mode 100644 index 0000000000..1556f115c0 Binary files /dev/null and b/windows/manage/images/uev-adk-select-uev-feature.png differ diff --git a/windows/manage/images/uev-archdiagram.png b/windows/manage/images/uev-archdiagram.png new file mode 100644 index 0000000000..eae098e666 Binary files /dev/null and b/windows/manage/images/uev-archdiagram.png differ diff --git a/windows/manage/images/uev-checklist-box.gif b/windows/manage/images/uev-checklist-box.gif new file mode 100644 index 0000000000..8af13c51d1 Binary files /dev/null and b/windows/manage/images/uev-checklist-box.gif differ diff --git a/windows/manage/images/uev-deployment-preparation.png b/windows/manage/images/uev-deployment-preparation.png new file mode 100644 index 0000000000..b665a0bfea Binary files /dev/null and b/windows/manage/images/uev-deployment-preparation.png differ diff --git a/windows/manage/images/uev-generator-process.png b/windows/manage/images/uev-generator-process.png new file mode 100644 index 0000000000..e16cedd0a7 Binary files /dev/null and b/windows/manage/images/uev-generator-process.png differ diff --git a/windows/manage/images/waas-do-fig1.png b/windows/manage/images/waas-do-fig1.png new file mode 100644 index 0000000000..e739d0b670 Binary files /dev/null and b/windows/manage/images/waas-do-fig1.png differ diff --git a/windows/manage/images/waas-do-fig2.png b/windows/manage/images/waas-do-fig2.png new file mode 100644 index 0000000000..0c315fddaa Binary files /dev/null and b/windows/manage/images/waas-do-fig2.png differ diff --git a/windows/manage/images/waas-do-fig3.png b/windows/manage/images/waas-do-fig3.png new file mode 100644 index 0000000000..66ac342b51 Binary files /dev/null and b/windows/manage/images/waas-do-fig3.png differ diff --git a/windows/manage/images/waas-do-fig4.png b/windows/manage/images/waas-do-fig4.png new file mode 100644 index 0000000000..3de9605bac Binary files /dev/null and b/windows/manage/images/waas-do-fig4.png differ diff --git a/windows/manage/images/waas-overview-patch.png b/windows/manage/images/waas-overview-patch.png new file mode 100644 index 0000000000..b16c211c59 Binary files /dev/null and b/windows/manage/images/waas-overview-patch.png differ diff --git a/windows/manage/images/waas-overview-timeline.png b/windows/manage/images/waas-overview-timeline.png new file mode 100644 index 0000000000..8488b2b680 Binary files /dev/null and b/windows/manage/images/waas-overview-timeline.png differ diff --git a/windows/manage/images/waas-rings.png b/windows/manage/images/waas-rings.png new file mode 100644 index 0000000000..a5446f3dff Binary files /dev/null and b/windows/manage/images/waas-rings.png differ diff --git a/windows/manage/images/waas-sccm-fig1.png b/windows/manage/images/waas-sccm-fig1.png new file mode 100644 index 0000000000..7557888301 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig1.png differ diff --git a/windows/manage/images/waas-sccm-fig10.png b/windows/manage/images/waas-sccm-fig10.png new file mode 100644 index 0000000000..b029618b67 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig10.png differ diff --git a/windows/manage/images/waas-sccm-fig11.png b/windows/manage/images/waas-sccm-fig11.png new file mode 100644 index 0000000000..fc6528e7ef Binary files /dev/null and b/windows/manage/images/waas-sccm-fig11.png differ diff --git a/windows/manage/images/waas-sccm-fig12.png b/windows/manage/images/waas-sccm-fig12.png new file mode 100644 index 0000000000..87464dd5f1 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig12.png differ diff --git a/windows/manage/images/waas-sccm-fig2.png b/windows/manage/images/waas-sccm-fig2.png new file mode 100644 index 0000000000..a1d7183a7c Binary files /dev/null and b/windows/manage/images/waas-sccm-fig2.png differ diff --git a/windows/manage/images/waas-sccm-fig3.png b/windows/manage/images/waas-sccm-fig3.png new file mode 100644 index 0000000000..cd406d9c5d Binary files /dev/null and b/windows/manage/images/waas-sccm-fig3.png differ diff --git a/windows/manage/images/waas-sccm-fig4.png b/windows/manage/images/waas-sccm-fig4.png new file mode 100644 index 0000000000..782c5ca6ef Binary files /dev/null and b/windows/manage/images/waas-sccm-fig4.png differ diff --git a/windows/manage/images/waas-sccm-fig5.png b/windows/manage/images/waas-sccm-fig5.png new file mode 100644 index 0000000000..5f215dec58 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig5.png differ diff --git a/windows/manage/images/waas-sccm-fig6.png b/windows/manage/images/waas-sccm-fig6.png new file mode 100644 index 0000000000..bd7df6f6d2 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig6.png differ diff --git a/windows/manage/images/waas-sccm-fig7.png b/windows/manage/images/waas-sccm-fig7.png new file mode 100644 index 0000000000..5b7c37b6a1 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig7.png differ diff --git a/windows/manage/images/waas-sccm-fig8.png b/windows/manage/images/waas-sccm-fig8.png new file mode 100644 index 0000000000..1db4dae84a Binary files /dev/null and b/windows/manage/images/waas-sccm-fig8.png differ diff --git a/windows/manage/images/waas-sccm-fig9.png b/windows/manage/images/waas-sccm-fig9.png new file mode 100644 index 0000000000..632b859232 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig9.png differ diff --git a/windows/manage/images/waas-strategy-fig1.png b/windows/manage/images/waas-strategy-fig1.png new file mode 100644 index 0000000000..c12cc660de Binary files /dev/null and b/windows/manage/images/waas-strategy-fig1.png differ diff --git a/windows/manage/images/waas-wsus-fig1.png b/windows/manage/images/waas-wsus-fig1.png new file mode 100644 index 0000000000..1d0dd4cc6b Binary files /dev/null and b/windows/manage/images/waas-wsus-fig1.png differ diff --git a/windows/manage/images/waas-wsus-fig10.png b/windows/manage/images/waas-wsus-fig10.png new file mode 100644 index 0000000000..fe9f6a6447 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig10.png differ diff --git a/windows/manage/images/waas-wsus-fig11.png b/windows/manage/images/waas-wsus-fig11.png new file mode 100644 index 0000000000..0ad08f70c2 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig11.png differ diff --git a/windows/manage/images/waas-wsus-fig12.png b/windows/manage/images/waas-wsus-fig12.png new file mode 100644 index 0000000000..fa9fb5c7a4 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig12.png differ diff --git a/windows/manage/images/waas-wsus-fig13.png b/windows/manage/images/waas-wsus-fig13.png new file mode 100644 index 0000000000..d2e916dc48 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig13.png differ diff --git a/windows/manage/images/waas-wsus-fig14.png b/windows/manage/images/waas-wsus-fig14.png new file mode 100644 index 0000000000..a0c8e30736 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig14.png differ diff --git a/windows/manage/images/waas-wsus-fig15.png b/windows/manage/images/waas-wsus-fig15.png new file mode 100644 index 0000000000..fd59e9ce23 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig15.png differ diff --git a/windows/manage/images/waas-wsus-fig16.png b/windows/manage/images/waas-wsus-fig16.png new file mode 100644 index 0000000000..57a34228d9 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig16.png differ diff --git a/windows/manage/images/waas-wsus-fig17.png b/windows/manage/images/waas-wsus-fig17.png new file mode 100644 index 0000000000..13e755e456 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig17.png differ diff --git a/windows/manage/images/waas-wsus-fig18.png b/windows/manage/images/waas-wsus-fig18.png new file mode 100644 index 0000000000..0b13e936fb Binary files /dev/null and b/windows/manage/images/waas-wsus-fig18.png differ diff --git a/windows/manage/images/waas-wsus-fig19.png b/windows/manage/images/waas-wsus-fig19.png new file mode 100644 index 0000000000..b67d17a56e Binary files /dev/null and b/windows/manage/images/waas-wsus-fig19.png differ diff --git a/windows/manage/images/waas-wsus-fig2.png b/windows/manage/images/waas-wsus-fig2.png new file mode 100644 index 0000000000..ff273ea10f Binary files /dev/null and b/windows/manage/images/waas-wsus-fig2.png differ diff --git a/windows/manage/images/waas-wsus-fig20.png b/windows/manage/images/waas-wsus-fig20.png new file mode 100644 index 0000000000..58fa43444f Binary files /dev/null and b/windows/manage/images/waas-wsus-fig20.png differ diff --git a/windows/manage/images/waas-wsus-fig3.png b/windows/manage/images/waas-wsus-fig3.png new file mode 100644 index 0000000000..1247e2f874 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig3.png differ diff --git a/windows/manage/images/waas-wsus-fig4.png b/windows/manage/images/waas-wsus-fig4.png new file mode 100644 index 0000000000..9fbc673814 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig4.png differ diff --git a/windows/manage/images/waas-wsus-fig5.png b/windows/manage/images/waas-wsus-fig5.png new file mode 100644 index 0000000000..7068f487cd Binary files /dev/null and b/windows/manage/images/waas-wsus-fig5.png differ diff --git a/windows/manage/images/waas-wsus-fig6.png b/windows/manage/images/waas-wsus-fig6.png new file mode 100644 index 0000000000..6256f5d617 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig6.png differ diff --git a/windows/manage/images/waas-wsus-fig7.png b/windows/manage/images/waas-wsus-fig7.png new file mode 100644 index 0000000000..69d3e6fe6f Binary files /dev/null and b/windows/manage/images/waas-wsus-fig7.png differ diff --git a/windows/manage/images/waas-wsus-fig8.png b/windows/manage/images/waas-wsus-fig8.png new file mode 100644 index 0000000000..8ec17f2741 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig8.png differ diff --git a/windows/manage/images/waas-wsus-fig9.png b/windows/manage/images/waas-wsus-fig9.png new file mode 100644 index 0000000000..dd430897ff Binary files /dev/null and b/windows/manage/images/waas-wsus-fig9.png differ diff --git a/windows/manage/images/waas-wufb-gp-broad.png b/windows/manage/images/waas-wufb-gp-broad.png new file mode 100644 index 0000000000..9fdd9e97f1 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-broad.png differ diff --git a/windows/manage/images/waas-wufb-gp-cb2-settings.png b/windows/manage/images/waas-wufb-gp-cb2-settings.png new file mode 100644 index 0000000000..97dc6ce41a Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cb2-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-cb2.png b/windows/manage/images/waas-wufb-gp-cb2.png new file mode 100644 index 0000000000..9be7638ed7 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cb2.png differ diff --git a/windows/manage/images/waas-wufb-gp-cbb1-settings.png b/windows/manage/images/waas-wufb-gp-cbb1-settings.png new file mode 100644 index 0000000000..dae9866faf Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cbb1-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-cbb2-settings.png b/windows/manage/images/waas-wufb-gp-cbb2-settings.png new file mode 100644 index 0000000000..2aa7bc212c Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cbb2-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-cbb2q-settings.png b/windows/manage/images/waas-wufb-gp-cbb2q-settings.png new file mode 100644 index 0000000000..8076b5a99e Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cbb2q-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-create.png b/windows/manage/images/waas-wufb-gp-create.png new file mode 100644 index 0000000000..63c2ce74aa Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-create.png differ diff --git a/windows/manage/images/waas-wufb-gp-edit-defer.png b/windows/manage/images/waas-wufb-gp-edit-defer.png new file mode 100644 index 0000000000..40da5b7709 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-edit-defer.png differ diff --git a/windows/manage/images/waas-wufb-gp-edit.png b/windows/manage/images/waas-wufb-gp-edit.png new file mode 100644 index 0000000000..e39bc829ff Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-edit.png differ diff --git a/windows/manage/images/waas-wufb-gp-scope-cb2.png b/windows/manage/images/waas-wufb-gp-scope-cb2.png new file mode 100644 index 0000000000..bb29adf5e1 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-scope-cb2.png differ diff --git a/windows/manage/images/waas-wufb-gp-scope.png b/windows/manage/images/waas-wufb-gp-scope.png new file mode 100644 index 0000000000..b8e6863c82 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-scope.png differ diff --git a/windows/manage/images/waas-wufb-intune-cb2.png b/windows/manage/images/waas-wufb-intune-cb2.png new file mode 100644 index 0000000000..3e8c1ce19e Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-cb2.png differ diff --git a/windows/manage/images/waas-wufb-intune-cbb1.png b/windows/manage/images/waas-wufb-intune-cbb1.png new file mode 100644 index 0000000000..6f1e815334 Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-cbb1.png differ diff --git a/windows/manage/images/waas-wufb-intune-cbb2.png b/windows/manage/images/waas-wufb-intune-cbb2.png new file mode 100644 index 0000000000..b8eef5bb5e Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-cbb2.png differ diff --git a/windows/manage/images/waas-wufb-intune-step11.png b/windows/manage/images/waas-wufb-intune-step11.png new file mode 100644 index 0000000000..48db2f63af Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step11.png differ diff --git a/windows/manage/images/waas-wufb-intune-step19.png b/windows/manage/images/waas-wufb-intune-step19.png new file mode 100644 index 0000000000..5a68ca7211 Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step19.png differ diff --git a/windows/manage/images/waas-wufb-intune-step2.png b/windows/manage/images/waas-wufb-intune-step2.png new file mode 100644 index 0000000000..1c7a8a1cae Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step2.png differ diff --git a/windows/manage/images/waas-wufb-intune-step7.png b/windows/manage/images/waas-wufb-intune-step7.png new file mode 100644 index 0000000000..daa96ba18c Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step7.png differ diff --git a/windows/manage/images/wsfb-distribute.png b/windows/manage/images/wsfb-distribute.png index f276ca5211..d0482f6ebe 100644 Binary files a/windows/manage/images/wsfb-distribute.png and b/windows/manage/images/wsfb-distribute.png differ diff --git a/windows/manage/images/wsfb-inventory.png b/windows/manage/images/wsfb-inventory.png new file mode 100644 index 0000000000..b060fb30e4 Binary files /dev/null and b/windows/manage/images/wsfb-inventory.png differ diff --git a/windows/manage/images/wsfb-inventoryaddprivatestore.png b/windows/manage/images/wsfb-inventoryaddprivatestore.png index b7152ea973..bb1152e35b 100644 Binary files a/windows/manage/images/wsfb-inventoryaddprivatestore.png and b/windows/manage/images/wsfb-inventoryaddprivatestore.png differ diff --git a/windows/manage/images/wsfb-private-store-gpo.PNG b/windows/manage/images/wsfb-private-store-gpo.PNG new file mode 100644 index 0000000000..5e7fe44ec2 Binary files /dev/null and b/windows/manage/images/wsfb-private-store-gpo.PNG differ diff --git a/windows/manage/images/wufb-config1.png b/windows/manage/images/wufb-config1.png new file mode 100644 index 0000000000..76185e86fe Binary files /dev/null and b/windows/manage/images/wufb-config1.png differ diff --git a/windows/manage/images/wufb-config2.png b/windows/manage/images/wufb-config2.png new file mode 100644 index 0000000000..0ab09d4868 Binary files /dev/null and b/windows/manage/images/wufb-config2.png differ diff --git a/windows/manage/images/wufb-config3.png b/windows/manage/images/wufb-config3.png new file mode 100644 index 0000000000..a76d1569be Binary files /dev/null and b/windows/manage/images/wufb-config3.png differ diff --git a/windows/manage/images/wufb-do.png b/windows/manage/images/wufb-do.png new file mode 100644 index 0000000000..8d6c9d0b8a Binary files /dev/null and b/windows/manage/images/wufb-do.png differ diff --git a/windows/manage/images/wufb-groups.png b/windows/manage/images/wufb-groups.png new file mode 100644 index 0000000000..13cdea04b0 Binary files /dev/null and b/windows/manage/images/wufb-groups.png differ diff --git a/windows/manage/images/wufb-pause-feature.png b/windows/manage/images/wufb-pause-feature.png new file mode 100644 index 0000000000..afeac43e29 Binary files /dev/null and b/windows/manage/images/wufb-pause-feature.png differ diff --git a/windows/manage/images/wufb-qual.png b/windows/manage/images/wufb-qual.png new file mode 100644 index 0000000000..4a93408522 Binary files /dev/null and b/windows/manage/images/wufb-qual.png differ diff --git a/windows/manage/images/wufb-sccm.png b/windows/manage/images/wufb-sccm.png new file mode 100644 index 0000000000..1d568c1fe4 Binary files /dev/null and b/windows/manage/images/wufb-sccm.png differ diff --git a/windows/manage/index.md b/windows/manage/index.md index 28f9aa851f..6f91d1ac21 100644 --- a/windows/manage/index.md +++ b/windows/manage/index.md @@ -30,40 +30,45 @@ Learn about managing and updating Windows 10.

    [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md)

    -

    The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments.

    - - -

    [Manage corporate devices](manage-corporate-devices.md)

    -

    You can use the same management tools to manage all device types running Windows 10 : desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, Orchestrator runbooks, System Center tools, and so on, will continue to work for Windows 10 on desktop editions.

    +

    The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments.

    +

    [Manage corporate devices](manage-corporate-devices.md)

    +

    You can use the same management tools to manage all device types running Windows 10: desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, Orchestrator runbooks, System Center tools, and so on, will continue to work for Windows 10 on desktop editions.

    +

    [Windows Spotlight on the lock screen](windows-spotlight.md)

    +

    Windows Spotlight is an option for the lock screen background that displays different background images and occasionally offers suggestions on the lock screen.

    + +

    [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md)

    Organizations might want to deploy a customized Start screen and menu to devices running Windows 10 Enterprise or Windows 10 Education. A standard Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes.

    - +

    [Create mandatory user profiles](mandatory-user-profile.md)

    Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings.

    +

    [Lock down Windows 10](lock-down-windows-10.md)

    Enterprises often need to manage how people use corporate devices. Windows 10 provides a number of features and methods to help you lock down specific parts of a Windows 10 device.

    - +

    [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md)

    Devices running Windows 10 Mobile can join Azure Active Directory (Azure AD) when the device is configured during the out-of-box experience (OOBE).

    - +

    [Configure devices without MDM](configure-devices-without-mdm.md)

    Create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile, or Windows 10 Mobile Enterprise.

    +[Windows 10 servicing options](introduction-to-windows-10-servicing.md)This article describes the new servicing options available in Windows 10, Windows 10 Mobile, and Windows 10 IoT Core (IoT Core) and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles. + +

    [Application Virtualization for Windows (App-V)](appv-for-windows.md)

    +

    When you deploy Application Virtualization (App-V) in your orgnazation, you can deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points, including the Windows Store, and interact with them as if they were installed locally.

    + -

    [Windows 10 servicing options](introduction-to-windows-10-servicing.md)

    -

    This article describes the new servicing options available in Windows 10, Windows 10 Mobile, and Windows 10 IoT Core (IoT Core) and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles.

    +

    [User Experience Virtualization for Windows (UE-V)](uev-for-windows.md)

    +

    When you deploy User Experience Virtualization (UE-V) in your organization, you can synchronize users' personalized application and operating system settings across all the devices they work from. UE-V allows you to capture user-customized application and Windows settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.

    -

    [Application development for Windows as a service](application-development-for-windows-as-a-service.md)

    -

    In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. Additionally, new releases must be made available on a continual basis, and must be deployable with minimal impact on users. Microsoft designed Windows 10 to meet these requirements by implementing a new approach to innovation, development, and delivery called [Windows as a service (WaaS)](introduction-to-windows-10-servicing.md). The key to enabling significantly shorter product cycles while maintaining high quality levels is an innovative community-centric approach to testing that Microsoft has implemented for Windows 10. The community, known as Windows Insiders, is comprised of millions of users around the world. When Windows Insiders opt in to the community, they test many builds over the course of a product cycle and provide feedback to Microsoft through an iterative methodology called flighting.

    - -

    [Windows Store for Business](windows-store-for-business.md)

    Welcome to the Windows Store for Business! You can use the Store for Business, to find, acquire, distribute, and manage apps for your organization.

    - + +

    [Change history for Manage and update Windows 10](change-history-for-manage-and-update-windows-10.md)

    This topic lists new and updated topics in the Manage and update Windows 10 documentation for [Windows 10 and Windows 10 Mobile](../index.md).

    @@ -72,5 +77,6 @@ Learn about managing and updating Windows 10.   ## Related topics [Windows 10 and Windows 10 Mobile](../index.md) +   - [Learn how Microsoft does IT at the IT Showcase](https://www.microsoft.com/itshowcase) +[Learn how Microsoft does IT at the IT Showcase](https://www.microsoft.com/itshowcase) diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index 8e531b3827..65114bd167 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, servicing -author: greg-lindsay +author: jdeckerMS --- # Windows 10 servicing options @@ -108,7 +108,7 @@ At the end of each approximately four month period, Microsoft executes a set of **The role of Windows Update for Business** -Although Windows 10 will enable IT administrators to defer installation of new feature upgrades using Windows Update, enterprises may also want additional control over how and when Windows Update installs releases. With this need in mind, Microsoft [announced Windows Update for Business](http://go.microsoft.com/fwlink/p/?LinkId=624798) in May of 2015. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing releases. This article will be updated with additional information about the role of Windows Update for Business in servicing Windows 10 devices as it becomes available. +Although Windows 10 will enable IT administrators to defer installation of new feature upgrades using Windows Update, enterprises may also want additional control over how and when Windows Update installs releases. With this need in mind, Microsoft [announced Windows Update for Business](https://go.microsoft.com/fwlink/p/?LinkId=624798) in May of 2015. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing releases. This article will be updated with additional information about the role of Windows Update for Business in servicing Windows 10 devices as it becomes available. ## Windows 10 servicing branches @@ -485,8 +485,8 @@ universal apps removed [Plan for Windows 10 deployment](../plan/index.md) -[Deploy Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624776) +[Deploy Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=624776) -[Manage and update Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624796) +[Manage and update Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=624796)     diff --git a/windows/manage/join-windows-10-mobile-to-azure-active-directory.md b/windows/manage/join-windows-10-mobile-to-azure-active-directory.md index 3a8047bf80..6c398d7d27 100644 --- a/windows/manage/join-windows-10-mobile-to-azure-active-directory.md +++ b/windows/manage/join-windows-10-mobile-to-azure-active-directory.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile author: jdeckerMS +localizationpriority: high --- # Join Windows 10 Mobile to Azure Active Directory @@ -25,7 +26,7 @@ When a device running Windows 10 Mobile is joined to Azure AD, the device can e - Single sign-on (SSO) in applications like Mail, Word, and OneDrive using resources backed by Azure AD. -- SSO in Microsoft Edge browser to Azure AD-connected web applications like Office 365 Portal, Visual Studio, and more than [2500 non-Microsoft apps](http://go.microsoft.com/fwlink/p/?LinkID=746211). +- SSO in Microsoft Edge browser to Azure AD-connected web applications like Office 365 Portal, Visual Studio, and more than [2500 non-Microsoft apps](https://go.microsoft.com/fwlink/p/?LinkID=746211). - SSO to resources on-premises. @@ -40,7 +41,7 @@ When a device running Windows 10 Mobile is joined to Azure AD, the device can e Windows Phone 8.1 only supported the ability to connect the device to personal cloud services using a Microsoft account for authentication. This required creating Microsoft accounts to be used for work purposes. In Windows 10 Mobile, you have the ability to join devices directly to Azure AD without requiring a personal Microsoft account. -If you have existing Windows Phone 8.1 devices, the first thing to understand is whether the devices you have can be upgraded to Windows 10 Mobile. Microsoft will be releasing more information about upgrade availability soon. As more information becomes available, it will be posted at [How to get Windows 10 Mobile]( http://go.microsoft.com/fwlink/p/?LinkId=746312). Premier Enterprise customers that have a business need to postpone Windows 10 Mobile upgrade should contact their Technical Account Manager to understand what options may be available. +If you have existing Windows Phone 8.1 devices, the first thing to understand is whether the devices you have can be upgraded to Windows 10 Mobile. Microsoft will be releasing more information about upgrade availability soon. As more information becomes available, it will be posted at [How to get Windows 10 Mobile]( https://go.microsoft.com/fwlink/p/?LinkId=746312). Premier Enterprise customers that have a business need to postpone Windows 10 Mobile upgrade should contact their Technical Account Manager to understand what options may be available. Before upgrading and joining devices to Azure AD, you will want to consider existing data usage. How users are using the existing devices and what data is stored locally will vary for every customer. Are text messages used for work purposes and need to be backed up and available after the upgrade? Are there photos stored locally or stored associated with an Microsoft account? Are there device and app settings that to be retained? Are there contacts stored in the SIM or associated with an Microsoft account? You will need to explore methods for capturing and storing the data that needs to be retained before you join the devices to Azure AD. Photos, music files, and documents stored locally on the device can be copied from the device using a USB connection to a PC. @@ -57,9 +58,9 @@ Even though Azure AD Join on Windows 10 Mobile provides the best overall experi - You can add access to Azure AD-backed resources on the device without resetting the device. -However, neither of these methods provides SSO in the Windows Store or SSO to resources on-premises, and does not provide the ability to roam settings based on the Azure AD account using enterprise roaming. [Learn about enterprise state roaming in Azure AD.](http://go.microsoft.com/fwlink/p/?LinkId=734996) +However, neither of these methods provides SSO in the Windows Store or SSO to resources on-premises, and does not provide the ability to roam settings based on the Azure AD account using enterprise roaming. [Learn about enterprise state roaming in Azure AD.](https://go.microsoft.com/fwlink/p/?LinkId=734996) -Using **Settings** > **Accounts** > **Your email and accounts** > **Add work or school account**, users can add their Azure AD account to the device. Alternatively, a work account can be added when the user signs in to an application like Mail, Word, etc. If you [enable auto-enrollment in your MDM settings](http://go.microsoft.com/fwlink/p/?LinkID=691615), the device will automatically be enrolled in MDM. +Using **Settings** > **Accounts** > **Your email and accounts** > **Add work or school account**, users can add their Azure AD account to the device. Alternatively, a work account can be added when the user signs in to an application like Mail, Word, etc. If you [enable auto-enrollment in your MDM settings](https://go.microsoft.com/fwlink/p/?LinkID=691615), the device will automatically be enrolled in MDM. An added work account provides the same SSO experience in browser apps like Office 365 (Office portal, Outlook Web Access, Calendar, People, OneDrive), Azure AD profile and change password app, and Visual Studio. You get SSO to built-in applications like Mail, Calendar, People, OneDrive and files hosted on OneDrive without prompts for a password. In Office apps like Microsoft Word, Microsoft Excel, etc., you simply select the Azure AD account and you are able to open files without entering a password. @@ -70,7 +71,7 @@ An added work account provides the same SSO experience in browser apps like Offi Currently, Azure AD Join only supports self-provisioning, meaning the credentials of the user of the device must be used during the initial setup of the device. If your mobile operator prepares devices on your behalf, this will impact your ability to join the device to Azure AD. Many IT administrators may start with a desire to set up devices for their employees, but the Azure AD Join experience is optimized for end-users, including the option for automatic MDM enrollment. - By default, Azure AD is set up to allow devices to join and to allow users to use their corporate credentials on organizational-owned devices or personal devices. The blog post [Azure AD Join on Windows 10 devices](http://go.microsoft.com/fwlink/p/?LinkID=616791) has more information on where you can review your Azure AD settings. You can configure Azure AD to not allow anyone to join, to allow everyone in your organization to join, or you can select specific Azure AD groups which are allowed to join. + By default, Azure AD is set up to allow devices to join and to allow users to use their corporate credentials on organizational-owned devices or personal devices. The blog post [Azure AD Join on Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkID=616791) has more information on where you can review your Azure AD settings. You can configure Azure AD to not allow anyone to join, to allow everyone in your organization to join, or you can select specific Azure AD groups which are allowed to join. - **Device setup** @@ -78,11 +79,11 @@ An added work account provides the same SSO experience in browser apps like Offi - **Mobile device management** - An MDM service is required for managing Azure AD-joined devices. You can use MDM to push settings to devices, as well as application and certificates used by VPN, Wi-Fi, etc. Azure AD Premium or [Enterprise Mobility Suite (EMS)](http://go.microsoft.com/fwlink/p/?LinkID=723984) licenses are required to set up your Azure AD-joined devices to automatically enroll in MDM. [Learn more about setting up your Azure AD tenant for MDM auto-enrollment.](http://go.microsoft.com/fwlink/p/?LinkID=691615) + An MDM service is required for managing Azure AD-joined devices. You can use MDM to push settings to devices, as well as application and certificates used by VPN, Wi-Fi, etc. Azure AD Premium or [Enterprise Mobility Suite (EMS)](https://go.microsoft.com/fwlink/p/?LinkID=723984) licenses are required to set up your Azure AD-joined devices to automatically enroll in MDM. [Learn more about setting up your Azure AD tenant for MDM auto-enrollment.](https://go.microsoft.com/fwlink/p/?LinkID=691615) - **Microsoft Passport** - Creating a Microsoft Passport (PIN) is required on Windows 10 Mobile by default and cannot be disabled. [You can control Microsoft Passport policies](http://go.microsoft.com/fwlink/p/?LinkId=735079) using controls in MDM, such as Intune. Because the device is joined using organizational credentials, the device must have a PIN to unlock the device. Windows Hello (biometrics such as fingerprint or iris) can be used for Passport authentication. Creating a Microsoft Passport requires the user to perform an multi-factor authentication since the PIN is a strong authentication credential. [Learn more about Microsoft Passport for Azure AD.](http://go.microsoft.com/fwlink/p/?LinkId=735004) + Creating a Microsoft Passport (PIN) is required on Windows 10 Mobile by default and cannot be disabled. [You can control Microsoft Passport policies](https://go.microsoft.com/fwlink/p/?LinkId=735079) using controls in MDM, such as Intune. Because the device is joined using organizational credentials, the device must have a PIN to unlock the device. Windows Hello (biometrics such as fingerprint or iris) can be used for Passport authentication. Creating a Microsoft Passport requires the user to perform an multi-factor authentication since the PIN is a strong authentication credential. [Learn more about Microsoft Passport for Azure AD.](https://go.microsoft.com/fwlink/p/?LinkId=735004) - **Conditional access** diff --git a/windows/manage/lock-down-windows-10-to-specific-apps.md b/windows/manage/lock-down-windows-10-to-specific-apps.md index 232ab26d13..a585ae2a4f 100644 --- a/windows/manage/lock-down-windows-10-to-specific-apps.md +++ b/windows/manage/lock-down-windows-10-to-specific-apps.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: edu, security author: jdeckerMS +localizationpriority: high --- # Lock down Windows 10 to specific apps @@ -107,13 +108,17 @@ In addition to specifying the apps that users can run, you should also restrict   -To learn more about locking down features, see [Customizations for Windows 10 Enterprise](http://go.microsoft.com/fwlink/p/?LinkId=691442). +To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). ## Customize Start screen layout for the device Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). +## Related topics + +- [Provisioning packages for Windows 10](../deploy/provisioning-packages.md) +     diff --git a/windows/manage/lock-down-windows-10.md b/windows/manage/lock-down-windows-10.md index 23461ca922..a3374f6d0f 100644 --- a/windows/manage/lock-down-windows-10.md +++ b/windows/manage/lock-down-windows-10.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, mobile author: jdeckerMS +localizationpriority: high --- # Lock down Windows 10 diff --git a/windows/manage/lockdown-features-windows-10.md b/windows/manage/lockdown-features-windows-10.md index b0d0851d25..c6eaa7e68d 100644 --- a/windows/manage/lockdown-features-windows-10.md +++ b/windows/manage/lockdown-features-windows-10.md @@ -8,13 +8,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS +localizationpriority: high --- # Lockdown features from Windows Embedded 8.1 Industry **Applies to** - Windows 10 -- Windows 10 Mobile + Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. This table maps Windows Embedded Industry 8.1 features to Windows 10 Enterprise features, along with links to documentation. @@ -33,33 +34,33 @@ Many of the lockdown features available in Windows Embedded 8.1 Industry have be -

    [Hibernate Once/Resume Many (HORM)](http://go.microsoft.com/fwlink/p/?LinkId=626758): Quick boot to device

    +

    [Hibernate Once/Resume Many (HORM)](https://go.microsoft.com/fwlink/p/?LinkId=626758): Quick boot to device

    N/A

    HORM is supported in Windows 10, version 1607.

    -

    [Unified Write Filter](http://go.microsoft.com/fwlink/p/?LinkId=626757): protect a device's physical storage media

    -[Unified Write Filter](http://go.microsoft.com/fwlink/p/?LinkId=626607) +

    [Unified Write Filter](https://go.microsoft.com/fwlink/p/?LinkId=626757): protect a device's physical storage media

    +[Unified Write Filter](https://msdn.microsoft.com/en-us/library/windows/hardware/mt572001.aspx)

    The Unified Write Filter is continued in Windows 10, with the exception of HORM which has been deprecated.

    -

    [Keyboard Filter]( http://go.microsoft.com/fwlink/p/?LinkId=626761): block hotkeys and other key combinations

    -[Keyboard Filter](http://go.microsoft.com/fwlink/p/?LinkId=708391) +

    [Keyboard Filter]( https://go.microsoft.com/fwlink/p/?LinkId=626761): block hotkeys and other key combinations

    +[Keyboard Filter](https://go.microsoft.com/fwlink/p/?LinkId=708391)

    Keyboard filter is added in Windows 10, version 1511. As in Windows Embedded Industry 8.1, Keyboard Filter is an optional component that can be turned on via Turn Windows Features On/Off. Keyboard Filter (in addition to the WMI configuration previously available) will be configurable through Windows Imaging and Configuration Designer (ICD) in the SMISettings path.

    -

    [Shell Launcher](http://go.microsoft.com/fwlink/p/?LinkId=626676): launch a Classic Windows application on sign-on

    -[Shell Launcher](http://go.microsoft.com/fwlink/p/?LinkId=618603) +

    [Shell Launcher](https://go.microsoft.com/fwlink/p/?LinkId=626676): launch a Classic Windows application on sign-on

    +[Shell Launcher](https://go.microsoft.com/fwlink/p/?LinkId=618603)

    Shell Launcher continues in Windows 10. It is now configurable in Windows ICD under the SMISettings category.

    -

    Learn [how to use Shell Launcher to create a kiosk device](http://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Classic Windows application.

    +

    Learn [how to use Shell Launcher to create a kiosk device](https://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Classic Windows application.

    -

    [Application Launcher]( http://go.microsoft.com/fwlink/p/?LinkId=626675): launch a Universal Windows Platform (UWP) app on sign-on

    -[Assigned Access](http://go.microsoft.com/fwlink/p/?LinkId=626608) +

    [Application Launcher]( https://go.microsoft.com/fwlink/p/?LinkId=626675): launch a Universal Windows Platform (UWP) app on sign-on

    +[Assigned Access](https://go.microsoft.com/fwlink/p/?LinkId=626608)

    The Windows 8 Application Launcher has been consolidated into Assigned Access. Application Launcher enabled launching a Windows 8 app and holding focus on that app. Assigned Access offers a more robust solution for ensuring that apps retain focus.

    -

    [Dialog Filter](http://go.microsoft.com/fwlink/p/?LinkId=626762): suppress system dialogs and control which processes can run

    +

    [Dialog Filter](https://go.microsoft.com/fwlink/p/?LinkId=626762): suppress system dialogs and control which processes can run

    [AppLocker](../keep-secure/applocker-overview.md)

    Dialog Filter has been deprecated for Windows 10. Dialog Filter provided two capabilities; the ability to control which processes were able to run, and the ability to prevent dialogs (in practice, system dialogs) from appearing.

      @@ -68,44 +69,44 @@ Many of the lockdown features available in Windows Embedded 8.1 Industry have be
    -

    [Toast Notification Filter]( http://go.microsoft.com/fwlink/p/?LinkId=626673): suppress toast notifications

    +

    [Toast Notification Filter]( https://go.microsoft.com/fwlink/p/?LinkId=626673): suppress toast notifications

    Mobile device management (MDM) and Group Policy

    Toast Notification Filter has been replaced by MDM and Group Policy settings for blocking the individual components of non-critical system toasts that may appear. For example, to prevent a toast from appearing when a USB drive is connected, ensure that USB connections have been blocked using the USB-related policies, and turn off notifications from apps.

    Group Policy: User Configuration > Administrative Templates > Start Menu and Taskbar > Notifications

    -

    MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow action center notifications and a [custom OMA-URI setting](http://go.microsoft.com/fwlink/p/?LinkID=616317) for AboveLock/AllowActionCenterNotifications.

    +

    MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow action center notifications and a [custom OMA-URI setting](https://go.microsoft.com/fwlink/p/?LinkID=616317) for AboveLock/AllowActionCenterNotifications.

    -

    [Embedded Lockdown Manager](http://go.microsoft.com/fwlink/p/?LinkId=626763): configure lockdown features

    -[Windows Imaging and Configuration Designer (ICD)](http://go.microsoft.com/fwlink/p/?LinkID=525483) +

    [Embedded Lockdown Manager](https://go.microsoft.com/fwlink/p/?LinkId=626763): configure lockdown features

    +[Windows Imaging and Configuration Designer (ICD)](https://go.microsoft.com/fwlink/p/?LinkID=525483)

    The Embedded Lockdown Manager has been deprecated for Windows 10 and replaced by the Windows ICD. Windows ICD is the consolidated tool for Windows imaging and provisioning scenarios and enables configuration of all Windows settings, including the lockdown features previously configurable through Embedded Lockdown Manager.

    -

    [USB Filter](http://go.microsoft.com/fwlink/p/?LinkId=626674): restrict USB devices and peripherals on system

    +

    [USB Filter](https://go.microsoft.com/fwlink/p/?LinkId=626674): restrict USB devices and peripherals on system

    MDM and Group Policy

    The USB Filter driver has been replaced by MDM and Group Policy settings for blocking the connection of USB devices.

    Group Policy: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions

    MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow removable storage or Allow USB connection (Windows 10 Mobile only).

    -

    [Assigned Access](http://go.microsoft.com/fwlink/p/?LinkID=613653): launch a UWP app on sign-in and lock access to system

    -[Assigned Access](http://go.microsoft.com/fwlink/p/?LinkId=626608) +

    [Assigned Access](https://go.microsoft.com/fwlink/p/?LinkID=613653): launch a UWP app on sign-in and lock access to system

    +[Assigned Access](https://go.microsoft.com/fwlink/p/?LinkId=626608)

    Assigned Access has undergone significant improvement for Windows 10. In Windows 8.1, Assigned Access blocked system hotkeys and edge gestures, and non-critical system notifications, but it also applied some of these limitations to other accounts on the device.

    In Windows 10, Assigned Access no longer affects accounts other than the one being locked down. Assigned Access now restricts access to other apps or system components by locking the device when the selected user account logs in and launching the designated app above the lock screen, ensuring that no unintended functionality can be accessed.

    -

    Learn [how to use Assigned Access to create a kiosk device](http://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Universal Windows app.

    +

    Learn [how to use Assigned Access to create a kiosk device](https://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Universal Windows app.

    -

    [Gesture Filter](http://go.microsoft.com/fwlink/p/?LinkId=626672): block swipes from top, left, and right edges of screen

    -[Assigned Access](http://go.microsoft.com/fwlink/p/?LinkId=626608) -

    The capabilities of Gesture Filter have been consolidated into Assigned Access for Windows 10. In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. For Windows 10, Charms have been removed, and blocking the closing or switching of apps is part of Assigned Access.

    +

    [Gesture Filter](https://go.microsoft.com/fwlink/p/?LinkId=626672): block swipes from top, left, and right edges of screen

    +MDM and Group Policy +

    In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. In Windows 10, Charms have been removed. In Windows 10, version 1607, you can block swipes using the [Allow edge swipe](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#LockDown_AllowEdgeSwipe) policy.

    -

    [Custom Logon]( http://go.microsoft.com/fwlink/p/?LinkId=626759): suppress Windows UI elements during Windows sign-on, sign-off, and shutdown

    -[Embedded Logon](http://go.microsoft.com/fwlink/p/?LinkId=626760) +

    [Custom Logon]( https://go.microsoft.com/fwlink/p/?LinkId=626759): suppress Windows UI elements during Windows sign-on, sign-off, and shutdown

    +[Embedded Logon](https://go.microsoft.com/fwlink/p/?LinkId=626760)

    No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.

    -

    [Unbranded Boot](http://go.microsoft.com/fwlink/p/?LinkId=626872): custom brand a device by removing or replacing Windows boot UI elements

    -[Unbranded Boot](http://go.microsoft.com/fwlink/p/?LinkId=626873) +

    [Unbranded Boot](https://go.microsoft.com/fwlink/p/?LinkId=626872): custom brand a device by removing or replacing Windows boot UI elements

    +[Unbranded Boot](https://go.microsoft.com/fwlink/p/?LinkId=626873)

    No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.

    diff --git a/windows/manage/lockdown-xml.md b/windows/manage/lockdown-xml.md index d763e5ec9b..2e5addcac7 100644 --- a/windows/manage/lockdown-xml.md +++ b/windows/manage/lockdown-xml.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, mobile author: jdeckerMS +localizationpriority: high --- # Configure Windows 10 Mobile using Lockdown XML @@ -20,9 +21,10 @@ Windows 10 Mobile allows enterprises to lock down a device, define multiple use This topic provides example XML that you can use in your own lockdown XML file that can be included in a provisioning package or when using a mobile device management (MDM) solution to push lockdown settings to enrolled devices. -Lockdown XML is an XML file that contains settings for Windows 10 Mobile. When you deploy the lockdown XML file to a device, it is saved on the device as **wehlockdown.xml**. When the device boots, it looks for wehlockdown.xml and applies any settings configured in the file. In this topic, you'll learn how to create an XML file that contains all lockdown entries available in the AssignedAccessXml area of the [EnterpriseAssignedAccess configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkID=618601). +Lockdown XML is an XML file that contains settings for Windows 10 Mobile. When you deploy the lockdown XML file to a device, it is saved on the device as **wehlockdown.xml**. When the device boots, it looks for wehlockdown.xml and applies any settings configured in the file. In this topic, you'll learn how to create an XML file that contains all lockdown entries available in the AssignedAccessXml area of the [EnterpriseAssignedAccess configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=618601). -> **Note**  On Windows 10 desktop editions, *assigned access* is a feature that lets you configure the device to run a single app above the lockscreen ([kiosk mode](set-up-a-device-for-anyone-to-use.md)). On a Windows 10 Mobile device, assigned access refers to the lockdown settings in AssignedAccessXml in the [EnterpriseAssignedAccess configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkID=618601). +> [!NOTE] +> On Windows 10 desktop editions, *assigned access* is a feature that lets you configure the device to run a single app above the lockscreen ([kiosk mode](set-up-a-device-for-anyone-to-use.md)). On a Windows 10 Mobile device, assigned access refers to the lockdown settings in AssignedAccessXml in the [EnterpriseAssignedAccess configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=618601). If you're not familiar with CSPs, read [Introduction to configuration service providers (CSPs)](how-it-pros-can-use-configuration-service-providers.md) first. @@ -211,7 +213,8 @@ Search | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](im Camera | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) Custom 1, 2, and 3 | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) -> **Note**  Custom buttons are hardware buttons that can be added to devices by OEMs. +> [!NOTE] +> Custom buttons are hardware buttons that can be added to devices by OEMs. In the following example, press-and-hold is disabled for the Back button. @@ -240,7 +243,8 @@ If you don't specify a button event, all actions for the button are disabled. In ButtonRemapList lets you change the app that a button will run. You can remap the Search button and any custom buttons included by the OEM. You can't remap the Back, Start, or Camera buttons. -> **Warning**  Button remapping can enable a user to open an application that is not in the allow list for that user role. Use button lock down to prevent application access for a user role. +> [!WARNING] +> Button remapping can enable a user to open an application that is not in the allow list for that user role. Use button lock down to prevent application access for a user role. To remap a button, you specify the button, the event, and the product ID for the app that you want the event to open. In the following example, when a user presses the Search button, the phone dialer will open instead of the Search app. @@ -262,13 +266,14 @@ In the following example, when a user presses the Search button, the phone diale ![XML for CSP Runner](images/CSPRunnerXML.jpg) -You can use CSPRunner to include settings that are not defined in AssignedAccessXML. For example, you can include settings from other sections of EnterpriseAssignedAccess CSP, such as lockscreen, theme, and time zone. You can also include settings from other CSPs, such as [Wi-Fi CSP](http://go.microsoft.com/fwlink/p/?LinkID=717460) or [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962%28v=vs.85%29.aspx). +You can use CSPRunner to include settings that are not defined in AssignedAccessXML. For example, you can include settings from other sections of EnterpriseAssignedAccess CSP, such as lockscreen, theme, and time zone. You can also include settings from other CSPs, such as [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkID=717460) or [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962%28v=vs.85%29.aspx). CSPRunner is helpful when you are configuring a device to support multiple roles. It lets you apply different policies according to the role that is signed on. For example, Wi-Fi could be enabled for a supervisor role and disabled for a stocking clerk role. In CSPRunner, you specify the CSP and settings using SyncML, a standardized markup language for device management. A SyncML section can include multiple settings, or you can use multiple SyncML sections -- it's up to you how you want to organize settings in this section. -> **Note**  This description of SyncML is just the information that you need to use SyncML in a lockdown XML file. To learn more about SyncML, see [Structure of OMA DM provisioning files](https://msdn.microsoft.com/en-us/windows/hardware/dn914774.aspx). +> [!NOTE] +> This description of SyncML is just the information that you need to use SyncML in a lockdown XML file. To learn more about SyncML, see [Structure of OMA DM provisioning files](https://msdn.microsoft.com/windows/hardware/dn914774.aspx). Let's start with the structure of SyncML in the following example: @@ -354,7 +359,9 @@ For a list of the settings and quick actions that you can allow or block, see [S ![XML for tiles](images/TilesXML.png) By default, under Assigned Access, tile manipulation is turned off (blocked) and only available if enabled in the user’s profile. If tile manipulation is enabled in the user’s profile, they can pin/unpin, move, and resize tiles based on their preferences. When multiple people use one device and you want to enable tile manipulation for multiple users, you must enable it for each user in their user profile. - > **Important** If a device is turned off then back on, the tiles reset to their predefined layout. If a device has only one profile, the only way to reset the tiles is to turn off then turn on the device. If a device has multiple profiles, the device resets the tiles to the predefined layout based on the logged-in user’s profile. + + > [!IMPORTANT] + > If a device is turned off then back on, the tiles reset to their predefined layout. If a device has only one profile, the only way to reset the tiles is to turn off then turn on the device. If a device has multiple profiles, the device resets the tiles to the predefined layout based on the logged-in user’s profile. ```xml @@ -371,7 +378,7 @@ For a list of the settings and quick actions that you can allow or block, see [S If you have existing lockdown xml, you must update start screen size if your device has >=400epx on its short axis so that tiles on Start can fill all 8 columns if you want to use all 8 columns instead of 6, or use 6 columns instead of 4. - [Learn about effective pixel width (epx) for different device size classes.](http://go.microsoft.com/fwlink/p/?LinkId=733340) + [Learn about effective pixel width (epx) for different device size classes.](https://go.microsoft.com/fwlink/p/?LinkId=733340) ## Configure additional roles @@ -421,9 +428,9 @@ For a list of the settings and quick actions that you can allow or block, see [S ## Add lockdown XML to a provisioning package -Use the Windows ICD tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) +Use the Windows ICD tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. [Install the ADK.](https://go.microsoft.com/fwlink/p/?LinkId=526740) -1. Follow the instructions at [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkID=629651) to create a project, selecting **Common to all Windows mobile editions** for your project. +1. Follow the instructions at [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkID=629651) to create a project, selecting **Common to all Windows mobile editions** for your project. 2. In **Available customizations**, go to **Runtime settings** > **EmbeddedLockdownProfiles** > **AssignedAccessXml**. @@ -460,12 +467,12 @@ Use the Windows ICD tool included in the Windows Assessment and Deployment Kit ( - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. -After you build the provisioning package, follow the instructions for [applying a provisioning package at runtime to Windows 10 Mobile](http://go.microsoft.com/fwlink/p/?LinkID=619164). +After you build the provisioning package, follow the instructions for [applying a provisioning package at runtime to Windows 10 Mobile](https://go.microsoft.com/fwlink/p/?LinkID=619164). ## Push lockdown XML using MDM -After you deploy your devices, you can still configure lockdown settings through your MDM solution if it supports the [EnterpriseAssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=618601). +After you deploy your devices, you can still configure lockdown settings through your MDM solution if it supports the [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601). To push lockdown settings to enrolled devices, use the AssignedAccessXML setting and use the lockdown XML as the value. The lockdown XML will be in a HandheldLockdown section that becomes XML embedded in XML, so the XML that you enter must use escaped characters (such as < in place of <). After the MDM provider pushes your lockdown settings to the device, the CSP processes the file and updates the device. diff --git a/windows/manage/manage-access-to-private-store.md b/windows/manage/manage-access-to-private-store.md index 8e2f813d33..634eb7c4a9 100644 --- a/windows/manage/manage-access-to-private-store.md +++ b/windows/manage/manage-access-to-private-store.md @@ -27,6 +27,22 @@ The private store is a feature in Store for Business that organizations receive Organizations using an MDM to manage apps can use a policy to show only the private store. When your MDM supports the Store for Business, the MDM can use the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#group-policy-table). More specifically, the **ApplicationManagement/RequirePrivateStoreOnly** policy. +## Show private store only using Group Policy + +If you're using Windows Store for Business and you want employees to only see apps you're managing in your private store, you can use Group Policy to show only the private store. Windows Store app will still be available, but employees can't view or purchase apps. Employees can view and install apps that the admin has added to your organization's private store. + +**To show private store only in Windows Store app** + +1. Type **gpedit** in the search bar, and then select **Edit group policy (Control panel)** to find and start Group Policy Editor. + +2. In the console tree of the snap-in, go to **User Configuration** or **Computer Configuration** > **Administrative Templates** > **Windows Components**, and then click **Store**. + +3. Right-click **Only display the private store within the Windows Store app** in the right pane, and click **Edit**. + + This opens the **Only display the private store within the Windows Store app** policy settings. + +4. On the **Only display the private store within the Windows Store app** setting page, click **Enabled**, and then click **OK**. + You can also prevent employees from using the Windows Store. For more information, see [Configure access to Windows Store](stop-employees-from-using-the-windows-store.md). ## Related topics diff --git a/windows/manage/manage-apps-windows-store-for-business-overview.md b/windows/manage/manage-apps-windows-store-for-business-overview.md index 6856a7683d..76b2ee98e8 100644 --- a/windows/manage/manage-apps-windows-store-for-business-overview.md +++ b/windows/manage/manage-apps-windows-store-for-business-overview.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Manage apps in Windows Store for Business diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index f127fe3045..a22f59c100 100644 --- a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -2,19 +2,22 @@ title: Manage connections from Windows operating system components to Microsoft services (Windows 10) description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 -keywords: privacy, manage connections to Microsoft +keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -LocalizationPriority: High +localizationpriority: high author: brianlic-msft --- # Manage connections from Windows operating system components to Microsoft services +[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + **Applies to** - Windows 10 +- Windows Server 2016 If you're looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). @@ -22,246 +25,195 @@ Learn about the network connections that Windows components make to Microsoft an If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. -Some of the network connections discussed in this article can be managed in Windows 10 Mobile, Windows 10 Mobile Enterprise, and the July release of Windows 10. However, you must use Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511 to manage them all. +You can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reason why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience. + +We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. + + +## What's new in Windows 10, version 1607 and Windows Server 2016 + +Here's a list of changes that were made to this article for Windows 10, version 1607 and Windows Server 2016: + +- Added instructions on how to turn off speech recognition and speech synthesis model updates in [14.5 Speech, inking, & typing](#bkmk-priv-speech). +- Added instructions on how to turn off flip ahead with an Internet Explorer Group Policy. +- Added a section on how to turn off automatic root updates to stop updating the certificate trust list in [1. Certificate trust lists](#certificate-trust-lists). +- Added a new setting in [25. Windows Update](#bkmk-wu). +- Changed the NCSI URL in [11. Network Connection Status Indicator](#bkmk-ncsi). +- Added a section on how to turn off features that depend on Microsoft Account cloud authentication service [10. Microsoft Account](#bkmk-microsoft-account). + +- Added the following Group Policies: + + - Turn off unsolicited network traffic on the Offline Maps settings page + - Turn off all Windows spotlight features + +## Settings + + +The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. + +If you're running Windows 10, they will be included in the next update for the Long Term Servicing Branch. + +### Settings for Windows 10 Enterprise, version 1607 + +See the following table for a summary of the management settings for Windows 10 Enterprise, version 1607. + +| Setting | UI | Group Policy | MDM policy | Registry | Command line | +| - | :-: | :-: | :-: | :-: | :-: | +| [1. Certificate trust lists](#certificate-trust-lists) | | ![Check mark](images/checkmark.png) | | | | +| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | | | ![Check mark](images/checkmark.png) | | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | | | +| [5. Font streaming](#font-streaming) | | | | ![Check mark](images/checkmark.png) | | +| [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +| [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | | | +| [9. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | +| [10. Microsoft Account](#bkmk-microsoft-account) | | | | ![Check mark](images/checkmark.png) | | +| [11. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | | | +| [13. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +| [14. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [15. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | +| [16. Settings > Privacy](#bkmk-settingssection) | | | | | | +|     [16.1 General](#bkmk-priv-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [16.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +|     [16.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +|     [16.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.6 Speech, inking, & typing](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [16.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.13 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.14 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [16.15 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [16.16 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | | | | | +|     [16.17 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +| [17. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [18. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [19. Teredo](#bkmk-teredo) | | | | | ![Check mark](images/checkmark.png) | +| [20. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [21. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [22. Windows Media Player](#bkmk-wmp) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | +| [23. Windows spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +| [24. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | | | +| [25. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [26. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | + +### Settings for Windows Server 2016 with Desktop Experience + +See the following table for a summary of the management settings for Windows Server 2016 with Desktop Experience. + +| Setting | UI | Group Policy | Registry | Command line | +| - | :-: | :-: | :-: | :-: | +| [1. Certificate trust lists](#certificate-trust-lists) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | | +| [5. Font streaming](#font-streaming) | | | ![Check mark](images/checkmark.png) | | +| [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | | +| [10. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | | +| [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | | +| [14. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | | +| [16. Settings > Privacy](#bkmk-settingssection) | | | | | +|     [16.1 General](#bkmk-priv-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [17. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | | | +| [19. Teredo](#bkmk-teredo) | | | | ![Check mark](images/checkmark.png) | +| [21. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [22. Windows Media Player](#bkmk-wmp) | | | | ![Check mark](images/checkmark.png) | +| [24. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | | +| [26. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | + +### Settings for Windows Server 2016 Server Core + +See the following table for a summary of the management settings for Windows Server 2016 Server Core. + +| Setting | Group Policy | Registry | Command line | +| - | :-: | :-: | :-: | :-: | :-: | +| [1. Certificate trust lists](#certificate-trust-lists) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [3. Date & Time](#bkmk-datetime) | | ![Check mark](images/checkmark.png) | | +| [5. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | | +| [12. Network Connection Status Indicator](#bkmk-ncsi) | ![Check mark](images/checkmark.png) | | | +| [17. Software Protection Platform](#bkmk-spp) | ![Check mark](images/checkmark.png) | | | +| [19. Teredo](#bkmk-teredo) | | | ![Check mark](images/checkmark.png) | +| [21. Windows Defender](#bkmk-defender) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [26. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | + +### Settings for Windows Server 2016 Nano Server + +See the following table for a summary of the management settings for Windows Server 2016 Nano Server. + +| Setting | Registry | Command line | +| - | :-: | :-: | :-: | :-: | :-: | +| [1. Certificate trust lists](#certificate-trust-lists) | ![Check mark](images/checkmark.png) | | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | | +| [19. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | +| [26. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | | + +## Settings + +Use the following sections for more information about how to configure each setting. + +### 1. Certificate trust lists + +A certificate trust list is a predefined list of items, such as a list of certificate hashes or a list of file name, that are signed by a trusted entity. Windows automatically downloads an updated certificate trust list when it is available. + +To turn off the automatic download of an updated certificate trust list, you can turn off automatic root updates, which also includes the disallowed certificate list and the pin rules list. + +For Windows 10, Windows Server 2016 with Desktop Experience, and Windows Server 2016 Server Core: + +- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Automatic Root Certificates Update** + + -and- + +1. Navigate to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Public Key Policies**. +2. Double-click **Certificate Path Validation Settings**. +3. On the **Network Retrieval** tab, select the **Define these policy settings** check box. +4. Clear the **Automatically update certificates in the Microsoft Root Certificate Program (recommended)** check box, and then click **OK**. + + -or- + +- Create the registry path **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot** and then add a REG\_DWORD registry setting, called **DisableRootAutoUpdate**, with a value of 1. + + -and- + +1. Navigate to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Public Key Policies**. +2. Double-click **Certificate Path Validation Settings**. +3. On the **Network Retrieval** tab, select the **Define these policy settings** check box. +4. Clear the **Automatically update certificates in the Microsoft Root Certificate Program (recommended)** check box, and then click **OK**. -In Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511, you can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. +On Windows Server 2016 Nano Server: -We are always working on improving Windows 10 for our customers. We invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows 10 work better for your organization. +- Create the registry path **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot** and then add a REG\_DWORD registry setting, called **DisableRootAutoUpdate**, with a value of 1. -Here's what's covered in this article: +>[!NOTE] +>CRL and OCSP network traffic is currently whitelisted and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign. -- [Info management settings](#bkmk-othersettings) +### 2. Cortana and Search - - [1. Cortana](#bkmk-cortana) +Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730683). - - [1.1 Cortana Group Policies](#bkmk-cortana-gp) - - - [1.2 Cortana MDM policies](#bkmk-cortana-mdm) - - - [1.3 Cortana Windows Provisioning](#bkmk-cortana-prov) - - - [2. Date & Time](#bkmk-datetime) - - - [3. Device metadata retrieval](#bkmk-devinst) - - - [4. Font streaming](#font-streaming) - - - [5. Insider Preview builds](#bkmk-previewbuilds) - - - [6. Internet Explorer](#bkmk-ie) - - - [6.1 Internet Explorer Group Policies](#bkmk-ie-gp) - - - [6.2 ActiveX control blocking](#bkmk-ie-activex) - - - [7. Live Tiles](#live-tiles) - - - [8. Mail synchronization](#bkmk-mailsync) - - - [9. Microsoft Edge](#bkmk-edge) - - - [9.1 Microsoft Edge Group Policies](#bkmk-edgegp) - - - [9.2 Microsoft Edge MDM policies](#bkmk-edge-mdm) - - - [9.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov) - - - [10. Network Connection Status Indicator](#bkmk-ncsi) - - - [11. Offline maps](#bkmk-offlinemaps) - - - [12. OneDrive](#bkmk-onedrive) - - - [13. Preinstalled apps](#bkmk-preinstalledapps) - - - [14. Settings > Privacy](#bkmk-settingssection) - - - [14.1 General](#bkmk-priv-general) - - - [14.2 Location](#bkmk-priv-location) - - - [14.3 Camera](#bkmk-priv-camera) - - - [14.4 Microphone](#bkmk-priv-microphone) - - - [14.5 Speech, inking, & typing](#bkmk-priv-speech) - - - [14.6 Account info](#bkmk-priv-accounts) - - - [14.7 Contacts](#bkmk-priv-contacts) - - - [14.8 Calendar](#bkmk-priv-calendar) - - - [14.9 Call history](#bkmk-priv-callhistory) - - - [14.10 Email](#bkmk-priv-email) - - - [14.11 Messaging](#bkmk-priv-messaging) - - - [14.12 Radios](#bkmk-priv-radios) - - - [14.13 Other devices](#bkmk-priv-other-devices) - - - [14.14 Feedback & diagnostics](#bkmk-priv-feedback) - - - [14.15 Background apps](#bkmk-priv-background) - - - [15. Software Protection Platform](#bkmk-spp) - - - [16. Sync your settings](#bkmk-syncsettings) - - - [17. Teredo](#bkmk-teredo) - - - [18. Wi-Fi Sense](#bkmk-wifisense) - - - [19. Windows Defender](#bkmk-defender) - - - [20. Windows Media Player](#bkmk-wmp) - - - [21. Windows spotlight](#bkmk-spotlight) - - - [22. Windows Store](#bkmk-windowsstore) - - - [23. Windows Update Delivery Optimization](#bkmk-updates) - - - [23.1 Settings > Update & security](#bkmk-wudo-ui) - - - [23.2 Delivery Optimization Group Policies](#bkmk-wudo-gp) - - - [23.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm) - - - [23.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov) - - - [24. Windows Update](#bkmk-wu) - -## What's new in Windows 10, version 1511 - - -Here's a list of changes that were made to this article for Windows 10, version 1511: - -- Added the following new sections: - - - [Mail synchronization](#bkmk-mailsync) - - - [Offline maps](#bkmk-offlinemaps) - - - [Windows spotlight](#bkmk-spotlight) - - - [Windows Store](#bkmk-windowsstore) - -- Added the following Group Policies: - - - Open a new tab with an empty tab - - - Configure corporate Home pages - - - Let Windows apps access location - - - Let Windows apps access the camera - - - Let Windows apps access the microphone - - - Let Windows apps access account information - - - Let Windows apps access contacts - - - Let Windows apps access the calendar - - - Let Windows apps access messaging - - - Let Windows apps control radios - - - Let Windows apps access trusted devices - - - Do not show feedback notifications - - - Turn off Automatic Download and Update of Map Data - - - Force a specific default lock screen image - -- Added the AllowLinguisticDataCollection MDM policy. - -- Added steps in the [Cortana](#bkmk-cortana) section on how to disable outbound traffic using Windows Firewall. - -- Changed the Windows Update section to apply system-wide settings, and not just per user. - -## Info management settings - - -This section lists the components that make network connections to Microsoft services automatically. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. - -The settings in this section assume you are using Windows 10, version 1511 (currently available in the Current Branch and Current Branch for Business). They will also be included in the next update for the Long Term Servicing Branch. - -- [1. Cortana](#bkmk-cortana) - -- [2. Date & Time](#bkmk-datetime) - -- [3. Device metadata retrieval](#bkmk-devinst) - -- [4. Font streaming](#font-streaming) - -- [5. Insider Preview builds](#bkmk-previewbuilds) - -- [6. Internet Explorer](#bkmk-ie) - -- [7. Live Tiles](#live-tiles) - -- [8. Mail synchronization](#bkmk-mailsync) - -- [9. Microsoft Edge](#bkmk-edge) - -- [10. Network Connection Status Indicator](#bkmk-ncsi) - -- [11. Offline maps](#bkmk-offlinemaps) - -- [12. OneDrive](#bkmk-onedrive) - -- [13. Preinstalled apps](#bkmk-preinstalledapps) - -- [14. Settings > Privacy](#bkmk-settingssection) - -- [15. Software Protection Platform](#bkmk-spp) - -- [16. Sync your settings](#bkmk-syncsettings) - -- [17. Teredo](#bkmk-teredo) - -- [18. Wi-Fi Sense](#bkmk-wifisense) - -- [19. Windows Defender](#bkmk-defender) - -- [20. Windows Media Player](#bkmk-wmp) - -- [21. Windows spotlight](#bkmk-spotlight) - -- [22. Windows Store](#bkmk-windowsstore) - -- [23. Windows Update Delivery Optimization](#bkmk-updates) - -- [24. Windows Update](#bkmk-wu) - - -See the following table for a summary of the management settings. For more info, see its corresponding section. - -![Management settings table](images/settings-table.png) - -### 1. Cortana - -Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730683). - -### 1.1 Cortana Group Policies +### 2.1 Cortana and Search Group Policies Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**. | Policy | Description | |------------------------------------------------------|---------------------------------------------------------------------------------------| -| Allow Cortana | Choose whether to let Cortana install and run on the device. | -| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results. | -| Do not allow web search | Choose whether to search the web from Windows Desktop Search.
    Default: Disabled| -| Don't search the web or display web results in Search| Choose whether to search the web from Cortana. | -| Set what information is shared in Search | Control what information is shared with Bing in Search. | +| Allow Cortana | Choose whether to let Cortana install and run on the device.

    Disable this policy to turn off Cortana. | +| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results.

    Disable this policy to block access to location information for Cortana. | +| Do not allow web search | Choose whether to search the web from Windows Desktop Search.

    Enable this policy to remove the option to search the Internet from Cortana. | +| Don't search the web or display web results in Search| Choose whether to search the web from Cortana.

    Enable this policy to stop web queries and results from showing in Search. | +| Set what information is shared in Search | Control what information is shared with Bing in Search.

    If you enable this policy and set it to **Anonymous info**, usage information will be shared but not search history, Microsoft Account information, or specific location. | -When you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. +In Windows 10, version 1507 and Windows 10, version 1511, when you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. + +>[!IMPORTANT] +>These steps are not required for devices running Windows 10, version 1607 or Windows Server 2016. 1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. @@ -287,22 +239,18 @@ When you enable the **Don't search the web or display web results in Search** Gr - For **Remote port**, choose **All ports**. -> **Note:** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. Fiddler is a network proxy and Windows Firewall does not block proxy traffic. You should use a network traffic analyzer, such as WireShark or Message Analyzer. +If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. Fiddler is a network proxy and Windows Firewall does not block proxy traffic. You should use a network traffic analyzer, such as WireShark or Message Analyzer. -### 1.2 Cortana MDM policies +### 2.2 Cortana and Search MDM policies -The following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). +For Windows 10 only, the following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| | Experience/AllowCortana | Choose whether to let Cortana install and run on the device. | | Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results.
    Default: Allowed| -### 1.3 Cortana Windows Provisioning - -To use Windows Imaging and Configuration Designer (ICD) to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies** to find **Experience** > **AllowCortana** and **Search** > **AllowSearchToUseLocation**. - -### 2. Date & Time +### 3. Date & Time You can prevent Windows from setting the time automatically. @@ -312,23 +260,34 @@ You can prevent Windows from setting the time automatically. - Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters\\Type** with a value of **NoSync**. -### 3. Device metadata retrieval +### 4. Device metadata retrieval To prevent Windows from retrieving device metadata from the Internet, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. -### 4. Font streaming +### 5. Font streaming -Starting with Windows 10, fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. +Fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. -> **Note:** This may change in future versions of Windows. -### 5. Insider Preview builds +### 6. Insider Preview builds -To turn off Insider Preview builds if you're running a released version of Windows 10. If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. +The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. -- Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Stop Insider builds**. +> [!NOTE] +> This setting stops communication with the Windows Insider Preview service that checks for new builds. Windows Insider Preview builds only apply to Windows 10 and are not available for Windows Server 2016. + +To turn off Insider Preview builds for a released version of Windows 10: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. + +To turn off Insider Preview builds for Windows 10: + +> [!NOTE] +> If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. + +- Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Insider Program** > **Stop Insider Preview builds**. -or- @@ -354,13 +313,9 @@ To turn off Insider Preview builds if you're running a released version of Windo - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. -### 6. Internet Explorer +### 7. Internet Explorer -Use Group Policy to manage settings for Internet Explorer. - -### 6.1 Internet Explorer Group Policies - -Find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. +Use Group Policy to manage settings for Internet Explorer. You can find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| @@ -370,19 +325,26 @@ Find the Internet Explorer Group Policy objects under **Computer Configuration** | Disable Periodic Check for Internet Explorer software updates| Choose whether Internet Explorer periodically checks for a new version.
    Default: Enabled | | Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
    Default: Disabled| -### 6.2 ActiveX control blocking +There are two more Group Policy objects that are used by Internet Explorer: + +| Path | Policy | Description | +| - | - | - | +| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
    Default: Enabled | +| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices.
    Default: Enabled | + +### 7.1 ActiveX control blocking ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx). -### 7. Live Tiles +### 8. Live Tiles To turn off Live Tiles: - Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage** -### 8. Mail synchronization +### 9. Mail synchronization To turn off mail synchronization for Microsoft Accounts that are configured on a device: @@ -400,15 +362,36 @@ To turn off the Windows Mail app: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application** -### 9. Microsoft Edge +### 10. Microsoft Account -Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730682). +To prevent communication to the Microsoft Account cloud authentication service. Many apps and system components that depend on Microsoft Account authentication may lose functionality. Some of them could be in unexpected ways. -### 9.1 Microsoft Edge Group Policies +- Change the **Start** REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\wlidsvc** to 4. + + +### 11. Microsoft Edge + +Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682). + +### 11.1 Microsoft Edge Group Policies Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. -> **Note:** The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. +> [!NOTE] +> The Microsoft Edge Group Policy names were changed in Windows 10, version 1607. The table below reflects those changes. + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Configure autofill | Choose whether employees can use autofill on websites.
    Default: Enabled | +| Configure Do Not Track | Choose whether employees can send Do Not Track headers.
    Default: Disabled | +| Configure password manager | Choose whether employees can save passwords locally on their devices.
    Default: Enabled | +| Configure search suggestions in Address bar | Choose whether the address bar shows search suggestions.
    Default: Enabled | +| Configure SmartScreen Filter | Choose whether SmartScreen is turned on or off.
    Default: Enabled | +| Allow web content on New Tab page | Choose whether a new tab page appears.
    Default: Enabled | +| Configure Home pages | Choose the corporate Home page for domain-joined devices.
    Set this to **about:blank** | + + +The Windows 10, version 1511 Microsoft Edge Group Policy names are: | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| @@ -420,7 +403,7 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g | Open a new tab with an empty tab | Choose whether a new tab page appears.
    Default: Enabled | | Configure corporate Home pages | Choose the corporate Home page for domain-joined devices.
    Set this to **about:blank** | -### 9.2 Microsoft Edge MDM policies +### 11.2 Microsoft Edge MDM policies The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). @@ -432,35 +415,39 @@ The following Microsoft Edge MDM policies are available in the [Policy CSP](http | Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions..
    Default: Allowed | | Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
    Default: Allowed | -### 9.3 Microsoft Edge Windows Provisioning - -Use Windows ICD to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies**. For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx). -### 10. Network Connection Status Indicator +### 12. Network Connection Status Indicator -Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftncsi.com to determine if the device can communicate with the Internet. For more info about NCIS, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). +Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. For more info about NCSI, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). + +In versions of Windows 10 prior to Windows 10, version 1607 and Windows Server 2016, the URL was http://www.msftncsi.com. You can turn off NCSI through Group Policy: - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** -> **Note** After you apply this policy, you must restart the device for the policy setting to take effect. +> [!NOTE] +> After you apply this policy, you must restart the device for the policy setting to take effect. -### 11. Offline maps +### 13. Offline maps You can turn off the ability to download and update offline maps. - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** -### 12. OneDrive + -and- + +- In Windows 10, version 1607 and later, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off unsolicited network traffic on the Offline Maps settings page** + +### 14. OneDrive To turn off OneDrive in your organization: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage** -### 13. Preinstalled apps +### 15. Preinstalled apps Some preinstalled apps get content before they are opened to ensure a great experience. You can remove these using the steps in this section. @@ -572,47 +559,52 @@ To remove the Get Skype app: Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage** -### 14. Settings > Privacy +### 16. Settings > Privacy Use Settings > Privacy to configure some settings that may be important to your organization. Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. -- [14.1 General](#bkmk-general) +- [16.1 General](#bkmk-general) -- [14.2 Location](#bkmk-priv-location) +- [16.2 Location](#bkmk-priv-location) -- [14.3 Camera](#bkmk-priv-camera) +- [16.3 Camera](#bkmk-priv-camera) -- [14.4 Microphone](#bkmk-priv-microphone) +- [16.4 Microphone](#bkmk-priv-microphone) -- [14.5 Speech, inking, & typing](#bkmk-priv-speech) +- [16.5 Notifications](#bkmk-priv-notifications) -- [14.6 Account info](#bkmk-priv-accounts) +- [16.6 Speech, inking, & typing](#bkmk-priv-speech) -- [14.7 Contacts](#bkmk-priv-contacts) +- [16.7 Account info](#bkmk-priv-accounts) -- [14.8 Calendar](#bkmk-priv-calendar) +- [16.8 Contacts](#bkmk-priv-contacts) -- [14.9 Call history](#bkmk-priv-callhistory) +- [16.9 Calendar](#bkmk-priv-calendar) -- [14.10 Email](#bkmk-priv-email) +- [16.10 Call history](#bkmk-priv-callhistory) -- [14.11 Messaging](#bkmk-priv-messaging) +- [16.11 Email](#bkmk-priv-email) -- [14.12 Radios](#bkmk-priv-radios) +- [16.12 Messaging](#bkmk-priv-messaging) -- [14.13 Other devices](#bkmk-priv-other-devices) +- [16.13 Radios](#bkmk-priv-radios) -- [14.14 Feedback & diagnostics](#bkmk-priv-feedback) +- [16.14 Other devices](#bkmk-priv-other-devices) -- [14.15 Background apps](#bkmk-priv-background) +- [16.15 Feedback & diagnostics](#bkmk-priv-feedback) -### 14.1 General +- [16.16 Background apps](#bkmk-priv-background) + +- [16.17 Motion](#bkmk-priv-motion) + +### 16.1 General **General** includes options that don't fall into other areas. To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: -> **Note:** When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. +> [!NOTE] +> When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. - Turn off the feature in the UI. @@ -630,7 +622,7 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Window -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Turn off the SmartScreen Filter**. +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Configure SmartScreen Filter**. Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. @@ -648,11 +640,12 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Window -or- -- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation**, with a value of 0 (zero). +- Create a REG\_DWORD registry setting called **EnableWebContentEvaluation** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost**, with a value of 0 (zero). To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: -> **Note: ** If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. +> [!NOTE] +> If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. @@ -674,7 +667,19 @@ To turn off **Let websites provide locally relevant content by accessing my lang - Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1. -### 14.2 Location +To turn off **Let apps on my other devices open apps and continue experiences on this devices**: + +- Turn off the feature in the UI. + + -or- + +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Continue experiences on this device**. + +To turn off **Let apps on my other devices use Bluetooth to open apps and continue experiences on this device**: + +- Turn off the feature in the UI. + +### 16.2 Location In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location. @@ -696,8 +701,8 @@ To turn off **Location for this device**: - **2**. Turned on and the employee can't turn it off. - **Note** - You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). + > [!NOTE] + > You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). -or- @@ -725,7 +730,7 @@ To turn off **Choose apps that can use your location**: - Turn off each app using the UI. -### 14.3 Camera +### 16.3 Camera In the **Camera** area, you can choose which apps can access a device's camera. @@ -747,8 +752,8 @@ To turn off **Let apps use my camera**: - **1**. Apps can use the camera. - **Note** - You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). + > [!NOTE] + > You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). -or- @@ -762,7 +767,7 @@ To turn off **Choose apps that can use your camera**: - Turn off the feature in the UI for each app. -### 14.4 Microphone +### 16.4 Microphone In the **Microphone** area, you can choose which apps can access a device's microphone. @@ -780,13 +785,26 @@ To turn off **Choose apps that can use your microphone**: - Turn off the feature in the UI for each app. -### 14.5 Speech, inking, & typing +### 16.5 Notifications + +In the **Notifications** area, you can choose which apps have access to notifications. + +To turn off **Let apps access my notifications**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access my notifications** + + - Set the **Select a setting** box to **Force Deny**. + +### 16.6 Speech, inking, & typing In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. -> **Note:** For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. - - +> [!NOTE] +> For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. To turn off the functionality: @@ -802,9 +820,21 @@ To turn off the functionality: -and- - Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero). +- Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero). -### 14.6 Account info + +If you're running at least Windows 10, version 1607, you can turn off updates to the speech recognition and speech synthesis models: + +Apply the Speech/AllowSpeechModelUpdate MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Speech_AllowSpeechModelUpdate), where: + +- **0** (default). Not allowed. +- **1**. Allowed. + + -or- + +- Create a REG\_DWORD registry setting called **AllowSpeechModelUpdate** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\Current\\Device\\Speech**, with a value of 0 (zero). + +### 16.7 Account info In the **Account Info** area, you can choose which apps can access your name, picture, and other account info. @@ -822,7 +852,7 @@ To turn off **Choose the apps that can access your account info**: - Turn off the feature in the UI for each app. -### 14.7 Contacts +### 16.8 Contacts In the **Contacts** area, you can choose which apps can access an employee's contacts list. @@ -836,7 +866,7 @@ To turn off **Choose apps that can access contacts**: - Set the **Select a setting** box to **Force Deny**. -### 14.8 Calendar +### 16.9 Calendar In the **Calendar** area, you can choose which apps have access to an employee's calendar. @@ -854,7 +884,7 @@ To turn off **Choose apps that can access calendar**: - Turn off the feature in the UI for each app. -### 14.9 Call history +### 16.10 Call history In the **Call history** area, you can choose which apps have access to an employee's call history. @@ -868,7 +898,7 @@ To turn off **Let apps access my call history**: - Set the **Select a setting** box to **Force Deny**. -### 14.10 Email +### 16.11 Email In the **Email** area, you can choose which apps have can access and send email. @@ -882,7 +912,7 @@ To turn off **Let apps access and send email**: - Set the **Select a setting** box to **Force Deny**. -### 14.11 Messaging +### 16.12 Messaging In the **Messaging** area, you can choose which apps can read or send messages. @@ -900,7 +930,7 @@ To turn off **Choose apps that can read or send messages**: - Turn off the feature in the UI for each app. -### 14.12 Radios +### 16.13 Radios In the **Radios** area, you can choose which apps can turn a device's radio on or off. @@ -918,7 +948,7 @@ To turn off **Choose apps that can control radios**: - Turn off the feature in the UI for each app. -### 14.13 Other devices +### 16.14 Other devices In the **Other Devices** area, you can choose whether devices that aren't paired to PCs, such as an Xbox One, can share and sync info. @@ -926,6 +956,10 @@ To turn off **Let apps automatically share and sync info with wireless devices t - Turn off the feature in the UI. + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps sync with devices** + To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**: - Turn off the feature in the UI. @@ -936,14 +970,14 @@ To turn off **Let your apps use your trusted devices (hardware you've already co - Set the **Select a setting** box to **Force Deny**. -### 14.14 Feedback & diagnostics +### 16.15 Feedback & diagnostics In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. To change how frequently **Windows should ask for my feedback**: -**Note** -Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device. +> [!NOTE] +> Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device. @@ -977,7 +1011,8 @@ To change the level of diagnostic and usage data sent when you **Send your devic - To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. - > **Note:** You can't use the UI to change the telemetry level to **Security**. + > [!NOTE] + > You can't use the UI to change the telemetry level to **Security**. @@ -1009,7 +1044,7 @@ To change the level of diagnostic and usage data sent when you **Send your devic - **3**. Maps to the **Full** level. -### 14.15 Background apps +### 16.16 Background apps In the **Background Apps** area, you can choose which apps can run in the background. @@ -1017,15 +1052,39 @@ To turn off **Let apps run in the background**: - Turn off the feature in the UI for each app. -### 15. Software Protection Platform + - Set the **Select a setting** box to **Force Deny**. -Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by applying the following Group Policy: +### 16.17 Motion -**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Activation** +In the **Motion** area, you can choose which apps have access to your motion data. + +To turn off **Let Windows and your apps use your motion data and collect motion history**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access motion** + +### 17. Software Protection Platform + +Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following: + +For Windows 10: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client AVS Validation** + + -or- + +- Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is disabled (default) and 1 is enabled. + +For Windows Server 2016 with Desktop Experience or Windows Server 2016 Server Core: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client AVS Validation** The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. -### 16. Sync your settings +### 18. Sync your settings You can control if your settings are synchronized: @@ -1051,13 +1110,13 @@ To turn off Messaging cloud sync: - Create a REG\_DWORD registry setting called **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging**, with a value of 0 (zero). -### 17. Teredo +### 19. Teredo You can disable Teredo by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](http://technet.microsoft.com/library/cc722030.aspx). - From an elevated command prompt, run **netsh interface teredo set state disabled** -### 18. Wi-Fi Sense +### 20. Wi-Fi Sense Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them. @@ -1075,15 +1134,15 @@ To turn off **Connect to suggested open hotspots** and **Connect to networks sha -or- -- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620909). +- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620909). -or- -- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620910). +- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620910). When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. -### 19. Windows Defender +### 21. Windows Defender You can disconnect from the Microsoft Antimalware Protection Service. @@ -1091,7 +1150,7 @@ You can disconnect from the Microsoft Antimalware Protection Service. -or- -- Apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). +- For Windows 10 only, apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). -or- @@ -1107,7 +1166,7 @@ You can stop sending file samples back to Microsoft. -or- -- Apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: +- For Windows 10 only, apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - **0**. Always prompt. @@ -1127,13 +1186,17 @@ You can stop downloading definition updates: -and- -- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. +- Disable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. + +For Windows 10 only, you can stop Enhanced Notifications: + +- Turn off the feature in the UI. You can also use the registry to turn off Malicious Software Reporting Tool telemetry by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1. -### 20. Windows Media Player +### 22. Windows Media Player -To remove Windows Media Player: +To remove Windows Media Player on Windows 10: - From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**. @@ -1141,13 +1204,26 @@ To remove Windows Media Player: - Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** -### 21. Windows spotlight +To remove Windows Media Player on Windows Server 2016: -Windows spotlight provides different background images and text on the lock screen. You can control it by using the user interface or through Group Policy. +- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** + +### 23. Windows spotlight + +Windows spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface or through Group Policy. + +If you're running Windows 10, version 1607 or later, you only need to enable the following Group Policy: + +- **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off all Windows spotlight features** + +If you're not running Windows 10, version 1607 or later, you can use the other options in this section. - Configure the following in **Settings**: - - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Show me tips, tricks, and more on the lock screen**. + - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Get fun facts, tips, tricks and more on your lock screen**. + + > [!NOTE] + > In Windows 10, version 1507 and Windows 10, version 1511, this setting was called **Show me tips, tricks, and more on the lock screen**. - **Personalization** > **Start** > **Occasionally show suggestions in Start**. @@ -1162,7 +1238,8 @@ Windows spotlight provides different background images and text on the lock scre - Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box. - **Note** This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. + > [!NOTE] + > This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. @@ -1170,15 +1247,15 @@ Windows spotlight provides different background images and text on the lock scre - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**. -For more info, see [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md). +For more info, see [Windows Spotlight on the lock screen](../manage/windows-spotlight.md). -### 22. Windows Store +### 24. Windows Store -You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. +You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. On Windows Server 2016, this will block Windows Store calls from Universal Windows Apps. - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**. -### 23. Windows Update Delivery Optimization +### 25. Windows Update Delivery Optimization Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. @@ -1186,42 +1263,44 @@ By default, PCs running Windows 10 Enterprise and Windows 10 Education will only Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization. -### 23.1 Settings > Update & security +In Windows 10, version 1607, you can stop network traffic related to Windows Update Delivery Optimization by setting **Download Mode** to **Simple** (99) or **Bypass** (100), as described below. + +### 25.1 Settings > Update & security You can set up Delivery Optimization from the **Settings** UI. - Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. -### 23.2 Delivery Optimization Group Policies +### 25.2 Delivery Optimization Group Policies You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. | Policy | Description | |---------------------------|-----------------------------------------------------------------------------------------------------| -| Download Mode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

    • None. Turns off Delivery Optimization.

    • Group. Gets or sends updates and apps to PCs on the same local network domain.

    • Internet. Gets or sends updates and apps to PCs on the Internet.

    • LAN. Gets or sends updates and apps to PCs on the same NAT only.

    | -| Group ID | Lets you provide a Group ID that limits which PCs can share apps and updates.
    ** Note** This ID must be a GUID.| +| Download Mode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

    • None. Turns off Delivery Optimization.

    • Group. Gets or sends updates and apps to PCs on the same local network domain.

    • Internet. Gets or sends updates and apps to PCs on the Internet.

    • LAN. Gets or sends updates and apps to PCs on the same NAT only.

    • Simple. Simple download mode with no peering.

    • Bypass. Use BITS instead of Windows Update Delivery Optimization.

    | +| Group ID | Lets you provide a Group ID that limits which PCs can share apps and updates.
    **Note:** This ID must be a GUID.| | Max Cache Age | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
    The default value is 259200 seconds (3 days).| | Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
    The default value is 20, which represents 20% of the disk.| | Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
    The default value is 0, which means unlimited possible bandwidth.| -### 23.3 Delivery Optimization MDM policies +### 25.3 Delivery Optimization MDM policies The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). | Policy | Description | |---------------------------|-----------------------------------------------------------------------------------------------------| -| DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

    • 0. Turns off Delivery Optimization.

    • 1. Gets or sends updates and apps to PCs on the same NAT only.

    • 2. Gets or sends updates and apps to PCs on the same local network domain.

    • 3. Gets or sends updates and apps to PCs on the Internet.

    | +| DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

    • 0. Turns off Delivery Optimization.

    • 1. Gets or sends updates and apps to PCs on the same NAT only.

    • 2. Gets or sends updates and apps to PCs on the same local network domain.

    • 3. Gets or sends updates and apps to PCs on the Internet.

    • 99. Simple download mode with no peering.

    • 100. Use BITS instead of Windows Update Delivery Optimization.

    | | DeliveryOptimization/DOGroupID | Lets you provide a Group ID that limits which PCs can share apps and updates.
    **Note** This ID must be a GUID.| | DeliveryOptimization/DOMaxCacheAge | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
    The default value is 259200 seconds (3 days).| | DeliveryOptimization/DOMaxCacheSize | Lets you specify the maximum cache size as a percentage of disk size.
    The default value is 20, which represents 20% of the disk.| | DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
    The default value is 0, which means unlimited possible bandwidth.| -### 23.4 Delivery Optimization Windows Provisioning +### 25.4 Delivery Optimization Windows Provisioning If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies -Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization. +Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](https://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization. 1. Open Windows ICD, and then click **New provisioning package**. @@ -1231,9 +1310,9 @@ Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windo 4. Go to **Runtime settings** > **Policies** > **DeliveryOptimization** to configure the policies. -For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730684). +For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730684). -### 24. Windows Update +### 26. Windows Update You can turn off Windows Update by setting the following registry entries: @@ -1243,13 +1322,18 @@ You can turn off Windows Update by setting the following registry entries: - Add a REG\_DWORD value called **DisableWindowsUpdateAccess** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. + -and- + +- Add a REG\_DWORD value called **UseWUServer** to **HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** and set the value to 1. + + You can turn off automatic updates by doing one of the following. This is not recommended. - Add a REG\_DWORD value called **AutoDownload** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5. -or- -- Apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: +- For Windows 10 only, apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - **0**. Notify the user before downloading the update. diff --git a/windows/manage/manage-corporate-devices.md b/windows/manage/manage-corporate-devices.md index f377f9a8fe..f96628d60a 100644 --- a/windows/manage/manage-corporate-devices.md +++ b/windows/manage/manage-corporate-devices.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices author: jdeckerMS +localizationpriority: high --- # Manage corporate devices @@ -33,7 +34,7 @@ Your employees using devices that are owned by the organization can connect to A You can join a device running Windows 10 to an on-premises Active Directory domain after the first-run experience (sometimes called out-of-box experience or OOBE). You can add devices running Windows 10 to your existing Active Directory infrastructure and manage them just as you've always been used to managing PCs running Windows. -Desktop devices running Windows 10 that are joined to an Active Directory domain can be managed using Group Policy and System Center 2012 R2 Configuration Manager. The following table shows the management support for Windows 10 in Configuration Manager. +Desktop devices running Windows 10 that are joined to an Active Directory domain can be managed using Group Policy and System Center Configuration Manager (current branch). The following table shows the management support for Windows 10 in Configuration Manager. @@ -48,7 +49,7 @@ Desktop devices running Windows 10 that are joined to an Active Directory domai - + @@ -70,7 +71,7 @@ Devices joined to Azure AD can be managed using Microsoft Intune or other mobile ![mdm options for mobile, desktop, and iot through device lifecycle](images/mdm.png) -For flexibility in identity and management, you can combine Active Directory and Azure AD. Learn about [integrating Active Directory and Azure Active Directory for a hybrid identity solution](http://go.microsoft.com/fwlink/p/?LinkId=613209). +For flexibility in identity and management, you can combine Active Directory and Azure AD. Learn about [integrating Active Directory and Azure Active Directory for a hybrid identity solution](https://go.microsoft.com/fwlink/p/?LinkId=613209). ## How setting conflicts are resolved @@ -91,30 +92,31 @@ When setting values that do not have a security implication conflict, last write Devices running Windows 10 include a built-in agent that can be used by MDM servers to enroll and manage devices. MDM servers do not need to create a separate agent or client to install on devices running Windows 10. -For more information about the MDM protocols, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkID=533172). +For more information about the MDM protocols, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkID=533172). ## Learn more -[How to bulk-enroll devices with On-premises Mobile Device Management in System Center Configuration Manager](https://technet.microsoft.com/en-us/library/mt627898.aspx) +[How to bulk-enroll devices with On-premises Mobile Device Management in System Center Configuration Manager](https://technet.microsoft.com/library/mt627898.aspx) [Azure AD, Microsoft Intune and Windows 10 - Using the cloud to modernize enterprise mobility](https://blogs.technet.microsoft.com/enterprisemobility/2015/06/12/azure-ad-microsoft-intune-and-windows-10-using-the-cloud-to-modernize-enterprise-mobility/) -[Microsoft Intune End User Enrollment Guide](http://go.microsoft.com/fwlink/p/?LinkID=617169) +[Microsoft Intune End User Enrollment Guide](https://go.microsoft.com/fwlink/p/?LinkID=617169) -[Azure AD Join on Windows 10 devices](http://go.microsoft.com/fwlink/p/?LinkId=616791) +[Azure AD Join on Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=616791) -[Azure AD support for Windows 10](http://go.microsoft.com/fwlink/p/?LinkID=615765) +[Azure AD support for Windows 10](https://go.microsoft.com/fwlink/p/?LinkID=615765) -[Windows 10 and Azure Active Directory: Embracing the Cloud](http://go.microsoft.com/fwlink/p/?LinkId=615768) +[Windows 10 and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768) -[How to manage Windows 10 devices using Intune](http://go.microsoft.com/fwlink/p/?LinkId=613620) +[How to manage Windows 10 devices using Intune](https://go.microsoft.com/fwlink/p/?LinkId=613620) -[Using Intune alone and with Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=613207) +[Using Intune alone and with Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=613207) -Microsoft Virtual Academy course: [System Center 2012 R2 Configuration Manager & Windows Intune](http://go.microsoft.com/fwlink/p/?LinkId=613208) +Microsoft Virtual Academy course: [System Center 2012 R2 Configuration Manager & Windows Intune](https://go.microsoft.com/fwlink/p/?LinkId=613208) ## Related topics +[Manage Windows 10 and Windows Store tips, tricks, and suggestions](manage-tips-and-suggestions.md) - [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md)  - [New policies for Windows 10](new-policies-for-windows-10.md) diff --git a/windows/manage/manage-cortana-in-enterprise.md b/windows/manage/manage-cortana-in-enterprise.md index b44e4c4920..36b77add2e 100644 --- a/windows/manage/manage-cortana-in-enterprise.md +++ b/windows/manage/manage-cortana-in-enterprise.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: eross-msft +localizationpriority: high --- # Cortana integration in your business or enterprise @@ -14,6 +15,8 @@ author: eross-msft - Windows 10 - Windows 10 Mobile +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. ## Cortana integration with Office 365 @@ -23,48 +26,49 @@ But Cortana works even harder when she connects to Office 365, helping employees **More info:** -- For specific info about what you need to know as a company administrator, including how to turn off Cortana with Office 365, see the [Cortana integration with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=717378) support topic. +- For specific info about what you need to know as a company administrator, including how to turn off Cortana with Office 365, see the [Cortana integration with Office 365](https://go.microsoft.com/fwlink/p/?LinkId=717378) support topic. -- For a quick review of the frequently asked questions about Cortana and Office 365 integration, see the blog post, [An early look at Cortana integration with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=717379). +- For a quick review of the frequently asked questions about Cortana and Office 365 integration, see the blog post, [An early look at Cortana integration with Office 365](https://go.microsoft.com/fwlink/p/?LinkId=717379). ## Cortana and Power BI Integration between Cortana and Power BI shows how Cortana can work with custom business analytics solutions to enable you to get answers directly from your key business data, including introducing new features that let you create custom Cortana answers using the full capabilities of Power BI Desktop. **More info:** -- For specific info about how to start using Power BI and Cortana integration, how to customize your data results, and how to use the “Hey Cortana” functionality, see the [Power BI: Announcing Power BI integration with Cortana and new ways to quickly find insights in your data](http://go.microsoft.com/fwlink/p/?LinkId=717382) blog. +- For specific info about how to start using Power BI and Cortana integration, how to customize your data results, and how to use the “Hey Cortana” functionality, see the [Power BI: Announcing Power BI integration with Cortana and new ways to quickly find insights in your data](https://go.microsoft.com/fwlink/p/?LinkId=717382) blog. ## Cortana and Microsoft Dynamics CRM Cortana integration is a Preview feature that's available for your test or dev environment, starting with the CRM Online 2016 Update. If you decide to use this Preview feature, you'll need to turn in on and accept the license terms. After that, salespeople will get proactive insights from Cortana on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. **More info:** -- For more info about Preview features, see [What are Preview features and how do I enable them?](http://go.microsoft.com/fwlink/p/?LinkId=746817). -- For more info about Cortana, see [What is Cortana?](http://go.microsoft.com/fwlink/p/?LinkId=746818). -- For more info about CRM integration, how to turn on Cortana, and how to provide feedback, see [Preview feature: Set up Cortana integration](http://go.microsoft.com/fwlink/p/?LinkId=746819). +- For more info about Preview features, see [What are Preview features and how do I enable them?](https://go.microsoft.com/fwlink/p/?LinkId=746817). +- For more info about Cortana, see [What is Cortana?](https://go.microsoft.com/fwlink/p/?LinkId=746818). +- For more info about CRM integration, how to turn on Cortana, and how to provide feedback, see [Preview feature: Set up Cortana integration](https://go.microsoft.com/fwlink/p/?LinkId=746819). ## Cortana and privacy -We understand that there are concerns about Cortana and enterprise privacy, so we’ve put together the [Cortana, Search, and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=717383) topic that covers many of the frequently asked questions. These questions include things such as what info is collected by Cortana, where the info is saved, how to manage what data is collected, how to turn Cortana off, how to opt completely out of data collection, and what info is shared with other Microsoft apps and services. +We understand that there are concerns about Cortana and enterprise privacy, so we’ve put together the [Cortana, Search, and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=717383) topic that covers many of the frequently asked questions. These questions include things such as what info is collected by Cortana, where the info is saved, how to manage what data is collected, how to turn Cortana off, how to opt completely out of data collection, and what info is shared with other Microsoft apps and services. ## Set up Cortana using Group Policy and MDM policies Set up and manage Cortana by using the following Group Policy and mobile device management (MDM) policies. |Group policy |MDM policy |Description | |-------------|-----------|------------| -|Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana |Experience/AllowCortana |Specifies whether employees can use Cortana.

    **Note**
    Employees can still perform searches even with Cortana turned off. | -|Computer Configuration\Administrative Templates\Control Panel\Regional and Language Options\Allow input personalization |Privacy/AllowInput Personalization |Specifies whether to turn on automatic learning, which allows the collection of speech and handwriting patterns, typing history, contacts, and recent calendar information. It is required for the use of Cortana.

    **Important**
    Cortana won’t work if this setting is turned off (disabled). | -|None |System/AllowLocation |Specifies whether to allow app access to the Location service. | -|Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results |None |Specifies whether search can perform queries on the web and if the web results are displayed in search.

    **Important**
    Cortana won’t work if this setting is turned off (disabled). | -|Computer Configuration\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location |Search/AllowSearchToUse Location |Specifies whether search and Cortana can provide location aware search and Cortana results.

    **Important**
    Cortana won’t work if this setting is turned off (disabled). | -|Computer Configuration\Administrative Templates\Windows Components\Search\Set the SafeSearch setting for Search |Search/SafeSearch Permissions |Specifies what level of safe search (filtering adult content) is required.

    **Note**
    This setting only applies to Windows 10 Mobile. | -|User Configuration\Administrative Templates\Windows Components\File Explorer\Turn off display of recent search entries in the File Explorer search box |None |Specifies whether the search box can suggest recent queries and prevent entries from being stored in the registry for future reference.

    **Important**
    Cortana won’t work if this setting is turned off (disabled). | -|User Configuration\Administrative Templates\Start Menu and Taskbar\Do not search communications |None |Specifies whether the Start menu search box searches communications.

    **Important**
    Cortana won’t work if this setting is turned off (disabled). | +|Computer Configuration\Administrative Templates\Windows Components\Search\AllowCortanaAboveLock |AboveLock/AllowCortanaAboveLock |Specifies whether an employee can interact with Cortana using voice commands when the system is locked.

    **Note**
    This setting only applies to Windows 10 for desktop devices. | +|Computer Configuration\Administrative Templates\Control Panel\Regional and Language Options\Allow input personalization |Privacy/AllowInputPersonalization |Specifies whether an employee can use voice commands with Cortana in the enterprise.

    **In Windows 10, version 1511**
    Cortana won’t work if this setting is turned off (disabled).

    **In Windows 10, version 1607 and later**
    Cortana still works if this setting is turned off (disabled). | +|None |System/AllowLocation |Specifies whether to allow app access to the Location service.

    **In Windows 10, version 1511**
    Cortana won’t work if this setting is turned off (disabled).

    **In Windows 10, version 1607 and later**
    Cortana still works if this setting is turned off (disabled). | +|None |Accounts/AllowMicrosoftAccountConnection |Specifies whether to allow employees to sign in using a Microsoft account (MSA) from Windows apps.

    Use this setting if you only want to support Azure AD in your organization. | +|Computer Configuration\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location |Search/AllowSearchToUseLocation |Specifies whether Cortana can use your current location during searches and for location reminders. | +|Computer Configuration\Administrative Templates\Windows Components\Search\Set the SafeSearch setting for Search |Search/SafeSearchPermissions |Specifies what level of safe search (filtering adult content) is required.

    **Note**
    This setting only applies to Windows 10 Mobile. | +|User Configuration\Administrative Templates\Windows Components\File Explorer\Turn off display of recent search entries in the File Explorer search box |None |Specifies whether the search box can suggest recent queries and prevent entries from being stored in the registry for future reference. | +|Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results |None |Specifies whether search can perform queries on the web and if the web results are displayed in search.

    **In Windows 10 Pro edition**
    This setting can’t be managed.

    **In Windows 10 Enterprise edition**
    Cortana won't work if this setting is turned off (disabled). | +|Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana |Experience/AllowCortana |Specifies whether employees can use Cortana.

    **Important**
    Cortana won’t work if this setting is turned off (disabled). However, employees can still perform local searches even with Cortana turned off. | **More info:** -- For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=717381). +- For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=717381). ## Related topics -- [Cortana and Windows](http://go.microsoft.com/fwlink/p/?LinkId=717384) -- [Cortana for developers](http://go.microsoft.com/fwlink/p/?LinkId=717385) +- [Cortana and Windows](https://go.microsoft.com/fwlink/p/?LinkId=717384) +- [Cortana for developers](https://go.microsoft.com/fwlink/p/?LinkId=717385)   diff --git a/windows/manage/manage-inventory-windows-store-for-business.md b/windows/manage/manage-inventory-windows-store-for-business.md index 8535d16d65..f8db99379b 100644 --- a/windows/manage/manage-inventory-windows-store-for-business.md +++ b/windows/manage/manage-inventory-windows-store-for-business.md @@ -1,70 +1,10 @@ --- title: Manage inventory in Windows Store for Business (Windows 10) description: When you acquire apps from the Windows Store for Business, we add them to the Inventory for your organization. Once an app is part of your inventory, you can distribute the app, and manage licenses. -redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/app-inventory-management-windows-store-for-business +redirect_url: https://technet.microsoft.com/itpro/windows/manage/app-inventory-managemement-windows-store-for-business ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library --- -# Manage inventory in Window Store for Business -When you acquire apps from the Windows Store for Business, we add them to the inventory for your organization. Once an app is part of your inventory, you can distribute the app, and manage licenses. - -## Distribute apps -You can assign apps to people, or you can make apps available in your private store. Once an app is in your private store, people in your org can install the app on their devices. For more information, see [Distribute apps using your private store](distribute-apps-from-your-private-store.md). - -**To make an app in inventory available in your private store** - -1. Sign in to the [Store for Business](http://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Inventory**. -3. Click **Refine**, and then choose **Online**. Store for Business will update the list of apps on the **Inventory** page. -4. From an app in **Inventory**, click the ellipses under **Action**, and then choose **Add to private store**. - -The value under Private store for the app will change to pending. It will take approximately twelve hours before the app is available in the private store. - -Employees can claim apps that admins added to the private store by doing the following. - -**To claim an app from the private store** - -1. Sign in to your computer with your Azure Active Directory (AD) credentials, and start the Windows Store app. -2. Click the private store tab. -3. Click the app you want to install, and then click **Install**. - -Another way to distribute apps is by assigning them to people in your organization. - -**To assign an app to an employee** - -1. Sign in to the [Store for Business](http://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Inventory**. -3. Find an app, click the ellipses under **Action**, and then choose **Assign to people**. -4. Type the email address for the employee that you're assigning the app to, and click **Confirm**. - -Employees will receive an email with a link that will install the app on their device. Click the link to start the Windows Store app, and then click **Install**. Also, in the Windows Store app, they can find the app under **My Library**. - -## Manage licenses -For apps in inventory, when you assign an app to an employee, a license for the app is assigned to them. You can manage these licenses, either by assigning them, or reclaiming them so you can assign them to another employee. You can also remove an app from the private store. - -**To assign licenses** -1. Sign in to the [Store for Business](http://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Inventory**. -3. Find an app, click the ellipses under **Action**, and then choose **View license details**. -4. Click **Assign to people**, type the name you are assigning the license to, and then click **Assign**. - -Store for Business assigns a license to the person, and adds them to the list of assigned licenses. - -**To reclaim licenses** -1. Sign in to the [Store for Business](http://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Inventory**. -3. Find an app, click the ellipses under **Action**, and then choose **View license details**. -4. Click the name of the person you are reclaiming the license from, and then click **Reclaim licenses**. - -Store for Business reclaims the license, and updates the number of avialable licenses. After you reclaim a license, you can assign a license to another employee. - -**To remove an app from the private store** - -If you decide that you don't want an app available for employees to install on their own, you can remove it from your private store. -1. Sign in to the [Store for Business](http://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Inventory**. -3. Find an app, click the ellipses under **Action**, and then choose **Remove from private store**, and then click **Remove**. - -The app will still be in your inventory, but your employees will not have access to the app from your private store. + diff --git a/windows/manage/manage-orders-windows-store-for-business.md b/windows/manage/manage-orders-windows-store-for-business.md index 03d95f9433..9ca7ce1322 100644 --- a/windows/manage/manage-orders-windows-store-for-business.md +++ b/windows/manage/manage-orders-windows-store-for-business.md @@ -6,6 +6,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Manage app orders in Windows Store for Business diff --git a/windows/manage/manage-private-store-settings.md b/windows/manage/manage-private-store-settings.md index 6132f1e513..e070bd57ea 100644 --- a/windows/manage/manage-private-store-settings.md +++ b/windows/manage/manage-private-store-settings.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Manage private store settings diff --git a/windows/manage/manage-settings-windows-store-for-business.md b/windows/manage/manage-settings-windows-store-for-business.md index 04bd40016e..704d4d4401 100644 --- a/windows/manage/manage-settings-windows-store-for-business.md +++ b/windows/manage/manage-settings-windows-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Manage settings for the Windows Store for Business @@ -36,7 +37,7 @@ You can add users and groups, as well as update some of the settings associated

    - + diff --git a/windows/manage/manage-tips-and-suggestions.md b/windows/manage/manage-tips-and-suggestions.md new file mode 100644 index 0000000000..2fbb2e3cda --- /dev/null +++ b/windows/manage/manage-tips-and-suggestions.md @@ -0,0 +1,64 @@ +--- +title: Manage Windows 10 and Windows Store tips, tricks, and suggestions (Windows 10) +description: Windows 10 provides organizations with various options to manage auser experiences to provide a consistent and predictable experience for employees. +keywords: ["device management"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: devices +author: jdeckerMS +localizationpriority: high +--- + +# Manage Windows 10 and Windows Store tips, tricks, and suggestions + + +**Applies to** + +- Windows 10 + + +Since its inception, Windows 10 has included a number of user experience features that provide useful tips, tricks, and suggestions as you use Windows, as well as app suggestions from the Windows Store. These features are designed to help people get the most out of their Windows 10 experience by, for example, sharing new features, providing more details on the features they use, or sharing content available in the Windows Store. Examples of such user experiences include: + +* **Windows Spotlight on the lock screen**. Daily updated images on the lock screen that can include additional facts and tips in “hotspots” that are revealed on hover. + +* **Start menu app suggestions**. App suggestions in Start that recommend productivity tool or utilities from the Windows Store. + +* **Additional apps on Start**. Additional apps pre-installed on the Start screen which can enhance the user’s experience. + +* **Windows tips**. Contextual tips that appear based on specific user actions to reveal related Windows features or help users complete a scenario. + +* **Microsoft account notifications**. For users who have a connected Microsoft account, toast notifications about their account like parental control notifications or subscription expiration. + +>[!TIP] +> On all Windows desktop editions, users can directly enable and disable Windows 10 tips, tricks, and suggestions and Windows Store suggestions. For example, users are able to select personal photos for the lock screen as opposed to the images provided by Microsoft, or turn off tips, tricks, or suggestions as they use Windows. + +Windows 10, version 1607 (also known as the Anniversary Update), provides organizations the ability to centrally manage the type of content provided by these features through Group Policy or mobile device management (MDM). The following table describes how administrators can manage suggestions and tips in Windows 10 commercial and education editions. + +## Options available to manage Windows 10 tips and tricks and Windows Store suggestions + +| Windows 10 edition | Disable |Show Microsoft apps only | Show Microsoft and popular third-party apps | +| --- | --- | --- | --- | +| Windows 10 Pro | No | Yes | Yes (default) | +| Windows 10 Enterprise | Yes | Yes | Yes (default) | +| Windows 10 Pro Education | Yes (default) | Yes | No (setting cannot be changed) | +| Windows 10 Education | Yes (default) | Yes | No (setting cannot be changed) | + + + +## Related topics + +- [Manage Windows 10 Start layout](windows-10-start-layout-options-and-policies.md) +- [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) +- [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md) +- [Windows 10 editions for education customers](https://technet.microsoft.com/en-us/edu/windows/windows-editions-for-education-customers) + + +  + +  + + + + + diff --git a/windows/manage/manage-users-and-groups-windows-store-for-business.md b/windows/manage/manage-users-and-groups-windows-store-for-business.md index 42fb25bfa2..23783a767d 100644 --- a/windows/manage/manage-users-and-groups-windows-store-for-business.md +++ b/windows/manage/manage-users-and-groups-windows-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Manage user accounts in Windows Store for Business @@ -32,20 +33,20 @@ Azure AD is an Azure service that provides identity and access management capabi - Integrate with on-premises Active Directory. -For more information on Azure AD, see [About Office 365 and Azure Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](http://go.microsoft.com/fwlink/p/?LinkId=708611). +For more information on Azure AD, see [About Office 365 and Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](https://go.microsoft.com/fwlink/p/?LinkId=708611). ## Add user accounts to your Azure AD directory If you created a new Azure AD directory when you signed up for Store for Business, you'll have a directory set up with one user account - the global administrator. That global administrator can add user accounts to your Azure AD directory. However, adding user accounts to your Azure AD directory will not give those employees access to Store for Business. You'll need to assign Store for Business roles to your employees. For more information, see [Roles and permissions in the Store for Business.](roles-and-permissions-windows-store-for-business.md) -You can use the [Office 365 admin dashboard](http://go.microsoft.com/fwlink/p/?LinkId=708616) or [Azure management portal](http://go.microsoft.com/fwlink/p/?LinkId=691086) to add user accounts to your Azure AD directory. If you'll be using Azure management portal, you'll need an active subscription to [Azure management portal](http://go.microsoft.com/fwlink/p/?LinkId=708617). +You can use the [Office 365 admin dashboard](https://go.microsoft.com/fwlink/p/?LinkId=708616) or [Azure management portal](https://go.microsoft.com/fwlink/p/?LinkId=691086) to add user accounts to your Azure AD directory. If you'll be using Azure management portal, you'll need an active subscription to [Azure management portal](https://go.microsoft.com/fwlink/p/?LinkId=708617). For more information, see: -- [Add user accounts using Office 365 admin dashboard](http://go.microsoft.com/fwlink/p/?LinkId=708618) +- [Add user accounts using Office 365 admin dashboard](https://go.microsoft.com/fwlink/p/?LinkId=708618) -- [Add user accounts using Azure management portal](http://go.microsoft.com/fwlink/p/?LinkId=708619) +- [Add user accounts using Azure management portal](https://go.microsoft.com/fwlink/p/?LinkId=708619)   diff --git a/windows/manage/manage-wifi-sense-in-enterprise.md b/windows/manage/manage-wifi-sense-in-enterprise.md index 172b930871..6f0d6a2526 100644 --- a/windows/manage/manage-wifi-sense-in-enterprise.md +++ b/windows/manage/manage-wifi-sense-in-enterprise.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile author: eross-msft +localizationpriority: medium --- # Manage Wi-Fi Sense in your company @@ -16,6 +17,8 @@ author: eross-msft - Windows 10 - Windows 10 Mobile +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + Wi-Fi Sense learns about open Wi-Fi hotspots your Windows PC or Windows phone connects to by collecting information about the network, like whether the open Wi-Fi network has a high-quality connection to the Internet. By using that information from your device and from other Wi-Fi Sense customers' devices too, Wi-Fi Sense builds a database of these high-quality networks. When you’re in range of one of these Wi-Fi hotspots, you automatically get connected to it. The initial settings for Wi-Fi Sense are determined by the options you chose when you first set up your PC with Windows 10. @@ -49,7 +52,7 @@ You can manage your Wi-Fi Sense settings by using registry keys and the Registry 1. Open your Registry Editor and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config\` 2. Create and set a new **DWORD (32-bit) Value** named, **AutoConnectAllowedOEM**, with a **Value data** of **0 (zero)**. -

    Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see [How to configure Wi-Fi Sense on Windows 10 in an enterprise](http://go.microsoft.com/fwlink/p/?LinkId=620959). +

    Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see [How to configure Wi-Fi Sense on Windows 10 in an enterprise](https://go.microsoft.com/fwlink/p/?LinkId=620959). ![Registry Editor, showing the creation of a new DWORD value](images/wifisense-registry.png) @@ -59,7 +62,7 @@ You can manage your Wi-Fi Sense settings by changing the Windows provisioning se **To set up Wi-Fi Sense using WiFISenseAllowed** - Change the Windows Provisioning setting, **WiFISenseAllowed**, to **0**. -

    Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Windows Provisioning settings reference topic, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620909). +

    Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Windows Provisioning settings reference topic, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620909). ### Using Unattended Windows Setup settings If your company still uses Unattend, you can manage your Wi-Fi Sense settings by changing the Unattended Windows Setup setting, **WiFiSenseAllowed**. @@ -67,7 +70,7 @@ If your company still uses Unattend, you can manage your Wi-Fi Sense settings by **To set up Wi-Fi Sense using WiFISenseAllowed** - Change the Unattended Windows Setup setting, **WiFISenseAllowed**, to **0**. -

    Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Unattended Windows Setup Reference topic, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620910). +

    Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Unattended Windows Setup Reference topic, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620910). ### How employees can change their own Wi-Fi Sense settings If you don’t turn off the ability for your employees to use Wi-Fi Sense, they can turn it on locally by selecting **Settings > Network & Internet > Wi-Fi > Manage Wi-Fi settings**, and then turning on **Connect to suggested open hotspots**. @@ -83,8 +86,8 @@ Even if you selected **Automatically connect to networks shared by your contacts If you select the **Share network with my contacts** check box the first time you connect to a new network, the network won’t be shared. ## Related topics -- [Wi-Fi Sense and Privacy](http://go.microsoft.com/fwlink/p/?LinkId=620911) -- [How to configure Wi-Fi Sense on Windows 10 in an enterprise](http://go.microsoft.com/fwlink/p/?LinkId=620959) +- [Wi-Fi Sense and Privacy](https://go.microsoft.com/fwlink/p/?LinkId=620911) +- [How to configure Wi-Fi Sense on Windows 10 in an enterprise](https://go.microsoft.com/fwlink/p/?LinkId=620959)   diff --git a/windows/manage/mandatory-user-profile.md b/windows/manage/mandatory-user-profile.md new file mode 100644 index 0000000000..5a19dddc3e --- /dev/null +++ b/windows/manage/mandatory-user-profile.md @@ -0,0 +1,171 @@ +--- +title: Create mandatory user profiles (Windows 10) +description: A mandatory user profile is a special type of pre-configured roaming user profile that administrators can use to specify settings for users. +keywords: [".man","ntuser"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +--- + +# Create mandatory user profiles + + +**Applies to** + +- Windows 10 + +> [!NOTE] +> When a mandatory profile is applied to a PC running Windows 10, version 1511, some features such as Universal Windows Platform (UWP) apps, the Start menu, Cortana, and Search, will not work correctly. This will be fixed in a future update. + +A mandatory user profile is a roaming user profile that has been pre-configured by an administrators to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. + +Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. + +When the server that stores the mandatory profile is unavailable, such as when the user is not connected to the corporate network, users with mandatory profiles can sign in with the locally cached copy of the mandatory profile, if one exists. Otherwise, the user will be signed in with a temporary profile. + +User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) of each user's profile in the file system of the profile server from `NTuser.dat` to `NTuser.man`. The `.man` extension causes the user profile to be a read-only profile. + + +## Profile extension for each Windows version + +The name of the folder in which you store the mandatory profile must use the correct extension for the operating system it will be applied to. The following table lists the correct extension for each operating system version. + +| Client operating system version | Server operating system version | Profile extension | +| --- | --- | --- | +| Windows XP | Windows Server 2003
    Windows Server 2003 R2 | none | +| Windows Vista
    Windows 7 | Windows Server 2008
    Windows Server 2008 R2 | v2 | +| Windows 8 | Windows Server 2012 | v3 | +| Windows 8.1 | Windows Server 2012 R2 | v4 | +| Windows 10, versions 1507 and 1511 | N/A | v5 | +| Windows 10, version 1607 (also known as the Anniversary Update) | Windows Server 2016 | v6 | + +For more information, see [Deploy Roaming User Profiles, Appendix B](https://technet.microsoft.com/library/jj649079.aspx) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198). + +## How to create a mandatory user profile + +First, you create a default user profile with the customizations that you want, run Sysprep with CopyProfile set to **True** in the answer file, copy the customized default user profile to a network share, and then you rename the profile to make it mandatory. + +**To create a default user profile** + +1. Sign in to a computer running Windows 10 as a member of the local Administrator group. Do not use a domain account. + + > [!NOTE] + > Use a lab or extra computer running a clean installation of Windows 10 to create a default user profile. Do not use a computer that is required for business (that is, a production computer). This process removes all domain accounts from the computer, including user profile folders. + +2. Configure the computer settings that you want to include in the user profile. For example, you can configure settings for the desktop background, uninstall default apps, install line-of-business apps, and so on. + + >[!NOTE] + >Unlike previous versions of Windows, you cannot apply a Start and taskbar layout using a mandatory profile. For alternative methods for customizing the Start menu and taskbar, see [Related topics](#related-topics). + +3. [Create an answer file (Unattend.xml)](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) that sets the [CopyProfile](https://msdn.microsoft.com/library/windows/hardware/dn922656.aspx) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user’s profile folder to the default user profile. You can use [Windows System Image Manager](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. + +3. Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) cmdlet in Windows PowerShell to uninstall the following applications: + + - Microsoft.windowscommunicationsapps_8wekyb3d8bbwe + - Microsoft.BingWeather_8wekyb3d8bbwe + - Microsoft.DesktopAppInstaller_8wekyb3d8bbwe + - Microsoft.Getstarted_8wekyb3d8bbwe + - Microsoft.Windows.Photos_8wekyb3d8bbwe + - Microsoft.WindowsCamera_8wekyb3d8bbwe + - Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe + - Microsoft.WindowsStore_8wekyb3d8bbwe + - Microsoft.XboxApp_8wekyb3d8bbwe + - Microsoft.XboxIdentityProvider_8wekyb3d8bbwe + - Microsoft.ZuneMusic_8wekyb3d8bbwe + + >[!NOTE] + >Uninstalling these apps will decrease sign-in time. If your deployment needs any of these apps, you can leave them installed. + +3. At a command prompt, type the following command and press **ENTER**. + + `sysprep /oobe /reboot /generalize /unattend:unattend.xml` + + (Sysprep.exe is located at: C:\Windows\System32\sysprep. By default, Sysprep looks for unattend.xml in this same folder.) + + >[!TIP] + >If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\System32\Sysprep\Panther\setupact.log and look for an entry like the following: + + >![Microsoft Bing Translator package](images/sysprep-error.png) + + >Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. + +5. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. + +6. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. + +7. In **User Profiles**, click **Default Profile**, and then click **Copy To**. + + ![Example of UI](images/copy-to.png) + +8. In **Copy To**, under **Permitted to use**, click **Change**. + + ![Example of UI](images/copy-to-change.png) + +9. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. + +10. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#extension) for the operating system version. For example, the folder name must end with “.v6” to identify it as a user profile folder for Windows 10, version 1607. + + - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. + - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. + + ![Example of UI](images/copy-to-path.png) + +9. Click **OK** to copy the default user profile. + + +**To make the user profile mandatory** + + +3. In File Explorer, open the folder where you stored the copy of the profile. + + >[!NOTE] + >If the folder is not displayed, click **View** > **Options** > **Change folder and search options**. On the **View** tab, select **Show hidden files and folders**, clear **Hide protected operating system files**, click **Yes** to confirm that you want to show operating system files, and then click **OK** to save your changes. + +1. Rename `Ntuser.dat` to `Ntuser.man`. + +## How to apply a mandatory user profile to users + +In a domain, you modify properties for the user account to point to the mandatory profile in a shared folder residing on the server. + +**To apply a mandatory user profile to users** + +1. Open **Active Directory Users and Computers** (dsa.msc). + +2. Navigate to the user account that you will assign the mandatory profile to. + +3. Right-click the user name and open **Properties**. + +4. On the **Profile** tab, in the **Profile path** field, enter the path to the shared folder without the extension. For example, if the folder name is \\\\*server*\profile.v6, you would enter \\\\*server*\profile. + +5. Click **OK**. + +It may take some time for this change to replicate to all domain controllers. + + + +## Apply policies to improve sign-in time + +When a user is configured with a mandatory profile, Windows 10 starts as though it was the first sign-in each time the user signs in. To improve sign-in performance for users with mandatory user profiles, apply the following Group Policy settings. + +- Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled +- Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled +- Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled + + + + + + + + + +## Related topics + +- [Manage Windows 10 Start layout and taskbar options](windows-10-start-layout-options-and-policies.md) +- [Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md) +- [Windows Spotlight on the lock screen](windows-spotlight.md) +- [Configure devices without MDM](configure-devices-without-mdm.md) + + + diff --git a/windows/manage/new-policies-for-windows-10.md b/windows/manage/new-policies-for-windows-10.md index 2da6a7e615..873c393efd 100644 --- a/windows/manage/new-policies-for-windows-10.md +++ b/windows/manage/new-policies-for-windows-10.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: high --- # New policies for Windows 10 @@ -17,9 +18,9 @@ author: jdeckerMS - Windows 10 - Windows 10 Mobile -Windows 10 includes the following new policies for management, in addition to policies that were available for Windows 8.1 and Windows Phone 8.1. [Download the complete set of Administrative Template (.admx) files for Windows 10](http://go.microsoft.com/fwlink/p/?LinkID=625081). +Windows 10 includes the following new policies for management, in addition to policies that were available for Windows 8.1 and Windows Phone 8.1. [Download the complete set of Administrative Template (.admx) files for Windows 10](https://go.microsoft.com/fwlink/p/?LinkID=625081). -## New GPOs in Windows 10 +## New Group Policy settings in Windows 10 There are some new policy settings in Group Policy for devices running Windows 10 , such as: @@ -40,11 +41,11 @@ There are some new policy settings in Group Policy for devices running Windows  - Consumer experiences, such as suggested apps in Start and app tiles from Microsoft dynamically inserted in the default Start menu -- [Microsoft Passport](http://go.microsoft.com/fwlink/p/?LinkId=623294) +- [Microsoft Passport](https://go.microsoft.com/fwlink/p/?LinkId=623294) - Windows Updates for Business -For a spreadsheet of Group Policy settings included in Windows, see [Group Policy Settings Reference for Windows and Windows Server](http://go.microsoft.com/fwlink/p/?LinkId=613627). +For a spreadsheet of Group Policy settings included in Windows, see [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=613627). ## New MDM policies @@ -65,7 +66,7 @@ Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, Wind - Security -- [VPN](http://go.microsoft.com/fwlink/p/?LinkId=623295) and enterprise Wi-Fi management +- [VPN](https://go.microsoft.com/fwlink/p/?LinkId=623295) and enterprise Wi-Fi management - Certificate management @@ -73,9 +74,9 @@ Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, Wind - Consumer experiences, such as suggested apps in Start and app tiles from Microsoft dynamically inserted in the default Start menu -If you use Microsoft Intune for MDM, you can [configure custom policies](http://go.microsoft.com/fwlink/p/?LinkId=616316) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](http://go.microsoft.com/fwlink/p/?LinkId=616317). +If you use Microsoft Intune for MDM, you can [configure custom policies](https://go.microsoft.com/fwlink/p/?LinkId=616316) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=616317). -No new [Exchange ActiveSync policies](http://go.microsoft.com/fwlink/p/?LinkId=613264). For more information, see the [ActiveSync configuration service provider](http://go.microsoft.com/fwlink/p/?LinkId=618944) technical reference. +No new [Exchange ActiveSync policies](https://go.microsoft.com/fwlink/p/?LinkId=613264). For more information, see the [ActiveSync configuration service provider](https://go.microsoft.com/fwlink/p/?LinkId=618944) technical reference. ## Related topics diff --git a/windows/manage/prerequisites-windows-store-for-business.md b/windows/manage/prerequisites-windows-store-for-business.md index 85f411ba17..0ca1be50d5 100644 --- a/windows/manage/prerequisites-windows-store-for-business.md +++ b/windows/manage/prerequisites-windows-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Prerequisites for Windows Store for Business @@ -27,25 +28,20 @@ You'll need this software to work with Store for Business. ### Required - IT Pros that are administering Store for Business need a browser compatible with Store for Business running on a PC or mobile device. Supported browsers include: Internet Explorer 10 or later, Microsoft Edge, or current versions of Chrome or Firefox. - -- Employees using apps from Store for Business need Windows 10, version 1511 running on a PC or mobile device. +- Employees using apps from Store for Business need at least Windows 10, version 1511 running on a PC or mobile device. Microsoft Azure Active Directory (AD) accounts for your employees: - - IT Pros need Azure AD accounts to sign up for Store for Business, and then to sign in, get apps, distribute apps, and manage app licenses. - - Employees need Azure AD accounts when they access Store for Business content from Windows-based devices. - - If you use a management tool to distribute and manage online-licensed apps, all employees will need an Azure AD account. -For more information on Azure AD, see [About Office 365 and Azure Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](http://go.microsoft.com/fwlink/p/?LinkId=708611). +For more information on Azure AD, see [About Office 365 and Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](https://go.microsoft.com/fwlink/p/?LinkId=708611). ### Optional While not required, you can use a management tool to distribute and manage apps. Using a management tool allows you to distribute content, scope app availability, and control when app updates are installed. This might make sense for larger organizations that already use a management tool. If you're considering using management tools, check with the management tool vendor to see if they support Store for Business. The management tool will need to: - Integrate with the Windows 10 management framework and Azure AD. - - Sync with the Store for Business inventory to distribute apps. ### Proxy configuration @@ -53,21 +49,15 @@ While not required, you can use a management tool to distribute and manage apps. If your organization restricts computers on your network from connecting to the Internet, there is a set of URLs that need to be available for devices to use Store for Business. Some of the Store for Business features use Windows Store app and Windows Store services. Devices using Store for Business – either to acquire, install, or update apps – will need access to these URLs. If you use a proxy server to block traffic, your configuration needs to allow these URLs: - login.live.com - - login.windows.net - - account.live.com - - clientconfig.passport.net - - windowsphone.com - - \*.wns.windows.com - - \*.microsoft.com - -- \*.msftncsi.com/ncsi.txt - +- www.msftncsi.com (prior to Windows 10, version 1607) +- www.msftconnecttest.com/connecttest.txt (replaces www.msftncsi.com +starting with Windows 10, version 1607)     diff --git a/windows/manage/product-ids-in-windows-10-mobile.md b/windows/manage/product-ids-in-windows-10-mobile.md index f1e1f9a3e3..6fd085952b 100644 --- a/windows/manage/product-ids-in-windows-10-mobile.md +++ b/windows/manage/product-ids-in-windows-10-mobile.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile author: jdeckerMS +localizationpriority: high --- # Product IDs in Windows 10 Mobile @@ -232,7 +233,7 @@ The following table lists the product ID and AUMID for each app that is included ## Get product ID and AUMID for other apps -To get the product ID and AUMID for apps that are installed from Windows Store or installed locally ([side-loaded](http://go.microsoft.com/fwlink/p/?LinkID=623433)), use the following steps. +To get the product ID and AUMID for apps that are installed from Windows Store or installed locally ([side-loaded](https://go.microsoft.com/fwlink/p/?LinkID=623433)), use the following steps. **Prerequisites**: a device with an SD card inserted and all apps installed that you want to get IDs for diff --git a/windows/manage/reset-a-windows-10-mobile-device.md b/windows/manage/reset-a-windows-10-mobile-device.md index f9b0a026b4..7a18801dd0 100644 --- a/windows/manage/reset-a-windows-10-mobile-device.md +++ b/windows/manage/reset-a-windows-10-mobile-device.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile author: jdeckerMS +localizationpriority: high --- # Reset a Windows 10 Mobile device @@ -18,15 +19,15 @@ author: jdeckerMS There are two methods for resetting a Windows 10 Mobile device: factory reset and "wipe and persist" reset. -- **Factory reset** restores the state of the device back to its first-boot state plus any update packages. The reset will not return device to the original factory state. To return the device to the original factory state, you must flash it with the original factory image.All the provisioning applied to the device by the enterprise will be lost and will need to be re-applied if needed. For details on what is removed or persists, see [Resetting a mobile device](http://go.microsoft.com/fwlink/p/?LinkID=703715). -- **"Wipe and persist" reset** preserves all the provisioning applied to the device before the reset. After the "wipe and persist" reset, all the preserved provisioning packages are automatically applied on the device and the data in the enterprise shared storage folder \\Data\\SharedData\\Enterprise\\Persistent is restored in that folder. For more information on the enterprise shared storage folder, see [EnterpriseExtFileSystem CSP](http://go.microsoft.com/fwlink/p/?LinkId=703716). +- **Factory reset** restores the state of the device back to its first-boot state plus any update packages. The reset will not return device to the original factory state. To return the device to the original factory state, you must flash it with the original factory image by using the [Windows Device Recovery Tool](https://support.microsoft.com/help/12379/windows-10-mobile-device-recovery-tool-faq). All the provisioning applied to the device by the enterprise will be lost and will need to be re-applied if needed. For details on what is removed or persists, see [Resetting a mobile device](https://go.microsoft.com/fwlink/p/?LinkID=703715). +- **"Wipe and persist" reset** preserves all the provisioning applied to the device before the reset. After the "wipe and persist" reset, all the preserved provisioning packages are automatically applied on the device and the data in the enterprise shared storage folder \\Data\\SharedData\\Enterprise\\Persistent is restored in that folder. For more information on the enterprise shared storage folder, see [EnterpriseExtFileSystem CSP](https://go.microsoft.com/fwlink/p/?LinkId=703716). You can trigger a reset using your mobile device management (MDM) service, or a user can trigger a reset in the user interface (UI) or by using hardware buttons. ## Reset using MDM -The remote wipe command is sent as an XML provisioning file to the device. Since the [RemoteWipe configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkId=703714) uses OMA DM and WAP, authentication between client and server and delivery of the XML provisioning file is handled by provisioning. The remote wipe command is implemented on the device by using the **ResetPhone** function. For more information about the data that is removed as a result of the remote wipe command, see [Resetting a mobile device](http://go.microsoft.com/fwlink/p/?LinkId=703715). +The remote wipe command is sent as an XML provisioning file to the device. Since the [RemoteWipe configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkId=703714) uses OMA DM and WAP, authentication between client and server and delivery of the XML provisioning file is handled by provisioning. The remote wipe command is implemented on the device by using the **ResetPhone** function. For more information about the data that is removed as a result of the remote wipe command, see [Resetting a mobile device](https://go.microsoft.com/fwlink/p/?LinkId=703715). To perform a factory reset, restoring the device back to its out-of-box state, use the following syncML. diff --git a/windows/manage/roles-and-permissions-windows-store-for-business.md b/windows/manage/roles-and-permissions-windows-store-for-business.md index 92d9f7e5e8..9542529fbe 100644 --- a/windows/manage/roles-and-permissions-windows-store-for-business.md +++ b/windows/manage/roles-and-permissions-windows-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Roles and permissions in Windows Store for Business @@ -96,7 +97,7 @@ This table lists the global user accounts and the permissions they have in the S ### Store for Business roles and permissions -Store for Businesshas a set of roles that help IT admins and employees manage access to apps and tasks for the Store for Business. Employees with these roles will need to use their Azure AD account to access the Store for Business. +Store for Business has a set of roles that help IT admins and employees manage access to apps and tasks for the Store for Business. Employees with these roles will need to use their Azure AD account to access the Store for Business. This table lists the roles and their permissions. diff --git a/windows/manage/set-up-a-device-for-anyone-to-use.md b/windows/manage/set-up-a-device-for-anyone-to-use.md index 156c44901a..f274498ed1 100644 --- a/windows/manage/set-up-a-device-for-anyone-to-use.md +++ b/windows/manage/set-up-a-device-for-anyone-to-use.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: high --- # Set up a device for anyone to use (kiosk mode) @@ -19,7 +20,7 @@ author: jdeckerMS **Looking for Windows Embedded 8.1 Industry information?** -- [Assigned Access]( http://go.microsoft.com/fwlink/p/?LinkId=613653) +- [Assigned Access]( https://go.microsoft.com/fwlink/p/?LinkId=613653) You can configure a device running Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile, or Windows 10 Mobile Enterprise as a kiosk device, so that users can only interact with a single application that you select. @@ -33,8 +34,8 @@ Do you need a computer that can only do one thing? For example: The following table identifies the type of application that can be used on each Windows 10 edition to create a kiosk device. -**Note**   -A Universal Windows app is built on the Universal Windows Platform (UWP), which was first introduced in Windows 8 as the Windows Runtime. A Classic Windows application uses the Classic Windows Platform (CWP) (e.g., COM, Win32, WPF, WinForms, etc.) and is typically launched using an .EXE or .DLL file. +> [!NOTE]   +> A Universal Windows app is built on the Universal Windows Platform (UWP), which was first introduced in Windows 8 as the Windows Runtime. A Classic Windows application uses the Classic Windows Platform (CWP) (e.g., COM, Win32, WPF, WinForms, etc.) and is typically launched using an .EXE or .DLL file.   diff --git a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md index ff53ab6757..211f47f9c2 100644 --- a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md +++ b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: high --- # Set up a kiosk on Windows 10 Pro, Enterprise, or Education @@ -16,7 +17,7 @@ author: jdeckerMS - Windows 10 -> **Looking for Windows Embedded 8.1 Industry information?** See [Assigned Access]( http://go.microsoft.com/fwlink/p/?LinkId=613653) +> **Looking for Windows Embedded 8.1 Industry information?** See [Assigned Access]( https://go.microsoft.com/fwlink/p/?LinkId=613653) A single-use or *kiosk* device is easy to set up in Windows 10 for desktop editions (Pro, Enterprise, and Education). For a kiosk device to run a Universal Windows app, use the **assigned access** feature. For a kiosk device (Windows 10 Enterprise or Education) to run a Classic Windows application, use **Shell Launcher** to set a custom user interface as the shell. To return the device to the regular shell, see [Sign out of assigned access](#sign-out-of-assigned-access). @@ -81,9 +82,9 @@ Using assigned access, Windows 10 runs the designated Universal Windows app abo - A domain or local user account. -- A Universal Windows app that is installed or provisioned for that account and is an above lock screen app. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md). For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](http://go.microsoft.com/fwlink/p/?LinkId=708386). +- A Universal Windows app that is installed or provisioned for that account and is an above lock screen app. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md). For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](https://go.microsoft.com/fwlink/p/?LinkId=708386). - The app can be your own company app that you have made available in your own app Store. To set up assigned access using MDM or PowerShell, you also need the Application User Model ID (AUMID) for the app. [Learn how to get the AUMID](http://go.microsoft.com/fwlink/p/?LinkId=614867). + The app can be your own company app that you have made available in your own app Store. To set up assigned access using MDM or PowerShell, you also need the Application User Model ID (AUMID) for the app. [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867). The Universal Windows app must be able to handle multiple views and cannot launch other apps or dialogs. @@ -110,13 +111,13 @@ To remove assigned access, in step 3, choose **Don't use assigned access**. Assigned Access has one setting, KioskModeApp. In the KioskModeApp setting, you enter the user account name and AUMID for the app to run in kiosk mode. -[Learn how to get the AUMID](http://go.microsoft.com/fwlink/p/?LinkId=614867). +[Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867). -[See the technical reference for the Assigned Access configuration service provider.](http://go.microsoft.com/fwlink/p/?LinkId=626608) +[See the technical reference for the Assigned Access configuration service provider.](https://go.microsoft.com/fwlink/p/?LinkId=626608) ### Set up assigned access using Windows Imaging and Configuration Designer (ICD) -Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that configures a device as a kiosk. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) +Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that configures a device as a kiosk. [Install the ADK.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) > **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. @@ -176,7 +177,7 @@ When you build a provisioning package, you may include sensitive information in After you allow the package to be installed, the settings will be applied to the device -[Learn how to apply a provisioning package in audit mode or OOBE.](http://go.microsoft.com/fwlink/p/?LinkID=692012) +[Learn how to apply a provisioning package in audit mode or OOBE.](https://go.microsoft.com/fwlink/p/?LinkID=692012) ### Set up assigned access using Windows PowerShell @@ -201,11 +202,11 @@ Set-AssignedAccess -AppName -UserSID ``` > **Note:** To set up assigned access using `-AppName`, the user account that you specify for assigned access must have logged on at least once. -[Learn how to get the AUMID](http://go.microsoft.com/fwlink/p/?LinkId=614867). +[Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867). -[Learn how to get the AppName](https://msdn.microsoft.com/en-us/library/windows/hardware/mt620046%28v=vs.85%29.aspx) (see **Parameters**). +[Learn how to get the AppName](https://msdn.microsoft.com/library/windows/hardware/mt620046%28v=vs.85%29.aspx) (see **Parameters**). -[Learn how to get the SID](http://go.microsoft.com/fwlink/p/?LinkId=615517). +[Learn how to get the SID](https://go.microsoft.com/fwlink/p/?LinkId=615517). To remove assigned access, using PowerShell, run the following cmdlet. @@ -223,7 +224,7 @@ Edit the registry to have an account automatically logged on. 1. Open Registry Editor (regedit.exe). **Note**   - If you are not familiar with Registry Editor, [learn how to modify the Windows registry](http://go.microsoft.com/fwlink/p/?LinkId=615002). + If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002).   2. Go to @@ -246,7 +247,7 @@ Edit the registry to have an account automatically logged on. ### Sign out of assigned access -To sign out of an assigned access account, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. +To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. The assigned access user will remain signed in until an admin account opens **Task Manager** > **Users** and signs out the user account. If you press **Ctrl + Alt + Del** and do not sign in to another account, after a set time, assigned access will resume. The default time is 30 seconds, but you can change that in the following registry key: @@ -265,7 +266,7 @@ Using Shell Launcher, you can configure a kiosk device that runs a Classic Windo - A Classic Windows application that is installed for that account. The app can be your own company application or a common app like Internet Explorer. -[See the technical reference for the shell launcher component.](http://go.microsoft.com/fwlink/p/?LinkId=618603) +[See the technical reference for the shell launcher component.](https://go.microsoft.com/fwlink/p/?LinkId=618603) ### Configure Shell Launcher @@ -282,28 +283,73 @@ Alternatively, you can turn on Shell Launcher using the Deployment Image Servici 1. Open a command prompt as an administrator. 2. Enter the following command. - -

    [Microsoft System Center Configuration Manager 2016](http://go.microsoft.com/fwlink/p/?LinkId=613622)

    [System Center Configuration Manager (current branch) ](https://technet.microsoft.com/en-us/library/mt346023.aspx)

    Client deployment, upgrade, and management with new and existing features

    [Update Windows Store for Business account settings](update-windows-store-for-business-account-settings.md)

    The Account information page in Windows Store for Business shows information about your organization that you can update, including: country or region, organization name, default domain, and language preference. These are settings in the Azure AD directory that you used when signing up for Store for Business

    The Account information page in Windows Store for Business shows information about your organization that you can update, including: organization information, payment options, and offline licensing settings.

    [Manage user accounts in Windows Store for Business](manage-users-and-groups-windows-store-for-business.md)

    - - - - - - - - - 
    Dism /online /Enable-Feature /FeatureName:Client-EmbeddedShellLauncher
    + + ``` + Dism /online /Enable-Feature /all /FeatureName:Client-EmbeddedShellLauncher + ``` **To set your custom shell** Modify the following PowerShell script as appropriate. The comments in the sample script explain the purpose of each section and tell you where you will want to change the script for your purposes. Save your script with the extension .ps1, open Windows PowerShell as administrator, and run the script on the kiosk device. ``` +# Check if shell launcher license is enabled +function Check-ShellLauncherLicenseEnabled +{ + [string]$source = @" +using System; +using System.Runtime.InteropServices; + +static class CheckShellLauncherLicense +{ + const int S_OK = 0; + + public static bool IsShellLauncherLicenseEnabled() + { + int enabled = 0; + + if (NativeMethods.SLGetWindowsInformationDWORD("EmbeddedFeature-ShellLauncher-Enabled", out enabled) != S_OK) { + enabled = 0; + } + + return (enabled != 0); + } + + static class NativeMethods + { + [DllImport("Slc.dll")] + internal static extern int SLGetWindowsInformationDWORD([MarshalAs(UnmanagedType.LPWStr)]string valueName, out int value); + } + +} +"@ + + $type = Add-Type -TypeDefinition $source -PassThru + + return $type[0]::IsShellLauncherLicenseEnabled() +} + +[bool]$result = $false + +$result = Check-ShellLauncherLicenseEnabled +"`nShell Launcher license enabled is set to " + $result +if (-not($result)) +{ + "`nThis device doesn't have required license to use Shell Launcher" + exit +} + $COMPUTER = "localhost" $NAMESPACE = "root\standardcimv2\embedded" # Create a handle to the class instance so we can call the static methods. -$ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting" +try { + $ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting" + } catch [Exception] { + write-host $_.Exception.Message; + write-host "Make sure Shell Launcher feature is enabled" + exit + } # This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group. @@ -318,7 +364,7 @@ function Get-UsernameSID($AccountName) { $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier]) return $NTUserSID.Value - + } # Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script. diff --git a/windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md b/windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md index e0859c769c..1a11ff9c20 100644 --- a/windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md +++ b/windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile author: jdeckerMS +localizationpriority: high --- # Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise @@ -20,7 +21,7 @@ author: jdeckerMS A device in kiosk mode runs a specified app with no access to other device functions, menus, or settings. You configure a device running Windows 10 Mobile or Windows 10 Mobile Enterprise for kiosk mode by using the Apps Corner feature. You can also use the Enterprise Assigned Access configuration service provider (CSP) to configure a kiosk experience. **Note**   -The specified app must be an above lock screen app. For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](http://go.microsoft.com/fwlink/p/?LinkId=708386). +The specified app must be an above lock screen app. For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](https://go.microsoft.com/fwlink/p/?LinkId=708386).   @@ -69,7 +70,7 @@ Enterprise Assigned Access allows you to lock down your Windows 10 Mobile or Wi In AssignedAccessXml, for Application, you enter the product ID for the app to run in kiosk mode. Find product IDs at [Product IDs in Windows 10 Mobile](product-ids-in-windows-10-mobile.md). -[See the technical reference for the Enterprise Assigned Access configuration service provider (CSP).](http://go.microsoft.com/fwlink/p/?LinkID=618601) +[See the technical reference for the Enterprise Assigned Access configuration service provider (CSP).](https://go.microsoft.com/fwlink/p/?LinkID=618601) ### Set up assigned access using Windows Imaging and Configuration Designer (ICD) @@ -78,14 +79,14 @@ When you build a provisioning package, you may include sensitive information in **To create and apply a provisioning package for a kiosk device** -1. Create an *AssignedAccess*.xml file that specifies the app the device will run. (You can name use any file name.) For instructions on AssignedAccessXml, see [EnterpriseAssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=618601). +1. Create an *AssignedAccess*.xml file that specifies the app the device will run. (You can name use any file name.) For instructions on AssignedAccessXml, see [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601). **Note**   Do not escape the xml in *AssignedAccess*.xml file as Windows Imaging and Configuration Designer (ICD) will do that when building the package. Providing escaped xml in Windows ICD will cause building the package fail.   -2. Open Windows ICD (by default, %windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). +2. Open Windows ICD (by default, `%windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe`). 3. Choose **Advanced provisioning**. @@ -177,7 +178,7 @@ When you build a provisioning package, you may include sensitive information in 5. Restart the device and verify that the runtime settings that were configured in the provisioning package were applied to the device. - [Learn how to apply a provisioning package in audit mode or OOBE.](http://go.microsoft.com/fwlink/p/?LinkID=692012) + [Learn how to apply a provisioning package in audit mode or OOBE.](https://go.microsoft.com/fwlink/p/?LinkID=692012) ## Related topics diff --git a/windows/manage/set-up-shared-or-guest-pc.md b/windows/manage/set-up-shared-or-guest-pc.md index 04d5016d22..f641f80569 100644 --- a/windows/manage/set-up-shared-or-guest-pc.md +++ b/windows/manage/set-up-shared-or-guest-pc.md @@ -1,11 +1,12 @@ --- title: Set up a shared or guest PC with Windows 10 (Windows 10) -description: tbd +description: Windows 10, version 1607, introduces *shared PC mode*, which optimizes Windows 10 for shared use scenarios. keywords: ["shared pc mode"] ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: high --- # Set up a shared or guest PC with Windows 10 @@ -15,9 +16,10 @@ author: jdeckerMS - Windows 10 -Windows 10, version 1607, introduces *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Education, and Enterprise. +Windows 10, version 1607, introduces *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Pro Education, Education, and Enterprise. -> **Note:** If you're interested in using Windows 10 for shared PCs in a school, see [Use Set up School PCs app](https://technet.microsoft.com/en-us/edu/windows/use-set-up-school-pcs-app) which provides a simple way to configure PCs with shared PC mode plus additional settings specific for education. +> [!NOTE] +> If you're interested in using Windows 10 for shared PCs in a school, see [Use Set up School PCs app](https://technet.microsoft.com/edu/windows/use-set-up-school-pcs-app) which provides a simple way to configure PCs with shared PC mode plus additional settings specific for education. ##Shared PC mode concepts A Windows 10 PC in shared PC mode is designed to be management- and maintenance-free with high reliability. In shared PC mode, only one user can be signed in at a time. When the PC is locked, the currently signed in user can always be signed out at the lock screen. Users who sign-in are signed in as standard users, not admin users. @@ -37,7 +39,11 @@ While shared PC mode does not configure Windows Update itself, it is strongly re - MDM: Set **Update/AllowAutoUpdate** to `4`. - Provisioning: In Windows Imaging and Configuration Designer (ICD), set **Policies/Update/AllowAutoUpdate** to `4`. -[Learn more about the AllowAutoUpdate settings](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_AllowAutoUpdate) +[Learn more about the AllowAutoUpdate settings](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_AllowAutoUpdate) + +###App behavior + +Apps can take advantage of shared PC mode by changing their app behavior to align with temporary use scenarios. For example, an app might only download content on demand on a device in shared PC mode, or might skip first run experiences. For information on how an app can query for shared PC mode, see [SharedModeSettings class](https://msdn.microsoft.com/en-us/library/windows/apps/windows.system.profile.sharedmodesettings.aspx). ###Customization Shared PC mode exposes a set of customizations to tailor the behavior to your requirements. These customizations are the options that you'll set either using MDM or a provisioning package as explained in [Configuring shared PC mode on Windows](#configuring-shared-pc-mode-on-windows). The options are listed in the following table. @@ -59,16 +65,18 @@ Shared PC mode exposes a set of customizations to tailor the behavior to your re ##Configuring shared PC mode on Windows You can configure Windows to be in shared PC mode in a couple different ways: -- Mobile device management (MDM): Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723294.aspx). Your MDM policy can contain any of the options listed in the [Customization](#customization) section. The following image shows a Microsoft Intune policy with the shared PC options added as OMA-URI settings. [Learn more about Windows 10 policy settings in Microsoft Intune.](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune) +- Mobile device management (MDM): Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx). Your MDM policy can contain any of the options listed in the [Customization](#customization) section. The following image shows a Microsoft Intune policy with the shared PC options added as OMA-URI settings. [Learn more about Windows 10 policy settings in Microsoft Intune.](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune) + ![custom OMA-URI policy in Intune](images/oma-uri-shared-pc.png) -- A provisioning package created with the Windows Imaging and Configuration Designer (ICD): You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Imaging and Configuration Designer (ICD). Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723294.aspx), exposed in ICD as SharedPC. + +- A provisioning package created with the Windows Imaging and Configuration Designer (ICD): You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Imaging and Configuration Designer (ICD). Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx), exposed in ICD as SharedPC. ![Shared PC settings in ICD](images/icd-adv-shared-pc.png) ### Create a provisioning package for shared use -Use the Windows ICD tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that configures a device for shared PC mode. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) +Use the Windows ICD tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that configures a device for shared PC mode. [Install the ADK and select **Configuration Designer**.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) 1. Open Windows ICD (by default, %windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). @@ -86,14 +94,15 @@ Use the Windows ICD tool included in the Windows Assessment and Deployment Kit ( 8. On the **Export** menu, select **Provisioning package**. 9. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** 10. Set a value for **Package Version**. - > **Tip**   - You can make changes to existing packages and change the version number to update previously applied packages. + > [!TIP] + > You can make changes to existing packages and change the version number to update previously applied packages.   -11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. +11. (*Optional*) In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. - > **Important**   - We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently. + + > [!IMPORTANT]   + > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.   12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. @@ -165,7 +174,8 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Work ac ![add a package option](images/package.png) -> **Note:** If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost. +> [!NOTE] +> If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost. ## Guidance for accounts on shared PCs @@ -198,7 +208,8 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Work ac ## Policies set by shared PC mode Shared PC mode sets local group policies to configure the device. Some of these are configurable using the shared pc mode options. -> **Important**: It is not recommended to set additional policies on PCs configured for **Shared PC Mode**. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. +> [!IMPORTANT] +> It is not recommended to set additional policies on PCs configured for **Shared PC Mode**. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. @@ -241,8 +252,8 @@ Shared PC mode sets local group policies to configure the device. Some of these - - + + diff --git a/windows/manage/settings-reference-windows-store-for-business.md b/windows/manage/settings-reference-windows-store-for-business.md index 283e512bd4..8b88eba8e5 100644 --- a/windows/manage/settings-reference-windows-store-for-business.md +++ b/windows/manage/settings-reference-windows-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Settings reference: Windows Store for Business diff --git a/windows/manage/settings-that-can-be-locked-down.md b/windows/manage/settings-that-can-be-locked-down.md index adf2de0b5e..c0348677ba 100644 --- a/windows/manage/settings-that-can-be-locked-down.md +++ b/windows/manage/settings-that-can-be-locked-down.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile author: jdeckerMS +localizationpriority: high --- # Settings and quick actions that can be locked down in Windows 10 Mobile @@ -265,27 +266,27 @@ The following table lists the settings pages and page groups. Use the page name - + - + - + - + - + diff --git a/windows/manage/sign-code-integrity-policy-with-device-guard-signing.md b/windows/manage/sign-code-integrity-policy-with-device-guard-signing.md index 71deb2dedb..96a6b5344b 100644 --- a/windows/manage/sign-code-integrity-policy-with-device-guard-signing.md +++ b/windows/manage/sign-code-integrity-policy-with-device-guard-signing.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store, security author: TrudyHa +localizationpriority: high --- # Sign code integrity policy with Device Guard signing diff --git a/windows/manage/sign-up-windows-store-for-business-overview.md b/windows/manage/sign-up-windows-store-for-business-overview.md index 93c2e85ad1..5a85ddec8a 100644 --- a/windows/manage/sign-up-windows-store-for-business-overview.md +++ b/windows/manage/sign-up-windows-store-for-business-overview.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Sign up and get started @@ -35,18 +36,22 @@ IT admins can sign up for the Windows Store for Business, and get started workin + + + + - + - + - + diff --git a/windows/manage/sign-up-windows-store-for-business.md b/windows/manage/sign-up-windows-store-for-business.md index 643d42eddf..69d44f17e8 100644 --- a/windows/manage/sign-up-windows-store-for-business.md +++ b/windows/manage/sign-up-windows-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Sign up for Windows Store for Business @@ -26,7 +27,7 @@ Before signing up for the Store for Business, make sure you're the global admini **To sign up for the Store for Business** -1. Go to [https://www.microsoft.com/business-store](http://go.microsoft.com/fwlink/p/?LinkId=691845), and click **Sign up**. +1. Go to [https://www.microsoft.com/business-store](https://go.microsoft.com/fwlink/p/?LinkId=691845), and click **Sign up**. - If you start the Store for Business sign up process, and don't have an Azure AD directory for your organization, we'll help you create one. For more info, see [Sign up for Azure AD accounts](#o365-welcome). diff --git a/windows/manage/stop-employees-from-using-the-windows-store.md b/windows/manage/stop-employees-from-using-the-windows-store.md index dabf676bf5..c95b8cddad 100644 --- a/windows/manage/stop-employees-from-using-the-windows-store.md +++ b/windows/manage/stop-employees-from-using-the-windows-store.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store, mobile author: TrudyHa +localizationpriority: high --- # Configure access to Windows Store @@ -79,13 +80,30 @@ If you have mobile devices in your organization that you upgraded from earlier v When your MDM tool supports Windows Store for Business, the MDM can use these CSPs to block Windows Store app: -- [Policy](http://go.microsoft.com/fwlink/p/?LinkId=717030) +- [Policy](https://go.microsoft.com/fwlink/p/?LinkId=717030) - [EnterpriseAssignedAccess](https://msdn.microsoft.com/library/windows/hardware/mt157024.aspx) (Windows 10 Mobile, only) For more information, see [Configure an MDM provider](configure-mdm-provider-windows-store-for-business.md). -## Related topics +## Show private store only using Group Policy +Applies to Windows 10 Enterprise, version 1607. + +If you're using Windows Store for Business and you want employees to only see apps you're managing in your private store, you can use Group Policy to show only the private store. Windows Store app will still be available, but employees can't view or purchase apps. Employees can view and install apps that the admin has added to your organization's private store. + +**To show private store only in Windows Store app** + +1. Type **gpedit** in the search bar, and then select **Edit group policy (Control panel)** to find and start Group Policy Editor. + +2. In the console tree of the snap-in, go to **User Configuration** or **Computer Configuration** > **Administrative Templates** > **Windows Components**, and then click **Store**. + +3. Right-click **Only display the private store within the Windows Store app** in the right pane, and click **Edit**. + + This opens the **Only display the private store within the Windows Store app** policy settings. + +4. On the **Only display the private store within the Windows Store app** setting page, click **Enabled**, and then click **OK**. + +## Related topics [Distribute apps using your private store](distribute-apps-from-your-private-store.md) diff --git a/windows/manage/troubleshoot-windows-store-for-business.md b/windows/manage/troubleshoot-windows-store-for-business.md index e2653436b7..55a31b14ec 100644 --- a/windows/manage/troubleshoot-windows-store-for-business.md +++ b/windows/manage/troubleshoot-windows-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Troubleshoot Windows Store for Business @@ -52,7 +53,7 @@ The private store for your organization is a page in the Windows Store app that ## Still having trouble? -If you are still having trouble using WSfB or installing the app, you can get more help on our [Support page](http://go.microsoft.com/fwlink/?LinkID=799757). +If you are still having trouble using WSfB or installing the app, you can get more help on our [Support page](https://go.microsoft.com/fwlink/?LinkID=799757).   diff --git a/windows/manage/uev-accessibility.md b/windows/manage/uev-accessibility.md new file mode 100644 index 0000000000..08416f8349 --- /dev/null +++ b/windows/manage/uev-accessibility.md @@ -0,0 +1,4 @@ +--- +title: Accessibility for UE-V +redirect_url: https://technet.microsoft.com/itpro/windows/manage/uev-for-windows +--- \ No newline at end of file diff --git a/windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md b/windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md new file mode 100644 index 0000000000..3b0c73a34d --- /dev/null +++ b/windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md @@ -0,0 +1,42 @@ +--- +title: Administering UE-V with Windows PowerShell and WMI +description: Administering UE-V with Windows PowerShell and WMI +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Administering UE-V with Windows PowerShell and WMI + +**Applies to** +- Windows 10, version 1607 + +User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets to help administrators perform various UE-V tasks. The following sections provide more information about using Windows PowerShell in UE-V. + +> **Note**  Administering UE-V with Windows PowerShell requires PowerShell 3.0 or higher. For a complete list of UE-V cmdlets, see [User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx). + +## Managing the UE-V service and packages by using Windows PowerShell and WMI + +You can use Windows PowerShell and Windows Management Instrumentation (WMI) to manage UE-V service configuration and synchronization behavior. The following topic describes how to manage configuration and synchronization. + +[Managing the UE-V Service and Packages with Windows PowerShell and WMI](uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md) + +## Managing UE-V settings location templates by using Windows PowerShell and WMI + + +After you create and deploy UE-V settings location templates, you can manage those templates by using Windows PowerShell or WMI. The following topic describes how to manage the settings location templates by using Windows PowerShell and WMI. + +[Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md) + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +- [Administering UE-V](uev-administering-uev.md) + +- [User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx) \ No newline at end of file diff --git a/windows/manage/uev-administering-uev.md b/windows/manage/uev-administering-uev.md new file mode 100644 index 0000000000..2c1455ebe3 --- /dev/null +++ b/windows/manage/uev-administering-uev.md @@ -0,0 +1,76 @@ +--- +title: Administering UE-V +description: Administering UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Administering UE-V + +**Applies to** +- Windows 10, version 1607 + +After you finish deploying User Experience Virtualization (UE-V), you'll perform ongoing administrative tasks, such as managing the configuration of the UE-V service and recovering lost settings. These tasks are explained in the following sections. + +## Managing UE-V configurations + + +In the course of the UE-V lifecycle, you'll manage the configuration of the UE-V service and also manage storage locations for resources such as settings package files. + +[Manage Configurations for UE-V](uev-manage-configurations.md) + +## Working with custom UE-V templates and the UE-V template generator + + +This topic explains how to use the UE-V template generator and manage custom settings location templates. + +[Working with Custom UE-V Templates and the UE-V Template Generator](uev-working-with-custom-templates-and-the-uev-generator.md) + +## Back up and restore application and Windows settings that are synchronized with UE-V + + +Windows Management Instrumentation (WMI) and Windows PowerShell features of UE-V allow you to restore settings packages. By using WMI and Windows PowerShell commands, you can restore application and Windows settings to their original state and restore additional settings when a user adopts a new device. + +[Manage Administrative Backup and Restore in UE-V](uev-manage-administrative-backup-and-restore.md) + +## Changing the frequency of UE-V scheduled tasks + + +You can configure the scheduled tasks that manage when UE-V checks for new or updated settings or for updated custom settings location templates in the settings template catalog. + +[Changing the Frequency of UE-V Scheduled Tasks](uev-changing-the-frequency-of-scheduled-tasks.md) + +## Migrating UE-V settings packages + + +You can relocate the user settings packages either when they migrate to a new server or for backup purposes. + +[Migrating UE-V Settings Packages](uev-migrating-settings-packages.md) + +## Using UE-V with Application Virtualization applications + + +You can use UE-V with Microsoft Application Virtualization (App-V) to share settings between virtual applications and installed applications across multiple computers. + +[Using UE-V with Application Virtualization Applications](uev-using-uev-with-application-virtualization-applications.md) + +## Other resources for this feature + + +- [User Experience Virtualization for Windows overview](uev-for-windows.md) + +- [Get Started with UE-V](uev-getting-started.md) + +- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) + +- [Troubleshooting UE-V](uev-troubleshooting.md) + +- [Technical Reference for UE-V](uev-technical-reference.md) + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). diff --git a/windows/manage/uev-application-template-schema-reference.md b/windows/manage/uev-application-template-schema-reference.md new file mode 100644 index 0000000000..94bdd8dd75 --- /dev/null +++ b/windows/manage/uev-application-template-schema-reference.md @@ -0,0 +1,966 @@ +--- +title: Application Template Schema Reference for UE-V +description: Application Template Schema Reference for UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Application Template Schema Reference for UE-V + +**Applies to** +- Windows 10, version 1607 + +User Experience Virtualization (UE-V) uses XML settings location templates to define the desktop application settings and Windows settings that are captured and applied by UE-V. UE-V includes a set of default settings location templates. You can also create custom settings location templates with the UE-V template generator. + +An advanced user can customize the XML file for a settings location template. This topic details the XML structure of the UE-V settings location templates and provides guidance for editing these files. + +## UE-V Application Template Schema Reference + + +This section details the XML structure of the UE-V settings location template and provides guidance for editing this file. + +### In This Section + +- [XML Declaration and Encoding Attribute](#xml21) + +- [Namespace and Root Element](#namespace21) + +- [Data types](#data21) + +- [Name Element](#name21) + +- [ID Element](#id21) + +- [Version Element](#version21) + +- [Author Element](#author21) + +- [Processes and Process Element](#processes21) + +- [Application Element](#application21) + +- [Common Element](#common21) + +- [SettingsLocationTemplate Element](#settingslocationtemplate21) + +- [Appendix: SettingsLocationTemplate.xsd](#appendix21) + +### XML Declaration and Encoding Attribute + +**Mandatory: True** + +**Type: String** + +The XML declaration must specify the XML version 1.0 attribute (<?xml version="1.0">). Settings location templates created by the UE-V template generator are saved in UTF-8 encoding, although the encoding is not explicitly specified. We recommend that you include the encoding="UTF-8" attribute in this element as a best practice. All templates included with the product specify this tag as well (see the documents in %ProgramFiles%\\Microsoft User Experience Virtualization\\Templates for reference). For example: + +`` + +### Namespace and Root Element + +**Mandatory: True** + +**Type: String** + +UE-V uses the http://schemas.microsoft.com/UserExperienceVirtualization/2012/SettingsLocationTemplate namespace for all applications. SettingsLocationTemplate is the root element and contains all other elements. Reference SettingsLocationTemplate in all templates using this tag: + +`` + +### Data types + +These are the data types for the UE-V application template schema. + +**GUID** +GUID describes a standard globally unique identifier regular expression in the form "\\{\[a-fA-F0-9\]{8}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{12}\\}". This is used in the Filesetting\\Root\\KnownFolder element to verify the formatting of well-known folders. + +**FilenameString** +FilenameString refers to the file name of a process to be monitored. Its values are restricted by the regex \[^\\\\\\?\\\*\\|<>/:\]+, (that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon characters). + +**IDString** +IDString refers to the ID value of Application elements, SettingsLocationTemplate, and Common elements (used to describe application suites that share common settings). It is restricted by the same regex as FilenameString (\[^\\\\\\?\\\*\\|<>/:\]+). + +**TemplateVersion** +TemplateVersion is an integer value used to describe the revision of the settings location template. Its value may range from 0 to 2147483647. + +**Empty** +Empty refers to a null value. This is used in Process\\ShellProcess to indicate that there is no process to monitor. This value should not be used in any application templates. + +**Author** +The Author data type is a complex type that identifies the author of a template. It contains two child elements: **Name** and **Email**. Within the Author data type, the Name element is mandatory while the Email element is optional. This type is described in more detail under the SettingsLocationTemplate element. + +**Range** +Range defines an integer class consisting of two child elements: **Minimum** and **Maximum**. This data type is implemented in the ProcessVersion data type. If specified, both Minimum and Maximum values must be included. + +**ProcessVersion** +ProcessVersion defines a type with four child elements: **Major**, **Minor**, **Build**, and **Patch**. This data type is used by the Process element to populate its ProductVersion and FileVersion values. The data for this type is a Range value. The Major child element is mandatory and the others are optional. + +**Architecture** +Architecture enumerates two possible values: **Win32** and **Win64**. These values are used to specify process architecture. + +**Process** +The Process data type is a container used to describe processes to be monitored by UE-V. It contains six child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. This table details each element’s respective data type: + +

    Admin Templates>System>User Profiles

    Turn off the advertising ID

    Enabled

    SetEduPolicies=True

    Admin Templates>Windows Components

    Do not show Windows Tips

    *Only on Pro, Enterprise, and Education*

    Enabled

    SetEduPolicies=True

    Turn off Microsoft consumer experiences

    *Only on Pro, Enterprise, and Education*

    Enabled

    SetEduPolicies=True

    Do not show Windows Tips

    *Only on Pro, Enterprise, Pro Education, and Education*

    Enabled

    SetEduPolicies=True

    Turn off Microsoft consumer experiences

    *Only on Pro, Enterprise, Pro Education, and Education*

    Enabled

    SetEduPolicies=True

    Microsoft Passport for Work

    Disabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates>Windows Components>Biometrics

    NarratorSettingsPageEaseoOfAccessNarratorSettingsPageEaseOfAccessNarrator
    MagnifierSettingsPageEaseoOfAccessMagnifierSettingsPageEaseOfAccessMagnifier
    High contrastSettingsPageEaseoOfAccessHighContrastSettingsPageEaseOfAccessHighContrast
    Closed captionsSettingsPageEaseoOfAccessClosedCaptioningSettingsPageEaseOfAccessClosedCaptioning
    More optionsSettingsPageEaseoOfAccessMoreOptionsSettingsPageEaseOfAccessMoreOptions
    Privacy

    [Windows Store for Business overview](windows-store-for-business-overview.md)

    Learn about Windows Store for Business.

    [Prerequisites for Windows Store for Business](prerequisites-windows-store-for-business.md)

    There are a few prerequisites for using Store for Business.

    [Sign up for Windows Store for Business](sign-up-windows-store-for-business.md)

    Before you sign up for Store for Business, at a minimum, you'll need an Azure Active Directory (AD) account for your organization, and you'll need to be the global administrator for your organization. If your organization is already using Azure AD, you can go ahead and sign up for Store for Business. If not, we'll help you create an Azure AD account and directory as part of the sign up process.

    [Roles and permissions in the Windows Store for Business](roles-and-permissions-windows-store-for-business.md)

    The first person to sign in to Store for Business must be a Global Admin of the Azure Active Directory (AD) tenant. Once the Global Admin has signed in, they can give permissions to others employees.

    [Settings reference: Windows Store for Business](settings-reference-windows-store-for-business.md)

    The Store for Business has a group of settings that admins use to manage the store.
    +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Element

    Data Type

    Mandatory

    Filename

    FilenameString

    True

    Architecture

    Architecture

    False

    ProductName

    String

    False

    FileDescription

    String

    False

    ProductVersion

    ProcessVersion

    False

    FileVersion

    ProcessVersion

    False

    + +  + +**Processes** +The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence. + +**Path** +Path is consumed by RegistrySetting and FileSetting to refer to registry and file paths. This element supports two optional attributes: **Recursive** and **DeleteIfNotFound**. Both values are set to default=”False”. + +Recursive indicates that the path and all subfolders are included for file settings or that all child registry keys are included for registry settings. In both cases, all items at the current level are included in the data captured. For a FileSettings object, all files within the specified folder are included in the data captured by UE-V but folders are not included. For registry paths, all values in the current path are captured but child registry keys are not captured. In both cases, care should be taken to avoid capturing large data sets or large numbers of items. + +The DeleteIfNotFound attribute removes the setting from the user’s settings storage path data. This may be desirable in cases where removing these settings from the package will save a large amount of disk space on the settings storage path file server. + +**FileMask** +FileMask specifies only certain file types for the folder that is defined by Path. For example, Path might be `C:\users\username\files` and FileMask could be `*.txt` to include only text files. + +**RegistrySetting** +RegistrySetting represents a container for registry keys and values and the associated desired behavior on the part of the UE-V service. Four child elements are defined within this type: **Path**, **Name**, **Exclude**, and a sequence of the values **Path** and **Name**. + +**FileSetting** +FileSetting contains parameters associated with files and files paths. Four child elements are defined: **Root**, **Path**, **FileMask**, and **Exclude**. Root is mandatory and the others are optional. + +**Settings** +Settings is a container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings described earlier. In addition, it can also contain the following child elements with behaviors described: + + ++++ + + + + + + + + + + + + + + + + + + +

    Element

    Description

    Asynchronous

    Asynchronous settings packages are applied without blocking the application startup so that the application start proceeds while the settings are still being applied. This is useful for settings that can be applied asynchronously, such as those get/set through an API, like SystemParameterSetting.

    PreventOverlappingSynchronization

    By default, UE-V only saves settings for an application when the last instance of an application using the template is closed. When this element is set to ‘false’, UE-V exports the settings even if other instances of an application are running. Suited templates – those that include a Common element section– that are shipped with UE-V use this flag to enable shared settings to always export on application close, while preventing application-specific settings from exporting until the last instance is closed.

    AlwaysApplySettings

    This parameter forces an imported settings package to be applied even if there are no differences between the package and the current state of the application. This parameter should be used only in special cases since it can slow down settings import.

    + +  + +### Name Element + +**Mandatory: True** + +**Type: String** + +Name specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. In general, avoid referencing version information, as this can be objected from the ProductVersion element. For example, specify `My Application` rather than `My Application 1.1`. + +**Note**   +UE-V does not reference external DTDs, so it is not possible to use named entities in a settings location template. For example, do not use ® to refer to the registered trade mark sign ®. Instead, use canonical numbered references to include these types of special characters, for example, &\#174 for the ® character. This rule applies to all string values in this document. + +See for a complete list of character entities. UTF-8-encoded documents may include the Unicode characters directly. Saving templates through the UE-V template generator converts character entities to their Unicode representations automatically. + +  + +### ID Element + +**Mandatory: True** + +**Type: String** + +ID populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime (for example, see the output of the Get-UevTemplate and Get-UevTemplateProgram PowerShell cmdlets). By convention, this tag should not contain any spaces, which simplifies scripting. Version numbers of applications should be specified in this element to allow for easy identification of the template, such as `MicrosoftOffice2016Win64`. + +### Version Element + +**Mandatory: True** + +**Type: Integer** + +**Minimum Value: 0** + +**Maximum Value: 2147483647** + +Version identifies the version of the settings location template for administrative tracking of changes. The UE-V template generator automatically increments this number by one each time the template is saved. Notice that this field must be a whole number integer; fractional values, such as `2.5` are not allowed. + +**Hint:** You can save notes about version changes using XML comment tags ``, for example: + +``` syntax + + 4 +``` + +**Important**   +This value is queried to determine if a new version of a template should be applied to an existing template in these instances: + +- When the scheduled Template Auto Update task executes + +- When the Update-UevTemplate PowerShell cmdlet is executed + +- When the microsoft\\uev:SettingsLocationTemplate Update method is called through WMI + +  + +### Author Element + +**Mandatory: False** + +**Type: String** + +Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](http://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V). + +### Processes and Process Element + +**Mandatory: True** + +**Type: Element** + +Processes contains at least one `` element, which in turn contains the following child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. The Filename child element is mandatory and the others are optional. A fully populated element contains tags similar to this example: + +``` syntax + + MyApplication.exe + Win64 + MyApplication + MyApplication.exe + + + + + + + + + + + + + +``` + +### Filename + +**Mandatory: True** + +**Type: String** + +Filename refers to the actual file name of the executable as it appears in the file system. This element specifies the primary criterion that UE-V uses to evaluate whether a template applies to a process or not. This element must be specified in the settings location template XML. + +Valid filenames must not match the regular expression \[^\\\\\\?\\\*\\|<>/:\]+, that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon (the \\ ? \* | < > / or : characters.). + +**Hint:** To test a string against this regex, use a PowerShell command window and substitute your executable’s name for **YourFileName**: + +`"YourFileName.exe" -match "[\\\?\*\|<>/:]+"` + +A value of **True** indicates that the string contains illegal characters. Here are some examples of illegal values: + +- \\\\server\\share\\program.exe + +- Program\*.exe + +- Pro?ram.exe + +- Program<1>.exe + +**Note**   +The UE-V template generator encodes the greater than and less than characters as > and < respectively. + +  + +In rare circumstances, the FileName value will not necessarily include the .exe extension, but it should be specified as part of the value. For example, `MyApplication.exe` should be specified instead of `MyApplication`. The second example will not apply the template to the process if the actual name of the executable file is “MyApplication.exe”. + +### Architecture + +**Mandatory: False** + +**Type: Architecture (String)** + +Architecture refers to the processor architecture for which the target executable was compiled. Valid values are Win32 for 32-bit applications or Win64 for 64-bit applications. If present, this tag limits the applicability of the settings location template to a particular application architecture. For an example of this, compare the %ProgramFiles%\\Microsoft User Experience Virtualization\\templates\\ MicrosoftOffice2016Win32.xml and MicrosoftOffice2016Win64.xml files included with UE-V. This is useful when relative paths change between different versions of an executable or if settings have been added or removed when moving from one processor architecture to another. + +If this element is absent, the settings location template ignores the process’ architecture and applies to both 32 and 64-bit processes if the file name and other attributes apply. + +**Note**   +UE-V does not support ARM processors in this version. + +  + +### ProductName + +**Mandatory: False** + +**Type: String** + +ProductName is an optional element used to identify a product for administrative purposes or reporting. ProductName differs from Filename in that there are no regular expression restrictions on its value. This allows for more easily understood descriptions of a process where the executable name may not be obvious. For example: + +``` syntax + + MyApplication.exe + My Application 6.x by Contoso.com + + + + +``` + +### FileDescription + +**Mandatory: False** + +**Type: String** + +FileDescription is an optional tag that allows for an administrative description of the executable file. This is a free text field and can be useful in distinguishing multiple executables within a software package where there is a need to identify the function of the executable. + +For example, in a suited application, it might be useful to provide reminders about the function of two executables (MyApplication.exe and MyApplicationHelper.exe), as shown here: + +``` syntax + + + + MyApplication.exe + My Application Main Engine + + + + + + MyApplicationHelper.exe + My Application Background Process Executable + + + + + +``` + +### ProductVersion + +**Mandatory: False** + +**Type: String** + +ProductVersion refers to the major and minor product versions of a file, as well as a build and patch level. ProductVersion is an optional element, but if specified, it must contain at least the Major child element. The value must express a range in the form Minimum="X" Maximum="Y" where X and Y are integers. The Minimum and Maximum values can be identical. + +The product and file version elements may be left unspecified. Doing so makes the template “version agnostic”, meaning that the template will apply to all versions of the specified executable. + +**Example 1:** + +Product version: 1.0 specified in the UE-V template generator produces the following XML: + +``` syntax + + + + +``` + +**Example 2:** + +File version: 5.0.2.1000 specified in the UE-V template generator produces the following XML: + +``` syntax + + + + + + +``` + +**Incorrect Example 1 – incomplete range:** + +Only the Minimum attribute is present. Maximum must be included in a range as well. + +``` syntax + + + +``` + +**Incorrect Example 2 – Minor specified without Major element:** + +Only the Minor element is present. Major must be included as well. + +``` syntax + + + +``` + +### FileVersion + +**Mandatory: False** + +**Type: String** + +FileVersion differentiates between the release version of a published application and the internal build details of a component executable. For the majority of commercial applications, these numbers are identical. Where they vary, the product version of a file indicates a generic version identification of a file, while file version indicates a specific build of a file (as in the case of a hotfix or update). This uniquely identifies files without breaking detection logic. + +To determine the product version and file version of a particular executable, right-click on the file in Windows Explorer, select Properties, then click on the Details tab. + +Including a FileVersion element for an application allows for more granular fine-tuning detection logic, but is not necessary for most applications. The ProductVersion element settings are checked first, and then FileVersion is checked. The more restrictive setting will apply. + +The child elements and syntax rules for FileVersion are identical to those of ProductVersion. + +``` syntax + + MSACCESS.EXE + Win32 + + + + + + + + + +``` + +### Application Element + +Application is a container for settings that apply to a particular application. It is a collection of the following fields/types. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Field/Type

    Description

    Name

    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21).

    ID

    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see [ID](#id21).

    Description

    An optional description of the template.

    LocalizedNames

    An optional name displayed in the UI, localized by a language locale.

    LocalizedDescriptions

    An optional template description localized by a language locale.

    Version

    Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version21).

    DeferToMSAccount

    Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.

    DeferToOffice365

    Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.

    FixedProfile

    Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.

    Processes

    A container for a collection of one or more Process elements. For more information, see [Processes](#processes21).

    Settings

    A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in [Data types](#data21).

    + +  + +### Common Element + +Common is similar to an Application element, but it is always associated with two or more Application elements. The Common section represents the set of settings that are shared between those Application instances. It is a collection of the following fields/types. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Field/Type

    Description

    Name

    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21).

    ID

    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see [ID](#id21).

    Description

    An optional description of the template.

    LocalizedNames

    An optional name displayed in the UI, localized by a language locale.

    LocalizedDescriptions

    An optional template description localized by a language locale.

    Version

    Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version21).

    DeferToMSAccount

    Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.

    DeferToOffice365

    Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.

    FixedProfile

    Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.

    Settings

    A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in [Data types](#data21).

    + +  + +### SettingsLocationTemplate Element + +This element defines the settings for a single application or a suite of applications. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Field/Type

    Description

    Name

    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21).

    ID

    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see [ID](#id21).

    Description

    An optional description of the template.

    LocalizedNames

    An optional name displayed in the UI, localized by a language locale.

    LocalizedDescriptions

    An optional template description localized by a language locale.

    + +  + +### Appendix: SettingsLocationTemplate.xsd + +Here is the SettingsLocationTemplate.xsd file showing its elements, child elements, attributes, and parameters: + +``` syntax + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +[Working with Custom UE-V Templates and the UE-V Template Generator](uev-working-with-custom-templates-and-the-uev-generator.md) + +[Technical Reference for UE-V](uev-technical-reference.md) diff --git a/windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md b/windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md new file mode 100644 index 0000000000..888c3b7ee1 --- /dev/null +++ b/windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md @@ -0,0 +1,249 @@ +--- +title: Changing the Frequency of UE-V Scheduled Tasks +description: Changing the Frequency of UE-V Scheduled Tasks +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Changing the Frequency of UE-V Scheduled Tasks + +**Applies to** +- Windows 10, version 1607 + +When the User Experience Virtualization (UE-V) service is enabled, it creates the following scheduled tasks: + +- [Monitor Application Settings](#monitor-application-settings) + +- [Sync Controller Application](#sync-controller-application) + +- [Synchronize Settings at Logoff](#synchronize-settings-at-logoff) + +- [Template Auto Update](#template-auto-update) + +**Note**
    +These tasks must remain enabled, because UE-V cannot function without them. + +These scheduled tasks are not configurable with the UE-V tools. Administrators who want to change the scheduled task for these items can create a script that uses the Schtasks.exe command-line options. + +For more information about Schtasks.exe, see [Schtasks](https://technet.microsoft.com/library/cc725744(v=ws.11).aspx). + +## UE-V Scheduled Tasks + +The following scheduled tasks are included in UE-V with sample scheduled task configuration commands. + +### Monitor Application Settings + +The **Monitor Application Settings** task is used to synchronize settings for Windows apps. It is runs at logon but is delayed by 30 seconds to not affect the logon detrimentally. The Monitor Application Status task runs the UevAppMonitor.exe file, which is located in the UE-V Agent installation directory. + + ++++ + + + + + + + + + + + + +
    Task nameDefault event

    \Microsoft\UE-V\Monitor Application Status

    Logon

    + +  + +### Sync Controller Application + +The **Sync Controller Application** task is used to start the Sync Controller to synchronize settings from the computer to the settings storage location. By default, the task runs every 30 minutes. At that time, local settings are synchronized to the settings storage location, and updated settings on the settings storage location are synchronized to the computer. The Sync Controller application runs the Microsoft.Uev.SyncController.exe, which is located in the UE-V Agent installation directory. + + ++++ + + + + + + + + + + + + +
    Task nameDefault event

    \Microsoft\UE-V\Sync Controller Application

    Logon, and every 30 minutes thereafter

    + +  + +For example, the following command configures the agent to synchronize settings every 15 minutes instead of the default 30 minutes. + +``` syntax +Schtasks /change /tn “Microsoft\UE-V\Sync Controller Application” /ri 15 +``` + +### Synchronize Settings at Logoff + +The **Synchronize Settings at Logoff** task is used to start an application at logon that controls the synchronization of applications at logoff for UE-V. The Synchronize Settings at Logoff task runs the Microsoft.Uev.SyncController.exe file, which is located in the UE-V Agent installation directory. + + ++++ + + + + + + + + + + + + +
    Task nameDefault event

    \Microsoft\UE-V\Synchronize Settings at Logoff

    Logon

    + +  + +### Template Auto Update + +The **Template Auto Update** task checks the settings template catalog for new, updated, or removed templates. This task only runs if the SettingsTemplateCatalog is configured. The **Template Auto Update** task runs the ApplySettingsCatalog.exe file, which is located in the UE-V Agent installation directory. + + ++++ + + + + + + + + + + + + +
    Task nameDefault event

    \Microsoft\UE-V\Template Auto Update

    System startup and at 3:30 AM every day, at a random time within a 1-hour window

    + +  + +**Example:** The following command configures the UE-V service to check the settings template catalog store every hour. + +``` syntax +schtasks /change /tn "Microsoft\UE-V\Template Auto Update" /ri 60 +``` + + +## UE-V Scheduled Task Details + + +The following chart provides additional information about scheduled tasks for UE-V 2: + + ++++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Task Name (file name)

    Default Frequency

    Power Toggle

    Idle Only

    Network Connection

    Description

    Monitor Application Settings (UevAppMonitor.exe)

    Starts 30 seconds after logon and continues until logoff.

    No

    Yes

    N/A

    Synchronizes settings for Windows (AppX) apps.

    Sync Controller Application (Microsoft.Uev.SyncController.exe)

    At logon and every 30 min thereafter.

    Yes

    Yes

    Only if Network is connected

    Starts the Sync Controller which synchronizes local settings with the settings storage location.

    Synchronize Settings at Logoff (Microsoft.Uev.SyncController.exe)

    Runs at logon and then waits for Logoff to Synchronize settings.

    No

    Yes

    N/A

    Start an application at logon that controls the synchronization of applications at logoff.

    Template Auto Update (ApplySettingsCatalog.exe)

    Runs at initial logon and at 3:30 AM every day thereafter.

    Yes

    No

    N/A

    Checks the settings template catalog for new, updated, or removed templates. This task only runs if SettingsTemplateCatalog is configured.

    + +  + +**Legend** + +- **Power Toggle** – Task Scheduler will optimize power consumption when not connected to AC power. The task might stop running if the computer switches to battery power. + +- **Idle Only** – The task will stop running if the computer ceases to be idle. By default the task will not restart when the computer is idle again. Instead the task will begin again on the next task trigger. + +- **Network Connection** – Tasks marked “Yes” only run if the computer has a network connection available. Tasks marked “N/A” run regardless of network connectivity. + +### How to Manage Scheduled Tasks + +To find Scheduled Tasks, perform the following: + +1. Open “Schedule Tasks” on the user computer. + +2. Navigate to: Task Scheduler -> Task Scheduler Library -> Microsoft -> UE-V + +3. Select the scheduled task you wish to manage and configure in the details pane. + +### Additional information + +The following additional information applies to UE-V scheduled tasks: + +- All task sequence programs are located in the UE-V Agent installation folder, `%programFiles%\Microsoft User Experience Virtualization\Agent\[architecture]\`, by default. + +- The Sync Controller Application Scheduled task is the crucial component when the UE-V SyncMethod is set to “SyncProvider” (UE-V default configuration). This scheduled task keeps the SettingsSToragePath synchronized with the locally cached versions of the settings package files. If users complain that settings do not synchronize often enough, then you can reduce the scheduled task setting to as little as 1 minute.  You can also increase the 30 min default to a higher amount if necessary. + +- You do not need to disable the Template Auto Update scheduled task if you use another method to keep the clients’ templates in sync (i.e. Group Policy or Configuration Manager Baselines). Leaving the SettingsTemplateCatalog property value blank prevents UE-V from checking the settings catalog for custom templates. This scheduled task runs ApplySettingsCatalog.exe and will essentially return immediately. + +- The Monitor Application Settings scheduled task will update Windows app (AppX) settings in real time, based on Windows app program setting triggers built into each app. + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +[Administering UE-V](uev-administering-uev.md) + +[Deploy UE-V for Custom Applications](uev-deploy-uev-for-custom-applications.md#deploycatalogue) diff --git a/windows/manage/uev-configuring-uev-with-group-policy-objects.md b/windows/manage/uev-configuring-uev-with-group-policy-objects.md new file mode 100644 index 0000000000..4476ea26b3 --- /dev/null +++ b/windows/manage/uev-configuring-uev-with-group-policy-objects.md @@ -0,0 +1,201 @@ +--- +title: Configuring UE-V with Group Policy Objects +description: Configuring UE-V with Group Policy Objects +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Configuring UE-V with Group Policy Objects + +**Applies to** +- Windows 10, version 1607 + +Some User Experience Virtualization (UE-V) Group Policy settings can be defined for computers, and other Group Policy settings can be defined for users. The Group Policy administrative templates for these settings are included in Windows 10, version 1607. + + +The following policy settings can be configured for UE-V. + +**Group Policy settings** + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Group Policy setting nameTargetGroup Policy setting descriptionConfiguration options

    Do not use the sync provider

    Computers and Users

    By using this Group Policy setting, you can configure whether UE-V uses the sync provider feature. This policy setting also lets you enable notification to appear when the import of user settings is delayed.

    Enable this setting to configure the UE-V service not to use the sync provider.

    First Use Notification

    Computers Only

    This Group Policy setting enables a notification in the notification area that appears when the UE-V service runs for the first time.

    The default is enabled.

    Roam Windows settings

    Computers and Users

    This Group Policy setting configures the synchronization of Windows settings.

    Select which Windows settings synchronize between computers.

    +

    By default, Windows themes, desktop settings, and Ease of Access settings synchronize settings between computers of the same operating system version.

    Settings package size warning threshold

    Computers and Users

    This Group Policy setting lets you configure the UE-V service to report when a settings package file size reaches a defined threshold.

    Specify the preferred threshold for settings package sizes in kilobytes (KB).

    +

    By default, the UE-V service does not have a package file size threshold.

    Settings storage path

    Computers and Users

    This Group Policy setting configures where the user settings are to be stored.

    Enter a Universal Naming Convention (UNC) path and variables such as \\Server\SettingsShare\%username%.

    Settings template catalog path

    Computers Only

    This Group Policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog is to be used to replace the default Microsoft templates that are installed with the UE-V service.

    Enter a Universal Naming Convention (UNC) path such as \\Server\TemplateShare or a folder location on the computer.

    +

    Select the check box to replace the default Microsoft templates.

    Sync settings over metered connections

    Computers and Users

    This Group Policy setting defines whether UE-V synchronizes settings over metered connections.

    By default, the UE-V service does not synchronize settings over a metered connection.

    Sync settings over metered connections even when roaming

    Computers and Users

    This Group Policy setting defines whether UE-V synchronizes settings over metered connections outside of the home provider network, for example, when the data connection is in roaming mode.

    By default, UE-V does not synchronize settings over a metered connection when it is in roaming mode.

    Synchronization timeout

    Computers and Users

    This Group Policy setting configures the number of milliseconds that the computer waits before a time-out when it retrieves user settings from the remote settings location. If the remote storage location is unavailable, and the user does not use the sync provider, the application start is delayed by this many milliseconds.

    Specify the preferred synchronization time-out in milliseconds. The default value is 2000 milliseconds.

    Tray Icon

    Computers Only

    This Group Policy setting enables the User Experience Virtualization (UE-V) tray icon.

    This setting only has an effect for UE-V 2.x and earlier. It has no effect for UE-V in Windows 10, version 1607.

    Use User Experience Virtualization (UE-V)

    Computers and Users

    This Group Policy setting lets you enable or disable User Experience Virtualization (UE-V).

    This setting only has an effect for UE-V 2.x and earlier. For UE-V in Windows 10, version 1607, use the **Enable UE-V** setting.

    Enable UE-V

    Computers and Users

    This policy setting allows you to enable or disable User Experience Virtualization (UE-V) feature. Reboot is needed for enable to take effect.

    This setting only has an effect for UE-V in Windows 10, version 1607. For UE-V 2.x and earlier, choose the **Use User Experience Virtualization (UE-V)** setting.

    + +  + +**Note**   +In addition, Group Policy settings are available for many desktop applications and Windows apps. You can use these settings to enable or disable settings synchronization for specific applications. + +  + +**Windows App Group Policy settings** + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Group Policy setting nameTargetGroup Policy setting descriptionConfiguration options

    Do not synchronize Windows Apps

    Computers and Users

    This Group Policy setting defines whether the UE-V service synchronizes settings for Windows apps.

    The default is to synchronize Windows apps.

    Windows App List

    Computer and User

    This setting lists the family package names of the Windows apps and states expressly whether UE-V synchronizes that app’s settings.

    You can use this setting to specify that settings of an app are never synchronized by UE-V, even if the settings of all other Windows apps are synchronized.

    Sync Unlisted Windows Apps

    Computer and User

    This Group Policy setting defines the default settings sync behavior of the UE-V service for Windows apps that are not explicitly listed in the Windows app list.

    By default, the UE-V service only synchronizes settings of those Windows apps that are included in the Windows app list.

    + +  + +For more information about synchronizing Windows apps, see [Windows App List](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md#win8applist). + +**To configure computer-targeted Group Policy settings** + +1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) on the computer that acts as a domain controller to manage Group Policy settings for UE-V computers. Navigate to **Computer configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. + +2. Select the Group Policy setting to be edited. + +**To configure user-targeted Group Policy settings** + +1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) tool in Microsoft Desktop Optimization Pack (MDOP) on the domain controller computer to manage Group Policy settings for UE-V. Navigate to **User configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. + +2. Select the edited Group Policy setting. + +The UE-V service uses the following order of precedence to determine synchronization. + +**Order of precedence for UE-V settings** + +1. User-targeted settings that are managed by Group Policy settings - These configuration settings are stored in the registry key by Group Policy under `HKEY_CURRENT_USER\Software\Policies\Microsoft\Uev\Agent\Configuration`. + +2. Computer-targeted settings that are managed by Group Policy settings - These configuration settings are stored in the registry key by Group Policy under `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Uev\Agent\Configuration`. + +3. Configuration settings that are defined by the current user by using Windows PowerShell or Windows management Instrumentation (WMI) - These configuration settings are stored by the UE-V service under this registry location: `HKEY_CURRENT_USER\Software\Microsoft\Uev\Agent\Configuration`. + +4. Configuration settings that are defined for the computer by using Windows PowerShell or WMI. These configuration settings are stored by the UE-V service under this registry location: `HKEY_LOCAL_MACHINE\Software\Microsoft\Uev\Agent\Configuration`. + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + + +[Administering UE-V](uev-administering-uev.md) + +[Manage Configurations for UE-V](uev-manage-configurations.md) diff --git a/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md b/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md new file mode 100644 index 0000000000..e18bff1e74 --- /dev/null +++ b/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md @@ -0,0 +1,248 @@ +--- +title: Configuring UE-V with System Center Configuration Manager +description: Configuring UE-V with System Center Configuration Manager +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Configuring UE-V with System Center Configuration Manager + +**Applies to** +- Windows 10, version 1607 + +After you deploy User Experience Virtualization (UE-V) and its required features, you can start to configure it to meet your organization's need. The UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of System Center Configuration Manager (2012 SP1 or later) to apply consistent configurations across sites where UE-V and Configuration Manager are installed. + +## UE-V Configuration Pack supported features + + +The UE-V Configuration Pack includes tools to: + +- Create or update UE-V settings location template distribution baselines + + - Define UE-V templates to be registered or unregistered + + - Update UE-V template configuration items and baselines as templates are added or updated + + - Distribute and register UE-V templates using standard Configuration Item remediation + +- Create or update a UE-V Agent policy configuration item to set or clear these settings + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Max package size

    Enable/disable Windows app sync

    Wait for sync on application start

    Setting import delay

    Sync unlisted Windows apps

    Wait for sync on logon

    Settings import notification

    IT contact URL

    Wait for sync timeout

    Settings storage path

    IT contact descriptive text

    Settings template catalog path

    Sync enablement

    Tray icon enabled

    Start/Stop UE-V agent service

    Sync method

    First use notification

    Define which Windows apps will roam settings

    Sync timeout

    + +   + +- Verify compliance by confirming that UE-V is running. + +## Generate a UE-V service policy configuration item + + +All UE-V service policy and configuration is distributed through a single configuration item that is generated using the UevAgentPolicyGenerator.exe tool. This tool reads the desired configuration from an XML configuration file and creates a CI containing the discovery and remediation settings needed to bring the machine into compliance. + +The UE-V service policy configuration item CAB file is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: + +- Site <site code> + +- PolicyName <name> Optional: Defaults to “UE-V Agent Policy” if not present + +- PolicyDescription <description> Optional: A description is provided if not present + +- CabFilePath <full path to configuration item .CAB file> + +- ConfigurationFile <full path to agent configuration XML file> + +**Note**   +It might be necessary to change the PowerShell execution policy to allow these scripts to run in your environment. Perform these steps in the Configuration Manager console: + +1. Select **Administration > Client Settings > Properties** + +2. In the **User Agent** tab, set the **PowerShell Execution Policy** to **Bypass** + +  + +**Create the first UE-V policy configuration item** + +1. Copy the default settings configuration file from the UE-V Config Pack installation directory to a location visible to your ConfigMgr Admin Console: + + ``` syntax + C:\Program Files (x86)\Windows Kits\10\Microsoft User Experience Virtualization\Management\AgentConfiguration.xml + ``` + + The default configuration file contains five sections: + + **Computer Policy** + All UE-V machine level settings. The DesiredState attribute can be + + - **Set** to have the value assigned in the registry + + - **Clear** to remove the setting + + - **Unmanaged** to have the configuration item left at its current state + + Do not remove lines from this section. Instead, set the DesiredState to ‘Unmanaged’ if you do not want Configuration Manager to alter current or default values. + + **CurrentComputerUserPolicy** + All UE-V user level settings. These entries override the machine settings for a user. The DesiredState attribute can be + + - **Set** to have the value assigned in the registry + + - **Clear** to remove the setting + + - **Unmanaged** to have the configuration item left at its current state + + Do not remove lines from this section. Instead, set the DesiredState to ‘Unmanaged’ if you do not want Configuration Manager to alter current or default values. + + **Services** + Entries in this section control service operation. The default configuration file contains a single entry for the UevAgentService. The DesiredState attribute can be set to **Running** or **Stopped**. + + **Windows8AppsComputerPolicy** + All machine level Windows app synchronization settings. Each PackageFamilyName listed in this section can be assigned a DesiredState of + + - **Enabled** to have settings roam + + - **Disabled** to prevent settings from roaming + + - **Cleared** to have the entry removed from UE-V control + + Additional lines can be added to this section based on the list of installed Windows apps that can be viewed using the PowerShell cmdlet GetAppxPackage. + + **Windows8AppsCurrentComputerUserPolicy** + Identical to the Windows8AppsComputerPolicy with settings that override machine settings for an individual user. + +2. Edit the configuration file by changing the desired state and value fields. + +3. Run this command on a machine running the ConfigMgr Admin Console: + + ``` syntax + C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevAgentPolicyGenerator.exe -Site ABC -CabFilePath "C:\MyCabFiles\UevPolicyItem.cab" -ConfigurationFile "c:\AgentConfiguration.xml" + ``` + +4. Import the CAB file using ConfigMgr console or PowerShell Import-CMConfigurationItem + +**Update a UE-V Policy Configuration Item** + +1. Edit the configuration file by changing the desired state and value fields. + +2. Run the command from Step 3 in [Create the First UE-V Policy Configuration Item](#create). If you changed the name with the PolicyName parameter, make sure you enter the same name. + +3. Reimport the CAB file. The version in ConfigMgr will be updated. + +## Generate a UE-V Template Baseline + + +UE-V templates are distributed using a baseline containing multiple configuration items. Each configuration item contains the discovery and remediation scripts needed to install one UE-V template. The actual UE-V template is embedded within the remediation script for distribution using standard Configuration Item functionality. + +The UE-V template baseline is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: + +- Site <site code> + +- BaselineName <name> (Optional: defaults to “UE-V Template Distribution Baseline” if not present) + +- BaselineDescription <description> (Optional: a description is provided if not present) + +- TemplateFolder <UE-V template folder> + +- Register <comma separated template file list> + +- Unregister <comma separated template list> + +- CabFilePath <Full path to baseline CAB file to generate> + +The result is a baseline CAB file that is ready for import into Configuration Manager. If at a future date, you update or add a template, you can rerun the command using the same baseline name. Importing the CAB results in CI version updates on the changed templates. + +### Create the First UE-V Template Baseline + +1. Create a “master” set of UE-V templates in a stable folder location visible to the machine running your ConfigMgr Admin Console. As templates are added or updated, this folder is where they are pulled for distribution. The initial list of templates can be copied from a machine with UE-V installed. The default template location is C:\\Program Files\\Microsoft User Experience Virtualization\\Templates. + +2. Create a text.bat file where you can add the template generator command. This is optional, but will make regeneration simpler if you save the command parameters. + +3. Add the command and parameters to the .bat file that will generate the baseline. The following example creates a baseline that distributes Notepad and Calculator: + + ``` syntax + C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevTemplateBaselineGenerator.exe -Site "ABC" -TemplateFolder "C:\ProductionUevTemplates" -Register "MicrosoftNotepad.xml, MicrosoftCalculator.xml" -CabFilePath "C:\MyCabFiles\UevTemplateBaseline.cab" + ``` + +4. Run the .bat file to create UevTemplateBaseline.cab ready for import into Configuration Manager. + +### Update a UE-V Template Baseline + +The template generator uses the template version to determine if a template should be updated. If you make a template change and update the version, the baseline generator compares the template in your master folder with the template contained in the CI on the ConfigMgr server. If a difference is found, the generated baseline and modified CI versions are updated. + +To distribute a new Notepad template, you would perform these steps: + +1. Update the template and template version located in the <Version> element of the template. + +2. Copy the template to your master template directory. + +3. Run the command in the .bat file that you created in Step 3 in [Create the First UE-V Template Baseline](#create2). + +4. Import the generated CAB file into ConfigMgr using the console or PowerShell Import-CMBaseline. + +## Get the UE-V Configuration Pack + +You can download the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2.0](https://www.microsoft.com/en-us/download/details.aspx?id=40913) from the Microsoft Download Center. + +## Have a suggestion for UE-V? + + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + + +[Manage Configurations for UE-V](uev-manage-configurations.md) + +  + +  + + + + + diff --git a/windows/manage/uev-deploy-required-features.md b/windows/manage/uev-deploy-required-features.md new file mode 100644 index 0000000000..286fc22b1e --- /dev/null +++ b/windows/manage/uev-deploy-required-features.md @@ -0,0 +1,162 @@ +--- +title: Deploy required UE-V features +description: Deploy required UE-V features +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# Deploy required UE-V features + +**Applies to** +- Windows 10, version 1607 + +To get up and running with User Experience Virtualization (UE-V), install and configure the following features. + +- [Deploy a settings storage location](#deploy-a-ue-v-settings-storage-location) that is accessible to end users. + + This is a standard network share that stores and retrieves user settings. + +- [Choose the configuration method for UE-V](#choose-the-configuration-method-for-ue-v) + + You can deploy and configure UE-V with common management tools including group policy, Configuration Manager, or Windows Management Infrastructure and PowerShell. + +- [Enable the UE-V service](#enable-the-ue-v-service) on user devices. + + With Windows 10, version 1607, UE-V is installed automatically. You need to enable the UE-V service on each user device you want to include in your UE-V environment. + +The topics in this section describe how to deploy these features. + +## Deploy a UE-V Settings Storage Location + +UE-V requires a location in which to store user settings in settings package files. You can configure this settings storage location in one of these ways: + +- Create your own settings storage location + +- Use existing Active Directory for your settings storage location + +> **Note**   As a matter of [performance and capacity planning](uev-prepare-for-deployment.md#performance-and-capacity-planning) and to reduce problems with network latency, create settings storage locations on the same local networks where the users’ devices reside. We recommend 20 MB of disk space per user for the settings storage location. + +### Create a UE-V Settings Storage Location + +Before you define the settings storage location, you must create a root directory with read/write permissions for users who store settings on the share. The UE-V service creates user-specific folders under this root directory. + +The settings storage location is defined by setting the SettingsStoragePath configuration option, which you can configure by using one of these methods: + +- Through [Group Policy](uev-configuring-uev-with-group-policy-objects.md) settings + +- With the [System Center Configuration Pack](uev-configuring-uev-with-system-center-configuration-manager.md) for UE-V + +- With [Windows PowerShell or Windows Management Instrumentation (WMI)](uev-administering-uev-with-windows-powershell-and-wmi.md) + + The path must be in a universal naming convention (UNC) path of the server and share. For example, **\\\\Server\\Settingsshare\\**. This configuration option supports the use of variables to enable specific synchronization scenarios. For example, you can use the %username%\\%computername% variables to preserve the end user settings experience in these scenarios: + +- End users that use multiple physical devices in your enterprise + +- Enterprise computers that are used by multiple end users + +The UE-V service dynamically creates a user-specific settings storage path, with a hidden system folder named **SettingsPackages**, based on the configuration setting of **SettingsStoragePath**. The service reads and writes settings to this location as defined by the registered UE-V settings location templates. + +**UE-V settings are determined by a "Last write wins" rule:** If the settings storage location is the same for a user with multiple managed computers, one UE-V service reads and writes to the settings location independently of services running on other computers. The last written settings and values are the ones applied when the service next reads from the settings storage location. + +**Deploy the settings storage location:** Follow these steps to define the settings storage location rather than using your existing Active Directory agent. You should limit access to the settings storage share to those users that require it, as shown in the tables below. + +**To deploy the UE-V network share** + +1. Create a new security group for UE-V users. + +2. Create a new folder on the centrally located computer that stores the UE-V settings packages, and then grant UE-V users access with group permissions to the folder. The administrator who supports UE-V must have permissions to this shared folder. + +3. Set the following share-level Server Message Block (SMB) permissions for the settings storage location folder. + + | **User account** | **Recommended permissions** | + |------------------------------|-----------------------------| + | Everyone | No permissions | + | Security group of UE-V users | Full control | + +4. Set the following NTFS file system permissions for the settings storage location folder. + + | **User account** | **Recommended permissions** | **Folder** | + |------------------------------|---------------------------------------------------|---------------------------| + | Creator/owner | Full control | Subfolders and files only | + | Security group of UE-V users | List folder/read data, create folders/append data | This folder only | + +With this configuration, the UE-V service creates and secures a Settingspackage folder while it runs in the context of the user, and grants each user permission to create folders for settings storage. Users receive full control to their Settingspackage folder while other users cannot access it. + +**Note** +If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor: + +1. Add a **REG\_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration**. + +2. Set the registry key value to *1*. + +### Use Active Directory with UE-V + +The UE-V service uses Active Directory (AD) by default if you don’t define a settings storage location. In these cases, the UE-V service dynamically creates the settings storage folder under the root of the AD home directory of each user. However, if a custom directory setting is configured in AD, then that directory is used instead. + +## Choose the Configuration Method for UE-V + +You’ll need to decide which configuration method you'll use to manage UE-V after deployment since this will be the configuration method you use to deploy the UE-V Agent. Typically, this is the configuration method that you already use in your environment, such as Windows PowerShell or Configuration Manager. + +You can configure UE-V before, during, or after you enable the UE-V service on user devices, depending on the configuration method that you use. + +- [**Group Policy**](uev-configuring-uev-with-group-policy-objects.md) You can use your existing Group Policy infrastructure to configure UE-V before or after you enable the UE-V service. The UE-V Group Policy ADMX template enables the central management of common UE-V service configuration options and includes settings to configure UE-V synchronization. + + >**Note** Starting with Windows 10, version 1607, UE-V ADMX templates are installed automatically. + + Group Policy ADMX templates configure the synchronization settings for the UE-V service and enable the central management of common UE-V service configuration settings by using an existing Group Policy infrastructure. + + Supported operating systems for the domain controller that deploys the Group Policy Objects include: + + Windows Server 2012 and Windows Server 2012 R2 + +- [**Configuration Manager**](uev-configuring-uev-with-system-center-configuration-manager.md) The UE-V Configuration Pack lets you use the Compliance Settings feature of System Center Configuration Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. + +- [**Windows PowerShell and WMI**](uev-administering-uev-with-windows-powershell-and-wmi.md) You can use scripted commands for Windows PowerShell and Windows Management Instrumentation (WMI) to modify the configuration of the UE-V service. + +>**Note** +Registry modification can result in data loss, or the computer becomes unresponsive. We recommend that you use other configuration methods. + +## Enable the UE-V service + +The UE-V service is the client-side component that captures user-personalized application and Windows settings and saves them in settings packages. Settings packages are built, locally stored, and copied to the settings storage location. + +Before enabling the UE-V service, you need to register the UE-V templates for first time use. In a PowerShell window, type **register-<TemplateName>** where **TemplateName** is the name of the UE-V template you want to register, and press ENTER. + +>**Note** +With Windows 10, version 1607, you must register UE-V templates for all inbox and custom templates. This provides flexibility for only deploying the required templates. + +With Windows 10, version 1607 and later, the UE-V service is installed on user devices. Enable the service to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. + +**To enable the UE-V service with Group Policy** + +1. Open the device’s **Group Policy Editor**. + +2. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft** **User Experience Virtualization**. + +3. Run **Enable UEV**. + +4. Restart the device. + +**To enable the UE-V service with Windows PowerShell** + +1. In a PowerShell window, type **Enable-UEV** and press ENTER. + +2. Restart the device. + +3. In a PowerShell window, type **Get-UEVStatus** and press ENTER to verify that the UE-V service was successfully enabled. + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +[Prepare a UE-V deployment](uev-prepare-for-deployment.md) + +[Deploy UE-V for use with custom applications](uev-deploy-uev-for-custom-applications.md) + +[Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) + diff --git a/windows/manage/uev-deploy-uev-for-custom-applications.md b/windows/manage/uev-deploy-uev-for-custom-applications.md new file mode 100644 index 0000000000..6a44f5decc --- /dev/null +++ b/windows/manage/uev-deploy-uev-for-custom-applications.md @@ -0,0 +1,251 @@ +--- +title: Use UE-V with custom applications +description: Use UE-V with custom applications +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# Use UE-V with custom applications + +**Applies to** +- Windows 10, version 1607 + +User Experience Virtualization (UE-V) uses XML files called ***settings location templates*** to monitor and synchronize application settings and Windows settings between user devices. By default, some settings location templates are included in UE-V. However, if you want to synchronize settings for desktop applications other than those included in the default templates, you can create your own custom settings location templates with the UE-V template generator. + +After you’ve reviewed [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) and decided that you want to synchronize settings for custom applications (third-party, line-of-business, e.g.), you’ll need to deploy the features of UE-V described in this topic. + +To start, here are the main steps required to synchronize settings for custom applications: + +- [Install the UE-V template generator](#install-the-uev-template-generator) + + Use the UEV template generator to create custom XML settings location templates. + +- [Configure a UE-V settings template catalog](#deploy-a-settings-template-catalog) + + You can define this path where custom settings location templates are stored. + +- [Create custom settings location templates](#create-custom-settings-location-templates) + + These custom templates let users sync settings for custom applications. + +- [Deploy the custom settings location templates](#deploy-the-custom-settings-location-templates) + + After you test the custom template to ensure that settings are synced correctly, you can deploy these templates in one of these ways: + + - With your existing electronic software distribution solution, such as Configuration Manager + + - With Group Policy preferences + + - With a UE-V settings template catalog + +>**Note** +Templates that are deployed with electronic software distribution methods or Group Policy must be registered with UE-V Windows Management Instrumentation (WMI) or Windows PowerShell. + +## Prepare to deploy UE-V for custom applications + +Before you start deploying the UE-V features that handle custom applications, review the following important information. + +### The UE-V template generator + +Use the UE-V template generator to monitor, discover, and capture the locations where Win32 applications store settings. The template generator does not create settings location templates for the following types of applications: + +- Virtualized applications + +- Applications that are offered through Terminal Services + +- Java applications + +- Windows applications + +>**Note** +UE-V settings location templates cannot be created from virtualized applications or Terminal Services applications. However, settings that are synchronized by using the templates can be applied to those applications. To create templates that support Virtual Desktop Infrastructure (VDI) and Terminal Services applications, open a version of the Windows Installer (.msi) package of the application by using the UE-V template generator. For more information about synchronizing settings for virtual applications, see [Using UE-V with virtual applications](uev-using-uev-with-application-virtualization-applications.md). + +**Excluded Locations:** The discovery process excludes locations that commonly store application software files that do not synchronize settings well between user computers or computing environments. By default, these are excluded: + +- HKEY\_CURRENT\_USER registry keys and files to which the logged-on user cannot write values + +- HKEY\_CURRENT\_USER registry keys and files that are associated with the core functionality of the Windows operating system + +- All registry keys that are located in the HKEY\_LOCAL\_MACHINE hive + +- Files that are located in Program Files directories + +- Files that are located in Users \\ \[User name\] \\ AppData \\ LocalLow + +- Windows operating system files that are located in %Systemroot% + +If registry keys and files that are stored in excluded locations are required to synchronize application settings, you can manually add the locations to the settings location template during the template creation process. + +### Replace the default Microsoft templates + +A default group of settings location templates for common Microsoft applications and Windows settings is included with Windows 10, version 1607. If you customize these templates, or create settings location templates to synchronize settings for custom applications, the UE-V service can be configured to use a settings template catalog to store the templates. In this case, you will need to include the default templates with the custom templates in the settings template catalog. + +>**Important** +After you enable the UE-V service, you’ll need to register the settings location templates using the `Register-UevTemplate` cmdlet in Windows PowerShell. + +When you use Group Policy to configure the settings template catalog path, you can choose to replace the default Microsoft templates. If you configure the policy settings to replace the default Microsoft templates, all of the default Microsoft templates that are installed with Windows 10, version 1607 are deleted and only the templates that are located in the settings template catalog are used. + +**Note** +If there are customized templates in the settings template catalog that use the same ID as the default Microsoft templates, the Microsoft templates are ignored. + +You can replace the default templates by using the UE-V Windows PowerShell features. To replace the default Microsoft template with Windows PowerShell, unregister all of the default Microsoft templates, and then register the customized templates. + +Old settings packages remain in the settings storage location even if you deploy new settings location templates for an application. These packages are not read by the UE-V service, but neither are they automatically deleted. + +### Install the UEV template generator + +Use the UE-V template generator to create custom settings location templates that you can then distribute to user devices. You can also use the template generator to edit an existing template or validate a template that was created with another XML editor. + +The UE-V template generator is included in the Windows Assessment and Deployment Kit (ADK) for Windows 10. + +Install the UE-V template generator on a computer that you can use to create a custom settings location template. This computer should have the applications installed for which custom settings location templates need to be generated. + +>**Important** +UE-V for Windows 10, version 1607 includes a new template generator. If you are upgrading from an existing UE-V installation, you’ll need to use the new generator to create settings location templates. Templates created with previous versions of the UE-V template generator will continue to work. + +**To install the UE-V template generator** + +1. Go to [Download the Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) to access the ADK. + +2. Select the **Get Windows ADK for Windows 10** button on this page to start the ADK installer. On the window pictured below, select **Microsoft User Experience Virtualization (UE-V) Template Generator** and then select Install. + + + +![Selecting UE-V features in ADK](images/uev-adk-select-uev-feature.png) + +3. To open the generator, select **Microsoft Application Virtualization Generator** from the **Start** menu. + +4. See [Working with Custom UE-V Templates and the UE-V Template Generator](uev-working-with-custom-templates-and-the-uev-generator.md) for information about how to use the template generator. + +### Deploy a settings template catalog + +The UE-V settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores all the custom settings location templates. The UE-V service checks this location one time each day and updates its synchronization behavior, based on the templates in this folder. + +The UE-V service checks this folder for templates that were added, updated, or removed. It registers new and changed templates and unregisters removed templates. By default, templates are registered and unregistered one time per day at 3:30 A.M. local time by the Task Scheduler and at system startup. To customize the frequency of this scheduled task, see [Changing the frequency of UE-V scheduled tasks](uev-changing-the-frequency-of-scheduled-tasks.md). + +You can configure the settings template catalog path with command-line options, Group Policy, WMI, or Windows PowerShell. Templates stored at the settings template catalog path are automatically registered and unregistered by a scheduled task. + +**To configure the settings template catalog for UE-V** + +1. Create a new folder on the computer that stores the UE-V settings template catalog. + +2. Set the following share-level (SMB) permissions for the settings template catalog folder. + + | **User account** | **Recommended permissions** | + |------------------|------------------------------| + | Everyone | No Permissions | + | Domain Computers | Read Permission Levels | + | Administrators | Read/Write Permission Levels | + +3. Set the following NTFS file system permissions for the settings template catalog folder. + + | **User account** | **Recommended permissions** | **Apply to** | + |------------------|-------------------------------|-----------------------------------| + | Creator/Owner | Full Control | This Folder, Subfolders and Files | + | Domain Computers | List Folder Contents and Read | This Folder, Subfolders and Files | + | Everyone | No Permissions | No Permissions | + | Administrators | Full Control | This Folder, Subfolders and Files | + +4. Click **OK** to close the dialog boxes. + +At a minimum, the network share must grant permissions for the Domain Computers group. In addition, grant access permissions for the network share folder to administrators who are to manage the stored templates. + +### Create custom settings location templates + +Use the UE-V template generator to create settings location templates for line-of-business applications or other custom applications. After you create the template for an application, deploy it to computers to synchronize settings for that application. + +**To create a UE-V settings location template with the UE-V template generator** + +1. Click **Start** > **All Programs** > **Microsoft User Experience Virtualization** > **Microsoft User Experience Virtualization template generator**. + +2. Click **Create a settings location template**. + +3. Specify the application. Browse to the file path of the application (.exe) or the application shortcut (.lnk) for which you want to create a settings location template. Specify the command-line arguments, if any, and working directory, if any. + +4. Click **Next** to continue. + + >**Note** Before the application is started, the system displays a prompt for **User Account Control**. Permission is required to monitor the registry and file locations that the application uses to store settings. + +5. After the application starts, close the application. The UE-V template generator records the locations where the application stores its settings. + +6. After the process is completed, click **Next** to continue. + +7. Review and select the appropriate registry settings locations and settings file locations to synchronize for this application. The list includes the following two categories for settings locations: + + - **Standard**: Application settings that are stored in the registry under the HKEY\_CURRENT\_USER keys or in the file folders under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming**. The UE-V template generator includes these settings by default. + + - **Nonstandard**: Application settings that are stored outside the locations are specified in the best practices for settings data storage (optional). These include files and folders under **Users** \\ \[User name\] \\ **AppData** \\ **Local**. Review these locations to determine whether to include them in the settings location template. Select the locations check boxes to include them. + +8. Click **Next** to continue. + +9. Review and edit any **Properties**, **Registry** locations, and **Files** locations for the settings location template. + + - Edit the following properties on the **Properties** tab: + + - **Application Name**: The application name that is written in the description of the program files properties. + + - **Program name**: The name of the program that is taken from the program file properties. This name usually has the .exe file name extension. + + - **Product version**: The product version number of the .exe file of the application. This property, in conjunction with the **File version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the product. + + - **File version**: The file version number of the .exe file of the application. This property, in conjunction with the **Product version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the program. + + - **template author name** (optional): The name of the settings location template author. + + - **template author email** (optional): The email address of the settings location template author. + + - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. Edit the registry locations by using the **Tasks** drop-down menu. Tasks enable you to add new keys, edit the name or scope of existing keys, delete keys, and browse the registry where the keys are located. Use the **All Settings** scope to include all the registry settings under the specified key. Use the **All Settings and Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. + + - The **Files** tab lists the file path and file mask of the file locations that are included in the settings location template. Edit the file locations by use of the **Tasks** drop-down menu. Tasks for file locations enable you to add new files or folder locations, edit the scope of existing files or folders, delete files or folders, and open the selected location in Windows Explorer. Leave the file mask empty to include all files in the specified folder. + +10. Click **Create**, and then click **Save** to save the settings location template on the computer. + +11. Click **Close** to close the settings template wizard. Exit the UE-V template generator application. + +12. After you have created the settings location template for an application, test the template. Deploy the template in a lab environment before you put it into production in the enterprise. + +See [Application template schema reference for UE-V](uev-application-template-schema-reference.md) for details about the XML structure of the UE-V settings location template and for guidance about editing these files. + +### Deploy the Custom Settings Location templates + +After you create a settings location template with the UE-V template generator, you should test it to ensure that the application settings are synchronized correctly. You can then safely deploy the settings location template to user devices in the enterprise. + +You can deploy settings location templates using of these methods: + +- An electronic software distribution (ESD) system such as System Center Configuration Manager + +- Group Policy preferences + +- A UE-V settings template catalog + +Templates that are deployed by using an ESD system or Group Policy objects must be registered using UE-V Windows Management Instrumentation (WMI) or Windows PowerShell. Templates that are stored in the settings template catalog location are automatically registered by the UE-V service. + +**To deploy UE-V settings location templates with a settings template catalog path** + +1. Browse to the network share folder that you defined as the settings template catalog. + +2. Add, remove, or update settings location templates in the settings template catalog to reflect the UE-V service template configuration that you want for UE-V computers. + + >**Note** + Templates on computers are updated daily. The update is based on changes to the settings template catalog. + +3. To manually update templates on a computer that runs the UE-V service, open an elevated command prompt, and browse to **Program Files\\Microsoft User Experience Virtualization \\ Agent \\ <x86 or x64 >**, and then run **ApplySettingstemplateCatalog.exe**. + + >**Note** + This program runs automatically during computer startup and daily at 3:30 A. M. to gather any new templates that were recently added to the catalog. + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) + +- [Deploy Required UE-V Features](uev-deploy-required-features.md) + diff --git a/windows/manage/uev-for-windows.md b/windows/manage/uev-for-windows.md new file mode 100644 index 0000000000..1f4eaab35c --- /dev/null +++ b/windows/manage/uev-for-windows.md @@ -0,0 +1,98 @@ +--- +title: User Experience Virtualization for Windows 10, version 1607 +description: Overview of User Experience Virtualization for Windows 10, version 1607 +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# User Experience Virtualization (UE-V) for Windows 10 overview + +**Applies to** +- Windows 10, version 1607 + +Many users customize their settings for Windows and for specific applications. Customizable Windows settings include Windows Store appearance, language, background picture, font size, and accent colors. Customizable application settings include language, appearance, behavior, and user interface options. + +With User Experience Virtualization (UE-V), you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to. + +**With UE-V you can…** + +- Specify which application and Windows settings synchronize across user devices + +- Deliver the settings anytime and anywhere users work throughout the enterprise + +- Create custom templates for your third-party or line-of-business applications + +- Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state + +With the release of Windows 10, version 1607, UE-V is included with the Windows 10 for Enterprise edition. If you are new to Windows 10 and UE-V or upgrading from a previous version of UE-V, you’ll need to download, activate, and install server- and client-side components to start synchronizing user-customized settings across devices. + +## Components of UE-V + +The diagram below illustrates how UE-V components work together to synchronize user settings. + +UE-V architecture, with server share, desktop, and UE-V service + + + +| **Component** | **Function** | +|--------------------------|------------------| +| **UE-V service** | Enabled on every device that needs to synchronize settings, the **UE-V service** monitors registered applications and Windows for any settings changes, then synchronizes those settings between devices. | +| **Settings packages** | Application settings and Windows settings are stored in **settings packages** created by the UE-V service. Settings packages are built, locally stored, and copied to the settings storage location.
    The setting values for **desktop applications** are stored when the user closes the application.
    Values for **Windows settings** are stored when the user logs off, when the computer is locked, or when the user disconnects remotely from a computer.
    The sync provider determines when the application or operating system settings are read from the **Settings Packages** and synchronized. | +| **Settings storage location** | This is a standard network share that your users can access. The UE-V service verifies the location and creates a hidden system folder in which to store and retrieve user settings. | +| **Settings location templates** | UE-V uses XML files as settings location templates to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V. You can also create, edit, or validate custom settings location templates by [managing settings synchronization for custom applications](#manage-settings-synchronization-for-custom-applications).
    **Note**  Settings location templates are not required for Windows applications. | +| **Universal Windows applications list** | Settings for Windows applications are captured and applied dynamically. The app developer specifies the settings that are synchronized for each app. UE-V determines which Windows applications are enabled for settings synchronization using a managed list of applications. By default, this list includes most Windows applications.
    You can add or remove applications in the Windows app list by following the procedures in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md). | + +## Manage settings synchronization for custom applications + +Use these UE-V components to create and manage custom templates for your third-party or line-of-business applications. + +| Component | Description | +|-------------------------------|---------------| +| **UE-V template generator** | Use the **UE-V template generator** to create custom settings location templates that you can then distribute to user computers. The UE-V template generator also lets you edit an existing template or validate a template that was created with a different XML editor.
    With the Windows 10, version 1607 release, the UE-V template generator is installed with the [Windows Assessment and Deployment kit for Windows 10, version 1607](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) (Windows ADK).
    If you are upgrading from an existing UE-V installation, you’ll need to use the new generator to create new settings location templates. Application templates created with previous versions of the UE-V template generator are still supported, however. | +| **Settings template catalog** | The **settings template catalog** is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores the custom settings location templates. The UE-V service checks this location once a day, retrieves new or updated templates, and updates its synchronization behavior.
    If you use only the UE-V default settings location templates, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see [Deploy a UE-V settings template catalog](uev-deploy-uev-for-custom-applications.md#deploycatalogue). | + + + +![UE-V template generator process](images/uev-generator-process.png) + +## Settings synchronized by default + +UE-V synchronizes settings for these applications by default. For a complete list and more detailed information, see [Settings that are automatically synchronized in a UE-V deployment](uev-prepare-for-deployment.md#autosyncsettings). + +- Microsoft Office 2016, 2013, and 2010 + +- Internet Explorer 11 and 10 + +- Many Windows applications, such as Xbox + +- Many Windows desktop applications, such as Notepad + +- Many Windows settings, such as desktop background or wallpaper + +>**Note** +You can also [customize UE-V to synchronize settings](uev-deploy-uev-for-custom-applications.md) for applications other than those synchronized by default. + +## Other resources for this feature + +- [Get Started with UE-V for Windows 10](uev-getting-started.md) + +- [UE-V for Windows 10 Release Notes](uev-release-notes-1607.md) + +- [Prepare to deploy UE-V for Windows 10](uev-prepare-for-deployment.md) + +- [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) + +- [Administer UE-V for Windows 10](uev-administering-uev.md) + +- [Technical Reference for UE-V for Windows 10](uev-technical-reference.md) + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). diff --git a/windows/manage/uev-getting-started.md b/windows/manage/uev-getting-started.md new file mode 100644 index 0000000000..f2497cb4f5 --- /dev/null +++ b/windows/manage/uev-getting-started.md @@ -0,0 +1,143 @@ +--- +title: Get Started with UE-V +description: Get Started with UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# Get Started with UE-V + +**Applies to** +- Windows 10, version 1607 + +Follow the steps in this topic to deploy User Experience Virtualization (UE-V) for the first time in a test environment. Evaluate UE-V to determine whether it’s the right solution to manage user settings across multiple devices within your enterprise. + +>**Note** +The information in this section is explained in greater detail throughout the rest of the documentation. If you’ve already determined that UE-V is the right solution and you don’t need to further evaluate it, see [Prepare a UE-V deployment](uev-prepare-for-deployment.md). + +The standard installation of UE-V synchronizes the default Microsoft Windows and Office settings and many Windows applications settings. For best results, ensure that your test environment includes two or more user computers that share network access. + +- [Step 1: Confirm prerequisites](#step-1-confirm-prerequisites). Review the supported configurations in this section to verify that your environment is able to run UE-V. + +- [Step 2: Deploy the settings storage location](#step-2-deploy-the-settings-storage-location). Explains how to deploy a settings storage location. All UE-V deployments require a location to store settings packages that contain the synchronized setting values. + +- [Step 3: Enable the UE-V service](#step-3-enable-the-ue-v-service-on-user-devices). Explains how to enable to UE-V service on user devices. To synchronize settings using UE-V, devices must have the UE-V service enabled and running. + +- [Step 4: Test Your UE-V evaluation deployment](#step-4-test-your-ue-v-evaluation-deployment). Run a few tests on two computers with the UE-V service enabled to see how UE-V works and if it meets your organization’s needs. + +- Step 5: Deploy UE-V for custom applications (optional). If you want to evaluate how your third-party and line-of-business applications work with UE-V, follow the steps in [Use UE-V with custom applications](uev-deploy-uev-for-custom-applications.md). Following this link takes you to another topic. Use your browser’s **Back** button to return to this topic. + +## Step 1: Confirm prerequisites + +Before you proceed, ensure that your environment meets the following requirements for running UE-V. + +| **Operating system** | **Edition** | **Service pack** | **System architecture** | **Windows PowerShell** | **Microsoft .NET Framework** | +|-------------------------|-------------|------------------|-------------------------|----------------------------------|------------------------------| +| Windows 10, version 1607 | Windows 10 Enterprise | NA | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4 or higher | +| Windows 8 and Windows 8.1 | Enterprise or Pro | None | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 | +| Windows Server 2012 or Windows Server 2012 R2 | Standard or Datacenter | None | 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 | + +## Step 2: Deploy the settings storage location + +You’ll need to deploy a settings storage location, a standard network share where user settings are stored in a settings package file. When you create the settings storage share, you should limit access to users that require it. For more information, see [Deploy a UE-V Settings Storage Location](uev-deploy-required-features.md#deploy-a-ue-v-settings-storage-location). + +**Create a network share** + +1. Create a new security group and add UE-V users to it. + +2. Create a new folder on the centrally located computer that stores the UE-V settings packages, and then grant the UE-V users access with group permissions to the folder. The administrator who supports UE-V must have permissions to this shared folder. + +3. Assign UE-V users permission to create a directory when they connect. Grant full permission to all subdirectories of that directory, but block access to anything above. + +4. Set the following share-level Server Message Block (SMB) permissions for the settings storage location folder. + + | **User account** | **Recommended permissions** | + |------------------------------|-----------------------------| + | Everyone | No permissions | + | Security group of UE-V users | Full control | + +5. Set the following NTFS file system permissions for the settings storage location folder. + + | **User account** | **Recommended permissions** | **Folder** | + |------------------------------|---------------------------------------------------|---------------------------| + | Creator/owner | Full control | Subfolders and files only | + | Security group of UE-V users | List folder/read data, create folders/append data | This folder only | + +**Security Note**  If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor: + +1. Add a **REG\_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration**. + +2. Set the registry key value to *1*. + +## Step 3: Enable the UE-V service on user devices + +For evaluation purposes, enable the service on at least two devices that belong to the same user in your test environment. + +The UE-V service is the client-side component that captures user-personalized application and Windows settings and saves them in settings packages. Settings packages are built, locally stored, and copied to the settings storage location. + +Before enabling the UE-V service, you'll need to register the UE-V templates for first use. In a PowerShell window, type `register-TemplateName` where **TemplateName** is the name of the UE-V template you want to register, and press ENTER. + +With Windows 10, version 1607 and later, the UE-V service is installed on user devices when the operating system is installed. Enable the service to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. + +**To enable the UE-V service with Group Policy** + +1. Open the device’s **Group Policy Editor**. + +2. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft** **User Experience Virtualization**. + +3. Run **Enable UEV**. + +4. Restart the device. + +**To enable the UE-V service with Windows PowerShell** + +1. In a PowerShell window, type **Enable-UEV** and press ENTER. + +2. Restart the device. + +3. In a PowerShell window, type **Get-UEVStatus** and press ENTER to verify that the UE-V service was successfully enabled. + +## Step 4: Test your UE-V evaluation deployment + +You’re ready to run a few tests on your UE-V evaluation deployment to see how UE-V works. + +1. On the first device (Computer A), make one or more of these changes: + + - Open Windows Desktop and move the taskbar to a different location in the window. + + - Change the default fonts. + + - Open Notepad and set format -> word wrap **on**. + + - Change the behavior of any Windows application, as detailed in [Managing UE-V settings location templates using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md). + + - Disable Microsoft Account settings synchronization and roaming profiles. + +2. Log off Computer A. Settings are saved in a UE-V settings package when users lock, logoff, exit an application, or when the sync provider runs (every 30 minutes by default). + +3. Log in to the second device (Computer B) as the same user as Computer A. + +4. Open Windows Desktop and verify that the taskbar location matches that of Computer A. Verify that the default fonts match and that NotePad is set to **word wrap on**. Also verify the change you made to any Windows applications. + +5. You can change the settings in Computer B back to the original Computer A settings. Then log off Computer B and log in to Computer A to verify the changes. + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Other resources for this feature + +- [User Experience Virtualization overview](uev-for-windows.md) + +- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) + +- [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) + +- [Administering UE-V ](uev-administering-uev.md) + +- [Troubleshooting UE-V ](uev-troubleshooting.md) + +- [Technical Reference for UE-V](uev-technical-reference.md) diff --git a/windows/manage/uev-manage-administrative-backup-and-restore.md b/windows/manage/uev-manage-administrative-backup-and-restore.md new file mode 100644 index 0000000000..4b70595e59 --- /dev/null +++ b/windows/manage/uev-manage-administrative-backup-and-restore.md @@ -0,0 +1,171 @@ +--- +title: Manage Administrative Backup and Restore in UE-V +description: Manage Administrative Backup and Restore in UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Manage Administrative Backup and Restore in UE-V + +**Applies to** +- Windows 10, version 1607 + +As an administrator of User Experience Virtualization (UE-V), you can restore application and Windows settings to their original state. You can also restore additional settings when a user adopts a new device. + +## Restore Settings in UE-V when a User Adopts a New Device + + +To restore settings when a user adopts a new device, you can put a settings location template in **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. To backup settings for a template, use the following cmdlet in Windows PowerShell: + +``` syntax +Set-UevTemplateProfile -ID -Profile +``` + +- <TemplateID> is the UE-V Template ID + +- <backup> can either be Backup or Roaming + +When replacing a user’s device, UE-V automatically restores settings if the user’s domain, username, and device name all match. All synchronized and any backup data is restored on the device automatically. + +You can also use the Windows PowerShell cmdlet, Restore-UevBackup, to restore settings from a different device. To clone the settings packages for the new device, use the following cmdlet in Windows PowerShell: + +``` syntax +Restore-UevBackup -Machine +``` + +where <MachineName> is the computer name of the device. + +Templates such as the Office 2013 template that include many applications can either all be included in the roamed (default) or backed up profile. Individual apps in a template suite follow the group. Office 2013 in-box templates include both roaming and backup-only settings. Backup-only settings cannot be included in a roaming profile. + +As part of the Backup/Restore feature, UE-V added **last known good (LKG)** to the options for rolling back to settings. In this release, you can roll back to either the original settings or LKG settings. The LKG settings let users roll back to an intermediate and stable point ahead of the pre-UE-V state of the settings. + +### How to Backup/Restore Templates with UE-V + +These are the key backup and restore components of UE-V: + +- Template profiles + +- Settings packages location within the Settings Storage Location template + +- Backup trigger + +- How settings are restored + +**Template Profiles** + +A UE-V template profile is defined when the template is registered on the device or post registration through the PowerShell/WMI configuration utility. The profile types include: + +- Roaming (default) + +- Backup + +- BackupOnly + +All templates are included in the roaming profile when registered unless otherwise specified. These templates synchronize settings to all UE-V enabled devices with the corresponding template enabled. + +Templates can be added to the Backup Profile with PowerShell or WMI using the Set-UevTemplateProfile cmdlet. Templates in the Backup Profile back up these settings to the Settings Storage Location in a special Device name directory. Specified settings are backed up to this location. + +Templates designated BackupOnly include settings specific to that device that should not be synchronized unless explicitly restored. These settings are stored in the same device-specific settings package location on the settings storage location as the Backedup Settings. These templates have a special identifier embedded in the template that specifies they should be part of this profile. + +**Settings packages location within the Settings Storage Location template** + +Roaming Profile settings are stored on the settings storage location. Templates assigned to the Backup or the BackupOnly profile store their settings to the Settings Storage Location in a special Device name directory. Each device with templates in these profiles has its own device name. UE-V does not clean up these directories. + +**Backup trigger** + +Backup is triggered by the same events that trigger a UE-V synchronization. + +**How settings are restored** + +Restoring a user’s device restores the currently registered Template’s settings from another device’s backup folder and all synchronized settings to the current machine. Settings are restored in these two ways: + +- **Automatic restore** + + If the user’s UE-V settings storage path, domain, and Computer name match the current user then all of the settings for that user are synchronized, with only the latest settings applied. If a user logs on to a new device for the first time and these criteria are met, the settings data is applied to that device. + + **Note**   + Accessibility and Windows Desktop settings require the user to re-logon to Windows to be applied. + +   + +- **Manual Restore** + + If you want to assist users by restoring a device during a refresh, you can choose to use the Restore-UevBackup cmdlet. This command ensures that the user’s current settings become the current state on the Settings Storage Location. + +## Restore Application and Windows Settings to Original State + + +WMI and Windows PowerShell commands let you restore application and Windows settings to the settings values that were on the computer the first time that the application started after the UE-V service was enabled. This restoring action is performed on a per-application or Windows settings basis. The settings are restored the next time that the application runs, or the settings are restored when the user logs on to the operating system. + +**To restore application settings and Windows settings with Windows PowerShell for UE-V** + +1. Open the Windows PowerShell window. + +2. Enter the following Windows PowerShell cmdlet to restore the application settings and Windows settings. + + + + + + + + + + + + + + + + + + +
    Windows PowerShell cmdletDescription

    Restore-UevUserSetting -<TemplateID>

    Restores the user settings for an application or restores a group of Windows settings.

    + +   + +**To restore application settings and Windows settings with WMI** + +1. Open a Windows PowerShell window. + +2. Enter the following WMI command to restore application settings and Windows settings. + + + + + + + + + + + + + + + + + + +
    WMI commandDescription

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name RestoreByTemplateId -ArgumentList <template_ID>

    Restores the user settings for an application or restores a group of Windows settings.

    + +   + + **Note**   + UE-V does not provide a settings rollback for Windows apps. + +   + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +[Administering UE-V with Windows PowerShell and WMI](uev-administering-uev-with-windows-powershell-and-wmi.md) + +[Administering UE-V](uev-administering-uev.md) diff --git a/windows/manage/uev-manage-configurations.md b/windows/manage/uev-manage-configurations.md new file mode 100644 index 0000000000..81dbad3d82 --- /dev/null +++ b/windows/manage/uev-manage-configurations.md @@ -0,0 +1,69 @@ +--- +title: Manage Configurations for UE-V +description: Manage Configurations for UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Manage Configurations for UE-V + +**Applies to** +- Windows 10, version 1607 + +In the course of the User Experience Virtualization (UE-V) lifecycle, you have to manage the configuration of the UE-V service and also manage storage locations for resources such as settings package files. The following topics provide guidance for managing these UE-V resources. + +## Configuring UE-V by using Group Policy Objects + +You can use Group Policy Objects to modify the settings that define how UE-V synchronizes settings on computers. + +[Configuring UE-V with Group Policy Objects](uev-configuring-uev-with-group-policy-objects.md) + +## Configuring UE-V with System Center Configuration Manager + +You can use System Center Configuration Manager to manage the UE-V service by using the UE-V Configuration Pack. + +[Configuring UE-V with System Center Configuration Manager](uev-configuring-uev-with-system-center-configuration-manager.md) + +## Administering UE-V with PowerShell and WMI + +UE-V provides Windows PowerShell cmdlets, which can help administrators perform various UE-V tasks. + +[Administering UE-V with Windows PowerShell and WMI](uev-administering-uev-with-windows-powershell-and-wmi.md) + +## Examples of configuration settings for UE-V + +Here are some examples of UE-V configuration settings: + +- **Settings Storage Path:** Specifies the location of the file share that stores the UE-V settings. + +- **Settings Template Catalog Path:** Specifies the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates. + +- **Register Microsoft Templates:** Specifies whether the default Microsoft templates should be registered during installation. + +- **Synchronization Method:** Specifies whether UE-V uses the sync provider or "none". The "SyncProvider" supports computers that are disconnected from the network. "None" applies when the computer is always connected to the network. For more information about the Sync Method, see [Sync Methods for UE-V](uev-sync-methods.md). + +- **Synchronization Timeout:** Specifies the number of milliseconds that the computer waits before time-out when it retrieves the user settings from the settings storage location. + +- **Synchronization Enable:** Specifies whether the UE-V settings synchronization is enabled or disabled. + +- **Maximum Package Size:** Specifies a settings package file threshold size in bytes at which the UE-V service reports a warning. + +- **Don’t Sync Windows App Settings:** Specifies that UE-V should not synchronize Windows apps. + +- **Enable/Disable First Use Notification:** Specifies whether UE-V displays a dialog box the first time that the UE-V service runs on a user’s computer. + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +[Administering UE-V](uev-administering-uev.md) + +[Deploy Required UE-V Features](uev-deploy-required-features.md) + +[Use UE-V with custom applications](uev-deploy-uev-for-custom-applications.md) diff --git a/windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md b/windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md new file mode 100644 index 0000000000..590e4d58c3 --- /dev/null +++ b/windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md @@ -0,0 +1,342 @@ +--- +title: Managing UE-V Settings Location Templates Using Windows PowerShell and WMI +description: Managing UE-V Settings Location Templates Using Windows PowerShell and WMI +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Managing UE-V Settings Location Templates Using Windows PowerShell and WMI + +**Applies to** +- Windows 10, version 1607 + +User Experience Virtualization (UE-V) uses XML settings location templates to define the settings that User Experience Virtualization captures and applies. UE-V includes a set of standard settings location templates. It also includes the UE-V template generator tool that enables you to create custom settings location templates. After you create and deploy settings location templates, you can manage those templates by using Windows PowerShell and the Windows Management Instrumentation (WMI). + +> **Note**  For a complete list of UE-V cmdlets, see [User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx). + +## Manage UE-V settings location templates by using Windows PowerShell + +The WMI and Windows PowerShell features of UE-V include the ability to enable, disable, register, update, and unregister settings location templates. By using these features, you can automate the process of registering, updating, or unregistering templates with the UE-V service. You can also manually register templates by using WMI and Windows PowerShell commands. By using these features in conjunction with an electronic software distribution solution, Group Policy, or another automated deployment method such as a script, you can further automate that process. + +You must have administrator permissions to update, register, or unregister a settings location template. Administrator permissions are not required to enable, disable, or list templates. + +****To manage settings location templates by using Windows PowerShell**** + +1. Use an account with administrator rights to open a Windows PowerShell command prompt. + +2. Use the following Windows PowerShell cmdlets to register and manage the UE-V settings location templates. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows PowerShell commandDescription

    Get-UevTemplate

    Lists all the settings location templates that are registered on the computer.

    Get-UevTemplate -Application <string>

    Lists all the settings location templates that are registered on the computer where the application name or template name contains <string>.

    Get-UevTemplate -TemplateID <string>

    Lists all the settings location templates that are registered on the computer where the template ID contains <string>.

    Get-UevTemplate [-ApplicationOrTemplateID] <string>

    Lists all the settings location templates that are registered on the computer where the application or template name, or template ID contains <string>.

    Get-UevTemplateProgram [-ID] <template ID>

    Gets the name of the program and version information, which depend on the template ID.

    Get-UevAppXPackage

    Gets the effective list of Windows apps.

    Get-UevAppXPackage -Computer

    Gets the list of Windows apps that are configured for the computer.

    Get-UevAppXPackage -CurrentComputerUser

    Gets the list of Windows apps that are configured for the current user.

    Register-UevTemplate [-Path] <template file path>[,<template file path>]

    Registers one or more settings location template with UE-V by using relative paths and/or wildcard characters in file paths. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.

    Register-UevTemplate -LiteralPath <template file path>[,<template file path>]

    Registers one or more settings location template with UE-V by using literal paths, where no characters can be interpreted as wildcard characters. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.

    Unregister-UevTemplate [-ID] <template ID>

    Unregisters a settings location template with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.

    Unregister-UevTemplate -All

    Unregisters all settings location templates with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.

    Update-UevTemplate [-Path] <template file path>[,<template file path>]

    Updates one or more settings location templates with a more recent version of the template. Use relative paths and/or wildcard characters in the file paths. The new template should be a newer version than the existing template.

    Update-UevTemplate -LiteralPath <template file path>[,<template file path>]

    Updates one or more settings location templates with a more recent version of the template. Use full paths to template files, where no characters can be interpreted as wildcard characters. The new template should be a newer version than the existing template.

    Clear-UevAppXPackage -Computer [-PackageFamilyName] <package family name>[,<package family name>]

    Removes one or more Windows apps from the computer Windows app list.

    Clear-UevAppXPackage -CurrentComputerUser

    Removes Windows app from the current user Windows app list.

    Clear-UevAppXPackage -Computer -All

    Removes all Windows apps from the computer Windows app list.

    Clear-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

    Removes one or more Windows apps from the current user Windows app list.

    Clear-UevAppXPackage [-CurrentComputerUser] -All

    Removes all Windows apps from the current user Windows app list.

    Disable-UevTemplate [-ID] <template ID>

    Disables a settings location template for the current user of the computer.

    Disable-UevAppXPackage -Computer [-PackageFamilyName] <package family name>[,<package family name>]

    Disables one or more Windows apps in the computer Windows app list.

    Disable-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

    Disables one or more Windows apps in the current user Windows app list.

    Enable-UevTemplate [-ID] <template ID>

    Enables a settings location template for the current user of the computer.

    Enable-UevAppXPackage -Computer [-PackageFamilyName] <package family name>[,<package family name>]

    Enables one or more Windows apps in the computer Windows app list.

    Enable-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

    Enables one or more Windows apps in the current user Windows app list.

    Test-UevTemplate [-Path] <template file path>[,<template file path>]

    Determines whether one or more settings location templates comply with its XML schema. Can use relative paths and wildcard characters.

    Test-UevTemplate -LiteralPath <template file path>[,<template file path>]

    Determines whether one or more settings location templates comply with its XML schema. The path must be a full path to the template file, but does not include wildcard characters.

    + +   + +The UE-V Windows PowerShell features enable you to manage a group of settings templates that are deployed in your enterprise. Use the following procedure to manage a group of templates by using Windows PowerShell. + +**To manage a group of settings location templates by using Windows PowerShell** + +1. Modify or update the desired settings location templates. + +2. If you want to modify or update the settings location templates, deploy those settings location templates to a folder that is accessible to the local computer. + +3. On the local computer, open a Windows PowerShell window with administrator rights. + +4. Unregister all the previously registered versions of the templates by typing the following command. + + ``` syntax + Unregister-UevTemplate -All + ``` + + This command unregisters all active templates on the computer. + +5. Register the updated templates by typing the following command. + + ``` syntax + Register-UevTemplate \*.xml + ``` + + This command registers all of the settings location templates that are located in the specified template folder. + +### Windows app list + +By listing a Windows app in the Windows app list, you specify whether that app is enabled or disabled for settings synchronization. Apps are identified in the list by their Package Family name and whether settings synchronization should be enabled or disabled for that app. When you use these settings along with the Unlisted Default Sync Behavior setting, you can control whether Windows apps are synchronized. + +To display the Package Family Name of installed Windows apps, at a Windows PowerShell command prompt, enter: + +``` syntax +Get-AppxPackage | Sort-Object PackageFamilyName | Format-Table PackageFamilyName +``` + +To display a list of Windows apps that can synchronize settings on a computer with their package family name, enabled status, and enabled source, at a Windows PowerShell command prompt, enter: `Get-UevAppxPackage` + +**Definitions of Get-UevAppxPackage properties** + +**PackageFamilyName** +The name of the package that is installed for the current user. + +**Enabled** +Defines whether the settings for the app are configured to synchronize. + +**EnabledSource** +The location where the configuration that enables or disables the app is set. Possible values are: *NotSet*, *LocalMachine*, *LocalUser*, *PolicyMachine*, and *PolicyUser*. + +**NotSet** +The policy is not configured to synchronize this app. + +**LocalMachine** +The enabled state is set in the local computer section of the registry. + +**LocalUser** +The enabled state is set in the current user section of the registry. + +**PolicyMachine** +The enabled state is set in the policy section of the local computer section of the registry. + +To get the user-configured list of Windows apps, at the Windows PowerShell command prompt, enter: `Get-UevAppxPackage -CurrentComputerUser` + +To get the computer-configured list of Windows apps, at the Windows PowerShell command prompt, enter: `Get-UevAppxPackage -Computer` + +For either parameter, CurrentComputerUser or Computer, the cmdlet returns a list of the Windows apps that are configured at the user or at the computer level. + +**Definitions of properties** + +**PackageFamilyName** +The name of the package that is installed for the current user. + +**Enabled** +Defines whether the settings for the app are configured to synchronize for the specified switch, that is, **user** or **computer**. + +**Installed** +True if the app, that is, the PackageFamilyName is installed for the current user. + +### Manage UE-V settings location templates by using WMI + +User Experience Virtualization provides the following set of WMI commands. Administrators can use these interfaces to manage settings location templates from Windows PowerShell and automate template administrative tasks. + +**To manage settings location templates by using WMI** + +1. Use an account with administrator rights to open a Windows PowerShell window. + +2. Use the following WMI commands to register and manage the UE-V settings location templates. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows PowerShell commandDescription

    Get-WmiObject -Namespace root\Microsoft\UEV SettingsLocationTemplate | Select-Object TemplateId,TemplateName, TemplateVersion,Enabled | Format-Table -Autosize

    Lists all the settings location templates that are registered for the computer.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name GetProcessInfoByTemplateId <template Id>

    Gets the name of the program and version information, which depends on the template name.

    Get-WmiObject -Namespace root\Microsoft\UEV EffectiveWindows8App

    Gets the effective list of Windows apps.

    Get-WmiObject -Namespace root\Microsoft\UEV MachineConfiguredWindows8App

    Gets the list of Windows apps that are configured for the computer.

    Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguredWindows8App

    Gets the list of Windows apps that are configured for the current user.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Register -ArgumentList <template path >

    Registers a settings location template with UE-V.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name UnregisterByTemplateId -ArgumentList <template ID>

    Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Update -ArgumentList <template path>

    Updates a settings location template with UE-V. The new template should be a newer version than the existing one.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name RemoveApp -ArgumentList <package family name | package family name>

    Removes one or more Windows apps from the computer Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name RemoveApp -ArgumentList <package family name | package family name>

    Removes one or more Windows apps from the current user Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name DisableByTemplateId -ArgumentList <template ID>

    Disables one or more settings location templates with UE-V.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name DisableApp -ArgumentList <package family name | package family name>

    Disables one or more Windows apps in the computer Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name DisableApp -ArgumentList <package family name | package family name>

    Disables one or more Windows apps in the current user Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name EnableByTemplateId -ArgumentList <template ID>

    Enables a settings location template with UE-V.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name EnableApp -ArgumentList <package family name | package family name>

    Enables Windows apps in the computer Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name EnableApp -ArgumentList <package family name | package family name>

    Enables Windows apps in the current user Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Validate -ArgumentList <template path>

    Determines whether a given settings location template complies with its XML schema.

    + +**Note**   +Where a list of Package Family Names is called by the WMI command, the list must be in quotes and separated by a pipe symbol, for example, `""`. + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +[Administering UE-V with Windows PowerShell and WMI](uev-administering-uev-with-windows-powershell-and-wmi.md) + +[Administering UE-V](uev-administering-uev.md) + +[User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx) diff --git a/windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md b/windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md new file mode 100644 index 0000000000..eeb54e2454 --- /dev/null +++ b/windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md @@ -0,0 +1,355 @@ +--- +title: Managing the UE-V Service and Packages with Windows PowerShell and WMI +description: Managing the UE-V service and packages with Windows PowerShell and WMI +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Managing the UE-V service and packages with Windows PowerShell and WMI + +**Applies to** +- Windows 10, version 1607 + +You can use Windows Management Instrumentation (WMI) and Windows PowerShell to manage User Experience Virtualization (UE-V) service configuration and synchronization behavior. + +>**Note**  For a complete list of UE-V cmdlets, see [User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx). + + +## To configure the UE-V service with Windows PowerShell + +1. Open a Windows PowerShell window. To manage computer settings that affect all users of the computer by using the *Computer* parameter, open the window with an account that has administrator rights. + +2. Use the following Windows PowerShell commands to configure the service. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows PowerShell commandDescription

    Enable-UEV

    +

    Turns on the UE-V service. Requires reboot.

    Disable-UEV

    Turns off the UE-V service. Requires reboot.

    Get-UevStatus

    Displays whether UE-V service is enabled or disabled, using a Boolean value.

    Get-UevConfiguration

    +

    Gets the effective UE-V service settings. User-specific settings have precedence over the computer settings.

    Get-UevConfiguration -CurrentComputerUser

    +

    Gets the UE-V service settings values for the current user only.

    Get-UevConfiguration -Computer

    Gets the UE-V service configuration settings values for all users on the computer.

    Get-UevConfiguration -Details

    Gets the details for each configuration setting. Displays where the setting is configured or if it uses the default value. Is displayed if the current setting is valid.

    Set-UevConfiguration -Computer -EnableDontSyncWindows8AppSettings

    Configures the UE-V service to not synchronize any Windows apps for all users on the computer.

    Set-UevConfiguration -CurrentComputerUser -EnableDontSyncWindows8AppSettings

    Configures the UE-V service to not synchronize any Windows apps for the current computer user.

    Set-UevConfiguration -Computer -EnableFirstUseNotification

    Configures the UE-V service to display notification the first time the service runs for all users on the computer.

    Set-UevConfiguration -Computer -DisableFirstUseNotification

    Configures the UE-V service to not display notification the first time that the service runs for all users on the computer.

    Set-UevConfiguration -Computer -EnableSettingsImportNotify

    Configures the UE-V service to notify all users on the computer when settings synchronization is delayed.

    +

    Use the DisableSettingsImportNotify parameter to disable notification.

    Set-UevConfiguration -CurrentComputerUser -EnableSettingsImportNotify

    Configures the UE-V service to notify the current user when settings synchronization is delayed.

    +

    Use the DisableSettingsImportNotify parameter to disable notification.

    Set-UevConfiguration -Computer -EnableSyncUnlistedWindows8Apps

    Configures the UE-V service to synchronize all Windows apps that are not explicitly disabled by the Windows app list for all users of the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md).

    +

    Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V service to synchronize only Windows apps that are explicitly enabled by the Windows App List.

    Set-UevConfiguration -CurrentComputerUser - EnableSyncUnlistedWindows8Apps

    Configures the UE-V service to synchronize all Windows apps that are not explicitly disabled by the Windows app list for the current user on the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md).

    +

    Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V service to synchronize only Windows apps that are explicitly enabled by the Windows App List.

    Set-UevConfiguration -Computer -DisableSync

    Disables UE-V for all the users on the computer.

    +

    Use the EnableSync parameter to enable or re-enable.

    Set-UevConfiguration -CurrentComputerUser -DisableSync

    Disables UE-V for the current user on the computer.

    +

    Use the EnableSync parameter to enable or re-enable.

    Set-UevConfiguration -Computer -EnableTrayIcon

    Enables the UE-V icon in the notification area for all users of the computer.

    +

    Use the DisableTrayIcon parameter to disable the icon.

    Set-UevConfiguration -Computer -MaxPackageSizeInBytes <size in bytes>

    Configures the UE-V service to report when a settings package file size reaches the defined threshold for all users on the computer. Sets the threshold package size in bytes.

    Set-UevConfiguration -CurrentComputerUser -MaxPackageSizeInBytes <size in bytes>

    Configures the UE-V service to report when a settings package file size reaches the defined threshold. Sets the package size warning threshold for the current user.

    Set-UevConfiguration -Computer -SettingsImportNotifyDelayInSeconds

    Specifies the time in seconds before the user is notified for all users of the computer

    Set-UevConfiguration -CurrentComputerUser -SettingsImportNotifyDelayInSeconds

    Specifies the time in seconds before notification for the current user is sent.

    Set-UevConfiguration -Computer -SettingsStoragePath <path to _settings_storage_location>

    Defines a per-computer settings storage location for all users of the computer.

    Set-UevConfiguration -CurrentComputerUser -SettingsStoragePath <path to _settings_storage_location>

    Defines a per-user settings storage location.

    Set-UevConfiguration -Computer -SettingsTemplateCatalogPath <path to catalog>

    Sets the settings template catalog path for all users of the computer.

    Set-UevConfiguration -Computer -SyncMethod <sync method>

    Sets the synchronization method for all users of the computer: SyncProvider or None.

    Set-UevConfiguration -CurrentComputerUser -SyncMethod <sync method>

    Sets the synchronization method for the current user: SyncProvider or None.

    Set-UevConfiguration -Computer -SyncTimeoutInMilliseconds <timeout in milliseconds>

    Sets the synchronization time-out in milliseconds for all users of the computer

    Set-UevConfiguration -CurrentComputerUser -SyncTimeoutInMilliseconds <timeout in milliseconds>

    Set the synchronization time-out for the current user.

    Clear-UevConfiguration -Computer -<setting name>

    Clears the specified setting for all users on the computer.

    Clear-UevConfiguration -CurrentComputerUser -<setting name>

    Clears the specified setting for the current user only.

    Export-UevConfiguration <settings migration file>

    Exports the UE-V computer configuration to a settings migration file. The file name extension must be .uev.

    +

    The Export cmdlet exports all UE-V service settings that are configurable with the Computer parameter.

    Import-UevConfiguration <settings migration file>

    Imports the UE-V computer configuration from a settings migration file. The file name extension must be .uev.

    + +   + +## To export UE-V package settings and repair UE-V templates with Windows PowerShell + +1. Open a Windows PowerShell window as an administrator. + +2. Use the following Windows PowerShell commands to configure the service. + + + + + + + + + + + + + + + + + + + + +

    Windows PowerShell command

    Description

    Export-UevPackage MicrosoftNotepad.pkgx

    Extracts the settings from a Microsoft Notepad package file and converts them into a human-readable format in XML.

    Repair-UevTemplateIndex

    Repairs the index of the UE-V settings location templates.

    + +## To configure the UE-V service with WMI + +1. User Experience Virtualization provides the following set of WMI commands. Administrators can use this interface to configure the UE-V service at the command line and automate typical configuration tasks. + + Use an account with administrator rights to open a Windows PowerShell window. + +2. Use the following WMI commands to configure the service. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows PowerShell commandDescription

    Get-WmiObject -Namespace root\Microsoft\UEV Configuration

    +

    Displays the active UE-V service settings. User-specific settings have precedence over the computer settings.

    Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration

    Displays the UE-V service configuration that is defined for a user.

    Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    Displays the UE-V service configuration that is defined for a computer.

    Get-WmiObject -Namespace root\Microsoft\Uev ConfigurationItem

    Displays the details for each configuration item.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    +

    $config.SettingsStoragePath = <path_to_settings_storage_location>

    +

    $config.Put()

    Defines a per-computer settings storage location.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration

    +

    $config.SettingsStoragePath = <path_to_settings_storage_location>

    +

    $config.Put()

    Defines a per-user settings storage location.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    +

    $config.SyncTimeoutInMilliseconds = <timeout_in_milliseconds>

    +

    $config.Put()

    Sets the synchronization time-out in milliseconds for all users of the computer.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    +

    $config.MaxPackageSizeInBytes = <size_in_bytes>

    +

    $config.Put()

    Configures the UE-V service to report when a settings package file size reaches a defined threshold. Set the threshold package file size in bytes for all users of the computer.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    +

    $config.SyncMethod = <sync_method>

    +

    $config.Put()

    Sets the synchronization method for all users of the computer: SyncProvider or None.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    +

    $config.<setting name> = $true

    +

    $config.Put()

    To enable a specific per-computer setting, clear the setting, and use $null as the setting value. Use UserConfiguration for per-user settings.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    +

    $config.<setting name> = $false

    +

    $config.Put()

    To disable a specific per-computer setting, clear the setting, and use $null as the setting value. Use User Configuration for per-user settings.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    +

    $config.<setting name> = <setting value>

    +

    $config.Put()

    Updates a specific per-computer setting. To clear the setting, use $null as the setting value.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    +

    $config.<setting name> = <setting value>

    +

    $config.Put()

    Updates a specific per-user setting for all users of the computer. To clear the setting, use $null as the setting value.

    + +When you are finished configuring the UE-V service with WMI and Windows PowerShell, the defined configuration is stored in the registry in the following locations. + +`\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UEV\Agent\Configuration` + +`\HKEY_CURRENT_USER\SOFTWARE\Microsoft\UEV\Agent\Configuration` + +## To export UE-V package settings and repair UE-V templates by using WMI + +1. UE-V provides the following set of WMI commands. Administrators can use this interface to export a package or repair UE-V templates. + +2. Use the following WMI commands. + + + + + + + + + + + + + + + + + + + + + + +
    WMI commandDescription

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name ExportPackage -ArgumentList <package name>

    Extracts the settings from a package file and converts them into a human-readable format in XML.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name RebuildIndex

    Repairs the index of the UE-V settings location templates. Must be run as administrator.

    + +   +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +[Administering UE-V with Windows PowerShell and WMI](uev-administering-uev-with-windows-powershell-and-wmi.md) + +[Administering UE-V](uev-administering-uev.md) + +[User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx) diff --git a/windows/manage/uev-migrating-settings-packages.md b/windows/manage/uev-migrating-settings-packages.md new file mode 100644 index 0000000000..85bb7a71b0 --- /dev/null +++ b/windows/manage/uev-migrating-settings-packages.md @@ -0,0 +1,53 @@ +--- +title: Migrating UE-V settings packages +description: Migrating UE-V settings packages +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Migrating UE-V settings packages + +**Applies to** +- Windows 10, version 1607 + +In the lifecycle of a User Experience Virtualization (UE-V) deployment, you might have to relocate the user settings packages either when you migrate to a new server or when you perform backups. Settings packages might have to be migrated in the following scenarios: + +- Upgrade of existing server hardware to a more modern server + +- Migration of a settings storage location share from a test server to a production server + +Simply copying the files and folders does not preserve the security settings and permissions. The following steps describe how to correctly copy the settings package along with their NTFS file system permissions to a new share. + +**To preserve UE-V settings packages when you migrate to a new server** + +1. In a new location on a different server, create a new folder, for example, MySettings. + +2. Disable sharing for the old folder share on the old server. + +3. To copy the existing settings packages to the new server with Robocopy + + ``` syntax + C:\start robocopy "\\servername\E$\MySettings" "\\servername\E$\MySettings" /b /sec /secfix /e /LOG:D:\Robocopylogs\MySettings.txt + ``` + + **Note**   + To monitor the copy progress, open MySettings.txt with a log viewer such as Trace32. + +   + +4. Grant share-level permissions to the new share. Leave the NTFS file system permissions as they were set by Robocopy. + + On computers on which the UE-V service is enabled, update the **SettingsStoragePath** configuration setting to the Universal Naming Convention (UNC) path of the new share. + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +[Administering UE-V](uev-administering-uev.md) + diff --git a/windows/manage/uev-prepare-for-deployment.md b/windows/manage/uev-prepare-for-deployment.md new file mode 100644 index 0000000000..0fa6f10ff2 --- /dev/null +++ b/windows/manage/uev-prepare-for-deployment.md @@ -0,0 +1,406 @@ +--- +title: Prepare a UE-V Deployment +description: Prepare a UE-V Deployment +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# Prepare a UE-V Deployment + +**Applies to** +- Windows 10, version 1607 + +Before you deploy User Experience Virtualization (UE-V), review this topic for important information about the type of deployment you’re planning and for preparations you can make beforehand so that your deployment is successful. If you leave this page, be sure to come back and read through the planning information in this topic. + +## Plan your UE-V deployment + +With UE-V, you can synchronize user-defined application and operating system settings across all the devices that a user works from. Use UE-V to synchronize settings for Windows applications and custom applications, such as third-party and line of business applications. + +Whether you want to synchronize settings for only default Windows applications or for both Windows and custom applications, you’ll need to first deploy the features required to use UE-V. + +[Deploy required UE-V features](uev-deploy-required-features.md) + +- [Define a settings storage location](uev-deploy-required-features.md#ssl) + +- [Decide how to manage UE-V configurations](#config) + +- [Enable the UE-V service](uev-deploy-required-features.md#enable-the-ue-v-service) on user computers + +If you want to use UE-V to synchronize user-defined settings for custom applications (third-party or line-of-business), you’ll need to install and configure these optional additional UE-V features: + +[Deploy UE-V for custom applications](uev-deploy-uev-for-custom-applications.md) + +- [Install the UE-V template generator](uev-deploy-uev-for-custom-applications.md#install-the-uev-template-generator) so you can create, edit, and validate the custom settings location templates required to synchronize custom application settings + +- [Create custom settings location templates](uev-deploy-uev-for-custom-applications.md#createcustomtemplates) with the UE-V template generator + +- [Deploy a UE-V settings template catalog](uev-deploy-uev-for-custom-applications.md#deploycatalogue) to store your custom settings location templates + +The workflow diagram below illustrates a typical UE-V deployment and the decisions you need to be prepared to make. + +![UE-V deployment preparation](images/uev-deployment-preparation.png) + + + +### Planning a UE-V deployment + +Review the following topics to determine which UE-V components you’ll be deploying. + +- [Decide whether to synchronize settings for custom applications](#decide-whether-to-synchronize-settings-for-custom-applications) + + If you want to synchronize settings for custom applications, you’ll need to install the UE-V template generator. Use the generator to create custom settings location templates, which involves the following tasks: + + - Review the [settings that are synchronized automatically in a UE-V deployment](#settings-automatically-synchronized-in-a-ue-v-deployment). + + - [Determine whether you need settings synchronized for other applications](#determine-whether-you-need-settings-synchronized-for-other-applications). + +- Review [other considerations for deploying UE-V](#other-considerations-when-preparing-a-ue-v-deployment), including high availability and capacity planning. + +- [Confirm prerequisites and supported configurations for UE-V](#confirm-prerequisites-and-supported-configurations-for-ue-v) + +## Decide whether to synchronize settings for custom applications + +In a UE-V deployment, many settings are automatically synchronized. You can also customize UE-V to synchronize settings for other applications, such as line-of-business and third-party apps. + +Deciding if you want UE-V to synchronize settings for custom applications is an essential part of planning your UE-V deployment. The topics in this section will help you make that decision. + +### Settings automatically synchronized in a UE-V deployment + +This section explains which settings are synchronized by default in UE-V, including: + +- Desktop applications that are synchronized by default + +- Windows desktop settings that are synchronized by default + +- A statement of support for Windows applications setting synchronization + +For downloadable UE-V templates, see: + +- [Microsoft Authored Office 2016 UE-V Templates](https://gallery.technet.microsoft.com/Authored-Office-2016-32-0dc05cd8) + +- [User Experience Virtualization (UE-V) settings templates for Microsoft Office](https://www.microsoft.com/download/details.aspx?id=46367) (for Office 2013 and Office 2010) + +### Desktop applications synchronized by default in UE-V + +When you enable the UE-V service on user devices, it registers a default group of settings location templates that capture settings values for these common Microsoft applications. + +| **Application category** | **Description** | +|-----------------------------|-------------------| +| Microsoft Office 2016 applications
    [Download a list of all settings synced](https://gallery.technet.microsoft.com/Authored-Office-2016-32-0dc05cd8) | Microsoft Access 2016
    Microsoft Lync 2016
    Microsoft Excel 2016
    Microsoft OneNote 2016
    Microsoft Outlook 2016
    Microsoft PowerPoint 2016
    Microsoft Project 2016
    Microsoft Publisher 2016
    Microsoft SharePoint Designer 2013 (not updated for 2016)
    Microsoft Visio 2016
    Microsoft Word 2016
    Microsoft Office Upload Manager
    Microsoft Infopath has been removed (deprecated) from the Office 2016 suite | +| Microsoft Office 2013 applications
    [Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367) | Microsoft Word 2013
    Microsoft Excel 2013
    Microsoft Outlook 2013
    Microsoft Access 2013
    Microsoft Project 2013
    Microsoft PowerPoint 2013
    Microsoft Publisher 2013
    Microsoft Visio 2013
    Microsoft InfoPath 2013
    Microsoft Lync 2013
    Microsoft OneNote 2013
    Microsoft SharePoint Designer 2013
    Microsoft Office 2013 Upload Center
    Microsoft OneDrive for Business 2013 +| Microsoft Office 2010 applications
    [Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367) | Microsoft Word 2010
    Microsoft Excel 2010
    Microsoft Outlook 2010
    Microsoft Access 2010
    Microsoft Project 2010
    Microsoft PowerPoint 2010
    Microsoft Publisher 2010
    Microsoft Visio 2010
    Microsoft SharePoint Workspace 2010
    Microsoft InfoPath 2010
    Microsoft Lync 2010
    Microsoft OneNote 2010
    Microsoft SharePoint Designer 2010 | +| Browser options: Internet Explorer 11 and 10 | Synchronize favorites, home page, tabs, and toolbars.
    **Note**
    UE-V does not roam settings for Internet Explorer cookies. | +| Windows accessories | Microsoft NotePad, WordPad | + +**Notes** +An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization. + +UE-V does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous operating systems. + +### Windows settings synchronized by default + +UE-V includes settings location templates that capture settings values for these Windows settings. + +| **Windows settings** | **Description** | **Apply on** | **Export on** | **Default state** | +|----------------------|-----------------|--------------|---------------|-------------------| +| Desktop background | Currently active desktop background or wallpaper | Log on, unlock, remote connect, Scheduled Task events | Log off, lock, remote disconnect, or scheduled task interval | Enabled | +| Ease of Access | Accessibility and input settings, Microsoft Magnifier, Narrator, and on-Screen Keyboard | Log on only | Log off or scheduled task interval | Enabled | +| Desktop settings | Start menu and Taskbar settings, folder options, default desktop icons, additional clocks, and region and language settings | Log on only | Log off or scheduled task | Enabled | + +>**Important** +UE-V roams taskbar settings between Windows 10 devices. However, UE-V does not synchronize taskbar settings between Windows 10 devices and devices running previous operating systems versions. + +| **Settings group** | **Category** | **Capture** | **Apply** | +|--------------------------|----------------|----------------|--------------| +| **Application Settings** | Windows applications | Close appllication
    Windows application settings change event | Start the UE-V App Monitor at startup
    Open app
    Windows application settings change event
    Arrival of a settings package | +| | Desktop applications | Application closes | Application opens and closes | +| **Desktop settings** | Desktop background | Lock or log off | Log on, unlock, remote connect, notification of new package arrival, or scheduled task runs | +| | Ease of Access (Common – Accessibility, Narrator, Magnifier, On-Screen-Keyboard) | Lock or Log off | Log on | +| | Ease of Access (Shell - Audio, Accessibility, Keyboard, Mouse) | Lock or log off | Log on, unlock, remote connect, notification of new package arrival, or scheduled task runs | +| | Desktop settings | Lock or log off | Log on | + +### UE-V-support for Windows applications + +For Windows applications, the application developer specifies which user settings are synchronized. You can specify which Windows apps are enabled for settings synchronization. + +To display a list of Windows applications that can synchronize settings with their package family name, enabled status, and enabled source, open a Windows PowerShell window, type Get-UevAppxPackage, and press ENTER. + +>**Note** +Starting in Windows 10, version 1607, you can configure UE-V to not synchronize Windows applications settings if the device is configured to use Enterprise State Roaming. + +### UE-V-support for roaming printers + +Users can print to their saved network printers, including their default network printer, from any network device. + +Printer roaming in UE-V requires one of these scenarios: + +- The print server can download the required driver when it roams to a new device. + +- The driver for the roaming network printer is pre-installed on any device that needs to access that network printer. + +- The printer driver can be imported from Windows Update. + +>**Note** +The UE-V printer roaming feature does not roam printer settings or preferences, such as printing double-sided. + +### Determine whether you need settings synchronized for other applications + +After you have reviewed the settings that are synchronized automatically in a UE-V deployment, you’ll need to decide whether to synchronize settings for other applications as your decision will determine how you deploy UE-V throughout your enterprise. + +As an administrator, when you consider which desktop applications to include in your UE-V solution, consider which settings can be customized by users, and how and where the application stores its settings. Not all desktop applications have settings that can be customized or that are routinely customized by users. In addition, not all desktop applications settings can be synchronized safely across multiple devices or environments. + +In general, you can synchronize settings that meet the following criteria: + +- Settings that are stored in user-accessible locations. For example, do not synchronize settings that are stored in System32 or outside the HKEY\_CURRENT\_USER (HKCU) section of the registry. + +- Settings that are not specific to the particular device. For example, exclude network shortcuts or hardware configurations. + +- Settings that can be synchronized between computers without risk of corrupted data. For example, do not use settings that are stored in a database file. + +### Checklist for evaluating custom applications + +If you’ve decided that you need to synchronize settings for custom applications, use this checklist to determine which applications you’ll include. + +| | **Description** | +|-------|--------------------------| +| ![Checklist box](images/uev-checklist-box.gif) | Does this application contain settings that the user can customize? | +| ![Checklist box](images/uev-checklist-box.gif) | Is it important for the user that these settings are synchronized? | +| ![Checklist box](images/uev-checklist-box.gif) | Are these user settings already managed by an application management or settings policy solution? UE-V applies application settings at application startup and Windows settings at logon, unlock, or remote connect events. If you use UE-V with other settings sharing solutions, users might experience inconsistency across synchronized settings. | +| ![Checklist box](images/uev-checklist-box.gif) | Are the application settings specific to the computer? Application preferences and customizations that are associated with hardware or specific computer configurations do not consistently synchronize across sessions and can cause a poor application experience. | +| ![Checklist box](images/uev-checklist-box.gif) | Does the application store settings in the Program Files directory or in the file directory that is located in the **Users**\\ \[User name\] \\**AppData**\\**LocalLow** directory? Application data that is stored in either of these locations usually should not synchronize with the user, because this data is specific to the computer or because the data is too large to synchronize. | +| ![Checklist box](images/uev-checklist-box.gif) | Does the application store any settings in a file that contains other application data that should not synchronize? UE-V synchronizes files as a single unit. If settings are stored in files that include application data other than settings, then synchronizing this additional data can cause a poor application experience. | +| ![Checklist box](images/uev-checklist-box.gif) | How large are the files that contain the settings? The performance of the settings synchronization can be affected by large files. Including large files can affect the performance of settings synchronization. | + +## Other considerations when preparing a UE-V deployment + +You should also consider these things when you are preparing to deploy UE-V: + +- [Managing credentials synchronization](#managing-credentials-synchronization-in-ue-v) + +- [Windows applications settings synchronization](#windows-applications-settings-synchronization) + +- [Custom UE-V settings location templates](#custom-ue-v-settings-location-templates) + +- [Unintentional user settings configurations](#prevent-unintentional-user-settings-configuration) + +- [Performance and capacity](#performance-and-capacity-planning) + +- [High availability](#high-availability-for-ue-v) + +- [Computer clock synchronization](#synchronize-computer-clocks-for-ue-v-settings-synchronization) + +### Managing credentials synchronization in UE-V + +Many enterprise applications, including Microsoft Outlook, Lync, and Skype for Business prompt users for their domain credentials when they log in. Users have the option of saving their credentials to disk to prevent having to enter them every time they open these applications. Enabling roaming credentials synchronization lets users save their credentials on one computer and avoid re-entering them on every computer they use in their environment. Users can synchronize some domain credentials with UE-V. + +**Important** +Credentials synchronization is disabled by default. You must explicitly enable credentials synchronization after you enable the UE-V service to implement this feature. + +UE-V can synchronize enterprise credentials, but does not roam credentials intended only for use on the local device. + +Credentials are synchronous settings, meaning that they are applied to users' profiles the first time they log on to their devices after UE-V synchronizes. + +Credentials synchronization is managed by its own settings location template, which is disabled by default. You can enable or disable this template through the same methods used for other templates. The template identifier for this feature is RoamingCredentialSettings. + +>**Important** +If you are using Active Directory Credential Roaming in your environment, we recommend that you do not enable the UE-V credential roaming template. Instead, use PowerShell or Group Policy to enable credentials synchronization. Note that credentials are encrypted during synchronization. + +[PowerShell](uev-administering-uev-with-windows-powershell-and-wmi.md)**:** Enter this PowerShell cmdlet to enable credential synchronization: + +`Enable-UevTemplate RoamingCredentialSettings` + +`Copy` + +Use this PowerShell cmdlet to disable credential synchronization: + +`Disable-UevTemplate RoamingCredentialSettings` + +`Copy` + + + +[Group Policy](uev-configuring-uev-with-group-policy-objects.md)**:** You must edit the Group Policy administrative template for UE-V, which is included in Windows 10, version 1607, to enable credential synchronization through group policy. Credentials synchronization is managed in Windows settings. To manage this feature with Group Policy, enable the **Synchronize Windows** settings policy. + +1. Open Group Policy Editor and navigate to **User Configuration > Administrative Templates > Windows Components > Microsoft User Experience Virtualization**. + +2. Double-click **Synchronize Windows settings**. + +3. If this policy is enabled, you can enable credentials synchronization by checking the **Roaming Credentials** check box, or disable credentials synchronization by unchecking it. + +4. Click **OK**. + +### Credential locations synchronized by UE-V + +Credential files saved by applications into the following locations are synchronized: + +- %UserProfile%\\AppData\\Roaming\\Microsoft\\Credentials\\ + +- %UserProfile%\\AppData\\Roaming\\Microsoft\\Crypto\\ + +- %UserProfile%\\AppData\\Roaming\\Microsoft\\Protect\\ + +- %UserProfile%\\AppData\\Roaming\\Microsoft\\SystemCertificates\\ + +Credentials saved to other locations are not synchronized by UE-V. + +### Windows applications settings synchronization + +UE-V manages Windows application settings synchronization in three ways: + +- **Sync Windows applications:** Allow or deny any Windows application synchronization + +- **Windows applications list:** Synchronize a list of Windows applications + +- **Unlisted default sync behavior:** Determine the synchronization behavior of Windows applications that are not in the Windows applications list. + +For more information, see the [Windows Application List](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md#win8applist). + +### Custom UE-V settings location templates + +If you are deploying UE-V to synchronize settings for custom applications, you’ll use the UE-V template generator to create custom settings location templates for those desktop applications. After you create and test a custom settings location template in a test environment, you can deploy the settings location templates to user devices. + +Custom settings location templates must be deployed with an existing deployment infrastructure, such as an enterprise software distribution method, including System Center Configuration Manager, with preferences, or by configuring a UE-V settings template catalog. Templates that are deployed with Configuration Manager or Group Policy must be registered using UE-V WMI or Windows PowerShell. + +For more information about custom settings location templates, see [Deploy UE-V with custom applications](uev-deploy-uev-for-custom-applications.md). For more information about using UE-V with Configuration Manager, see [Configuring UE-V with System Center Configuration Manager](uev-configuring-uev-with-system-center-configuration-manager.md). + +### Prevent unintentional user settings configuration + +UE-V downloads new user settings information from a settings storage location and applies the settings to the local device in these instances: + +- Each time an application is started that has a registered UE-V template + +- When a user logs on to a device + +- When a user unlocks a device + +- When a connection is made to a remote desktop device running UE-V + +- When the Sync Controller Application scheduled task is run + +If UE-V is installed on computer A and computer B, and the settings that you want for the application are on computer A, then computer A should open and close the application first. If the application is opened and closed on computer B first, then the application settings on computer A are configured to the application settings on computer B. Settings are synchronized between computers on per-application basis. Over time, settings become consistent between computers as they are opened and closed with preferred settings. + +This scenario also applies to Windows settings. If the Windows settings on computer B should be the same as the Windows settings on computer A, then the user should log on and log off computer A first. + +If the user settings that the user wants are applied in the wrong order, they can be recovered by performing a restore operation for the specific application or Windows configuration on the computer on which the settings were overwritten. For more information, see [Manage Administrative Backup and Restore in UE-V](uev-manage-administrative-backup-and-restore.md). + +### Performance and capacity planning + +Specify your requirements for UE-V with standard disk capacity and network health monitoring. + +UE-V uses a Server Message Block (SMB) share for the storage of settings packages. The size of settings packages varies depending on the settings information for each application. While most settings packages are small, the synchronization of potentially large files, such as desktop images, can result in poor performance, particularly on slower networks. + +To reduce problems with network latency, create settings storage locations on the same local networks where the users’ computers reside. We recommend 20 MB of disk space per user for the settings storage location. + +By default, UE-V synchronization times out after 2 seconds to prevent excessive lag due to a large settings package. You can configure the SyncMethod=SyncProvider setting by using [Group Policy objects](uev-configuring-uev-with-group-policy-objects.md). + +### High availability for UE-V + +The UE-V settings storage location and settings template catalog support storing user data on any writable share. To ensure high availability, follow these criteria: + +- Format the storage volume with an NTFS file system. + +- The share can use Distributed File System (DFS) replication, but Distributed File System Replication (DFSR) is specifically not supported. Distributed File System Namespaces (DFSN) are supported. For detailed information, see: + + - [Information about roaming profiles from the Directory Services team](https://blogs.technet.microsoft.com/askds/tag/roaming-profiles/) + + - [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](https://support.microsoft.com/kb/2533009) + + In addition, because SYSVOL uses DFSR for replication, SYSVOL cannot be used for UE-V data file replication. + +- Configure the share permissions and NTFS access control lists (ACLs) as specified in [Deploying the settings storage location for UE-V](uev-deploy-required-features.md#ssl). + +- Use file server clustering along with the UE-V service to provide access to copies of user state data in the event of communications failures. + +- You can store the settings storage path data (user data) and settings template catalog templates on clustered shares, on DFSN shares, or on both. + +### Synchronize computer clocks for UE-V settings synchronization + +Computers that run the UE-V service must use a time server to maintain a consistent settings experience. UE-V uses time stamps to determine if settings must be synchronized from the settings storage location. If the computer clock is inaccurate, older settings can overwrite newer settings, or the new settings might not be saved to the settings storage location. + +## Confirm prerequisites and supported configurations for UE-V + +Before you proceed, ensure that your environment meets these requirements for using UE-V. + +| **Operating system** | **Edition** | **Service pack** | **System architecture** | **Windows PowerShell** | **Microsoft .NET Framework** | +|--------------------------|---------------|------------------|-------------------------|--------------------------|--------------------------------| +| Windows 10, version 1607 | Windows 10 for Enterprise | NA | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher | +| Windows 8 and Windows 8.1 | Enterprise or Pro | None | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher | +| Windows Server 2012 and Windows Server 2012 R2 | Standard or Datacenter | None | 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher | + +**Note** +- Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed. + +- The “Delete Roaming Cache” policy for mandatory profiles is not supported with UE-V and should not be used. + +There are no special random access memory (RAM) requirements specific to UE-V. + +### Synchronization of settings through the Sync Provider + +Sync Provider is the default setting for users and synchronizes a local cache with the settings storage location in these instances: + +- Log on/log off + +- Lock/unlock + +- Remote desktop connect/disconnect + +- Application open/close + +A scheduled task manages this synchronization of settings every 30 minutes or through trigger events for certain applications. For more information, see [Changing the frequency of UE-V scheduled tasks](uev-changing-the-frequency-of-scheduled-tasks.md). + +The UE-V service synchronizes user settings for devices that are not always connected to the enterprise network (remote devices and laptops) and devices that are always connected to the network (devices that run Windows Server and host virtual desktop interface (VDI) sessions). + +**Synchronization for computers with always-available connections** When you use UE-V on devices that are always connected to the network, you must configure the UE-V service to synchronize settings by using the *SyncMethod=None* parameter, which treats the settings storage server as a standard network share. In this configuration, the UE-V service can be configured to notify if the import of the application settings is delayed. + +Enable this configuration using one of these methods: + +- After you enable the UE-V service, use the Settings Management feature in System Center Configuration Manager or the UE-V ADMX templates (installed with Windows 10, version 1607) to push the SyncMethod = None configuration. + +- Use Windows PowerShell or Windows Management Instrumentation (WMI) to set the SyncMethod = None configuration. + +Restart the device to allow the settings to synchronize. + +- >**Note** +These methods do not work for pooled virtual desktop infrastructure (VDI) environments. + + +>**Note** +If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on log off, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path. + +**Synchronization for external sync engines** The *SyncMethod=External* parameter specifies that if UE-V settings are written to a local folder on the user device, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different devices that users access. + +**Support for shared VDI sessions** UE-V supports VDI sessions that are shared among end users. You can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions. + +>**Note** +If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](uev-manage-administrative-backup-and-restore.md). + +The VDI template is provided with UE-V and is typically available here after installation: C:\ProgramData\Microsoft\UEV\InboxTemplates + +### Prerequisites for UE-V template generator support + +Install the UE-V template generator on the device that is used to create custom settings location templates. This device should be able to run the applications that you want to synchronize settings for. You must be a member of the Administrators group on the device that runs the UE-V template generator software. + +The UE-V template generator must be installed on a device that uses an NTFS file system. The UE-V template generator software requires .NET Framework 4. For more information, see [Use UE-V with custom applications](uev-deploy-uev-for-custom-applications.md). + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Other resources for this feature + +- [User Experience Virtualization overview](uev-for-windows.md) + +- [Get started with UE-V](uev-getting-started.md) + +- [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) + +- [Administering UE-V ](uev-administering-uev.md) + +- [Troubleshooting UE-V ](uev-troubleshooting.md) + +- [Technical Reference for UE-V](uev-technical-reference.md) diff --git a/windows/manage/uev-privacy-statement.md b/windows/manage/uev-privacy-statement.md new file mode 100644 index 0000000000..eb9e64f8a1 --- /dev/null +++ b/windows/manage/uev-privacy-statement.md @@ -0,0 +1,4 @@ +--- +title: User Experience Virtualization Privacy Statement +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/uev-security-considerations +--- \ No newline at end of file diff --git a/windows/manage/uev-release-notes-1607.md b/windows/manage/uev-release-notes-1607.md new file mode 100644 index 0000000000..416b8f4508 --- /dev/null +++ b/windows/manage/uev-release-notes-1607.md @@ -0,0 +1,133 @@ +--- +title: User Experience Virtualization (UE-V) Release Notes +description: User Experience Virtualization (UE-V) Release Notes +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# User Experience Virtualization (UE-V) Release Notes + +**Applies to** +- Windows 10, version 1607 + +This topic includes information required to successfully install and use UE-V that is not included in the User Experience Virtualization (UE-V) documentation. If there are differences between the information in this topic and other UE-V topics, the latest change should be considered authoritative. + +### Company Settings Center removed in UE-V for Windows 10, version 1607 + +In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues. + +With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings. + +Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell. + +**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable: + +- Contact IT Link Text +- Contact IT URL +- Tray Icon + + +### Upgrading from UE-V 1.0 to the in-box version of UE-V is blocked + +Version 1.0 of UE-V used Offline Files (Client Side Caching) for settings synchronization and pinned the UE-V sync folder to be available when the network was offline, however, this technology was removed in UE-V 2.x. As a result, UE-V 1.0 users are blocked from upgrading to UE-V for Windows 10, version 1607. + +WORKAROUND: Remove the UE-V 1.0 sync folder from the Offline Files configuration and then upgrade to the in-box version of UE-V for Windows, version 1607 release. + +### UE-V settings location templates for Skype cause Skype to crash + +When a user generates a valid settings location template for the Skype desktop application, registers it, and then launches the Skype desktop application, Skype crashes. An ACCESS\_VIOLATION is recorded in the Application Event Log. + +WORKAROUND: Remove or unregister the Skype template to allow Skype to work again. + +### Registry settings do not synchronize between App-V and native applications on the same device + +When a device has an application that is installed through both Application Virtualization (App-V) and locally with a Windows Installer (.msi) file, the registry-based settings do not synchronize between the technologies. + +WORKAROUND: To resolve this problem, run the application by selecting one of the two technologies, but not both. + +### Unpredictable results when both Office 2010 and Office 2013 are installed on the same device + +When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be quite large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. + +WORKAROUND: Install only one version of Office or limit which settings are synchronized by UE-V. + +### Uninstall and re-install of Windows 8 applications reverts settings to initial state + +While using UE-V settings synchronization for a Windows 8 application, if the user uninstalls the application and then reinstalls the application, the application’s settings revert to their default values. This happens because the uninstall removes the local (cached) copy of the application’s settings but does not remove the local UE-V settings package. When the application is reinstalled and launched, UE-V gather the application settings that were reset to the application defaults and then uploads the default settings to the central storage location. Other computers running the application then download the default settings. This behavior is identical to the behavior of desktop applications. + +WORKAROUND: None. + +### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office + +We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click [here](). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. + +WORKAROUND: None + +### Favicons that are associated with Internet Explorer 9 favorites do not roam + +The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. + +WORKAROUND: Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. + +### File settings paths are stored in registry + +Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. + +WORKAROUND: Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. + +### Long Settings Storage Paths could cause an error + +Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: + +\[boost::filesystem::copy\_file: The system cannot find the path specified\] + +To check the operational log events, open the Event Viewer and navigate to Applications and Services Logs / Microsoft / User Experience Virtualization / Logging / Operational. + +WORKAROUND: None. + +### Some operating system settings only roam between like operating system versions + +Operating system settings for Narrator and currency characters specific to the locale (i.e. language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. + +WORKAROUND: None + +## Hotfixes and Knowledge Base articles for UE-V + +This section contains hotfixes and KB articles for UE-V. + +| KB Article | Title | Link | +|------------|---------|--------| +| 3018608 | UE-V - TemplateConsole.exe crashes when UE-V WMI classes are missing | [support.microsoft.com/kb/3018608](http://support.microsoft.com/kb/3018608) | +| 2903501 | UE-V: User Experience Virtualization (UE-V) compatibility with user profiles | [support.microsoft.com/kb/2903501](http://support.microsoft.com/kb/2903501) | +| 2770042 | UE-V Registry Settings | [support.microsoft.com/kb/2770042](http://support.microsoft.com/kb/2770042) | +| 2847017 | Internet Explorer settings replicated by UE-V | [support.microsoft.com/kb/2847017](http://support.microsoft.com/kb/2847017) | +| 2769631 | How to repair a corrupted UE-V install | [support.microsoft.com/kb/2769631](http://support.microsoft.com/kb/2769631) | +| 2850989 | Migrating MAPI profiles with Microsoft UE-V is not supported | [support.microsoft.com/kb/2850989](http://support.microsoft.com/kb/2850989) | +| 2769586 | UE-V roams empty folders and registry keys | [support.microsoft.com/kb/2769586](http://support.microsoft.com/kb/2769586) | +| 2782997 | How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) | [support.microsoft.com/kb/2782997](http://support.microsoft.com/kb/2782997) | +| 2769570 | UE-V does not update the theme on RDS or VDI sessions | [support.microsoft.com/kb/2769570](http://support.microsoft.com/kb/2769570) | +| 2850582 | How To Use Microsoft User Experience Virtualization With App-V Applications | [support.microsoft.com/kb/2850582](http://support.microsoft.com/kb/2850582) | +| 3041879 | Current file versions for Microsoft User Experience Virtualization | [support.microsoft.com/kb/3041879](http://support.microsoft.com/kb/3041879) | +| 2843592 | Information on User Experience Virtualization and High Availability | [support.microsoft.com/kb/2843592](http://support.microsoft.com/kb/2843592) | + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +**Additional resources for this feature** + + +- [User Experience Virtualization](uev-for-windows.md) + +- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) + +- [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) + +- [Administering UE-V ](uev-administering-uev.md) + +- [Troubleshooting UE-V ](uev-troubleshooting.md) + +- [Technical Reference for UE-V](uev-technical-reference.md) diff --git a/windows/manage/uev-security-considerations.md b/windows/manage/uev-security-considerations.md new file mode 100644 index 0000000000..11f3d82582 --- /dev/null +++ b/windows/manage/uev-security-considerations.md @@ -0,0 +1,239 @@ +--- +title: Security Considerations for UE-V +description: Security Considerations for UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Security Considerations for UE-V + +**Applies to** +- Windows 10, version 1607 + +This topic contains a brief overview of accounts and groups, log files, and other security-related considerations for User Experience Virtualization (UE-V). For more information, follow the links that are provided here. + +## Security considerations for UE-V configuration + + +**Important** +When you create the settings storage share, limit the share access to users who require access. + +Because settings packages might contain personal information, you should take care to protect them as well as possible. In general, do the following: + +- Restrict the share to only those users who require access. Create a security group for users who have redirected folders on a particular share and limit access to only those users. + +- When you create the share, hide the share by putting a $ after the share name. This addition hides the share from casual browsers, and the share is not visible in My Network Places. + +- Only give users the minimum amount of permissions that they must have. The following tables show the required permissions. + +1. Set the following share-level SMB permissions for the setting storage location folder. + + + + + + + + + + + + + + + + + + + + + + +
    User accountRecommended permissions

    Everyone

    No permissions

    Security group of UE-V

    Full control

    + + +2. Set the following NTFS file system permissions for the settings storage location folder. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    User accountRecommended permissionsFolder

    Creator/Owner

    No permissions

    No permissions

    Domain Admins

    Full control

    This folder, subfolders, and files

    Security group of UE-V users

    List folder/read data, create folders/append data

    This folder only

    Everyone

    Remove all permissions

    No permissions

    + +3. Set the following share-level SMB permissions for the settings template catalog folder. + + + + + + + + + + + + + + + + + + + + + + + + + + +
    User accountRecommend permissions

    Everyone

    No permissions

    Domain computers

    Read permission Levels

    Administrators

    Read/write permission levels

    + + +4. Set the following NTFS permissions for the settings template catalog folder. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    User accountRecommended permissionsApply to

    Creator/Owner

    Full control

    This folder, subfolders, and files

    Domain Computers

    List folder contents and Read permissions

    This folder, subfolders, and files

    Everyone

    No permissions

    No permissions

    Administrators

    Full Control

    This folder, subfolders, and files

    + +### Use Windows Server as of Windows Server 2003 to host redirected file shares + +User settings package files contain personal information that is transferred between the client computer and the server that stores the settings packages. Because of this process, you should ensure that the data is protected while it travels over the network. + +User settings data is vulnerable to these potential threats: interception of the data as it passes over the network, tampering with the data as it passes over the network, and spoofing of the server that hosts the data. + +As of Windows Server 2003, several features of the Windows Server operating system can help secure user data: + +- **Kerberos** - Kerberos is standard on all versions of Microsoft Windows 2000 Server and Windows Server beginning with Windows Server 2003. Kerberos ensures the highest level of security to network resources. NTLM authenticates the client only; Kerberos authenticates the server and the client. When NTLM is used, the client does not know whether the server is valid. This difference is particularly important if the client exchanges personal files with the server, as is the case with Roaming User Profiles. Kerberos provides better security than NTLM. Kerberos is not available on the Microsoft Windows NT Server 4.0 or earlier operating systems. + +- **IPsec** - The IP Security Protocol (IPsec) provides network-level authentication, data integrity, and encryption. IPsec ensures the following: + + - Roamed data is safe from data modification while data is en route. + + - Roamed data is safe from interception, viewing, or copying. + + - Roamed data is safe from access by unauthenticated parties. + +- **SMB Signing** - The Server Message Block (SMB) authentication protocol supports message authentication, which prevents active message and "man-in-the-middle" attacks. SMB signing provides this authentication by placing a digital signature into each SMB. The digital signature is then verified by both the client and the server. In order to use SMB signing, you must first either enable it, or you must require it on both the SMB client and the SMB server. Note that the SMB signing imposes a performance penalty. It does not consume any more network bandwidth, but it uses more CPU cycles on the client and server side. + +### Always use the NTFS file system for volumes that hold user data + +For the most secure configuration, configure servers that host the UE-V settings files to use the NTFS file system. Unlike the FAT file system, NTFS supports Discretionary access control lists (DACLs) and system access control lists (SACLs). DACLs and SACLs control who can perform operations on a file and what events trigger the logging of actions that is performed on a file. + +### Do not rely on EFS to encrypt user files when they are transmitted over the network + +When you use the Encrypting File System (EFS) to encrypt files on a remote server, the encrypted data is not encrypted during transit over the network; it only becomes encrypted when it is stored on disk. + +This encryption process does not apply when your system includes Internet Protocol security (IPsec) or Web Distributed Authoring and Versioning (WebDAV). IPsec encrypts data while it is transported over a TCP/IP network. If the file is encrypted before it is copied or moved to a WebDAV folder on a server, it remains encrypted during the transmission and while it is stored on the server. + +### Let the UE-V service create folders for each user + +To ensure that UE-V works optimally, create only the root share on the server, and let the UE-V service create the folders for each user. UE-V creates these user folders with the appropriate security. + +This permission configuration enables users to create folders for settings storage. The UE-V service creates and secures a settings package folder while it runs in the context of the user. Users receive full control to their settings package folder. Other users do not inherit access to this folder. You do not have to create and secure individual user directories. The UE-V service that runs in the context of the user does it automatically. + +> **Note**  Additional security can be configured when a Windows Server is used for the settings storage share. UE-V can be configured to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable additional security, use the following command: + +1. Add the REG\_DWORD registry key RepositoryOwnerCheckEnabled to `HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration`. + +2. Set the registry key value to *1*. + +When this configuration setting is in place, the UE-V service verifies that the local Administrators group or current user is the owner of the settings package folder. If not, then the UE-V service does not grant access to the folder. + + +If you must create folders for the users, ensure that you have the correct permissions set. + +We strongly recommend that you do not pre-create folders. Instead, let the UE-V service create the folder for the user. + +### Ensure correct permissions to store UE-V 2 settings in a home directory or custom directory + +If you redirect UE-V settings to a user’s home directory or a custom Active Directory (AD) directory, ensure that the permissions on the directory are set appropriately for your organization. + +### Review the contents of settings location templates and control access to them as needed + +When creating a settings location template, the UE-V generator uses a Lightweight Directory Access Protocol (LDAP) query to get username and email address of the current logged in user. This information is stored in the template as the template author name and template author email. (None of this information is sent to Microsoft.) + +If you plan to share settings location templates with anyone outside your organization you should review all the settings locations and ensure the settings location templates do not contain any personal or company information. You can view the contents by opening the settings location template files using any XML viewer. The following are ways you can view and remove any personal or company information from the settings location template files before sharing with anyone outside your company: + +- **Template Author Name** – Specify a general, non-identifying name for the template author name or exclude this data from the template. + +- **Template Author Email** – Specify a general, non-identifying template author email or exclude this data from the template. + +To remove the template author name or template author email, you can use the UE-V generator application. From the generator, select **Edit a Settings Location Template**. Select the settings location template to edit from the recently used templates or Browse to the settings template file. Select **Next** to continue. On the Properties page, remove the data from the Template author name or Template author email text fields. Save the settings location template. + +## Have a suggestion for UE-V? + + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +[Technical Reference for UE-V](uev-technical-reference.md) diff --git a/windows/manage/uev-sync-methods.md b/windows/manage/uev-sync-methods.md new file mode 100644 index 0000000000..f6f490523d --- /dev/null +++ b/windows/manage/uev-sync-methods.md @@ -0,0 +1,44 @@ +--- +title: Sync Methods for UE-V +description: Sync Methods for UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# Sync Methods for UE-V + +**Applies to** +- Windows 10, version 1607 + +The User Experience Virtualization (UE-V) service lets you synchronize users’ application and Windows settings with the settings storage location. The *Sync Method* configuration defines how the UE-V service uploads and downloads those settings to the settings storage location. UE-V includes a SyncMethod called the *SyncProvider*. For more information about trigger events that start the synchronization of application and Windows settings, see [Sync Trigger Events for UE-V](uev-sync-trigger-events.md). + +## SyncMethod Configuration + +This table provides a description of each SyncMethod configuration: + +| **SyncMethod Configuration** | **Description** | +|------------------------------|---------------------| +| SyncProvider (Default) | Settings changes for a specific application or for global Windows desktop settings are saved locally to a cache folder. These changes are then synchronized with the settings storage location when a synchronization trigger event takes place. Pushing out changes will save the local changes to the settings storage path.
    This default setting is the gold standard for computers. This option attempts to synchronize the setting and times out after a short delay to ensure that the application or operating system startup isn’t delayed for a long period of time.
    This functionality is also tied to the Scheduled task – Sync Controller Application. The administrator controls the frequency of the Scheduled task. By default, computers synchronize their settings every 30 min after logging on. | +| External | This configuration method specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access. | +| None | This configuration setting is designed for the Virtual Desktop Infrastructure (VDI) and Streamed Application experience primarily. This setting should be used on computers running the Windows Server operating system in a datacenter, where the connection will always be available.
    Any settings changes are saved directly to the server. If the network connection to the settings storage path is not available, then the settings changes are cached on the device and are synchronized the next time that the Sync Provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on logoff, then these settings changes are lost, and the user must reapply the change when the computer can again reach the settings storage path.
    Apps and OS will wait indefinitely for the location to be present. This could cause App load or OS logon time to dramatically increase if the location is not found. | + +You can configure the sync method in these ways: + +- Through [Group Policy](uev-configuring-uev-with-group-policy-objects.md) settings + +- With the [System Center Configuration Pack](uev-configuring-uev-with-system-center-configuration-manager.md) for UE-V + +- With [Windows PowerShell or Windows Management Instrumentation (WMI)](uev-administering-uev-with-windows-powershell-and-wmi.md) + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +[Deploy Required UE-V Features](uev-deploy-required-features.md) + +[Technical Reference for UE-V](uev-technical-reference.md) diff --git a/windows/manage/uev-sync-trigger-events.md b/windows/manage/uev-sync-trigger-events.md new file mode 100644 index 0000000000..46add6efc1 --- /dev/null +++ b/windows/manage/uev-sync-trigger-events.md @@ -0,0 +1,128 @@ +--- +title: Sync Trigger Events for UE-V +description: Sync Trigger Events for UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# Sync Trigger Events for UE-V + +**Applies to** +- Windows 10, version 1607 + +User Experience Virtualization (UE-V) lets you synchronize your application and Windows settings across all your domain-joined devices. *Sync trigger events* define when the UE-V service synchronizes those settings with the settings storage location. For more information about Sync Method configuration, see [Sync Methods for UE-V](uev-sync-methods.md). + +## UE-V Sync Trigger Events + + +The following table explains the trigger events for classic applications and Windows settings. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    UE-V Trigger Event

    SyncMethod=SyncProvider

    SyncMethod=None

    Windows Logon

      +

    • Application and Windows settings are imported to the local cache from the settings storage location.

      • +

    • [Asynchronous Windows settings](uev-prepare-for-deployment.md#windows-settings-synchronized-by-default) are applied.

      • +

    • Synchronous Windows settings will be applied during the next Windows logon.

      • +

    • Application settings will be applied when the application starts.

      • +
      +

    • Application and Windows settings are read directly from the settings storage location.

      • +

    • Asynchronous and synchronous Windows settings are applied.

      • +

    • Application settings will be applied when the application starts.

      • +

    Windows Logoff

    Store changes locally and cache and copy asynchronous and synchronous Windows settings to the settings storage location server, if available

    Store changes to asynchronous and synchronous Windows settings storage location

    Windows Connect (RDP) / Unlock

    Synchronize any asynchronous Windows settings from settings storage location to local cache, if available.

    +

    Apply cached Windows settings

    Download and apply asynchronous windows settings from settings storage location

    Windows Disconnect (RDP) / Lock

    Store asynchronous Windows settings changes to the local cache.

    +

    Synchronize any asynchronous Windows settings from the local cache to settings storage location, if available

    Store asynchronous Windows settings changes to the settings storage location

    Application start

    Apply application settings from local cache as the application starts

    Apply application settings from settings storage location as the application starts

    Application closes

    Store any application settings changes to the local cache and copy settings to settings storage location, if available

    Store any application settings changes to settings storage location

    Sync Controller Scheduled Task

    +

    Application and Windows settings are synchronized between the settings storage location and the local cache.

    +
    +Note   +

    Settings changes are not cached locally until an application closes. This trigger will not export changes made to a currently running application.

    +

    For Windows settings, this means that any changes will not be cached locally and exported until the next Lock (Asynchronous) or Logoff (Asynchronous and Synchronous).

    +
    +
    +  +
    +

    Settings are applied in these cases:

    +
      +

    • Asynchronous Windows settings are applied directly.

      • +

    • Application settings are applied when the application starts.

      • +

    • Both asynchronous and synchronous Windows settings are applied during the next Windows logon.

      • +

    • Windows app (AppX) settings are applied during the next refresh. See [Monitor Application Settings](uev-changing-the-frequency-of-scheduled-tasks.md#monitor-application-settings) for more information.

      • +

    NA

    Asynchronous Settings updated on remote store*

    Load and apply new asynchronous settings from the cache.

    Load and apply settings from central server

    + +  + +## Have a suggestion for UE-V? + + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + + +[Technical Reference for UE-V](uev-technical-reference.md) + +[Changing the Frequency of UE-V Scheduled Tasks](uev-changing-the-frequency-of-scheduled-tasks.md) + +[Choose the Configuration Method for UE-V](uev-deploy-required-features.md) + +  + +  + + + + + diff --git a/windows/manage/uev-synchronizing-microsoft-office-with-uev.md b/windows/manage/uev-synchronizing-microsoft-office-with-uev.md new file mode 100644 index 0000000000..784667ed37 --- /dev/null +++ b/windows/manage/uev-synchronizing-microsoft-office-with-uev.md @@ -0,0 +1,142 @@ +--- +title: Synchronizing Microsoft Office with UE-V +description: Synchronizing Office with UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Synchronizing Office with UE-V + +**Applies to** +- Windows 10, version 1607 + +Microsoft User Experience Virtualization (UE-V) supports the synchronization of Microsoft Office application settings. The combination of UE-V and App-V support for Office enables the same experience on virtualized instances of Office from any UE-V-enabled device or virtualized desktop. + +To synchronize Office applications settings, you can download Office templates from the [User Experience Virtualization (UE-V) Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V&f%5B0%5D.Text=UE-V). This resource provides Microsoft-authored UE-V settings location templates as well as community-developed settings location templates. + + +## Microsoft Office support in UE-V + +UE-V includes settings location templates for Microsoft Office 2016, 2013, and 2010. In previous versions of UE-V, settings location templates for Office 2013 and Office 2010 were distributed and registered when you installed the UE-V agent. Now that UE-V is a feature in Windows 10, version 1607, settings location templates are installed when you install or upgrade to the new operating system. + +These templates help synchronize users’ Office experience between devices. Microsoft Office 2016 settings roamed by Office 365 experience are not included in these settings. For a list of Office 365-specific settings, see [Overview of user and roaming settings for Office](https://technet.microsoft.com/library/jj733593.aspx). + +## Synchronized Office Settings + + +Review the following tables for details about Office support in UE-V: + +### Supported UE-V templates for Microsoft Office + + +++++ + + + + + + + + + + + + + + +
    Office 2016 templates (UE-V for Windows 10 and Windows 10, version 1607, available in UE-V gallery)Office 2013 templates (UE-V for Windows 10 and UE-V 2.x, available on UE-V gallery)Office 2010 templates (UE-V 1.0 and 1.0 SP1)

    MicrosoftOffice2016Win32.xml

    +

    MicrosoftOffice2016Win64.xml

    +

    MicrosoftSkypeForBusiness2016Win32.xml

    +

    MicrosoftSkypeForBusiness2016Win64.xml

    MicrosoftOffice2013Win32.xml

    +

    MicrosoftOffice2013Win64.xml

    +

    MicrosoftLync2013Win32.xml

    +

    MicrosoftLync2013Win64.xml

    MicrosoftOffice2010Win32.xml

    +

    MicrosoftOffice2010Win64.xml

    +

    MicrosoftLync2010.xml

    +

    + +  + +### Microsoft Office Applications supported by the UE-V templates + + +++++ + + + + + + + +

    Microsoft Access 2016

    +

    Microsoft Lync 2016

    +

    Microsoft Excel 2016

    +

    Microsoft OneNote 2016

    +

    Microsoft Outlook 2016

    +

    Microsoft PowerPoint 2016

    +

    Microsoft Project 2016

    +

    Microsoft Publisher 2016

    +

    Microsoft SharePoint Designer 2013 (not udpated for 2016)

    +

    Microsoft Visio 2016

    +

    Microsoft Word 2016

    +

    Microsoft Office Upload Manager

    Microsoft Access 2013

    +

    Microsoft Lync 2013

    +

    Microsoft Excel 2013

    +

    Microsoft InfoPath 2013

    +

    Microsoft OneNote 2013

    +

    Microsoft Outlook 2013

    +

    Microsoft PowerPoint 2013

    +

    Microsoft Project 2013

    +

    Microsoft Publisher 2013

    +

    Microsoft SharePoint Designer 2013

    +

    Microsoft Visio 2013

    +

    Microsoft Word 2013

    +

    Microsoft Office Upload Manager

    Microsoft Access 2010

    +

    Microsoft Lync 2010

    +

    Microsoft Excel 2010

    +

    Microsoft InfoPath 2010

    +

    Microsoft OneNote 2010

    +

    Microsoft Outlook 2010

    +

    Microsoft PowerPoint 2010

    +

    Microsoft Project 2010

    +

    Microsoft Publisher 2010

    +

    Microsoft SharePoint Designer 2010

    +

    Microsoft Visio 2010

    +

    Microsoft Word 2010

    +

    + +  + +## Deploying Office templates + + +You can deploy UE-V settings location template with the following methods: + +- **Registering template with PowerShell**. If you use Windows PowerShell to manage computers, run the following Windows PowerShell command as Administrator to register this settings location template: + + ``` syntax + Register-UevTemplate -Path + ``` + + For more information about using UE-V and Windows PowerShell, see [Managing UE-V settings location templates using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md). + +- **Registering template with Template Catalog Path**. If you use the Settings Template Catalog Path to manage templates on users’ computers, copy the Office template into the folder defined in the UE-V service. The next time the Template Auto Update (ApplySettingsCatalog.exe) scheduled task runs, the settings location template will be registered on the device. For more information, see [Deploy a settings template catalog](uev-deploy-uev-for-custom-applications.md#deployasettingstemplatecatalog). + +- **Registering template with Configuration Manager**. If you use Configuration Manager to manage your UE-V settings storage templates, recreate the Template Baseline CAB, import it into Configuration Manager, and then deploy the baseline to user devices. For more information, see the guidance provided in the documentation for the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2.0](https://www.microsoft.com/en-us/download/details.aspx?id=40913). + +## Have a suggestion for UE-V? + + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). diff --git a/windows/manage/uev-technical-reference.md b/windows/manage/uev-technical-reference.md new file mode 100644 index 0000000000..20adefafdf --- /dev/null +++ b/windows/manage/uev-technical-reference.md @@ -0,0 +1,67 @@ +--- +title: Technical Reference for UE-V +description: Technical Reference for UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Technical Reference for UE-V + +**Applies to** +- Windows 10, version 1607 + +This technical reference section includes additional technical documentation about the various features of User Experience Virtualization (UE-V). This information is provided to help the administrator better understand UE-V. + +## Technical reference topics for UE-V + + +- [Sync Methods for UE-V](uev-sync-methods.md) + + Defines how UE-V synchronizes settings between computers and the settings storage location. Sync Provider is the default sync method for UE-V. This topic includes technical reference information for sync methods, including the Sync Provider. + +- [Sync Trigger Events for UE-V](uev-sync-trigger-events.md) + + Defines when the UE-V service synchronizes those settings with the settings storage location. This topic provides technical reference information about when synchronization takes place based upon the sync method deployed. + +- [Synchronizing Microsoft Office with UE-V](uev-synchronizing-microsoft-office-with-uev.md) + + Provides guidance for downloading and enabling the Microsoft-authored UE-V settings location templates that support Microsoft Office settings synchronization. + +- [Application Template Schema Reference for UE-V](uev-application-template-schema-reference.md) + + Details the XML structure of UE-V settings location templates and provides guidance for editing these files. + +- [Security Considerations for UE-V](uev-security-considerations.md) + + Provides a brief overview of accounts, groups, and other security-related considerations for UE-V. + +## Other resources for this feature + + +- [User Experience Virtualization overview](uev-for-windows.md) + +- [Get Started with UE-V](uev-getting-started.md) + +- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) + +- [Administering UE-V](uev-administering-uev.md) + +- [Troubleshooting UE-V](uev-troubleshooting.md) + +## Have a suggestion for UE-V? + + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +  + +  + + + + + diff --git a/windows/manage/uev-troubleshooting.md b/windows/manage/uev-troubleshooting.md new file mode 100644 index 0000000000..4060f14739 --- /dev/null +++ b/windows/manage/uev-troubleshooting.md @@ -0,0 +1,39 @@ +--- +title: Troubleshooting UE-V +description: Troubleshooting UE-V +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Troubleshooting UE-V + +**Applies to** +- Windows 10, version 1607 + +For information that can help with troubleshooting UE-V for Windows 10, see: + +- [UE-V: List of Microsoft Support Knowledge Base Articles](http://social.technet.microsoft.com/wiki/contents/articles/14271.ue-v-list-of-microsoft-support-knowledge-base-articles.aspx) + +- [User Experience Virtualization Release Notes](uev-release-notes-1607.md) + +- [Technical Reference for UE-V](uev-technical-reference.md) + +- [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc) + +## Other resources + +- [User Experience Virtualization overview](uev-for-windows.md) + +- [Get Started with UE-V](uev-getting-started.md) + +- [Prepare a UE-V deployment](uev-prepare-for-deployment.md) + +- [Administering UE-V](uev-administering-uev.md) + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). diff --git a/windows/manage/uev-upgrade-uev-from-previous-releases.md b/windows/manage/uev-upgrade-uev-from-previous-releases.md new file mode 100644 index 0000000000..aa12c04977 --- /dev/null +++ b/windows/manage/uev-upgrade-uev-from-previous-releases.md @@ -0,0 +1,108 @@ +--- +title: Upgrade to UE-V for Windows 10 +description: Explains how to upgrade to the latest version of UE-V. +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# Upgrade to UE-V for Windows 10 + +**Applies to** +- Windows 10, version 1607 + +If you’re already using UE-V 2.x and you’re planning to upgrade user devices to Windows 10, version 1607 or later releases, you need to make only a few adjustments to your existing environment. These steps are explained in more detail below. + +1. Upgrade user devices to Windows 10, version 1607 or later release. + +2. Verify that UE-V settings were migrated correctly. + +3. Enable the UE-V service on user devices. + +4. Install the UE-V template generator if you want to synchronize application settings for custom applications. + +> **Important**  You can upgrade your existing UE-V installation to Windows 10, version 1607 from UE-V versions 2.1 or 2.0 only. If you are using a previous version of UE-V, you’ll need to upgrade from that version to UE-V 2.x before you upgrade to Windows 10, version 1607.. + +## Upgrade user devices to Windows 10, version 1607 + +Performing an in-place upgrade on user devices automatically installs the UE-V service, updates the settings location path, and migrates users' UE-V settings. See the [Windows 10 documentation for IT Pros](https://technet.microsoft.com/itpro/windows/deploy/index) for information about upgrading user devices to Windows 10. + +## Verify that UE-V settings were migrated correctly + +After upgrading a user device to Windows 10, version 1607, it’s important to verify that UE-V settings and template registrations were migrated correctly during the upgrade. You can verify UE-V settings using Windows Powershell or the device’s registry. + +**To verify UE-V settings using Windows PowerShell** + +1. Run PowerShell as Administrator, type **Get-UEVConfiguration**, and press ENTER to view current configurations. + +2. Check that the settings were successfully updated. + +3. Type **Get-UEVTemplate** and press ENTER to check that your templates are still registered. + + > **Note** You’ll need to register the NotePad template again after you upgrade the device to Windows 10. + +**To verify UE-V settings using the device’s registry** + +1. In a command prompt, run **Regedit** as Administrator. + +2. Navigate to **HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration.** + +3. Verify that the settings storage path and the settings template catalog path are pointing to the same locations as before you upgraded the device to Windows 10. + +## Enable the UE-V service on user devices + +The UE-V service is the client-side component that captures user-personalized application and Windows settings and saves them in settings packages. Settings packages are built, locally stored, and copied to the settings storage location. + +With Windows 10, version 1607 and later, the UE-V service replaces the UE-V Agent and no longer requires a separate download and installation. Enable the service on user devices to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. + +> **Important**  The UE-V Agent used in prior releases of UE-V is replaced with the UE service. The UE-V service included with Windows 10, version 1607 and later releases, does not include the agent user interface and is configurable through cmdlets or registry settings only. + +**To enable the UE-V service with Group Policy** + +1. Open the device’s **Group Policy Editor**. + +2. Navigate to **Computer Configuration > Administrative Templates > Windows Components > Microsoft User Experience Virtualization**. + +3. Run **Enable UEV** + +4. Restart the device. + +**To enable the UE-V service with Windows PowerShell** + +1. Run PowerShell as Administrator, type **Enable-UEV**, and press ENTER. + +2. Restart the device. + +3. Type **Get-UEVStatus** and press ENTER to verify that the service was successfully enabled. + +## Install the UE-V template generator + +The UE-V template generator is included in the Windows Assessment and Deployment Kit (ADK) for Windows 10. + +**To install the UE-V template generator** + +1. Go to [Download the Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) to access the ADK. + +2. Select the **Get Windows ADK for Windows 10** button on this page to start the ADK installer. On the screen pictured below, select **Microsoft User Experience Virtualization (UE-V) Template Generator** and then select **Install**. + + ![Selecting UE-V features in ADK](images/uev-adk-select-uev-feature.png) + +3. To open the generator, open the **Start** menu and navigate to **Windows Kits** > **Microsoft User Experience Virtualization (UE-V) Template Generator**. + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Other resources for this feature + +- [UE-V Release Notes](uev-release-notes-1607.md) + +- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) + +- [Administer UE-V](uev-administering-uev.md) + +- [Migrating settings packages](uev-migrating-settings-packages.md) + +- [Technical Reference for UE-V](uev-technical-reference.md) diff --git a/windows/manage/uev-using-uev-with-application-virtualization-applications.md b/windows/manage/uev-using-uev-with-application-virtualization-applications.md new file mode 100644 index 0000000000..7d75a528a0 --- /dev/null +++ b/windows/manage/uev-using-uev-with-application-virtualization-applications.md @@ -0,0 +1,56 @@ +--- +title: Using UE-V with Application Virtualization applications +description: Using UE-V with Application Virtualization applications +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Using UE-V with Application Virtualization applications + +**Applies to** +- Windows 10, version 1607 + +User Experience Virtualization (UE-V) supports Microsoft Application Virtualization (App-V) applications without any required modifications to either the App-V package or the UE-V template. However, an additional step is required because you cannot run the UE-V template generator directly on a virtualized App-V application. Instead, you must install the application locally, generate the template, and then apply the template to the virtualized application. UE-V supports App-V for Windows 10 packages and App-V 5.0 packages. + +## UE-V settings synchronization for App-V applications + + +UE-V monitors when an application opens by the program name and, optionally, by file version numbers and product version numbers, whether the application is installed locally or virtually by using App-V. When the application starts, UE-V monitors the App-V process, applies any settings that are stored in the user's settings storage path, and then enables the application to start normally. UE-V monitors App-V applications and automatically translates the relevant file and registry paths to the virtualized location as opposed to the physical location outside the App-V computing environment. + + **To implement settings synchronization for a virtualized application** + +1. Run the UE-V template generator to collect the settings of the locally installed application whose settings you want to synchronize between computers. This process creates a settings location template. If you use a built-in template such as a Microsoft Office template, skip this step. For more information about using the UE-V template generator, see [Deploy UE-V for custom applications](uev-deploy-uev-for-custom-applications.md#createcustomtemplates). + +2. Install the App-V application package if you have not already done so. + +3. Publish the template to the location of your settings template catalog or manually install the template by using the `Register-UEVTemplate` Windows PowerShell cmdlet. + + **Note**   + If you publish the newly created template to the settings template catalog, the client does not receive the template until the sync provider updates the settings. To manually start this process, open **Task Scheduler**, expand **Task Scheduler Library**, expand **Microsoft**, and expand **UE-V**. In the results pane, right-click **Template Auto Update**, and then click **Run**. + +   + +4. Start the App-V package. + +## Have a suggestion for UE-V? + + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + + +[Administering UE-V](uev-administering-uev.md) + +  + +  + + + + + diff --git a/windows/manage/uev-whats-new-in-uev-for-windows.md b/windows/manage/uev-whats-new-in-uev-for-windows.md new file mode 100644 index 0000000000..a7759f623e --- /dev/null +++ b/windows/manage/uev-whats-new-in-uev-for-windows.md @@ -0,0 +1,125 @@ +--- +title: What's New in UE-V for Windows 10, version 1607 +description: What's New in UE-V for Windows 10, version 1607 +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + +# What's New in UE-V + +**Applies to** +- Windows 10, version 1607 + +User Experience Virtualization (UE-V) for Windows 10, version 1607, includes these new features and capabilities compared to UE-V 2.1. See [UE-V Release notes](uev-release-notes-1607.md) for more information about the UE-V for Windows 10, version 1607 release. + +## UE-V is now a feature in Windows 10 + +With Windows 10, version 1607 and later releases, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack. + +The changes in UE-V for Windows 10, version 1607 impact already existing implementations of UE-V in the following ways: + +- The UE-V Agent is replaced by the UE-V service. The UE-V service is installed with Windows 10, version 1607 and no longer has to be deployed separately. Performing an in-place upgrade to Windows 10, version 1607, on user devices automatically installs the UE-V service, migrates users’ UE-V configurations, and updates the settings storage path. + +- The UE-V template generator is available from the Windows 10 ADK. In previous releases of UE-V, the template generator was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new template generator to create new settings location templates, existing settings location templates will continue to work. + +- The Company Settings Center was removed and is no longer available on user devices. Users can no longer manage their synchronized settings. + +- The inbox templates such as Office 2016 and IE 10 are included as a part of Windows 10 and need to be manually registered with Powershell or Group policy before use. + +For more information about how to configure an existing UE-V installation after upgrading user devices to Windows 10, see [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md). + +> **Important**  You can upgrade your existing UE-V installation to Windows 10 from UE-V versions 2.1 or 2.0 only. If you are using a previous version of UE-V, you’ll need to upgrade from that version to UE-V 2.x before you upgrade to Windows 10. + +## New UE-V template generator is available from the Windows 10 ADK + +UE-V for Windows 10 includes a new template generator, available from a new location. If you are upgrading from an existing UE-V installation, you’ll need to use the new generator to create settings location templates. The UE-V for Windows 10 template generator is now available in the [Windows 10 Assessment and Deployment Kit](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) (Windows ADK). + +## Company Settings Center removed in UE-V for Windows 10, version 1607 + +In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues. + +With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings. + +Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell. + +**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable: + +- Contact IT Link Text +- Contact IT URL +- Tray Icon + +## Compatibility with Microsoft Enterprise State Roaming + +With Windows 10, version 1607, users can synchronize Windows application settings and Windows operating system settings to Azure instead of to OneDrive. You can use the Windows 10 enterprise sync functionality together with UE-V on on-premises domain-joined devices only. + +In hybrid cloud environments, UE-V can roam Win32 applications on-premises while [Enterprise State Roaming](https://azure.microsoft.com/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) (ESR) can roam the rest, e.g., Windows and desktop settings, themes, colors, etc., to an Azure cloud installation. + +To configure UE-V to roam Windows desktop and application data only, change the following group policies: + +- Disable “Roam Windows settings” group policy + +- Enable “Do not synchronize Windows Apps” group policy + +For more information about using UE-V with Enterprise State Roaming, see [Settings and data roaming FAQ](https://azure.microsoft.com/documentation/articles/active-directory-windows-enterprise-state-roaming-faqs/#what-are-the-options-for-roaming-settings-for-existing-windows-desktop-applications). + +Additionally, to enable Windows 10 and UE-V to work together, configure these policy settings in the Microsoft User Experience Virtualization node: + +- Enable “Do Not Synchronize Windows Apps” + +- Disable “Sync Windows Settings” + + +## Settings Synchronization Behavior Changed in UE-V for Windows 10 + +While earlier versions of UE-V roamed taskbar settings between Windows 10 devices, UE-V for Windows 10, version 1607 does not synchronize taskbar settings between devices running Windows 10 and devices running previous versions of Windows. + +In addition, UE-for Windows does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous versions of Windows. + +## Support Added for Roaming Network Printers + +Users can now print to their saved network printers from any network device, including their default network printer. + +Printer roaming in UE-V requires one of these scenarios: + +- The print server can download the required driver when it roams to a new device. + +- The driver for the roaming network printer is pre-installed on any device that needs to access that network printer. + +- The printer driver can be imported from Windows Update. + +> **Note**  The UE-V printer roaming feature does not roam printer settings or preferences, such as printing double-sided. + +## Office 2016 Settings Location Template + +UE-V for Windows 10, version 1607 includes the Microsoft Office 2016 settings location template with improved Outlook signature support. We’ve added synchronization of default signature settings for new, reply, and forwarded emails. Users no longer have to choose the default signature settings. + +> **Note**  An Outlook profile must be created on any device on which a user wants to synchronize their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization. + +UE-V works with Office 365 to determine whether Office 2016 settings are roamed by Office 365. If settings are roamed by Office 365, they are not roamed by UE-V. See [Overview of user and roaming settings for Microsoft Office](https://technet.microsoft.com/library/jj733593.aspx) for more information. + +To enable settings synchronization using UE-V, do one of the following: + +- Use Group Policy to disable Office 365 synchronization + +- Do not enable the Office 365 synchronization experience during Office 2013 installation + +UE-V includes Office 2016, Office 2013, and Office 2010 templates. Office 2007 templates are no longer supported. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get templates from the [User Experience Virtualization Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V&f%5B0%5D.Text=UE-V). + +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + +- [Microsoft User Experience Virtualization](uev-for-windows.md) + +- [Get Started with UE-V](uev-getting-started.md) + +- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) + +- [User Experience Virtualization (UE-V) Release Notes](uev-release-notes-1607.md) for Windows 10, version 1607 + +- [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) diff --git a/windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md b/windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md new file mode 100644 index 0000000000..056526037b --- /dev/null +++ b/windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md @@ -0,0 +1,162 @@ +--- +title: Working with Custom UE-V Templates and the UE-V Template Generator +description: Working with Custom UE-V Templates and the UE-V Template Generator +author: MaggiePucciEvans +ms.pagetype: mdop, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Working with custom UE-V templates and the UE-V template generator + +**Applies to** +- Windows 10, version 1607 + +User Experience Virtualization (UE-V) uses XML files called ***settings location templates*** to monitor and synchronize application settings and Windows settings between user devices. By default, some settings location templates are included in UE-V. However, if you want to synchronize settings for desktop applications other than those included in the default templates, you can create your own custom settings location templates with the UE-V template generator. You can also edit or validate custom settings location templates with the UE-V template generator. + +Use the UE-V template generator to monitor, discover, and capture the locations where Win32 applications store settings. The template generator does not create settings location templates for the following types of applications: + +- Virtualized applications +- Applications that are offered through Terminal Services +- Java applications +- Windows applications + +## Standard and non-standard settings locations + +The UE-V template generator helps you identify where applications search for settings files and registry settings that applications use to store settings information. The generator discovers settings only in locations that are accessible to a standard user. Settings that are stored in other locations are excluded. + +Discovered settings are grouped into two categories: **Standard** and **Non-standard**. Standard settings are recommended for synchronization, and UE-V can readily capture and apply them. Non-standard settings can potentially synchronize settings but, because of the rules that UE-V uses, these settings might not consistently or dependably synchronize settings. These settings might depend on temporary files, result in unreliable synchronization, or might not be useful. These settings locations are presented in the UE-V template generator. You can choose to include or exclude them on a case-by-case basis. + +The UE-V template generator opens the application as part of the discovery process. The generator can capture settings in the following locations: + +- **Registry Settings** – Registry locations under **HKEY\_CURRENT\_USER** + +- **Application Settings Files** – Files that are stored under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming** + +The UE-V template generator excludes locations, which commonly store application software files, but do not synchronize well between user computers or environments. The UE-V template generator excludes these locations. Excluded locations are as follows: + +- HKEY\_CURRENT\_USER registry keys and files to which the logged-on user cannot write values + +- HKEY\_CURRENT\_USER registry keys and files that are associated with the core functionality of the Windows operating system + +- All registry keys that are located in the HKEY\_LOCAL\_MACHINE hive, which requires administrator rights and might require to set a User Account Control (UAC) agreement + +- Files that are located in Program Files directories, which requires administrator rights and might require to set a UAC agreement + +- Files that are located under Users \\ \[User name\] \\ AppData \\ LocalLow + +- Windows operating system files that are located in %Systemroot%, which requires administrator rights and might require to set a UAC agreement + +If registry keys and files that are stored in these locations are required to synchronize application settings, you can manually add the excluded locations to the settings location template during the template creation process. + +## Edit settings location templates with the UE-V template generator + +Use the UE-V template generator to edit settings location templates. When the revised settings are added to the templates with the UE-V template generator, the version information within the template is automatically updated to ensure that any existing templates that are deployed in the enterprise are updated correctly. + +**To edit a UE-V settings location template with the UE-V template generator** + +1. Open the **Start** menu and navigate to **Windows Kits** > **Microsoft User Experience Virtualization (UE-V) Template Generator** to open the template generator. + +2. Click **Edit a settings location template**. + +3. In the list of recently used templates, select the template to be edited. Alternatively, click **Browse** to search for the settings template file. Click **Next** to continue. + +4. Review the **Properties**, **Registry** locations, and **Files** locations for the settings template. Edit as required. + + - On the **Properties** tab, you can view and edit the following properties: + + - **Application name** The application name that is written in the description of the program file properties. + + - **Program name** The name of the program that is taken from the program file properties. This name usually has the .exe file name extension. + + - **Product version** The product version number of the .exe file of the application. This property, together with the **File version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, then the settings location template applies to all versions of the product. + + - **File version** The file version number of the .exe file of the application. This property, along with the **Product version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the program. + + - **Template author name** (optional) The name of the settings template author. + + - **Template author email** (optional) The email address of the settings location template author. + + - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. You can edit the registry locations by using the **Tasks** drop-down menu. In the Tasks menu, you can add new keys, edit the name or scope of existing keys, delete keys, and browse the registry in which the keys are located. When you define the scope for the registry, you can use the **All Settings** scope to include all the registry settings under the specified key. Use **All Settings** and **Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. + + - The **Files** tab lists the file path and file mask of the file locations that are included in the settings location template. You can edit the file locations by using the **Tasks** drop-down menu. In the **Tasks** menu for file locations, you can add new files or folder locations, edit the scope of existing files or folders, delete files or folders, and open the selected location in Windows Explorer. To include all files in the specified folder, leave the file mask empty. + +5. Click **Save** to save the changes to the settings location template. + +6. Click **Close** to close the Settings Template Wizard. Exit the UE-V template generator application. + + After you edit the settings location template for an application, you should test the template. Deploy the revised settings location template in a lab environment before you put it into production in the enterprise. + +**How to manually edit a settings location template** + +1. Create a local copy of the settings location template .xml file. UE-V settings location templates are .xml files that identify the locations where application store settings values. + + >**Note**   + A settings location template is unique because of the template **ID**. If you copy the template and rename the .xml file, template registration fails because UE-V reads the template **ID** tag in the .xml file to determine the name, not the file name of the .xml file. UE-V also reads the **Version** number to know if anything has changed. If the version number is higher, UE-V updates the template. + +   +2. Open the settings location template file with an XML editor. + +3. Edit the settings location template file. All changes must conform to the UE-V schema file that is defined in [SettingsLocationTempate.xsd](uev-application-template-schema-reference.md). By default, a copy of the .xsd file is located in \\ProgramData\\Microsoft\\UEV\\Templates. + +4. Increment the **Version** number for the settings location template. + +5. Save the settings location template file, and then close the XML editor. + +6. Validate the modified settings location template file by using the UE-V template generator. + +7. You must register the edited UE-V settings location template before it can synchronize settings between client computers. To register a template, open Windows PowerShell, and then run the following cmdlet: `update-uevtemplate [templatefilename]`. You can then copy the file to the settings storage catalog. The UE-V Agent on users’ computers should then update as scheduled in the scheduled task. + +## Validate settings location templates with the UE-V template generator + + +It is possible to create or edit settings location templates in an XML editor without using the UE-V template generator. If you do, you can use the UE-V template generator to validate that the new or revised XML matches the schema that has been defined for the template. + +**To validate a UE-V settings location template with the UE-V template generator** + +1. Open the **Start** menu and navigate to **Windows Kits** > **Microsoft User Experience Virtualization (UE-V) Template Generator** to open the template generator. + +2. Click **Validate a settings location template**. + +3. In the list of recently used templates, select the template to be edited. Alternatively, you can **Browse** to the settings template file. Click **Next** to continue. + +4. Click **Validate** to continue. + +5. Click **Close** to close the Settings Template Wizard. Exit the UE-V template generator application. + + After you validate the settings location template for an application, you should test the template. Deploy the template in a lab environment before you put it into a production environment in enterprise. + +## Share settings location templates with the Template Gallery + +The [User Experience Virtualization Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V&f%5B0%5D.Text=UE-V) enables administrators to share their UE-V settings location templates. Upload your settings location templates to the gallery for other users to use, and download templates that other users have created. + +Before you share a settings location template on the UE-V template gallery, ensure it does not contain any personal or company information. You can use any XML viewer to open and view the contents of a settings location template file. The following template values should be reviewed before you share a template with anyone outside your company. + +- Template Author Name – Specify a general, non-identifying name for the template author name or exclude this data from the template. + +- Template Author Email – Specify a general, non-identifying template author email or exclude this data from the template. + +Before you deploy any settings location template that you have downloaded from the UE-V gallery, you should first test the template to ensure that the application settings synchronize settings correctly in a test environment. + +## Have a suggestion for UE-V? + + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Related topics + + +[Administering UE-V](uev-administering-uev.md) + +[Use UE-V with custom applications](uev-deploy-uev-for-custom-applications.md) + +  + +  + + + + + diff --git a/windows/manage/update-windows-store-for-business-account-settings.md b/windows/manage/update-windows-store-for-business-account-settings.md index 2870bbda8a..90469e91a6 100644 --- a/windows/manage/update-windows-store-for-business-account-settings.md +++ b/windows/manage/update-windows-store-for-business-account-settings.md @@ -6,6 +6,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Update Windows Store for Business account settings @@ -109,7 +110,7 @@ Not all cards available in all countries. When you add a payment option, Store f **To add a new payment option** 1. Sign in to [Store for Business](http://businessstore.microsoft.com). -2. Click **Settings**, and then click **Account information**. +2. Click **Manage**, and then click **Account information**. 3. Under **My payment options**, tap or click **Show my payment options**, and then select the type of credit card that you want to add. 4. Add information to any required fields, and then click **Next**. @@ -117,13 +118,13 @@ Once you click Next, the information you provided will be validated with a tes **Note**: 
    When adding credit or debit cards, you may be prompted to enter a CVV . The CVV is only used for verification purposes and is not stored in our systems after validation. -**To update a payment option**: +**To update a payment option** 1. Sign in to [Store for Business](http://businessstore.microsoft.com). -2. Click **Settings**, and then click **Account information**. -3. Under My payment options > Credit Cards, select the payment option that you want to update, and then click Update. -4. Enter any updated information in the appropriate fields, and then click Next. -Once you click Next, the information you provided will be validated with a test authorization transaction and, if validated, the payment option will be added to your list of available payment options. Otherwise, you will be prompted for additional information or notified if there are any problems. +2. Click **Manage**, and then click **Account information**. +3. Under **My payment options** > **Credit Cards**, select the payment option that you want to update, and then click **Update**. +4. Enter any updated information in the appropriate fields, and then click **Next**. +Once you click **Next**, the information you provided will be validated with a test authorization transaction and, if validated, the payment option will be added to your list of available payment options. Otherwise, you will be prompted for additional information or notified if there are any problems. **Note**:
     Certain actions, like updating or adding a payment option, require temporary “test authorization” transactions to validate the payment option. These may appear on your statement as $0.00 authorizations or as small pending transactions. These transactions are temporary and should not impact your account unless you make several changes in a short period of time or have a low balance. @@ -131,6 +132,14 @@ Once you click Next, the information you provided will be validated with a tes Offline licensing is a new licensing option for Windows 10. With offline licenses, organizations can cache apps and their licenses to deploy within their network. ISVs or devs can opt-in their apps for offline licensing when they submit them to the developer center. Only apps that are opted in to offline licensing will show that they are available for offline licensing in Store for Business. This model means organizations can deploy apps when users or devices do not have connectivity to the Store. +Admins can decide whether or not offline licenses are shown for apps in Windows Store for Business. + +**To set offline license visibility** + +1. Sign in to [Store for Business](http://businessstore.microsoft.com). +2. Click **Manage**, and then click **Account information**. +3. Under **Offline licensing**, click **Show offline licensed apps to people shopping in the store** to show availability for both online and offline licenses. + You have the following distribution options for offline-licensed apps: - Include the app in a provisioning package, and then use it as part of imaging a device. - Distribute the app through a management tool. diff --git a/windows/manage/windows-10-mobile-and-mdm.md b/windows/manage/windows-10-mobile-and-mdm.md index 3053aedc09..6e1b32d24a 100644 --- a/windows/manage/windows-10-mobile-and-mdm.md +++ b/windows/manage/windows-10-mobile-and-mdm.md @@ -1,74 +1,59 @@ --- -title: Windows 10 Mobile and mobile device management (Windows 10) -description: This guide provides an overview of the mobile device and app management technologies in the Windows 10 Mobile operating system. +title: Windows 10 Mobile deployment and management guide (Windows 10) +description: This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. ms.assetid: 6CAA1004-CB65-4FEC-9B84-61AAD2125E5E -keywords: telemetry, BYOD, MDM +keywords: Mobile, telemetry, BYOD, MDM ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile, devices, security +localizationpriority: high author: AMeeus --- -# Windows 10 Mobile and mobile device management +# Windows 10 Mobile deployment and management guide -**Applies to** -- Windows 10 Mobile +*Applies to: Windows 10 Mobile, version 1511 and Windows 10 Mobile, version 1607* -This guide provides an overview of the mobile device and app management technologies in the Windows 10 Mobile operating system. It describes how mobile device management (MDM) systems use the built-in device management client to deploy, configure, maintain, and support phones and small tablets running Windows 10 Mobile. +This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. -Bring Your Own Device (BYOD—that is, personal devices) and corporate devices are key scenarios that Windows 10 Mobile MDM capabilities support. The operating system offers a flexible approach to registering devices with directory services and MDM systems, and IT organizations can provision comprehensive device-configuration profiles based on their company’s need to control and secure mobile business data. -Windows 10 Mobile not only delivers more comprehensive, restrictive configuration settings than Windows Phone 8.1 did but also provides capabilities to deploy and manage apps built on the Universal Windows Platform (UWP). Companies can distribute apps directly from Windows Store or by using their MDM system. They can control and distribute custom line-of-business (LOB) apps the same way. +Employees increasingly depend on smartphones to complete daily work tasks, but these devices introduce unique management and security challenges. Whether providing corporate devices or allowing people to use their personal devices, IT needs to deploy and manage mobile devices and apps quickly to meet business goals. However, they also need to ensure that the apps and data on those mobile devices are protected against cybercrime or loss. Windows 10 Mobile helps organizations directly address these challenges with robust, flexible, built-in mobile device and app management technologies. +Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement using a comprehensive mobile device management solution. -## Overview +**In this article** +- Deploy +- Configure +- Apps +- Manage +- Retire -Organizations’ users increasingly depend on their mobile devices, but phones and tablets bring new and unfamiliar challenges for IT departments. IT must be able to deploy and manage mobile devices and apps quickly to support the business while balancing the growing need to protect corporate data because of evolving laws, regulations, and cybercrime. IT must ensure that the apps and data on those mobile devices are safe, especially on personal devices. Windows 10 Mobile helps organizations address these challenges by providing a robust, flexible, built-in MDM client. IT departments can use the MDM system of their choice to manage this client. -### Built-in MDM client +## Deploy + +Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which Mobile Device Management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced. +Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or System Center Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select whichever system best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050). + +### Deployment scenarios + +*Applies to: Corporate and personal devices* The built-in MDM client is common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT). The client provides a single interface through which you can manage any device that runs Windows 10. The client has two important roles: device enrollment in an MDM system and device management. -- **Device enrollment.** Users can enroll in the MDM system. On Windows 10, a user can register a device with Microsoft Azure Active Directory (Azure AD) and enroll in an MDM system at the same time so that the system can manage the device, the apps running on it, and the confidential data it holds. Enrollment establishes the management authority for the device. Only one management authority (or MDM enrollment) is possible at a time, which helps prevent unauthorized access to devices and ensures their stability and reliability. -- **Device management.** The MDM client allows the MDM system to configure policy settings; deploy apps and updates; and perform other management tasks, such as remotely wiping the device. The MDM system sends configuration requests and collects inventory through the MDM client. The client uses [configuration service providers (CSPs)](http://go.microsoft.com/fwlink/p/?LinkId=734049) to configure and inventory settings. A CSP is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. (The security architecture of Windows 10 Mobile prevents direct access to registry settings and operating system files. For more information, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md).) +Organizations typically have two scenarios to consider when it comes to device deployment: Bring Your Own (BYO) personal devices and Choose Your Own (CYO) company-owned devices. In both cases, the device must be enrolled in an MDM system, which would configure it with settings appropriate for the organization and the employee. +Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Windows Store for Business, or by using their MDM system, which can also work with the Windows Store for Business for public store apps. +Knowing who owns the device and what the employee will use it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ. -The MDM client is an integral part of Windows 10 Mobile. As a result, there is no need for an additional, custom MDM app to enroll the device or to allow an MDM system to manage it. All MDM systems have equal access to Windows 10 Mobile MDM application programming interfaces (APIs), so you can choose Microsoft Intune or a third-party MDM product to manage Windows 10 Mobile devices. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050). +For **personal devices**, companies need to be able to manage corporate apps and data on the device without impeding the employee’s ability to personalize it to meet their individual needs. The employee owns the device and corporate policy allows them to use it for both business and personal purposes, with the ability to add personal apps at their discretion. The main concern with personal devices is how organizations can prevent corporate data from being compromised, while still keeping personal data private and under the sole control of the employee. This requires that the device be able to support separation of apps and data with strict control of business and personal data traffic. -### Windows 10 Mobile editions +For **corporate devices**, organizations have a lot more control. IT can provide a selected list of supported device models to employees, or they can directly purchase and preconfigure them. Because devices are owned by the company, employees can be limited as to how much they can personalize these devices. Security and privacy concerns may be easier to navigate, because the device falls entirely under existing company policy. -Every device that runs Windows 10 Mobile includes all the enterprise mobile device security and management capabilities the MDM client provides. Microsoft also offers an Enterprise edition of Windows 10 Mobile, which includes three additional capabilities. To enable these capabilities, you can provision a license file without reinstalling the operating system: +### Device enrollment -- **Ability to postpone software updates.**Windows 10 Mobile gets software updates directly from Windows Update, and you cannot curate updates prior to deployment. Windows 10 Mobile Enterprise, however, allows you to curate and validate updates prior to deploying them. -- **No limit on the number of self-signed LOB apps that you can deploy to a single device.** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device, more than 20 if your organization’s devices run Windows 10 Mobile Enterprise. -- **Set telemetry to security level.** The telemetry security level configures the operating system to gather only the telemetry information required to keep devices secured. +*Applies to: Corporate and personal devices* ->**Note:**  Your organization can opt to purchase a code signing certificate from Verisign to sign LOB apps or use [Windows Store for Business](windows-store-for-business.md) to obtain apps. With either method, you can distribute more than 20 apps to a single device without activating Windows 10 Mobile Enterprise on that device by using your MDM system. -  -To activate Windows 10 Mobile Enterprise on any Windows 10 Mobile device, use your company’s MDM system or a provisioning package to inject a license onto the device. You can download a Windows 10 Mobile Enterprise license from the Business Support Portal. +The way in which personal and corporate devices are enrolled into an MDM system differs. Your operations team should consider these differences when determining which approach is best for mobile workers in your organization. -### Lifecycle management - -Windows 10 Mobile supports end-to-end lifecycle device management to give companies control of their devices, data, and apps. Comprehensive MDM systems use the built-in MDM client to manage devices throughout their lifecycle, as Figure 1 illustrates. The remainder of this guide describes the operating system’s mobile device and app management capabilities through each phase of the lifecycle, showing how MDM systems use specific features. - -![figure 1](images/win10-mobile-mdm-fig1.png) - -Figure 1. Device management lifecycle - -## Device deployment - -Device deployment includes the initial registration and configuration of the device, including its enrollment with an MDM system. Sometimes, companies preinstall apps. The major factors in how you deploy devices and which controls you put in place are device ownership and how the user will use the device. This guide covers two scenarios: - -1. Companies allow users to personalize their devices because the users own the devices or because company policy doesn’t require tight controls (defined as *personal devices* in this guide). -2. Companies don’t allow users to personalize their devices or they limit personalization, usually because the organization owns the devices and security considerations are high (defined as *corporate devices* in this guide). - -Often, employees can choose devices from a list of supported models, or companies provide devices that they preconfigure, or bootstrap, with a baseline configuration. - -Microsoft recommends Azure AD Join and MDM enrollment and management for corporate devices and Azure AD Registration and MDM enrollment and management for personal devices. - -### Deployment scenarios - -Most organizations support both personal and corporate device scenarios. The infrastructure for these scenarios is similar, but the deployment process and configuration policies differ. Table 1 describes characteristics of the personal and corporate device scenarios. Activation of a device with an organizational identity is unique to Windows 10 Mobile. - -Table 1. Characteristics of personal and corporate device scenarios +**Device initialization and enrollment considerations** @@ -79,35 +64,49 @@ Table 1. Characteristics of personal and corporate device scenarios - - + + - - + + - - - + + + - - - + + +
    Personal devicesCorporate devicesPersonal devicesCorporate devices
    OwnershipUserOwnershipEmployee Organization
    Primary usePersonalWorkDevice Innitialization + +In the Out-of-the-Box Experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device.The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address. The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext). +Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory organizational identity. +Skipping the account setup in OOBE will result in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device will have to be reset. +
    DeploymentThe primary identity on the device is a personal identity. A Microsoft account is the default option for Windows 10 Mobile.The primary identity on the device is an organizational identity. An Azure AD account is the default option for Windows 10 Mobile.Device Enrollment + +Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive. Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+AAD+MDM). If your organization does not have Azure AD, the employee’s device will automatically be enrolled into your organization’s MDM system (MSA+MDM). +MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM). +The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (AAD+MDM).
    -  -### Identity management -People can use only one account to activate a device, so it’s imperative that your organization control which account you enable first. The account you choose will determine who controls the device and influence your management capabilities. The following list describes the impact that users’ identities have on management (Table 2 summarizes these considerations): +**Recommendation:** Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (AAD+MDM) and personal devices (MSA+AAD+MDM). This requires Azure AD Premium. -- **Personal identity.** In this scenario, employees use their Microsoft account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution. You can apply policies to help protect and contain corporate apps and data on the devices, designed to prevent intellectual property leaks, but users keep full control over personal activities, such as downloading and installing apps and games. -- **Organizational identity.** In this scenario, employees use their Azure AD account to register the device to Azure AD and automatically enroll it with the organization’s MDM solution. In this case, companies can block personal use of devices. Using organizational Identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization. +### Identity management -Table 2. Personal vs. organizational identity +*Applies to: Corporate and personal devices* + +Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen will determine who controls the device and influence your management capabilities. + +>**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/en-us/account/) and an [Azure AD account](https://www.microsoft.com/en-us/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services. + +The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios. + +**Identity choice considerations for device management** @@ -118,1187 +117,959 @@ Table 2. Personal vs. organizational identity - - + + - - + + - - - + + + - - - + + + - - + + - - - + + + + + + + + + + + + + + + + + +
    Personal identityCorporate identityPersonal identityWork identity
    First account on the deviceMicrosoft accountFirst account on the deviceMicrosoft Account Azure AD account
    Device sign-inUsers cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account.Users can unlock devices with an Azure AD account. Organizations can block the addition of a personal identity.Ease of enrollmentEmployees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+AAD+MDM).Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (AAD+MDM – requires Azure AD Premium).
    User settings and data roaming across devicesUser and app settings roam across devices activated with the same personal identity over personal OneDrive.Windows 10 Mobile currently does not support users and app settings roaming over the enterprise cloud. It can block the roaming of personal cloud settings.Credential managementEmployees sign in to the device with Microsoft Account credentials. +Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account. +Employees sign in to the device with Azure AD credentials. +IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations. +
    Ability to block the use of a personal identity on the device
    Ability to block the use of a personal identity on the device No Yes
    Level of control

    Organization can apply most* restrictive policies to devices, but they cannot remove the Microsoft account from them. Device users can reclaim full control over their devices by un-enrolling them from the organization’s MDM solution.

    -
    -Note   -

    * MDM functionality on personal devices might be limited in the future.

    -
    -
    -  -
    		Organizations are free to apply the restrictive policies to devices that policy standards and compliance regulations require and prevent the user from un-enrolling the device from the enterprise.User settings and data roaming across multiple Windows devicesUser and app settings roam across all devices activated with the same personal identity through OneDrive.If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD- joined device, this will not be the case. Microsoft is investigating Enterprise roaming for a future release.
    Level of controlOrganizations can apply most of the available restrictive policies to devices and disable the Microsoft account. You can prevent users from reclaiming full control over their devices by unenrolling them from the organization’s MDM solution or resetting the device. Legal limitations may apply. For more information, contact your legal department.Organizations are free to apply any restrictive policies to devices to bring them in line with corporate standards and compliance regulations. They can also prevent the user from unenrolling the device from the enterprise.
    Information ProtectionYou can apply policies to help protect and contain corporate apps and data on the devices and prevent intellectual property leaks, but still provide employees with full control over personal activities like downloading and installing apps and games.Companies can block personal use of devices. Using organizational identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization.
    App purchasesEmployees can purchase and install apps from the Store using a personal credit card.Employees can install apps from your Store for Business. Employees cannot install or purchase app from the Store without the addition of an MSA.
    -  -### Infrastructure requirements -For both device scenarios, the essential infrastructure and tools required to deploy and manage Windows 10 Mobile devices include an Azure AD subscription and an MDM system. -Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid solution. Azure AD has three editions: Free, Basic, and Premium (see [Azure Active Directory editions](http://go.microsoft.com/fwlink/p/?LinkId=723980)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. Organizations that use Microsoft Office 365 or Intune are already using Azure AD. +>**Note:** In the context of [Windows-as-a-Service](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing), differentiation of MDM capabilities will change in the future. ->**Note:**  Most industry-leading MDM vendors already support integration with Azure AD or are working on integration. You can find the MDM vendors that support Azure AD in [Azure Marketplace](http://go.microsoft.com/fwlink/p/?LinkId=723981). -  -Users can enroll Windows 10 Mobile devices in third-party MDM systems without using an Azure AD organizational account. (By default, Intune uses Azure AD and includes a license). If your organization doesn’t use Azure AD, you must use a personal identity to activate devices and enable common scenarios, such as downloading apps from Windows Store. +### Infrastructure choices -Multiple MDM systems that support Windows 10 Mobile are available. Most support personal and corporate device deployment scenarios. Microsoft offers [Intune](http://go.microsoft.com/fwlink/p/?LinkId=723983), which is part of the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) and a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management, so employees use the same credentials to enroll devices in Intune or sign in to Office 365. Intune supports devices that run other operating systems, as well, such as iOS and Android, to provide a complete MDM solution. +*Applies to: Corporate and personal devices* -You can also integrate Intune with System Center Configuration Manager to gain a single console in which to manage all devices—in the cloud and on premises. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=734051). For guidance on choosing between a stand-alone Intune installation and Intune integrated with Configuration Manager, see [Choose between Intune by itself or integrating Intune with System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=723985). -In addition to Intune, other MDM providers support Windows 10 Mobile. Currently, the following MDM systems claim to support Windows 10 and Windows 10 Mobile: [AirWatch](http://go.microsoft.com/fwlink/p/?LinkId=723986), [Citrix](http://go.microsoft.com/fwlink/p/?LinkId=723987), [Lightspeed Systems](http://go.microsoft.com/fwlink/p/?LinkId=723988), [Matrix42](http://go.microsoft.com/fwlink/p/?LinkId=723989), [MobileIron](http://go.microsoft.com/fwlink/p/?LinkId=723990), [SAP](http://go.microsoft.com/fwlink/p/?LinkId=723991), [SOTI](http://go.microsoft.com/fwlink/p/?LinkId=723992), and [Symantec](http://go.microsoft.com/fwlink/p/?LinkId=723993). +For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](https://technet.microsoft.com/en-us/library/mt627908.aspx). -All MDM vendors have equal access to the [Windows 10 MDM APIs](http://go.microsoft.com/fwlink/p/?LinkId=734050). The extent to which they implement these APIs depends on the vendor. Contact your preferred MDM vendor to determine its level of support. +**Azure Active Directory** +Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](http://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. ->**Note:**  Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. -In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (for example, passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052). -  -### Provisioning +**Mobile Device Management** +Microsoft [Intune](http://www.microsoft.com/en-us/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. +You can also integrate Intune with Configuration Manager to gain a single console for managing all devices in the cloud and on premises, mobile or PC. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](http://technet.microsoft.com/en-us/library/jj884158.aspx). For guidance on choosing between a stand-alone Intune installation and Intune integrated with System Center Configuration Manager, see Choose between Intune by itself or integrating Intune with System Center Configuration Manager. +Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](http://azure.microsoft.com/en-us/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. -Provisioning is new to Windows 10 and uses the MDM client in Windows 10 Mobile. You can create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10. -To assist users with MDM system enrollment, use a provisioning package. To do so, use the [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) to create a provisioning package, and then install that package on the device. -Users can perform self-service MDM enrollment based on the following deployment scenarios: +>**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. +In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](http://technet.microsoft.com/en-us/library/ms.o365.cc.devicepolicy.aspx). -- **Corporate device.** During the out-of-the-box experience (OOBE), you can instruct the user to select **This device is owned by my organization** and join the device to Azure AD and the MDM system. -- **Personal device.** The user activates the device with a Microsoft account, but you can instruct him or her to register the device with Azure AD and enroll in Intune. To do so in Windows 10 Mobile, the user clicks, **Settings**, clicks **Accounts**, and then clicks **Work access**. -To automate MDM enrollment, use provisioning packages as follows: -- **Corporate device.** You can create a provisioning package and apply it to a corporate device before delivery to the user, or instruct the user to apply the package during OOBE. After application of the provisioning package, the OOBE process automatically chooses the enterprise path and requires the user to register the device with Azure AD and enroll it in the MDM system. -- **Personal device.** You can create a provisioning package and make it available to users who want to enroll their personal device in the enterprise. The user enrolls the device in the corporate MDM for further configuration by applying the provisioning package. To do so in Windows 10 Mobile, the user clicks **Settings**, clicks **Accounts**, and then clicks **Provisioning**). +**Cloud services** +On mobile devices that run Windows 10 Mobile, users can easily connect to cloud services that provide user notifications and collect telemetry (usage data). Windows 10 Mobile enables organizations to manage how devices consume these cloud services. -Distribute provisioning packages to devices by publishing them in an easily accessible location (e.g., an email attachment or a web page). You can cryptographically sign or encrypt provisioning packages and require that the user enter a password to apply them. +**Windows Push Notification Services** +The Windows Push Notification Services enable software developers to send toast, tile, badge, and raw updates from their cloud services. It provides a mechanism to deliver updates to users in a power-efficient and dependable way. +However, push notifications can affect battery life so the battery saver in Windows 10 Mobile limits background activity on the devices to extend battery life. Users can configure battery saver to turn on automatically when the battery drops below a set threshold. Windows 10 Mobile disables the receipt of push notifications to save energy when battery saver is on. +However, there is an exception to this behavior. In Windows 10 Mobile, the Always allowed battery saver setting (found in the Settings app) allows apps to receive push notifications even when battery saver is on. Users can manually configure this list, or IT can use the MDM system to configure the battery saver settings URI scheme in Windows 10 Mobile (ms-settings:batterysaver-settings). -See [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=734054) for more information on creating provisioning packages. +For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). -## Device configuration +**Windows Update for Business** +Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. -The following sections describe the device configuration capabilities of the built-in Windows 10 Mobile MDM client. This client exposes the capabilities to any MDM system compatible with Windows 10. Configurable settings include: +**Windows Store for Business** +The Windows Store for Business is the place where IT administrators can find, acquire, manage, and distribute apps to Windows 10 devices. This includes both internal line-of-business (LOB) apps, as well as commercially available third-party apps. -- [Email accounts](#email) -- [Account restrictions](#restrictions) -- [Device lock restrictions](#device-lock) -- [Hardware restrictions](#hardware) -- [Certificate management](#certificate) -- [Wi-Fi](#wifi) -- [Proxy](#proxy) -- [Virtual private network (VPN)](#vpn) -- [Access point name (APN) profiles](#apn) -- [Data leak prevention](#data) -- [Storage management](#storage) +## Configure ->**Note:**  Although all the MDM settings this section describes are available in Windows 10 Mobile, not all MDM systems may show them in their user interface. In addition, naming may vary among MDM systems. Consult your MDM system’s documentation for more information. -  -### Email accounts +MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. What configuration settings you use will differ based on the deployment scenario, and corporate devices will offer IT the broadest range of control. -You can use your corporate MDM system to manage corporate email accounts. Define email account profiles in the MDM system, and then deploy them to devices. You would usually deploy these settings immediately after enrollment, regardless of scenario. +>**Note:** This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor. +Not all MDM systems support every setting described in this guide. Some support custom policies through OMA-URI XML files. See [Microsoft Intune support for Custom Policies](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#custom-uri-settings-for-windows-10-devices). Naming conventions may also vary among MDM vendors. -This capability extends to email systems that use EAS. Table 3 lists settings that you can configure in EAS email profiles. +### Account profile -Table 3. Windows 10 Mobile settings for EAS email profiles +*Applies to: Corporate devices* -| Setting | Description | -|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Email Address | The email address associated with the EAS account | -| Domain | The domain name of the Exchange Server instance | -| Account Name | A user-friendly name for the email account on the device | -| Password | The password for the email account | -| Server Name | The server name that the email account uses | -| User Name | The user name for the email account | -| Calendar Age Filter | The age of calendar items to be synchronized with the device (for example, synchronizing calendar items within the past 7 days) | -| Logging | The level of diagnostic logging | -| Mail Body Type | The email body format type: text, HTML, RTF, or Multipurpose Internet Mail Extensions | -| Mail HTML Truncation | The maximum size of an HTML-formatted email message before the message is synchronized to the device (Any HTML-formatted email message that exceeds this size is automatically truncated.) | -| Mail Plain Text Truncation | The maximum size of a text-formatted email message before the message is synchronized to the device (Any text-formatted email message that exceeds this size is automatically truncated.) | -| Schedule | The schedule for synchronizing email between the Exchange Server instance and the device | -| Use SSL | Establishes whether Secure Sockets Layer (SSL) is required when syncing | -| Mail Age Filter | The age of messages to be synchronized with the device (for example, synchronizing messages within the past 7 days) | -| Content Types | The content type that is synchronized (e.g., email, contacts, calendar, task items) | -  -Table 4 lists settings that you can configure in other email profiles. +Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization will reduce the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts. -Table 4. Windows 10 Mobile settings for other email profiles +- **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Windows Store, Xbox, or Groove. +- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than Microsoft accounts. -| Setting | Description | -|-------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------| -| User logon name | The user logon name for the email account | -| Outgoing authentication required | Whether the outgoing server requires authentication | -| Password | The password for the account in the **User logon name** field | -| Domain | The domain name for the account in the **User logon name** field | -| Days to download | How much email (measured in days) should be downloaded from the server | -| Incoming server | The incoming server name and port number, where the value format is *server\_name:port\_number* (The port number is optional.) | -| Send and receive schedule | The length of time (in minutes) between email send-and-receive updates | -| IMAP4 maximum attachment size | The maximum size for message attachments for Internet Message Access Protocol version 4 (IMAP4) accounts | -| Send mail display name | The name of the sender displayed on a sent email | -| Outgoing server | The outgoing server name and port number, where the value format is *server\_name:port\_number* (The port number is optional.) | -| Reply address | The user’s reply email address | -| Email service name | The name of the email service | -| Email service type | The email service type (for example, POP3, IMAP4). | -| Maximum receive message size | The maximum size (in bytes) of messages retrieved from the incoming email server (Messages that exceed this size are truncated to the maximum size.) | -| Delete message action | How messages are deleted on the server (Messages can either be permanently deleted or sent to the Trash folder.) | -| Use cellular only | Whether the account should be used only with cellular connections and not Wi-Fi connections | -| Content types to synchronize | The content types supported for synchronization (in other words, mail messages, contacts, calendar items) | -| Content synchronization server | The name of the content synchronization server, if it’s different from the email server | -| Calendar synchronization server | The name of the calendar synchronization server, if it’s different from the email server | -| Contact server requires SSL | Whether the contact server requires an SSL connection | -| Calendar server requires SSL | Whether the calendar server requires an SSL connection | -| Contact items synchronization schedule | The schedule for syncing contact items | -| Calendar items synchronization schedule | The schedule for syncing calendar items | -| Alternative SMTP email account | The display name associated with a user’s alternative Simple Mail Transfer Protocol (SMTP) email account | -| Alternate SMTP domain name | The domain name for the user’s alternative SMTP email account | -| Alternate SMTP account enabled | Whether the user’s alternative SMTP account is enabled | -| Alternate SMTP password | The password for the user’s alternative SMTP account | -| Incoming and outgoing servers require SSL | A group of properties that specify whether the incoming and outgoing email servers use SSL | -  -### Account restrictions +### Email accounts -On a corporate device registered with Azure AD and enrolled in the MDM system, you can control whether users can use a Microsoft account or add other consumer email accounts. Table 5 lists the settings that you can use to manage accounts on Windows 10 Mobile devices. +*Applies to: Corporate and personal devices* -Table 5. Windows 10 Mobile account management settings -| Setting | Description | -| - | -| -| Allow Microsoft Account | Specifies whether users are allowed to add a Microsoft account to the device after MDM enrollment and use this account for connection authentication and services, such as purchasing apps in Windows Store, or cloud-based consumer services, such as Xbox or Groove. If a device was activated with a Microsoft account, the MDM system would not be able to block that account from being used. | -| Allow Adding Non Microsoft Accounts | Specifies whether users are allowed to add email accounts other than Microsoft accounts after MDM enrollment. If **Allow Microsoft Account** is applied, user can also not use a Microsoft account. | -| Allow “Your Account” | Specifies whether users are able to change account configuration in the **Your Email and Accounts** panel in Settings.| -  -### Device lock restrictions +Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies. -It’s common sense to lock a device when it is not in use. Microsoft recommends that you secure Windows 10 Mobile devices and implement a device lock policy. A device password or PIN lock is a best practice for securing apps and data on devices. [Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=723994) is the name given to the new biometric sign-in option that allows users to use their face, iris, or fingerprints to unlock their compatible device, all of which Windows 10 supports. +- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [ActiveSync CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920017(v=vs.85).aspx). +- **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile. ->**Note:**  In addition to the device lock restrictions discussed in this section, Windows 10 supports Microsoft Passport for Work, which lets you access apps and services without a password. -  -Table 6 lists the MDM settings in Windows 10 Mobile that you can use to configure device lock restrictions. +### Device Lock restrictions -Table 6. Windows 10 Mobile device lock restrictions +*Applies to: Corporate and personal devices* + +It’s common practice to protect a device that contains corporate information with a passcode when it is not in use. As a best practice, Microsoft recommends that you implement a device lock policy for Windows 10 Mobile devices for securing apps and data. You can use a complex password or numeric PIN to lock devices. Introduced with Windows 10, [Windows Hello](http://windows.microsoft.com/en-us/windows-10/getstarted-what-is-hello) allows you to use a PIN, a companion device (like Microsoft band), or biometrics to validate your identity to unlock Windows 10 Mobile devices. + +>**Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based. +Companion devices must be paired with Windows 10 PC’s via Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires Pro or Enterprise edition on the Windows 10 PC being signed into. + +Most of the device lock restriction policies have been available via ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply. + +- **Device Password Enabled** Specifies whether users are required to use a device lock password. +- **Allow Simple Device Password** Whether users can use a simple password (e.g., 1111 or 1234). +- **Alphanumeric Device Password Required** Whether users need to use an alphanumeric password. When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user will be able to enter a numeric PIN on the keyboard. +- **Min Device Password Complex Characters** The number of password element types (i.e., uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords. +- **Device Password History** The number of passwords Windows 10 Mobile remembers in the password history (Users cannot reuse passwords in the history to create new passwords.) +- **Min Device Password Length** The minimum number of characters required to create new passwords. +- **Max Inactivity Time Device Lock** The number of minutes of inactivity before devices are locked and require a password to unlock. +- **Allow Idle Return Without Password** Whether users are required to re-authenticate when their devices return from a sleep state before the inactivity time was reached. +- **Max Device Password Failed Attempts** The number of authentication failures allowed before a device is wiped (A value of zero disables device wipe functionality.) +- **Screen Timeout While Locked** The number of minutes before the lock screen times out (this policy influences device power management). +- **Allow Screen Timeout While Locked User Configuration** Whether users can manually configure screen timeout while the device is on the lock screen (Windows 10 Mobile ignores the **Screen Timeout While Locked** setting if you disable this setting). + +Settings related to Windows Hello would be important device lock settings to configure if you are deploying devices using the corporate deployment scenario. +Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an AAD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment. + +You will notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies will be applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information. + +### Prevent changing of settings + +*Applies to: Corporate devices* + +Employees are usually allowed to change certain personal device settings that you may want to lock down on corporate devices. Employees can interactively adjust certain settings of the phone through the settings applets. Using MDM, you can limit what users are allowed to change. + +- **Allow Your Account** Specifies whether users are able to change account configuration in the Your Email and Accounts panel in Settings +- **Allow VPN** Allows the user to change VPN settings +- **Allow Data Sense** Allows the user to change Data Sense settings +- **Allow Date Time** Allows the user to change data and time setting +- **Allow Edit Device Name** Allows users to change the device name +- **Allow Speech Model Update** Specifies whether the device will receive updates to the speech recognition and speech synthesis models (to improve accuracy and performance) + +### Hardware restrictions + +*Applies to: Corporate devices* + +Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi Fi. You can use hardware restrictions to control the availability of these features. + +The following lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. + +>**Note:** Some of these hardware restrictions provide connectivity and assist in data protection. + +- **Allow NFC:** Whether the NFC radio is enabled +- **Allow USB Connection:** Whether the USB connection is enabled (doesn’t affect USB charging) +- **Allow Bluetooth:** Whether users can enable and use the Bluetooth radio on their devices +- **Allow Bluetooth Advertising:** Whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices +- **Allow Bluetooth Discoverable Mode:** Whether the device can discover other devices (e.g., headsets) +- **Allow Bluetooth pre-pairing** Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device +- **Bluetooth Services Allowed List:** The list of Bluetooth services and profiles to which the device can connect +- **Set Bluetooth Local Device Name:** The local Bluetooth device name +- **Allow Camera:** Whether the camera is enabled +- **Allow Storage Card:** Whether the storage card slot is enabled +- **Allow Voice Recording:** Whether the user can use the microphone to create voice recordings +- **Allow Location:** Whether the device can use the GPS sensor or other methods to determine location so applications can use location information + +### Certificates + +*Applies to: Personal and corporate devices* + +Certificates help improve security by providing account authentication, Wi Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation. +To install certificates manually, you can post them on Microsoft Edge website or send them directly via email, which is ideal for testing purposes. +Using SCEP and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device (as long as the MDM system supports the Simple Certificate Enrollment Protocol (SCEP) or Personal Information Exchange (PFX)). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. +In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings. +Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](../keep-secure/installing-digital-certificates-on-windows-10-mobile.md). +Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. + +>**Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Windows Store. This Windows 10 Mobile app can help you: +- View a summary of all personal certificates +- View the details of individual certificates +- View the certificates used for VPN, Wi-Fi, and email authentication +- Identify which certificates may have expired +- Verify the certificate path and confirm that you have the correct intermediate and root CA certificates +- View the certificate keys stored in the device TPM + +### Wi-Fi profiles + +*Applies to: Corporate and personal devices* + +Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention. +You can create multiple Wi-Fi profiles in your MDM system. The below table lists the Windows 10 Mobile Wi Fi connection profile settings that can be configured by administrators. + +- **SSID** The case-sensitive name of the Wi Fi network Service Set Identifier +- **Security type** The type of security the Wi Fi network uses; can be one of the following authentication types: + - Open 802.11 + - Shared 802.11 + - WPA-Enterprise 802.11 + - WPA-Personal 802.11 + - WPA2-Enterprise 802.11 + - WPA2-Personal 802.11 +- **Authentication encryption** The type of encryption the authentication uses; can be one of the following encryption methods: + - None (no encryption) + - Wired Equivalent Privacy + - Temporal Key Integrity Protocol + - Advanced Encryption Standard (AES) +- **Extensible Authentication Protocol Transport Layer Security (EAP-TLS)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use EAP-TLS with certificates for authentication +- **Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MSCHAPv2)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use PEAP-MSCHAPv2 with a user name and password for authentication +- **Shared key** WPA-Personal 802.11 and WPA2-Personal 802.11 security types can use a shared key for authentication. +- **Proxy** The configuration of any network proxy that the Wi Fi connection requires (to specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address) +- **Disable Internet connectivity checks** Whether the Wi Fi connection should check for Internet connectivity +- **Proxy auto-configuration URL** A URL that specifies the proxy auto-configuration file +- **Enable Web Proxy Auto-Discovery Protocol (WPAD)** Specifies whether WPAD is enabled + +In addition, you can set a few device wide Wi-Fi settings. +- **Allow Auto Connect to Wi Fi Sense Hotspots** Whether the device will automatically detect and connect to Wi-Fi networks +- **Allow Manual Wi-Fi Configuration** Whether the user can manually configure Wi-Fi settings +- **Allow Wi-Fi** Whether the Wi-Fi hardware is enabled +- **Allow Internet Sharing** Allow or disallow Internet sharing +- **WLAN Scan Mode** How actively the device scans for Wi-Fi networks + +Get more detailed information about Wi-Fi connection profile settings in the [Wi-Fi CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx). + +### APN profiles + +*Applies to: Corporate devices* + +An Access Point Name (APN) defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. +An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. +You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles. + +- **APN name** The APN name +- *IP connection type* The IP connection type; set to one of the following values: + - IPv4 only + - IPv6 only + - IPv4 and IPv6 concurrently + - IPv6 with IPv4 provided by 46xlat +- **LTE attached** Whether the APN should be attached as part of an LTE Attach +- **APN class ID** The globally unique identifier that defines the APN class to the modem +- **APN authentication type** The APN authentication type; set to one of the following values: + - None + - Auto + - PAP + - CHAP + - MSCHAPv2 +- **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type +- **Password** The password for the user account specified in User name +- **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile +- **Always on** Whether the connection manager will automatically attempt to connect to the APN whenever it is available +- **Connection enabled** Specifies whether the APN connection is enabled +- **Allow user control** Allows users to connect with other APNs than the enterprise APN +- **Hide view** Whether the cellular UX will allow the user to view enterprise APNs + +Get more detailed information about APN settings in the [APN CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn958617(v=vs.85).aspx). + +### Proxy + +*Applies to: Corporate devices* + +The below lists the Windows 10 Mobile settings for managing APN proxy settings for Windows 10 Mobile device connectivity. + +- **Connection name** Specifies the name of the connection the proxy is associated with (this is the APN name of a configured connection) +- **Bypass Local** Specifies if the proxy should be bypassed when local hosts are accessed by the device +- **Enable** Specifies if the proxy is enabled +- **Exception** Specifies a semi-colon delimited list of external hosts which should bypass the proxy when accessed +- **User Name** Specifies the username used to connect to the proxy +- **Password** Specifies the password used to connect to the proxy +- **Server** Specifies the name of the proxy server +- **Proxy connection type** The proxy connection type, supporting: Null proxy, HTTP, WAP, SOCKS4 +- **Port** The port number of the proxy connection + +For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914762(v=vs.85).aspx). + +### VPN + +*Applies to: Corporate and personal devices* + +Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point to Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Windows Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Windows Store using your MDM system (see App Management). + +You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile. +To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP), you can use the following settings: + +- **VPN Servers** The VPN server for the VPN profile +- **Routing policy type** The type of routing policy the VPN profile uses can be set to one of the following values: + - Split tunnel. Only network traffic destined to the intranet goes through the VPN connection + - Force tunnel. All traffic goes through the VPN connection +- **Tunneling protocol type** The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols can be one the following values: PPTP, L2TP, IKEv2, Automatic +- **User authentication method** The user authentication method for the VPN connection can have a value of EAP or MSChapv2 (Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections) +- **Machine certificate** The machine certificate used for IKEv2-based VPN connections +- **EAP configuration** To create a single sign-on experience for VPN users using certificate authentication, you need to create an Extensible Authentication Protocol (EAP) configuration XML file and include it in the VPN profile +- **L2tpPsk** The pre-shared key used for an L2TP connection +- **Cryptography Suite** Enable the selection of cryptographic suite attributes used for IPsec tunneling + +>**Note:** The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard will walk you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client. + +Windows Store–based VPN plugins for the VPN connection allow you to create a VPN plugin profile with the following attributes: + +- **VPN server** A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address +- **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (e.g., authentication information) that the plugin provider requires +- **Windows Store VPN plugin family name** Specifies the Windows Store package family name for the Windows Store–based VPN plugin + +In addition, you can specify per VPN Profile: + +- **App Trigger List** You can add an App Trigger List to every VPN profile. The app specified in the list will automatically trigger the VPN profile for intranet connectivity. When multiple VPN profiles are needed to serve multiple apps, the operating system automatically establishes the VPN connection when the user switches between apps. Only one VPN connection at a time can be active. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. +- **Route List** List of routes to be added to the routing table for the VPN interface. This is required for split tunneling cases where the VPN server site has more subnets that the default subnet based on the IP assigned to the interface. +- **Domain Name Information List** Name Resolution Policy Table (NRPT) rules for the VPN profile. +- **Traffic Filter List** Specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface. +- **DNS suffixes** A comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List. +- **Proxy** Any post-connection proxy support required for the VPN connection; including Proxy server name and Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings. +- **Always on connection** Windows 10 Mobile features always-on VPN, which makes it possible to automatically start a VPN connection when a user signs in. The VPN stays connected until the user manually disconnects it. +- **Remember credentials** Whether the VPN connection caches credentials. +- **Trusted network detection** A comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible (Wi-Fi). +- **Enterprise Data Protection Mode ID** Enterprise ID, which is an optional field that allows the VPN to automatically trigger based on an app defined with a Windows Information Protection policy. +- **Device Compliance** To set up Azure AD-based Conditional Access for VPN and allow that SSO with a certificate different from the VPN Authentication certificate for Kerberos Authentication in the case of Device Compliance. +- **Lock Down VPN profile** A Lock Down VPN profile has the following characteristics: + - It is an always-on VPN profile. + - It can never be disconnected. + - If the VPN profile is not connected, the user has no network connectivity. + - No other VPN profiles can be connected or modified. +- **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require. + +For more details about VPN profiles, see the [VPNv2 CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914776(v=vs.85).aspx) + +Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges. +- **Allow VPN** Whether users can change VPN settings +- **Allow VPN Over Cellular** Whether users can establish VPN connections over cellular networks +- **Allow VPN Over Cellular when Roaming** Whether users can establish VPN connections over cellular networks when roaming + +### Storage management + +*Applies to: Corporate and personal devices* + +Protecting the apps and data stored on a device is critical to device security. One method for helping protect your apps and data is to encrypt internal device storage. The device encryption in Windows 10 Mobile helps protect corporate data against unauthorized access, even when an unauthorized user has physical possession of the device. + +Windows 10 Mobile also has the ability to install apps on a secure digital (SD) card. The operating system stores apps on a partition specifically designated for that purpose. This feature is always on so you don’t need to set a policy explicitly to enable it. + +The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. This gives users the flexibility to use an SD card while still protecting the confidential apps and data on it. + +You can disable the **Allow Storage Card** setting if you wish to prevent users from using SD cards entirely. If you choose not to encrypt storage, you can help protect your corporate apps and data by using the Restrict app data to the system volume and Restrict apps to the system volume settings. These help ensure that users cannot copy your apps and data to SD cards. + +Here is a list of MDM storage management settings that Windows 10 Mobile provides. + +- **Allow Storage Card** Whether the use of storage cards for data storage is allowed +- **Require Device Encryption** Whether internal storage is encrypted (when a device is encrypted, you cannot use a policy to turn encryption off) +- **Encryption method** Specifies the BitLocker drive encryption method and cipher strength; can be one of the following values: + - AES-Cipher Block Chaining (CBC) 128-bit + - AES-CBC 256-bit + - XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default) + - XTS-AES-256-bit +- **Allow Federal Information Processing Standard (FIPS) algorithm policy** Whether the device allows or disallows the FIPS algorithm policy +- **SSL cipher suites** Specifies a list of the allowed cryptographic cipher algorithms for SSL connections +- **Restrict app data to the system volume** Specifies whether app data is restricted to the system drive +- **Restrict apps to the system volume** Specifies whether apps are restricted to the system drive + + +## Apps + +*Applies to: Corporate and personal devices* + +User productivity on mobile devices is often driven by apps. + +Windows 10 makes it possible to develop apps that work seamlessly across multiple devices using the Universal Windows Platform (UWP) for Windows apps. UWP converges the application platform for all devices running Windows 10 so that apps run without modification on all editions of Windows 10. This saves developers both time and resources, helping deliver apps to mobile users more quickly and efficiently. This write-once, run-anywhere model also boosts user productivity by providing a consistent, familiar app experience on any device type. + +For compatibility with existing apps, Windows Phone 8.1 apps still run on Windows 10 Mobile devices, easing the migration to the newest platform. Microsoft recommend migrating your apps to UWP to take full advantage of the improvements in Windows 10 Mobile. In addition, bridges have been developed to easily and quickly update existing Windows Phone 8.1 (Silverlight) and iOS apps to the UWP. + +Microsoft also made it easier for organizations to license and purchase UWP apps via Windows Store for Business and deploy them to employee devices using the Windows Store, or an MDM system, that can be integrated with the Windows Store for Business. Putting apps into the hands of mobile workers is critical, but you also need an efficient way to ensure those apps comply with corporate policies for data security. + +To learn more about Universal Windows apps, see the [Guide to Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/en-us/library/windows/apps/dn894631.aspx) for additional information, or take this [Quick Start Challenge: Universal Windows Apps in Visual Studio](https://mva.microsoft.com/en-US/training-courses/quick-start-challenge-universal-windows-apps-in-visual-studio-14477?l=Be2FMfgmB_505192797). Also, see [Porting apps to Windows 10](https://msdn.microsoft.com/en-us/windows/uwp/porting/index). + +### Windows Store for Business: Sourcing the right app + +*Applies to: Corporate and personal devices* + +The first step in app management is to obtain the apps your users need. You can develop your own apps or source your apps from the Windows Store. With Windows Phone 8.1, an MSA was needed to acquire and install apps from the Windows Store. With the Windows Store for Business, Microsoft enables organizations to acquire apps for employees from a private store with the Windows Store, without the need for MSAs on Windows 10 devices. + +Windows Store for Business is a web portal that allows IT administrators to find, acquire, manage, and distribute apps to Windows 10 devices. + +Azure AD authenticated managers have access to Windows Store for Business functionality and settings, and store managers can create a private category of apps that are specific and private to their organization. (You can get more details about what specific Azure AD accounts have access to Windows Store for Business here). Windows Store for Business enables organizations to purchase app licenses for their organization and make apps available to their employees. In addition to commercially available apps, your developers can publish line-of-business (LOB) apps to Windows Store for Business by request. You can also integrate their Windows Store for Business subscriptions with their MDM systems, so the MDM system can distribute and manage apps from Windows Store for Business. + +Windows Store for Business supports app distribution under two licensing models: online and offline. + +The online model (store-managed) is the recommended method, and supports both personal device and corporate device management scenarios. To install online apps, the device must have Internet access at the time of installation. On corporate devices, an employee can be authenticated with an Azure AD account to install online apps. On personal devices, an employee must register their device with Azure AD to be able to install corporate licensed online apps. +Corporate device users will find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system app catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention. + +Employees with personal devices can install apps licensed by their organization using the Store app on their device. They can use either the Azure AD account or Microsoft Account within the Store app if they wish to purchase personal apps. If you allow employees with corporate devices to add a secondary Microsoft Account (MSA), the Store app on the device provides a unified method for installing personal and corporate apps. + +Online licensed apps do not need to be transferred or downloaded from the Windows Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it will automatically be installed from the cloud. Also, apps will be automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Windows Store for Business reclaims the license so it can be used for another user or on another device. + +To distribute an app offline (organization-managed), the app must be downloaded from the Windows Store for Business. This can be accomplished in the Windows Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Windows Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Windows Store, then you must obtain the files directly from the developer or use the online licensing method. + +To install acquired Windows Store or LOB apps offline on a Windows 10 Mobile device, IT administrators can use an MDM system. The MDM system distributes the app packages that you downloaded from Windows Store (also called sideloading) to Windows 10 Mobile devices. Support for offline app distribution depends on the MDM system you are using, so consult your MDM vendor documentation for details. You can fully automate the app deployment process so that no user intervention is required. + +Windows Store apps or LOB apps that have been uploaded to the Windows Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Windows Store certificates. LOB apps that are uploaded to the Windows Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition. + +Learn more about the [Windows Store for Business](windows-store-for-business.md). + +### Managing apps + +*Applies to: Corporate devices* + +IT administrators can control which apps are allowed to be installed on Windows 10 Mobile devices and how they should be kept up-to-date. + +Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow (sometimes also called whitelist/blacklist) lists of apps from the Windows Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Windows Store. + +For more details, see [AppLocker CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920019(v=vs.85).aspx). + +In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM. + +- **Allow All Trusted Apps** Whether users can sideload apps on the device. +- **Allow App Store Auto Update** Whether automatic updates of apps from Windows Store are allowed. +- **Allow Developer Unlock** Whether developer unlock is allowed. +- **Allow Shared User App Data** Whether multiple users of the same app can share data. +- **Allow Store** Whether Windows Store app is allowed to run. This will completely block the user from installing apps from the Store, but will still allow app distribution through an MDM system. +- **Application Restrictions** An XML blob that defines the app restrictions for a device. The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher. See AppLocker above. +- **Disable Store Originated Apps** Disables the launch of all apps from Windows Store that came pre-installed or were downloaded before the policy was applied. +- **Require Private Store Only** Whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available. +- **Restrict App Data to System Volume** Whether app data is allowed only on the system drive or can be stored on an SD card. +- **Restrict App to System Volume** Whether app installation is allowed only to the system drive or can be installed on an SD card. +- **Start screen layout** An XML blob used to configure the Start screen (see [Start layout for Windows 10 Mobile](http://msdn.microsoft.com/en-us/library/windows/hardware/mt171093(v=vs.85).aspx) for more information). + +Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps) + +### Data leak prevention + +*Applies to: Corporate and personal devices* + +One of the biggest challenges in protecting corporate information on mobile devices is keeping that data separate from personal data. Most solutions available to create this data separation require users to login in with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity. + +Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data protected and personal data private. It automatically tags personal and corporate data and applies policies for those apps that can access data classified as corporate. This includes when data is at rest on local or removable storage. Because corporate data is always protected, users cannot copy it to public locations like social media or personal email. + +Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data will be encrypted at all times and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps consider all data corporate and encrypt everything by default. + +Any app developed on the UWA platform can be enlightened. Microsoft has made a concerted effort to enlighten several of its most popular apps, including: +- Microsoft Edge +- Microsoft People +- Mobile Office apps (Word, Excel, PowerPoint, and OneNote) +- Outlook Mail and Calendar +- Microsoft Photos +- Microsoft OneDrive +- Groove Music +- Microsoft Movies & TV +- Microsoft Messaging + +The following table lists the settings that can be configured for Windows Information Protection: +- **Enforcement level*** Set the enforcement level for information protection: + - Off (no protection) + - Silent mode (encrypt and audit only) + - Override mode (encrypt, prompt, and audit) + - Block mode (encrypt, block, and audit) +- **Enterprise protected domain names*** A list of domains used by the enterprise for its user identities. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. +- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user will not be able to remove protection from enterprise content through the OS or app user experience. +- **Require protection under lock configuration** Specifies whether the protection under lock feature (also known as encrypt under PIN) should be configured. +- **Data recovery certificate*** Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy. +- **Revoke on unenroll** Whether to revoke the information protection keys when a device unenrolls from the management service. +- **RMS template ID for information protection** Allows the IT admin to configure the details about who has access to RMS-protected files and for how long. +- **Allow Azure RMS for information protection** Specifies whether to allow Azure RMS encryption for information protection. +- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the Start menu. +- **Status** A read-only bit mask that indicates the current state of information protection on the device. The MDM service can use this value to determine the current overall state of information protection. +- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. +- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected. +- **Enterprise Cloud Resources** A list of Enterprise resource domains hosted in the cloud that need to be protected. + +>**Note:** * Are mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings - specifically Enterprise IP Range and Enterprise Network Domain Names – must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key (so that others in the company can access it. + +For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](../keep-secure/protect-enterprise-data-using-wip.md). + +### Managing user activities + +*Applies to: Corporate devices* + +On corporate devices, some user activities expose corporate data to unnecessary risk. For example, users might create a screen capture of corporate information out of an internal LOB app. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. The following demonstrates those capabilities that can be used to help prevent data leaks. + +- **Allow copy and paste** Whether users can copy and paste content +- **Allow Cortana** Whether users can use Cortana on the device (where available) +- **Allow device discovery** Whether the device discovery user experience is available on the lock screen (for example, controlling whether a device could discover a projector [or other devices] when the lock screen is displayed) +- **Allow input personalization** Whether personally identifiable information can leave the device or be saved locally (e.g., Cortana learning, inking, dictation) +- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) +- **Allow screen capture** Whether users are allowed to capture screenshots on the device +- **Allow SIM error dialog prompt** Specifies whether to display a dialog prompt when no SIM card is installed +- **Allow sync my settings** Whether the user experience settings are synchronized between devices (works with Microsoft accounts only) +- **Allow toasts notifications above lock screen** Whether users are able to view toast notification on the device lock screen +- **Allow voice recording** Whether users are allowed to perform voice recordings +- **Do Not Show Feedback Notifications** Prevents devices from showing feedback questions from Microsoft +- **Allow Task Switcher** Allows or disallows task switching on the device to prevent visibility of App screen tombstones in the task switcher +- **Enable Offline Maps Auto Update** Disables the automatic download and update of map data +- **Allow Offline Maps Download Over Metered Connection** Allows the download and update of map data over metered connections + +You can find more details on the experience settings in Policy CSP. + +### Microsoft Edge + +*Applies to: Corporate and personal devices* + +MDM systems also give you the ability to manage Microsoft Edge on mobile devices. Microsoft Edge is the only browser available on Windows 10 Mobile devices. It differs slightly from the desktop version as it does not support Flash or Extensions. Edge is also an excellent PDF viewer as it can be managed and integrates with Windows Information Protection. + +The following settings for Microsoft Edge on Windows 10 Mobile can be managed. + +- **Allow Browser** Whether users can run Microsoft Edge on the device +- **Allow Do Not Track headers** Whether Do Not Track headers are allowed +- **Allow InPrivate** Whether users can use InPrivate browsing +- **Allow Password Manager** Whether users can use Password Manager to save and manage passwords locally +- **Allow Search Suggestions in Address Bar** Whether search suggestions are shown in the address bar +- **Allow SmartScreen** Whether SmartScreen Filter is enabled +- **Cookies** Whether cookies are allowed +- **Favorites** Configure Favorite URLs +- **First Run URL** The URL to open when a user launches Microsoft Edge for the first time +- **Prevent SmartScreen Prompt Override** Whether users can override the SmartScreen warnings for URLs +- **Prevent Smart Screen Prompt Override for Files** Whether users can override the SmartScreen warnings for files + +## Manage + +In enterprise IT environments, the need for security and cost control must be balanced against the desire to provide users with the latest technologies. Since cyberattacks have become an everyday occurrence, it is important to properly maintain the state of your Windows 10 Mobile devices. IT needs to control configuration settings, keeping them from drifting out of compliance, as well as enforce which devices can access internal applications. Windows 10 Mobile delivers the mobile operations management capabilities necessary to ensure that devices are in compliance with corporate policy. + +### Servicing options + +**A streamlined update process** + +*Applies to: Corporate and personal devices* + +Microsoft has streamlined the Windows product engineering and release cycle so new features, experiences, and functionality demanded by the market can be delivered more quickly than ever before. Microsoft plans to deliver two Feature Updates per year (12-month period). Feature Updates establish a Current Branch or CB, and have an associated version. --+++ - - - - - - - - + + + - - + + + - - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + +
    SettingDescription
    Device Password Enabled

    Specifies whether users are required to use a device lock password

    -
    -Note   -

    -
      -

    • When a device is registered with Azure AD and automatic MDM enrollment is not configured, the user will automatically be prompted to set a password PIN of at least six digits (simple PINs are not allowed).

      • -

    • If the device is capable of using biometric authentication, the user will be able to enroll an iris or other biometric gesture (depending on hardware) for device lock purposes. When a user uses a biometric gesture, he or she can still use the PIN as a fallback mechanism (for example, if the iris-recognition camera fails).

      • -
    -
    -
    -  -
    		BranchVersionRelease Date
    Allow Simple Device PasswordWhether users can use a simple password (for example, 1111 or 1234)Current Branch1511November 2015
    Alphanumeric Device Password RequiredWhether users need to use an alphanumeric password When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user will be able to enter a numeric PIN on the keyboard.Current Branch for Business1511March 2016
    Min Device Password Complex CharactersThe number of password element types (in other words, uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords
    Device Password ExpirationThe number of days before a password expires (Biometric data does not expire.)
    Device Password HistoryThe number of passwords Windows 10 Mobile remembers in the password history (Users cannot reuse passwords in the history to create new passwords.)
    Min Device Password LengthThe minimum number of characters required to create new passwords
    Max Inactivity Time Device LockThe number of minutes of inactivity before devices are locked and require a password to unlock
    Allow Idle Return Without PasswordWhether users are required to re-authenticate when their devices return from a sleep state, before the inactivity time was reached
    Max Device Password Failed AttemptsThe number of authentication failures allowed before a device is wiped (A value of zero disables device wipe functionality.)
    Screen Timeout While LockedThe number of minutes before the lock screen times out (This policy influences the device’s power management.)
    Allow Screen Timeout While Locked User ConfigurationWhether users can manually configure screen timeout while the device is on the lock screen (Windows 10 Mobile ignores the Screen Timeout While Locked setting if you disable this setting.)Current Branch1607July 2016
    -  -### Hardware restrictions -Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can also use hardware restrictions to control the availability of these features. Table 7 lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. +Microsoft will also deliver and install monthly updates for security and stability directly to Windows 10 Mobile devices. These Quality Updates, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process. ->**Note:**  Some of these hardware restrictions provide connectivity and assist in data protection. Enterprise data protection is currently being tested in select customer evaluation programs. -  -Table 7. Windows 10 Mobile hardware restrictions +Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates will take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process will apply to both feature and quality updates. -| Setting | Description | -|--------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------| -| Allow NFC | Whether the NFC radio is enabled | -| Allow USB Connection | Whether the USB connection is enabled (this setting doesn’t affect USB charging) | -| Allow Bluetooth | Whether users can enable and use the Bluetooth radio on their devices | -| Allow Bluetooth Advertising | Whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices | -| Allow Bluetooth Discoverable Mode | Whether the device can discover other devices (for example, headsets) | -| Bluetooth Services Allowed List | The list of Bluetooth services and profiles to which the device can connect | -| Set Bluetooth Local Device Name | The local Bluetooth device name | -| Allow Wi-Fi | Whether the Wi-Fi radio is enabled | -| Allow Auto Connect to Wi-Fi Sense Hotspots | Whether the device can automatically connect to Wi-Fi hotspots and friends’ home networks that are shared through Wi-Fi Sense | -| Allow Manual Wi-Fi Configuration | Whether users can manually connect to Wi-Fi networks not specified in the MDM system’s list of configured Wi-Fi networks | -| WLAN Scan Mode | How actively the device scans for Wi-Fi networks (This setting is hardware dependent.) | -| Allow Camera | Whether the camera is enabled | -| Allow Storage Card | Whether the storage card slot is enabled | -| Allow Voice Recording | Whether the user can use the microphone to create voice recordings | -| Allow Location | Whether the device can use the GPS sensor or other methods to determine location so applications can use location information | -  -### Certificate management - -Managing certificates can be difficult for users, but certificates are pervasive for a variety of uses, including, account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users could manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates for their entire life cycle, from enrollment through renewal to revocation. You can use the Simple Certificate Enrollment Protocol (SCEP) and Personal Information Exchange (PFX) certificates files to install certificates on Windows 10 Mobile. Certificate management through SCEP and MDM systems is fully transparent to users and requires no user intervention, so it helps improve user productivity and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device. Table 8 lists the SCEP settings that the MDM client in Windows 10 Mobile provides. - -Table 8. Windows 10 Mobile SCEP certificate enrollment settings - -| Setting | Description | -|------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Certificate enrollment server URLs | The certificate enrollment servers (to specify multiple server URLs, separate the URLs with semicolons \[;\]) | -| SCEP enrollment challenge | The Base64-encoded SCEP enrollment challenge | -| Extended key use object identifiers | The object identifiers (OIDs) for extended key use | -| Key usage | The key usage bits for the certificate in decimal format | -| Subject name | The certificate subject name | -| Private key storage | Where to store the private key (in other words, the Trusted Platform Module \[TPM\], a software key storage provider \[KSP\], or the Microsoft Passport KSP) | -| Pending retry delay | How long the device will wait to retry when the SCEP server sends a pending status | -| Pending retry count | The number of times a device will retry when the SCEP server sends a pending status | -| Template name | The OID of the certificate template name | -| Private key length | The private key length (in other words, 1024, 2048, or 4096 bits; Microsoft Passport supports only the 2048 key length) | -| Certificate hash algorithm | The hash algorithm family (in other words, SHA-1, SHA-2, SHA-3; multiple hash algorithm families are separated by plus signs \[+\]) | -| Root CA thumbprint | The root CA thumbprint | -| Subject alternative names | Subject alternative names for the certificate (Use semicolons to separate multiple subject alternative names.) | -| Valid period | The unit of measure for the period of time the certificate is considered valid (in other words, days, months, or years) | -| Valid period units | The number of units of time that the certificate is considered valid (Use this setting with the **Valid Period** setting. For example, if this setting is **3** and **Valid Period** is **Years**, the certificate is valid for 3 years.) | -| Custom text to show in Microsoft Passport PIN prompt | The custom text to show on the Microsoft Passport PIN prompt during certificate enrollment | -| Thumbprint | The current certificate thumbprint, if certificate enrollment succeeds | -  -In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. Table 9 lists the Windows 10 Mobile PFX certificate deployment settings. - -Table 9. Windows 10 Mobile PFX certificate deployment settings - -| Setting | Description | -|-----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Private key storage | Where to store the private key (in other words, the TPM, a software KSP, or the Microsoft Passport KSP) | -| Microsoft Passport container name | The tenant identifier of the Azure AD tenant from which the Microsoft Passport is derived, required only if you select **Microsoft Passport KSP** in **Private key storage** | -| PFX packet | The PFX packet with the exported and encrypted certificates and keys in Binary64 format | -| PFX packet password | The password that protects the PFX blob specified in **PFX packet** | -| PFX packet password encryption | Whether the MDM system encrypts the PFX certificate password with the MDM certificate | -| PFX private key export | Whether the PFX private key can be exported | -| Thumbprint | The thumbprint of the installed PFX certificate | -  -Use the **Allow Manual Root Certificate Installation** setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. - ->**Note:**  To diagnose certificate-related issues on Windows 10 Mobile devices, use the free [Certificates app](http://go.microsoft.com/fwlink/p/?LinkId=723996) in Windows Store. This Windows 10 Mobile app can help you: - -- View a summary of all personal certificates. -- View the details of individual certificates. -- View the certificates used for VPN, Wi-Fi, and email authentication. -- Identify which certificates may have expired. -- Verify the certificate path and confirm that you have the correct intermediate and root CA certificates. -- View the certificate keys stored in the device TPM. -  -### Wi-Fi - -People use Wi-Fi on their mobile devices as much as or more than cellular data. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but you can use your MDM system to fully configure Wi-Fi settings without user intervention. - -Table 10 lists the Windows 10 Mobile Wi-Fi connection profile settings. Use the information in this table to help you create Wi-Fi connection profiles in your MDM system. - -Table 10. Windows 10 Mobile Wi-Fi connection profile settings +Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device will Auto Scan for available updates. However, depending on the device’s network and power status, update methods and timing will vary. --++++++ - - - - - - - - + + + + + + - - + + + + + - - + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + +
    SettingDescription
    SSIDThe case-sensitive name of the Wi-Fi network (service set identifier [SSID])Network connectionDescriptionAuto ScanAuto DownloadAuto InstallAuto Restart
    Security typeThe type of security the Wi-Fi network uses; can be one of the following authentication types: -
      -

    • Open 802.11

      • -

    • Shared 802.11

      • -

    • WPA-Enterprise 802.11

      • -

    • WPA-Personal 802.11

      • -

    • WPA2-Enterprise 802.11

      • -

    • WPA2-Personal 802.11

      • -
    		Wi-FiDevice is connected to a personal or corporate Wi-Fi network (no data charges)YesYes/td> +YesYes – outside of Active Hours (forced restart after 7 days if user postpones restart)
    Authentication encryptionThe type of encryption the authentication uses; can be one of the following encryption methods: -
      -

    • None (no encryption)

      • -

    • Wired Equivalent Privacy

      • -

    • Temporal Key Integrity Protocol

      • -

    • Advanced Encryption Standard (AES)

      • -
    		CellularDevice is only connected to a cellular network (standard data charges apply)Will skip a daily scan if scan was successfully completed in the last 5 daysWill only occur if update package is small and does not exceed the mobile operator data limit or the user clicks “download now”.Yes, if the user clicked “download now”Idem
    Extensible Authentication Protocol Transport Layer Security (EAP-TLS)WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use EAP-TLS with certificates for authentication
    Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MSCHAPv2)WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use PEAP-MSCHAPv2 with a user name and password for authentication
    Shared keyWPA-Personal 802.11 and WPA2-Personal 802.11 security types can use a shared key for authentication.
    ProxyThe configuration of any network proxy that the Wi-Fi connection requires (To specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address.)
    Disable Internet connectivity checksWhether the Wi-Fi connection should check for Internet connectivity
    Proxy auto-configuration URLA URL that specifies the proxy auto-configuration file
    Enable Web Proxy Auto-Discovery Protocol (WPAD)Specifies whether WPAD is enabledCellular -- RoamingDevice is only connected to a cellular network and roaming charges applyNoNoNoIdem
    -  -Table 11 lists the Windows 10 Mobile settings for managing Wi-Fi connectivity. -Table 11. Windows 10 Mobile Wi-Fi connectivity settings +**Keeping track of updates releases** -| Setting | Configuration | -|--------------------------------------------|----------------------------------------------------------------------------| -| Allow Auto Connect To Wi-Fi Sense Hotspots | Whether the device will automatically detect and connect to Wi-Fi networks | -| Allow Manual Wi-Fi Configuration | Whether the user can manually configure Wi-Fi settings | -| Allow Wi-Fi | Whether the Wi-Fi hardware is enabled | -| WLAN Scan Mode | How actively the device scans for Wi-Fi networks | -  -### Proxy +*Applies to: Corporate and Personal devices* -Apps running on Windows 10 Mobile (for example, Microsoft Edge) can use proxy connections to access Internet content, but Wi-Fi connections on the corporate intranet most typically use proxy connections, instead. You can define multiple proxies in Windows 10 Mobile. +Microsoft publishes new feature updates for Windows 10 and Windows 10 Mobile on a regular basis. The [Windows release information page](https://technet.microsoft.com/en-us/windows/release-info) is designed to help you determine if your devices are current with the latest Windows 10 feature and quality updates. The release information published on this page, covers both Windows 10 for PCs and Windows 10 Mobile. In addition, the [Windows update history page](http://windows.microsoft.com/en-us/windows-10/update-history-windows-10) helps you understand what these updates are about. ->**Note:**  Windows 10 Mobile also supports proxy auto-configuration (PAC) files, which can automatically configure proxy settings. The Web Proxy Auto-Discovery Protocol (WPAD) lets apps use Dynamic Host Configuration Protocol and Domain Name System (DNS) lookups to locate the PAC file. -  -Table 12 lists the Windows 10 Mobile settings for proxy connections. +>**Note:** +We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback via the Feedback Hub -Table 12. Windows 10 Mobile proxy connection settings +**Windows as a Service** + +*Applies to: Corporate and Personal devices* + +Microsoft created a new way to deliver and install updates to Windows 10 Mobile directly to devices without Mobile Operator approval. This capability helps to simplify update deployments and ongoing management, broadens the base of employees who can be kept current with the latest Windows features and experiences, and lowers total cost of ownership for organizations who no longer have to manage updates to keep devices secure. + +Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the chart below: --+++++ - - - - - - - - + + + + + - - + + + + - - + + + + + - - - - - - - - - - - - - - - - - - + + + + +
    SettingsConfiguration
    Proxy nameThe unique name of the proxy connectionServicing optionAvailability of new features for installationMinimum length of servicing lifetimeKey benefitsSupported editions
    Proxy IDThe unique identifier for the proxy connectionWindows Insider BuildsAs appropriate during development cycle, released to Windows Insiders onlyVariable, until the next Insider build is released to Windows InsidersAllows Insiders to test new feature and application compatibility before a Feature Update is released/td> +Mobile
    NameThe user-friendly name of the proxy connectionCurrent Branch (CB)Immediately after the Feature Update is published to Windows Update by MicrosoftMicrosoft typically releases two Feature Updates per 12-month period (approximately every four months, though it can potentially be longer)Makes new features available to users as soon as possibleMobile & Mobile Enterprise
    Server addressThe address of the proxy server, which can be the server FQDN or IP address
    IP address typeThe IP address type that identifies the proxy server, which can be one of the following values: -
      -

    • IPV4

      • -

    • IPV6

      • -

    • E164

      • -

    • ALPHA

      • -
    Proxy connection typeThe proxy connection type, which can be one of the following values: -
      -

    • ISA

      • -

    • WAP

      • -

    • SOCKS

      • -

    • NULL

      • -
    PortsThe port information for the proxy connection; includes the following settings: -
      -

    • Port Name. The unique name of a port that the proxy connection uses, such as PORT0 or PORT1

      • -

    • Port Name/Port Nbr. The proxy connection port number for this port

      • -

    • Port Name/Services. The services that use this proxy connection port

      • -

    • Services/Service Name. The name of a service that uses the proxy connection

      • -

    • Services/Service Name/Service Name. The protocol associated with the parent port connection

      • -
    Configuration referenceThe connection reference information for the proxy connection. The corporation determines the information in this optional setting.Current Branch for Business (CBB)A minimum of four months after the corresponding Feature Update is first published to Windows Update by MicrosoftA minimum of four months, though it potentially can be longerNoProvides additional time to test new feature before deploymentMobile Enterprise only
    -  -### VPN -In addition to Wi-Fi, users often use a VPN to securely access apps and resources on their company’s intranet behind a firewall. Windows 10 Mobile supports several VPN vendors in addition to native Microsoft VPNs (such as Point to Point Tunneling Protocol \[PPTP\], Layer 2 Tunneling Protocol \ -[L2TP\], and Internet Key Exchange Protocol version 2 \[IKEv2\]), including: +**Enterprise Edition** -- IKEv2 -- IP security -- SSL VPN connections (which require a downloadable plug-in from the VPN server vendor) +*Applies to: Corporate devices* -You can configure Windows 10 Mobile to use auto-triggered VPN connections, as well. You define a VPN connection for each app that requires intranet connectivity. When users switch between apps, the operating system automatically establishes the VPN connection for that app. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. +While Windows 10 Mobile provides updates directly to user devices from Windows Update, there are many organizations that want to track, test, and schedule updates to corporate devices. To support these requirements, we created the Windows 10 Mobile Enterprise edition. -With always-on VPN, Windows 10 Mobile can automatically start a VPN connection when a user signs-in, as well. The VPN stays connected until the user manually disconnects it. -MDM support for VPN connections in Windows 10 Mobile includes provisioning and updating VPN connection profiles and associating VPN connections with apps. You can create and provision VPN connection profiles, and then deploy them to managed devices that run Windows 10 Mobile. Table 13 lists the Windows 10 Mobile fields for VPN connection profiles. +Upgrading to Windows 10 Mobile Enterprise edition provides additional device and app management capabilities for organizations that want to: +- **Defer, approve and deploy feature and quality updates:** Windows 10 Mobile devices get updates directly from Windows Update. If you want to curate updates prior to deploying them, an upgrade to Windows 10 Mobile Enterprise edition is required. Once Enterprise edition is enabled, the phone can be set to the Current Branch for Business servicing option, giving IT additional time to test updates before they are released. +- **Deploy an unlimited number of self-signed LOB apps to a single device:** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device. To deploy more than 20 self-signed LOB apps, Windows 10 Mobile Enterprise is required. +- **Set the telemetry level:** Microsoft collects telemetry data to help keep Windows devices secure and to help Microsoft improve the quality of Windows and Microsoft services. An upgrade to Windows 10 Mobile Enterprise edition is required to set the telemetry level so that only telemetry information required to keep devices secured is gathered. -Table 13. Windows 10 Mobile VPN connection profile settings +To learn more about telemetry, visit [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). + +To activate Windows 10 Mobile Enterprise, use your MDM system or a provisioning package to inject the Windows 10 Enterprise license on a Windows 10 Mobile device. Licenses can be obtained from the Volume Licensing portal. For testing purposes, you can obtain a licensing file from the MSDN download center. A valid MSDN subscription is required. + +Details on updating a device to Enterprise edition with [WindowsLicensing CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904983(v=vs.85).aspx) + +>**Recommendation:** Microsoft recommends using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices. + +**Deferring and Approving Updates with MDM** + +*Applies to: Corporate devices with Enterprise edition* + +Once a device is upgraded to Windows 10 Mobile Enterprise edition, you can manage devices that receive updates from Windows Update (or Windows Update for Business) with a set of update policies. + +To control Feature Updates, you will need to move your devices to the Current Branch for Business (CBB) servicing option. A device that subscribes to CBB will wait for the next CBB to be published by Microsoft Update. While the device will wait for Feature Updates until the next CBB, Quality Updates will still be received by the device. + +To control monthly Quality Update additional deferral policies, need to be set to your desired deferral period. When Quality Updates are available for your Windows 10 Mobile devices from Windows Update, these updates will not install until your deferral period lapses. This gives IT Professionals some time to test the impact of the updates on devices and apps. + +Before updates are distributed and installed, you may want to test them for issues or application compatibility. IT pros have the ability require updates to be approved. This enables the MDM administrator to select and approve specific updates to be installed on a device and accept the EULA associated with the update on behalf of the user. Please remember that on Windows 10 Mobile all updates are packaged as a “OS updates” and never as individual fixes. + +You may want to choose to handle Quality Updates and Feature Updates in the same way and not wait for the next CBB to be released to your devices. This streamlines the release of updates using the same process for approval and release. You can apply different deferral period by type of update. In version 1607 Microsoft added additional policy settings to enable more granularity to control over updates. + +Once updates are being deployed to your devices, you may want to pause the rollout of updates to enterprise devices. +For example, after you start rolling out a quality update, certain phone models are adversely impacted or users are reporting a specific LOB app is not connecting and updating a database. Problems can occur that did not surface during initial testing. +IT professionals can pause updates to investigate and remediate unexpected issues. + +The following table summarizes applicable update policy settings by version of Windows 10 Mobile. All policy settings are backward compatible, and will be maintained in future Feature Updates. Consult the documentation of your MDM system to understand support for these settings in your MDM. --+++ - - - - - - - - + + + - - + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + +
    SettingDescription
    Native VPN protocol profile

    The configuration information when the VPN uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP); includes the following settings:

    -
      -

    • Servers. The VPN server for the VPN profile

      • -

    • Routing policy type. The type of routing policy the VPN profile uses; can be set to one of the following values:

      -
        -

      • Split tunnel. Only network traffic destined to the intranet goes through the VPN connection.

        • -

      • Force tunnel. All traffic goes through the VPN connection.

        • -
      • -

    • Tunneling protocol type. The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols; can be one the following values:

      -
        -

      • PPTP

        • -

      • L2TP

        • -

      • IKEv2

        • -

      • Automatic

        • -
      • -

    • User authentication method. The user authentication method for the VPN connection; can have a value of EAP or MSChapv2. Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections.

      • -

    • Machine certificate. The machine certificate used for IKEv2-based VPN connections.

      • -

    • EAP configuration. An HTML-encoded XML blob of the EAP configuration. For more information about creating the EAP configuration XML blob, see [EAP configuration](http://go.microsoft.com/fwlink/p/?LinkId=734055). You can use the XML blob these steps create in the MDM system to create the VPN profile.

      • -
    		Activity (Policy)Version 1511 settingsVersion 1607 settings
    VPN plugin profileWindows Store–based VPN plug-ins for the VPN connection; includes the following settings: -
      -

    • VPN servers. A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address.

      • -

    • Custom configuration. An HTML-encoded XML blob for SSL–VPN plug-in–specific configuration information (e.g., authentication information) that the plug-in provider requires.

      • -

    • Windows Store VPN plugin family name. Specifies the Windows Store package family name for the Windows Store–based VPN plug-in.

      • -
    		Subscribe device to CBB, to defer Feature UpdatesRequireDeferUpgrade + +Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers feature update for minimum of 4 months after Current Branch was release.BranchReadinessLevel + +Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers feature update for minimum of 4 months after Current Branch was release.
    Defer UpdatesDeferUpdatePeriod + +Defer Quality Updates for 4 weeks or 28 daysDeferQualityUpdatePeriodInDays + +Defer Feature and Quality Updates for up to 30 days.
    Approve UpdatesRequireUpdateApproval + +RequireUpdateApproval + +
    Always on connectionWhether the VPN connects at user sign-in and stays connected until the user manually disconnects the VPN connection.
    App trigger listA list of apps that automatically initiate the VPN connection. Each app trigger in the list includes the following settings: -
      -

    • App ID. The app identity for the app that automatically initiates the VPN connection Any apps in this list can send data through the VPN connection; set it to one of the following values:

      -
        -

      • Unique name of the Windows Store app (Package Family Name). The package family name is a unique name for each app. For example, the package family name for the Skype app is Microsoft.SkypeApp_kzf8qxf38zg5c.

        • -

      • Fully qualified path to the app (such as C:\Windows\System\Notepad.exe).

        • -

      • Kernel driver name.

        • -
      • -
    DNS suffixesA comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List.
    LockDown VPN profileWhether this VPN connection is a LockDown profile. A LockDown VPN profile has the following characteristics: -
      -

    • It is an always-on VPN profile.

      • -

    • It can never be disconnected.

      • -

    • If the VPN profile is not connected, the user has no network connectivity.

      • -

    • No other VPN profiles can be connected or modified.

      • -
    -

    You must delete a LockDown VPN profile before you can add, remove, or connect other VPN profiles.

    Name Resolution Policy Table rulesA list of Name Resolution Policy Table rules for the VPN connection. Each rule in the list includes the following settings: -
      -

    • Domain name. The namespace for the policy; can be an FQDN or a domain suffix.

      • -

    • Domain name type. The type of namespace in Domain name; has a value of either FQDN or Suffix.

      • -

    • DNS servers. A comma-separated list of DNS server IP addresses to use for the namespace specified in Domain name.

      • -

    • Web proxy servers. The IP address for the web proxy server (if the intranet redirects traffic through a web proxy server).

      • -
    ProxyAny post connection proxy support required for the VPN connection; includes the following settings: -
      -

    • Proxy server. Specifies the fully qualified host name or IP address of the proxy server when a specific proxy server is required.

      • -

    • Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings.

      • -
    Remember credentialsWhether the VPN connection caches credentials.
    Route listA list of routes to add to the routing table for the VPN connection. Each route in the list includes the following settings: -
      -

    • Address. The destination subnet address in IPv4 or IPv6 format (such as 192.168.0.0).

      • -

    • Prefix size. The portion of the address used to identify the destination subnet address (such as 16 to produce the subnet 192.168.0.0/16).

      • -
    Traffic filter listA list of traffic rules that define the traffic that can be sent through the VPN connection. Each rule in the list includes the following settings: -
      -

    • App ID. The app identity for the traffic filter based on a specific app (app-based traffic filter). Any apps in this list can send data through the VPN connection; set to one of the following values:

      -
        -

      • Unique name of the Windows Store app (Package Family Name). The package family name is a unique name for each app. For example, the package family name for the Skype app is Microsoft.SkypeApp_kzf8qxf38zg5c.

        • -

      • Fully qualified path to the app (such as C:\Windows\System\Notepad.exe).

        • -

      • Kernel driver name.

        • -
      • -

    • Protocol. The IP protocol to use for the traffic filter rule (for example, TCP = 6, UDP = 17).

      • -

    • Local port ranges. Specifies a comma-separated list of local IP port ranges (for example, 100–180, 200, 300–350).

      • -

    • Remote port ranges. A comma-separated list of remote IP port ranges (for example, 100–180, 200, 300–350).

      • -

    • Local address ranges. A comma-separated list of local IP address ranges that are allowed to use the VPN connection (for example, 192.168.0.1–192.168.0.255, 172.16.10.0–172.16.10.255).

      • -

    • Remote address ranges. A comma-separated list of remote IP address ranges that are allowed to use the VPN connection (for example, 192.168.0.1–192.168.0.255, 172.16.10.0–172.16.10.255).

      • -

    • Routing policy type. The type of IP tunnel for the VPN connection; set to one of the following:

      -
        -

      • Split tunnel. Only traffic destined for the intranet is sent through the VPN connection.

        • -

      • Force tunnel. All traffic is sent through the VPN connection.

        • -
      • -
    Trusted network detectionA comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible.Pause Update rollout once an approved update is being deployed, pausing the rollout of the update.PauseDeferrals + +Pause Feature Updates for up to 35 daysPauseQualityUpdates + +Pause Feature Updates for up to 35 days
    -  -Table 14 lists the Windows 10 Mobile settings for managing VPN connections. These settings help you manage VPNs over cellular data connections, which in turn help reduce costs associated with roaming or data plan charges. - -Table 14. Windows 10 Mobile VPN management settings - -| Setting | Description | -|--------------------------------------|---------------------------------------------------------------------------------| -| Allow VPN | Whether users can change VPN settings | -| Allow VPN Over Cellular | Whether users can establish VPN connections over cellular networks | -| Allow VPN Over Cellular when Roaming | Whether users can establish VPN connections over cellular networks when roaming | -  -### APN profiles - -An APN defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. - -An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. Corporations in Europe and the Asia-Pacific use APNs, but they are not common in the United States. - -You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. Table 15 lists the MDM settings that Windows 10 Mobile supports for APN profiles. - -Table 15. Windows 10 Mobile APN profile settings - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription
    APN nameThe APN name
    IP connection typeThe IP connection type; set to one of the following values: -
      -

    • IPv4 only

      • -

    • IPv6 only

      • -

    • IPv4 and IPv6 concurrently

      • -

    • IPv6 with IPv4 provided by 46xlat

      • -
    LTE attachedWhether the APN should be attached as part of an LTE Attach
    APN class IDThe globally unique identifier that defines the APN class to the modem
    APN authentication typeThe APN authentication type; set to one of the following values: -
      -

    • None

      • -

    • Auto

      • -

    • PAP

      • -

    • CHAP

      • -

    • MSCHAPv2

      • -
    User nameThe user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type
    PasswordThe password for the user account specified in User name
    Integrated circuit card IDThe integrated circuit card ID associated with the cellular connection profile
    -  -### Data leak protection - -Some user experiences can risk corporate data stored on corporate devices. For example, allowing users to copy and paste information out of the organization’s LOB app can put data at risk. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data -and prevent data leaks. For example, you can prevent settings synchronization, copy-and-paste operations, and screen captures. Table 16 lists the MDM settings in Windows 10 Mobile that you can use to help prevent data leaks. - -Table 16. Windows 10 Mobile data leak protection settings - -| Setting | Description | -|----------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Allow copy and paste | Whether users can copy and paste content | -| Allow Cortana | Whether users can use Cortana on the device, where available | -| Allow device discovery | Whether the device discovery user experience is available on the lock screen (For example, this setting can control whether a device could discover a projector \[or other devices\] when the lock screen is displayed.) | -| Allow input personalization | Whether personally identifiable information can leave the device or be saved locally (for example, Cortana learning, inking, dictation) | -| Allow manual MDM unenrollment | Whether users are allowed to delete the workplace account (in other words, unenroll the device from the MDM system) | -| Allow screen capture | Whether users are allowed to capture screenshots on the device | -| Allow SIM error dialog prompt | Specifies whether to display a dialog prompt when no SIM card is installed | -| Allow sync my settings | Whether the user experience settings are synchronized between devices (works with Microsoft accounts only) | -| Allow toasts notifications above lock screen | Whether users are able to view toast notification on the device lock screen | -| Allow voice recording | Whether users are allowed to perform voice recordings. | -  -### Storage management - -Protecting the apps and data stored on a device is critical to device security. One method for helping protect your apps and data is to encrypt internal device storage by using the device encryption in Windows 10 Mobile. This encryption helps protect corporate data against unauthorized access, even when an unauthorized user has physical possession of the device. - -A feature in Windows 10 Mobile is the ability to install apps on a secure digital (SD) card. The operating system stores apps on a partition specifically designated for that purpose. This feature is always on, so you don’t need to set a policy explicitly to enable it. -The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. -You can disable the **Allow Storage Card** setting to prevent users from using SD cards altogether, but the primary advantage of the SD card app partition–encryption feature is that organizations can give users the flexibility to use an SD card while still protecting the confidential apps and data on it. - -If you don’t encrypt storage, you can help protect your corporate apps and data by using the **Restrict app data to the system volume** and **Restrict apps to the system volume** settings. They help ensure that users cannot copy your apps and data to SD cards. - -Table 17 lists the MDM storage-management settings that Windows 10 Mobile provides. - -Table 17. Windows 10 Mobile storage management settings - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription
    Allow Storage CardWhether users can use storage cards for device storage (This setting does not prevent programmatic access to the storage cards.)
    Require Device EncryptionWhether internal storage is encrypted (When a device is encrypted, you cannot use a policy to turn encryption off.)
    Encryption methodSpecifies the BitLocker drive encryption method and cipher strength; can be one of the following values: -
      -

    • AES-Cipher Block Chaining (CBC) 128-bit

      • -

    • AES-CBC 256-bit

      • -

    • XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default)

      • -

    • XTS-AES-256-bit

      • -
    Allow Federal Information Processing Standard (FIPS) algorithm policyWhether the device allows or disallows the FIPS algorithm policy
    SSL cipher suitesSpecifies a list of the allowed cryptographic cipher algorithms for SSL connections
    Restrict app data to the system volumeSpecifies whether app data is restricted to the system drive
    Restrict apps to the system volumeSpecifies whether apps are restricted to the system drive
    -  -## App management - -Apps help improve user productivity on mobile devices. New to Windows 10 is the ability for organizations purchase apps from Windows Store for their employees and deploy those apps from Windows Store or an MDM system. App management is becoming a key capability of MDM systems, helping reduce the effort required to perform common app-related tasks, such as distributing apps, and protecting data through app policies. This section describes the app management features in Windows 10 Mobile and includes the following topics: - -- [Universal Windows Platform (UWP)](#uwp) -- [Sourcing the right app](#sourcing) -- [Windows Store for Business](#store) -- [Mobile application management (MAM) policies](#mam) -- [Microsoft Edge](#edge) - -### Universal Windows Platform - -Windows 10 introduces UWP, converging the application platform for all devices running some edition of Windows 10. UWP apps run without modification on all editions of Windows 10, and Windows Store now has apps that you can license and purchased for all your Windows 10 devices. Windows Phone 8.1 and Windows 8.1 apps still run on Windows 10 devices, but the MAM improvements in Windows 10 work only with UWP apps. See the [Guide to Universal Windows Platform (UWP) apps](http://go.microsoft.com/fwlink/p/?LinkId=734056) for additional information. - -### Sourcing the right app - -The first step in app management is to obtain the apps your users need, and you can now acquire apps from Windows Store. Developers can also create apps specific to an organization, known as *line-of-business (LOB) apps* (the developers of these apps are *LOB publishers*). An LOB developer (internal or external) can now publish these apps to Windows Store at your request, or you can obtain the app packages offline and distribute them through your MDM system. - -To install Windows Store or LOB apps, use the Windows Store cloud service or your MDM system to distribute the app packages. Your MDM system can deploy apps online by redirecting the user to a licensed app in Windows Store or offline by distributing a package that you downloaded from Windows Store (also called *sideloading*) on Windows 10 Mobile devices. You can fully automate the app deployment process so that no user intervention is required. - -IT administrators can obtain apps through Store for Business. Most apps can be distributed online, meaning that the user must be logged in to the device with an Azure AD account and have Internet access at the time of installation. To distribute an app offline, the developer must opt in. If the app developer doesn’t allow download of the app from Windows Store, then you must obtain the files directly from the developer or use the online method. See [Windows Store for Business](windows-store-for-business.md) for additional information about apps obtained through Store for Business. -Windows Store apps are automatically trusted. For custom LOB apps developed internally or by a trusted software vendor, ensure that the device trusts the app signing certificate. There are two ways to establish this trust: use a signing certificate from a trusted source, or generate your own signing certificate and add your chain of trust to the trusted certificates on the device. You can install up to 20 self-signed apps on a Windows 10 Mobile device. When you purchase a signing certificate from a public CA, you can install more than 20 apps on a device, although you can install more than 20 self-signed apps per device with [Windows 10 Mobile Enterprise](#mobile-edition). - -Users can install apps from Windows Store that the organization purchases through the Store app on their device. If you allow your users to log in with a Microsoft account, the Store app on the device provides a unified method for installing personal and corporate apps. - -### Store for Business - -[Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) is a web portal that IT pros and purchasers use to find, acquire, manage, and distribute apps to Windows 10 devices. This online portal gives Azure AD authenticated managers access to Store for Business functionality and settings. Store managers can create a private section of Windows Store in which organizations can manage apps specific and private to them. Store for Business allows organizations to make apps available to their users and purchase app licenses for them. They can also integrate their Store for Business subscriptions with their MDM systems, so the MDM system can deploy apps from their free Store for Business subscription. - -The process for using Store for Business is as follows: - -1. Create a Store for Business subscription for your organization. -2. In the Store for Business portal, acquire apps from Windows Store (only free apps are available at this time). -3. In Store for Business, distribute apps to users, and manage the app licenses for the apps acquired in the previous step. -4. Integrate your MDM system with your organization’s Store for Business subscription. -5. Use your MDM system to deploy the apps. - -For more information about Store for Business, see [Windows Store for Business](windows-store-for-business.md). - -### Mobile application management (MAM) policies - -With MDM, you can manage Device Guard on Windows 10 Mobile and create an allow (whitelist) or deny (blacklist) list of apps. This capability extends to built-in apps, as well, such as phone, text messaging, email, and calendar. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. - -You can also control users’ access to Windows Store and whether the Store service updates apps automatically. You can manage all these capabilities through your MDM system. Table 18 lists the Windows 10 Mobile app management settings. - -Table 18. Windows 10 Mobile app management settings - -| Setting | Description | -|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Allow All Trusted Apps | Whether users can sideload apps on the device | -| Allow App Store Auto Update | Whether automatic updates of apps from Windows Store are allowed | -| Allow Developer Unlock | Whether developer unlock is allowed | -| Allow Shared User App Data | Whether multiple users of the same app can share data | -| Allow Store | Whether Windows Store app is allowed to run | -| Allow Windows Bridge For Android App Execution | Whether the Windows Bridge for Android app is allowed to run | -| Application Restrictions | An XML blob that defines the app restrictions for a device (The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher.) | -| Require Private Store Only | Whether the private store is exclusively available to users (If enabled, only the private store is available. If disabled, the retail catalog and private store are both available.) | -| Restrict App Data To System Volume | Whether app data is allowed only on the system drive | -| Restrict App To System Volume | Whether app installation is allowed only to the system drive | -| Start screen layout | An XML blob used to configure the Start screen (See [Start layout for Windows 10 Mobile editions](http://go.microsoft.com/fwlink/p/?LinkId=734057) for more information.) | -  -One potential security issue is that users can register as Windows 10 Mobile app developers and turn on developer features on their device, potentially installing apps from unknown sources and opening the device to malware threats. To prevent users from turning on developer features on their devices, set the **Disable development unlock (side loading)** policy, which you can configure through your MDM system. - -### Microsoft Edge - -MDM systems give you the ability to manage Microsoft Edge on mobile devices. Table 19 lists the Microsoft Edge settings for Windows 10 Mobile. - -Table 19. Microsoft Edge settings for Windows 10 Mobile - -| Setting | Description | -|-------------------------------------------------|-------------------------------------------------------------------------------------------------------| -| Allow Active Scripting | Whether active scripting is allowed | -| Allow Autofill | Whether values are automatically filled on websites | -| Allow Browser | Whether Internet Explorer is allowed on the device | -| Allow Cookies | Whether cookies are allowed | -| Allow Do Not Track headers | Whether Do Not Track headers are allowed | -| Allow InPrivate | Whether users can use InPrivate browsing | -| Allow Password Manager | Whether users can use Password Manager to save and manage passwords locally | -| Allow Search Suggestions in Address Bar | Whether search suggestions are shown in the address bar | -| Allow SmartScreen | Whether SmartScreen Filter is enabled | -| First Run URL | The URL to open when a user launches Microsoft Edge for the first time | -| Prevent Smart Screen Prompt Override For Files | Whether users can override the SmartScreen Filter warnings about downloading unverified files | -  -## Device operations - -In this section, you learn how MDM settings in Windows 10 Mobile enable the following scenarios: - -- [Device update](#device-update) -- [Device compliance monitoring](#device-comp) -- [Device inventory](#data-inv) -- [Remote assistance](#remote-assist) -- [Cloud services](#cloud-serv) - -### Device update - -To help protect mobile devices and their data, you must keep those devices updated. Windows Update automatically installs updates and upgrades when they become available. - -The device update features described in this section are available only in [Windows 10 Mobile Enterprise](#mobile-edition). You can use your MDM system to postpone system upgrades when you activate an Enterprise license on managed Windows 10 Mobile devices and control how updates and upgrades are applied. For example, you can disable updates altogether, defer updates and upgrades, and schedule the day and time to install updates, as you would with Windows Server Update Services (WSUS) on Windows 10 desktops running the [Current Branch for Business](introduction-to-windows-10-servicing.md). -Table 20 lists the Windows 10 Mobile Enterprise settings that you can use to configure updates and upgrades. - -Table 20. Windows 10 Mobile Enterprise update management settings - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription
    Allow automatic updateThe automatic update behavior for scanning, downloading, and installing updates; the behavior can be one of the following: -
      -

    • Notify users prior to downloading updates.

      • -

    • Automatically install updates, and then notify users to schedule a restart (this is the default behavior).

      • -

    • Automatically install and restart devices with user notification.

      • -

    • Automatically install and restart devices at a specified time.

      • -

    • Automatically install and restart devices without user interaction.

      • -

    • Turn off automatic updates.

      • -
    Allow non Microsoft signed updateWhether automatic updates will accept updates that entities other than Microsoft have signed
    Allow update serviceWhether devices can obtain updates from Windows Update, WSUS, or Windows Store
    Monthly security updates deferredWhether monthly updates (for example, security patches) are deferred (You can defer updates up to 4 weeks.)
    Nonsecurity upgrades deferredWhether nonsecurity upgrades are deferred (You can defer upgrades up to 4 weeks.)
    Pause update deferralsWhether the device should skip an update cycle (This setting is valid only when you configure devices to defer updates or upgrades.)
    Require update approvalWhether approval is required before updates can be installed on devices (If approval is required, any updates that have an End User License Agreement [EULA] are automatically accepted on the user’s behalf.)
    Schedule install timeThe scheduled time at which updates are installed
    Scheduled install dayThe schedule of days on which updates are installed
    Update deferral periodHow long updates should be deferred
    Update service URLThe name of a WSUS server from which to download updates instead of Windows Update
    Upgrade deferral periodHow long Windows 10 Mobile upgrades should be deferred
    -  -In addition to configuring how Windows 10 Mobile Enterprise obtains updates, you can manage individual Windows 10 Mobile updates. Table 21 provides information about approved updates to help you control the rollout of new updates to Windows 10 Mobile Enterprise devices. - -Table 21. Windows 10 Mobile Enterprise approved update information - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription
    Approved updatesA list of approved updates. Each update in the list includes the Approved Time setting, which specifies the update approval time. Any approved updates automatically accept EULAs on behalf of users.
    Failed updatesA list of updates that failed during installation. Each update in the list includes the following settings: -
      -

    • H Result. The update failure code

      • -

    • Status. The failed update state (for example, download, install)

      • -
    Installed updatesA list of updates that are installed on the device.
    Installable updatesA list of updates that are available for installation. Each update in the list includes the following settings: -
      -

    • Type. The type of update available for installation, set to one of the following values:

      -
        -

      • 0 (no type)

        • -

      • 1 (security)

        • -

      • 2 (critical)

        • -
      • -

    • Revision Number. The revision number for the update used to get metadata for the update during synchronization.

      • -
    Pending reboot updatesA list of updates that require a restart to complete update installation. Each update in the last has the Installed Time setting enabled, which specifies installation time for the update.
    Last successful scan timeThe last time a successful update scan was completed.
    Defer upgradeWhether the upgrade is deferred until the next update cycle.
    -  - -### Device compliance monitoring - -You can use your MDM system to monitor compliance. Windows 10 Mobile provides audit information to track issues or perform remedial actions. This information helps you ensure that devices are configured to comply with organizational standards. - -You can also assess the health of devices that run Windows 10 Mobile and take enterprise policy actions. The process that the health attestation feature in Windows 10 Mobile uses is as follows: - -1. The health attestation client collects data used to verify device health. -2. The client forwards the data to the Health Attestation Service (HAS). -3. The HAS generates a Health Attestation Certificate. -4. The client forwards the Health Attestation Certificate and related information to the MDM system for verification. - -For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). - -Depending on the results of the health state validation, an MDM system can take one of the following actions: - -- Allow the device to access resources. -- Allow the device to access resources but identify the device for further investigation. -- Prevent the device from accessing resources. - -Table 21 lists data points that the HAS collects and evaluates from devices that run Windows 10 Mobile to determine the action to perform. For most of these data points, the MDM system can take one of the following actions: - -- Disallow all access. -- Disallow access to high-business-impact assets. -- Allow conditional access based on other data points that are present at evaluation time—for example, other attributes on the health certificate or a device’s past activities and trust history. -- Take one of the previous actions, and also place the device on a watch list to monitor it more closely for potential risks. -- Take corrective action, such as informing IT administrators to contact the owner and investigate the issue. - -Table 21. Windows 10 Mobile HAS data points - -| Data point | Description | -|----------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Attestation Identity Key (AIK) present | Indicates that an AIK is present (in other words, the device can be trusted more than a device without an AIK). | -| Data Execution Prevention (DEP) enabled | Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. | -| BitLocker status | BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker. | -| Secure Boot enabled | Whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. | -| Code integrity enabled | Whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. | -| Safe mode | Whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. | -| Running Windows Preinstallation Environment (Windows PE) | Whether the device is running Windows PE. A device running Windows PE isn’t as secure as a device running Windows 10 Mobile. | -| Boot debug enabled | Whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. | -| OS kernel debugging enabled | Whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. | -| Test signing enabled | Whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. | -| Boot Manager Version | The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted). | -| Code integrity version | Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). | -| Secure Boot Configuration Policy (SBCP) present | Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. | -| Boot cycle whitelist | The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant. | -  -### Device inventory - -Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely, and you can use the system’s reporting capabilities to analyze device resources and information. With this information, you can determine the current hardware and software resources of the device (for example, installed updates). - -Table 22 lists examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide. - -Table 22. Windows 10 Mobile software and hardware inventory examples - -| Setting | Description | -| - | - | -| Installed enterprise apps | List of the enterprise apps installed on the device | -| Device name | The device name configured for the device | -| Firmware version | Version of firmware installed on the device | -| Operating system version | Version of the operating system installed on the device | -| Device local time | Local time on the device | -| Processor type | Processor type for the device | -| Device model | Model of the device as defined by the manufacturer | -| Device manufacturer | Manufacturer of the device | -| Device processor architecture | Processor architecture for the device | -| Device language | Language in use on the device | -| Phone number | Phone number assigned to the device | -| Roaming status | Indicates whether the device has a roaming cellular connection | -| International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) | Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user | | IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device | -| Wi-Fi media access control (MAC) address | MAC address assigned to the Wi-Fi adapter in the device | -| Wi-Fi DNS suffix and subnet mask | DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device | -| Secure Boot state | Indicates whether Secure Boot is enabled | -| Enterprise encryption policy compliance | Indicates whether the device is encrypted | -  -### Remote assistance - -The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: - -- **Remote lock.** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it but not immediately (for example, leaving the device at a customer site). -- **Remote PIN reset.** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost, and users are able to gain access to their devices quickly. -- **Remote ring.** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. -- **Remote find.** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. To configure Windows 10 Mobile remote find, use the settings in Table 23. The remote find feature returns the most current latitude, longitude, and altitude of the device. + +**Managing the Update Experience** + +*Applies to: Corporate devices with Enterprise edition* + +Set update client experience with [Allowautomaticupdate](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_AllowAutoUpdate) policy for your employees. This allows the IT Pro to influence the way the update client on the devices behaves when scanning, downloading, and installing updates. + +This can include: +- Notifying users prior to downloading updates. +- Automatically downloading updates, and then notifying users to schedule a restart (this is the default behavior if this policy is not configured). +- Automatically downloading and restarting devices with user notification. +- Automatically downloading and restarting devices at a specified time. +- Automatically downloading and restarting devices without user interaction. +- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device will not receive any updates. + +In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, etc.) or on a specific what [day of the week](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, etc.). + +**Managing the source of updates with MDM** + +*Applies to: Corporate devices with Enterprise edition* + +Although Windows 10 Enterprise enables IT administrators to defer installation of new updates from Windows Update, enterprises may also want additional control over update processes. With this in mind, Microsoft created Windows Update for Business. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. If you are using a MDM system, the use of Windows Update for Business is not a requirement, as you can manage these features from your MDM system. + +Learn more about [Windows Update for Business](../plan/windows-update-for-business.md). + +IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS. + +**Managing Updates with Windows Update Server** + +*Applies to: Corporate devices with Enterprise edition* + +When using WSUS, set **UpdateServiceUrl** to allow the device to check for updates from a WSUS server instead of Windows Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet, usually handheld devices used for task completion, or other Windows IoT devices. + +Learn more about [managing updates with Windows Server Update Services (WSUS)](https://technet.microsoft.com/en-us/windowsserver/bb332157.aspx) + +**Querying the device update status** + +*Applies to: Personal and corporate devices* + +In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates. + +The device update status query provides an overview of: +- Installed updates: A list of updates that are installed on the device. +- Installable updates: A list of updates that are available for installation. +- Failed updates: A list of updates that failed during installation, including indication of why the update failed. +- Pending reboot: A list of updates that require a restart to complete update installation. +- Last successful scan time: The last time a successful update scan was completed. +- Defer upgrade: Whether the upgrade is deferred until the next update cycle. + +### Device health + +*Applies to: Personal and corporate devices* + +Device Health Attestation (DHA) is another line of defense that is new to Windows 10 Mobile. It can be used to remotely detect devices that lack a secure configuration or have vulnerabilities that could allow them to be easily exploited by sophisticated attacks. + +Windows 10 Mobile makes it easy to integrate with Microsoft Intune or third-party MDM solutions for an overall view of device health and compliance. Using these solutions together, you can detect jailbroken devices, monitor device compliance, generate compliance reports, alert users or administrators to issues, initiate corrective action, and manage conditional access to resources like Office 365 or VPN. + +The first version of Device Health Attestation (DHA) was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, Device Health Attestation (DHA) capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network. + +The health attestation feature is based on Open Mobile Alliance (OMA) standards. IT managers can use DHA to validate devices that: +- Run Windows 10 operating system (mobile phone or PC) +- Support Trusted Module Platform (TPM 1.2 or 2.0) in discrete of firmware format +- Are managed by a DHA-enabled device management solution (Intune or third-party MDM) +- Operate in cloud, hybrid, on-premises, and BYOD scenarios + +DHA-enabled device management solutions help IT managers create a unified security bar across all managed Windows 10 Mobile devices. This allows IT managers to: +- Collect hardware attested data (highly assured) data remotely +- Monitor device health compliance and detect devices that are vulnerable or could be exploited by sophisticated attacks +- Take actions against potentially compromised devices, such as: +- Trigger corrective actions remotely so offending device is inaccessible (lock, wipe, or brick the device) +- Prevent the device from getting access to high-value assets (conditional access) +- Trigger further investigation and monitoring (route the device to a honeypot for further monitoring) +- Simply alert the user or the admin to fix the issue + +>**Note:** Windows Device Health Attestation Service can be used for conditional access scenarios which may be enabled by Mobile Device Management solutions (e.g.: Microsoft Intune) and other types of management systems (e.g.: SCCM) purchased separately. + +For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). + +Thisis a lists of attributes that are supported by DHA and can trigger the corrective actions mentioned above. +- **Attestation Identity Key (AIK) present** Indicates that an AIK is present (i.e., the device can be trusted more than a device without an AIK). +- **Data Execution Prevention (DEP) enabled** Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. +- **BitLocker status** BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker. +- **Secure Boot enabled** Whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. +- **Code integrity enabled** Whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. +- **Safe mode** Whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. +- **Boot debug enabled** Whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. +- **OS kernel debugging enabled** Whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. +- **Test signing enabled** Whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. +- **Boot Manager Version** The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted). +- **Code integrity version** Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). +- **Secure Boot Configuration Policy (SBCP) present** Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. +- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant. + +**Example scenario** + +Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device. + +Here is what occurs when a smartphone is turned on: +1. Windows 10 Secure Boot protects the boot sequence, enables the device to boot into a defined and trusted configuration, and loads a factory trusted boot loader. +2. Windows 10 Trusted Boot takes control, verifies the digital signature of the Windows kernel, and the components are loaded and executed during the Windows startup process. +3. In parallel to Steps 1 and 2, Windows 10 Mobile TPM (Trusted Platform Modules – measured boot) runs independently in a hardware-protected security zone (isolated from boot execution path monitors boot activities) to create an integrity protected and tamper evident audit trail - signed with a secret that is only accessible by TPM. +4. Devices managed by a DHA-enabled MDM solution send a copy of this audit trail to Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. +5. Microsoft HAS reviews the audit trails, issues an encrypted/signed report, and forwards it to the device. +6. IT managers can use a DHA-enabled MDM solution to review the report in a protected, tamper-resistant and tamper-evident communication channel. They can assess if a device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with security needs and enterprise policies. + +### Asset reporting + +*Applies to: Corporate devices with Enterprise edition* + +Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely and provide reporting capabilities to analyze device resources and information. This data informs IT about the current hardware and software resources of the device (e.g., installed updates). + +The following list shows examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide. + +- **Installed enterprise apps** List of the enterprise apps installed on the device +- **Device name** The device name configured for the device +- **Firmware version** Version of firmware installed on the device +- **Operating system version** Version of the operating system installed on the device +- **Device local time** Local time on the device +- **Processor type** Processor type for the device +- **Device model** Model of the device as defined by the manufacturer +- **Device manufacturer** Manufacturer of the device +- **Device processor architecture** Processor architecture for the device +- **Device language** Language in use on the device +- **Phone number** Phone number assigned to the device +- **Roaming status** Indicates whether the device has a roaming cellular connection +- **International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user +- **Wi-Fi IP address** IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device +- **Wi-Fi media access control (MAC) address** MAC address assigned to the Wi-Fi adapter in the device +- **Wi-Fi DNS suffix and subnet mask** DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device +- **Secure Boot state** Indicates whether Secure Boot is enabled +- **Enterprise encryption policy compliance** Indicates whether the device is encrypted + +### Manage telemetry + +*Applies to: Corporate devices with Windows 10 Mobile Enterprise edition* + +Microsoft uses telemetry (diagnostics, performance, and usage data) from Windows devices to help inform decisions and focus efforts to provide the most robust and valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Telemetry helps keep Windows devices healthy, improve the operating system, and personalize features and services. + +You can control the level of data that telemetry systems collect. To configure devices, specify one of these levels in the Allow Telemetry setting with your MDM system. + +For more information, see [Configure Windows telemetry in Your organization](configure-windows-telemetry-in-your-organization.md). + +>**Note:** Telemetry can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition. + +### Remote assistance + +*Applies to: Personal and corporate devices* + +The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: +- **Remote lock** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it, but not immediately (e.g., leaving the device at a customer site). +- **Remote PIN reset** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost and users are able to quickly gain access to their devices. +- **Remote ring** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. +- **Remote find** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. Remote find parameters can be configured via phone settings (see table below). The remote find feature returns the most current latitude, longitude, and altitude of the device. + +**Remote assistance policies** +- **Desired location accuracy** The desired accuracy as a radius value in meters; has a value between 1 and 1,000 meters +- **Maximum remote find** Maximum length of time in minutes that the server will accept a successful remote find; has a value between 0 and 1,000 minutes +- **Remote find timeout** The number of seconds devices should wait for a remote find to finish; has a value between 0 and 1,800 seconds These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password. -Table 23. Windows 10 Mobile remote find settings +>**Remote control software** Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Windows Store. -| Setting | Description | -|---------------------------|---------------------------------------------------------------------------------------------------------------------------------| -| Desired location accuracy | The desired accuracy as a radius value in meters; has a value between 1 and 1,000 meters | -| Maximum remote find | Maximum length of time in minutes that the server will accept a successful remote find; has a value between 0 and 1,000 minutes | -| Remote find timeout | The number of seconds devices should wait for a remote find to finish; has a value between 0 and 1,800 seconds | -  -### Cloud services +## Retire -On mobile devices that run Windows 10 Mobile, users can easily connect to apps and data. As a result, they frequently connect to cloud services that provide user notifications and collect telemetry (usage data). Windows 10 Mobile enables organizations to manage how devices consume these cloud services. +*Applies to: Corporate and Personal devices* -**Manage push notifications** +Device retirement is the last phase of the device lifecycle, which in today’s business environment averages about 18 months. After that time period, employees want the productivity and performance improvements that come with the latest hardware. It’s important that devices being replaced with newer models are securely retired since you don’t want any company data to remain on discarded devices that could compromise the confidentiality of your data. This is typically not a problem with corporate devices, but it can be more challenging in a personal device scenario. You need to be able to selectively wipe all corporate data without impacting personal apps and data on the device. IT also needs a way to adequately support users who need to wipe devices that are lost or stolen. -The Windows Push Notification Services enable software developers to send toast, tile, badge, and raw updates from their cloud services. It provides a mechanism to deliver updates to users in a power-efficient and dependable way. -Push notifications can affect battery life, however, so the battery saver in Windows 10 Mobile limits background activity on the devices to extend battery life. Users can configure battery saver to turn on automatically when the battery drops below a set threshold. When battery saver is on, Windows 10 Mobile disables the receipt of push notifications to save energy. +Windows 10 Mobile IT supports device retirement in both personal and corporate scenarios, allowing IT to be confident that corporate data remains confidential and user privacy is protected. -There is an exception to this behavior, however. In Windows 10 Mobile, the **Always allowed** battery saver settings (found in the Settings app) allow apps to receive push notifications even when battery saver is on. Users can manually configure this list, or you can use the MDM system to configure it—that is, you can use the battery saver settings URI scheme in Windows 10 Mobile (**ms-settings:batterysaver-settings**) to configure these settings. -For more information about push notifications, see [Windows Push Notification Services (WNS) overview](http://go.microsoft.com/fwlink/p/?LinkId=734060). +>**Note:** All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration. -**Manage telemetry** +**Personal devices:** Windows 10 mobile supports the USA regulatory requirements for a “kill switch” in case your phone is lost or stolen. Reset protection is a free service on account.microsoft.com that helps ensure that the phone cannot be easily reset and reused. All you need to do to turn on **Reset Protection** is sign in with your Microsoft account and accept the recommended settings. To manually turn it on, you can find it under Settings > Updates & security > Find my phone. At this point, Reset Protection is only available with an MSA, not with Azure AD account. It is also only available in the USA and not in other regions of the world. -As people use Windows 10 Mobile, it can collect performance and usage telemetry that helps Microsoft identify and troubleshoot problems as well as improve its products and services. Microsoft recommends that you select **Full** for this setting. -Microsoft employees, contractors, vendors, and partners might have access to relevant portions of the information that Windows 10 Mobile collects, but they are permitted to use the information only to repair or improve Microsoft products and services or third-party software and hardware designed for use with Microsoft products and services. +If you choose to completely wipe a device when lost or when an employee leaves the company, make sure you obtain consent from the user and follow any local legislation that protects the user’s personal data. -You can control the level of data that MDM systems collect. Table 24 lists the data levels that Windows 10 Mobile collects and provides a brief description of each. To configure devices, specify one of these levels in the **Allow Telemetry** setting. -Table 24. Windows 10 Mobile data collection levels -| Level of data | Description | -|- | - | -| Security | Collects only the information required to keep Windows 10 Mobile enterprise-grade secure, including information about telemetry client settings, the Malicious Software Removal Tool, and Windows Defender. This level is available only on Windows 10 Enterprise, Windows 10 Education, and Windows 10 IoT Core. For Windows 10 Mobile, this setting disables Windows 10 Mobile telemetry. | -| Basic | Provides only the data vital to the operation of Windows 10 Mobile. This data level helps keep Windows 10 Mobile and apps running properly by letting Microsoft know the device’s capabilities, what’s installed, and whether Windows is operating correctly. This option also turns on basic error reporting back to Microsoft. By selecting this option, you allow Microsoft to provide updates through Windows Update, including malicious software protection through the Malicious Software Removal Tool. | -| Enhanced | Includes all Basic data plus data about how users use Windows 10 Mobile, such as how frequently or how long they use certain features or apps and which apps they use most often. This option also lets operating system collect enhanced diagnostic information, such as the memory state of a device when a system or app crash occurs, and measure reliability of devices, the operating system, and apps. | -| Full | Includes all Basic and Enhanced data and also turns on advanced diagnostic features that collect additional data from devices, such as system files or memory snapshots, which may unintentionally include parts of documents user are working on when a problem occurred. This information helps Microsoft further troubleshoot and fix problems. If an error report contains personal data, Microsoft does not use that information to identify, contact, or target advertising to users. | -  -## Device retirement +A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data will be tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles will immediately be removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and will be reported to the MDM system. -Device retirement (unenrollment) is the last phase of the device life cycle. Historically, mobile device retirement has been a complex and difficult process for organizations. When the organization no longer needs devices, it must remove (wipe) corporate data from them. BYOD scenarios make retirement even more complex because users expect their personal apps and data to remain untouched. Therefore, organizations must remove their data without affecting users’ data. +**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that that will also make the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process. -You can remotely remove all corporate data from devices that run Windows 10 Mobile without affecting existing user data (partial or enterprise wipe). The help desk or the devices’ users can initiate device retirement. When retirement is complete, Windows 10 Mobile returns the devices to a consumer state, as they were before enrollment. The following list summarizes the corporate data removed from a device when it’s retired: +**Settings for personal or corporate device retirement** +- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) +- **Allow user to reset phone** Whether users are allowed to use Settings or hardware key combinations to return the device to factory defaults -- Email accounts -- Enterprise-issued certificates -- Network profiles -- Enterprise-deployed apps -- Any data associated with the enterprise-deployed apps ->**Note:**  All these features are in addition to the device’s software and hardware factory reset features, which users can use to restore devices to their factory configuration. -  -To specify whether users can delete the workplace account in Control Panel and unenroll from the MDM system, enable the **Allow Manual MDM Unenrollment** setting. Table 25 lists additional Windows 10 remote wipe settings that you can use the MDM system to configure. - -Table 25. Windows 10 Mobile remote wipe settings - -| Setting | Description | -|-------------------------------|----------------------------------------------------------------------------------------------------------------------| -| Wipe | Specifies that a remote wipe of the device should be performed | -| Allow manual MDM unenrollment | Whether users are allowed to delete the workplace account (in other words, unenroll the device from the MDM system) | -| Allow user to reset phone | Whether users are allowed to use Control Panel or hardware key combinations to return the device to factory defaults | -  ## Related topics -- [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050) -- [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) -- [Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052) -- [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) +- [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050) +- [Enterprise Mobility + Security](https://go.microsoft.com/fwlink/p/?LinkId=723984) +- [Overview of Mobile Device Management for Office 365](https://go.microsoft.com/fwlink/p/?LinkId=734052) +- [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=722910) + + +## Revision History + +- November 2015 Updated for Windows 10 Mobile (version 1511) +- August 2016 Updated for Windows 10 Mobile Anniversary Update (version 1607) + diff --git a/windows/manage/windows-10-start-layout-options-and-policies.md b/windows/manage/windows-10-start-layout-options-and-policies.md index 3b744fbf9e..93ebd58d4e 100644 --- a/windows/manage/windows-10-start-layout-options-and-policies.md +++ b/windows/manage/windows-10-start-layout-options-and-policies.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: high --- # Manage Windows 10 Start and taskbar layout @@ -16,10 +17,12 @@ author: jdeckerMS - Windows 10 -> **Looking for consumer information?** See [Customize the Start menu](http://windows.microsoft.com/en-us/windows-10/getstarted-see-whats-on-the-menu) and topic-to-be-added-for-taskbars +> **Looking for consumer information?** See [Customize the Start menu](http://windows.microsoft.com/windows-10/getstarted-see-whats-on-the-menu) Organizations might want to deploy a customized Start and taskbar configuration to devices running Windows 10 Enterprise or Windows 10 Education. A standard, customized Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. Configuring the taskbar allows the organization to pin useful apps for their employees and to remove apps that are pinned by default. +> **Note:** Taskbar configuration is available starting in Windows 10, version 1607. + ## Start options ![start layout sections](images/startannotated.png) @@ -121,11 +124,11 @@ Starting in Windows 10, version 1607, you can pin additional apps to the taskbar There are three categories of apps that might be pinned to a taskbar: * Apps pinned by the user -* Default Windows apps, pinned during operating system installation (Edge, File Explorer, Store) +* Default Windows apps, pinned during operating system installation (Microsoft Edge, File Explorer, Store) * Apps pinned by the enterprise, such as in an unattended Windows setup **Note**   - The earlier method of using [TaskbarLinks](http://go.microsoft.com/fwlink/p/?LinkId=761230) in an unattended Windows setup file is deprecated in Windows 10, version 1607. + The earlier method of using [TaskbarLinks](https://go.microsoft.com/fwlink/p/?LinkId=761230) in an unattended Windows setup file is deprecated in Windows 10, version 1607. The following example shows how apps will be pinned - Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using XML to the right (green square). diff --git a/windows/manage/windows-spotlight.md b/windows/manage/windows-spotlight.md index af6bd8ed19..f6182e086b 100644 --- a/windows/manage/windows-spotlight.md +++ b/windows/manage/windows-spotlight.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: jdeckerMS +localizationpriority: high --- # Windows Spotlight on the lock screen diff --git a/windows/manage/windows-store-for-business-overview.md b/windows/manage/windows-store-for-business-overview.md new file mode 100644 index 0000000000..6f8d654f82 --- /dev/null +++ b/windows/manage/windows-store-for-business-overview.md @@ -0,0 +1,278 @@ +--- +title: Windows Store for Business overview (Windows 10) +description: With the new Windows Store for Business, organizations can make volume purchases of Windows apps. +ms.assetid: 9DA71F6B-654D-4121-9A40-D473CC654A1C +ms.prod: w10 +ms.pagetype: store, mobile +ms.mktglfcycl: manage +ms.sitesec: library +author: TrudyHa +localizationpriority: high +--- + +# Windows Store for Business overview + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +With the new Windows Store for Business, organizations can make volume purchases of Windows apps. The Store for Business provides app purchases based on organizational identity, flexible distribution options, and the ability to reclaim or re-use licenses. Organizations can also use the Store for Business to create a private store for their employees that includes apps from the Store, as well private Line-of-Business (LOB) apps. + +## Features + + +Organizations of any size can benefit from using the Store for Business provides: + +- **Scales to fit the size of your business** - For smaller businesses, with Azure AD accounts and Windows 10 devices, you can quickly have an end-to-end process for acquiring and distributing content using the Store for Business. For larger businesses, all the capabilities of the Store for Business are available to you, or you can integrate the Store for Business with management tools, for greater control over access to apps and app updates. You can use existing work or school accounts. + +- **Bulk app acquisition** - Acquire apps in volume from the Store for Business. + +- **Private store** - Curate a private store for your business that’s easily available from any Windows 10 device. + +- **Flexible distribution options** - Flexible options for distributing content and apps to your employee devices: + + - Distribute through Store for Business services. You can assign apps to individual employees, or make apps available to all employees in your private store. + + - Use a management tool from Microsoft, or a 3rd-party tool for advanced distribution and management functions, or for managing images. + + - Offline licensing model allows you to distribute apps without connecting to Store services, and for managing images. + +- **Line-of-business apps** - Privately add and distribute your internal line-of-business apps using any of the distribution options. + +- **App license management**: Admins can reclaim and reuse app licenses. Online and offline licenses allow you to customize how you decide to deploy apps. + +- **Up-to-date apps** - The Store for Business manages the update process for apps with online licenses. Apps are automatically updated so you are always current with the most recent software updates and product features. Store for Business apps also uninstall cleanly, without leaving behind extra files, for times when you need to switch apps for specific employees. + +## Prerequisites + + +You'll need this software to work with the Store for Business. + +### Required + +- IT Pros that are administering Store for Business need a browser compatible with Store for Business running on a PC or mobile device. Supported browsers include: Internet Explorer 10 or later, Microsoft Edge, or current versions of Chrome or Firefox. + +- Employees using apps from Store for Business need Windows 10, version 1511 running on a PC or mobile device. + +Microsoft Azure Active Directory (AD) accounts for your employees: + +- Admins need Azure AD accounts to sign up for the Store for Business, and then to sign in, get apps, distribute apps, and manage app licenses. + +- Employees need Azure AD account when they access Store for Business content from Windows devices. + +- If you use a management tool to distribute and manage online-licensed apps, all employees will need an Azure AD account + +- For offline-licensed apps, Azure AD accounts are not required for employees. + +For more information on Azure AD, see [About Office 365 and Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](https://go.microsoft.com/fwlink/p/?LinkId=708611). + +### Optional + +While not required, you can use a management tool to distribute and manage apps. Using a management tool allows you to distribute content, scope app availability, and control when app updates are installed. This might make sense for larger organizations that already use a management tool. A couple of things to note about management tools: + +- Need to integrate with Windows 10 management framework and Azure AD. + +- Need to sync with the Store for Business inventory to distribute apps. + +## How does the Store for Business work? + + +### Sign up! + +The first step for getting your organization started with the Store for Business is signing up. To sign up for the Business store, you need an Azure AD account and you must be a Global Administrator for your organization. + +For more information, see [Sign up for the Store for Business](../manage/sign-up-windows-store-for-business.md). + +### Set up + +After your admin signs up for the Store for Business, they can assign roles to other employees in your company. The admin needs Azure AD User Admin permissions to assign WSFB roles. These are the roles and their permissions. + + +++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    PermissionAccount settingsAcquire appsDistribute appsDevice Guard signing

    Admin

    X

    X

    X

    Purchaser

    X

    X

    Device Guard signer

    X

    + + + +In some cases, admins will need to add Azure Active Directory (AD) accounts for their employees. For more information, see [Manage user accounts and groups](../manage/manage-users-and-groups-windows-store-for-business.md). + +Also, if your organization plans to use a management tool, you’ll need to configure your management tool to sync with the Store for Business. + +### Get apps and content + +Once signed in to the Store for Business, you can browse and search for all products in the Store for Business catalog. Some apps are free, and some apps charge a price. We're continuing to add more paid apps to the Store for Business. Check back if you don't see the app that you're looking for. Currently, you can pay for apps with a credit card. We'll be adding more payment options over time. + +**App types** -- These app types are supported in the Store for Business: + +- Universal Windows Platform apps + +- Universal Windows apps, by device: Phone, Surface Hub, IOT devices, HoloLens + +Apps purchased from the Store for Business only work on Windows 10 devices. + +Line-of-business (LOB) apps are also supported via the Business store. You can invite IT developers or ISVs to be LOB publishers for your organization. This allows them to submit apps via the developer center that are only available to your organization. These apps can be distributed using the distribution methods discussed in this topic. For more information, see [Working with Line-of-Business apps](working-with-line-of-business-apps.md). + +**App licensing model** + +The Business store supports two options to license apps: online and offline. **Online** licensing is the default licensing model and is similar to the Windows Store. Online licensed apps require users and devices to connect to the Store for Business service to acquire an app and its license. **Offline** licensing is a new licensing option for Windows 10. With offline licenses, organizations can cache apps and their licenses to deploy within their network. ISVs or devs can opt-in their apps for offline licensing when they submit them to the developer center. + +For more information, see [Apps in the Store for Business](../manage/apps-in-windows-store-for-business.md#licensing-model). + +### Distribute apps and content + +App distribution is handled through two channels, either through the Store for Business, or using a management tool. You can use either or both distribution methods in your organization. + +**Using the Store for Business** – Distribution options for the Store for Business: + +- Email link – After purchasing an app, admins can send employees a link in an email message. Employees can click the link to install the app. + +- Curate private store for all employees – A private store can include content you’ve purchased from the Store, and your line-of-business apps that you’ve submitted to the Store for Business. Apps in your private store are available to all of your employees. They can browse the private store and install apps when needed. + +- To use the options above users must be signed in with an Azure AD account on a Windows 10 device. + +**Using a management tool** – For larger organizations that might want a greater level of control over how apps are distributed and managed, a management tools provides other distribution options: + +- Scoped content distribution – Ability to scope content distribution to specific groups of employees. + +- Install apps for employees – Employees are not responsible for installing apps. Management tool installs apps for employees. + +Management tools can synchronize content that has been acquired in the Store for Business. If an offline application has been purchased this will also include the app package, license and metadata for the app (like, icons, count, or localized product descriptions). Using the metadata, management tools can enable portals or apps as a destination for employees to acquire apps. + +For more information, see [Distribute apps to your employees from the Store for Business](../manage/distribute-apps-to-your-employees-windows-store-for-business.md). + +### Manage Store for Business settings and content + +Once you are signed up with the Business store and have purchased apps, Admins can manage Store for Business settings and inventory. + +**Manage Store for Business settings** + +- Assign and change roles for employees or groups + +- Device Guard signing + +- Register a management server to deploy and install content + +- Manage relationships with LOB publishers + +- Manage offline licenses + +- Update the name of your private store + +**Manage inventory** + +- Assign app licenses to employees + +- Reclaim and reassign app licenses + +- Manage app updates for all apps, or customize updates for each app. Online apps will automatically update from the Store. Offline apps can be updated using a management server. + +- Download apps for offline installs + +For more information, see [Manage settings in the Store for Business](../manage/manage-settings-windows-store-for-business.md) and [Manage apps](../manage/manage-apps-windows-store-for-business-overview.md). + +## Supported markets + + +Store for Business is currently available in these markets. + +|Country or locale|Paid apps|Free apps| +|-----------------|---------|---------| +|Argentina|X|X| +|Australia|X|X| +|Austria|X|X| +|Belgium (Dutch, French)|X|X| +|Brazil| |X| +|Canada (English, French)|X|X| +|Chile|X|X| +|Columbia|X|X| +|Croatia|X|X| +|Czech Republic|X|X| +|Denmark|X|X| +|Finland|X|X| +|France|X|X| +|Germany|X|X| +|Greece|X|X| +|Hong Kong SAR|X|X| +|Hungary|X|X| +|India| |X| +|Indonesia|X|X| +|Ireland|X|X| +|Italy|X|X| +|Japan|X|X| +|Malaysia|X|X| +|Mexico|X|X| +|Netherlands|X|X| +|New Zealand|X|X| +|Norway|X|X| +|Philippines|X|X| +|Poland|X|X| +|Portugal|X|X| +|Romania|X|X| +|Russia| |X| +|Singapore|X|X| +|Slovakia|X|X| +|South Africa|X|X| +|Spain|X|X| +|Sweden|X|X| +|Switzerland (French, German)|X|X| +|Taiwan| |X| +|Thailand|X|X| +|Turkey|X|X| +|Ukraine| |X| +|United Kingdom|X|X| +|United States|X|X| +|Vietnam|X|X| + +## ISVs and the Store for Business + + +Developers in your organization, or ISVs can create content specific to your organization. In the Store for Business, we call these line-of-business (LOB) apps, and the devs that create them are LOB publishers. The process looks like this: + +- Admin invites devs to be LOB publishers for your organization. These devs can be internal devs, or external ISVs. + +- LOB publishers accept the invitation, develop apps, and submits the app to the Windows Dev Center. LOB publishers use Enterprise associations when submitting the app to make the app exclusive to your organization. + +- Admin adds the app to Store for Business inventory. + +Once the app is in inventory, admins can choose how to distribute the app. ISVs creating apps through the dev center can make their apps available in the Store for Business. ISVs can opt-in their apps to make them available for offline licensing. Apps purchased in the Store for Business will work only on Windows 10. + +For more information on line-of-business apps, see [Working with Line-of-Business apps](../manage/working-with-line-of-business-apps.md). diff --git a/windows/manage/windows-store-for-business.md b/windows/manage/windows-store-for-business.md index d3a4044273..67a6d43bab 100644 --- a/windows/manage/windows-store-for-business.md +++ b/windows/manage/windows-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Windows Store for Business diff --git a/windows/manage/working-with-line-of-business-apps.md b/windows/manage/working-with-line-of-business-apps.md index f780a06748..f16e66fee9 100644 --- a/windows/manage/working-with-line-of-business-apps.md +++ b/windows/manage/working-with-line-of-business-apps.md @@ -7,6 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +localizationpriority: high --- # Working with line-of-business apps @@ -21,7 +22,7 @@ Your company can make line-of-business (LOB) applications available through Wind Developers within your own company, or ISVs that you invite, can become LOB publishers and submit apps to the Windows Store for your company. Once a LOB publisher submits an app for your company, the app is only available to your company. LOB publishers submit apps through the Windows Dev Center using the same process as all apps that are in the Store, and then can be managed or deployed using the same process as any other app that has been acquired through the Store. -One advantage of making apps available through Store for Business is that the app has been signed by the Store, and uses the standard Store policies. For companies that can’t submit their application through the Windows Dev Center (for example, those needing additional capabilities or due to compliance purposes), [Sideloading](http://go.microsoft.com/fwlink/p/?LinkId=623433) is also supported in Windows 10. +One advantage of making apps available through Store for Business is that the app has been signed by the Store, and uses the standard Store policies. For companies that can’t submit their application through the Windows Dev Center (for example, those needing additional capabilities or due to compliance purposes), [Sideloading](https://go.microsoft.com/fwlink/p/?LinkId=623433) is also supported in Windows 10. ## Adding LOB apps to your private store @@ -38,7 +39,7 @@ What you'll have to set up: - Your company needs to be signed up with Store for Business. -- LOB publishers need to have an active developer account. To learn more about account options, see [Ready to sign up](http://go.microsoft.com/fwlink/p/?LinkId=623432). +- LOB publishers need to have an active developer account. To learn more about account options, see [Ready to sign up](https://go.microsoft.com/fwlink/p/?LinkId=623432). - LOB publishers need to have an app in the Store, or have an app ready to submit to the Store. @@ -48,7 +49,7 @@ For developers within your own organization, or ISVs you're working with to crea **To invite a developer to become an LOB publisher** -1. Sign in to the [Windows Store for Business]( http://go.microsoft.com/fwlink/p/?LinkId=623531). +1. Sign in to the [Windows Store for Business]( https://go.microsoft.com/fwlink/p/?LinkId=623531). 2. Click **Settings**, and then choose **LOB publishers**. 3. On the Line-of business publishers page, click **Add** to complete a form and send an email invitation to a developer.
    **Note** This needs to be the email address listed in contact info for the developer account. @@ -57,16 +58,16 @@ For developers within your own organization, or ISVs you're working with to crea The developer receives an email invite to become an LOB publisher for your company. Once they accept the invite, they can log in to the Windows Dev Center to create an app submission for your company. The info here assumes that devs or ISVs have an active developer account. -After an app is published and available in the Store, ISVs publish an updated version by creating another submission in their dashboard. Creating a new submission allows the ISV to make the changes required to create a LOB app for your company. To learn more about updates to an app submission, see [App submissions](http://go.microsoft.com/fwlink/p/?LinkId=623463) and [Distributing LOB apps to enterprises](http://go.microsoft.com/fwlink/p/?LinkId=627543). +After an app is published and available in the Store, ISVs publish an updated version by creating another submission in their dashboard. Creating a new submission allows the ISV to make the changes required to create a LOB app for your company. To learn more about updates to an app submission, see [App submissions](https://go.microsoft.com/fwlink/p/?LinkId=623463) and [Distributing LOB apps to enterprises](https://go.microsoft.com/fwlink/p/?LinkId=627543). **To create a new submission for an app** -1. Sign in to the [Windows Dev Center](http://go.microsoft.com/fwlink/p/?LinkId=623486), go to your Dashboard, and click the app you want to make available as an LOB app. +1. Sign in to the [Windows Dev Center](https://go.microsoft.com/fwlink/p/?LinkId=623486), go to your Dashboard, and click the app you want to make available as an LOB app. 2. On the App overview page, under **Action**, click **Update**. -OR- - Submit your app following the guidelines in [App submissions](http://go.microsoft.com/fwlink/p/?LinkId=623463). Be sure to completed steps 3 and 4 when you set app pricing and availability options. + Submit your app following the guidelines in [App submissions](https://go.microsoft.com/fwlink/p/?LinkId=623463). Be sure to completed steps 3 and 4 when you set app pricing and availability options. 3. On the **Pricing and availability** page, under **Distribution and visibility**, click **Line-of-business (LOB) distribution**, and then choose the enterprise(s) who will get the LOB app. No one else will have access to the app. 4. Under **Organizational licensing**, click **Show options**. @@ -79,8 +80,8 @@ After an app is published and available in the Store, ISVs publish an updated ve 5. Click **Save** to save your changes and start the app submission process. -For more information, see [Organizational licensing options]( http://go.microsoft.com/fwlink/p/?LinkId=708615) and [Distributing LOB apps to enterprises](http://go.microsoft.com/fwlink/p/?LinkId=627543).
    -**Note** In order to get the LOB app, the organization must be located in a [supported market](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-store-for-business-overview#supported-markets), and you must not have excluded that market when submitting your app. +For more information, see [Organizational licensing options]( https://go.microsoft.com/fwlink/p/?LinkId=708615) and [Distributing LOB apps to enterprises](https://go.microsoft.com/fwlink/p/?LinkId=627543).
    +**Note** In order to get the LOB app, the organization must be located in a [supported market](https://technet.microsoft.com/itpro/windows/whats-new/windows-store-for-business-overview#supported-markets), and you must not have excluded that market when submitting your app. ### Add app to inventory (admin) diff --git a/windows/plan/TOC.md b/windows/plan/TOC.md index c7591ce190..7118e1238c 100644 --- a/windows/plan/TOC.md +++ b/windows/plan/TOC.md @@ -1,5 +1,5 @@ # [Plan for Windows 10 deployment](index.md) -## [Windows 10 servicing options](windows-10-servicing-options.md) +## [Windows 10 servicing overview](windows-10-servicing-options.md) ## [Windows 10 deployment considerations](windows-10-deployment-considerations.md) ## [Windows 10 compatibility](windows-10-compatibility.md) ## [Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) @@ -108,4 +108,4 @@ ### [ACT Product and Documentation Resources](act-product-and-documentation-resources.md) ### [ACT Glossary](act-glossary.md) ### [Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) -## [Change history for Plan for Windows 10 deployment](change-history-for-plan-for-windows-10-deployment.md) +## [Change history for Plan for Windows 10 deployment](change-history-for-plan-for-windows-10-deployment.md) \ No newline at end of file diff --git a/windows/plan/act-community-ratings-and-process.md b/windows/plan/act-community-ratings-and-process.md index 6d28ac6493..e9c34a2026 100644 --- a/windows/plan/act-community-ratings-and-process.md +++ b/windows/plan/act-community-ratings-and-process.md @@ -1,48 +1,5 @@ --- title: ACT Community Ratings and Process (Windows 10) description: The Application Compatibility Toolkit (ACT) Community uses the Microsoft® Compatibility Exchange to share compatibility ratings between all registered ACT Community members. -ms.assetid: be6c8c71-785b-4adf-a375-64ca7d24e26c -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: appcompat -author: TrudyHa ---- - -# ACT Community Ratings and Process - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Application Compatibility Toolkit (ACT) Community uses the Microsoft® Compatibility Exchange to share compatibility ratings between all registered ACT Community members. - -When you access the Microsoft Compatibility Exchange as a registered ACT Community member, you can upload your compatibility data to the community and download issues from other ACT Community members. For information about how compatibility ratings are entered, see [Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md). - -ACT takes your information and combines it with all of the information provided by the other ACT Community users and shows the average rating as a color gradient from one to five bars. - -![act community](images/dep-win8-e-act-communityexample.gif) - -## Process for Synchronizing Compatibility Ratings - - -The following diagram shows the process for synchronizing compatibility ratings with the ACT Community. - -You have the option to exclude applications from being shared with the Microsoft Compatibility Exchange. However, you will not get compatibility ratings from the ACT Community for any application that you exclude. For more information, see [Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md). - -![act community workflow](images/dep-win8-l-act-communityworkflowdiagram.jpg) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-database-configuration.md b/windows/plan/act-database-configuration.md index dc8103e03e..7c07865d8a 100644 --- a/windows/plan/act-database-configuration.md +++ b/windows/plan/act-database-configuration.md @@ -1,85 +1,5 @@ --- title: ACT Database Configuration (Windows 10) description: The Application Compatibility Toolkit (ACT) uses a Microsoft® SQL Server® database for storing and sharing compatibility issue data. -ms.assetid: 032bbfe0-86fa-48ff-b638-b9d6a908c45e -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# ACT Database Configuration - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Application Compatibility Toolkit (ACT) uses a Microsoft® SQL Server® database for storing and sharing compatibility issue data. If you do not use Microsoft SQL Server, you can download and install Microsoft SQL Server Express. For information about creating Microsoft SQL Server databases, see [Administering the Database Engine](http://go.microsoft.com/fwlink/p/?LinkId=64169). - -## ACT Database Creation - - -You can create the ACT database by using one of the following methods: - -- Run Application Compatibility Manager (ACM), and then use the ACT Configuration Wizard to create a new database. - - -or- - -- Run the CreateDB.sql file, located at %SYSTEMDRIVE%\\ProgramData\\Microsoft\\Application Compatibility Toolkit\\CreateDB.sql. - -### ACT Database Permissions - -You must assign the following database roles to the following accounts. - -- To the user and local service accounts that will run the ACT Log Processing Service (LPS), assign the db\_datareader, db\_datawriter, and db\_owner database roles. - -- To the user account that will run Application Compatibility Manager (ACM), assign the db\_datareader and db\_datawriter database roles. - -Alternatively, grant the following explicit permissions to each user that will run the ACT LPS or ACM. - -- SELECT - -- INSERT - -- UPDATE - -- DELETE - -- EXECUTE - -### ACT Database Recommendations - -We also recommend that you make the following changes to the database as part of your deployment planning: - -- **Create a larger database, including a larger log file–size setting, and then set the growth increments appropriately**. If you create a database with the default setting for data storage, the data portion of the database will have an initial size of 1 megabyte (MB), and a growth increment of 1 MB. If you create a database with the default setting for log file storage, the log file portion of the database will have an initial size of 1 MB and a growth increment of 10 percent. We recommend that you maintain a data-to-log file ratio of 5:1 or 4:1. For example, if your data portion is 5 gigabytes (GB), your log file portion should be 1 GB. - -- **Change the recovery model of your database**. The default recovery model is **Full**, but we recommend that you change the recovery model to **Simple** to improve performance and reduce disk space requirements. - -- **Store the data portion and log file portion of your ACT database on separate hard drives**. Unless otherwise specified by your SQL Administrator, the default is for the data and log files to be stored on the same hard drive. We recommend separating the data from the log files to reduce disk I/O contention. - -## Related topics - - -[ACT Tools, Packages, and Services](act-tools-packages-and-services.md) - -[ACT Deployment Options](act-deployment-options.md) - -[ACT Database Migration](act-database-migration.md) - -[ACT LPS Share Permissions](act-lps-share-permissions.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-database-migration.md b/windows/plan/act-database-migration.md index 4b4009c05e..e8b5e9b74f 100644 --- a/windows/plan/act-database-migration.md +++ b/windows/plan/act-database-migration.md @@ -1,68 +1,5 @@ --- title: ACT Database Migration (Windows 10) description: The schema for an ACT database can change when ACT is updated or when a new version of ACT is released. -ms.assetid: b13369b4-1fb7-4889-b0b8-6d0ab61aac3d -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# ACT Database Migration - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The schema for an ACT database can change when ACT is updated or when a new version of ACT is released. If the schema for an ACT database does not match the current schema, you can migrate the compatibility data to a new database. You can then use the current version of ACT to open the new database. - -To create the new database, you must have database-creation permissions on the instance of SQL Server. - -## Migrating Compatibility Data from an ACT Database - - -You can migrate compatibility data from an ACT database to a new database by using one of the following methods: - -- Run Application Compatibility Manager (ACM), and then use the ACT Configuration Wizard to open the database. The wizard guides you through migrating the compatibility data to a new database. - -- Run the MigrateDB.sql file, located at %SYSTEMDRIVE%\\ProgramData\\Microsoft\\Application Compatibility Toolkit\\MigrateDB.sql.. The following table shows the location of the MigrateDB.sql file. - -## Database Migration from ACT 5.6 - - -When you migrate compatibility data from an ACT 5.6 database to a new database, the following information is excluded from the migration: - -- Issues that were reported by ACT 5.6 data-collection packages (DCPs). - -- Solutions that correspond to issues reported by ACT 5.6 DCPs. - -- Lists of file names that ACT 5.6 associated with each application. - -You cannot migrate any compatibility data from ACT databases that were created on a version of ACT before ACT 5.6. - -## Related topics - - -[ACT Tools, Packages, and Services](act-tools-packages-and-services.md) - -[ACT Deployment Options](act-deployment-options.md) - -[ACT Database Configuration](act-database-configuration.md) - -[ACT LPS Share Permissions](act-lps-share-permissions.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-deployment-options.md b/windows/plan/act-deployment-options.md index 32bb1e10f0..a550b72152 100644 --- a/windows/plan/act-deployment-options.md +++ b/windows/plan/act-deployment-options.md @@ -1,61 +1,5 @@ --- title: ACT Deployment Options (Windows 10) description: While planning your deployment of the Application Compatibility Toolkit (ACT), consider which computers you want running the various tools, packages, and services for ACT. -ms.assetid: 90d56dd8-8d57-44e8-bf7a-29aabede45ba -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# ACT Deployment Options - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -While planning your deployment of the Application Compatibility Toolkit (ACT), consider which computers you want running the various tools, packages, and services for ACT. - -The following diagram shows supported deployment options for an ACT installation. The options listed first are the most highly recommended. - -![act supported topologies](images/dep-win8-l-act-supportedtopologies.jpg) - -## Collecting Data Across Domains - - -If you plan to deploy inventory-collector packages to computers running Windows XP, where some of the computers are on a different domain than the ACT LPS share, do one of the following: - -- Set up a separate ACT LPS share on each domain and configure the inventory-collector package to upload log files to the ACT LPS share on the same domain. - -- Set up a single ACT LPS share on one computer. On the computer that hosts the share, use Group Policy to allow connections from anonymous users. - -These steps are not necessary if the computers where you deploy inventory-collector packages are running Windows Vista, Windows 7, Windows 8, Windows 8.1, or Windows 10. - -If you choose to have distributed logging with a subsequent step of moving log files to your central share, move the files to the central share before processing the files. You can move the files manually or use a technology like Distributed File-System Replication (DFSR). - -## Related topics - - -[ACT Tools, Packages, and Services](act-tools-packages-and-services.md) - -[ACT Database Configuration](act-database-configuration.md) - -[ACT Database Migration](act-database-migration.md) - -[ACT LPS Share Permissions](act-lps-share-permissions.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-glossary.md b/windows/plan/act-glossary.md index 87b42aab6e..17f66a70be 100644 --- a/windows/plan/act-glossary.md +++ b/windows/plan/act-glossary.md @@ -1,118 +1,5 @@ --- title: ACT Glossary (Windows 10) description: The following table lists terms and definitions used by the Application Compatibility Toolkit (ACT). -ms.assetid: 984d1cce-c1ac-4aa8-839a-a23e15da6f32 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# ACT Glossary - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The following table lists terms and definitions used by the Application Compatibility Toolkit (ACT). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TermDefinition

    ACT Community

    An online environment that enables ACT users to share issues and solution data with other registered ACT users.

    ACT Log Processing Service (LPS)

    The service that processes the log files uploaded from your client computers, adding the information to your ACT database.

    AppHelp message

    A type of compatibility fix. An AppHelp message is designed to appear when a user starts an application that has compatibility issues. The message can prevent the application from starting, or simply provide information about compatibility issues in the application.

    Application Compatibility Manager (ACM)

    The user interface that enables you to view reports generated from the ACT database. This is also where you create data-collection packages.

    Compatibility Administrator

    A tool that enables you to create and deploy compatibility fixes, compatibility modes, and AppHelp messages, to resolve your compatibility issues.

    compatibility fix

    A small piece of code that intercepts API calls from applications, transforming them so that Windows will provide the same product support for the application as previous versions of the operating system. Previously known as a "shim".

    compatibility mode

    Group of compatibility fixes found to resolve many common application compatibility issues.

    compatibility solution

    The solution to a known compatibility issue, as entered by the user, Microsoft, or a vendor.

    data-collection package

    A Windows installer (.msi) file created by Application Compatibility Manager (ACM) for deploying to each of your client computers. Data-collection packages include inventory collection packages and runtime analysis packages.

    deployment

    The process of distributing and installing a software program throughout an entire organization. A deployment is not the same as a pilot, which is where you provide the software application to a smaller group of users to identify and evaluate problems that might occur during the actual deployment.

    independent software vendor (ISV)

    An individual or an organization that independently creates computer software.

    inventory-collector package

    A package that examines each of your organization's computers to identify the installed applications and system information. You can view the results on the Analyze screen in ACM.

    Microsoft Compatibility Exchange

    A web service that transfers compatibility information between Microsoft and the ACT database.

    runtime-analysis package

    A data-collection package that you deploy to computers in a test environment for compatibility testing. The runtime-analysis package includes tools for monitoring applications for compatibility issues and submitting compatibility feedback.

    session 0

    The session that is used for all of the system services. Previously, users could run in Session 0 without issues; however, this was changed in Windows Vista so that all users are now required to run in Session 1 or later.

    shim

    See Other Term: compatibility fix

    User Account Control (UAC)

    A security feature that helps prevent unauthorized changes to a computer, by asking the user for permission or administrator credentials before performing actions that could potentially affect the computer's operation or that change settings that affect multiple users.

    - -  - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-lps-share-permissions.md b/windows/plan/act-lps-share-permissions.md index f2496dc915..37a6534881 100644 --- a/windows/plan/act-lps-share-permissions.md +++ b/windows/plan/act-lps-share-permissions.md @@ -1,76 +1,5 @@ --- title: ACT LPS Share Permissions (Windows 10) description: To upload log files to the ACT Log Processing Service (LPS) share, certain permissions must be set at the share level and folder level. -ms.assetid: 51f6ddf7-f424-4abe-a0e0-71fe616f9e84 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# ACT LPS Share Permissions - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -To upload log files to the ACT Log Processing Service (LPS) share, certain permissions must be set at the share level and folder level. - -## Share-Level Permissions - - -The **Everyone** group must have **Change** and **Read** permissions to the ACT LPS share. - -**To set the share-level permissions** - -1. Browse to the ACT LPS share, right-click the folder, and select **Properties**. - -2. Click the **Sharing** tab, share the folder, and then click **Permissions**. - -3. Add the **Everyone** group if it is not already listed, and then select the **Change** and **Read** check boxes in the **Allow** column. - -## Folder-Level Permissions (NTFS Only) - - -The **Everyone** group must have **Write** access to the ACT LPS share. - -The ACT Log Processing Service account must have **List Folder Contents**, **Read**, and **Write** permissions. - -- If the ACT Log Processing Service account is **Local System Account**, apply the permissions to the *<domain>*\\*<computer>*$ account. - -- If the ACT Log Processing Service is a user account, apply the permissions to the specific user. - -**To set the folder-level permissions** - -1. In Windows Explorer, right-click the folder for the ACT LPS share, and then click **Properties**. - -2. Click the **Security** tab, add the account that runs the ACT Log Processing Service, and then select the **List Folder Contents**, **Read**, and **Write** check boxes in the **Allow** column. - -3. Add the **Everyone** group if it is not already listed, and then select the **Write** check box in the **Allow** column. - -## Related topics - - -[ACT Tools, Packages, and Services](act-tools-packages-and-services.md) - -[ACT Deployment Options](act-deployment-options.md) - -[ACT Database Configuration](act-database-configuration.md) - -[ACT Database Migration](act-database-migration.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-operatingsystem-application-report.md b/windows/plan/act-operatingsystem-application-report.md index 3c0f49d348..62da93a40d 100644 --- a/windows/plan/act-operatingsystem-application-report.md +++ b/windows/plan/act-operatingsystem-application-report.md @@ -1,80 +1,5 @@ --- title: OperatingSystem - Application Report (Windows 10) description: This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports. -ms.assetid: 9721485b-6092-4974-8cfe-c84472237a57 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# <OperatingSystem> - Application Report - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports. - -The **<OperatingSystem> - Application Report** screen shows the following information for the applications from which you have collected data: - -- The application name, application vendor, and application version. - -- Your organization’s compatibility rating for the application. - -- Compatibility ratings from users in your organization who are using a runtime analysis package to test the application. - -- Whether the information for the application is included in the synchronization process with the Microsoft Compatibility Exchange. - -- Compatibility information for the application from the application vendor. - -- Compatibility ratings from the ACT Community, if you are a member of the ACT Community. To join the ACT Community, see [Settings Dialog Box - Preferences Tab](act-settings-dialog-box-preferences-tab.md). - -- The count of active issues for the application. - -- The count of computers in your organization on which the application is installed. - -**To open the <OperatingSystem> - Application Report screen** - -1. In ACM, on the **Quick Reports** pane, click **Analyze**. - -2. In the **Quick Reports** pane, under an operating system heading, click **Applications**. - -## Using the <OperatingSystem> - Application Report Screen - - -On the **<OperatingSystem> - Application Report** screen, you can perform the following actions: - -- Export the report data to a spreadsheet, or import a report. For more information, see [Saving, Opening, and Exporting Reports](saving-opening-and-exporting-reports.md). - -- Choose whether to synchronize data for each application with the Microsoft Compatibility Exchange. For more information, see [Selecting the Send and Receive Status for an Application](selecting-the-send-and-receive-status-for-an-application.md). - -- Synchronize your compatibility issues by using the Microsoft Compatibility Exchange. For more information, see [Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md). - -- Filter the report by using the query builder. For more information, see [Filtering Your Compatibility Data](filtering-your-compatibility-data.md). - -- Select your compatibility rating for an application. For more information, see [Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md). - -- Select your deployment status for an application. For more information, see [Selecting Your Deployment Status](selecting-your-deployment-status.md). - -- Assign categories and subcategories to an application. For more information, see [Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md). - -- Specify the importance of an application to your organization. For more information, see [Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md). - -- Double-click an application name to view the associated dialog box. For more information, see [<Application> Dialog Box](application-dialog-box.md). - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-operatingsystem-computer-report.md b/windows/plan/act-operatingsystem-computer-report.md index 3547b28c17..bf508ee97a 100644 --- a/windows/plan/act-operatingsystem-computer-report.md +++ b/windows/plan/act-operatingsystem-computer-report.md @@ -1,62 +1,5 @@ --- title: OperatingSystem - Computer Report (Windows 10) -ms.assetid: ed0a56fc-9f2a-4df0-8cef-3a09d6616de8 -description: -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# <OperatingSystem> - Computer Report - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The **<OperatingSystem> - Computer Report** screen shows the following information for each computer in your organization: - -- The computer name, domain, and operating system. - -- The count of applications and devices installed on the computer. - -- The count of installed applications and devices that have issues. - -**To open the <OperatingSystem> - Computer Report screen** - -1. In Application Compatibility Manager (ACM), on the **Quick Reports** pane, click **Analyze**. - -2. In the **Quick Reports** pane, under an operating system heading, click **Computers**. - -## Using the <OperatingSystem> - Computer Report Screen - - -On the **<OperatingSystem> - Computer Report** screen, you can perform the following actions: - -- Export the report data to a spreadsheet, or import a report. For more information, see [Saving, Opening, and Exporting Reports](saving-opening-and-exporting-reports.md). - -- Synchronize your compatibility issues by using the Microsoft Compatibility Exchange. For more information, see [Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md). - -- Filter the report by using the query builder. For more information, see [Filtering Your Compatibility Data](filtering-your-compatibility-data.md). - -- Assign categories and subcategories to a computer. For more information, see [Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md). - -- Specify the importance of a computer to your organization. For more information, see [Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md). - -- Double-click a computer name to view its associated dialog box. For more information, see [<Computer> Dialog Box](computer-dialog-box.md). - -  - -  - - - - - +description: This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports. +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-operatingsystem-device-report.md b/windows/plan/act-operatingsystem-device-report.md index 67e74536c6..6668aa3041 100644 --- a/windows/plan/act-operatingsystem-device-report.md +++ b/windows/plan/act-operatingsystem-device-report.md @@ -1,64 +1,5 @@ --- title: OperatingSystem - Device Report (Windows 10) -ms.assetid: 8b5a936f-a92e-46a7-ac44-6edace262355 -description: -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# <OperatingSystem> - Device Report - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The **<OperatingSystem> - Device Report** screen shows the following information for each device installed in your organization: - -- The model and manufacturer of the device. - -- The class of device, as reported by the device. - -- An evaluation from the device manufacturer of whether the device works on a 32-bit operating system or a 64-bit operating system. - -- The count of computers on which the device is installed. - -**To open the <OperatingSystem> - Device Report screen** - -1. In Application Compatibility Manager (ACM), on the **Quick Reports** pane, click **Analyze**. - -2. In the **Quick Reports** pane, under an operating system heading, click **Devices**. - -## Using the <OperatingSystem> - Device Report Screen - - -On the **<OperatingSystem> - Device Report** screen, you can: - -- Export the report data to a spreadsheet, or import a report. For more information, see [Saving, Opening, and Exporting Reports](saving-opening-and-exporting-reports.md). - -- Synchronize your compatibility issues by using the Microsoft Compatibility Exchange. For more information, see [Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md). - -- Filter the report by using the query builder. For more information, see [Filtering Your Compatibility Data](filtering-your-compatibility-data.md). - -- Assign categories and subcategories to a device. For more information, see [Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md). - -- Specify the importance of a device to your organization. For more information, see [Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md). - -- Double-click a device name to view its associated dialog box. For more information, see [<Device> Dialog Box](device-dialog-box.md). - -  - -  - - - - - +description: This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports. +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-product-and-documentation-resources.md b/windows/plan/act-product-and-documentation-resources.md index 02677af71d..2c3290db5b 100644 --- a/windows/plan/act-product-and-documentation-resources.md +++ b/windows/plan/act-product-and-documentation-resources.md @@ -1,62 +1,8 @@ --- title: ACT Product and Documentation Resources (Windows 10) description: The following sections provide links to resources and reference material for the Application Compatibility Toolkit (ACT). -ms.assetid: c7954b5a-164d-4548-af58-cd3a1de5cc43 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics --- - -# ACT Product and Documentation Resources - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The following sections provide links to resources and reference material for the Application Compatibility Toolkit (ACT). - -## Information Related to the Application Compatibility Toolkit - - -- [Microsoft SQL Server](http://go.microsoft.com/fwlink/p/?LinkId=184584). Use Microsoft SQL Server to take full advantage of ACT features. Visit the SQL Server home page for product information, technical resources, and support. - -- [Microsoft SQL Server Express Edition](http://go.microsoft.com/fwlink/p/?LinkId=690325). If you are not already running SQL Server, download a free version of SQL Server Express and its management tools. - -- [Microsoft System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=690326). Visit the System Center Configuration Manager home page for product information, technical resources, and support. - -- [Microsoft Application Verifier](http://go.microsoft.com/fwlink/p/?LinkId=52529). Application Verifier is required by the Standard User Analyzer tool. - -## Information About Application Compatibility - - -- [Application Compatibility home page](http://go.microsoft.com/fwlink/p/?LinkId=184586). Go here for general application compatibility information, including videos, key resources, advice, and technical guidance. - -- [Windows Developer Center home page](http://go.microsoft.com/fwlink/p/?LinkId=184587). Find information about the Windows SDK, including how to develop your application, how to get help with compatibility issues, and other development-related content. - -## Information About Windows Deployment - - -- [Microsoft Deployment Toolkit](http://go.microsoft.com/fwlink/p/?LinkId=618117). Download the latest version of the Microsoft Deployment Toolkit (MDT) to assist with image creation and automated installation, reduce deployment time, standardize desktop and server images, limit service disruptions, reduce post-deployment help desk costs, and improve security and ongoing configuration management. - -- [Windows website](http://go.microsoft.com/fwlink/p/?LinkId=731). Visit the Windows home page for product information, technical resources, and support. - -## Related topics - - -[Troubleshooting ACT](troubleshooting-act.md) - -[Using ACT](using-act.md) - -[Software Requirements for ACT](software-requirements-for-act.md) -     diff --git a/windows/plan/act-settings-dialog-box-preferences-tab.md b/windows/plan/act-settings-dialog-box-preferences-tab.md index 6af88e476e..eaa5fec362 100644 --- a/windows/plan/act-settings-dialog-box-preferences-tab.md +++ b/windows/plan/act-settings-dialog-box-preferences-tab.md @@ -1,65 +1,5 @@ --- title: Settings Dialog Box - Preferences Tab (Windows 10) description: To display the Settings dialog box, in Application Compatibility Manager (ACM), on the Tools menu, click Settings. -ms.assetid: deae2100-4110-4d72-b5ee-7c167f80bfa4 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Settings Dialog Box - Preferences Tab - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -To display the **Settings** dialog box, in Application Compatibility Manager (ACM), on the **Tools** menu, click **Settings**. - -In the **Settings** dialog box, on the **Preferences** tab, use the following controls to join or leave the ACT Community, send ACT usage data to Microsoft, or be notified when there are updates available for ACT. - -**Yes, I want to join the ACT Community** -If this check box is selected, you are a member of the ACT Community and can share application compatibility data with other ACT users. - -If this check box is cleared, you still receive compatibility data from the Microsoft compatibility database, but not from other ACT users. - -For more information about the ACT Community, see [ACT Community Ratings and Process](act-community-ratings-and-process.md). - -**Send ACT usage data to Microsoft** -If this check box is selected, the following ACT usage data is sent to Microsoft: - -- The version of SQL Server being used by the ACT database. - -- The count of 32-bit or 64-bit computers in your organization. - -- The count of computers running a Windows operating system. - -- The operating systems you intend to deploy into your organization. - -- The count of computers to which you deployed data-collection packages. - -If this check box is cleared, your ACT usage data is not sent to Microsoft. - -**Notify me when a newer version of ACT is available (recommended)** -If this check box is selected, ACM notifies you when an update is available for ACT. - -## Related topics - - -[Settings Dialog Box - Settings Tab](act-settings-dialog-box-settings-tab.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-settings-dialog-box-settings-tab.md b/windows/plan/act-settings-dialog-box-settings-tab.md index 0f1b179b3c..30e7000dd2 100644 --- a/windows/plan/act-settings-dialog-box-settings-tab.md +++ b/windows/plan/act-settings-dialog-box-settings-tab.md @@ -1,66 +1,5 @@ --- title: Settings Dialog Box - Settings Tab (Windows 10) description: To display the Settings dialog box, in Application Compatibility Manager (ACM), on the Tools menu, click Settings. -ms.assetid: aeec1647-cf91-4f8b-9f6d-dbf4b898d901 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Settings Dialog Box - Settings Tab - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -To display the **Settings** dialog box, in Application Compatibility Manager (ACM), on the **Tools** menu, click **Settings**. - -In the **Settings** dialog box, on the **Settings** tab, use the following controls to modify the settings for your ACT database and ACT Log Processing Service. - -**SQL Server** -Lists the database server name for the SQL Server database server that contains your ACT database. - -Click **Browse** to search for available database servers. A **Select Server** dialog box appears from which you can select the database server that contains your ACT database. - -**Database** -Lists the database name of your ACT database. - -**Change** -Opens the user interface where you can create, open, or migrate an ACT database. - -**This computer is configured as a Log Processing Service** -If selected, indicates that this computer is used for the ACT Log Processing Service. Clear this check box to use a different computer to process the logs. - -If there is no designated ACT Log Processing Service, log processing defaults to the local computer. - -**Log Processing Service Account** -Specifies the account information, including the account type and account credentials, to be used to start the ACT Log Processing Service. - -The account must have read and write access to the ACT database. For information about setting up database permissions for the ACT Log Processing Service, see [Troubleshooting ACT Database Issues](troubleshooting-act-database-issues.md). - -**Log Share** -Specifies the absolute path to the ACT Log Processing Service share where log files are processed. Click **Browse** to search for a location. The **Share as** box automatically updates to show the directory name. - -For information about ensuring that all computers can access the share, see [Troubleshooting the ACT Log Processing Service](troubleshooting-the-act-log-processing-service.md). - -## Related topics - - -[Settings Dialog Box - Preferences Tab](act-settings-dialog-box-preferences-tab.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-technical-reference.md b/windows/plan/act-technical-reference.md index c05f03fc92..29e311a2f5 100644 --- a/windows/plan/act-technical-reference.md +++ b/windows/plan/act-technical-reference.md @@ -13,77 +13,37 @@ author: TrudyHa **Applies to** +- Windows 10, version 1607 + +We've replaced the majority of functionality included in the Application Compatibility Toolkit (ACT) with Upgrade Analytics, a solution in the Microsoft Operations Management Suite. Upgrade Analytics gives enterprises the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With new Windows versions being released multiple times a year, ensuring application and driver compatibility on an ongoing basis is key to adopting new Windows versions as they are released. + +Microsoft developed Upgrade Analytics in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Upgrade Analytics was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10. + +With Windows telemetry enabled, Upgrade Analytics collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. + +Use Upgrade Analytics to get: +- A visual workflow that guides you from pilot to production -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 +- Detailed computer and application inventory -The Microsoft® Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. +- Powerful computer level search and drill-downs -By using ACT, you can obtain compatibility information from Microsoft and software vendors, identify compatibility issues within your own organization, and share compatibility ratings with other ACT users. The tools in ACT help you analyze and mitigate compatibility issues before you deploy a version of Windows to your organization. +- Guidance and insights into application and driver compatibility issues, with suggested fixes -ACT is available in the [Windows Assessment and Deployment Kit (ADK) for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=526740). +- Data driven application rationalization tools + +- Application usage information, allowing targeted validation; workflow to track validation progress and decisions + +- Data export to commonly used software deployment tools, including System Center Configuration Manager + +The Upgrade Analytics workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. For more information about Upgrade Analytics, see [Manage Windows upgrades with Upgrade Analytics](https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics) + +At the same time, we've kept the Standard User Analyzer tool, which helps you test your apps and to monitor API calls for potential compatibility issues, and the Compatiblility Administrator, which helps you to resolve potential compatibility issues. ## In this section - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Welcome to ACT](welcome-to-act.md)

    The Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. With ACT, you can obtain compatibility information from Microsoft and software vendors, identify compatibility issues within your own organization, and share compatibility ratings with other ACT users. The tools in ACT help you analyze and mitigate compatibility issues before deploying a version of Windows to your organization.

    [Configuring ACT](configuring-act.md)

    This section provides information about setting up the Application Compatibility Toolkit (ACT) in your organization.

    [Using ACT](using-act.md)

    This section describes how to use the Application Compatibility Toolkit (ACT) in your organization.

    [Troubleshooting ACT](troubleshooting-act.md)

    This section provides troubleshooting information for the Application Compatibility Toolkit (ACT).

    [ACT User Interface Reference](act-user-interface-reference.md)

    This section contains information about the user interface for Application Compatibility Manager (ACM), which is a tool in the Application Compatibility Toolkit (ACT).

    [ACT Product and Documentation Resources](act-product-and-documentation-resources.md)

    The following sections provide links to resources and reference material for the Application Compatibility Toolkit (ACT).

    [ACT Glossary](act-glossary.md)

    The following table lists terms and definitions used by the Application Compatibility Toolkit (ACT).

    [Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md)

    You can fix some compatibility issues that are due to the changes made between Windows operating system versions. These issues can include User Account Control (UAC) restrictions.

    - -  - -  - -  - - - - - +|Topic |Description | +|------|------------| +|[Standard User Analyzer (SUA) User's Guide](sua-users-guide.md) |The Standard User Analyzer (SUA) helps you test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows. | +|[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) |The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows to your organization. | +|[Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) |You can fix some compatibility issues that are due to the changes made between Windows operating system versions. These issues can include User Account Control (UAC) restrictions. | \ No newline at end of file diff --git a/windows/plan/act-toolbar-icons-in-acm.md b/windows/plan/act-toolbar-icons-in-acm.md index 9a0d2b3e79..bd6b97dcde 100644 --- a/windows/plan/act-toolbar-icons-in-acm.md +++ b/windows/plan/act-toolbar-icons-in-acm.md @@ -1,233 +1,5 @@ --- title: Toolbar Icons in ACM (Windows 10) description: The following table shows icons that appear on toolbars and navigational elements in Application Compatibility Manager (ACM). -ms.assetid: 44872da1-c7ad-41b9-8323-d3c3f49b2706 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Toolbar Icons in ACM - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The following table shows icons that appear on toolbars and navigational elements in Application Compatibility Manager (ACM). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    IconDescriptionLocation
    ACT home icon

    Opens the Application Compatibility Manager Overview screen.

      -

    • Collect toolbar

      • -

    • Analyze toolbar

      • -
    ACT Create new DCP

    Opens the New Data Collection Package dialog box.

    -

    For more information, see [Creating a Runtime-Analysis Package](creating-a-runtime-analysis-package.md).

      -

    • Collect toolbar

      • -
    ACT export DCP

    Exports your data-collection package settings.

    -

    For more information, see [Exporting a Data-Collection Package](exporting-a-data-collection-package.md).

      -

    • Collect toolbar

      • -
    ACT delete icon

    Deletes a data-collection package that has not yet run on your client computers.

    -

    For more information, see [Deleting a Data-Collection Package](deleting-a-data-collection-package.md).

      -

    • Collect toolbar

      • -
    ACT open icon

    Imports an existing compatibility report.

    -

    For more information, see [Saving, Opening, and Exporting Reports](saving-opening-and-exporting-reports.md).

      -

    • Analyze toolbar

      • -
    ACT save report

    Saves a compatibility report, including your preferences and settings.

    -

    For more information, see [Saving, Opening, and Exporting Reports](saving-opening-and-exporting-reports.md).

      -

    • Analyze toolbar

      • -
    ACT export report data

    Exports your report data to a Microsoft® Excel® spreadsheet (.xls) file.

    -

    For more information, see [Saving, Opening, and Exporting Reports](saving-opening-and-exporting-reports.md).

      -

    • Analyze toolbar

      • -
    ACT send and receive

    Synchronizes your compatibility data with the Microsoft Compatibility Exchange.

    -

    For more information, see [Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md).

      -

    • Analyze toolbar

      • -
    ACT filter data

    Turns the query builder on or off.

    -

    For more information, see [Filtering Your Compatibility Data](filtering-your-compatibility-data.md).

      -

    • Analyze toolbar

      • -
    ACT Risk Assessment

    Opens the Set Assessment dialog box.

    -

    For more information, see [Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md).

      -

    • Analyze toolbar

      • -

    • Report Details toolbar

      • -
    ACT deployment status

    Opens the Set Deployment Status dialog box.

    -

    For more information, see [Selecting Your Deployment Status](selecting-your-deployment-status.md).

      -

    • Analyze toolbar

      • -

    • Report Details toolbar

      • -
    ACT categorize icon

    Opens the Assign Categories dialog box.

    -

    For more information, see [Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md).

      -

    • Analyze toolbar

      • -

    • Report Details toolbar

      • -
    ACT prioritize icon

    Opens the Assign Priorities dialog box.

    -

    For more information, see [Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md).

      -

    • Analyze toolbar

      • -

    • Report Details toolbar

      • -
    ACT send and receive icon

    Opens the Send and Receive Status dialog box.

    -

    For more information, see [Selecting the Send and Receive Status for an Application](selecting-the-send-and-receive-status-for-an-application.md).

      -

    • Analyze toolbar

      • -

    • Report Details toolbar

      • -
    ACT Add issue icon

    Opens the Add Issue dialog box.

    -

    For more information, see [Adding or Editing an Issue](adding-or-editing-an-issue.md).

      -

    • Report Details toolbar

      • -
    ACT add solution

    Opens the Add Solution dialog box.

    -

    For more information, see [Adding or Editing a Solution](adding-or-editing-a-solution.md).

      -

    • Report Details toolbar

      • -
    ACT Save icon

    Saves a compatibility issue.

      -

    • Add Issue dialog box

      • -
    ACT Reactivate resolved issue icon

    Reactivates a resolved compatibility issue.

    -

    For more information, see [Resolving an Issue](resolving-an-issue.md).

      -

    • Add Issue dialog box

      • -
    ACT refresh icon

    Refreshes the screen. If you are using the query builder, updates the screen with the query results.

      -

    • Collect toolbar

      • -

    • Analyze toolbar

      • -

    • Data Collection Package - Status toolbar

      • -

    • Report Details toolbar

      • -
    ACT move up and down icons

    Enables you to scroll up and down the screen or dialog box information, showing the related details.

    -

    This button may not be available for all issues or information.

      -

    • Report Details toolbar

      • -

    • Add Issue dialog box

      • -

    • New Data Collection Package dialog box

      • -

    • Data Collection Package - Status toolbar

      • -
    ACT help icon

    Opens the online Help system.

      -

    • All screens

      • -
    - -  - -## Related topics - - -[Ratings Icons in ACM](ratings-icons-in-acm.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-tools-packages-and-services.md b/windows/plan/act-tools-packages-and-services.md index bf9c2bf728..7e20751a4a 100644 --- a/windows/plan/act-tools-packages-and-services.md +++ b/windows/plan/act-tools-packages-and-services.md @@ -1,60 +1,5 @@ --- title: ACT Tools, Packages, and Services (Windows 10) description: The Application Compatibility Toolkit is included with the Windows ADK. Download the Windows ADK. -ms.assetid: f5a16548-7d7b-4be9-835e-c06158dd0b89 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# ACT Tools, Packages, and Services - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Application Compatibility Toolkit is included with the Windows ADK. [Download the Windows ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) - -ACT includes the following: - -- **Application Compatibility Manager (ACM):** A tool that you can use to create your data-collection packages and analyze the collected inventory and compatibility data. - -- **Inventory-collector package:** A data-collection package that can be deployed to computers to gather inventory data that will be uploaded to the ACT database. - -- **Runtime-analysis package:** A data-collection package that can be deployed to computers in a test environment for compatibility testing on the new operating system. - -- **ACT Log Processing Service (LPS):** A service that is used to process the ACT log files uploaded from the computers where your data-collection packages have been installed. The service adds the information to your ACT database. - -- **ACT LPS share:** A file share that is accessed by the ACT LPS, to store the log files that will be processed and added to the ACT database. - -- **ACT database:** A Microsoft® SQL Server database that stores the collected inventory and compatibility data. You can use ACM to view the information stored in the ACT database. - -- **Microsoft Compatibility Exchange:** A web service that propagates application-compatibility issues. - -## Related topics - - -[ACT Deployment Options](act-deployment-options.md) - -[ACT Database Configuration](act-database-configuration.md) - -[ACT Database Migration](act-database-migration.md) - -[ACT LPS Share Permissions](act-lps-share-permissions.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/act-user-interface-reference.md b/windows/plan/act-user-interface-reference.md index ff28470715..affbef996f 100644 --- a/windows/plan/act-user-interface-reference.md +++ b/windows/plan/act-user-interface-reference.md @@ -1,74 +1,5 @@ --- title: ACT User Interface Reference (Windows 10) description: This section contains information about the user interface for Application Compatibility Manager (ACM), which is a tool in the Application Compatibility Toolkit (ACT). -ms.assetid: 303d3dd7-2cc1-4f5f-b032-b7e288b04893 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# ACT User Interface Reference - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section contains information about the user interface for Application Compatibility Manager (ACM), which is a tool in the Application Compatibility Toolkit (ACT). - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Toolbar Icons in ACM](act-toolbar-icons-in-acm.md)

    The following table shows icons that appear on toolbars and navigational elements in Application Compatibility Manager (ACM).

    [Ratings Icons in ACM](ratings-icons-in-acm.md)

    Compatibility ratings can originate from Microsoft, the application vendor, your organization, and from the Application Compatibility Toolkit (ACT) community.

    [Activating and Closing Windows in ACM](activating-and-closing-windows-in-acm.md)

    The Windows dialog box shows the windows that are open in Application Compatibility Manager (ACM).

    [Settings for ACM](settings-for-acm.md)

    This section provides information about settings that you can configure in Application Compatibility Manager (ACM).

    - -  - -## Related topics - - -[Using ACT](using-act.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/activating-and-closing-windows-in-acm.md b/windows/plan/activating-and-closing-windows-in-acm.md index dfa085659e..4640049e22 100644 --- a/windows/plan/activating-and-closing-windows-in-acm.md +++ b/windows/plan/activating-and-closing-windows-in-acm.md @@ -1,47 +1,8 @@ --- title: Activating and Closing Windows in ACM (Windows 10) description: The Windows dialog box shows the windows that are open in Application Compatibility Manager (ACM). -ms.assetid: 747bf356-d861-4ce7-933e-fa4ecfac7be5 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics --- - -# Activating and Closing Windows in ACM - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The **Windows** dialog box shows the windows that are open in Application Compatibility Manager (ACM). - -**To view a list of the open windows in ACM** - -- On the **Window** menu, click **Windows**. - -**To show an open window in ACM** - -- In the **Windows** dialog box, click the window name from the list of open windows, and then click **Activate**. - - The selected window appears on top of any others on your screen. - -**To close one or more windows in ACM** - -- In the **Windows** dialog box, click one or more window names from the list of open windows, and then click **Close Window(s)**. - -## Related topics - - -[Managing Your Data-Collection Packages](managing-your-data-collection-packages.md) -     diff --git a/windows/plan/adding-or-editing-a-solution.md b/windows/plan/adding-or-editing-a-solution.md index f16e5237b2..b5a52a45c2 100644 --- a/windows/plan/adding-or-editing-a-solution.md +++ b/windows/plan/adding-or-editing-a-solution.md @@ -1,105 +1,5 @@ --- title: Adding or Editing a Solution (Windows 10) description: If you find your own solutions to compatibility issues, you can enter the solutions in Application Compatibility Manager (ACM). You can use the Microsoft Compatibility Exchange to upload solutions to Microsoft Corporation. -ms.assetid: 86cb8804-d577-4af6-b96f-5e0409784a23 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Adding or Editing a Solution - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -If you find your own solutions to compatibility issues, you can enter the solutions in Application Compatibility Manager (ACM). You can use the Microsoft Compatibility Exchange to upload solutions to Microsoft Corporation. - -## Adding Solutions for Compatibility Issues with Your Applications and Websites - - -You can view or add solutions only for applications or websites. - -**Note**   -The following examples use the **<Application\_Name>** dialog box. The procedures for websites are similar. - -  - -**To add a solution** - -1. On the **<Operating\_System> - Application Report** screen, double-click the name of the application to display the **<Application\_Name>** dialog box. - -2. Click the **Issues** tab. - -3. On the **Actions** menu, click **Add Solution**. - -4. Enter the information from the following table, and then click **Save**. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    Title

    Can be up to 100 characters in length.

    Solution Type

    You must select a value from the list.

    Solution Details

    Information about your solution, including the steps to reproduce your fix.

    Solution Details URL

    URL for a page that shows more information about the solution.

    - -   - -**To edit an existing solution** - -1. On the **<Operating\_System> - Application Report** screen, double-click the name of the application to display the <Application\_Name> dialog box. - -2. Click the **Issues** tab. - -3. Double-click the issue that includes the solution that you want to modify. - -4. Click the **Solutions** tab. - -5. Double-click the solution to edit. - -6. Modify the information about the solution, and then click **Save**. - - **Note**   - You can only modify your own solutions. You cannot modify solutions entered by other users. - -   - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/adding-or-editing-an-issue.md b/windows/plan/adding-or-editing-an-issue.md index 75e4e67390..08d2098675 100644 --- a/windows/plan/adding-or-editing-an-issue.md +++ b/windows/plan/adding-or-editing-an-issue.md @@ -1,115 +1,5 @@ --- title: Adding or Editing an Issue (Windows 10) description: In Application Compatibility Manager (ACM), you can enter information about the compatibility issues that you discover. -ms.assetid: 8a9fff79-9f88-4ce2-a4e6-b9382f28143d -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Adding or Editing an Issue - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -In Application Compatibility Manager (ACM), you can enter information about the compatibility issues that you discover. - -You can use the Microsoft Compatibility Exchange to share compatibility information with others. For information about the Microsoft Compatibility Exchange, see [Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md). - -## Adding Issues for Your Applications and Websites - - -You can view or add issues only for applications or websites. - -**Note**   -The following examples use the **<Application\_Name>** dialog box. The procedures are similar for websites. - -  - -**To add an issue** - -1. On the **<Operating\_System> - Application Report** screen, double-click the name of the application to display the **<Application\_Name>** dialog box. - -2. On the **Actions** menu, click **Add Issue**. - -3. Enter the information from the following table, and then click **Save**. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    Title

    Can be up to 256 characters in length.

    Priority

    You must select a value from the list.

    Severity

    You must select a value from the list.

    Symptom

    You must select a value from the list.

    Cause

    You must select a value from the list.

    Affected Operating Systems

    Operating systems on which the issue occurs. You must select at least one operating system.

    Issue Description

    Description of the issue, including the steps to reproduce the problem.

    Link to More Information

    URL for a page that shows more information about the issue.

    - -   - -**To edit an existing issue** - -1. On the **<Operating\_System> - Application Report** screen, double-click the name of the application that includes the issue you want to modify. - -2. In the **<Application\_Name>** dialog box, click the **Issues** tab, and then double-click the specific issue to be edited. - -3. Modify the issue information, and then click **Save**. - - **Note**   - You can modify your own issues. You cannot modify issues entered by another user. - -   - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/analyzing-your-compatibility-data.md b/windows/plan/analyzing-your-compatibility-data.md index 30f6a43c24..2d69b55931 100644 --- a/windows/plan/analyzing-your-compatibility-data.md +++ b/windows/plan/analyzing-your-compatibility-data.md @@ -1,80 +1,5 @@ --- title: Analyzing Your Compatibility Data (Windows 10) description: This section provides information about viewing and working with your compatibility data in Application Compatibility Manager (ACM). -ms.assetid: b98f3d74-fe22-41a2-afe8-2eb2799933a1 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Analyzing Your Compatibility Data - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides information about viewing and working with your compatibility data in Application Compatibility Manager (ACM). - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Viewing Your Compatibility Reports](viewing-your-compatibility-reports.md)

    This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports.

    [Organizing Your Compatibility Data](organizing-your-compatibility-data.md)

    This section provides step-by-step instructions for organizing your compatibility data in Application Compatibility Manager (ACM).

    [Filtering Your Compatibility Data](filtering-your-compatibility-data.md)

    You can use Query Builder to filter your compatibility-issue data or reports by selecting specific restriction criteria.

    [Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md)

    The Microsoft® Compatibility Exchange is a web service that propagates application compatibility issues between various data sources, for example Microsoft Corporation, independent software vendors (ISVs) and the ACT Community. This process involves checking for updated compatibility information from Microsoft over the Internet. You can send and receive data to keep Application Compatibility Manager (ACM) updated with the latest compatibility information.

    - -  - -## Related topics - - -[Taking Inventory of Your Organization](taking-inventory-of-your-organization.md) - -[Testing Compatibility on the Target Platform](testing-compatibility-on-the-target-platform.md) - -[Managing Your Data-Collection Packages](managing-your-data-collection-packages.md) - -[Fixing Compatibility Issues](fixing-compatibility-issues.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/application-dialog-box.md b/windows/plan/application-dialog-box.md index c8d9515fa6..7615d0949e 100644 --- a/windows/plan/application-dialog-box.md +++ b/windows/plan/application-dialog-box.md @@ -1,126 +1,5 @@ --- title: Application Dialog Box (Windows 10) description: In Application Compatibility Manager (ACM), the Application dialog box shows information about the selected application. -ms.assetid: a43e85a6-3cd4-4235-bc4d-01e4d097db7e -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# <Application> Dialog Box - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -In Application Compatibility Manager (ACM), the *<Application>* dialog box shows information about the selected application. - -**To open the <Application> dialog box** - -1. In ACM, in the **Quick Reports** pane, click **Analyze**. - -2. Under an operating system heading, click **Applications**. - -3. Double-click the name of an application. - -## Tabs in the <Application> dialog box - - -The following table shows the information available in the *<Application>* dialog box. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TabInformation

    Assessment

    Shows the compatibility ratings for the application from the application vendor, your internal organization, and the ACT Community.

    -

    For more information, see [Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md).

    Issues

    For each issue associated with the selected application, shows:

    -
      -

    • The issue status, either active (a red X) or resolved (a green check mark).

      • -

    • The provider who created the record of the issue.

      • -

    • The severity of the issue as entered by the provider.

      • -

    • The symptom of the issue as entered by the provider.

      • -

    • The date on which the issue was added to the ACT database.

      • -
    -

    For more information, see [Creating and Editing Issues and Solutions](creating-and-editing-issues-and-solutions.md).

    Application Properties

    Shows the following properties for the selected application:

    -
      -

    • MSI. Shows the installer name, vendor, version, language, and so on.

      • -

    • Add/Remove Programs. Shows the application name that appears in Control Panel, vendor, registry path, and string for uninstalling.

      • -

    • Shell. Shows the shortcuts for the application and where the shortcuts appear on the Start menu.

      • -

    • Registry. Shows the registry name for the application, registry path, file name, and so on.

      • -

    • Service Control Manager. Shows the entries in the Services console that correspond to the application.

      • -

    Computers

    Shows the following information for each of the computers that have the specified application installed:

    -
      -

    • Computer name, domain, and operating system.

      • -

    • Media Access Control (MAC) address for the computer.

      • -

    • Manufacturer of the computer.

      • -

    Labels

    Shows the label for the selected application.

    -

    For information about labels, see [Labeling Data in ACM](labeling-data-in-acm.md).

    Feedback

    Shows feedback that your testers have submitted to the ACT database for the selected application.

    - -  - -## Using the <Application> Dialog Box - - -In the **<Application>** dialog box, you can perform the following actions: - -- Select your compatibility rating for the application. For more information, see [Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md). - -- Select your deployment status for the application. For more information, see [Selecting Your Deployment Status](selecting-your-deployment-status.md). - -- Assign categories and subcategories to the application. For more information, see [Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md). - -- Specify the importance of the application to your organization. For more information, see [Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md). - -- Choose whether to synchronize data for the application with the Microsoft Compatibility Exchange. For more information, see [Selecting the Send and Receive Status for an Application](selecting-the-send-and-receive-status-for-an-application.md). - -- Add, edit, or resolve an issue for the selected application, and add or edit solutions. For more information, see [Creating and Editing Issues and Solutions](creating-and-editing-issues-and-solutions.md). - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/available-data-types-and-operators-in-compatibility-administrator.md b/windows/plan/available-data-types-and-operators-in-compatibility-administrator.md index 8076d0787c..a83be4fbc1 100644 --- a/windows/plan/available-data-types-and-operators-in-compatibility-administrator.md +++ b/windows/plan/available-data-types-and-operators-in-compatibility-administrator.md @@ -222,8 +222,6 @@ The following table shows the operators that you can use for querying your custo   ## Related topics - - [Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md)   diff --git a/windows/plan/categorizing-your-compatibility-data.md b/windows/plan/categorizing-your-compatibility-data.md index f00d576eee..e77b9ca34e 100644 --- a/windows/plan/categorizing-your-compatibility-data.md +++ b/windows/plan/categorizing-your-compatibility-data.md @@ -1,90 +1,5 @@ --- title: Categorizing Your Compatibility Data (Windows 10) -ms.assetid: 6420f012-316f-4ef0-bfbb-14baaa664e6e -description: -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Categorizing Your Compatibility Data - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -To customize and filter your compatibility reports, you can create categories and subcategories to assign to your applications, computers, devices, and websites. By default, Microsoft provides the following categories: - -- **Software Vendor**. In this category, you can, for example, create a subcategory for each vendor. You can then use this category to generate reports by software vendor, which can be helpful when having discussions with a specific vendor or evaluating the vendor’s performance relative to your compatibility requirements. - -- **Test Complexity**. You can use this category to help with planning and assigning test resources. You can, for example, create subcategories like Critical and Nice-to-Have. - -Categories are extensible, multiple-selection string values, so you can use them for almost anything. For example, you can create a category for signoff from multiple owners so that software can be authorized only when all categories have been selected, indicating that each group has signed off. - -As another example, you can create a category for unit of deployment. You can use subcategories such as Division and Region. You can use this category to track the software needs of a specific deployment unit. This way, you can see when the software required by the unit has been tested, approved, and is ready for deployment to the unit. - -**Note**   -The following examples use the **<Operating\_System> - Application Report** screen. You can alternatively use the **<Application\_Name>** dialog box. You can also complete these procedures in the reports for computers, devices, and websites. - -  - -## Creating, Renaming, or Deleting Categories and Subcategories - - -You can manage your categories and subcategories from both the report screen and report-details screen. - -**To create, rename, or delete a category or subcategory** - -1. On the **<Operating\_System> - Application Report** screen, click any application name. - -2. On the **Actions** menu, click **Assign Categories**. - -3. Click **Category List**. - -4. In the **Categories** or **Subcategories** area, do any or all of the following: - - - Add a category or subcategory, by clicking **Add**. Type the name of your new category or subcategory, and then click outside the active text area. - - You must create at least one subcategory before a category will appear in the **Assign Categories** dialog box. - - - Rename a category or subcategory, by selecting the item and then clicking **Rename**. Type the new name, and then click outside the active text area. - - - Delete a category or subcategory, by selecting the item and then clicking **Remove**. - -5. After you have finished adding, renaming, and deleting categories and subcategories, click **OK** to close the **Category List** dialog box. - -## Assigning Data to a Category and Subcategory - - -You can assign categories and subcategories from both the report screen and report-details screen. - -**To assign and unassign categories and subcategories** - -1. On the **<Operating\_System> - Application Report** screen, click the application name. - -2. On the **Actions** menu, click **Assign Categories**. - -3. To assign a category, select the check box next to the applicable category or subcategory. - - To unassign a category, clear the check box. - -4. Click **OK**. - - You can use the query builder to filter based on this information. - -  - -  - - - - - +description: Steps to customize and filter your compatibility reports through categories and subcategories. +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/change-history-for-plan-for-windows-10-deployment.md b/windows/plan/change-history-for-plan-for-windows-10-deployment.md index 215b92dbfb..fe06fd00a1 100644 --- a/windows/plan/change-history-for-plan-for-windows-10-deployment.md +++ b/windows/plan/change-history-for-plan-for-windows-10-deployment.md @@ -14,9 +14,10 @@ author: TrudyHa This topic lists new and updated topics in the [Plan for Windows 10 deployment](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). + ## RELEASE: Windows 10, version 1607 -The topics in this library have been updated for Windows 10, version 1607 (also known as the Anniversary Update). The following new topics have been added: +The topics in this library have been updated for Windows 10, version 1607 (also known as the Anniversary Update). ## July 2016 @@ -24,6 +25,7 @@ The topics in this library have been updated for Windows 10, version 1607 (also | New or changed topic | Description | |--------------------------------------------------------------------------------------------------------------------------------------------------|-------------| +|[Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) (multiple topics) |Redirected deprecated content to the [Upgrade Analytics](../deploy/manage-windows-upgrades-with-upgrade-analytics.md) content. Only Standard User Analyzer and Compatibility Administrator continue to be supported.| | [Windows 10 servicing overview](windows-10-servicing-options.md) | Content on this page was summarized. Detailed content about servicing branches was moved to the [Windows 10 servicing options](../manage/introduction-to-windows-10-servicing.md) page. | diff --git a/windows/plan/chromebook-migration-guide.md b/windows/plan/chromebook-migration-guide.md index 12773fdd7e..8db7b3b57c 100644 --- a/windows/plan/chromebook-migration-guide.md +++ b/windows/plan/chromebook-migration-guide.md @@ -236,7 +236,7 @@ Assign the setting-migration priority based on how critical the setting is to th ## Plan for email migration Many of your users may be using Google Apps Gmail to manage their email, calendars, and contacts. You need to create the list of users you will migrate and the best time to perform the migration. -Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252). +Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information, see [Migrate Google Apps mailboxes to Office 365](https://go.microsoft.com/fwlink/p/?LinkId=690252). **Identify the list of user mailboxes to migrate** @@ -244,7 +244,7 @@ In regards to creating the list of users you will migrate, it might seem that th Also, when you perform a migration it is a great time to verify that all user mailboxes are active. In many environments there are a significant number of mailboxes that were provisioned for users that are no longer a part of the institution (such as interns or student assistants). You can eliminate these users from your list of user mailboxes to migrate. -Create your list of user mailboxes to migrate in Excel 2016 based on the format described in step 7 in [Create a list of Gmail mailboxes to migrate](http://go.microsoft.com/fwlink/p/?LinkId=690253). If you follow this format, you can use the Microsoft Excel spreadsheet to perform the actual migration later in the process. +Create your list of user mailboxes to migrate in Excel 2016 based on the format described in step 7 in [Create a list of Gmail mailboxes to migrate](https://go.microsoft.com/fwlink/p/?LinkId=690253). If you follow this format, you can use the Microsoft Excel spreadsheet to perform the actual migration later in the process. **Identify companion devices that access Google Apps Gmail** @@ -252,7 +252,7 @@ In addition to Chromebook devices, users may have companion devices (smartphones After you have identified each companion device, verify the settings for the device that are used to access Office 365. You only need to test one type of each companion device. For example, if users use Android phones to access Google Apps Gmail mailboxes, configure the device to access Office 365 and then record those settings. You can publish those settings on a website or to your helpdesk staff so that users will know how to access their Office 365 mailbox. -In most instances, users will only need to provide in their Office 365 email account and password. However, you should verify this on each type of companion device. For more information about how to configure a companion device to work with Office 365, see [Compare how different mobile devices work with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690254). +In most instances, users will only need to provide in their Office 365 email account and password. However, you should verify this on each type of companion device. For more information about how to configure a companion device to work with Office 365, see [Compare how different mobile devices work with Office 365](https://go.microsoft.com/fwlink/p/?LinkId=690254). **Identify the optimal timing for the migration** Typically, the best time to perform the migration is between academic years or during semester breaks. Select the time of least activity for your institution. And during that time, the optimal time to perform the migration might be during an evening or over a weekend. @@ -571,9 +571,9 @@ Examine each of the following network infrastructure technologies and services a For more information that compares Internet bandwidth consumption for Chromebook and Windows devices, see the following resources: - - [Chromebook vs. Windows Notebook Network Traffic Analysis](http://go.microsoft.com/fwlink/p/?LinkId=690255) - - [Hidden Cost of Chromebook Deployments](http://go.microsoft.com/fwlink/p/?LinkId=690256) - - [Microsoft Windows 8.1 Notebook vs. Chromebooks for Education](http://go.microsoft.com/fwlink/p/?LinkId=690257) + - [Chromebook vs. Windows Notebook Network Traffic Analysis](https://go.microsoft.com/fwlink/p/?LinkId=690255) + - [Hidden Cost of Chromebook Deployments](https://go.microsoft.com/fwlink/p/?LinkId=690256) + - [Microsoft Windows 8.1 Notebook vs. Chromebooks for Education](https://go.microsoft.com/fwlink/p/?LinkId=690257) - **Power.** Although not specifically a network infrastructure, you need to ensure your classrooms have adequate power. Chromebook and Windows devices should consume similar amounts of power. This means that your existing power outlets should support the same number of Windows devices. @@ -612,15 +612,15 @@ Table 7. Network infrastructure products and technologies and deployment resourc DHCP
      -

    • [Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)

      • -

    • [DHCP Deployment Guide](http://go.microsoft.com/fwlink/p/?LinkId=734021)

      • +

    • [Core Network Guide](https://go.microsoft.com/fwlink/p/?LinkId=733920)

      • +

    • [DHCP Deployment Guide](https://go.microsoft.com/fwlink/p/?LinkId=734021)

    DNS
      -

    • [Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)

      • -

    • [Deploying Domain Name System (DNS)](http://go.microsoft.com/fwlink/p/?LinkId=734022)

      • +

    • [Core Network Guide](https://go.microsoft.com/fwlink/p/?LinkId=733920)

      • +

    • [Deploying Domain Name System (DNS)](https://go.microsoft.com/fwlink/p/?LinkId=734022)

    @@ -650,16 +650,16 @@ Table 8. AD DS, Azure AD and deployment resources AD DS
      -

    • [Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)

      • -

    • [Active Directory Domain Services Overview](http://go.microsoft.com/fwlink/p/?LinkId=733909)

      • +

    • [Core Network Guide](https://go.microsoft.com/fwlink/p/?LinkId=733920)

      • +

    • [Active Directory Domain Services Overview](https://go.microsoft.com/fwlink/p/?LinkId=733909)

    Azure AD
      -

    • [Azure Active Directory documentation](http://go.microsoft.com/fwlink/p/?LinkId=690258)

      • -

    • [Manage and support Azure Active Directory Premium](http://go.microsoft.com/fwlink/p/?LinkId=690259)

      • -

    • [Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines](http://go.microsoft.com/fwlink/p/?LinkId=690260)

      • +

    • [Azure Active Directory documentation](https://go.microsoft.com/fwlink/p/?LinkId=690258)

      • +

    • [Manage and support Azure Active Directory Premium](https://go.microsoft.com/fwlink/p/?LinkId=690259)

      • +

    • [Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines](https://go.microsoft.com/fwlink/p/?LinkId=690260)

    @@ -689,38 +689,38 @@ Table 9. Management systems and deployment resources Windows provisioning packages
      -

    • [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=733918)

      • -

    • [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911)

      • -

    • [Step-By-Step: Building Windows 10 Provisioning Packages](http://go.microsoft.com/fwlink/p/?LinkId=690261)

      • +

    • [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkId=733918)

      • +

    • [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=733911)

      • +

    • [Step-By-Step: Building Windows 10 Provisioning Packages](https://go.microsoft.com/fwlink/p/?LinkId=690261)

    Group Policy
      -

    • [Core Network Companion Guide: Group Policy Deployment](http://go.microsoft.com/fwlink/p/?LinkId=733915)

      • -

    • [Deploying Group Policy](http://go.microsoft.com/fwlink/p/?LinkId=734024)

      • +

    • [Core Network Companion Guide: Group Policy Deployment](https://go.microsoft.com/fwlink/p/?LinkId=733915)

      • +

    • [Deploying Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=734024)

    Configuration Manager
      -

    • [Site Administration for System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733914)

      • -

    • [Deploying Clients for System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733919)

      • +

    • [Site Administration for System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=733914)

      • +

    • [Deploying Clients for System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=733919)

    Intune
      -

    • [Set up and manage devices with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=690262)

      • -

    • [Smoother Management Of Office 365 Deployments with Windows Intune](http://go.microsoft.com/fwlink/p/?LinkId=690263)

      • -

    • [System Center 2012 R2 Configuration Manager & Windows Intune](http://go.microsoft.com/fwlink/p/?LinkId=690264)

      • +

    • [Set up and manage devices with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=690262)

      • +

    • [Smoother Management Of Office 365 Deployments with Windows Intune](https://go.microsoft.com/fwlink/p/?LinkId=690263)

      • +

    • [System Center 2012 R2 Configuration Manager & Windows Intune](https://go.microsoft.com/fwlink/p/?LinkId=690264)

    MDT
      -

    • [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=690324)

      • -

    • [Step-By-Step: Installing Windows 8.1 From A USB Key](http://go.microsoft.com/fwlink/p/?LinkId=690265)

      • +

    • [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=690324)

      • +

    • [Step-By-Step: Installing Windows 8.1 From A USB Key](https://go.microsoft.com/fwlink/p/?LinkId=690265)

    @@ -751,23 +751,23 @@ Table 10. Management systems and app deployment resources Group Policy
      -

    • [Editing an AppLocker Policy](http://go.microsoft.com/fwlink/p/?LinkId=734025)

      • -

    • [Group Policy Software Deployment Background](http://go.microsoft.com/fwlink/p/?LinkId=734026)

      • -

    • [Assigning and Publishing Software](http://go.microsoft.com/fwlink/p/?LinkId=734027)

      • +

    • [Editing an AppLocker Policy](https://go.microsoft.com/fwlink/p/?LinkId=734025)

      • +

    • [Group Policy Software Deployment Background](https://go.microsoft.com/fwlink/p/?LinkId=734026)

      • +

    • [Assigning and Publishing Software](https://go.microsoft.com/fwlink/p/?LinkId=734027)

    Configuration Manager
      -

    • [How to Deploy Applications in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733917)

      • -

    • [Application Management in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733907)

      • +

    • [How to Deploy Applications in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=733917)

      • +

    • [Application Management in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=733907)

    Intune
      -

    • [Deploy apps to mobile devices in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733913)

      • -

    • [Manage apps with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733910)

      • +

    • [Deploy apps to mobile devices in Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=733913)

      • +

    • [Manage apps with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=733910)

    @@ -792,13 +792,13 @@ If you do no want to migrate any user or device settings from the Chromebook dev In the [Plan for email migration](#plan-email-migrate) section, you identified the user mailboxes to migrate, identified the companion devices that access Google Apps Gmail, and identified the optimal timing for migration. You can perform this migration before or after you deploy the Windows devices. -Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information on how to automate the migration from Google Apps Gmail to Office 365, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252). +Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information on how to automate the migration from Google Apps Gmail to Office 365, see [Migrate Google Apps mailboxes to Office 365](https://go.microsoft.com/fwlink/p/?LinkId=690252). Alternatively, if you want to migrate to Office 365 from: - **On-premises Microsoft Exchange Server.** Use the following resources to migrate to Office 365 from an on-premises Microsoft Exchange Server: - - [Cutover Exchange Migration and Single Sign-On](http://go.microsoft.com/fwlink/p/?LinkId=690266) - - [Step-By-Step: Migration of Exchange 2003 Server to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690267) - - [Step-By-Step: Migrating from Exchange 2007 to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690268) + - [Cutover Exchange Migration and Single Sign-On](https://go.microsoft.com/fwlink/p/?LinkId=690266) + - [Step-By-Step: Migration of Exchange 2003 Server to Office 365](https://go.microsoft.com/fwlink/p/?LinkId=690267) + - [Step-By-Step: Migrating from Exchange 2007 to Office 365](https://go.microsoft.com/fwlink/p/?LinkId=690268) - **Another on-premises or cloud-based email service.** Follow the guidance from that vendor. ## Perform cloud storage migration @@ -832,11 +832,11 @@ For example, if you selected to deploy Windows devices by each classroom, start In some instances, you may receive the devices with Windows 10 already deployed, and want to use provisioning packages. In other cases, you may have a custom Windows 10 image that you want to deploy to the devices by using Configuration Manager and/or MDT. For information on how to deploy Windows 10 images to the devices, see the following resources: -- [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) -- [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=733918) -- [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=690324) -- [Step-By-Step: Installing Windows 8.1 From A USB Key](http://go.microsoft.com/fwlink/p/?LinkId=690265) -- [Operating System Deployment in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733916) +- [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=733911) +- [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkId=733918) +- [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=690324) +- [Step-By-Step: Installing Windows 8.1 From A USB Key](https://go.microsoft.com/fwlink/p/?LinkId=690265) +- [Operating System Deployment in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=733916) In addition to the Windows 10 image deployment, you may need to perform the following tasks as a part of device deployment: @@ -848,7 +848,7 @@ In addition to the Windows 10 image deployment, you may need to perform the fol After you complete these steps, your management system should take over the day-to-day maintenance tasks for the Windows 10 devices. Verify that the user and device settings migrated correctly as you deploy each batch of Windows 10 devices. Continue this process until you deploy all Windows 10 devices. ## Related topics -- [Try it out: Windows 10 deployment (for education)](http://go.microsoft.com/fwlink/p/?LinkId=623254) -- [Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255) +- [Try it out: Windows 10 deployment (for education)](https://go.microsoft.com/fwlink/p/?LinkId=623254) +- [Try it out: Windows 10 in the classroom](https://go.microsoft.com/fwlink/p/?LinkId=623255)     diff --git a/windows/plan/common-compatibility-issues.md b/windows/plan/common-compatibility-issues.md index 4e96594b85..0883298316 100644 --- a/windows/plan/common-compatibility-issues.md +++ b/windows/plan/common-compatibility-issues.md @@ -1,58 +1,6 @@ --- title: Common Compatibility Issues (Windows 10) ms.assetid: f5ad621d-bda2-45b5-ae85-bc92970f602f -description: -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Common Compatibility Issues - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -Compatibility issues tend to occur with the following technologies: - -- **User Account Control (UAC)**: Adds security to Windows by limiting administrator-level access to the computer, restricting most users to running as Standard Users. UAC limits the context in which a process executes to minimize the ability of the user to inadvertently expose the computer to viruses or other malware. UAC affects any application installer or update that requires Administrator permissions to run, performs Administrator checks or actions, or attempts to write to a non-virtualized registry location. - -- **Windows Resource Protection (WRP)**: Enables applications to function properly even if an application attempts to write to protected system files or registry locations. WRP creates a temporary work area and redirects write actions for the application session. WRP affects any application installation that attempts to replace, modify, or delete protected operating system files or registry keys. Attempts typically fail and return an Access Denied error. - -- **Internet Explorer Protected Mode**: Helps to defend against elevation-of-privilege attacks by restricting the ability to write to any local-computer-zone resources other than temporary Internet files. This mode affects any website or web application that attempts to modify user files or registry keys or that attempts to open a new window in another domain. - -- **Deprecation**: Any application that uses .dll files, executable (.exe) files, COM objects, registry keys, APIs, or other files that have been deprecated from previous versions of Windows may lose functionality or fail to start. - -- **Graphical Identification and Authentication (GINA) DLL**: Prior to the release of Windows Vista, independent software vendors (ISVs) were able to modify authentication by installing a GINA DLL. The GINA DLL performed the user identification and authentication. - - The current authentication model does not require the GINA DLL and ignores all previous GINA DLLs. This change affects any application or hardware component that attempts to log on by using customized logon applications, including biometric devices (fingerprint readers), customized user interfaces, and virtual private network (VPN) solutions for remote users with customized logon user interfaces. - -- **Session 0**: Prior to the release of Windows Vista, the first user who logged on to a computer ran in Session 0, which is the same session that is used for system services. The current model requires all users to run in Session 1 or later so that no user runs in the same session as the system services. Applications will fail to start if they depend on *interactive services*. An interactive service is any service that attempts to send a window message, attempts to locate a window or additional service, or attempts to run any user processes that open the same named object, unless it is a globally named object. - -- **Windows Filtering Platform (WFP)**: WFP is an API that enables developers to create code that interacts with the filtering that occurs at several layers in the networking stack and throughout the operating system. If you are using a previous version of the WFP API in your environment, you might experience failures when running network-scanning, antivirus, or firewall applications. - -- **Operating System Version Changes**: The operating system version number changes with each operating system release. The **GetVersion** function returns the version number when queried by an application. This change affects any application or application installer that specifically checks for the operating system version and might prevent the installation from occurring or the application from running. - -- **Windows 64-bit**: 64-bit versions of Windows use the Windows on Windows 64 (WOW64) emulator. This emulator enables the 64-bit operating system to run 32-bit applications. The use of this emulator might cause an application or a component that uses 16-bit executables or installers, or 32-bit kernel drivers, to fail to start or to function incorrectly. - -## Related topics - - -[Using Compatibility Monitor to Send Feedback](using-compatibility-monitor-to-send-feedback.md) - -  - -  - - - - - +description: List of common compatibility issues, based on the type of technology. +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/compatibility-fix-database-management-strategies-and-deployment.md b/windows/plan/compatibility-fix-database-management-strategies-and-deployment.md index f608310bd6..fe4aede4bb 100644 --- a/windows/plan/compatibility-fix-database-management-strategies-and-deployment.md +++ b/windows/plan/compatibility-fix-database-management-strategies-and-deployment.md @@ -161,15 +161,4 @@ End Function Most of your testing of application-compatibility issues will happen prior to the deployment of a new Windows operating system into your environment. As such, a common approach is to include the custom compatibility-fix database, which includes all of your known issues, in your corporate image. Then, as you update your compatibility-fix database, you can provide the updates by using one of the two mechanisms described in the "Deploying Your Custom Compatibility Fix Databases" section earlier in this topic. ## Related topics - - -[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) - -  - -  - - - - - +[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) \ No newline at end of file diff --git a/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md b/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md index 688cf0a0d5..a27d633a60 100644 --- a/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md +++ b/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md @@ -78,7 +78,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix blocks InstallShield from setting the value of RunAs registry keys to InteractiveUser Because InteractiveUser no longer has Administrator rights.

    Note   -

    For more detailed information about this application fix, see [Using the BlockRunAsInteractiveUser Fix](http://go.microsoft.com/fwlink/p/?LinkId=690328).

    +

    For more detailed information about this application fix, see [Using the BlockRunAsInteractiveUser Fix](https://go.microsoft.com/fwlink/p/?LinkId=690328).

      @@ -101,7 +101,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    You can control this fix further by entering the relevant registry keys as parameters that are separated by the ^ Symbol; for example: Software\MyCompany\Key1^Software\MyCompany\Key2.

    Note   -

    For more detailed information about this application fix, see [Using the CopyHKCUSettingsFromOtherUsers Fix](http://go.microsoft.com/fwlink/p/?LinkId=690329).

    +

    For more detailed information about this application fix, see [Using the CopyHKCUSettingsFromOtherUsers Fix](https://go.microsoft.com/fwlink/p/?LinkId=690329).

      @@ -118,7 +118,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix modifies the file path names to point to a new location on the hard disk.

    Note   -

    For more detailed information about the CorrectFilePaths application fix, see [Using the CorrectFilePaths Fix](http://go.microsoft.com/fwlink/p/?LinkId=690330). We recommend that you use this fix together with the CorrectFilePathsUninstall fix if you are applying it to a setup installation file.

    +

    For more detailed information about the CorrectFilePaths application fix, see [Using the CorrectFilePaths Fix](https://go.microsoft.com/fwlink/p/?LinkId=690330). We recommend that you use this fix together with the CorrectFilePathsUninstall fix if you are applying it to a setup installation file.

      @@ -130,7 +130,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix corrects the file paths that are used by the uninstallation process of an application.

    Note   -

    For more detailed information about this fix, see [Using the CorrectFilePathsUninstall Fix](http://go.microsoft.com/fwlink/p/?LinkId=690331). We recommend that you use this fix together with the CorrectFilePaths fix if you are applying it to a setup installation file.

    +

    For more detailed information about this fix, see [Using the CorrectFilePathsUninstall Fix](https://go.microsoft.com/fwlink/p/?LinkId=690331). We recommend that you use this fix together with the CorrectFilePaths fix if you are applying it to a setup installation file.

      @@ -142,7 +142,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix intercepts the ShellExecute(Ex) calls, and then inspects the HWND value. If the value is invalid, this fix enables the call to use the currently active HWND value.

    Note   -

    For more detailed information about the CorrectShellExecuteHWND application fix, see [Using the CorrectShellExecuteHWND Fix](http://go.microsoft.com/fwlink/p/?LinkId=690332).

    +

    For more detailed information about the CorrectShellExecuteHWND application fix, see [Using the CorrectShellExecuteHWND Fix](https://go.microsoft.com/fwlink/p/?LinkId=690332).

      @@ -214,7 +214,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.

    Note   -

    For more detailed information about this application fix, see [Using the DisableDWM Fix]( http://go.microsoft.com/fwlink/p/?LinkId=690334).

    +

    For more detailed information about this application fix, see [Using the DisableDWM Fix]( https://go.microsoft.com/fwlink/p/?LinkId=690334).

      @@ -252,7 +252,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix handles the error code and attempts to recall the CreateProcess function together with requested elevation. If the fixed application already has a UAC manifest, the error code will be returned unchanged.

    Note   -

    For more detailed information about this application fix, see [Using the ElevateCreateProcess Fix](http://go.microsoft.com/fwlink/p/?LinkId=690335).

    +

    For more detailed information about this application fix, see [Using the ElevateCreateProcess Fix](https://go.microsoft.com/fwlink/p/?LinkId=690335).

      @@ -269,7 +269,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix determines the amount of free space, so that if the amount of free space is larger than 2 GB, the compatibility fix returns a value of 2 GB, but if the amount of free space is smaller than 2 GB, the compatibility fix returns the actual free space amount.

    Note   -

    For more detailed information about this application fix, see [Using the EmulateGetDiskFreeSpace Fix](http://go.microsoft.com/fwlink/p/?LinkId=690336).

    +

    For more detailed information about this application fix, see [Using the EmulateGetDiskFreeSpace Fix](https://go.microsoft.com/fwlink/p/?LinkId=690336).

      @@ -281,7 +281,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix forces applications that use the CompareStringW/LCMapString sorting table to use an older version of the table.

    Note   -

    For more detailed information about this e application fix, see [Using the EmulateSorting Fix](http://go.microsoft.com/fwlink/p/?LinkId=690337).

    +

    For more detailed information about this e application fix, see [Using the EmulateSorting Fix](https://go.microsoft.com/fwlink/p/?LinkId=690337).

      @@ -297,7 +297,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix enables the computer to restart and finish the installation process by verifying and enabling that the SeShutdownPrivilege service privilege exists.

    Note   -

    For more detailed information about this application fix, see [Using the EnableRestarts Fix](http://go.microsoft.com/fwlink/p/?LinkId=690338).

    +

    For more detailed information about this application fix, see [Using the EnableRestarts Fix](https://go.microsoft.com/fwlink/p/?LinkId=690338).

      @@ -332,7 +332,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix intercepts the GetCurrentThemeName API and returns the value for the Windows XP default theme, (Luna).

    Note   -

    For more detailed information about the FakeLunaTheme application fix, see [Using the FakeLunaTheme Fix](http://go.microsoft.com/fwlink/p/?LinkId=690339).

    +

    For more detailed information about the FakeLunaTheme application fix, see [Using the FakeLunaTheme Fix](https://go.microsoft.com/fwlink/p/?LinkId=690339).

      @@ -353,7 +353,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix allows the user to temporarily imitate being a part of the Administrators group by returning a value of True during the administrator check.

    Note   -

    For more detailed information about this application fix, see [Using the ForceAdminAccess Fix](http://go.microsoft.com/fwlink/p/?LinkId=690342).

    +

    For more detailed information about this application fix, see [Using the ForceAdminAccess Fix](https://go.microsoft.com/fwlink/p/?LinkId=690342).

      @@ -402,7 +402,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix intercepts the RegisterRawInputDevices API and prevents the delivery of the WM_INPUT messages. This delivery failure forces the included hooks to be ignored and forces DInput to use Windows-specific hooks.

    Note   -

    For more detailed information about this application fix, see [Using the IgnoreAltTab Fix](http://go.microsoft.com/fwlink/p/?LinkId=690343).

    +

    For more detailed information about this application fix, see [Using the IgnoreAltTab Fix](https://go.microsoft.com/fwlink/p/?LinkId=690343).

      @@ -440,7 +440,7 @@ The following table lists the known compatibility fixes for all Windows operatin
    Note   -

    For more detailed information about this application fix, see [Using the IgnoreException Fix](http://go.microsoft.com/fwlink/p/?LinkId=690344).

    +

    For more detailed information about this application fix, see [Using the IgnoreException Fix](https://go.microsoft.com/fwlink/p/?LinkId=690344).

      @@ -462,7 +462,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix intercepts the MessageBox* APIs and inspects them for specific message text. If matching text is found, the application continues without showing the message box.

    Note   -

    For more detailed information about this application fix, see [Using the IgnoreMessageBox Fix](http://go.microsoft.com/fwlink/p/?LinkId=690345).

    +

    For more detailed information about this application fix, see [Using the IgnoreMessageBox Fix](https://go.microsoft.com/fwlink/p/?LinkId=690345).

      @@ -491,7 +491,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix intercepts the function call to create the object and replaces the word Global with Local.

    Note   -

    For more detailed information about this application fix, see [Using the LocalMappedObject Fix](http://go.microsoft.com/fwlink/p/?LinkId=690346).

    +

    For more detailed information about this application fix, see [Using the LocalMappedObject Fix](https://go.microsoft.com/fwlink/p/?LinkId=690346).

      @@ -503,7 +503,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix locates any RunDLL.exe-based uninstallers and forces them to run with different credentials during the application installation. After it applies this fix, the installer will create a shortcut that specifies a matching string to run during the application installation, thereby enabling the uninstallation to occur later.

    Note   -

    For more detailed information about this application fix, see [Using the MakeShortcutRunas Fix]( http://go.microsoft.com/fwlink/p/?LinkId=690347)

    +

    For more detailed information about this application fix, see [Using the MakeShortcutRunas Fix]( https://go.microsoft.com/fwlink/p/?LinkId=690347)

      @@ -528,7 +528,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix reduces the security privilege levels on a specified set of files and folders.

    Note   -

    For more detailed information about this application fix, see [Using the OpenDirectoryACL Fix](http://go.microsoft.com/fwlink/p/?LinkId=690348).

    +

    For more detailed information about this application fix, see [Using the OpenDirectoryACL Fix](https://go.microsoft.com/fwlink/p/?LinkId=690348).

      @@ -603,7 +603,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix enables a child .exe file to run with elevated privileges when it is difficult to determine the parent process with either the ElevateCreateProcess fix or by marking the .exe files to RunAsAdmin.

    Note   -

    For more detailed information about this application fix, see [Using the RelaunchElevated Fix](http://go.microsoft.com/fwlink/p/?LinkId=690349).

    +

    For more detailed information about this application fix, see [Using the RelaunchElevated Fix](https://go.microsoft.com/fwlink/p/?LinkId=690349).

      @@ -620,7 +620,7 @@ The following table lists the known compatibility fixes for all Windows operatin

  • STANDARD_READ_RIGHTS

    Note   -

    For more detailed information about this application fix, see [Using the RetryOpenSCManagerwithReadAccess Fix](http://go.microsoft.com/fwlink/p/?LinkId=690350).

    +

    For more detailed information about this application fix, see [Using the RetryOpenSCManagerwithReadAccess Fix](https://go.microsoft.com/fwlink/p/?LinkId=690350).

      @@ -633,7 +633,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix retries the OpenService() API call and verifies that the user has Administrator rights, is not a Protected Administrator, and by using read-only access. Applications can test for the existence of a service by calling the OpenService() API but some applications ask for all access when making this check. This fix retries the call but only asking for read-only access. The user needs to be an administrator for this to work

    Note   -

    For more detailed information about this application fix, see [Using the RetryOpenServiceWithReadAccess Fix](http://go.microsoft.com/fwlink/p/?LinkId=690351).

    +

    For more detailed information about this application fix, see [Using the RetryOpenServiceWithReadAccess Fix](https://go.microsoft.com/fwlink/p/?LinkId=690351).

      @@ -645,7 +645,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix enables the application to run by using elevated privileges. The fix is the equivalent of specifying requireAdministrator in an application manifest.

    Note   -

    For more detailed information about this application fix, see [Using the RunAsAdmin Fix](http://go.microsoft.com/fwlink/p/?LinkId=690353).

    +

    For more detailed information about this application fix, see [Using the RunAsAdmin Fix](https://go.microsoft.com/fwlink/p/?LinkId=690353).

      @@ -657,7 +657,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix enables the application to run by using the highest available permissions. This is the equivalent of specifying highestAvailable in an application manifest.

    Note   -

    For more detailed information about this application fix, see [Using the RunAsHighest Fix](http://go.microsoft.com/fwlink/p/?LinkId=690355).

    +

    For more detailed information about this application fix, see [Using the RunAsHighest Fix](https://go.microsoft.com/fwlink/p/?LinkId=690355).

      @@ -669,7 +669,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix enables the application to run by using the privileges that are associated with the creation process, without requiring elevation. This is the equivalent of specifying asInvoker in an application manifest.

    Note   -

    For more detailed information about this application fix, see [Using the RunAsInvoker Fix](http://go.microsoft.com/fwlink/p/?LinkId=690356).

    +

    For more detailed information about this application fix, see [Using the RunAsInvoker Fix](https://go.microsoft.com/fwlink/p/?LinkId=690356).

      @@ -692,7 +692,7 @@ The following table lists the known compatibility fixes for all Windows operatin
    Note   -

    For more detailed information about this application fix, see [Using the SessionShim Fix](http://go.microsoft.com/fwlink/p/?LinkId=690358).

    +

    For more detailed information about this application fix, see [Using the SessionShim Fix](https://go.microsoft.com/fwlink/p/?LinkId=690358).

      @@ -727,7 +727,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix applies the specified compatibility fixes by modifying the export table and by nullifying the use of module inclusion and exclusion.

    Note   -

    For more information about this application fix, see [Using the ShimViaEAT Fix](http://go.microsoft.com/fwlink/p/?LinkId=690359).

    +

    For more information about this application fix, see [Using the ShimViaEAT Fix](https://go.microsoft.com/fwlink/p/?LinkId=690359).

      @@ -752,7 +752,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix flags the application as being an installer file (for example, setup.exe), and then prompts for elevation.

    Note   -

    For more detailed information about this application fix, see [Using the SpecificInstaller Fix]( http://go.microsoft.com/fwlink/p/?LinkId=690361).

    +

    For more detailed information about this application fix, see [Using the SpecificInstaller Fix]( https://go.microsoft.com/fwlink/p/?LinkId=690361).

      @@ -764,7 +764,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix flags the application to exclude it from detection by the GenericInstaller function.

    Note   -

    For more detailed information about this application fix, see [Using the SpecificNonInstaller Fix](http://go.microsoft.com/fwlink/p/?LinkId=690363).

    +

    For more detailed information about this application fix, see [Using the SpecificNonInstaller Fix](https://go.microsoft.com/fwlink/p/?LinkId=690363).

      @@ -795,7 +795,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    Where MessageString1 and MessageString2 reflect the message strings that can pass.

    Note   -

    Multiple message strings must be separated by spaces. For more detailed information about this application fix, see [Using the UIPIEnableCustomMsgs Fix](http://go.microsoft.com/fwlink/p/?LinkId=690365).

    +

    Multiple message strings must be separated by spaces. For more detailed information about this application fix, see [Using the UIPIEnableCustomMsgs Fix](https://go.microsoft.com/fwlink/p/?LinkId=690365).

      @@ -810,7 +810,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    Where 1055 reflects the first message ID, 1056 reflects the second message ID, and 1069 reflects the third message ID that can pass.

    Note   -

    Multiple messages can be separated by spaces. For more detailed information about this application fix, see [Using the UIPIEnableStandardMsgs Fix [act]](http://go.microsoft.com/fwlink/p/?LinkId=690367).

    +

    Multiple messages can be separated by spaces. For more detailed information about this application fix, see [Using the UIPIEnableStandardMsgs Fix [act]](https://go.microsoft.com/fwlink/p/?LinkId=690367).

      @@ -828,7 +828,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    VirtualRegistry

    The problem is indicated when a Component failed to be located error message displays when an application is started.

    The fix enables the registry functions to allow for virtualization, redirection, expansion values, version spoofing, the simulation of performance data counters, and so on.

    -

    For more detailed information about this application fix, see [Using the VirtualRegistry Fix](http://go.microsoft.com/fwlink/p/?LinkId=690368).

    +

    For more detailed information about this application fix, see [Using the VirtualRegistry Fix](https://go.microsoft.com/fwlink/p/?LinkId=690368).

    VirtualizeDeleteFile

    @@ -836,7 +836,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix makes the application's DeleteFile function call a virtual call in an effort to remedy the UAC and file virtualization issues that were introduced with Windows Vista. This fix also links other file APIs (for example, GetFileAttributes) to ensure that the virtualization of the file is deleted.

    Note   -

    For more detailed information about this application fix, see [Using the VirtualizeDeleteFile Fix](http://go.microsoft.com/fwlink/p/?LinkId=690369).

    +

    For more detailed information about this application fix, see [Using the VirtualizeDeleteFile Fix](https://go.microsoft.com/fwlink/p/?LinkId=690369).

      @@ -848,14 +848,14 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix redirects the HKCR write calls (HKLM) to the HKCU hive for a per-user COM registration. This operates much like the VirtualRegistry fix when you use the VirtualizeHKCR parameter; however, VirtualizeHKCRLite provides better performance.

    HKCR is a virtual merge of the HKCU\Software\Classes and HKLM\Software\Classes directories. The use of HKCU is preferred if an application is not elevated and is ignored if the application is elevated.

    You typically will use this compatibility fix in conjunction with the VirtualizeRegisterTypeLib fix.

    -

    For more detailed information about this application fix, see [Using the VirtualizeHKCRLite Fix](http://go.microsoft.com/fwlink/p/?LinkId=690370).

    +

    For more detailed information about this application fix, see [Using the VirtualizeHKCRLite Fix](https://go.microsoft.com/fwlink/p/?LinkId=690370).

    VirtualizeRegisterTypeLib

    The fix, when it is used with the VirtualizeHKCRLite fix, ensures that the type library and the COM class registration happen simultaneously. This functions much like the RegistryTypeLib fix when the RegisterTypeLibForUser parameter is used.

    Note   -

    For more detailed information about this application fix, see [Using the VirtualizeRegisterTypelib Fix](http://go.microsoft.com/fwlink/p/?LinkId=690371).

    +

    For more detailed information about this application fix, see [Using the VirtualizeRegisterTypelib Fix](https://go.microsoft.com/fwlink/p/?LinkId=690371).

      @@ -907,7 +907,7 @@ The following table lists the known compatibility fixes for all Windows operatin

  • Save the custom database.

    Note   -

    For more information about the WinXPSP2VersionLie application fix, see [Using the WinXPSP2VersionLie Fix](http://go.microsoft.com/fwlink/p/?LinkId=690374).

    +

    For more information about the WinXPSP2VersionLie application fix, see [Using the WinXPSP2VersionLie Fix](https://go.microsoft.com/fwlink/p/?LinkId=690374).

      @@ -923,7 +923,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    Where Component1.dll and Component2.dll reflect the components to be skipped.

    Note   -

    For more detailed information about this application fix, see [Using the WRPDllRegister Fix](http://go.microsoft.com/fwlink/p/?LinkId=690375).

    +

    For more detailed information about this application fix, see [Using the WRPDllRegister Fix](https://go.microsoft.com/fwlink/p/?LinkId=690375).

      @@ -935,7 +935,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix emulates the successful authentication and modification of file and registry APIs, so that the application can continue.

    Note   -

    For more detailed information about WRPMitigation, see [Using the WRPMitigation Fix](http://go.microsoft.com/fwlink/p/?LinkId=690376).

    +

    For more detailed information about WRPMitigation, see [Using the WRPMitigation Fix](https://go.microsoft.com/fwlink/p/?LinkId=690376).

      @@ -1009,15 +1009,4 @@ The following table lists the known compatibility modes. - - -  - -  - -  - - - - - + \ No newline at end of file diff --git a/windows/plan/compatibility-monitor-users-guide.md b/windows/plan/compatibility-monitor-users-guide.md index 9a72ed30d3..a183923ba1 100644 --- a/windows/plan/compatibility-monitor-users-guide.md +++ b/windows/plan/compatibility-monitor-users-guide.md @@ -1,72 +1,5 @@ --- title: Compatibility Monitor User's Guide (Windows 10) description: Compatibility Monitor is a tool in the runtime analysis package that you can use to monitor applications for compatibility issues. You can also use the Compatibility Monitor tool to submit compatibility feedback. -ms.assetid: 67d6eff0-1576-44bd-99b4-a3ffa5e205ac -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Compatibility Monitor User's Guide - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -Compatibility Monitor is a tool in the runtime analysis package that you can use to monitor applications for compatibility issues. You can also use the Compatibility Monitor tool to submit compatibility feedback. - -## In this section - - - ---- - - - - - - - - - - - - - - - - -
    TopicDescription

    [Using Compatibility Monitor to Send Feedback](using-compatibility-monitor-to-send-feedback.md)

    The Microsoft Compatibility Monitor tool is installed as part of the runtime-analysis package. From the computers in your test environment, you can use Compatibility Monitor to submit compatibility information to the Application Compatibility Toolkit (ACT) database for your organization.

    [Common Compatibility Issues](common-compatibility-issues.md)

    Compatibility issues tend to occur with the following technologies:

    - -  - -## Related topics - - -[Deciding Which Applications to Test](deciding-which-applications-to-test.md) - -[Creating an Enterprise Environment for Compatibility Testing](creating-an-enterprise-environment-for-compatibility-testing.md) - -[Creating a Runtime-Analysis Package](creating-a-runtime-analysis-package.md) - -[Deploying a Runtime-Analysis Package](deploying-a-runtime-analysis-package.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/computer-dialog-box.md b/windows/plan/computer-dialog-box.md index b191d79a79..89054bac9a 100644 --- a/windows/plan/computer-dialog-box.md +++ b/windows/plan/computer-dialog-box.md @@ -1,109 +1,5 @@ --- title: Computer Dialog Box (Windows 10) description: In Application Compatibility Manager (ACM), the Computer dialog box shows information about the selected computer. -ms.assetid: f89cbb28-adcd-41cd-9a54-402bc4aaffd9 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# <Computer> Dialog Box - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -In Application Compatibility Manager (ACM), the *<Computer>* dialog box shows information about the selected computer. - -**To open the <Computer> dialog box** - -1. In ACM, in the **Quick Reports** pane, click **Analyze**. - -2. Under an operating system heading, click **Computers**. - -3. Double-click the name of a computer. - -## Tabs in the <Computer> dialog box - - -The following table shows the information available in the *<Computer>* dialog box. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    TabInformation

    Details

    Shows the following information for the selected computer:

    -
      -

    • The computer name, operating system, architecture, and domain.

      • -

    • The IP address, Media Access Control (MAC) address, and hardware identifier.

      • -

    • The manufacturer, asset tag, and system number.

      • -

    • The hardware specifications.

      • -

    Applications

    Shows the following information for each of the applications installed on the selected computer:

    -
      -

    • The application name, version number, and application vendor.

      • -

    • The compatibility rating for the application as determined by your organization.

      • -

    • The compatibility information from the application vendor.

      • -

    • The compatibility information from the ACT Community, which you can view if you are a member of the ACT Community. For more information, see [Settings Dialog Box - Preferences Tab](act-settings-dialog-box-preferences-tab.md).

      • -

    • The issues that have been opened for the application.

      • -

    • The count of computers in your organization on which the application is installed.

      • -

    Devices

    Shows the following information for each of the devices installed on the selected computer:

    -
      -

    • The model and manufacturer of the device.

      • -

    • An evaluation of whether the device works on a 32-bit operating system or a 64-bit operating system.

      • -

    • The class of device, as reported by the device.

      • -

    • The count of computers in your organization on which the device is installed.

      • -

    Labels

    Shows the label for the selected computer.

    -

    For information about labels, see [Labeling Data in ACM](labeling-data-in-acm.md).

    - -  - -## Using the <Computer> Dialog Box - - -In the *<Computer>* dialog box, you can perform the following actions: - -- Assign categories and subcategories to the computer. For more information, see [Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md). - -- Specify the importance of the computer to your organization. For more information, see [Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md). - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/configuring-act.md b/windows/plan/configuring-act.md index f5803ddd81..372e1dcaf1 100644 --- a/windows/plan/configuring-act.md +++ b/windows/plan/configuring-act.md @@ -1,90 +1,5 @@ --- title: Configuring ACT (Windows 10) description: This section provides information about setting up the Application Compatibility Toolkit (ACT) in your organization. -ms.assetid: aacbe35e-ea40-47ac-bebf-ed2660c8fd86 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Configuring ACT - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides information about setting up the Application Compatibility Toolkit (ACT) in your organization. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [ACT Tools, Packages, and Services](act-tools-packages-and-services.md)

    The Application Compatibility Toolkit is included with the Windows ADK. [Download the Windows ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740)

    [ACT Deployment Options](act-deployment-options.md)

    While planning your deployment of the Application Compatibility Toolkit (ACT), consider which computers you want running the various tools, packages, and services for ACT.

    [ACT Database Configuration](act-database-configuration.md)

    The Application Compatibility Toolkit (ACT) uses a Microsoft® SQL Server® database for storing and sharing compatibility issue data. If you do not use Microsoft SQL Server, you can download and install Microsoft SQL Server Express. For information about creating Microsoft SQL Server databases, see [Administering the Database Engine](http://go.microsoft.com/fwlink/p/?LinkId=64169).

    [ACT Database Migration](act-database-migration.md)

    The schema for an ACT database can change when ACT is updated or when a new version of ACT is released. If the schema for an ACT database does not match the current schema, you can migrate the compatibility data to a new database. You can then use the current version of ACT to open the new database.

    [ACT LPS Share Permissions](act-lps-share-permissions.md)

    To upload log files to the ACT Log Processing Service (LPS) share, certain permissions must be set at the share level and folder level.

    - -  - -## Related topics - - -[Welcome to ACT](welcome-to-act.md) - -[Using ACT](using-act.md) - -[Troubleshooting ACT](troubleshooting-act.md) - -[ACT User Interface Reference](act-user-interface-reference.md) - -[ACT Product and Documentation Resources](act-product-and-documentation-resources.md) - -[ACT Glossary](act-glossary.md) - -[Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md b/windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md index a88189a7a2..90b404e888 100644 --- a/windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md +++ b/windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md @@ -69,8 +69,6 @@ If you are unable to find a preloaded compatibility fix for your application, yo By default, Compatibility Administrator selects the basic matching criteria for your application. As a best practice, use a limited set of matching information to represent your application, because it reduces the size of the database. However, make sure you have enough information to correctly identify your application. ## Related topics - - [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)   diff --git a/windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md b/windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md index ac5091d0bb..789f3199ca 100644 --- a/windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md +++ b/windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md @@ -74,8 +74,6 @@ A compatibility mode includes a set of compatibility fixes and must be deployed The compatibility mode is added to your custom database. ## Related topics - - [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)   diff --git a/windows/plan/creating-a-runtime-analysis-package.md b/windows/plan/creating-a-runtime-analysis-package.md index 04411a5fa7..e6b56c752b 100644 --- a/windows/plan/creating-a-runtime-analysis-package.md +++ b/windows/plan/creating-a-runtime-analysis-package.md @@ -1,59 +1,8 @@ --- title: Creating a Runtime-Analysis Package (Windows 10) description: In Application Compatibility Manager (ACM), you can create runtime-analysis packages, which you can then deploy to computers for compatibility testing in your test environment. -ms.assetid: 3c703ebe-46b3-4dcd-b355-b28344bc159b -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics --- - -# Creating a Runtime-Analysis Package - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -In Application Compatibility Manager (ACM), you can create runtime-analysis packages, which you can then deploy to computers for compatibility testing in your test environment. - -**To create a runtime-analysis package** - -1. In ACM, click **Collect** to open the Collect screen. - -2. On the **File** menu, click **New**. - -3. Click **Runtime application testing**. - -4. Provide the information that is requested for the package, and then click **Create**. - -5. Navigate to the location where you want to save the Windows installer (.msi) file for the package. - - This .msi file is the file that you can use to install the runtime-analysis package on each computer in your test environment. - -6. Type a file name for the .msi file, and then click **Save**. - -7. Click **Finish**. - -## Related topics - - -[Deciding Which Applications to Test](deciding-which-applications-to-test.md) - -[Creating an Enterprise Environment for Compatibility Testing](creating-an-enterprise-environment-for-compatibility-testing.md) - -[Deploying a Runtime-Analysis Package](deploying-a-runtime-analysis-package.md) - -[Compatibility Monitor User's Guide](compatibility-monitor-users-guide.md) - -  -   diff --git a/windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md b/windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md index 5b48ebdbb8..f63dd95d8f 100644 --- a/windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md +++ b/windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md @@ -89,15 +89,4 @@ The following issues might occur with computers running Windows 2000: - Copying an AppHelp entry for a system database or a custom-compatibility fix from a system database might cause Compatibility Administrator to hide the descriptive text. ## Related topics - - -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - -  - -  - - - - - +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) \ No newline at end of file diff --git a/windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md b/windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md index 840fa87695..2953ad9c9f 100644 --- a/windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md +++ b/windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md @@ -1,115 +1,5 @@ --- title: Creating an Enterprise Environment for Compatibility Testing (Windows 10) description: The goal of the test environment is to model the operating system that you want to deploy and assess compatibility before deploying the operating system to your production environment. -ms.assetid: cbf6d8b6-7ebc-4faa-bbbd-e02653ed4adb -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Creating an Enterprise Environment for Compatibility Testing - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The goal of the test environment is to model the operating system that you want to deploy and assess compatibility before deploying the operating system to your production environment. Your test environment is composed of computers on which the new operating system is installed. Your test environment can be a long-term investment. Consider retaining the test environment after deployment to assist in future deployment projects. - -## Modeling the Production Environment - - -We recommend the following practices for setting up your test environment: - -- Physically separate your test environment from your production environment. Physical separation helps ensure that activity in the test environment does not affect the production environment. - -- On the computers in your test environment, install the new operating system. - -- Perform all of your tests by using accounts that have similar permissions to the accounts in your production environment. This approach helps to ensure that you can determine potential security issues. - -## Configuring the Test Environment for Automated Testing - - -Typically, tests are run more than once, which requires being able to revert your test environment to a previous state. We recommend the following practices to ensure consistency in testing and consistency in restoring the state of your test environment: - -- Use disk-imaging software to create physical disk images. - -- Use software virtualization features to reverse changes to virtualized hard disks. - -## Determining When Virtualization Is Appropriate - - -The following table shows some of the advantages and disadvantages of virtualization. - - ---- - - - - - - - - - - - - -
    AdvantagesDisadvantages
      -

    • Supports a large number of servers in a limited amount of physical space. You can run as many virtual servers as the physical computer’s resources allow.

      • -

    • Easily shares your test environment between teams. For example, your test team can create a virtualized test environment and then provide a copy to your development team for use in its development processes.

      • -

    • Supports multiple users performing simultaneous testing, mimicking the ability for each user to have a dedicated test environment.

      • -

    • Easily restores your environment to a previous state. For example, you can revert to a previous state by using the Undo Disks option.

      • -
      -

    • May reduce performance. Virtualized servers may be slower than their physical counterparts. The performance of virtualized servers is reduced because physical resources such as disks are virtualized.

      • -

    • May not support all applications and device drivers. Some hardware-specific device drivers and applications are not supported in virtualized servers.

      • -
    - -  - -## Testing Methodology - - -When testing an application in a new operating system, we recommend the following methods: - -- Retain the default security-feature selections. - -- Use test automation tools to run your test cases in a consistent, reproducible way. - -- Use your application in the same way that you use it in your production environment. - -- Use the Compatibility Monitor tool in the runtime-analysis package to gather compatibility feedback. - -- Send and receive compatibility data to obtain data and solutions through the Microsoft Compatibility Exchange. - -- When testing a website or a web application, include both intranet and extranet sites, prioritizing the list based on how critical the site or the application is to your organization. - -## Related topics - - -[Deciding Which Applications to Test](deciding-which-applications-to-test.md) - -[Creating a Runtime-Analysis Package](creating-a-runtime-analysis-package.md) - -[Deploying a Runtime-Analysis Package](deploying-a-runtime-analysis-package.md) - -[Compatibility Monitor User's Guide](compatibility-monitor-users-guide.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/creating-an-inventory-collector-package.md b/windows/plan/creating-an-inventory-collector-package.md index c174e746e0..c52e8f3965 100644 --- a/windows/plan/creating-an-inventory-collector-package.md +++ b/windows/plan/creating-an-inventory-collector-package.md @@ -1,58 +1,5 @@ --- title: Creating an Inventory-Collector Package (Windows 10) description: You can use Application Compatibility Manager (ACM) to create an inventory-collector package. -ms.assetid: 61d041d6-e308-47b3-921b-709d72926d6d -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Creating an Inventory-Collector Package - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can use Application Compatibility Manager (ACM) to create an inventory-collector package. You can then deploy the inventory-collector package to other computers to gather inventory data. The package uploads inventory data to the Application Compatibility Toolkit (ACT) database. - -**To create an inventory-collector package** - -1. In ACM, click **Collect** to open the **Collect** screen. - -2. On the **File** menu, click **New**. - -3. Click **Application inventory**. - -4. Provide the information that is requested for the package, and then click **Create**. - -5. Browse to the location where you want to save the Windows® Installer (.msi) file for the package. - - You can use this .msi file to install the inventory-collector package on each computer for which you want to gather inventory data. - -6. Type a file name for the .msi file, and then click **Save**. - -7. Click **Finish**. - -## Related topics - - -[Identifying Computers for Inventory Collection](identifying-computers-for-inventory-collection.md) - -[Deploying an Inventory-Collector Package](deploying-an-inventory-collector-package.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/creating-and-editing-issues-and-solutions.md b/windows/plan/creating-and-editing-issues-and-solutions.md index 0ce76a3f2f..e1897a0122 100644 --- a/windows/plan/creating-and-editing-issues-and-solutions.md +++ b/windows/plan/creating-and-editing-issues-and-solutions.md @@ -1,65 +1,5 @@ --- title: Creating and Editing Issues and Solutions (Windows 10) description: This section provides step-by-step instructions for adding and editing application compatibility issues and solutions. Your issue and solution data can be uploaded to Microsoft through the Microsoft® Compatibility Exchange. -ms.assetid: b64fe4e0-24bd-4bbd-9645-80ae5644e774 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Creating and Editing Issues and Solutions - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides step-by-step instructions for adding and editing application compatibility issues and solutions. Your issue and solution data can be uploaded to Microsoft through the Microsoft® Compatibility Exchange. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Adding or Editing an Issue](adding-or-editing-an-issue.md)

    In Application Compatibility Manager (ACM), you can enter information about the compatibility issues that you discover.

    [Adding or Editing a Solution](adding-or-editing-a-solution.md)

    If you find your own solutions to compatibility issues, you can enter the solutions in Application Compatibility Manager (ACM). You can use the Microsoft Compatibility Exchange to upload solutions to Microsoft Corporation.

    [Resolving an Issue](resolving-an-issue.md)

    You can use Application Compatibility Manager (ACM) to flag issues as resolved. Resolving an issue changes the status of the issue from a red x to a green check mark on your report and report detail screens.

    - -  - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/customizing-your-report-views.md b/windows/plan/customizing-your-report-views.md index a68961a2e6..1c69e77305 100644 --- a/windows/plan/customizing-your-report-views.md +++ b/windows/plan/customizing-your-report-views.md @@ -1,149 +1,5 @@ --- title: Customizing Your Report Views (Windows 10) description: You can customize how you view your report data in Application Compatibility Manager (ACM). -ms.assetid: ba8da888-6749-43b4-8efb-4f26c7954721 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Customizing Your Report Views - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can customize how you view your report data in Application Compatibility Manager (ACM). - -## Modifying the <Operating\_System> Reports View - - -You can choose which operating systems ACM shows in the compatibility reports. For operating systems that you exclude from the reports, the data continues to be collected but ACM does not display it. - -If you are using ACM on multiple computers that access the same ACT database, when you remove an operating system from your reports, all of the computers running ACM no longer show the operating system. - -**To add or remove an operating system from the Quick Reports pane** - -1. On the **Analyze** screen, at the bottom of the **Quick Reports** pane, click **Customize this view**. - -2. In the **Deployment Reports** area, select the check boxes for the operating systems you want to show in your reports, and then click **OK**. - -3. Select the architectures, **32-bit**, **64-bit**, or **Both**, for which you want to see compatibility ratings in the report screens. - -## Adding and Removing Columns from the Report Views - - -You can add and remove columns from most of the report screens. In the report dialog boxes, you cannot add or remove columns, but you can reorder the columns. - -**To add or remove a column** - -1. On the selected report screen, right-click the column headings, and then click **Column Options**. - -2. Select the check box next to any column that you want to add, and clear the check box next to any column that you want to remove. - -3. If you want, reorder the columns by using the **Move Up** and **Move Down** buttons. - -4. Click **OK**. - -### Columns by Screen - -The following table shows the columns that are available for each screen. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ScreenDefault columnsAdditional columns

    [<OperatingSystem> - Application Report](act-operatingsystem-application-report.md)

      -

    • Application Name

      • -

    • Version

      • -

    • Company

      • -

    • My Assessment

      • -

    • User Assessment

      • -

    • Send/Receive Status

      • -

    • Vendor Assessment

      • -

    • Community Assessment

      • -

    • Active Issues

      • -

    • Computers

      • -
      -

    • Resolved Issues

      • -

    • Language

      • -

    • Priority

      • -

    • Deployment Status

      • -

    • Issues with Solutions

      • -

    [<OperatingSystem> - Computer Report](act-operatingsystem-computer-report.md)

      -

    • Computer Name

      • -

    • Applications with Issues

      • -

    • Devices with Issues

      • -

    • Operating System

      • -

    • Domain

      • -

    • Applications

      • -

    • Devices

      • -
      -

    • Priority

      • -

    [<OperatingSystem> - Device Report](act-operatingsystem-device-report.md)

      -

    • Model

      • -

    • Manufacturer

      • -

    • Assessment

      • -

    • Device Class

      • -

    • Computers

      • -
      -

    • Assessment

      • -

    • Priority

      • -

    [Internet Explorer - Web Site Report](internet-explorer-web-site-report.md)

      -

    • Web Site

      • -

    • My Assessment

      • -

    • Active Issues

      • -

    • Resolved Issues

      • -
      -

    • None

      • -
    - -  - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md b/windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md index 8bb30d37a8..97e2f14378 100644 --- a/windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md +++ b/windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md @@ -1,239 +1,5 @@ --- title: Data Sent Through the Microsoft Compatibility Exchange (Windows 10) description: The Microsoft Compatibility Exchange propagates data of various types between Microsoft Corporation, independent software vendors (ISVs) and the Application Compatibility Toolkit (ACT) Community. -ms.assetid: 3ec61e33-9db8-4367-99d5-e05c2f50e144 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Data Sent Through the Microsoft Compatibility Exchange - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Microsoft Compatibility Exchange propagates data of various types between Microsoft Corporation, independent software vendors (ISVs) and the Application Compatibility Toolkit (ACT) Community. - -## Data Sent to Microsoft - - -During synchronization, the Microsoft Compatibility Exchange sends the following information to Microsoft Corporation: - -- **Application information and properties**. This data includes the application name, the vendor, the version number, the language, and the deployment type. - -The data-synchronization process does not send your list of URLs visited as part of the information exchange. - -## Data Sent to the ACT Community - - -The Microsoft Compatibility Exchange sends the following information to the ACT Community for each application that you decide to share with the ACT Community: - -- **Application information and properties**. This data includes the application name, the vendor, the version number, the language, and the deployment type. - -- **Miscellaneous data**. This data includes: - - - The database GUID that identifies the organization that is the source of the data. - - - The issue data. - - - The issue ID. - - - The platform and destination operating system. - - - The severity. - - - The cause. - - - The symptom. - - - The solution data. - - - The solution type. - - - The issue and solution provider. - - - The issue and solution subprovider. - - - The issue and solution published date. - - - Your risk assessment. - -The data-synchronization process does not send your list of URLs visited as part of the information exchange. - -## Data Matching - - -After you send your data, the Microsoft Compatibility Exchange matches your application properties against the known issues listed in the Application Profile database. The Microsoft Compatibility Exchange downloads any issues and corresponding solutions that match your application set and then stores the information in your ACT database. - -## Data Sent From Microsoft and ISVs - - -For each application that matches an application in the Application Profile database, the Microsoft Compatibility Exchange returns the following information, provided by authoritative sources including Microsoft Corporation and independent software vendors (ISVs). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    DataDescription

    Risk assessment

    The determination of whether the application has compatibility issues.

    Symptom

    Behavior exhibited by the application.

    Cause

    Reason for the failure.

    Provider and subprovider

    Source of the compatibility issue.

    Issue ID

    A unique ID number for the compatibility issue.

    Severity

    Impact this issue has on the application experience.

    Priority

    Degree of impact that this issue has on your organization.

    Published Date

    Date that the source entered the data into the database.

    Operating system name

    Friendly name of the installed operating system.

    Major version

    Major version number of the operating system.

    Minor version

    Minor version number of the operating system.

    Locale

    Language ID of the application to which the compatibility issue applies.

    Title

    Short title of the compatibility issue.

    Summary

    Description of the compatibility issue.

    Service pack major

    Major version number of the operating system service pack.

    Service pack minor

    Minor version number of the operating system service pack.

    URL HREF

    URL of any links provided for the compatibility issue.

    Provider and subprovider IDs

    IDs for the source of the compatibility issue's solution.

    Solution type

    Type of solution provided for the compatibility issue.

    Locale

    Language ID of the application to which the solution applies.

    Title

    Short title of the solution.

    Details

    Description of the solution.

    URL HREF

    URL of any links provided for the compatibility issue solution.

    - -  - -## Data Sent From the ACT Community - - -For each application that matches an application in the Application Profile database, the Microsoft Compatibility Exchange returns the following ACT Community information, which you receive only if you are a member of the ACT Community: - - ---- - - - - - - - - - - - - - - - - - - - - -
    DataDescription

    Works

    The count of Works ratings, for 32-bit and 64-bit operating systems.

    Works with Minor Issues or has Solutions

    The count of Works with Minor Issues or has Solutions ratings, for 32-bit and 64-bit operating systems.

    Does Not Work

    The count of Does Not Work ratings, for 32-bit and 64-bit operating systems.

    - -  - -## Related topics - - -[Selecting the Send and Receive Status for an Application](selecting-the-send-and-receive-status-for-an-application.md) - -[Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md b/windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md index 0bf24136b1..d4d3319cbc 100644 --- a/windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md +++ b/windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md @@ -1,54 +1,5 @@ --- title: Deciding Whether to Fix an Application or Deploy a Workaround (Windows 10) description: You can fix a compatibility issue by changing the code for the application or by deploying a workaround. -ms.assetid: e495d0c8-bfba-4537-bccd-64c4b52206f1 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Deciding Whether to Fix an Application or Deploy a Workaround - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can fix a compatibility issue by changing the code for the application or by deploying a workaround. - -## Fixing an Application - - -Fixing an application by changing the code is often the recommended way to address a compatibility issue. Although applying a fix to the code might involve higher initial costs or additional development time, it can limit long-term maintenance or operational costs. After you change the code, all users can use the application without encountering the issue. - -If you do not have access to the code, or if you do not have the time and resources to apply a fix, an alternative approach is to deploy a workaround. - -## Deploying a Workaround - - -A workaround involves applying alternative registry settings to address a compatibility issue. Deploying a workaround might be quicker and easier than changing the code, but you can incur long-term maintenance or operational costs. For example, you must make sure that new users have the correct set of features enabled or disabled on their computers. Using a workaround might also make your application or systems less secure. However, the overall security enhancement associated with deploying the newer version of Windows® may more than offset this reduction in security. - -Consider changing registry settings as a short-term solution while you develop the long-term solution of changing the code. - -## Related topics - - -[SUA User's Guide](sua-users-guide.md) - -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/deciding-which-applications-to-test.md b/windows/plan/deciding-which-applications-to-test.md index a0d4d06986..4b548c65f6 100644 --- a/windows/plan/deciding-which-applications-to-test.md +++ b/windows/plan/deciding-which-applications-to-test.md @@ -1,54 +1,5 @@ --- title: Deciding Which Applications to Test (Windows 10) description: Before starting your compatibility testing on the version of Windows that you want to deploy, you can use the Application Compatibility Toolkit (ACT) to identify which applications should be the focus of your testing. -ms.assetid: d7c1c28f-b7b4-43ac-bf87-2910a2b603bf -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Deciding Which Applications to Test - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -Before starting your compatibility testing on the version of Windows that you want to deploy, you can use the Application Compatibility Toolkit (ACT) to identify which applications should be the focus of your testing. - -**To choose the applications to include in compatibility testing** - -1. Gather your application and device inventory. For more information, see [Taking Inventory of Your Organization](taking-inventory-of-your-organization.md). - -2. Use the Microsoft Compatibility Exchange to get the latest compatibility ratings. For more information, see [Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md). - -3. Organize and group your applications, and determine which applications need to be tested. For more information, see [Organizing Your Compatibility Data](organizing-your-compatibility-data.md). - - After completing these steps, you can then start creating and deploying your runtime-analysis packages to the test environment for your compatibility testing. - -## Related topics - - -[Creating an Enterprise Environment for Compatibility Testing](creating-an-enterprise-environment-for-compatibility-testing.md) - -[Creating a Runtime-Analysis Package](creating-a-runtime-analysis-package.md) - -[Deploying a Runtime-Analysis Package](deploying-a-runtime-analysis-package.md) - -[Compatibility Monitor User's Guide](compatibility-monitor-users-guide.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/deleting-a-data-collection-package.md b/windows/plan/deleting-a-data-collection-package.md index 002a431377..c5401542c9 100644 --- a/windows/plan/deleting-a-data-collection-package.md +++ b/windows/plan/deleting-a-data-collection-package.md @@ -1,52 +1,5 @@ --- title: Deleting a Data-Collection Package (Windows 10) description: In Application Compatibility Manager (ACM), you can delete any of your existing data-collection packages from the database. -ms.assetid: 1b397d7a-7216-4078-93d9-47c7becbf73e -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Deleting a Data-Collection Package - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -In Application Compatibility Manager (ACM), you can delete any of your existing data-collection packages from the database. - -You cannot undo the deletion of a data-collection package. If you mistakenly delete a data-collection package, you must create a new package to replace the deleted package. - -**To delete a data-collection package** - -1. In ACM, click **Collect** to open the Collect screen. - -2. Select the data-collection package that you want to delete, and then press the DELETE key. - -3. In the confirmation box, click **Yes**. - -## Related topics - - -[Log File Locations for Data-Collection Packages](log-file-locations-for-data-collection-packages.md) - -[Exporting a Data-Collection Package](exporting-a-data-collection-package.md) - -[Labeling Data in ACM](labeling-data-in-acm.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index dd53f66282..b451e7b8aa 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -142,7 +142,7 @@ You can use MDT to deploy 32-bit or 64-bit versions of Windows 10. Install the 6 >**Note:**  If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32 bit versions of the operating system. -For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](https://technet.microsoft.com/en-us/library/dn759415.aspx#InstallingaNewInstanceofMDT). +For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](https://technet.microsoft.com//library/dn759415.aspx#InstallingaNewInstanceofMDT). Now, you’re ready to create the MDT deployment share and populate it with the operating system, apps, and device drivers you want to deploy to your devices. @@ -336,7 +336,7 @@ Now that you have an Office 365 subscription, you need to determine how you will In this method, you have an on-premises AD DS domain. As shown in Figure 4, the Azure AD Connector tool automatically synchronizes AD DS with Azure AD. When you add or change any user accounts in AD DS, the Azure AD Connector tool automatically updates Azure AD. ->**Note:**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/en-us/library/dn510997.aspx?f=255&MSPPError=-2147217396). +>**Note:**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com//library/dn510997.aspx?f=255&MSPPError=-2147217396). ![fig 4](images/deploy-win-10-school-figure4.png) @@ -385,7 +385,7 @@ You can deploy the Azure AD Connect tool by using one of the following methods: *Figure 7. Azure AD Connect in Azure* -This guide describes how to run Azure AD Connect on premises. For information about running Azure AD Connect in Azure, see [Deploy Office 365 Directory Synchronization (DirSync) in Microsoft Azure](https://technet.microsoft.com/en-us/library/dn635310.aspx). +This guide describes how to run Azure AD Connect on premises. For information about running Azure AD Connect in Azure, see [Deploy Office 365 Directory Synchronization (DirSync) in Microsoft Azure](https://technet.microsoft.com//library/dn635310.aspx). ### Deploy Azure AD Connect on premises @@ -436,8 +436,8 @@ Several methods are available to bulk-import user accounts into AD DS domains. T |Method | Description and reason to select this method | |-------| ---------------------------------------------| -|Ldifde.exe |This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| -|VBScript | This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx) and [ADSI Scriptomatic](https://technet.microsoft.com/en-us/scriptcenter/dd939958.aspx).| +|Ldifde.exe |This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com//library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| +|VBScript | This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com//library/bb727091.aspx) and [ADSI Scriptomatic](https://technet.microsoft.com//scriptcenter/dd939958.aspx).| |Windows PowerShell| This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).|

    ### Create a source file that contains the user and group accounts @@ -448,8 +448,8 @@ After you have selected your user and group account bulk import method, you’re | Method | Source file format | |--------| -------------------| -|Ldifde.exe|Ldifde.exe requires a specific format for the source file. Use Ldifde.exe to export existing user and group accounts so that you can see the format. For examples of the format that Ldifde.exe requires, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| -|VBScript | VBScript can use any .csv file format to create a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in comma-separated values (CSV) format, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx).| +|Ldifde.exe|Ldifde.exe requires a specific format for the source file. Use Ldifde.exe to export existing user and group accounts so that you can see the format. For examples of the format that Ldifde.exe requires, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com//library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| +|VBScript | VBScript can use any .csv file format to create a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in comma-separated values (CSV) format, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com//library/bb727091.aspx).| | Windows PowerShell| Windows PowerShell can use any .csv file format you want to create as a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in CSV format, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).|

    ### Import the user accounts into AD DS @@ -460,8 +460,8 @@ With the bulk-import source file finished, you’re ready to import the user and For more information about how to import user accounts into AD DS by using: -- Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx). -- VBScript, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx). +- Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com//library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx). +- VBScript, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com//library/bb727091.aspx). - Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). ### Summary @@ -702,14 +702,14 @@ The first step in preparation for Windows 10 deployment is to configure—that i 1. Import operating systems -Import the operating systems that you selected in the [Select operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#ImportanOperatingSystemintotheDeploymentWorkbench). +Import the operating systems that you selected in the [Select operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](https://technet.microsoft.com//library/dn759415.aspx#ImportanOperatingSystemintotheDeploymentWorkbench). 2. Import device drives Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.

    -Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#ImportDeviceDriversintotheDeploymentWorkbench). +Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](https://technet.microsoft.com//library/dn759415.aspx#ImportDeviceDriversintotheDeploymentWorkbench). @@ -724,8 +724,8 @@ If you have Intune, you can deploy Windows Store apps after you deploy Windows 1 In addition, you must prepare your environment for sideloading (deploying) Windows Store apps. For more information about how to:

      -
    • Prepare your environment for sideloading, see [Sideload LOB apps in Windows 10](https://technet.microsoft.com/en-us/itpro/windows/deploy/sideload-apps-in-windows-10).
      • -
    • Create an MDT application, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench).
      • +
    • Prepare your environment for sideloading, see [Sideload LOB apps in Windows 10](https://technet.microsoft.com/itpro/windows/deploy/sideload-apps-in-windows-10).
      • +
    • Create an MDT application, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com//library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench).
    @@ -737,11 +737,11 @@ In addition, you must prepare your environment for sideloading (deploying) Windo You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.

    -To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com/en-us/library/jj219423.aspx?f=255&MSPPError=-2147217396).

    +To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com//library/jj219423.aspx?f=255&MSPPError=-2147217396).

    If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.

    **Note:**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.

    -For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench). +For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com//library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench). @@ -757,7 +757,7 @@ For more information about how to create an MDT application for Window desktop a
  • Upgrade existing devices to Windows 10 Education 32-bit.
    • -Again, you will create the task sequences based on the operating systems that you imported in Step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewTaskSequenceintheDeploymentWorkbench). +Again, you will create the task sequences based on the operating systems that you imported in Step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](https://technet.microsoft.com//library/dn759415.aspx#CreateaNewTaskSequenceintheDeploymentWorkbench). @@ -767,7 +767,7 @@ Again, you will create the task sequences based on the operating systems that yo Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32 bit and 64 bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.

    -For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#UpdateaDeploymentShareintheDeploymentWorkbench). +For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](https://technet.microsoft.com//library/dn759415.aspx#UpdateaDeploymentShareintheDeploymentWorkbench). @@ -782,9 +782,9 @@ You can use Windows Deployment Services in conjunction with MDT to automatically - [Windows Deployment Services overview](https://technet.microsoft.com/library/hh831764.aspx) - The Windows Deployment Services Help file, included in Windows Deployment Services - - [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/en-us/library/jj648426.aspx) + - [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com//library/jj648426.aspx) -2. Add LTI boot images (Windows PE images) to Windows Deployment Services.

    The LTI boot images (.wim files) that you will add to Windows Deployment Services are in the MDT deployment share. Locate the .wim files in the Boot subfolder in the deployment share. For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](https://technet.microsoft.com/en-us/library/dn759415.aspx#AddLTIBootImagestoWindowsDeploymentServices). +2. Add LTI boot images (Windows PE images) to Windows Deployment Services.

    The LTI boot images (.wim files) that you will add to Windows Deployment Services are in the MDT deployment share. Locate the .wim files in the Boot subfolder in the deployment share. For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](https://technet.microsoft.com//library/dn759415.aspx#AddLTIBootImagestoWindowsDeploymentServices). ### Summary @@ -897,7 +897,7 @@ Microsoft has several recommended settings for educational institutions. Table 1 Use of Microsoft accounts You want faculty and students to use only Azure AD accounts for institution-owned devices. For these devices, do not use Microsoft accounts or associate a Microsoft account with the Azure AD accounts.

    **Note:**  Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.

    -**Group Policy.** Configure the [Accounts: Block Microsoft accounts](https://technet.microsoft.com/en-us/library/jj966262.aspx?f=255&MSPPError=-2147217396) Group Policy setting to use the Users can’t add Microsoft accounts setting option.

    +**Group Policy.** Configure the [Accounts: Block Microsoft accounts](https://technet.microsoft.com//library/jj966262.aspx?f=255&MSPPError=-2147217396) Group Policy setting to use the Users can’t add Microsoft accounts setting option.

    **Intune.** Enable or disable the camera by using the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy. @@ -905,7 +905,7 @@ Microsoft has several recommended settings for educational institutions. Table 1 Restrict local administrator accounts on the devices Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.

    -**Group Policy**. Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](https://technet.microsoft.com/en-us/library/cc732525.aspx).

    +**Group Policy**. Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](https://technet.microsoft.com//library/cc732525.aspx).

    **Intune**. Not available. @@ -913,7 +913,7 @@ Microsoft has several recommended settings for educational institutions. Table 1 Restrict the local administrator accounts on the devices Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.

    -**Group Policy**. Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](https://technet.microsoft.com/en-us/library/cc732525.aspx).

    +**Group Policy**. Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](https://technet.microsoft.com//library/cc732525.aspx).

    **Intune**. Not available. @@ -921,7 +921,7 @@ Microsoft has several recommended settings for educational institutions. Table 1 Manage the built-in administrator account created during device deployment When you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and optionally disable it.

    -**Group Policy**. Rename the built-in Administrator account by using the **Accounts: Rename administrator account** Group Policy setting. For more information about how to rename the built-in Administrator account, see [To rename the Administrator account using the Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc747484.aspx). You will specify the new name for the Administrator account. You can disable the built-in Administrator account by using the **Accounts: Administrator account status** Group Policy setting. For more information about how to disable the built-in Administrator account, see [Accounts: Administrator account status](https://technet.microsoft.com/en-us/library/jj852165.aspx).

    +**Group Policy**. Rename the built-in Administrator account by using the **Accounts: Rename administrator account** Group Policy setting. For more information about how to rename the built-in Administrator account, see [To rename the Administrator account using the Group Policy Management Console](https://technet.microsoft.com//library/cc747484.aspx). You will specify the new name for the Administrator account. You can disable the built-in Administrator account by using the **Accounts: Administrator account status** Group Policy setting. For more information about how to disable the built-in Administrator account, see [Accounts: Administrator account status](https://technet.microsoft.com//library/jj852165.aspx).

    **Intune**. Not available. @@ -929,7 +929,7 @@ Microsoft has several recommended settings for educational institutions. Table 1 Control Windows Store access You can control access to Windows Store and whether existing Windows Store apps receive updates. You can only disable the Windows Store app in Windows 10 Education and Windows 10 Enterprise.

    -**Group Policy**. You can disable the Windows Store app by using the **Turn off the Store Application** Group Policy setting. You can prevent Windows Store apps from receiving updates by using the **Turn off Automatic Download and Install of updates** Group Policy setting. For more information about configuring these settings, see [Can I use Group Policy to control the Windows Store in my enterprise environment?](https://technet.microsoft.com/en-us/library/hh832040.aspx#BKMK_UseGP).

    +**Group Policy**. You can disable the Windows Store app by using the **Turn off the Store Application** Group Policy setting. You can prevent Windows Store apps from receiving updates by using the **Turn off Automatic Download and Install of updates** Group Policy setting. For more information about configuring these settings, see [Can I use Group Policy to control the Windows Store in my enterprise environment?](https://technet.microsoft.com//library/hh832040.aspx#BKMK_UseGP).

    **Intune**. You can enable or disable the camera by using the **Allow application store** policy setting in the **Apps** section of a **Windows 10 General Configuration** policy. @@ -953,7 +953,7 @@ Microsoft has several recommended settings for educational institutions. Table 1 Use of audio recording Audio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices.

    -**Group Policy**. You can disable the Sound Recorder app by using the **Do not allow Sound Recorder to run** Group Policy setting. You can disable other audio recording apps by using AppLocker policies. Create AppLocker policies by using the information in [Editing an AppLocker Policy](https://technet.microsoft.com/en-us/library/ee791894(v=ws.10).aspx) and [Create Your AppLocker Policies](https://technet.microsoft.com/en-us/library/ee791899.aspx).

    +**Group Policy**. You can disable the Sound Recorder app by using the **Do not allow Sound Recorder to run** Group Policy setting. You can disable other audio recording apps by using AppLocker policies. Create AppLocker policies by using the information in [Editing an AppLocker Policy](https://technet.microsoft.com//library/ee791894(v=ws.10).aspx) and [Create Your AppLocker Policies](https://technet.microsoft.com//library/ee791899.aspx).

    **Intune**. You can enable or disable the camera by using the **Allow voice recording** policy setting in the **Features** section of a **Windows 10 General Configuration** policy. @@ -989,13 +989,13 @@ Microsoft has several recommended settings for educational institutions. Table 1 Now, you’re ready to configure settings by using Group Policy. The steps in this section assume that you have an AD DS infrastructure. You will configure the Group Policy settings you select in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) section. -For more information about Group Policy, see [Group Policy Planning and Deployment Guide](https://technet.microsoft.com/en-us/library/cc754948.aspx). +For more information about Group Policy, see [Group Policy Planning and Deployment Guide](https://technet.microsoft.com//library/cc754948.aspx). #### To configure Group Policy settings -1. Create a Group Policy object (GPO) that will contain the Group Policy settings by completing the steps in [Create a new Group Policy object](https://technet.microsoft.com/en-us/library/cc738830.aspx). -2. Configure the settings in the GPO by completing the steps in [Edit a Group Policy object](https://technet.microsoft.com/en-us/library/cc739902.aspx). -3. Link the GPO to the appropriate AD DS site, domain, or organizational unit by completing the steps in [Link a Group Policy object to a site, domain, or organizational unit](https://technet.microsoft.com/en-us/library/cc738954(v=ws.10).aspx). +1. Create a Group Policy object (GPO) that will contain the Group Policy settings by completing the steps in [Create a new Group Policy object](https://technet.microsoft.com//library/cc738830.aspx). +2. Configure the settings in the GPO by completing the steps in [Edit a Group Policy object](https://technet.microsoft.com//library/cc739902.aspx). +3. Link the GPO to the appropriate AD DS site, domain, or organizational unit by completing the steps in [Link a Group Policy object to a site, domain, or organizational unit](https://technet.microsoft.com//library/cc738954(v=ws.10).aspx). ### Configure settings by using Intune @@ -1006,9 +1006,9 @@ For more information about Intune, see [Documentation for Microsoft Intune](http #### To configure Intune settings 1. Add Intune to your Office 365 subscription by completing the steps in [Get started with a paid subscription to Microsoft Intune](https://docs.microsoft.com/en-us/intune/get-started/start-with-a-paid-subscription-to-microsoft-intune). -2. Enroll devices with Intune by completing the steps in [Get ready to enroll devices in Microsoft Intune](https://technet.microsoft.com/en-us/library/dn646962.aspx). -3. Configure the settings in Intune Windows 10 policies by completing the steps in [Manage settings and features on your devices with Microsoft Intune policies](https://technet.microsoft.com/en-us/library/dn646984.aspx). -4. Manage Windows 10 devices by completing the steps in [Manage Windows PCs with Microsoft Intune](https://technet.microsoft.com/en-us/library/dn646959.aspx). +2. Enroll devices with Intune by completing the steps in [Get ready to enroll devices in Microsoft Intune](https://technet.microsoft.com//library/dn646962.aspx). +3. Configure the settings in Intune Windows 10 policies by completing the steps in [Manage settings and features on your devices with Microsoft Intune policies](https://technet.microsoft.com//library/dn646984.aspx). +4. Manage Windows 10 devices by completing the steps in [Manage Windows PCs with Microsoft Intune](https://technet.microsoft.com//library/dn646959.aspx). ### Deploy apps by using Intune @@ -1041,14 +1041,14 @@ Prior to deployment of Windows 10, ensure that you complete the tasks listed in Use the Deployment Wizard to deploy Windows 10. The LTI deployment process is almost fully automated: You provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. ->**Note:**  To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/en-us/library/dn781089.aspx). +>**Note:**  To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com//library/dn781089.aspx). In most instances, deployments occur without incident. Only in rare occasions do deployments experience problems. #### To deploy Windows 10 1. **Initiate the LTI deployment process**. Initiate the LTI deployment process booting over the network (PXE boot) or from local media. You selected the method for initiating the LTI deployment process in the [Select a method to initiate deployment](#select-a-method-to-initiate-deployment) section earlier in this guide. -2. **Complete the Deployment Wizard**. For more information about how to complete the Deployment Wizard, see the “Running the Deployment Wizard” topic in [Using the Microsoft Deployment Toolkit](https://technet.microsoft.com/en-us/library/dn759415.aspx#Running%20the%20Deployment%20Wizard). +2. **Complete the Deployment Wizard**. For more information about how to complete the Deployment Wizard, see the “Running the Deployment Wizard” topic in [Using the Microsoft Deployment Toolkit](https://technet.microsoft.com//library/dn759415.aspx#Running%20the%20Deployment%20Wizard). ### Set up printers @@ -1256,8 +1256,8 @@ Now, you have identified the tasks you need to perform monthly, at the end of an ##Related resources

      -
    • [Try it out: Windows 10 deployment (for educational institutions)](http://go.microsoft.com/fwlink/p/?LinkId=623254)
      • -
    • [Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255)
      • -
    • [Chromebook migration guide](http://go.microsoft.com/fwlink/p/?LinkId=623249)
      • +
    • [Try it out: Windows 10 deployment (for educational institutions)](https://go.microsoft.com/fwlink/p/?LinkId=623254)
      • +
    • [Try it out: Windows 10 in the classroom](https://go.microsoft.com/fwlink/p/?LinkId=623255)
      • +
    • [Chromebook migration guide](https://go.microsoft.com/fwlink/p/?LinkId=623249)
    diff --git a/windows/plan/deploying-a-runtime-analysis-package.md b/windows/plan/deploying-a-runtime-analysis-package.md index bf01c5258c..38f478a9b9 100644 --- a/windows/plan/deploying-a-runtime-analysis-package.md +++ b/windows/plan/deploying-a-runtime-analysis-package.md @@ -1,48 +1,5 @@ --- title: Deploying a Runtime-Analysis Package (Windows 10) description: When you deploy a runtime-analysis package, you are deploying it to your test environment for compatibility testing. -ms.assetid: 304bf0be-0e7c-4c5f-baac-bed7f8bef509 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Deploying a Runtime-Analysis Package - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -When you deploy a runtime-analysis package, you are deploying it to your test environment for compatibility testing. - -For information about creating the test environment, see [Creating an Enterprise Environment for Compatibility Testing](creating-an-enterprise-environment-for-compatibility-testing.md). - -To deploy a runtime-analysis package, you can use the same deployment methods that you might use to deploy an inventory-collector package. For information about deployment methods, see [Deploying an Inventory-Collector Package](deploying-an-inventory-collector-package.md). - -## Related topics - - -[Deciding Which Applications to Test](deciding-which-applications-to-test.md) - -[Creating an Enterprise Environment for Compatibility Testing](creating-an-enterprise-environment-for-compatibility-testing.md) - -[Creating a Runtime-Analysis Package](creating-a-runtime-analysis-package.md) - -[Compatibility Monitor User's Guide](compatibility-monitor-users-guide.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/deploying-an-inventory-collector-package.md b/windows/plan/deploying-an-inventory-collector-package.md index 406a2823fd..784ecd61b4 100644 --- a/windows/plan/deploying-an-inventory-collector-package.md +++ b/windows/plan/deploying-an-inventory-collector-package.md @@ -1,142 +1,5 @@ --- title: Deploying an Inventory-Collector Package (Windows 10) -ms.assetid: 8726ff71-0d17-4449-bdb7-66957ae51c62 -description: -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -author: TrudyHa ---- - -# Deploying an Inventory-Collector Package - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can use the following methods to deploy an inventory-collector package to the destination computers: - -- **Group Policy Software Installation.** This is a feature of Active Directory Domain Services in Windows Server. All computers to which you deploy the package must be part of the Active Directory forest. - -- **Logon script.** You can use Windows Script Host to create a logon script. Installing by using a logon script requires administrator credentials on the local computer. - -- **Microsoft® System Center Configuration Manager.** For information about how to use System Center Configuration Manager, see the product documentation. - -- **Manual distribution.** You can use a file server on the network as a software distribution point, or you can distribute removable media. User installation of an inventory-collector package requires administrator credentials on the local computer. - -**To deploy an inventory-collector package by using Group Policy Software Installation** - -1. Ensure that the computers to which you want to deploy the inventory-collector package are members of the Active Directory forest. - -2. Create a Group Policy Object (GPO) for publishing the inventory-collector package. - -3. Assign the GPO to the organizational units (OUs) that contain the set of computers. - -4. Create and publish a new software installation package by using Group Policy Software Installation. - - For information about the Group Policy Software Installation process, see [Best practices for Group Policy Software Installation](http://go.microsoft.com/fwlink/p/?LinkId=87996). - -**To assign a logon script for installing an inventory-collector package to an organizational unit** - -1. Create the logon script. The following script is an example. - - ``` syntax - Set ws = WScript.CreateObject("WScript.Shell") - ws.Run("\\servername\collector\package_name.exe") - ``` - - To keep the installation from running repeatedly, your script must create a marker. - - For more information about logon scripts, see [Assign a Logon Script to a User in the Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=87997). - -2. Save your script in the SYSVOL\\Scripts folder. - -3. Open the Active Directory Users and Computers console by clicking **Start**, clicking **All Programs**, clicking **Administrative Tools**, and then clicking **Active Directory Users and Computers**. - -4. Right-click the OU to which you intend to assign the logon script, click **Properties**, and then click the **Group Policy** tab. - -5. Click **New** to add a new GPO, or select an existing GPO and then click **Edit**. - -6. In the left pane, expand the **User Configuration** object, expand the **Windows Setting** object, and then click **Scripts (Logon/Logoff)**. - -7. In the right pane, double-click the **Logon** script. - -8. Click **Add**. - -9. Click **Browse**, browse to the \\\\*<domain>*\\Sysvol\\Scripts folder, select your script, and then click **Open**. - -10. Click **OK** to close the **Logon Properties** dialog box. - -11. Close the Group Policy Management console and the Active Directory Users and Computers console. - -12. On a computer that is a member of the domain and a part of the OU, log on as an OU user. - -13. Open a **Command Prompt** window, and then type `GPUPDATE /force` to force the update of the Group Policy setting. - -14. At the command prompt, type `RSOP.msc` to verify your Group Policy assignment. - -15. In the left pane, expand the **Computer Configuration** object, expand the **Windows Setting** object, and then click **Security Settings**. - -16. Expand **Account Policies**, click **Password Policy**, and verify the assigned Group Policy setting. - -17. Close the Resultant Set of Policy console and the **Command Prompt** window. - -**To deploy an inventory-collector package by using System Center Configuration Manager** - -1. Verify that the computers to which you want to deploy the package are included in your Configuration Manager inventory. - -2. Create a Configuration Manager computer collection that includes the computers. - -3. Create a shared folder that contains the source image of the inventory-collector package. - -4. Create a Configuration Manager package that is based on the source image from the shared folder. - - For more information, see [How to Create a Package](http://go.microsoft.com/fwlink/p/?LinkId=131355). - -5. Specify the Configuration Manager software distribution points. - -6. Create a Configuration Manager program that includes the required commands and command-line options to deploy the inventory-collector package. - - For more information, see [How to Create a Program](http://go.microsoft.com/fwlink/p/?LinkId=131356). - -7. Create a Configuration Manager advertisement that instructs Configuration Manager clients to run the program that you specified in the previous step. - - For more information, see [How to Create an Advertisement](http://go.microsoft.com/fwlink/p/?LinkId=131357). - -**To deploy an inventory-collector package from a network share** - -1. Store your package (.msi) file in a shared folder on the network. - -2. Notify the users of the computers that require the inventory-collector package to run the .msi file. For example, you might send an email message that includes a hyperlink to the shared folder. - -**To deploy an inventory-collector package to offline computers** - -1. In your inventory-collector package, specify a local output path for the log file. - -2. Burn your.msi file to removable media. - -3. Send the removable media to users of the offline computers. - -4. Instruct the users to run the .msi file and then return the generated log file. For example, the users might send the log file in an email message or place the file on a network share. - -## Related topics - - -[Identifying Computers for Inventory Collection](identifying-computers-for-inventory-collection.md) - -[Creating an Inventory-Collector Package](creating-an-inventory-collector-package.md) - -  - -  - - - - - +description: How to deploy an inventory-collector package to your destination computers. +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/deployment-considerations-for-windows-to-go.md b/windows/plan/deployment-considerations-for-windows-to-go.md index 5ef6884c18..a1a32d6836 100644 --- a/windows/plan/deployment-considerations-for-windows-to-go.md +++ b/windows/plan/deployment-considerations-for-windows-to-go.md @@ -56,11 +56,11 @@ When a Windows To Go workspace is first used at the workplace, the Windows To Go When the Windows To Go workspace is going to be used first on an off-premises computer, such as one at the employee’s home, then the IT professional preparing the Windows To Go drives should configure the drive to be able to connect to organizational resources and to maintain the security of the workspace. In this situation, the Windows To Go workspace needs to be configured for offline domain join and BitLocker needs to be enabled before the workspace has been initialized. **Tip**   -Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](http://go.microsoft.com/fwlink/p/?LinkId=619076). +Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](https://go.microsoft.com/fwlink/p/?LinkId=619076).   -DirectAccess can be used to ensure that the user can login with their domain credentials without needing a local account. For instructions on setting up a DirectAccess solution, for a small pilot deployment see [Deploy a Single Remote Access Server using the Getting Started Wizard](http://go.microsoft.com/fwlink/p/?LinkId=619077) for a larger scale deployment, see [Deploy Remote Access in an Enterprise](http://go.microsoft.com/fwlink/p/?LinkId=619078). If you do not want to use DirectAccess as an alternative users could log on using a local user account on the Windows To Go workspace and then use a virtual private network for remote access to your organizational network. +DirectAccess can be used to ensure that the user can login with their domain credentials without needing a local account. For instructions on setting up a DirectAccess solution, for a small pilot deployment see [Deploy a Single Remote Access Server using the Getting Started Wizard](https://go.microsoft.com/fwlink/p/?LinkId=619077) for a larger scale deployment, see [Deploy Remote Access in an Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=619078). If you do not want to use DirectAccess as an alternative users could log on using a local user account on the Windows To Go workspace and then use a virtual private network for remote access to your organizational network. ### Image deployment and drive provisioning considerations @@ -155,28 +155,28 @@ The following list of commonly used Wi-Fi network adapters that are not supporte

    Marvell

    Yukon 88E8001/8003/8010 PCI Gigabit Ethernet

    pci\ven_11ab&dev_4320&subsys_811a1043

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619080)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619082)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619080)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619082)

    Marvell

    Libertas 802.11b/g Wireless

    pci\ven_11ab&dev_1faa&subsys_6b001385&rev_03

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619128)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619129)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619128)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619129)

    Qualcomm

    Atheros AR6004 Wireless LAN Adapter

    sd\vid_0271&pid_0401

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619086)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619086)

    64-bit driver not available

    Qualcomm

    Atheros AR5BWB222 Wireless Network Adapter

    pci\ven_168c&dev_0034&subsys_20031a56

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619348)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619348)

    64-bit driver not available

    @@ -189,43 +189,43 @@ The following list of commonly used Wi-Fi network adapters that are not supporte

    Qualcomm

    Atheros AR5005G Wireless Network Adapter

    pci\ven_168c&dev_001a&subsys_04181468&rev_01

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619349)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619091)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619349)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619091)

    Ralink

    Wireless-G PCI Adapter

    pci\ven_1814&dev_0301&subsys_00551737&rev_00

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619092)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619093)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619092)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619093)

    Ralink

    Turbo Wireless LAN Card

    pci\ven_1814&dev_0301&subsys_25611814&rev_00

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619094)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619095)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619094)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619095)

    Ralink

    Wireless LAN Card V1

    pci\ven_1814&dev_0302&subsys_3a711186&rev_00

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619097)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619098)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619097)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619098)

    Ralink

    D-Link AirPlus G DWL-G510 Wireless PCI Adapter(rev.C)

    pci\ven_1814&dev_0302&subsys_3c091186&rev_00

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619099)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619100)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619099)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619100)

      -IT administrators that want to target Windows To Go images for specific systems should test their images to ensure that the necessary system drivers are in the image, especially for critical functionality like Wi-Fi that is not supported by class drivers. Some consumer devices require OEM specific driver packages, which may not be available on Windows Update. For more information on how to add a driver to a Windows Image, please refer to the [Basic Windows Deployment Step-by-Step Guide](http://go.microsoft.com/fwlink/p/?LinkId=619079). +IT administrators that want to target Windows To Go images for specific systems should test their images to ensure that the necessary system drivers are in the image, especially for critical functionality like Wi-Fi that is not supported by class drivers. Some consumer devices require OEM specific driver packages, which may not be available on Windows Update. For more information on how to add a driver to a Windows Image, please refer to the [Basic Windows Deployment Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=619079). ### Application installation and domain join @@ -273,7 +273,7 @@ Enabling a system to always boot from USB first has implications that you should   -If you are going to be using a Windows 7 computer as a host-PC, see the wiki article [Tips for configuring your BIOS settings to work with Windows To Go](http://go.microsoft.com/fwlink/p/?LinkID=618951). +If you are going to be using a Windows 7 computer as a host-PC, see the wiki article [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). ### Roaming between different firmware types diff --git a/windows/plan/device-dialog-box.md b/windows/plan/device-dialog-box.md index 7cd1c0d3ec..5d32e55b8f 100644 --- a/windows/plan/device-dialog-box.md +++ b/windows/plan/device-dialog-box.md @@ -1,90 +1,5 @@ --- title: Device Dialog Box (Windows 10) description: In Application Compatibility Manager (ACM), the Device dialog box shows information about the selected device. -ms.assetid: 5bd7cfda-31ea-4967-8b64-6c0425092f4e -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# <Device> Dialog Box - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -In Application Compatibility Manager (ACM), the *<Device>* dialog box shows information about the selected device. - -**To open the <Device> dialog box** - -1. In ACM, in the **Quick Reports** pane, click **Analyze**. - -2. Under an operating system heading, click **Devices**. - -3. Double-click the name of a device. - -## Tabs in the <Device> dialog box - - -The following table shows the information available in the *<Device>* dialog box. - - ---- - - - - - - - - - - - - - - - - -
    TabInformation

    Details

    Shows the following information for the selected device:

    -
      -

    • The model and manufacturer of the device.

      • -

    • The class of device, as reported by the device.

      • -

    • An evaluation of whether the device works on a 32-bit operating system or a 64-bit operating system.

      • -

    Computers

    Shows the following information for each of the computers on which the device is installed:

    -
      -

    • Computer name, domain, and operating system.

      • -

    • The count of installed applications and devices.

      • -

    • The count of installed applications and devices that have issues.

      • -
    - -  - -## Using the <Device> Dialog Box - - -In the *<Device>* dialog box, you can perform the following actions: - -- Assign categories and subcategories to the device. For more information, see [Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md). - -- Specify the importance of the device to your organization. For more information, see [Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md). - -  - -  - - - - - +description: This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports. +--- \ No newline at end of file diff --git a/windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md b/windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md index 85c5e0ba27..7bcd802f03 100644 --- a/windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md +++ b/windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md @@ -60,15 +60,4 @@ You can enable your disabled compatibility fixes at any time. 2. On the **Database** menu, click **Enable Entry**. ## Related topics - - -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - -  - -  - - - - - +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) \ No newline at end of file diff --git a/windows/plan/example-filter-queries.md b/windows/plan/example-filter-queries.md index 7b7732863d..8494d2a4b1 100644 --- a/windows/plan/example-filter-queries.md +++ b/windows/plan/example-filter-queries.md @@ -1,79 +1,5 @@ --- title: Example Filter Queries (Windows 10) description: You can filter your compatibility-issue data or reports by selecting specific restriction criteria. -ms.assetid: eae59380-56cc-4d57-bd2c-11a0e3c689c9 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Example Filter Queries - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can filter your compatibility-issue data or reports by selecting specific restriction criteria. - -## Example Queries - - -The following sections show example queries created by using the Query Builder. - -### All Applications with Issues - -The following example query returns all applications that have one or more known issues. - -![act filter example all apps with issues](images/dep-win8-e-act-filterexampleallappswissues.gif) - -### All Applications with Solutions for Known Issues - -The following example query returns all applications that have solutions for their known issues. - -![act filter examples for issues with solutions](images/dep-win8-e-act-filterexampleforissueswsolutions.gif) - -### All Applications with Specific Solution Types - -The following example query returns all applications that have a solution type of Application Update or Application Configuration. - -![act filter example for specific solutions](images/dep-win8-e-act-filterexampleforspecificsolutions.gif) - -### All Applications with No Known Issues - -The following example query returns all applications that have no known issues. - -![act filter example all apps with no issues](images/dep-win8-e-act-filterexampleallapps0issues.gif) - -### All Applications with No Active Issues - -The following example query returns all applications that have no active issues. - -![act filter example all apps with no active issues](images/dep-win8-e-act-filterexampleallapps0activeissues.gif) - -### All Applications Appearing in a Specific Category and Subcategory - -The following example query returns all applications that have a category of Department and a subcategory of either Human Resources or Finance. - -![act filter example category](images/dep-win8-e-act-filterexamplecategory.gif) - -## Related topics - - -[Filtering Your Compatibility Data](filtering-your-compatibility-data.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/exporting-a-data-collection-package.md b/windows/plan/exporting-a-data-collection-package.md index 5baee693f6..e3b5a9ce64 100644 --- a/windows/plan/exporting-a-data-collection-package.md +++ b/windows/plan/exporting-a-data-collection-package.md @@ -1,54 +1,5 @@ --- title: Exporting a Data-Collection Package (Windows 10) description: In Application Compatibility Manager (ACM), you can export a data-collection package as a Windows installer (.msi) file. You can then use the .msi file to install the data-collection package on the computers from which you want to gather data. -ms.assetid: 98fe19e4-9533-4ffc-a275-8b3776ee93ed -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Exporting a Data-Collection Package - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -In Application Compatibility Manager (ACM), you can export a data-collection package as a Windows installer (.msi) file. You can then use the .msi file to install the data-collection package on the computers from which you want to gather data. - -You can export only one data-collection package at a time. - -**To export a data-collection package** - -1. In ACM, click **Collect** to open the Collect screen. - -2. Select the data-collection package that you want to export. - -3. On the **File** menu, click **Export**. - -4. Navigate to the folder where you want to store the Windows installer (.msi) file for the data-collection package, and then click **Save**. - -## Related topics - - -[Log File Locations for Data-Collection Packages](log-file-locations-for-data-collection-packages.md) - -[Deleting a Data-Collection Package](deleting-a-data-collection-package.md) - -[Labeling Data in ACM](labeling-data-in-acm.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/filtering-your-compatibility-data.md b/windows/plan/filtering-your-compatibility-data.md index fcc724c2d5..83040f196c 100644 --- a/windows/plan/filtering-your-compatibility-data.md +++ b/windows/plan/filtering-your-compatibility-data.md @@ -1,115 +1,5 @@ --- title: Filtering Your Compatibility Data (Windows 10) description: You can use Query Builder to filter your compatibility-issue data or reports by selecting specific restriction criteria. -ms.assetid: b64267b5-83c0-4b4d-a075-0975d3a359c8 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Filtering Your Compatibility Data - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can use Query Builder to filter your compatibility-issue data or reports by selecting specific restriction criteria. - -The following table shows the columns in Query Builder. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ColumnDescription

    And/Or

    If you select And, your data must match all query rows to appear as a returned result.

    -

    If you select Or, your data can match any query row to appear as a returned result.

    Field

    Select filter criteria.

    Operator

    Select an operator. The available operators depend on the field that you choose.

    Value

    Type or select a value.

    - -  - -## Creating Basic Queries - - -You can insert as many query clauses as you want to create a customized view of your compatibility data. - -**Note**   -The following examples use the **<Operating\_System> - Application Report** screen. The process is the same for other report types. - -  - -**To create a basic query** - -1. On the **<Operating\_System> - Application Report** screen, click **Toggle Filter**. - -2. In the Query Builder, enter your filter criteria, pressing the Tab key to add clauses. - - To delete a clause, right-click the row, and then click **Delete Clause**. - -3. Click **Refresh**. - - Your filtered results appear. To close the Query Builder, click **Toggle Filter** again. - -## Querying on Objects - - -You can query your compatibility data based on its relationship with other objects. For example, in the applications report, you can query for applications that have corresponding issues. Fields that have a (+) suffix in Query Builder are collections of objects. - -**To query for a collection of objects** - -1. In Query Builder, in the **Field** column, click any field that contains a plus sign (+) as suffix. - -2. In the **Operator** column, select **Exists**, **Not Exists**, or **All Have**. - - Query Builder creates a group clause, which is shown by a bracket that spans the rows that are included in the group. - -3. Move your cursor to the next row in the group clause, and then in the **Field** column, select a field. - -4. In the **Operator** column, select an operator. - -5. In the **Value** column, enter a value, and then click **Refresh**. - -## Related topics - - -[Example Filter Queries](example-filter-queries.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/fixing-compatibility-issues.md b/windows/plan/fixing-compatibility-issues.md index b7f338d5ac..50f8032d64 100644 --- a/windows/plan/fixing-compatibility-issues.md +++ b/windows/plan/fixing-compatibility-issues.md @@ -1,78 +1,5 @@ --- title: Fixing Compatibility Issues (Windows 10) description: This section provides step-by-step instructions and describes development tools that you can use to help fix your compatibility issues. -ms.assetid: 30ba8d14-a41a-41b3-9019-e8658d6974de -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Fixing Compatibility Issues - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides step-by-step instructions and describes development tools that you can use to help fix your compatibility issues. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Deciding Whether to Fix an Application or Deploy a Workaround](deciding-whether-to-fix-an-application-or-deploy-a-workaround.md)

    You can fix a compatibility issue by changing the code for the application or by deploying a workaround.

    [SUA User's Guide](sua-users-guide.md)

    You can use Standard User Analyzer (SUA) to test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows.

    [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)

    The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows to your organization. Compatibility Administrator provides the following:

    - -  - -## Related topics - - -[Taking Inventory of Your Organization](taking-inventory-of-your-organization.md) - -[Testing Compatibility on the Target Platform](testing-compatibility-on-the-target-platform.md) - -[Managing Your Data-Collection Packages](managing-your-data-collection-packages.md) - -[Analyzing Your Compatibility Data](analyzing-your-compatibility-data.md) - -[Troubleshooting ACT](troubleshooting-act.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/identifying-computers-for-inventory-collection.md b/windows/plan/identifying-computers-for-inventory-collection.md index a7378b9820..524304a7cf 100644 --- a/windows/plan/identifying-computers-for-inventory-collection.md +++ b/windows/plan/identifying-computers-for-inventory-collection.md @@ -1,104 +1,5 @@ --- title: Identifying Computers for Inventory Collection (Windows 10) -ms.assetid: f5bf2d89-fff2-4960-a153-dc1146b442fb -description: -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -author: TrudyHa ---- - -# Identifying Computers for Inventory Collection - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -An inventory-collector package gathers inventory data from the computers on which it is installed. This data includes the following: - -- **System inventory.** Information about the client computer. This information includes the memory capacity, the processor speed, and the processor architecture. - -- **Device inventory.** Information about the devices that are installed on the client computer. This information includes the model, the manufacturer, and the device class. - -- **Software inventory.** An inventory of the applications that are installed on the computer. This information includes system technologies such as Windows® Installer. - -To generate a complete inventory and obtain a comprehensive view of your organization, inventory all computers. However, remember that deploying inventory-collector packages to all computers in your organization will require the additional work of analyzing and reducing a larger list of applications. If you do not have the resources to deploy to all computers or you cannot process a larger list of applications, consider deploying inventory-collector packages to representative subsets of computers instead. - -If you decide to deploy inventory-collector packages to representative subsets of computers in your organization, consider the following: - -- [Managed and Unmanaged Environments](#bmk-managedunmanaged) - -- [Role-Based Applications](#bmk-rolebasedapplications) - -- [Software Distribution](#bmk-softwaredistribution) - -- [Geographic Distribution](#bmk-geographicdistribution) - -- [Computer Types](#bmk-computertypes) - -## Managed and Unmanaged Environments - - -In your organization, you may have managed environments and unmanaged environments. - -In a managed environment, IT administrators strictly control and manage the installation and use of applications. In this environment, you can discover the full inventory by deploying inventory-collector packages to a limited subset of computers. - -In an unmanaged environment, users have administrator permissions and can install applications at their own discretion. To obtain the full inventory, you must deploy your inventory-collector packages to more computers. - -## Role-Based Applications - - -Your organization may use role-based applications that relate to job function. For example, accountants may use finance-related applications. Reviewing application use together with job function helps you better identify which subsets of computers need inventory-collector packages. - -## Software Distribution - - -You can distribute applications in various ways within an organization. For example, you can use Group Policy, Microsoft® IntelliMirror®, Microsoft System Center Configuration Manager, or a customized distribution method. Reviewing the policies for your software distribution system helps you better identify which subsets of computers need inventory-collector packages. - -## Geographic Distribution - - -While you plan for inventory collection, consider the geographic distribution of your organization, and consider application use within each region. Be sure to account for divisional applications, localized applications, and applications that are specific to the geographic location and export restrictions. Consult with technical and business leaders from each region to understand the differences and determine which subsets of computers need inventory-collector packages. - -## Computer Types - - -Computer types can be an important factor in the deployment of inventory-collector packages. The following sections describe common computer types. - -### Mobile Computers - -Mobile users are frequently offline, occasionally synchronizing with the corporate network through a LAN or VPN connection. The user must be online for the inventory-collector package to be downloaded and installed, and must be online again for the logged data to be uploaded. - -### Multiuser Computers - -Multiuser computers are typically in university computer labs, libraries, and organizations that enable job sharing. These computers include a core set of applications that are always available, in addition to many applications that can be installed and removed as necessary. Because these computers typically have a core set of applications, you can identify a narrow subset of computers to receive the inventory-collector package. - -### AppStations and TaskStations - -AppStations that run vertical applications are typically for marketing, claims and loan processing, and customer service. TaskStations are typically dedicated to running a single application in a location such as a manufacturing floor (as an entry terminal) or a call center. Because AppStations and TaskStations do not typically enable users to add or remove applications, you can identify a narrow subset of computers to receive the inventory-collector package. - -### Kiosks - -Kiosks are generally in public areas. These computers run unattended. They also generally run a single application by using a single-use account and automatic logon. Because these computers typically run a single application, you can identify a narrow subset of computers to receive the inventory-collector package. - -## Related topics - - -[Creating an Inventory-Collector Package](creating-an-inventory-collector-package.md) - -[Deploying an Inventory-Collector Package](deploying-an-inventory-collector-package.md) - -  - -  - - - - - +description: To generate a complete inventory and obtain a comprehensive view of your organization, inventory all computers. However, remember that deploying inventory-collector packages to all computers in your organization will require the additional work of analyzing and reducing a larger list of applications. If you do not have the resources to deploy to all computers or you cannot process a larger list of applications, consider deploying inventory-collector packages to representative subsets of computers instead. +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/index.md b/windows/plan/index.md index 1a3583938b..b692bf0504 100644 --- a/windows/plan/index.md +++ b/windows/plan/index.md @@ -15,11 +15,11 @@ Windows 10 provides new deployment capabilities, scenarios, and tools by buildi ## In this section |Topic |Description | |------|------------| -|[Windows 10 servicing options](windows-10-servicing-options.md) |Windows 10 provides a new model for organizations to deploy and upgrade Windows by providing updates to features and capabilities through a continual process. | +| [Windows 10 servicing overview](windows-10-servicing-options.md) | Windows 10 provides a new model for organizations to deploy and upgrade Windows by providing updates to features and capabilities through a continual process. | |[Windows 10 deployment considerations](windows-10-deployment-considerations.md) |There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. | |[Windows 10 compatibility](windows-10-compatibility.md) |Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. | |[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) |There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. | -|[Windows Update for Business](windows-update-for-business.md) |Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. | +| [Windows Update for Business](windows-update-for-business.md) | Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. | |[Windows To Go: feature overview](windows-to-go-overview.md) |Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. | |[Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) |The Microsoft® Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. | |[Change history for Plan for Windows 10 deployment](change-history-for-plan-for-windows-10-deployment.md) |This topic lists new and updated topics in the Plan for Windows 10 deployment documentation for [Windows 10 and Windows 10 Mobile](../index.md). | @@ -30,14 +30,9 @@ Windows 10 provides new deployment capabilities, scenarios, and tools by buildi - [Deploy Windows 10 with Configuration Manager and MDT 2013 Update 1](../deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) - [Upgrade to Windows 10 with MDT 2013 Update 1](../deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) - [Upgrade to Windows 10 with Configuration Manager](../deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md) -- [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) +- [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=733911) - [Windows 10 and Windows 10 Mobile](../index.md)     - - - - - diff --git a/windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md b/windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md index c55deebb84..bd057029b9 100644 --- a/windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md +++ b/windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md @@ -59,15 +59,4 @@ When a custom database is no longer necessary, either because the applications a 2. On the **File** menu, click **Uninstall**. ## Related topics - - -[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) - -  - -  - - - - - +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) \ No newline at end of file diff --git a/windows/plan/integration-with-management-solutions-.md b/windows/plan/integration-with-management-solutions-.md index 83dcaee001..73206e6baf 100644 --- a/windows/plan/integration-with-management-solutions-.md +++ b/windows/plan/integration-with-management-solutions-.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing, devices -author: TrudyHa +author: jdeckerMS --- # Integration with management solutions diff --git a/windows/plan/internet-explorer-web-site-report.md b/windows/plan/internet-explorer-web-site-report.md index da0098b6c3..f30fc92bd6 100644 --- a/windows/plan/internet-explorer-web-site-report.md +++ b/windows/plan/internet-explorer-web-site-report.md @@ -1,68 +1,5 @@ --- title: Internet Explorer - Web Site Report (Windows 10) -ms.assetid: f072033d-9d42-47ed-8fb0-dbdc28442910 -description: -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Internet Explorer - Web Site Report - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The **Internet Explorer - Web Site Report** screen shows the following information for each of the websites visited in your organization: - -- The website URL. - -- Your organization's compatibility rating for the website. - -- The count of issues for the website. - -- The count of resolved issues for the website. - -**To open the Internet Explorer - Web Site Report screen** - -1. In Application Compatibility Manager (ACM), on the **Quick Reports** pane, click **Analyze**. - -2. In the **Quick Reports** pane, under the **Internet Explorer** heading, click **Web Sites**. - -## Using the Internet Explorer - Web Site Report Screen - - -On the **Internet Explorer - Web Site Report** screen, you can: - -- Export the report data to a spreadsheet, or import a report. For more information, see [Saving, Opening, and Exporting Reports](saving-opening-and-exporting-reports.md). - -- Synchronize your compatibility issues by using the Microsoft Compatibility Exchange. For more information, see [Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md). - -- Filter the report by using the query builder. For more information, see [Filtering Your Compatibility Data](filtering-your-compatibility-data.md). - -- Specify your compatibility rating for a website. For more information, see [Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md). - -- Select your deployment status for a website. For more information, see [Selecting Your Deployment Status](selecting-your-deployment-status.md). - -- Assign categories and subcategories to a website. For more information, see [Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md). - -- Specify the importance of a website to your organization. For more information, see [Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md). - -- Double-click a website name to view its associated dialog box. For more information, see [<WebsiteURL> Dialog Box](websiteurl-dialog-box.md). - -  - -  - - - - - +description: The Internet Explorer - Web Site Report screen shows the URL, your organization's compatibility rating, issue count, and resolved issue count, for each of the websites visited in your organization. +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/labeling-data-in-acm.md b/windows/plan/labeling-data-in-acm.md index 1e0ae71639..92f7448f84 100644 --- a/windows/plan/labeling-data-in-acm.md +++ b/windows/plan/labeling-data-in-acm.md @@ -1,54 +1,5 @@ --- title: Labeling Data in ACM (Windows 10) description: Application data and its associated compatibility issues can vary within an organization. -ms.assetid: d099c747-e68a-4cad-a639-9f33efab35b3 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Labeling Data in ACM - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -Application data and its associated compatibility issues can vary within an organization. For example, the applications used by a Human Resources (HR) department might differ from the applications used by a Sales department. Even for applications that are used across an organization, different compatibility issues might be found for each business group because of the unique application use by each business group. - -Your data-collection packages can add a *label* to your inventoried applications. To filter by business group when analyzing reports, you can create a different data-collection package for each business group and have each package assign a unique label. For example, you can create a data-collection package for your Sales department with a **Sales** label. During reports analysis, you can filter your results so that only the data with the **Sales** label is visible. - -You can specify a label when you create a data-collection package. You cannot change the label for an existing data-collection package. - -**To specify the label for a new data-collection package** - -1. In Application Compatibility Manager (ACM), on the **Go** menu, click **Collect**. - -2. On the **Collect** screen, click **File** from the toolbar, and then click **New** to start creating a new data-collection package. - -3. In the wizard, enter the label that you want to be applied by the data-collection package. - -## Related topics - - -[Log File Locations for Data-Collection Packages](log-file-locations-for-data-collection-packages.md) - -[Exporting a Data-Collection Package](exporting-a-data-collection-package.md) - -[Deleting a Data-Collection Package](deleting-a-data-collection-package.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/log-file-locations-for-data-collection-packages.md b/windows/plan/log-file-locations-for-data-collection-packages.md index 99ea5bc63f..5fa3b6c466 100644 --- a/windows/plan/log-file-locations-for-data-collection-packages.md +++ b/windows/plan/log-file-locations-for-data-collection-packages.md @@ -1,54 +1,5 @@ --- title: Log File Locations for Data-Collection Packages (Windows 10) -ms.assetid: dcc395e7-2d9c-4935-abab-33c5934ce24a -description: -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Log File Locations for Data-Collection Packages - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -When you create a data-collection package in Application Compatibility Manager (ACM), you can select an output location for your log files. You have the following options: - -- Specify an ACT Log Processing Service (LPS) share. The data-collection package automatically writes the log files to the specified ACT LPS share. - - If the ACT LPS share is unavailable when the upload time interval is reached, the data-collection package will make two more attempts. - - For inventory collector packages, after the third attempt, the inventory collector package no longer attempts to upload data. - - For runtime-analysis packages, if the problem persists, the runtime-analysis package will store the log file in %SYSTEMDRIVE%\\Users\\All Users\\Microsoft\\Application Compatibility Toolkit\\LogProcessor\\Failed. The runtime-analysis package will attempt to upload the files again at the next upload interval. - -- Select **Local (%ACTAppData%\\DataCollector\\Output)**. If you use this option, the data-collection package creates log files on the local system and the computer administrator must manually copy the files to the ACT LPS share location. Consider this option for mobile users who are not always connected to the network. The log files are located in %SYSTEMDRIVE%\\Users\\All Users\\Microsoft\\Application Compatibility Toolkit\\DataCollector\\Output. - -- Type an alternate network share location. If you use this option, verify that the data-collection package can write to the alternate location. You might consider this option if your organization is geographically diverse. For example, administrators can create data-collection packages and file shares individually for each geographic location. Administrators at a central location must then move the log files to a central location and map the files to the ACT LPS share for processing and entry into the ACT database. - -## Related topics - - -[Exporting a Data-Collection Package](exporting-a-data-collection-package.md) - -[Deleting a Data-Collection Package](deleting-a-data-collection-package.md) - -[Labeling Data in ACM](labeling-data-in-acm.md) - -  - -  - - - - - +description: Selecting the output for your data-collection package log files. +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md b/windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md index 7c8a961d1d..a654054608 100644 --- a/windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md +++ b/windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md @@ -56,17 +56,6 @@ This section provides information about managing your application-compatibility   ## Related topics - - [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) -[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) - -  - -  - - - - - +[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) \ No newline at end of file diff --git a/windows/plan/managing-your-data-collection-packages.md b/windows/plan/managing-your-data-collection-packages.md index 46eaa26130..03cbe4849d 100644 --- a/windows/plan/managing-your-data-collection-packages.md +++ b/windows/plan/managing-your-data-collection-packages.md @@ -1,80 +1,5 @@ --- title: Managing Your Data-Collection Packages (Windows 10) description: This section provides information about using Application Compatibility Manager (ACM) to manage your data-collection packages. -ms.assetid: 369ae82f-c8ca-42ec-85df-1b760a74e70a -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Managing Your Data-Collection Packages - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides information about using Application Compatibility Manager (ACM) to manage your data-collection packages. Data-collection packages include inventory-collector packages and runtime-analysis packages. The following procedures apply to both package types. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Log File Locations for Data-Collection Packages](log-file-locations-for-data-collection-packages.md)

    When you create a data-collection package in Application Compatibility Manager (ACM), you can select an output location for your log files. You have the following options:

    [Exporting a Data-Collection Package](exporting-a-data-collection-package.md)

    In Application Compatibility Manager (ACM), you can export a data-collection package as a Windows installer (.msi) file. You can then use the .msi file to install the data-collection package on the computers from which you want to gather data.

    [Deleting a Data-Collection Package](deleting-a-data-collection-package.md)

    In Application Compatibility Manager (ACM), you can delete any of your existing data-collection packages from the database.

    [Labeling Data in ACM](labeling-data-in-acm.md)

    Application data and its associated compatibility issues can vary within an organization. For example, the applications used by a Human Resources (HR) department might differ from the applications used by a Sales department. Even for applications that are used across an organization, different compatibility issues might be found for each business group because of the unique application use by each business group.

    - -  - -## Related topics - - -[Taking Inventory of Your Organization](taking-inventory-of-your-organization.md) - -[Testing Compatibility on the Target Platform](testing-compatibility-on-the-target-platform.md) - -[Analyzing Your Compatibility Data](analyzing-your-compatibility-data.md) - -[Fixing Compatibility Issues](fixing-compatibility-issues.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/organizational-tasks-for-each-report-type.md b/windows/plan/organizational-tasks-for-each-report-type.md index e572f3b042..61498e165d 100644 --- a/windows/plan/organizational-tasks-for-each-report-type.md +++ b/windows/plan/organizational-tasks-for-each-report-type.md @@ -1,96 +1,5 @@ --- title: Organizational Tasks for Each Report Type (Windows 10) description: The following table shows which tasks can be performed for each report type. -ms.assetid: 7463fab1-ba6e-4a9a-9112-0b69a18fe353 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Organizational Tasks for Each Report Type - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The following table shows which tasks can be performed for each report type. - - --------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Report[Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md)[Selecting Your Deployment Status](selecting-your-deployment-status.md)[Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md)[Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md)[Selecting the Send and Receive Status for an Application](selecting-the-send-and-receive-status-for-an-application.md)[Creating and Editing Issues and Solutions](creating-and-editing-issues-and-solutions.md)

    [<OperatingSystem> - Application Report](act-operatingsystem-application-report.md)

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    [<OperatingSystem> - Computer Report](act-operatingsystem-computer-report.md)

    No

    No

    Yes

    Yes

    No

    No

    [<OperatingSystem> - Device Report](act-operatingsystem-device-report.md)

    No

    No

    Yes

    Yes

    No

    No

    [<WebsiteURL> Dialog Box](websiteurl-dialog-box.md)

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    - -  - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/organizing-your-compatibility-data.md b/windows/plan/organizing-your-compatibility-data.md index 54bc38d151..30d2918977 100644 --- a/windows/plan/organizing-your-compatibility-data.md +++ b/windows/plan/organizing-your-compatibility-data.md @@ -1,90 +1,5 @@ --- title: Organizing Your Compatibility Data (Windows 10) description: This section provides step-by-step instructions for organizing your compatibility data in Application Compatibility Manager (ACM). -ms.assetid: e91ae444-5d85-4b5f-b655-a765ecc78b1e -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Organizing Your Compatibility Data - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides step-by-step instructions for organizing your compatibility data in Application Compatibility Manager (ACM). - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Organizational Tasks for Each Report Type](organizational-tasks-for-each-report-type.md)

    The following table shows which tasks can be performed for each report type.

    [Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md)

    You can rate the compatibility of your applications, installation packages, or websites, based on whether they run successfully on a 32-bit or 64-bit operating system. Your rating applies to your entire organization and is based on your own testing results and organizational requirements.

    [Selecting Your Deployment Status](selecting-your-deployment-status.md)

    In Application Compatibility Manager (ACM), you can track the deployment status of your applications and websites.

    [Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md)

    To customize and filter your compatibility reports, you can create categories and subcategories to assign to your applications, computers, devices, and websites. By default, Microsoft provides the following categories:

    [Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md)

    You can prioritize your applications, websites, computers, and devices to help customize and filter your compatibility reports. The priority levels are:

    [Selecting the Send and Receive Status for an Application](selecting-the-send-and-receive-status-for-an-application.md)

    For each application listed in Application Compatibility Manager (ACM), you can select whether to send and receive specific application data through the Microsoft Compatibility Exchange

    [Creating and Editing Issues and Solutions](creating-and-editing-issues-and-solutions.md)

    This section provides step-by-step instructions for adding and editing application compatibility issues and solutions. Your issue and solution data can be uploaded to Microsoft through the Microsoft® Compatibility Exchange.

    - -  - -## Related topics - - -[Viewing Your Compatibility Reports](viewing-your-compatibility-reports.md) - -[Filtering Your Compatibility Data](filtering-your-compatibility-data.md) - -[Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/prepare-your-organization-for-windows-to-go.md b/windows/plan/prepare-your-organization-for-windows-to-go.md index fabf25bc73..a5443fb11c 100644 --- a/windows/plan/prepare-your-organization-for-windows-to-go.md +++ b/windows/plan/prepare-your-organization-for-windows-to-go.md @@ -70,7 +70,7 @@ Because Windows To Go requires no additional software and minimal configuration, Windows To Go uses volume activation. You can use either Active Directory-based activation or KMS activation with Windows To Go. The Windows To Go workspace counts as another installation when assessing compliance with application licensing agreements. -Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Office 365 ProPlus, Office 365 ProPlus subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Office 365 ProPlus or Office 365 Enterprise SKUs containing Office 365 ProPlus via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](http://go.microsoft.com/fwlink/p/?LinkId=618922). +Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Office 365 ProPlus, Office 365 ProPlus subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Office 365 ProPlus or Office 365 Enterprise SKUs containing Office 365 ProPlus via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=618922). You should investigate other software manufacturer’s licensing requirements to ensure they are compatible with roaming usage before deploying them to a Windows To Go workspace. @@ -79,7 +79,7 @@ Using Multiple Activation Key (MAK) activation is not a supported activation met   -See [Plan for Volume Activation](http://go.microsoft.com/fwlink/p/?LinkId=618923) for more information about these activation methods and how they can be used in your organization. +See [Plan for Volume Activation](https://go.microsoft.com/fwlink/p/?LinkId=618923) for more information about these activation methods and how they can be used in your organization. ## Organizational unit structure and use of Group Policy Objects @@ -98,14 +98,14 @@ If you configure Windows To Go drives for scenarios where drives may remain unus ## User account and data management -People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to have the ability to get to the data that they work with and to keep it accessible when the workspace is not being used. For this reason we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user’s profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](http://go.microsoft.com/fwlink/p/?LinkId=618924). +People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to have the ability to get to the data that they work with and to keep it accessible when the workspace is not being used. For this reason we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user’s profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). Windows To Go is fully integrated with your Microsoft account. Setting synchronization is accomplished by connecting a Microsoft account to a user account. Windows To Go devices fully support this feature and can be managed by Group Policy so that the customization and configurations you prefer will be applied to your Windows To Go workspace. ## Remote connectivity -If you want Windows To Go to be able to connect back to organizational resources when it is being used off-premises a remote connectivity solution must be enabled. Windows Server 2012 DirectAccess can be used as can a virtual private network (VPN) solution. For more information about configuring a remote access solution, see the [Remote Access (DirectAccess, Routing and Remote Access) Overview](http://go.microsoft.com/fwlink/p/?LinkId=618925). +If you want Windows To Go to be able to connect back to organizational resources when it is being used off-premises a remote connectivity solution must be enabled. Windows Server 2012 DirectAccess can be used as can a virtual private network (VPN) solution. For more information about configuring a remote access solution, see the [Remote Access (DirectAccess, Routing and Remote Access) Overview](https://go.microsoft.com/fwlink/p/?LinkId=618925). ## Related topics diff --git a/windows/plan/prioritizing-your-compatibility-data.md b/windows/plan/prioritizing-your-compatibility-data.md index 3d55e9d1f3..7304d6dbb9 100644 --- a/windows/plan/prioritizing-your-compatibility-data.md +++ b/windows/plan/prioritizing-your-compatibility-data.md @@ -1,103 +1,5 @@ --- title: Prioritizing Your Compatibility Data (Windows 10) -ms.assetid: 103e125a-bd2b-4019-9d6a-2e1d50c380b1 -description: -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Prioritizing Your Compatibility Data - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can prioritize your applications, websites, computers, and devices to help customize and filter your compatibility reports. The priority levels are: - -- **Priority 1 - Business Critical**. The highest priority level, applied to an item that is so important to your organization that a compatibility issue with the item would keep you from deploying a new operating system. - -- **Priority 2 - Important**. Items that your organization regularly uses but can function without. - -- **Priority 3 - Nice to Have**. Lower-priority items that you want to show in your compatibility reports that do not belong in either of the previous two categories. - -- **Priority 4 - Unimportant**. Items that are irrelevant to the daily functions of your organization. - -- **Unspecified**. The default priority level, applied to items that have not yet been reviewed for deployment. - -## Prioritizing Your Applications, Computers, Devices, and Websites - - -The following example uses the **<Operating\_System> - Application Report** screen. You can alternatively use the **<Application\_Name>** dialog box. The procedure is the same on the reports for computers, devices, and websites. - -**To change the priority** - -1. On the **<Operating\_System> - Application Report** screen, click the name of the application. - -2. On the **Actions** menu, click **Set Priority**. - -3. Click a priority, and then click **OK**. - -**To filter your data by priority** - -1. On the **<Operating\_System> - Application Report** screen, click **Toggle Filter**. - -2. Enter your filter criteria, pressing the Tab key to add clauses. - - Consider the following example, which shows a query that filters for all applications that have a priority level of **Business Critical** or **Important**. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    And/OrFieldOperatorValue

    And

    Priority

    Equals

    Priority 1 - Business Critical

    Or

    Priority

    Equals

    Priority 2 - Important

    - -   - - To delete a clause, right-click the row, and then click **Delete Clause**. - -3. Click **Refresh**. - - Your filtered results appear. - -  - -  - - - - - +description: Prioritizing your apps, websites, computers, and devices to help customize and filter your compatibilty reports. +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/ratings-icons-in-acm.md b/windows/plan/ratings-icons-in-acm.md index e8f095c0ac..c1f0184338 100644 --- a/windows/plan/ratings-icons-in-acm.md +++ b/windows/plan/ratings-icons-in-acm.md @@ -1,111 +1,5 @@ --- title: Ratings Icons in ACM (Windows 10) description: Compatibility ratings can originate from Microsoft, the application vendor, your organization, and from the Application Compatibility Toolkit (ACT) community. -ms.assetid: 0165499e-cb47-4d76-98a6-b871d23e4e83 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Ratings Icons in ACM - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -Compatibility ratings can originate from Microsoft, the application vendor, your organization, and from the Application Compatibility Toolkit (ACT) community. - -For information about specifying your own ratings, see [Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md). For information about community ratings, see [ACT Community Ratings and Process](act-community-ratings-and-process.md). - -## Icons - - -The following table shows icons that appear on the report screens and dialog boxes for **Company Assessment** and **Vendor Assessment**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    IconDescription
    ACT Green icon

    Application, device, or website functions as expected on a 32-bit operating system.

    ACT green 64-bit icon

    Application, device, or website functions as expected on a 64-bit operating system.

    ACT minor issue icon

    Application, device, or website with issues that are minor or have known solutions on a 32-bit operating system. Severity 3 issues are considered minor issues.

    ACT Minor issues 64-bit icon

    Application, device, or website with issues that are minor or have known solutions on a 64-bit operating system.

    ACT does not work icon

    Application, device, or website with major issues, such as data loss or severely impaired functionality, on 32-bit operating systems. Severity 1 and Severity 2 issues are considered major issues.

    ACT does not work 64-bit icon

    Application, device, or website with major issues, such as data loss or severely impaired functionality, on 64-bit operating systems.

    ACT Information icon

    Application, device, or website that does not have any application assessment data for 32-bit operating systems. The item does not match any information in the database, or no assessments have been submitted.

    ACT 64-bit info icon

    Application, device, or website that does not have any application assessment data for 64-bit operating systems.

    - -  - -## User Ratings and ACT Community Ratings - - -Ratings are displayed graphically in the **User Ratings** column and the **Community Assessment** column. The rating color and bar count depend on how the users or community rated the item. There are three possible ratings: - -- **Works**. Applications with this rating receive five green bars. - -- **Works with minor issues or has solutions**. Applications with this rating receive three light-green bars. - -- **Does not work**. Applications with this rating receive a single red bar. - -The color gradient from one to five bars shows the average rating. - -![act community](images/dep-win8-e-act-communityexample.gif) - -## Related topics - - -[Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md) - -[Analyzing Your Compatibility Data](analyzing-your-compatibility-data.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/resolving-an-issue.md b/windows/plan/resolving-an-issue.md index 4d5557c944..e6a5b97651 100644 --- a/windows/plan/resolving-an-issue.md +++ b/windows/plan/resolving-an-issue.md @@ -1,62 +1,5 @@ --- title: Resolving an Issue (Windows 10) description: You can use Application Compatibility Manager (ACM) to flag issues as resolved. Resolving an issue changes the status of the issue from a red x to a green check mark on your report and report detail screens. -ms.assetid: 96195122-185d-4f6a-8e84-79c3d069e933 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Resolving an Issue - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can use Application Compatibility Manager (ACM) to flag issues as resolved. Resolving an issue changes the status of the issue from a red **x** to a green check mark on your report and report detail screens. - -Resolving an issue is not required. However, if you do not resolve the issue, the issue remains active in your ACT database and provides inaccurate reports. - -## Resolving Issues for Your Applications and Websites - - -This procedure describes how to resolve an existing issue that is documented in ACM. For information about adding an issue, see [Adding or Editing an Issue](adding-or-editing-an-issue.md). - -**Note**   -The following example uses the **<Application\_Name>** dialog box. The procedure is similar for websites. - -  - -**To resolve issues** - -1. On the **<Operating\_System> - Application Report** screen, double-click the name of the application to display the **<Application\_Name>** dialog box. - -2. Click the **Issues** tab. - -3. Double-click the specific issue to resolve. - -4. On the **Actions** menu, click **Resolve**, and then close the **<Application\_Name> - <Issue\_Title>** dialog box. - - The issue appears with a green check mark in the report details screen. - - **Note**   - If you have not entered a solution but have resolved the issue, Microsoft recommends that you enter a solution with **Other** solution type and add text that describes why you resolved the issue without a solution. For information about entering solutions, see [Adding or Editing a Solution](adding-or-editing-a-solution.md). - -   - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/saving-opening-and-exporting-reports.md b/windows/plan/saving-opening-and-exporting-reports.md index 67d940bd0d..65bfc93fba 100644 --- a/windows/plan/saving-opening-and-exporting-reports.md +++ b/windows/plan/saving-opening-and-exporting-reports.md @@ -1,78 +1,5 @@ --- title: Saving, Opening, and Exporting Reports (Windows 10) description: You can perform several common reporting tasks from the Analyze screen, including saving a compatibility report, opening a saved compatibility report (.adq) file, and exporting your report data to a spreadsheet (.xls) file. -ms.assetid: 8be72a6c-63ab-4451-ad79-815e2ac18aa2 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Saving, Opening, and Exporting Reports - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can perform several common reporting tasks from the **Analyze** screen, including saving a compatibility report, opening a saved compatibility report (.adq) file, and exporting your report data to a spreadsheet (.xls) file. - -## Saving Your Compatibility Report - - -You can save your compatibility report data, including any custom filters created by the query builder tool. You can import this report data back into Application Compatibility Manager (ACM) at a later time. - -**To save a report** - -1. In the **Quick Reports** pane, click **Analyze**. - -2. Expand the node for the target operating system for which you want to see compatibility reports, and then click a node for a report type. - -3. On the **File** menu, click **Save As**. - -4. Browse to the folder where you want to save your report, and then click **Save**. - -## Opening an Existing Compatibility Report - - -In ACM, you can open, or import, a compatibility report (.adq) file. - -**To open a report** - -1. In the **Quick Reports** pane, click **Analyze**. - -2. Expand the node for the target operating system for which you want to see compatibility reports, and then click a node for a report type. - -3. On the **File** menu, click **Open Report**. - -4. Browse to the folder where you saved your report, and then click **Open**. - -## Exporting Compatibility Report Data - - -You can export your compatibility report data to an Microsoft® Excel® spreadsheet (.xls) file. - -**To export report data** - -1. In the **Quick Reports** pane, click **Analyze**. - -2. Expand the node for the target operating system for which you want to see compatibility reports, and then click a node for a report type. - -3. On the **File** menu, click **Export Report**. - -4. Browse to the folder where you want to store the spreadsheet file, and then click **Save**. - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md b/windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md index 99b2f4a61f..2488fe4e38 100644 --- a/windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md +++ b/windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md @@ -62,8 +62,6 @@ You can export your search results to a text (.txt) file for later review or arc 2. Browse to the location where you want to store your search result file, and then click **Save**. ## Related topics - - [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)   diff --git a/windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md b/windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md index 25906a1746..34260942d9 100644 --- a/windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md +++ b/windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md @@ -166,8 +166,6 @@ You can export any of your search results into a tab-delimited text (.txt) file 2. Browse to the location where you intend to store the search results file, and then click **Save**. ## Related topics - - [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)   diff --git a/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md b/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md index 999d2e6956..2cce8de874 100644 --- a/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md +++ b/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md @@ -22,9 +22,9 @@ One of the most important requirements to consider when you plan your Windows To ## Backup and restore -As long as you are not saving data on the Windows To Go drive, there is no need for a backup and restore solution for Windows To Go. If you are saving data on the drive and are not using folder redirection and offline files, you should back up all of your data to a network location, such as cloud storage or a network share after each work session. Review the new and improved features described in [Supporting Information Workers with Reliable File Services and Storage](http://go.microsoft.com/fwlink/p/?LinkId=619102) for different solutions you could implement. +As long as you are not saving data on the Windows To Go drive, there is no need for a backup and restore solution for Windows To Go. If you are saving data on the drive and are not using folder redirection and offline files, you should back up all of your data to a network location, such as cloud storage or a network share after each work session. Review the new and improved features described in [Supporting Information Workers with Reliable File Services and Storage](https://go.microsoft.com/fwlink/p/?LinkId=619102) for different solutions you could implement. -If the USB drive fails for any reason, the standard process to restore the drive to working condition is to reformat and re-provision the drive with Windows To Go, so all data and customization on the drive will be lost. This is another reason why using roaming user profiles, folder redirection and offline files with Windows To Go is strongly recommended. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](http://go.microsoft.com/fwlink/p/?LinkId=618924). +If the USB drive fails for any reason, the standard process to restore the drive to working condition is to reformat and re-provision the drive with Windows To Go, so all data and customization on the drive will be lost. This is another reason why using roaming user profiles, folder redirection and offline files with Windows To Go is strongly recommended. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). ## BitLocker @@ -47,16 +47,16 @@ We recommend that you use the **NoDefaultDriveLetter** attribute when provisioni To prevent accidental data leakage between Windows To Go and the host system Windows 8 has a new SAN policy—OFFLINE\_INTERNAL - “4” to prevent the operating system from automatically bringing online any internally connected disk. The default configuration for Windows To Go has this policy enabled. It is strongly recommended you do not change this policy to allow mounting of internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 operating system, mounting the drive will lead to loss of hibernation state and therefor user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted. -For more information, see [How to Configure Storage Area Network (SAN) Policy in Windows PE](http://go.microsoft.com/fwlink/p/?LinkId=619103). +For more information, see [How to Configure Storage Area Network (SAN) Policy in Windows PE](https://go.microsoft.com/fwlink/p/?LinkId=619103). ## Security certifications for Windows To Go Windows to Go is a core capability of Windows when it is deployed on the drive and is configured following the guidance for the applicable security certification. Solutions built using Windows To Go can be submitted for additional certifications by the solution provider that cover the solution provider’s specific hardware environment. For more details about Windows security certifications, see the following topics. -- [Windows Platform Common Criteria Certification](http://go.microsoft.com/fwlink/p/?LinkId=619104) +- [Windows Platform Common Criteria Certification](https://go.microsoft.com/fwlink/p/?LinkId=619104) -- [FIPS 140 Evaluation](http://go.microsoft.com/fwlink/p/?LinkId=619107) +- [FIPS 140 Evaluation](https://go.microsoft.com/fwlink/p/?LinkId=619107) ## Related topics diff --git a/windows/plan/selecting-the-send-and-receive-status-for-an-application.md b/windows/plan/selecting-the-send-and-receive-status-for-an-application.md index 782d3c1651..3674f73b68 100644 --- a/windows/plan/selecting-the-send-and-receive-status-for-an-application.md +++ b/windows/plan/selecting-the-send-and-receive-status-for-an-application.md @@ -1,98 +1,5 @@ --- title: Selecting the Send and Receive Status for an Application (Windows 10) description: For each application listed in Application Compatibility Manager (ACM), you can select whether to send and receive specific application data through the Microsoft Compatibility Exchange. -ms.assetid: ae139093-27cf-4ad8-882d-e0509e78d33a -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Selecting the Send and Receive Status for an Application - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -For each application listed in Application Compatibility Manager (ACM), you can select whether to send and receive specific application data through the Microsoft Compatibility Exchange - -. For information about how to send and receive data, see [Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md). - -## Selecting the Send and Receive Status for an Application - - -**Note**   -The following example uses the **<Operating\_System> - Application Report** screen. You can alternatively use the **<Application\_Name>** dialog box. - -  - -**To change the send and receive status for an application** - -1. On the **<Operating\_System> - Application Report** screen, click the application name for which you want to select the send and receive status. - -2. On the **Actions** menu, click **Set Send and Receive Status**. - -3. Select one of the following: - - - **Do not send to Microsoft** - - - **Send to Microsoft** (default) - -4. Click **OK**. - -**To filter based on send and receive status** - -1. On the **<Operating\_System> - Application Report** screen, click **Toggle Filter**. - -2. In the **Query Builder**, enter your filter criteria, pressing the Tab key to add clauses. - - To delete a clause, right-click the row, and then click **Delete Clause**. - - The following example shows a query that filters for applications with a send and receive status of **Do not send to Microsoft**. - - - - - - - - - - - - - - - - - - - - - - - - -
    And/OrFieldOperatorValue

    And

    Send and Receive Status

    Equals

    Do not send to Microsoft

    - -   - -3. Click **Refresh**. - - Your filtered results appear. - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/selecting-your-compatibility-rating.md b/windows/plan/selecting-your-compatibility-rating.md index b7042d456d..e0b0defc6d 100644 --- a/windows/plan/selecting-your-compatibility-rating.md +++ b/windows/plan/selecting-your-compatibility-rating.md @@ -1,108 +1,5 @@ --- title: Selecting Your Compatibility Rating (Windows 10) description: You can rate the compatibility of your applications, installation packages, or websites, based on whether they run successfully on a 32-bit or 64-bit operating system. -ms.assetid: 959da499-8fd6-4f32-8771-a0580dd8e0d3 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Selecting Your Compatibility Rating - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can rate the compatibility of your applications, installation packages, or websites, based on whether they run successfully on a 32-bit or 64-bit operating system. Your rating applies to your entire organization and is based on your own testing results and organizational requirements. - -Possible ratings include: - -- **Works**. During your organization's testing phase, there were no issues with the application, installation package, or website. - -- **Works with minor issues or has solutions**. During your organization's testing phase, there were no Severity 1 or Severity 2 issues with the application, installation package, or website. For information about severity levels, see [Adding or Editing an Issue](adding-or-editing-an-issue.md). - -- **Does not work**. During your organization's testing phase, the application, installation package, or website experienced a Severity 1 or Severity 2 issue. - -- **No data**. You have no compatibility data to provide. - -## Selecting a Compatibility Rating - - -You can select your compatibility rating from the report screen or from the associated dialog box that shows report details. As an example, the following procedures use the **<Operating\_System> - Application Report** screen. You can alternatively use the **<Application\_Name>** dialog box. The procedure is the same on the report for websites. - -**To select your compatibility rating** - -1. On the **<Operating\_System> - Application Report** screen, click the application name. - -2. On the **Actions** menu, click **Set Assessment**. - -3. Choose your ratings. Select separate ratings for 32-bit operating systems and 64-bit operating systems, and then click **OK**. - - If your organization does not use a 32-bit operating system, or does not use a 64-bit operating system, you can hide the option in the **Customize Report Views** dialog box. If you hide the option, the associated column no longer appears in the **Set Assessment** dialog box. - -## Filtering By Your Compatibility Ratings - - -You can filter your applications, installation packages, or website data by your compatibility ratings. - -**To filter based on your compatibility ratings** - -1. On the **<Operating\_System> - Application Report** screen, click **Toggle Filter**. - -2. In the **Query Builder**, enter your filter criteria, pressing the Tab key to add additional clauses. - - For example, the following query will show applications with a rating of **Works** or a rating of **Works with minor issues or has solutions**. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    And/OrFieldOperatorValue

    And

    My Assessment

    Equals

    Works

    Or

    My Assessment

    Equals

    Works with minor issues or has solutions

    - -   - - To delete a clause, right-click the row, and then click **Delete Clause**. - -3. Click **Refresh**. - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/selecting-your-deployment-status.md b/windows/plan/selecting-your-deployment-status.md index 8cc4a070bc..61fdf90369 100644 --- a/windows/plan/selecting-your-deployment-status.md +++ b/windows/plan/selecting-your-deployment-status.md @@ -1,117 +1,5 @@ --- title: Selecting Your Deployment Status (Windows 10) description: In Application Compatibility Manager (ACM), you can track the deployment status of your applications and websites. -ms.assetid: 7735d256-77eb-4498-93aa-c838ee6e00fc -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Selecting Your Deployment Status - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -In Application Compatibility Manager (ACM), you can track the deployment status of your applications and websites. - -## Selecting Your Deployment Status - - -You can change the deployment status from both the report screen and the associated report dialog box. - -**Note**   -The following examples use the **<Operating\_System> - Application Report** screen. You can alternatively use the **<Application\_Name>** dialog box. The procedure is the same for setting deployment status on the report for websites. - -  - -**To change the deployment status of an application** - -1. On the **<Operating\_System> - Application Report** screen, click the application name. - -2. On the **Actions** menu, click **Set Deployment Status**. - -3. Select one of the following options: - - - **Not Reviewed** (default) - - - **Testing** - - - **Mitigating** - - - **Ready to Deploy** - - - **Will Not Deploy** - -4. Click **OK**. - -## Filtering By Deployment Status - - -You can filter your applications and websites by your deployment status. - -**To filter based on deployment status** - -1. On the **<Operating\_System> - Application Report** screen, click **Toggle Filter**. - - The **Query Builder** appears with a blank row. - -2. In the **Query Builder**, enter your filter criteria, pressing the Tab key to add clauses. - - For example, the following query filters for applications with a deployment status of **Mitigating** or **Ready to Deploy**. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    And/OrFieldOperatorValue

    And

    Deployment Status

    Equals

    Mitigating

    Or

    Deployment Status

    Equals

    Ready to Deploy

    - -   - - To delete a clause, right-click the row, and then click **Delete Clause**. - -3. Click **Refresh**. - - Your filtered results appear. - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/sending-and-receiving-compatibility-data.md b/windows/plan/sending-and-receiving-compatibility-data.md index 5a694085b2..fe2e0356a0 100644 --- a/windows/plan/sending-and-receiving-compatibility-data.md +++ b/windows/plan/sending-and-receiving-compatibility-data.md @@ -1,69 +1,5 @@ --- title: Sending and Receiving Compatibility Data (Windows 10) description: The Microsoft® Compatibility Exchange is a web service that propagates application compatibility issues between various data sources, for example Microsoft Corporation, independent software vendors (ISVs) and the ACT Community. -ms.assetid: b86d2431-1caa-4f95-baf9-52ff6af546cd -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Sending and Receiving Compatibility Data - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Microsoft® Compatibility Exchange is a web service that propagates application compatibility issues between various data sources, for example Microsoft Corporation, independent software vendors (ISVs) and the ACT Community. This process involves checking for updated compatibility information from Microsoft over the Internet. You can send and receive data to keep Application Compatibility Manager (ACM) updated with the latest compatibility information. - -The synchronization process includes only the changes made since the last synchronization. During the synchronization process, a dialog box displaying the synchronization status appears. You can continue to work during this process. If no new issues have occurred since your last synchronization, the Microsoft Compatibility Exchange uploads your issue information and notifies you that no updates exist. - -The synchronization process uses the Microsoft Compatibility Exchange to: - -- Download new information from Microsoft and ISVs, except for the applications for which you choose not to send application data to Microsoft. - -- Upload your compatibility issues to Microsoft. - -- Upload and download compatibility information from the ACT Community, if you are a member of the ACT Community and agree to share your data. For information about configuring your membership in the ACT Community, see [Settings Dialog Box - Preferences Tab](act-settings-dialog-box-preferences-tab.md). - -For information about which data is sent and received through the Microsoft Compatibility exchange, see [Data Sent Through the Microsoft Compatibility Exchange](data-sent-through-the-microsoft-compatibility-exchange.md). - -## Reviewing and Synchronizing Your Data - - -Prior to sending your application data to Microsoft, you can review your application list and view the exact data being sent as a text (.txt) file. After you are done reviewing the information, you can synchronize your data with Microsoft. - -**To review and synchronize your data** - -1. On the **Analyze** screen, click **Send and Receive**. - -2. Click **Review the data before sending**. - - The **Send and Receive Data** dialog box shows all of the application data that is to be sent to Microsoft during the synchronization process. To avoid sending application data for specific applications, see [Selecting the Send and Receive Status for an Application](selecting-the-send-and-receive-status-for-an-application.md). - -3. Optionally, click **Review all data**, save the resulting .txt file locally, and then review the exact XML data that will be sent to Microsoft. - -4. After you finish reviewing the application list and XML data, click **Send**. - -## Related topics - - -[Data Sent Through the Microsoft Compatibility Exchange](data-sent-through-the-microsoft-compatibility-exchange.md) - -[ACT Community Ratings and Process](act-community-ratings-and-process.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/settings-for-acm.md b/windows/plan/settings-for-acm.md index 6abb406ec3..fe209d179d 100644 --- a/windows/plan/settings-for-acm.md +++ b/windows/plan/settings-for-acm.md @@ -1,70 +1,5 @@ --- title: Settings for ACM (Windows 10) description: This section provides information about settings that you can configure in Application Compatibility Manager (ACM). -ms.assetid: e0126284-4348-4708-8976-a1e404f35971 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Settings for ACM - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides information about settings that you can configure in Application Compatibility Manager (ACM). - -## In this section - - - ---- - - - - - - - - - - - - - - - - -
    TopicDescription

    [Settings Dialog Box - Settings Tab](act-settings-dialog-box-settings-tab.md)

    To display the Settings dialog box, in Application Compatibility Manager (ACM), on the Tools menu, click Settings.

    [Settings Dialog Box - Preferences Tab](act-settings-dialog-box-preferences-tab.md)

    To display the Settings dialog box, in Application Compatibility Manager (ACM), on the Tools menu, click Settings.

    - -  - -## Related topics - - -[Configuring ACT](configuring-act.md) - -[ACT Database Configuration](act-database-configuration.md) - -[Troubleshooting ACT](troubleshooting-act.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/setup-and-deployment.md b/windows/plan/setup-and-deployment.md index 618c4b80a0..6705747d10 100644 --- a/windows/plan/setup-and-deployment.md +++ b/windows/plan/setup-and-deployment.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing, devices -author: TrudyHa +author: jdeckerMS --- # Setup and deployment @@ -87,7 +87,7 @@ Windows Update for Business allows administrators to control when upgrades and u   -Administrators can control deferral periods with Group Policy Objects by using the [Local Group Policy Editor (GPEdit)](http://go.microsoft.com/fwlink/p/?LinkId=734030) or, for domain joined systems, [Group Policy Management Console (GPMC)](http://go.microsoft.com/fwlink/p/?LinkId=699325). For additional details on Group Policy management see [Group Policy management for IT pros](http://go.microsoft.com/fwlink/p/?LinkId=699282). +Administrators can control deferral periods with Group Policy Objects by using the [Local Group Policy Editor (GPEdit)](https://go.microsoft.com/fwlink/p/?LinkId=734030) or, for domain joined systems, [Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=699325). For additional details on Group Policy management see [Group Policy management for IT pros](https://go.microsoft.com/fwlink/p/?LinkId=699282). **Set different deferrals based on update classification in GPedit.msc** ![figure 4](images/wuforbusiness-fig4-localpoleditor.png) ![figure 5](images/wuforbusiness-fig5-deferupgrade.png) @@ -157,7 +157,7 @@ Delivery Optimization configuration settings can be viewed by going to: Settings You can use Group Policy to configure Windows Update Delivery Optimization. To do this, use the following steps: -1. Download the [Administrative Templates (.admx) file for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=699283) from the Microsoft Download Center. +1. Download the [Administrative Templates (.admx) file for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=699283) from the Microsoft Download Center. 2. Copy the following files to the SYSVOL central store: - DeliveryOptimization.admx from C:\\Program Files (x86)\\Microsoft Group Policy\\Windows 10\\PolicyDefinitions - DeliveryOptimization.adml from C:\\Program Files (x86)\\Microsoft Group Policy\\Windows 10\\PolicyDefinitions\\en-US @@ -172,9 +172,9 @@ You can use Group Policy to configure Windows Update Delivery Optimization. To d Microsoft scanned this file for viruses, using the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to it. -For more information about Windows Update Delivery Optimization in Windows 10, see the [Windows Update Delivery Optimization FAQ](http://go.microsoft.com/fwlink/p/?LinkId=699284). +For more information about Windows Update Delivery Optimization in Windows 10, see the [Windows Update Delivery Optimization FAQ](https://go.microsoft.com/fwlink/p/?LinkId=699284). -For additional resources, see [How to use Group Policy to configure Windows Update Delivery Optimization in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=699288). +For additional resources, see [How to use Group Policy to configure Windows Update Delivery Optimization in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=699288). ## Related topics diff --git a/windows/plan/software-requirements-for-act.md b/windows/plan/software-requirements-for-act.md index 3564e2d753..d631eef7aa 100644 --- a/windows/plan/software-requirements-for-act.md +++ b/windows/plan/software-requirements-for-act.md @@ -1,86 +1,5 @@ --- title: Software Requirements for ACT (Windows 10) description: The Application Compatibility Toolkit (ACT) has the following software requirements. -ms.assetid: 9bbc21d4-f2ac-4a91-8add-017b1eacdeee -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Software Requirements for ACT - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Application Compatibility Toolkit (ACT) has the following software requirements. - -## Operating Systems - - -ACT can be installed on the following operating systems: - -- Windows 10 - -- Windows 8.1 - -- Windows 8 - -- Windows 7 - -- Windows Server 2012 - -- Windows Server 2008 R2 - -You can deploy inventory collector packages to all of the operating systems where you can install ACT. In addition, you can also deploy inventory collector packages to Windows Server 2008, Windows Vista, and Windows XP. - -**Note**   -As of Update 2, there is a known issue where the inventory collector package fails on Windows Vista. - -  - -## Database Components - - -ACT requires one of the following database components: - -- Microsoft® SQL Server® 2012 - -- Microsoft® SQL Server® 2008 R2 - -- SQL Server 2008 - -- SQL Server 2005 - -- SQL Server 2008 Express - -- SQL Server 2005 Express Edition - -## .NET Framework - - -ACT requires .NET Framework 4. - -## Related topics - - -[What's New in Act 6.1](whats-new-in-act-60.md) - -[Software Requirements for RAP](software-requirements-for-rap.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/software-requirements-for-rap.md b/windows/plan/software-requirements-for-rap.md index 07311438e4..b9914238fc 100644 --- a/windows/plan/software-requirements-for-rap.md +++ b/windows/plan/software-requirements-for-rap.md @@ -1,70 +1,5 @@ --- title: Software Requirements for RAP (Windows 10) description: The runtime-analysis package (RAP) has the following software requirements. -ms.assetid: 0163ce70-f5ba-400c-bdd5-a25511aac91f -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Software Requirements for RAP - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The runtime-analysis package (RAP) has the following software requirements. - -## Compatibility Monitor Supported Operating Systems - - -The Microsoft Compatibility Monitor tool is included in the runtime-analysis package. You can use the Compatibility Monitor on the following operating systems: - -- Windows 10 - -- Windows 8.1 - -- Windows 8 - -- Windows 7 - -## SUA Tool and Compatibility Administrator Supported Operating Systems - - -The Standard User Analyzer (SUA) tool and wizard and the Compatibility Administrator tool are included in the runtime-analysis package. You can use the tools on the following operating systems: - -- Windows 10 - -- Windows 8.1 - -- Windows 8 - -- Windows 7 - -- Windows Server 2012 - -- Windows Server 2008 R2 - -## Related topics - - -[What's New in Act 6.1](whats-new-in-act-60.md) - -[Software Requirements for ACT](software-requirements-for-act.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/sua-users-guide.md b/windows/plan/sua-users-guide.md index e0f2921b80..fff7a5757e 100644 --- a/windows/plan/sua-users-guide.md +++ b/windows/plan/sua-users-guide.md @@ -54,16 +54,6 @@ You can use SUA in either of the following ways: - -  - -## Related topics - - -[Deciding Whether to Fix an Application or Deploy a Workaround](deciding-whether-to-fix-an-application-or-deploy-a-workaround.md) - -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) -     diff --git a/windows/plan/taking-inventory-of-your-organization.md b/windows/plan/taking-inventory-of-your-organization.md index 07b40d240a..d199af1ab6 100644 --- a/windows/plan/taking-inventory-of-your-organization.md +++ b/windows/plan/taking-inventory-of-your-organization.md @@ -1,76 +1,5 @@ --- title: Taking Inventory of Your Organization (Windows 10) description: This section provides information about how to use the Application Compatibility Toolkit (ACT) to identify applications and devices that are installed in your organization. -ms.assetid: d52f138d-c6b2-4ab1-bb38-5b036311a51d -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Taking Inventory of Your Organization - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides information about how to use the Application Compatibility Toolkit (ACT) to identify applications and devices that are installed in your organization. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Identifying Computers for Inventory Collection](identifying-computers-for-inventory-collection.md)

    An inventory-collector package gathers inventory data from the computers on which it is installed. This data includes the following:

    [Creating an Inventory-Collector Package](creating-an-inventory-collector-package.md)

    You can use Application Compatibility Manager (ACM) to create an inventory-collector package. You can then deploy the inventory-collector package to other computers to gather inventory data. The package uploads inventory data to the Application Compatibility Toolkit (ACT) database.

    [Deploying an Inventory-Collector Package](deploying-an-inventory-collector-package.md)

    You can use the following methods to deploy an inventory-collector package to the destination computers:

    - -  - -## Related topics - - -[Testing Compatibility on the Target Platform](testing-compatibility-on-the-target-platform.md) - -[Managing Your Data-Collection Packages](managing-your-data-collection-packages.md) - -[Analyzing Your Compatibility Data](analyzing-your-compatibility-data.md) - -[Fixing Compatibility Issues](fixing-compatibility-issues.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/testing-compatibility-on-the-target-platform.md b/windows/plan/testing-compatibility-on-the-target-platform.md index 621a8bfeb2..9ba06e8cb3 100644 --- a/windows/plan/testing-compatibility-on-the-target-platform.md +++ b/windows/plan/testing-compatibility-on-the-target-platform.md @@ -1,84 +1,5 @@ --- title: Testing Compatibility on the Target Platform (Windows 10) description: This section provides information about setting up a test environment for compatibility testing, and about creating and deploying runtime-analysis packages to the test environment. -ms.assetid: 8f3e9d58-37c2-41ea-a216-32712baf6cf4 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Testing Compatibility on the Target Platform - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides information about setting up a test environment for compatibility testing, and about creating and deploying runtime-analysis packages to the test environment. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Deciding Which Applications to Test](deciding-which-applications-to-test.md)

    Before starting your compatibility testing on the version of Windows that you want to deploy, you can use the Application Compatibility Toolkit (ACT) to identify which applications should be the focus of your testing.

    [Creating an Enterprise Environment for Compatibility Testing](creating-an-enterprise-environment-for-compatibility-testing.md)

    The goal of the test environment is to model the operating system that you want to deploy and assess compatibility before deploying the operating system to your production environment. Your test environment is composed of computers on which the new operating system is installed. Your test environment can be a long-term investment. Consider retaining the test environment after deployment to assist in future deployment projects.

    [Creating a Runtime-Analysis Package](creating-a-runtime-analysis-package.md)

    In Application Compatibility Manager (ACM), you can create runtime-analysis packages, which you can then deploy to computers for compatibility testing in your test environment.

    [Deploying a Runtime-Analysis Package](deploying-a-runtime-analysis-package.md)

    When you deploy a runtime-analysis package, you are deploying it to your test environment for compatibility testing.

    [Compatibility Monitor User's Guide](compatibility-monitor-users-guide.md)

    Compatibility Monitor is a tool in the runtime analysis package that you can use to monitor applications for compatibility issues. You can also use the Compatibility Monitor tool to submit compatibility feedback.

    - -  - -## Related topics - - -[Taking Inventory of Your Organization](taking-inventory-of-your-organization.md) - -[Managing Your Data-Collection Packages](managing-your-data-collection-packages.md) - -[Analyzing Your Compatibility Data](analyzing-your-compatibility-data.md) - -[Fixing Compatibility Issues](fixing-compatibility-issues.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/testing-your-application-mitigation-packages.md b/windows/plan/testing-your-application-mitigation-packages.md index 669904c1e6..5fc970623c 100644 --- a/windows/plan/testing-your-application-mitigation-packages.md +++ b/windows/plan/testing-your-application-mitigation-packages.md @@ -84,15 +84,4 @@ At this point, you probably cannot resolve any unresolved application compatibil If your developers have insufficient resources to resolve the application compatibility issues, outsource the mitigation effort to another organization within your company. ## Related topics - - -[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) - -  - -  - - - - - +[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) \ No newline at end of file diff --git a/windows/plan/troubleshooting-act-database-issues.md b/windows/plan/troubleshooting-act-database-issues.md index ba1e7c4f7a..e0fb05fd2a 100644 --- a/windows/plan/troubleshooting-act-database-issues.md +++ b/windows/plan/troubleshooting-act-database-issues.md @@ -1,157 +1,5 @@ --- title: Troubleshooting ACT Database Issues (Windows 10) description: The following solutions may help you resolve issues that are related to your Microsoft® SQL Server® database for the Application Compatibility Toolkit (ACT). -ms.assetid: c36ab5d8-cc82-4681-808d-3d491551b75e -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Troubleshooting ACT Database Issues - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The following solutions may help you resolve issues that are related to your Microsoft® SQL Server® database for the Application Compatibility Toolkit (ACT). - -For information about how to set up the database, see [ACT Database Configuration](act-database-configuration.md). - -## Connecting to a SQL Server Database - - -When you attempt to connect to a SQL Server database, you may receive the following error message: - -The SQL Server you entered either does not exist or you do not have the required credentials for access. - -This error message indicates that the connection to the database is not valid. To investigate this error, do the following: - -1. Verify that the SQL Server database to which you are connecting is a valid database. - -2. Verify that you have read and write permissions to the database. If you do not have read and write permissions, contact your SQL Server administrator. For more information, see [Adding a Member to a SQL Server Database Role](http://go.microsoft.com/fwlink/p/?LinkId=64170). - -If you have read and write permissions to the database but cannot connect to it, you may be able to change the settings for your instance of SQL Server to resolve the issue. Namely, you can enable TCP/IP and firewall exceptions. - -**To enable TCP/IP and firewall exceptions for your instance of SQL Server** - -1. In a **Command Prompt** window, type the following command to stop your instance of SQL Server. - - ``` syntax - net stop - - ``` - - In the preceding command, *MSSQLSERVER* is the name of the instance of SQL Server. For SQL Server, the default name is MSSQLSERVER. For Microsoft SQL Server Express, the default name is MSSQL$SQLEXPRESS. - -2. Enable TCP/IP for your instance of SQL Server: - - 1. In the **Command Prompt** window, type `SQLServerManager.msc` - - 2. In SQL Server Configuration Manager, expand **SQL Server 2005 Network Configuration**, and then click **Protocols for MSSQLSERVER**. - - 3. Right-click **TCP/IP**, and then click **Enable**. - -3. Add firewall port exceptions for your instance of SQL Server: - - 1. In the **Command Prompt** window, type `firewall.cpl` - - 2. In the Windows® Firewall tool, click the **Exceptions** tab, and then click **Add Port**. - - 3. Add a firewall exception for TCP port 1433 (SQL Server) and for UDP port 1434 (SQL Server Browser), and then click **OK**. - - **Note**   - SQL Server Browser is the service that receives incoming SQL Server requests so that you can access the SQL Server Express database from a remote computer. By default, this service is disabled, which means that you can only access the database locally. If Application Compatibility Manager (ACM) or the ACT Log Processing Service is not installed on the same computer as the database, you must use the Services tool to manually start SQL Server Browser. - -   - -4. In the **Command Prompt** window, type `net start ` to start your instance of SQL Server, where *MSSQLSERVER* is the name of the instance. - -5. Type `sc config SQLBrowser start= auto` to change the configuration of SQL Server Browser. - -6. Type `net start SQLBrowser` to start SQL Server Browser. - -## Verifying SQL Server Version - - -If you attempt to connect to a SQL Server version that is not valid for ACT, you may receive the following error message: - -The SQL Server you are trying to connect to is not a supported version. Please check the Help documentation to find out about the supported versions of the SQL Server. - -To investigate this error, verify that ACT supports your version of SQL Server or SQL Server Express. For more information, see [Software Requirements for ACT](software-requirements-for-act.md). - -## Creating an ACT Database - - -You cannot create an ACT database by using ACM if you do not have database-creation permissions for the instance of SQL Server. To create the database, add the required permissions to the user account and then use ACM to create it. Alternatively, ask a SQL Server administrator to create the database. - -**To grant database-creation permissions to a user account** - -1. In SQL Server Management Studio, expand the **Security** folder, right-click **Logins**, and then click **New Logins**. - -2. On the **General** page, type the name of the user account that you will use to create the ACT database. - -3. Click **Server Roles**. - -4. Select the **sysadmin** or **dbcreator** check box, depending on your organization's policy. - -**To create an ACT database as a SQL Server administrator** - -1. Use SQL Server Management Studio to open and run the CreateDB.sql script against your instance of SQL Server. For information about the location of the CreateDB.sql file, see [ACT Database Configuration](act-database-configuration.md). - - - or - - - Use the OSQL tool, and run the command `osql -E -S -I CreateDB.sql` - -2. In ACM, in the **Settings** dialog box, update the **Database** box with the information for the newly created database. - - To use ACM with the ACT database, the user account must have read and write permissions to the database. - -## Granting ACT Database Permissions for the ACT Log Processing Service - - -The ACT Log Processing Service requires read and write access to the ACT database. - -**To grant permissions to the ACT database** - -1. In SQL Server Management Studio, expand the **Security** folder, right-click **Logins**, and then click **New Login**. - -2. Complete the following information on the **General** page: - - - **Login name**. Type the name of the account that requires permissions. If you are using the Local System account for the ACT Log Processing Service, provide access to the *<domain>*\\*<computer\_name>*$ account, where *<computer\_name>* is the name of the computer that is running the ACT Log Processing Service. - - - **Default database**. Select the ACT database to which your user account requires permissions. - -3. Click **User Mapping**. - -4. Select the check box next to your ACT database. - -5. Select the **db\_datareader** and **db\_datawriter** check boxes, and then click **OK**. - - **Important**   - If you continue to experience issues with the ACT Log Processing Service, even while you are using the Local System account, see [Troubleshooting Kerberos Delegation](http://go.microsoft.com/fwlink/p/?LinkId=65474). - -   - -## Related topics - - -[ACT Database Configuration](act-database-configuration.md) - -[Software Requirements for ACT](software-requirements-for-act.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/troubleshooting-act.md b/windows/plan/troubleshooting-act.md index 3de62348a2..1366988ae6 100644 --- a/windows/plan/troubleshooting-act.md +++ b/windows/plan/troubleshooting-act.md @@ -1,72 +1,5 @@ --- title: Troubleshooting ACT (Windows 10) description: This section provides troubleshooting information for the Application Compatibility Toolkit (ACT). -ms.assetid: 5696b0c0-5db5-4111-a1e1-825129e683d8 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Troubleshooting ACT - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides troubleshooting information for the Application Compatibility Toolkit (ACT). - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Troubleshooting the ACT Configuration Wizard](troubleshooting-the-act-configuration-wizard.md)

    When you start Application Compatibility Manager (ACM) for the first time, the Application Compatibility Toolkit (ACT) Configuration Wizard appears. The wizard helps you configure your ACT database, your shared folder for ACT log files, and your ACT Log Processing Service account.

    [Troubleshooting the ACT Log Processing Service](troubleshooting-the-act-log-processing-service.md)

    The following solutions may help you resolve issues that are related to the Application Compatibility Toolkit (ACT) Log Processing Service.

    [Troubleshooting ACT Database Issues](troubleshooting-act-database-issues.md)

    The following solutions may help you resolve issues that are related to your Microsoft® SQL Server® database for the Application Compatibility Toolkit (ACT).

    - -  - -## Related topics - - -[Using ACT](using-act.md) - -[ACT Product and Documentation Resources](act-product-and-documentation-resources.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/troubleshooting-the-act-configuration-wizard.md b/windows/plan/troubleshooting-the-act-configuration-wizard.md index 709b60fb6d..08200ff49f 100644 --- a/windows/plan/troubleshooting-the-act-configuration-wizard.md +++ b/windows/plan/troubleshooting-the-act-configuration-wizard.md @@ -1,76 +1,5 @@ --- title: Troubleshooting the ACT Configuration Wizard (Windows 10) description: When you start Application Compatibility Manager (ACM) for the first time, the Application Compatibility Toolkit (ACT) Configuration Wizard appears. -ms.assetid: f4f489c7-50b7-4b07-8b03-79777e1aaefd -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Troubleshooting the ACT Configuration Wizard - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -When you start Application Compatibility Manager (ACM) for the first time, the Application Compatibility Toolkit (ACT) Configuration Wizard appears. The wizard helps you configure your ACT database, your shared folder for ACT log files, and your ACT Log Processing Service account. - -## Selecting a Configuration for ACM - - -The **Enterprise configuration** option enables all ACT functionality. You must be an administrator on the local computer to select this option. - -The **View and manage reports only** option enables you to use ACM to create data-collection packages and analyze your data. You cannot access the ACT Log Processing Service. This option assumes that another computer in your organization is processing the logs and loading the compatibility data into the ACT database. - -## Configuring ACT Database Settings - - -To configure ACT database settings in the ACT Configuration Wizard, you must have read and write permissions to the ACT database. For more information, see [ACT Database Configuration](act-database-configuration.md). If you do not have the appropriate permissions, contact your Microsoft® SQL Server® administrator. For more information, see [Troubleshooting ACT Database Issues](troubleshooting-act-database-issues.md). - -## Configuring the ACT Log Processing Service - - -If you use the Local System account to run the ACT Log Processing Service, your user account must be an Administrator account. Your computer account *<domain>*\\*<computer>*$ must have read and write permissions to the ACT database. - -Your user account must also have **Log on as a service** permissions. For more information, see [Troubleshooting the ACT Log Processing Service](troubleshooting-the-act-log-processing-service.md). - -## Configuring the Share for the ACT Log Processing Service - - -For information about how to configure the share for the ACT Log Processing Service, see [ACT LPS Share Permissions](act-lps-share-permissions.md). - -## Changing Settings After You Finish the ACT Configuration Wizard - - -In the **Settings** dialog box in ACM, you can change some of the settings that you see in the ACT Configuration Wizard. You can also change other settings that are not available in the wizard. For more information, see [Settings for ACM](settings-for-acm.md). - -## Restarting the ACT Configuration Wizard - - -If you cancel the configuration process before you reach the final page of the ACT Configuration Wizard, your settings are deleted and the wizard restarts the next time that you start ACM. - -## Related topics - - -[Configuring ACT](configuring-act.md) - -[Using ACT](using-act.md) - -[Troubleshooting ACT](troubleshooting-act.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/troubleshooting-the-act-log-processing-service.md b/windows/plan/troubleshooting-the-act-log-processing-service.md index 0fff19e588..5f338b3141 100644 --- a/windows/plan/troubleshooting-the-act-log-processing-service.md +++ b/windows/plan/troubleshooting-the-act-log-processing-service.md @@ -1,103 +1,5 @@ --- title: Troubleshooting the ACT Log Processing Service (Windows 10) description: The following solutions may help you resolve issues that are related to the Application Compatibility Toolkit (ACT) Log Processing Service. -ms.assetid: cb6f90c2-9f7d-4a34-a91e-8ed55b8c256d -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Troubleshooting the ACT Log Processing Service - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The following solutions may help you resolve issues that are related to the Application Compatibility Toolkit (ACT) Log Processing Service. - -For information about how to set up permissions for the service, see [ACT LPS Share Permissions](act-lps-share-permissions.md). - -## Reviewing Files in ACT Log File Format - - -When you are reviewing log files for ACT, be aware that the log files are in Unicode format. - -## Uploading Files to the ACT Log Processing Service Share After Setting Permissions - - -If you cannot upload files to the ACT Log Processing Service share, you must first verify that the account permissions are set correctly for the share. For more information, see [ACT LPS Share Permissions](act-lps-share-permissions.md). - -If the computers from which you are collecting data and the ACT Log Processing Service share are on different domains, or if the computers are not domain members, you must take additional steps. For the **Anonymous** group, provide explicit write permissions to the ACT Log Processing Service share. Alternatively, you can provide similar permissions to the **Authenticated users** group if you do not want to enable anonymous access. For more information, see [Everyone Group Does Not Include Anonymous Security Identifier](http://go.microsoft.com/fwlink/p/?LinkId=79830). - -If you are collecting data from computers that are running Microsoft® Windows® 2000 and you are uploading your collected data to a different domain, you must also explicitly enable null session access for the ACT Log Processing Service share. - -## Working Around Windows Firewall on the Computer That Hosts the ACT Log Processing Service Share - - -If your organization has configured Windows Firewall on the computer that hosts your ACT Log Processing Service share, log files will not be copied to your share. To work around this issue, you can use one of the following methods: - -- Before you set up the ACT Log Processing Service share, turn off Windows Firewall on the computer that will host the share. - -- Continue to use Windows Firewall, but enable the **File Sharing** option. - -## Viewing and Assigning "Log on as a service" Permissions - - -Starting the ACT Log Processing Service requires either a Local System account or a user account. For a user account to start the ACT Log Processing Service and complete the ACT Configuration Wizard, the *<domain>*\\*<user>* account must have **Log on as a service** permissions. By default, these permissions are assigned to built-in computer accounts, such as the Local System account. - -**To add rights to a user account for logging on as a service** - -1. In Control Panel, double-click **Administrative Tools**, and then double-click **Local Security Policy**. - -2. Expand the **Local Policies** folder, and then click **User Rights Assignment**. - -3. Double-click the **Log on as a service** policy. - -4. Verify that your *<domain>*\\*<user>* account appears. If it does not appear, click **Add User or Group**. - -5. Add your user account information, click **OK**, and then click **OK** again. - -## Starting the ACT Log Processing Service - - -If the ACT Log Processing Service does not start and log files are not being processed, the reason may be one of the following: - -- **A conflict exists between ACT and the Microsoft® SQL Server® database.** If both ACT and the SQL Server database are on the same computer, the ACT Log Processing Service might have started before the SQL Server service. - -- **The ACT Log Processing Service does not have the correct permissions to the ACT database.** To investigate, see [Troubleshooting ACT Database Issues](troubleshooting-act-database-issues.md). - -- **The account type is incorrect for the account that is running the ACT Log Processing Service.** The ACT Log Processing Service account must be an Administrator account. - -**To manually restart the ACT Log Processing Service** - -1. In Control Panel, double-click **Administrative Tools**, and then double-click **Services**. - -2. Right-click **ACT Log Processing Service**, and then click **Restart**. - -3. In the event log, verify that no issues occurred when the service restarted. - -## Related topics - - -[Troubleshooting ACT Database Issues](troubleshooting-act-database-issues.md) - -[Configuring ACT](configuring-act.md) - -[Software Requirements for ACT](software-requirements-for-act.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/understanding-and-using-compatibility-fixes.md b/windows/plan/understanding-and-using-compatibility-fixes.md index 6c73a5645b..6ab830868c 100644 --- a/windows/plan/understanding-and-using-compatibility-fixes.md +++ b/windows/plan/understanding-and-using-compatibility-fixes.md @@ -93,15 +93,4 @@ Compatibility fixes are shipped as part of the Windows operating system and are You can apply the compatibility fixes to any of your applications. However, Microsoft does not provide the tools to use the Compatibility Fix infrastructure to create your own custom fixes. ## Related topics - - -[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) - -  - -  - - - - - +[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) \ No newline at end of file diff --git a/windows/plan/using-act.md b/windows/plan/using-act.md index 3793af0dd1..3e3ffff7d2 100644 --- a/windows/plan/using-act.md +++ b/windows/plan/using-act.md @@ -1,90 +1,5 @@ --- title: Using ACT (Windows 10) description: This section describes how to use the Application Compatibility Toolkit (ACT) in your organization. -ms.assetid: e6a68f44-7503-450d-a000-a04fbb93a146 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Using ACT - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section describes how to use the Application Compatibility Toolkit (ACT) in your organization. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Taking Inventory of Your Organization](taking-inventory-of-your-organization.md)

    This section provides information about how to use the Application Compatibility Toolkit (ACT) to identify applications and devices that are installed in your organization.

    [Testing Compatibility on the Target Platform](testing-compatibility-on-the-target-platform.md)

    This section provides information about setting up a test environment for compatibility testing, and about creating and deploying runtime-analysis packages to the test environment.

    [Managing Your Data-Collection Packages](managing-your-data-collection-packages.md)

    This section provides information about using Application Compatibility Manager (ACM) to manage your data-collection packages. Data-collection packages include inventory-collector packages and runtime-analysis packages. The following procedures apply to both package types.

    [Analyzing Your Compatibility Data](analyzing-your-compatibility-data.md)

    This section provides information about viewing and working with your compatibility data in Application Compatibility Manager (ACM).

    [Fixing Compatibility Issues](fixing-compatibility-issues.md)

    This section provides step-by-step instructions and describes development tools that you can use to help fix your compatibility issues.

    - -  - -## Related topics - - -[Welcome to ACT](welcome-to-act.md) - -[Configuring ACT](configuring-act.md) - -[Troubleshooting ACT](troubleshooting-act.md) - -[ACT User Interface Reference](act-user-interface-reference.md) - -[ACT Product and Documentation Resources](act-product-and-documentation-resources.md) - -[ACT Glossary](act-glossary.md) - -[Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/using-compatibility-monitor-to-send-feedback.md b/windows/plan/using-compatibility-monitor-to-send-feedback.md index 9a86a64d25..c5e20c52ba 100644 --- a/windows/plan/using-compatibility-monitor-to-send-feedback.md +++ b/windows/plan/using-compatibility-monitor-to-send-feedback.md @@ -1,84 +1,5 @@ --- title: Using Compatibility Monitor to Send Feedback (Windows 10) description: The Microsoft Compatibility Monitor tool is installed as part of the runtime-analysis package. -ms.assetid: dc59193e-7ff4-4950-8c20-e90c246e469d -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Using Compatibility Monitor to Send Feedback - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Microsoft Compatibility Monitor tool is installed as part of the runtime-analysis package. From the computers in your test environment, you can use Compatibility Monitor to submit compatibility information to the Application Compatibility Toolkit (ACT) database for your organization. - -**To automatically monitor applications on your computer for compatibility issues** - -1. Start the Compatibility Monitor tool. - -2. In Compatibility Monitor, click **Start Monitoring**. - -3. Leave Compatibility Monitor running, and use the applications that you want to test for compatibility issues. - - Compatibility information is automatically detected during monitoring, and is silently submitted to the ACT database at regular intervals. - -4. After you finish testing applications, click **Stop Monitoring** to stop the automatic monitoring and submission of compatibility information. - -**To submit your compatibility rating for an application** - -1. Start the Compatibility Monitor tool. - -2. In Compatibility Monitor, click **Give Compatibility Feedback**. - - You can enter and submit compatibility ratings whether monitoring is on or off. The process of submitting your compatibility feedback is entirely independent of the monitoring process. - -3. Find your application in the list, and then select your compatibility rating for the application. - - You can select ratings for one or more applications. - -4. Click **Submit** to submit your compatibility ratings to the ACT database. - - A copy of your ratings is kept on your computer so that you can review and modify the ratings later. - -**To submit a description of a compatibility issue for an application** - -1. Start the Compatibility Monitor tool. - -2. In Compatibility Monitor, click **Give Compatibility Feedback**. - -3. Find your application in the list, and then click the **Add Details** link. - -4. In the **Title** box, enter a title for the compatibility issue. The title is typically a phrase that briefly describes the issue. Check with others in your organization to verify your organization’s preferred style for issue titles. - -5. In the **Description** box, enter a description of the compatibility issue. - -6. Optionally, attach a screen shot or a step-by-step recording of the compatibility issue. - -7. Click **Submit** to submit your compatibility issue to the ACT database. - - After submitting your compatibility issue, you cannot edit it later. To submit further compatibility issues, you will need to submit a new issue. - -## Related topics - - -[Common Compatibility Issues](common-compatibility-issues.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/using-the-sdbinstexe-command-line-tool.md b/windows/plan/using-the-sdbinstexe-command-line-tool.md index fdd93bf2f3..301917b901 100644 --- a/windows/plan/using-the-sdbinstexe-command-line-tool.md +++ b/windows/plan/using-the-sdbinstexe-command-line-tool.md @@ -79,18 +79,5 @@ The following table describes the available command-line options. -  - ## Related topics - - -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - -  - -  - - - - - +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) \ No newline at end of file diff --git a/windows/plan/using-the-sua-tool.md b/windows/plan/using-the-sua-tool.md index c758d2f32d..df93b0550b 100644 --- a/windows/plan/using-the-sua-tool.md +++ b/windows/plan/using-the-sua-tool.md @@ -69,8 +69,6 @@ The following flowchart shows the process of using the SUA tool. The SUA tool generates a custom compatibility-fix database and automatically applies it to the local computer, so that you can test the fixes to see whether they worked. ## Related topics - - [Tabs on the SUA Tool Interface](tabs-on-the-sua-tool-interface.md) [Showing Messages Generated by the SUA Tool](showing-messages-generated-by-the-sua-tool.md) diff --git a/windows/plan/using-the-sua-wizard.md b/windows/plan/using-the-sua-wizard.md index a8f3b3ce03..17703c2eb7 100644 --- a/windows/plan/using-the-sua-wizard.md +++ b/windows/plan/using-the-sua-wizard.md @@ -73,8 +73,6 @@ The following flowchart shows the process of using the SUA Wizard. If the remedies do not fix the issue with the application, click **No** again, and the wizard may offer additional remedies. If the additional remedies do not fix the issue, the wizard informs you that there are no more remedies available. For information about how to run the SUA tool for additional investigation, see [Using the SUA Tool](using-the-sua-tool.md). ## Related topics - - [SUA User's Guide](sua-users-guide.md)   diff --git a/windows/plan/viewing-the-events-screen-in-compatibility-administrator.md b/windows/plan/viewing-the-events-screen-in-compatibility-administrator.md index 8c89db2a64..34186e3746 100644 --- a/windows/plan/viewing-the-events-screen-in-compatibility-administrator.md +++ b/windows/plan/viewing-the-events-screen-in-compatibility-administrator.md @@ -40,8 +40,6 @@ Compatibility Administrator enables you to copy your compatibility fixes from on If you open the **Events** screen and then perform the copy operation, you can see a description of the action, along with the time stamp, which enables you to view your fix information without confusion. ## Related topics - - [Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md) [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) diff --git a/windows/plan/viewing-your-compatibility-reports.md b/windows/plan/viewing-your-compatibility-reports.md index c0f5ffaae9..57ba7d07a9 100644 --- a/windows/plan/viewing-your-compatibility-reports.md +++ b/windows/plan/viewing-your-compatibility-reports.md @@ -1,86 +1,5 @@ --- title: Viewing Your Compatibility Reports (Windows 10) description: This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports. -ms.assetid: a28bbfbe-5f05-4a1e-9397-0a3ceb585871 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Viewing Your Compatibility Reports - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [<OperatingSystem> - Application Report](act-operatingsystem-application-report.md)

    This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports.

    [<OperatingSystem> - Computer Report](act-operatingsystem-computer-report.md)

    The <OperatingSystem> - Computer Report screen shows the following information for each computer in your organization:

    [<OperatingSystem> - Device Report](act-operatingsystem-device-report.md)

    The <OperatingSystem> - Device Report screen shows the following information for each device installed in your organization:

    [Internet Explorer - Web Site Report](internet-explorer-web-site-report.md)

    The Internet Explorer - Web Site Report screen shows the following information for each of the websites visited in your organization:

    [Saving, Opening, and Exporting Reports](saving-opening-and-exporting-reports.md)

    You can perform several common reporting tasks from the Analyze screen, including saving a compatibility report, opening a saved compatibility report (.adq) file, and exporting your report data to a spreadsheet (.xls) file.

    [Customizing Your Report Views](customizing-your-report-views.md)

    You can customize how you view your report data in Application Compatibility Manager (ACM).

    - -  - -## Related topics - - -[Organizing Your Compatibility Data](organizing-your-compatibility-data.md) - -[Filtering Your Compatibility Data](filtering-your-compatibility-data.md) - -[Sending and Receiving Compatibility Data](sending-and-receiving-compatibility-data.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/websiteurl-dialog-box.md b/windows/plan/websiteurl-dialog-box.md index f9f44433db..e07214a067 100644 --- a/windows/plan/websiteurl-dialog-box.md +++ b/windows/plan/websiteurl-dialog-box.md @@ -1,56 +1,5 @@ --- title: WebsiteURL Dialog Box (Windows 10) description: In Application Compatibility Manager (ACM), the websiteURL dialog box shows information about the selected website. -ms.assetid: 0dad26e1-4bba-4fef-b160-3fa1f4325da8 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# <WebsiteURL> Dialog Box - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -In Application Compatibility Manager (ACM), the *<websiteURL>* dialog box shows information about the selected website. - -**To open the <WebsiteURL> Dialog Box** - -1. In ACM, in the **Quick Reports** pane, click **Analyze**. - -2. Under the **Internet Explorer** heading, click **Web Sites**. - -3. Double-click the URL for a website. - -## Using the <WebsiteURL> Dialog Box - - -In the *<websiteURL>* dialog box, you can perform the following actions: - -- Select your compatibility rating for the website. For more information, see [Selecting Your Compatibility Rating](selecting-your-compatibility-rating.md). - -- Select your deployment status for the website. For more information, see [Selecting Your Deployment Status](selecting-your-deployment-status.md). - -- Assign categories and subcategories to the website. For more information, see [Categorizing Your Compatibility Data](categorizing-your-compatibility-data.md). - -- Specify the importance of the website to your organization. For more information, see [Prioritizing Your Compatibility Data](prioritizing-your-compatibility-data.md). - -- Add or edit an issue for the selected website, and add or edit a solution. For more information, see [Creating and Editing Issues and Solutions](creating-and-editing-issues-and-solutions.md). - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/welcome-to-act.md b/windows/plan/welcome-to-act.md index c6755be21e..b4ef6d3088 100644 --- a/windows/plan/welcome-to-act.md +++ b/windows/plan/welcome-to-act.md @@ -1,82 +1,5 @@ --- title: Welcome to ACT (Windows 10) description: The Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. -ms.assetid: 3963db88-83d2-4b9a-872e-31c275d1a321 -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# Welcome to ACT - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. With ACT, you can obtain compatibility information from Microsoft and software vendors, identify compatibility issues within your own organization, and share compatibility ratings with other ACT users. The tools in ACT help you analyze and mitigate compatibility issues before deploying a version of Windows to your organization. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [What's New in ACT 6.1](whats-new-in-act-60.md)

    Two major updates have been released since ACT 6.1. They are ACT 6.1 Update and ACT 6.1 Update 2. The following table lists changes made in the Application Compatibility Toolkit (ACT), which is included in the Windows Assessment and Deployment Kit (ADK) download.

    [Software Requirements for ACT](software-requirements-for-act.md)

    The Application Compatibility Toolkit (ACT) has the following software requirements.

    [Software Requirements for RAP](software-requirements-for-rap.md)

    The runtime-analysis package (RAP) has the following software requirements.

    - -  - -## Related topics - - -[Configuring ACT](configuring-act.md) - -[Using ACT](using-act.md) - -[Troubleshooting ACT](troubleshooting-act.md) - -[ACT User Interface Reference](act-user-interface-reference.md) - -[ACT Product and Documentation Resources](act-product-and-documentation-resources.md) - -[ACT Glossary](act-glossary.md) - -[Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/whats-new-in-act-60.md b/windows/plan/whats-new-in-act-60.md index b516ef3eae..89d6afdf1c 100644 --- a/windows/plan/whats-new-in-act-60.md +++ b/windows/plan/whats-new-in-act-60.md @@ -1,84 +1,5 @@ --- title: What's New in ACT 6.1 (Windows 10) description: Two major updates have been released since ACT 6.1. -ms.assetid: f12e137d-0b55-4f7d-88e0-149302655d9b -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -author: TrudyHa ---- - -# What's New in ACT 6.1 - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -Two major updates have been released since ACT 6.1. They are ACT 6.1 Update and ACT 6.1 Update 2. The following table lists changes made in the Application Compatibility Toolkit (ACT), which is included in the Windows Assessment and Deployment Kit (ADK) download. - - ---- - - - - - - - - - - - - - - -
    VersionChanges
    ACT 6.1 Update
      -
    • Support for Windows 10, including viewing Windows 10 reports on Application Compatibility Manager.
      • -
    • Bug fixes: this version of ACT fixed an issue where Inventory-Collector package would fail when it tried to inventory the system.
      • -
    ACT 6.1 Update 2

    Bug fixes: this version of ACT addresses the following bugs:

    -
      -

    • Capability to create custom compatibility fixes for Windows versions other than the currently running version.

      • -

    • Fixed issue where Inventory-Collector Package crashes when running on some Windows 7 x86 systems.

      • -

    • Fixed issue where not specifying a tag for Inventory-Collector Package would cause an error in the log processing service. The result of this bug was that data collected by the Package would not be processed.

      • -

    • Fixed issue where Standard User Analyzer (SUA) returns an error when trying to apply mitigations to an app on Windows 7.

      • -

    • Fixed issue where ACT is unable to create custom compatibility fixes for 32-bit systems correctly.

      • -
    - -  - -**Note**   -The version numbers for ACT 6.1 Update and Update 2 are identical, so you will need to look at the product ID of ACT to tell them apart. To find the product ID, open ACT, go to **Help** > **About**, and compare the product ID to the following list. - -- **ACT 6.1 Update**: B264FCCB-3F1F-828F-CCF8-EDB93E860970 - -- **ACT 6.1 Update 2**: B2BC4686-29A9-9E9D-F2E4-7E20659EECE7 - -If you run into any of the bugs fixed in Update 2, you likely have ACT 6.1 Update or older. Please download the latest version in the Windows ADK. - -  - -## Related topics - - -[Software Requirements for ACT](software-requirements-for-act.md) - -[Software Requirements for RAP](software-requirements-for-rap.md) - -  - -  - - - - - +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics +--- \ No newline at end of file diff --git a/windows/plan/windows-10-compatibility.md b/windows/plan/windows-10-compatibility.md index 7466117367..013a715282 100644 --- a/windows/plan/windows-10-compatibility.md +++ b/windows/plan/windows-10-compatibility.md @@ -6,6 +6,7 @@ keywords: deploy, upgrade, update, appcompat ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: appcompat +localizationpriority: high ms.sitesec: library author: mtniehaus --- @@ -19,13 +20,13 @@ author: mtniehaus Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. -For full system requirements, see [Windows 10 specifications](http://go.microsoft.com/fwlink/p/?LinkId=625077). Some driver updates may be required for Windows 10. +For full system requirements, see [Windows 10 specifications](https://go.microsoft.com/fwlink/p/?LinkId=625077). Some driver updates may be required for Windows 10. Existing desktop (Win32) application compatibility is also expected to be strong, with most existing applications working without any changes. Some applications that interface with Windows at a low level, those that use undocumented APIs, or those that do not follow recommended coding practices could experience issues. Existing Windows Store (WinRT) apps created for Windows 8 and Windows 8.1 should also continue to work, because compatibility can be validated against all the apps that have been submitted to the Windows Store. -For web apps and sites, modern HTML5-based sites should also have a high degree of compatibility and excellent performance through the new Microsoft Edge browser, while older web apps and sites can continue to use Internet Explorer 11 and the Enterprise Mode features that were first introduced in Windows 7 and Windows 8.1 and are still present in Windows 10. For more information about Internet Explorer and Enterprise Mode, see the [Internet Explorer 11 Deployment Guide for IT Pros.](http://go.microsoft.com/fwlink/p/?LinkId=734031) +For web apps and sites, modern HTML5-based sites should also have a high degree of compatibility and excellent performance through the new Microsoft Edge browser, while older web apps and sites can continue to use Internet Explorer 11 and the Enterprise Mode features that were first introduced in Windows 7 and Windows 8.1 and are still present in Windows 10. For more information about Internet Explorer and Enterprise Mode, see the [Internet Explorer 11 Deployment Guide for IT Pros.](https://go.microsoft.com/fwlink/p/?LinkId=734031) ## Recommended application testing process diff --git a/windows/plan/windows-10-deployment-considerations.md b/windows/plan/windows-10-deployment-considerations.md index cefe2e8c90..9c2cb27ef4 100644 --- a/windows/plan/windows-10-deployment-considerations.md +++ b/windows/plan/windows-10-deployment-considerations.md @@ -4,6 +4,7 @@ description: There are new deployment options in Windows 10 that help you simpl ms.assetid: A8DD6B37-1E11-4CD6-B588-92C2404219FE keywords: deploy, upgrade, update, in-place ms.prod: w10 +localizationpriority: high ms.mktglfcycl: plan ms.sitesec: library author: mtniehaus @@ -80,7 +81,7 @@ Note that the original Windows 8 release is only supported until January 2016. For existing Windows PCs running Windows Vista, you can perform wipe-and-load (OS refresh) deployments when you use compatible hardware. -Note that to take advantage of the limited-time free upgrade offer for PCs running Windows 7, Windows 8, or Windows 8.1, you must leverage an in-place upgrade, either from Windows Update or by using the upgrade media available from the [Windows 10 software download page](http://go.microsoft.com/fwlink/p/?LinkId=625073) to acquire a new Windows 10 license from the Windows Store. For more information, refer to the [Windows 10 FAQ](http://go.microsoft.com/fwlink/p/?LinkId=625074). +Note that to take advantage of the limited-time free upgrade offer for PCs running Windows 7, Windows 8, or Windows 8.1, you must leverage an in-place upgrade, either from Windows Update or by using the upgrade media available from the [Windows 10 software download page](https://go.microsoft.com/fwlink/p/?LinkId=625073) to acquire a new Windows 10 license from the Windows Store. For more information, refer to the [Windows 10 FAQ](https://go.microsoft.com/fwlink/p/?LinkId=625074). For organizations with Software Assurance for Windows, both in-place upgrade or wipe-and-load can be leveraged (with in-place upgrade being the preferred method, as previously discussed). @@ -91,9 +92,9 @@ For organizations that do not take advantage of the free upgrade offer and are n For new computers acquired with Windows 10 preinstalled, you can leverage dynamic provisioning scenarios to transform the device from its initial state into a fully-configured organization PC. There are two primary dynamic provisioning scenarios you can use: -- **User-driven, from the cloud.** By joining a device into Azure Active Directory and leveraging the automatic mobile device management (MDM) provisioning capabilities at the same time, an end user can initiate the provisioning process themselves just by entering the Azure Active Directory account and password (called their “work or school account” within Windows 10). The MDM service can then transform the device into a fully-configured organization PC. For more information, see [Azure Active Directory integration with MDM](http://go.microsoft.com/fwlink/p/?LinkId=625075). +- **User-driven, from the cloud.** By joining a device into Azure Active Directory and leveraging the automatic mobile device management (MDM) provisioning capabilities at the same time, an end user can initiate the provisioning process themselves just by entering the Azure Active Directory account and password (called their “work or school account” within Windows 10). The MDM service can then transform the device into a fully-configured organization PC. For more information, see [Azure Active Directory integration with MDM](https://go.microsoft.com/fwlink/p/?LinkId=625075). -- **IT admin-driven, using new tools.** Using the new Windows Imaging and Configuration Designer (ICD) tool, IT administrators can create provisioning packages that can be applied to a computer to transform it into a fully-configured organization PC. For more information, see [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=625076). +- **IT admin-driven, using new tools.** Using the new Windows Imaging and Configuration Designer (ICD) tool, IT administrators can create provisioning packages that can be applied to a computer to transform it into a fully-configured organization PC. For more information, see [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=625076). In either of these scenarios, you can make a variety of configuration changes to the PC: diff --git a/windows/plan/windows-10-infrastructure-requirements.md b/windows/plan/windows-10-infrastructure-requirements.md index f8a5b10095..be533cabf2 100644 --- a/windows/plan/windows-10-infrastructure-requirements.md +++ b/windows/plan/windows-10-infrastructure-requirements.md @@ -5,6 +5,7 @@ ms.assetid: B0FA27D9-A206-4E35-9AE6-74E70748BE64 keywords: deploy, upgrade, update, hardware ms.prod: w10 ms.mktglfcycl: plan +localizationpriority: high ms.sitesec: library author: mtniehaus --- @@ -28,11 +29,11 @@ For persistent VDI environments, carefully consider the I/O impact from upgradin ## Deployment tools -A new version of the Assessment and Deployment Toolkit (ADK) has been released to support Windows 10. This new version, available for download [here](http://go.microsoft.com/fwlink/p/?LinkId=526740), is required for Windows 10; you should not use earlier versions of the ADK to deploy Windows 10. It also supports the deployment of Windows 7, Windows 8, and Windows 8.1. +A new version of the Assessment and Deployment Toolkit (ADK) has been released to support Windows 10. This new version, available for download [here](https://go.microsoft.com/fwlink/p/?LinkId=526740), is required for Windows 10; you should not use earlier versions of the ADK to deploy Windows 10. It also supports the deployment of Windows 7, Windows 8, and Windows 8.1. Significant enhancements in the ADK for Windows 10 include new runtime provisioning capabilities, which leverage the Windows Imaging and Configuration Designer (Windows ICD), as well as updated versions of existing deployment tools (DISM, USMT, Windows PE, and more). -Microsoft Deployment Toolkit 2013 Update 1, available for download [here](http://go.microsoft.com/fwlink/p/?LinkId=625079), has also been updated to support Windows 10 and the new ADK; older versions do not support Windows 10. New in this release is task sequence support for Windows 10 in-place upgrades. +Microsoft Deployment Toolkit 2013 Update 1, available for download [here](https://go.microsoft.com/fwlink/p/?LinkId=625079), has also been updated to support Windows 10 and the new ADK; older versions do not support Windows 10. New in this release is task sequence support for Windows 10 in-place upgrades. For System Center Configuration Manager, Windows 10 support is offered with various releases: @@ -49,7 +50,7 @@ For more details about System Center Configuration Manager support for Windows  ## Management tools -In addition to System Center Configuration Manager, Windows 10 also leverages other tools for management. For Windows Server and Active Directory, existing supported versions are fully supported for Windows 10. New Group Policy templates will be needed to configure new settings available in Windows 10; these templates are available in the Windows 10 media images, and are available as a separate download [here](http://go.microsoft.com/fwlink/p/?LinkId=625081). See [Group Policy settings reference](http://go.microsoft.com/fwlink/p/?LinkId=625082) for a list of the new and modified policy settings. If you are using a central policy store, follow the steps outlined [here](http://go.microsoft.com/fwlink/p/?LinkId=625083) to update the ADMX files stored in that central store. +In addition to System Center Configuration Manager, Windows 10 also leverages other tools for management. For Windows Server and Active Directory, existing supported versions are fully supported for Windows 10. New Group Policy templates will be needed to configure new settings available in Windows 10; these templates are available in the Windows 10 media images, and are available as a separate download [here](https://go.microsoft.com/fwlink/p/?LinkId=625081). See [Group Policy settings reference](https://go.microsoft.com/fwlink/p/?LinkId=625082) for a list of the new and modified policy settings. If you are using a central policy store, follow the steps outlined [here](https://go.microsoft.com/fwlink/p/?LinkId=625083) to update the ADMX files stored in that central store. No new Active Directory schema updates or specific functional levels are currently required for core Windows 10 product functionality, although subsequent upgrades could require these to support new features. @@ -65,9 +66,9 @@ Microsoft Desktop Optimization Pack (MDOP) has been updated to support Windows    -For more information, see the [MDOP TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=625090). +For more information, see the [MDOP TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=625090). -For devices you manage with mobile device management (MDM) solutions such as Microsoft Intune, existing capabilities (provided initially in Windows 8.1) are fully supported in Windows 10; new Windows 10 MDM settings and capabilities will require updates to the MDM services. See [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=625084) for more information. +For devices you manage with mobile device management (MDM) solutions such as Microsoft Intune, existing capabilities (provided initially in Windows 8.1) are fully supported in Windows 10; new Windows 10 MDM settings and capabilities will require updates to the MDM services. See [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=625084) for more information. Windows Server Update Services (WSUS) requires some additional configuration to receive updates for Windows 10. Use the Windows Server Update Services admin tool and follow these instructions: @@ -81,7 +82,7 @@ Windows Server Update Services (WSUS) requires some additional configuration to Figure 1. WSUS product list with Windows 10 choices -Because Windows 10 updates are cumulative in nature, each month’s new update will supersede the previous month's. Consider leveraging “express installation” packages to reduce the size of the payload that needs to be sent to each PC each month; see [Express installation files](http://go.microsoft.com/fwlink/p/?LinkId=625086) for more information. (Note that this will increase the amount of disk storage needed by WSUS, and impacts all operating systems being managed with WSUS.) +Because Windows 10 updates are cumulative in nature, each month’s new update will supersede the previous month's. Consider leveraging “express installation” packages to reduce the size of the payload that needs to be sent to each PC each month; see [Express installation files](https://go.microsoft.com/fwlink/p/?LinkId=625086) for more information. (Note that this will increase the amount of disk storage needed by WSUS, and impacts all operating systems being managed with WSUS.) ## Activation @@ -91,15 +92,15 @@ Windows 10 volume license editions of Windows 10 will continue to support all | Product | Required update | |----------------------------------------|---------------------------------------------------------------------------------------------| | Windows 10 | None | -| Windows Server 2012 R2 and Windows 8.1 | [https://support.microsoft.com/kb/3058168](http://go.microsoft.com/fwlink/p/?LinkId=625087) | -| Windows Server 2012 and Windows 8 | [https://support.microsoft.com/kb/3058168](http://go.microsoft.com/fwlink/p/?LinkId=625087) | +| Windows Server 2012 R2 and Windows 8.1 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | +| Windows Server 2012 and Windows 8 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | | Windows Server 2008 R2 and Windows 7 | Available by October 2015 |   Additionally, new product keys will be needed for all types of volume license activation (KMS, MAK, and AD-based Activation); these keys are available on the Volume Licensing Service Center (VLSC) for customers with rights to the Windows 10 operating system. To find the needed keys: -- Sign into the [Volume Licensing Service Center (VLSC)](http://go.microsoft.com/fwlink/p/?LinkId=625088) at with a Microsoft account that has appropriate rights. +- Sign into the [Volume Licensing Service Center (VLSC)](https://go.microsoft.com/fwlink/p/?LinkId=625088) at with a Microsoft account that has appropriate rights. - For KMS keys, click **Licenses** and then select **Relationship Summary**. Click the appropriate active license ID, and then select **Product Keys** near the right side of the page. For KMS running on Windows Server, find the **Windows Srv 2012R2 DataCtr/Std KMS for Windows 10** product key; for KMS running on client operating systems, find the **Windows 10** product key. diff --git a/windows/plan/windows-10-servicing-options.md b/windows/plan/windows-10-servicing-options.md index 6ac55f7ffc..83af9a41f3 100644 --- a/windows/plan/windows-10-servicing-options.md +++ b/windows/plan/windows-10-servicing-options.md @@ -1,5 +1,5 @@ --- -title: Windows 10 servicing options (Windows 10) +title: Windows 10 servicing overview (Windows 10) description: Windows 10 provides a new model for organizations to deploy and upgrade Windows by providing updates to features and capabilities through a continual process. ms.assetid: 6EF0792C-B587-497D-8489-4A7F5848D92A keywords: deploy, upgrade, update, servicing @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: servicing ms.sitesec: library -author: greg-lindsay +author: jdeckerMS --- # Windows 10 servicing overview @@ -72,6 +72,7 @@ Windows 10 enables organizations to fulfill the desire to provide users with the ## Related topics +[Windows 10 release information](https://technet.microsoft.com/windows/release-info)
    [Windows 10 deployment considerations](windows-10-deployment-considerations.md)
    [Windows 10 compatibility](windows-10-compatibility.md)
    [Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) \ No newline at end of file diff --git a/windows/plan/windows-to-go-frequently-asked-questions.md b/windows/plan/windows-to-go-frequently-asked-questions.md index a9f0dfee6c..8170500400 100644 --- a/windows/plan/windows-to-go-frequently-asked-questions.md +++ b/windows/plan/windows-to-go-frequently-asked-questions.md @@ -127,7 +127,7 @@ Windows To Go can be deployed using standard Windows deployment tools like Diskp - A Windows 10 Enterprise or Windows 10 Education host PC that can be used to provision new USB keys -You can use a Windows PowerShell script to target several drives and scale your deployment for a large number of Windows To Go drives. You can also use a USB duplicator to duplicate a Windows To Go drive after it has been provisioned if you are creating a large number of drives. See the [Windows To Go Step by Step](http://go.microsoft.com/fwlink/p/?LinkId=618950) article on the TechNet wiki for a walkthrough of the drive creation process. +You can use a Windows PowerShell script to target several drives and scale your deployment for a large number of Windows To Go drives. You can also use a USB duplicator to duplicate a Windows To Go drive after it has been provisioned if you are creating a large number of drives. See the [Windows To Go Step by Step](https://go.microsoft.com/fwlink/p/?LinkId=618950) article on the TechNet wiki for a walkthrough of the drive creation process. ## Is Windows To Go supported on both USB 2.0 and USB 3.0 drives? @@ -152,7 +152,7 @@ Yes. Because USB 3.0 offers significantly faster speeds than USB 2.0, a Windows ## Can the user self-provision Windows To Go? -Yes, if the user has administrator permissions they can self-provision a Windows To Go drive using the Windows To Go Creator wizard which is included in Windows 10 Enterprise and Windows 10 Education. Additionally, System Center 2012 Configuration Manager SP1 and later releases includes support for user self-provisioning of Windows To Go drives. Configuration Manager can be downloaded for evaluation from the [Microsoft TechNet Evaluation Center](http://go.microsoft.com/fwlink/p/?LinkID=618746). +Yes, if the user has administrator permissions they can self-provision a Windows To Go drive using the Windows To Go Creator wizard which is included in Windows 10 Enterprise and Windows 10 Education. Additionally, System Center 2012 Configuration Manager SP1 and later releases includes support for user self-provisioning of Windows To Go drives. Configuration Manager can be downloaded for evaluation from the [Microsoft TechNet Evaluation Center](https://go.microsoft.com/fwlink/p/?LinkID=618746). ## How can Windows To Go be managed in an organization? @@ -186,7 +186,7 @@ After you have entered firmware setup, make sure that boot from USB is enabled. Alternatively, if your computer supports it, you can try to use the one-time boot menu (often F12), to select USB boot on a per-boot basis. -For more detailed instructions, see the wiki article, [Tips for configuring your BIOS settings to work with Windows To Go](http://go.microsoft.com/fwlink/p/?LinkID=618951). +For more detailed instructions, see the wiki article, [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). **Warning**   Configuring a computer to boot from USB will cause your computer to attempt to boot from any bootable USB device connected to your computer. This potentially includes malicious devices. Users should be informed of this risk and instructed to not have any bootable USB storage devices plugged in to their computers except for their Windows To Go drive. @@ -312,7 +312,7 @@ The size constraints are the same as full Windows. To ensure that you have enoug ## Do I need to activate Windows To Go every time I roam? -No, Windows To Go requires volume activation; either using the [Key Management Service](http://go.microsoft.com/fwlink/p/?LinkId=619051) (KMS) server in your organization or using [Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=619053) based volume activation. The Windows To Go workspace will not need to be reactivated every time you roam. KMS activates Windows on a local network, eliminating the need for individual computers to connect to Microsoft. To remain activated, KMS client computers must renew their activation by connecting to the KMS host on periodic basis. This typically occurs as soon as the user has access to the corporate network (either through a direct connection on-premises or a through remote connection using DirectAccess or a virtual private network connection), once activated the machine will not need to be activated again until the activation validity interval has passed. In a KMS configuration the activation validity interval is 180 days. +No, Windows To Go requires volume activation; either using the [Key Management Service](https://go.microsoft.com/fwlink/p/?LinkId=619051) (KMS) server in your organization or using [Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=619053) based volume activation. The Windows To Go workspace will not need to be reactivated every time you roam. KMS activates Windows on a local network, eliminating the need for individual computers to connect to Microsoft. To remain activated, KMS client computers must renew their activation by connecting to the KMS host on periodic basis. This typically occurs as soon as the user has access to the corporate network (either through a direct connection on-premises or a through remote connection using DirectAccess or a virtual private network connection), once activated the machine will not need to be activated again until the activation validity interval has passed. In a KMS configuration the activation validity interval is 180 days. ## Can I use all Windows features on Windows To Go? @@ -346,12 +346,12 @@ Yes. You can use a combination of identifiers to determine if the currently runn Next, check if the **OperatingSystemSKU** property is equal to **4** (for Windows 10 Enterprise) or **121** (for Windows 10 Education). The combination of those two properties represents a Windows To Go workspace environment. -For more information, see the MSDN article on the [Win32\_OperatingSystem class](http://go.microsoft.com/fwlink/p/?LinkId=619059). +For more information, see the MSDN article on the [Win32\_OperatingSystem class](https://go.microsoft.com/fwlink/p/?LinkId=619059). ## How is Windows To Go licensed? -Windows To Go allows organization to support the use of privately owned PCs at the home or office with more secure access to their organizational resources. With Windows To Go use rights under [Software Assurance](http://go.microsoft.com/fwlink/p/?LinkId=619062), an employee will be able to use Windows To Go on any company PC licensed with Software Assurance as well as from their home PC. +Windows To Go allows organization to support the use of privately owned PCs at the home or office with more secure access to their organizational resources. With Windows To Go use rights under [Software Assurance](https://go.microsoft.com/fwlink/p/?LinkId=619062), an employee will be able to use Windows To Go on any company PC licensed with Software Assurance as well as from their home PC. ## Does Windows Recovery Environment work with Windows To Go? What’s the guidance for recovering a Windows To Go drive? @@ -383,7 +383,7 @@ You can reset the BitLocker system measurements to incorporate the new boot orde A message is displayed, informing you that your data will not be protected while BitLocker is suspended and asking if you want to suspend BitLocker Drive Encryption. Click **Yes** to continue and suspend BitLocker on the drive. -4. Restart the computer and enter the firmware settings to reset the boot order to boot from USB first. For more information on changing the boot order in the BIOS, see [Tips for configuring your BIOS settings to work with Windows To Go](http://go.microsoft.com/fwlink/p/?LinkId=618951) on the TechNet wiki. +4. Restart the computer and enter the firmware settings to reset the boot order to boot from USB first. For more information on changing the boot order in the BIOS, see [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) on the TechNet wiki. 5. Restart the computer again and then log on to the host computer using an account with administrator privileges. (Neither your Windows To Go drive nor any other USB drive should be inserted.) @@ -410,7 +410,7 @@ Reformatting the drive erases the data on the drive, but doesn’t reconfigure t   -2. Start the [diskpart](http://go.microsoft.com/fwlink/p/?LinkId=619070) command interpreter, by typing `diskpart` at the command prompt. +2. Start the [diskpart](https://go.microsoft.com/fwlink/p/?LinkId=619070) command interpreter, by typing `diskpart` at the command prompt. 3. Use the `select disk` command to identify the drive. If you do not know the drive number, use the `list` command to display the list of disks available. @@ -433,9 +433,9 @@ There is no support in Windows for upgrading a Windows To Go drive. Deployed Win ## Additional resources -- [Windows 10 forums](http://go.microsoft.com/fwlink/p/?LinkId=618949) +- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) -- [Windows To Go Step by Step Wiki](http://go.microsoft.com/fwlink/p/?LinkId=618950) +- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) - [Windows To Go: feature overview](windows-to-go-overview.md) diff --git a/windows/plan/windows-to-go-overview.md b/windows/plan/windows-to-go-overview.md index f00dfb55ea..4b1d981e94 100644 --- a/windows/plan/windows-to-go-overview.md +++ b/windows/plan/windows-to-go-overview.md @@ -19,7 +19,7 @@ author: mtniehaus Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. -PCs that meet the Windows 7 or later [certification requirements](http://go.microsoft.com/fwlink/p/?LinkId=618711) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go is not intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some additional considerations that you should keep in mind before you start to use Windows To Go: +PCs that meet the Windows 7 or later [certification requirements](https://go.microsoft.com/fwlink/p/?LinkId=618711) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go is not intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some additional considerations that you should keep in mind before you start to use Windows To Go: - [Differences between Windows To Go and a typical installation of Windows](#bkmk-wtgdif) @@ -63,7 +63,7 @@ The applications that you want to use from the Windows To Go workspace should be Enterprises install Windows on a large group of computers either by using configuration management software (such as System Center Configuration Manager), or by using standard Windows deployment tools such as DiskPart and the Deployment Image Servicing and Management (DISM) tool. -These same tools can be used to provision Windows To Go drive, just as you would if you were planning for provisioning a new class of mobile PCs. You can use the [Windows Assessment and Deployment Kit](http://go.microsoft.com/fwlink/p/?LinkId=526803) to review deployment tools available. +These same tools can be used to provision Windows To Go drive, just as you would if you were planning for provisioning a new class of mobile PCs. You can use the [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) to review deployment tools available. **Important**   Make sure you use the versions of the deployment tools provided for the version of Windows you are deploying. There have been many enhancements made to support Windows To Go. Using versions of the deployment tools released for earlier versions of Windows to provision a Windows To Go drive is not supported. @@ -104,26 +104,26 @@ Using a USB drive that has not been certified is not supported   -- IronKey Workspace W700 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w700.html](http://go.microsoft.com/fwlink/p/?LinkId=618714)) +- IronKey Workspace W700 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w700.html](https://go.microsoft.com/fwlink/p/?LinkId=618714)) -- IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](http://go.microsoft.com/fwlink/p/?LinkId=618717)) +- IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](https://go.microsoft.com/fwlink/p/?LinkId=618717)) -- IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](http://go.microsoft.com/fwlink/p/?LinkId=618718)) +- IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](https://go.microsoft.com/fwlink/p/?LinkId=618718)) -- Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](http://go.microsoft.com/fwlink/p/?LinkId=618719)) +- Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618719)) -- Spyrus Portable Workplace ([http://www.spyruswtg.com/](http://go.microsoft.com/fwlink/p/?LinkId=618720)) +- Spyrus Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) We recommend that you run the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Portable Workplace. -- Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](http://go.microsoft.com/fwlink/p/?LinkId=618720)) +- Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) **Important**   - You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go please refer to [http://www.spyruswtg.com/](http://go.microsoft.com/fwlink/p/?LinkId=618720). + You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go please refer to [http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720).   -- Spyrus Worksafe ([http://www.spyruswtg.com/](http://go.microsoft.com/fwlink/p/?LinkId=618720)) +- Spyrus Worksafe ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) **Tip**   This device contains an embedded smart card. @@ -136,11 +136,11 @@ Using a USB drive that has not been certified is not supported Super Talent Express RC8 for Windows To Go - ([http://www.supertalent.com/wtg/](http://go.microsoft.com/fwlink/p/?LinkId=618721)) + ([http://www.supertalent.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618721)) -- Western Digital My Passport Enterprise ([http://www.wd.com/wtg](http://go.microsoft.com/fwlink/p/?LinkId=618722)) +- Western Digital My Passport Enterprise ([http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722)) - We recommend that you run the WD Compass utility to prepare the Western Digital My Passport Enterprise drive for provisioning with Windows To Go.  For more information about the WD Compass utility please refer to [http://www.wd.com/wtg](http://go.microsoft.com/fwlink/p/?LinkId=618722) + We recommend that you run the WD Compass utility to prepare the Western Digital My Passport Enterprise drive for provisioning with Windows To Go.  For more information about the WD Compass utility please refer to [http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722) **For host computers** @@ -249,16 +249,16 @@ In addition to the USB boot support in the BIOS, the Windows 10 image on your W ## Additional resources -- [Windows 10 forums](http://go.microsoft.com/fwlink/p/?LinkId=618949) +- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) -- [Windows To Go Step by Step Wiki](http://go.microsoft.com/fwlink/p/?LinkId=618950) +- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) -- [Tips for configuring your BIOS settings to work with Windows To Go](http://go.microsoft.com/fwlink/p/?LinkId=618951) +- [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) ## Related topics -- [Deploy Windows To Go in your organization](http://go.microsoft.com/fwlink/p/?LinkId=619975) +- [Deploy Windows To Go in your organization](https://go.microsoft.com/fwlink/p/?LinkId=619975) - [Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) diff --git a/windows/plan/windows-update-for-business.md b/windows/plan/windows-update-for-business.md index 67c4200203..93dcee04ac 100644 --- a/windows/plan/windows-update-for-business.md +++ b/windows/plan/windows-update-for-business.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing; devices -author: TrudyHa +author: jdeckerMS --- # Windows Update for Business @@ -19,12 +19,12 @@ Get an overview of how you can implement and deploy a Windows Update for Busines ## Introduction -Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. By using [Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: +Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. By using [Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: - **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). - **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient. -- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=699281). +- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](https://go.microsoft.com/fwlink/p/?LinkId=699281). -Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](http://go.microsoft.com/fwlink/p/?LinkId=734043) and [System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=734044). +Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](https://go.microsoft.com/fwlink/p/?LinkId=734043) and [System Center Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=734044). ## Deploy Windows Update for Business in your organization diff --git a/windows/whats-new/applocker.md b/windows/whats-new/applocker.md index eded8c7862..2e082cd98c 100644 --- a/windows/whats-new/applocker.md +++ b/windows/whats-new/applocker.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft -redirect_url: whats-new-windows-10-version-1507-and-1511.md +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in AppLocker? diff --git a/windows/whats-new/bitlocker.md b/windows/whats-new/bitlocker.md index 0176decb20..9f0df242bf 100644 --- a/windows/whats-new/bitlocker.md +++ b/windows/whats-new/bitlocker.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security, mobile author: brianlic-msft -redirect_url: whats-new-windows-10-version-1507-and-1511.md +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in BitLocker? diff --git a/windows/whats-new/change-history-for-what-s-new-in-windows-10.md b/windows/whats-new/change-history-for-what-s-new-in-windows-10.md index 750a878d7d..a38cbf4702 100644 --- a/windows/whats-new/change-history-for-what-s-new-in-windows-10.md +++ b/windows/whats-new/change-history-for-what-s-new-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: TrudyHa +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/whats-new/index --- # Change history for What's new in Windows 10 diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md new file mode 100644 index 0000000000..df040f8573 --- /dev/null +++ b/windows/whats-new/contribute-to-a-topic.md @@ -0,0 +1,71 @@ +--- +title: Edit an existing topic using the Contribute link +description: Instructions about how to edit an existing topic by using the Contribute link. +keywords: contribute, edit a topic +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +--- + +# Edit an existing topic using the Contribute link +You can now make suggestions and update existing, public content with a GitHub account and a simple click of a link. + +>**Note**
    +>At this time, only the English (en-us) content is available for editing. + +**To edit a topic** + +1. All contributors who are ***not*** a Microsoft employee must [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before contributing to any Microsoft repositories. +If you've already contributed to Microsoft repositories in the past, congratulations! +You've already completed this step. + +2. Go to the page on TechNet that you want to update, and then click **Contribute**. + + ![GitHub Web, showing the Contribute link](images/contribute-link.png) + +3. Log into (or sign up for) a GitHub account. + + You must have a GitHub account to get to the page that lets you edit a topic. + +4. Click the **Pencil** icon (in the red box) to edit the content. + + ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) + +5. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: + - **If you're linked to the Microsoft organization in GitHub:** [Windows Open Publishing Guide Home](http://aka.ms/windows-op-guide) + + - **If you're external to Microsoft:** [Mastering Markdown](https://guides.github.com/features/mastering-markdown/) + +6. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. + + ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) + +7. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change** to create a fork in your personal GitHub account. + + ![GitHub Web, showing the Propose file change button](images/propose-file-change.png) + + The **Comparing changes** screen appears to see what the changes are between your fork and the original content. + +8. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. + + If there are no problems, you’ll see the message, **Able to merge**. + + ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) + +9. Click **Create pull request**. + +10. Enter a title and description to give the approver the appropriate context about what’s in the request. + +11. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. + +12. Click **Create pull request** again to actually submit the pull request. + + The pull request is sent to the writer of the topic and your edits are reviewed. If your request is accepted, updates are published to one of the following places: + + - [Windows 10](https://technet.microsoft.com/itpro/windows) + - [Internet Explorer 11](https://technet.microsoft.com/itpro/internet-explorer) + - [Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge) + - [Surface](https://technet.microsoft.com/itpro/surface) + - [Surface Hub](https://technet.microsoft.com/itpro/surface-hub) + - [Windows 10 for Education](https://technet.microsoft.com/edu/windows) + - [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop) diff --git a/windows/whats-new/credential-guard.md b/windows/whats-new/credential-guard.md index 02ff200227..3edfe53458 100644 --- a/windows/whats-new/credential-guard.md +++ b/windows/whats-new/credential-guard.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft -redirect_url: whats-new-windows-10-version-1507-and-1511.md +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in Credential Guard? diff --git a/windows/whats-new/device-guard-overview.md b/windows/whats-new/device-guard-overview.md index 28e92f028b..e42271af40 100644 --- a/windows/whats-new/device-guard-overview.md +++ b/windows/whats-new/device-guard-overview.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # Device Guard overview @@ -25,7 +26,7 @@ For details on how to implement Device Guard, see [Device Guard deployment guide ## Why use Device Guard With thousands of new malicious files created every day, using traditional methods like signature-based detection to fight against malware provides an inadequate defense against new attacks. Device Guard on Windows 10 Enterprise changes from a mode where apps are trusted unless blocked by an antivirus or other security solutions, to a mode where the operating system trusts only apps authorized by your enterprise. -Device Guard also helps protect against [zero day attacks](http://go.microsoft.com/fwlink/p/?linkid=534209) and works to combat the challenges of [polymorphic viruses](http://go.microsoft.com/fwlink/p/?LinkId=534210). +Device Guard also helps protect against [zero day attacks](https://go.microsoft.com/fwlink/p/?linkid=534209) and works to combat the challenges of [polymorphic viruses](https://go.microsoft.com/fwlink/p/?LinkId=534210). ## Virtualization-based security using Windows 10 Enterprise Hypervisor Windows 10 Enterprise Hypervisor introduces new capabilities around virtual trust levels, which helps Windows 10 Enterprise services to run in a protected environment, in isolation from the running operating system. Windows 10 Enterprise virtualization-based security helps protect kernel code integrity and helps to provide credential isolation for the local security authority (LSA). Letting the Kernel Code Integrity service run as a hypervisor-hosted service increases the level of protection around the root operating system, adding additional protections against any malware that compromises the kernel layer. diff --git a/windows/whats-new/device-management.md b/windows/whats-new/device-management.md index 55051d9fd0..79260f0f69 100644 --- a/windows/whats-new/device-management.md +++ b/windows/whats-new/device-management.md @@ -7,118 +7,11 @@ ms.pagetype: devices, mobile ms.mktglfcycl: explore ms.sitesec: library author: jdeckerMS +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/manage-corporate-devices --- # Enterprise management for Windows 10 devices - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices. - -## MDM support - - -MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Windows Store, VPN configuration, and more. To learn more about the changes in MDM policies for Windows 10, version 1607, see [What's new in MDM enrollment and management](https://msdn.microsoft.com/en-us/library/windows/hardware/mt299056%28v=vs.85%29.aspx#whatsnew_1607). - -MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](http://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification. - -Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. - -## Unenrollment - - -When a person leaves your organization and you unenroll the user account or device from management, the enterprise-controlled configurations and apps are removed from the device. You can unenroll the device remotely or the person can unenroll by manually removing the account from the device. - -When a personal device is unenrolled, the user's data and apps are untouched, while enterprise information such as certificates, VPN profiles, and enterprise apps are removed. - -## Infrastructure - - -Enterprises have the following identity and management choices. - -| Area | Choices | -|---|---| -| Identity | Active Directory; Azure AD | -| Grouping | Domain join; Workgroup; Azure AD join | -| Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | - -  - -**Note**   -With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](http://go.microsoft.com/fwlink/p/?LinkID=613512). - -  - -## Device lockdown - - -Do you need a computer that can only do one thing? For example: - -- A device in the lobby that customers can use to view your product catalog. - -- A portable device that drivers can use to check a route on a map. - -- A device that a temporary worker uses to enter data. - -You can configure a persistent locked down state to [create a kiosk-type device](https://technet.microsoft.com/en-us/itpro/windows/manage/set-up-a-device-for-anyone-to-use). When the locked-down account is logged on, the device displays only the app that you select. - -You can also [configure a lockdown state](https://technet.microsoft.com/en-us/itpro/windows/manage/lock-down-windows-10-to-specific-apps) that takes effect when a given user account logs on. The lockdown restricts the user to only the apps that you specify. - -Lockdown settings can also be configured for device look and feel, such as a theme or a [custom layout on the Start screen](https://technet.microsoft.com/en-us/itpro/windows/manage/windows-10-start-layout-options-and-policies). - -## Updates - - -With Windows 10, your enterprise will have more choice and flexibility in applying operating system updates. You can manage and control updates to devices running Windows 10 Pro and Windows 10 Enterprise using MDM policies. - -While Windows Update provides updates to unmanaged devices, most enterprises prefer to manage and control the flow of updates using their device management solution. You can choose to apply the latest updates as soon as they are available, or you can set a source and schedule for updates that works for your specific requirements. - -For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](../manage/introduction-to-windows-10-servicing.md). - -## Easier certificate management - - -For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](http://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](https://tnstage.redmond.corp.microsoft.com/en-us/itpro/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile) - -## Learn more - - -[Windows 10: Manageability Choices](http://go.microsoft.com/fwlink/p/?LinkId=533886) - -[Windows 10: Management](http://go.microsoft.com/fwlink/p/?LinkId=533887) - -[Windows 10 Technical Preview Fundamentals for IT Pros: Windows 10 Management and Deployment](http://go.microsoft.com/fwlink/p/?LinkId=533888) - -[Reference for Mobile device management for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=533172) - -Active Directory blog posts on Azure AD and Windows 10: - -- [Azure AD, Microsoft Intune and Windows 10 - Using the cloud to modernize enterprise mobility!](http://go.microsoft.com/fwlink/p/?LinkId=619025) - -- [Azure AD Join on Windows 10 devices](http://go.microsoft.com/fwlink/p/?LinkID=616791) - -- [Azure AD on Windows 10 Personal Devices]( http://go.microsoft.com/fwlink/p/?LinkId=619028) - -- [Azure Active Directory and Windows 10: Bringing the cloud to enterprise desktops!](http://go.microsoft.com/fwlink/p/?LinkID=615765) - -## Related topics - - -[Manage corporate devices](../manage/manage-corporate-devices.md) - -[Windows Hello](microsoft-passport.md) - -[Enterprise Data Protection Overview](edp-whats-new-overview.md) - -  - -  - - - +This page has been redirected to **What's new in Windows 10, versions 1507 and 1511**. diff --git a/windows/whats-new/edge-ie11-whats-new-overview.md b/windows/whats-new/edge-ie11-whats-new-overview.md index 9370b6beb5..8c053fd990 100644 --- a/windows/whats-new/edge-ie11-whats-new-overview.md +++ b/windows/whats-new/edge-ie11-whats-new-overview.md @@ -1,56 +1,6 @@ --- title: Browser Microsoft Edge and Internet Explorer 11 (Windows 10) description: Resources to help you explore the Windows 10 browsing options for your enterprise. -ms.assetid: e986f903-69ad-4145-9d24-0c6d04b3e489 -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: mobile -author: eross-msft +redirect_url: https://technet.microsoft.com/itpro/microsoft-edge/enterprise-guidance-using-microsoft-edge-and-ie11 --- -# Browser: Microsoft Edge and Internet Explorer 11 -**Microsoft Edge content applies to:** - -- Windows 10 -- Windows 10 Mobile - -**Internet Explorer 11 content applies to:** - -- Windows 10 - -## Enterprise guidance -Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](http://go.microsoft.com/fwlink/p/?linkid=290956). - -We also recommend that you upgrade to IE11 if you're running any earlier versions of Internet Explorer. IE11 is supported on Windows 7, Windows 8.1, and Windows 10. So any legacy apps that work with IE11 will continue to work even as you migrate to Windows 10. - -### Microsoft Edge -Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana. - -- **Web Note.** Microsoft Edge lets you annotate, highlight, and call things out directly on webpages. -- **Reading view.** Microsoft Edge lets you enjoy and print online articles in a distraction-free layout that's optimized for your screen size. While in reading view, you can also save webpages or PDF files to your reading list, for later viewing. -- **Cortana.** Cortana is automatically enabled on Microsoft Edge. Microsoft Edge lets you highlight words for more info and gives you one-click access to things like restaurant reservations and reviews, without leaving the webpage. -- **Compatibility and security.** Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or that are included on your Enterprise Mode Site List. You must use IE11 to run older, less secure technology, such as ActiveX controls. - -### IE11 -IE11 offers enterprises additional security, manageability, performance, backward compatibility, and modern standards support. - -- **Backward compatibility.** IE11 supports 9 document modes that include high-fidelity emulations for older versions of IE. -- **Modern web standards.** IE11 supports modern web technologies like HTML5, CSS3, and WebGL, which help to ensure today's modern websites and apps work just as well as your old, legacy websites and apps. -- **More secure.** IE11 was designed with security in mind and is more secure than older versions. Using security features like SmartScreen and Enhanced Protected Mode can help IE11 reduce your risk. -- **Faster.** IE11 is significantly faster than previous versions of Internet Explorer, taking advantage of network optimization and hardware-accelerated text, graphics, and JavaScript rendering. -- **Easier migration to Windows 10.** IE11 is the only version of IE that runs on Windows 7, Windows 8.1, and Windows 10. Upgrading to IE11 on Windows 7 can also help your organization support the next generation of software, services, and devices. -- **Administration.** IE11 can use the Internet Explorer Administration Kit (IEAK) 11 or MSIs for deployment, and includes more than 1,600 Group Policies and preferences for granular control. - -## Related topics -- [Web Application Compatibility Lab Kit for Internet Explorer 11](https://technet.microsoft.com/en-us/browser/mt612809.aspx) -- [Download Internet Explorer 11](http://windows.microsoft.com/en-US/internet-explorer/download-ie) -- [Microsoft Edge - Deployment Guide for IT Pros](https://technet.microsoft.com/itpro/microsoft-edge/index) -- [Internet Explorer 11 - Deployment Guide for IT Pros](https://technet.microsoft.com/itpro/internet-explorer/ie11-deploy-guide/index) -- [IEAK 11 - Internet Explorer Administration Kit 11 Users Guide](https://technet.microsoft.com/en-us/itpro/internet-explorer/ie11-ieak/index) -- [Internet Explorer 11 - FAQ for IT Pros](https://technet.microsoft.com/en-us/itpro/internet-explorer/ie11-faq/faq-for-it-pros-ie11) - - - - - diff --git a/windows/whats-new/edp-whats-new-overview.md b/windows/whats-new/edp-whats-new-overview.md index 4b157c50e8..a6816c161f 100644 --- a/windows/whats-new/edp-whats-new-overview.md +++ b/windows/whats-new/edp-whats-new-overview.md @@ -1,81 +1,5 @@ --- title: Enterprise data protection (EDP) overview (Windows 10) description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data disclosure through apps and services that are outside of the enterprise’s control like email, social media, and the public cloud. -ms.assetid: 428A3135-CB5E-478B-B1FF-B6EB76F0DF14 -keywords: EDP Overview, EDP -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: mobile, security -author: eross-msft ---- - -# Enterprise data protection (EDP) overview - -**Applies to:** -- Windows 10 Insider Preview -- Windows 10 Mobile Preview - -[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. - -Enterprise data protection (EDP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. EDP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. - -## Benefits of EDP - -EDP provides: -- Obvious separation between personal and corporate data, without requiring employees to switch environments or apps. - -- Additional data protection for existing line-of-business apps without a need to update the apps. - -- Ability to wipe corporate data from devices while leaving personal data alone. - -- Use of audit reports for tracking issues and remedial actions. - -- Integration with your existing management system (Microsoft Intune, System Center Configuration Manager (version 1511 or later), or your current mobile device management (MDM) system) to configure, deploy, and manage EDP for your company. - -## Enterprise scenarios -EDP currently addresses these enterprise scenarios: -- You can encrypt enterprise data on employee-owned and corporate-owned devices. - -- You can remotely wipe enterprise data off managed computers, including employee-owned computers, without affecting the personal data. - -- You can select specific apps that can access enterprise data, called "allowed apps" that are clearly recognizable to employees. You can also block non-protected apps from accessing enterprise data. - -- Your employees won't have their work otherwise interrupted while switching between personal and enterprise apps while the enterprise policies are in place. Switching environments or signing in multiple times isn’t required. - -## Why use EDP? -EDP gives you a new way to manage data policy enforcement for apps and documents, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune). - -- **Change the way you think about data policy enforcement.** As an enterprise admin, you need to maintain compliance in your data policy and data access. EDP helps make sure that your enterprise data is protected on both corporate and employee-owned devices, even when the employee isn’t using the device. When employees create content on an enterprise-protected device, they can choose to save it as a work document. If it's a work document, it becomes locally-maintained as enterprise data. - -- **Manage your enterprise documents, apps, and encryption modes.** - - - **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using an EDP-protected device, EDP encrypts the data on the device. - - - **Using allowed apps.** Managed apps (apps that you've included on the allowed apps list in your EDP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if EDP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - - - **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your protected apps list, the app is trusted with enterprise data. All apps not on this list are blocked from accessing your enterprise data, depending on your EDP management-mode. - - You don’t have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in your protected apps list. - - - **Deciding your level of data access.** EDP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your protected apps list. - - - **Data encryption at rest.** EDP helps protect enterprise data on local files and on removable media. - - Apps such as Microsoft Word work with EDP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens EDP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies EDP to the new document. - - - **Helping prevent accidental data disclosure to public spaces.** EDP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your protected apps list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your protected apps list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the business cloud, while maintaining the encryption locally. - - - **Helping prevent accidental data disclosure to removable media.** EDP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t. - - - **Remove access to enterprise data from enterprise-protected devices.** EDP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable. - -## Turn off EDP - -You can turn off all enterprise data protection and restrictions, reverting to where you were pre-EDP, with no data loss. However, turning off EDP isn't recommended. If you choose to turn it off, you can always turn it back on, but EDP won't retain your decryption and policies info. - -## Related topics -- [Protect your enterprise data using enterprise data protection (EDP)](../keep-secure/protect-enterprise-data-using-edp.md) -  \ No newline at end of file +redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip +--- \ No newline at end of file diff --git a/windows/whats-new/images/compare-changes.png b/windows/whats-new/images/compare-changes.png new file mode 100644 index 0000000000..0d86db70f5 Binary files /dev/null and b/windows/whats-new/images/compare-changes.png differ diff --git a/windows/whats-new/images/contribute-link.png b/windows/whats-new/images/contribute-link.png new file mode 100644 index 0000000000..6b17e6dd56 Binary files /dev/null and b/windows/whats-new/images/contribute-link.png differ diff --git a/windows/whats-new/images/pencil-icon.png b/windows/whats-new/images/pencil-icon.png new file mode 100644 index 0000000000..82fe7852dd Binary files /dev/null and b/windows/whats-new/images/pencil-icon.png differ diff --git a/windows/whats-new/images/preview-changes.png b/windows/whats-new/images/preview-changes.png new file mode 100644 index 0000000000..f98b2c6443 Binary files /dev/null and b/windows/whats-new/images/preview-changes.png differ diff --git a/windows/whats-new/images/propose-file-change.png b/windows/whats-new/images/propose-file-change.png new file mode 100644 index 0000000000..aedbc07b16 Binary files /dev/null and b/windows/whats-new/images/propose-file-change.png differ diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index c83ad18429..ff170bce3b 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -2,15 +2,16 @@ title: What's new in Windows 10 (Windows 10) description: Learn about new features in Windows 10 for IT professionals, such as Enterprise Data Protection, Microsoft Passport, Device Guard, and more. ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 -keywords: ["What's new in Windows 10", "Windows 10", "anniversary update"] +keywords: ["What's new in Windows 10", "Windows 10", "anniversary update", "contribute", "edit topic"] ms.prod: w10 author: TrudyHa +localizationpriority: high --- # What's new in Windows 10 -Windows 10 provides IT professionals with advanced protection against modern security threats and comprehensive management and control over devices and apps, as well as flexible deployment, update, and support options. Learn about new features in Windows 10 for IT professionals, such as Enterprise Data Protection, Windows Hello, Device Guard, and more. +Windows 10 provides IT professionals with advanced protection against modern security threats and comprehensive management and control over devices and apps, as well as flexible deployment, update, and support options. Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more. ## In this section @@ -18,16 +19,15 @@ Windows 10 provides IT professionals with advanced protection against modern sec - [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) - -  +- [Edit an existing topic using the Contribute link](contribute-to-a-topic.md) ## Learn more - [Windows 10 roadmap](https://www.microsoft.com/en-us/WindowsForBusiness/windows-roadmap) - [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info) - [Windows 10 update history](https://support.microsoft.com/en-us/help/12387/windows-10-update-history) -- [Windows 10 content from Microsoft Ignite](http://go.microsoft.com/fwlink/p/?LinkId=613210) -- [Compare Windows 10 Editions](http://go.microsoft.com/fwlink/p/?LinkId=690485) +- [Windows 10 content from Microsoft Ignite](https://go.microsoft.com/fwlink/p/?LinkId=613210) +- [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkId=690485) diff --git a/windows/whats-new/lockdown-features-windows-10.md b/windows/whats-new/lockdown-features-windows-10.md index 0acfd3723a..67a759be13 100644 --- a/windows/whats-new/lockdown-features-windows-10.md +++ b/windows/whats-new/lockdown-features-windows-10.md @@ -8,108 +8,9 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/lockdown-features-windows-10 --- # Lockdown features from Windows Embedded 8.1 Industry -**Applies to** -- Windows 10 -- Windows 10 Mobile - -Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. This table maps Windows Embedded Industry 8.1 features to Windows 10 Enterprise features, along with links to documentation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows Embedded 8.1 Industry lockdown featureWindows 10 featureChanges

    [Hibernate Once/Resume Many (HORM)](http://go.microsoft.com/fwlink/p/?LinkId=626758): Quick boot to device

    		N/A

    HORM is supported in Windows 10, version 1607.

    [Unified Write Filter](http://go.microsoft.com/fwlink/p/?LinkId=626757): protect a device's physical storage media

    		[Unified Writer Filter](http://go.microsoft.com/fwlink/p/?LinkId=626607)

    The Unified Write Filter is continued in Windows 10, with the exception of HORM which has been deprecated.

    [Keyboard Filter]( http://go.microsoft.com/fwlink/p/?LinkId=626761): block hotkeys and other key combinations

    		[Keyboard Filter](http://go.microsoft.com/fwlink/p/?LinkId=708391)

    Keyboard filter is added in Windows 10, version 1511. As in Windows Embedded Industry 8.1, Keyboard Filter is an optional component that can be turned on via Turn Windows Features On/Off. Keyboard Filter (in addition to the WMI configuration previously available) will be configurable through Windows Imaging and Configuration Designer (ICD) in the SMISettings path.

    [Shell Launcher](http://go.microsoft.com/fwlink/p/?LinkId=626676): launch a Classic Windows application on sign-on

    		[Shell Launcher](http://go.microsoft.com/fwlink/p/?LinkId=618603)

    Shell Launcher continues in Windows 10. It is now configurable in Windows ICD under the SMISettings category.

    -

    Learn [how to use Shell Launcher to create a kiosk device](http://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Classic Windows application.

    [Application Launcher]( http://go.microsoft.com/fwlink/p/?LinkId=626675): launch a Universal Windows Platform (UWP) app on sign-on

    		[Assigned Access](http://go.microsoft.com/fwlink/p/?LinkId=626608)

    The Windows 8 Application Launcher has been consolidated into Assigned Access. Application Launcher enabled launching a Windows 8 app and holding focus on that app. Assigned Access offers a more robust solution for ensuring that apps retain focus.

    [Dialog Filter](http://go.microsoft.com/fwlink/p/?LinkId=626762): suppress system dialogs and control which processes can run

    		[AppLocker](../keep-secure/applocker-overview.md)

    Dialog Filter has been deprecated for Windows 10. Dialog Filter provided two capabilities; the ability to control which processes were able to run, and the ability to prevent dialogs (in practice, system dialogs) from appearing.

    -
      -

    • Control over which processes are able to run will now be provided by AppLocker.

      • -

    • System dialogs in Windows 10 have been replaced with system toasts. To see more on blocking system toasts, see Toast Notification Filter below.

      • -

    [Toast Notification Filter]( http://go.microsoft.com/fwlink/p/?LinkId=626673): suppress toast notifications

    		Mobile device management (MDM) and Group Policy

    Toast Notification Filter has been replaced by MDM and Group Policy settings for blocking the individual components of non-critical system toasts that may appear. For example, to prevent a toast from appearing when a USB drive is connected, ensure that USB connections have been blocked using the USB-related policies, and turn off notifications from apps.

    -

    Group Policy: User Configuration > Administrative Templates > Start Menu and Taskbar > Notifications

    -

    MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow action center notifications and a [custom OMA-URI setting](http://go.microsoft.com/fwlink/p/?LinkID=616317) for AboveLock/AllowActionCenterNotifications.

    [Embedded Lockdown Manager](http://go.microsoft.com/fwlink/p/?LinkId=626763): configure lockdown features

    		[Windows Imaging and Configuration Designer (ICD)](http://go.microsoft.com/fwlink/p/?LinkID=525483)

    The Embedded Lockdown Manager has been deprecated for Windows 10 and replaced by the Windows ICD. Windows ICD is the consolidated tool for Windows imaging and provisioning scenarios and enables configuration of all Windows settings, including the lockdown features previously configurable through Embedded Lockdown Manager.

    [USB Filter](http://go.microsoft.com/fwlink/p/?LinkId=626674): restrict USB devices and peripherals on system

    		MDM and Group Policy

    The USB Filter driver has been replaced by MDM and Group Policy settings for blocking the connection of USB devices.

    -

    Group Policy: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions

    -

    MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow removable storage or Allow USB connection (Windows 10 Mobile only).

    [Assigned Access](http://go.microsoft.com/fwlink/p/?LinkID=613653): launch a UWP app on sign-in and lock access to system

    		[Assigned Access](http://go.microsoft.com/fwlink/p/?LinkId=626608)

    Assigned Access has undergone significant improvement for Windows 10. In Windows 8.1, Assigned Access blocked system hotkeys and edge gestures, and non-critical system notifications, but it also applied some of these limitations to other accounts on the device.

    -

    In Windows 10, Assigned Access no longer affects accounts other than the one being locked down. Assigned Access now restricts access to other apps or system components by locking the device when the selected user account logs in and launching the designated app above the lock screen, ensuring that no unintended functionality can be accessed.

    -

    Learn [how to use Assigned Access to create a kiosk device](http://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Universal Windows app.

    [Gesture Filter](http://go.microsoft.com/fwlink/p/?LinkId=626672): block swipes from top, left, and right edges of screen

    		[Assigned Access](http://go.microsoft.com/fwlink/p/?LinkId=626608)

    The capabilities of Gesture Filter have been consolidated into Assigned Access for Windows 10. In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. For Windows 10, Charms have been removed, and blocking the closing or switching of apps is part of Assigned Access.

    [Custom Logon]( http://go.microsoft.com/fwlink/p/?LinkId=626759): suppress Windows UI elements during Windows sign-on, sign-off, and shutdown

    		[Embedded Logon](http://go.microsoft.com/fwlink/p/?LinkId=626760)

    No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.

    [Unbranded Boot](http://go.microsoft.com/fwlink/p/?LinkId=626872): custom brand a device by removing or replacing Windows boot UI elements

    		[Unbranded Boot](http://go.microsoft.com/fwlink/p/?LinkId=626873)

    No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.

    -  -  -  +This topic has been redirected. \ No newline at end of file diff --git a/windows/whats-new/microsoft-passport.md b/windows/whats-new/microsoft-passport.md index a132b19ad6..e8b4935152 100644 --- a/windows/whats-new/microsoft-passport.md +++ b/windows/whats-new/microsoft-passport.md @@ -8,35 +8,9 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: mobile, security author: jdeckerMS +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/manage-identity-verification-using-microsoft-passport --- # Windows Hello overview -**Applies to** -- Windows 10 -- Windows 10 Mobile -> **Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name in Windows 10, version 1607. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. - -In Windows 10, Windows Hello replaces passwords with strong two-factor authentication that consists of an enrolled device and a Windows Hello (biometric) or PIN. - -Windows Hello lets users authenticate to a Microsoft account, an Active Directory account, a Microsoft Azure Active Directory (AD) account, or non-Microsoft service that supports [Fast ID Online (FIDO)](http://go.microsoft.com/fwlink/p/?LinkId=533889) authentication. After an initial two-step verification during Hello enrollment, Hello is set up on the user's device and the user sets a gesture, which can be biometric such as a fingerprint or a PIN. The user provides the gesture to verify identity; Windows then uses Hello to authenticate users and help them to access protected resources and services. -Hello also enables Windows 10 Mobile devices to be used as a remote credential when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Hello on the user’s Windows 10 Mobile device. Because users carry their phone with them, Hello makes implementing two-factor authentication across the enterprise less costly and complex than other solutions - -## Benefits of Windows Hello - -- **User convenience**. The employee provides credentials (such as account and password, or other credentials), and is then guided to set up Windows Hello. From that point on, the employee can access enterprise resources by providing a gesture. -- **Security**. Hello helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Microsoft - -Passport credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are generated within isolated environments of Trusted Platform Modules (TPMs). -[Learn how to implement and manage Windows Hello for Business in your organization.](../keep-secure/implement-microsoft-passport-in-your-organization.md) - -## Learn more - -[Why a PIN is better than a password](../keep-secure/why-a-pin-is-better-than-a-password.md) -[Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](http://go.microsoft.com/fwlink/p/?LinkId=533890) -[Windows 10: The End Game for Passwords and Credential Theft?](http://go.microsoft.com/fwlink/p/?LinkId=533891) - -## Related topics -[Device management](device-management.md) -  -  +This topic has been redirected. \ No newline at end of file diff --git a/windows/whats-new/new-provisioning-packages.md b/windows/whats-new/new-provisioning-packages.md index 62900c57c8..18725fae2a 100644 --- a/windows/whats-new/new-provisioning-packages.md +++ b/windows/whats-new/new-provisioning-packages.md @@ -7,124 +7,10 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: mobile author: jdeckerMS +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/deploy/provisioning-packages --- # Provisioning packages -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using Windows Provisioning, an IT administrator can easily specify desired configuration and settings required to enroll the devices into management (through a wizard-driven user interface) and then apply that configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers. - -With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. - -Provisioning packages are simple enough that with a short set of written instructions, a student or non-technical employee can use them to configure their device. This can result in a significant reduction in the time required to configure multiple devices in your organization. - -## New in Windows 10, Version 1607 - -The Windows Assessment and Deployment Kit (ADK) for Windows 10 includes the Imaging and Configuration Designer (ICD), a tool for configuring images and runtime settings which are then built into provisioning packages. Windows ICD for Windows 10, Version 1607, simplifies common provisioning scenarios. - -![Configuration Designer options](images/icd.png) - -Windows ICD in Windows 10, Version 1607, supports the following scenarios for IT administrators: - -* **Simple provisioning** – Enables IT administrators to define a desired configuration in Windows ICD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner. - - > [Learn how to use simple provisioning to configure Windows 10 computers.](../deploy/provision-pcs-for-initial-deployment.md) - -* **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use Windows ICD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices. - - > [Learn how to use advanced provisioning to configure Windows 10 computers with apps and certificates.](../deploy/provision-pcs-with-apps-and-certificates.md) - -* **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows 10 Mobile devices and enroll them into mobile device management (MDM) before handing them to end-users in the organization. IT administrators can use Windows ICD to specify the management end-point and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include: - - * System Center Configuration Manager and Microsoft Intune hybrid (certificate-based enrollment) - * AirWatch (password-string based enrollment) - * Mobile Iron (password-string based enrollment) - * Other MDMs (cert-based enrollment) - -> **Note:** Windows ICD in Windows 10, Version 1607, also provides a wizard to create provisioning packages for school PCs. To learn more, see [Set up students' PCs to join domain](https://technet.microsoft.com/edu/windows/index). - -## Benefits of provisioning packages - - -Provisioning packages let you: - -- Quickly configure a new device without going through the process of installing a new image. - -- Save time by configuring multiple devices using one provisioning package. - -- Quickly configure employee-owned devices in an organization without a mobile device management (MDM) infrastructure. - -- Set up a device without the device having network connectivity. - -Provisioning packages can be: - -- Installed using removable media such as an SD card or USB flash drive. - -- Attached to an email. - -- Downloaded from a network share. - -## What you can configure - - -The following table provides some examples of what can be configured using provisioning packages. - -| Customization options | Examples | -|--------------------------|-----------------------------------------------------------------------------------------------| -| Bulk Active Directory join and device name | Join devices to Active Directory domain and assign device names using hardware-specific serial numbers or random characters | -| Applications | Windows apps, line-of-business applications | -| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service\* | -| Certificates | Root certification authority (CA), client certificates | -| Connectivity profiles | Wi-Fi, proxy settings, Email | -| Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings | -| Data assets | Documents, music, videos, pictures | -| Start menu customization | Start menu layout, application pinning | -| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on | -\* Using a provisioning package for auto-enrollment to System Center Configuration Manager or Configuration Manager/Intune hybrid is not supported. Use the Configuration Manager console to enroll devices. -  - -For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( http://go.microsoft.com/fwlink/p/?LinkId=619012). - -## Creating a provisioning package - - -With Windows 10, you can use the Windows Imaging and Configuration Designer (ICD) tool to create provisioning packages. To install Windows ICD and create provisioning packages, you must install the Windows Assessment and Deployment Kit (ADK) for Windows 10 [from the Windows Insider Program site](http://go.microsoft.com/fwlink/p/?linkid=533700). - -While running ADKsetup.exe for Windows 10, version 1607, select the following feature from the **Select the features you want to install** dialog box: - -- Windows Imaging and Configuration Designer (ICD) - -> **Note:** In previous versions of the Windows 10 ADK, you had to install additional features for Windows ICD to run. Starting in version 1607, you can install Windows ICD without other ADK features. - -After you install Windows ICD, you can use it to create a provisioning package. For detailed instructions on how to create a provisioning package, see [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkID=629651). - -## Applying a provisioning package to a device - - -Provisioning packages can be applied both during image deployment and during runtime. For information on how to apply a provisioning package to a Windows 10-based device, see [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkID=629651). - -## Learn more - - -[Windows 10: Deployment](http://go.microsoft.com/fwlink/p/?LinkId=533708) - -## Related topics - - - - -[Configure devices without MDM](../manage/configure-devices-without-mdm.md) - -  - -  - - - - - +This topic has been redirected. \ No newline at end of file diff --git a/windows/whats-new/security-auditing.md b/windows/whats-new/security-auditing.md index c597c177b0..8683fc520d 100644 --- a/windows/whats-new/security-auditing.md +++ b/windows/whats-new/security-auditing.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft ms.pagetype: security, mobile -redirect_url: whats-new-windows-10-version-1507-and-1511.md +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in security auditing? @@ -21,7 +21,7 @@ Security auditing is one of the most powerful tools that you can use to maintain ## New features in Windows 10, version 1511 -- The [WindowsSecurityAuditing](http://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](http://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices. +- The [WindowsSecurityAuditing](https://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](https://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices. ## New features in Windows 10 diff --git a/windows/whats-new/security.md b/windows/whats-new/security.md index ae44b5893e..f2d45edd95 100644 --- a/windows/whats-new/security.md +++ b/windows/whats-new/security.md @@ -190,8 +190,8 @@ Table 1. Windows 10 hardware requirements In this table, **R** stands for *recommended*, **Y** means that the hardware component is *required* for that Windows 10 feature, and **N** means that the hardware component is *not used* with that Windows 10 feature.   ## Related topics -[Windows 10 Specifications](http://go.microsoft.com/fwlink/p/?LinkId=717550) -[Making Windows 10 More Personal and More Secure with Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=717551) +[Windows 10 Specifications](https://go.microsoft.com/fwlink/p/?LinkId=717550) +[Making Windows 10 More Personal and More Secure with Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=717551) [Protect BitLocker from pre-boot attacks](../keep-secure/protect-bitlocker-from-pre-boot-attacks.md) [BitLocker Countermeasures](../keep-secure/bitlocker-countermeasures.md) [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md) diff --git a/windows/whats-new/trusted-platform-module.md b/windows/whats-new/trusted-platform-module.md index 91f4646825..e4a2614653 100644 --- a/windows/whats-new/trusted-platform-module.md +++ b/windows/whats-new/trusted-platform-module.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security, mobile author: brianlic-msft -redirect_url: whats-new-windows-10-version-1507-and-1511.md +redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/trusted-platform-module-overview --- # What's new in Trusted Platform Module? diff --git a/windows/whats-new/user-account-control.md b/windows/whats-new/user-account-control.md index 7933086c5d..4a670324d3 100644 --- a/windows/whats-new/user-account-control.md +++ b/windows/whats-new/user-account-control.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: brianlic-msft -redirect_url: whats-new-windows-10-version-1507-and-1511.md +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in User Account Control? diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index c304d8acb2..4dcad74254 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: TrudyHa +localizationpriority: high --- # What's new in Windows 10, versions 1507 and 1511 @@ -69,7 +70,7 @@ With Windows 10, you can create provisioning packages that let you quickly and e ### Easier certificate management -For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](http://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](~/keep-secure/installing-digital-certificates-on-windows-10-mobile.md) +For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](https://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](~/keep-secure/installing-digital-certificates-on-windows-10-mobile.md) ### Microsoft Passport @@ -81,7 +82,7 @@ Microsoft Passport lets users authenticate to a Microsoft account, an Active Dir #### New Security auditing features in Windows 10, version 1511 -- The [WindowsSecurityAuditing](http://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](http://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices. +- The [WindowsSecurityAuditing](https://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](https://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices. #### New features in Windows 10, version 1507 @@ -248,9 +249,9 @@ Windows 10 provides mobile device management (MDM) capabilities for PCs, laptop MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Windows Store, VPN configuration, and more. -MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](http://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification. +MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification. -Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=533172) +Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=533172) ### Unenrollment @@ -271,7 +272,7 @@ Enterprises have the following identity and management choices. | Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) |  > **Note**   -With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](http://go.microsoft.com/fwlink/p/?LinkID=613512). +With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512).   ### Device lockdown @@ -297,15 +298,49 @@ A standard, customized Start layout can be useful on devices that are common to Administrators can also use mobile device management (MDM) or Group Policy to disable the use of [Windows Spotlight on the lock screen](../manage/windows-spotlight.md). +### Windows Store for Business +**New in Windows 10, version 1511** + +With the Windows Store for Business, organizations can make volume purchases of Windows apps. The Store for Business provides app purchases based on organizational identity, flexible distribution options, and the ability to reclaim or re-use licenses. Organizations can also use the Store for Business to create a private store for their employees that includes apps from the Store, as well private Line-of-Business (LOB) apps. + +For more information, see [Windows Store for Business overview](../manage/windows-store-for-business-overview.md). + + ## Updates +Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. -With Windows 10, your enterprise will have more choice and flexibility in applying operating system updates. You can manage and control updates to devices running Windows 10 Pro and Windows 10 Enterprise using MDM policies. +By using [Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: -While Windows Update provides updates to unmanaged devices, most enterprises prefer to manage and control the flow of updates using their device management solution. You can choose to apply the latest updates as soon as they are available, or you can set a source and schedule for updates that works for your specific requirements. +- **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). + +- **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient. + +- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](https://go.microsoft.com/fwlink/p/?LinkId=699281). + +Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) and [System Center Configuration Manager](http://technet.microsoft.com/library/gg682129.aspx). + + +Learn more about [Windows Update for Business](../plan/windows-update-for-business.md). For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](../manage/introduction-to-windows-10-servicing.md). +## Microsoft Edge +Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana. + +- **Web Note.** Microsoft Edge lets you annotate, highlight, and call things out directly on webpages. +- **Reading view.** Microsoft Edge lets you enjoy and print online articles in a distraction-free layout that's optimized for your screen size. While in reading view, you can also save webpages or PDF files to your reading list, for later viewing. +- **Cortana.** Cortana is automatically enabled on Microsoft Edge. Microsoft Edge lets you highlight words for more info and gives you one-click access to things like restaurant reservations and reviews, without leaving the webpage. +- **Compatibility and security.** Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or that are included on your Enterprise Mode Site List. You must use IE11 to run older, less secure technology, such as ActiveX controls. + +### Enterprise guidance +Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). + +We also recommend that you upgrade to IE11 if you're running any earlier versions of Internet Explorer. IE11 is supported on Windows 7, Windows 8.1, and Windows 10. So any legacy apps that work with IE11 will continue to work even as you migrate to Windows 10. + +[Learn more about using Microsoft Edge in the enterprise](https://technet.microsoft.com/itpro/microsoft-edge/enterprise-guidance-using-microsoft-edge-and-ie11) + + ## Learn more - [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info) diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index 187e1aafba..7eb664abab 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: TrudyHa +localizationpriority: high --- # What's new in Windows 10, version 1607 @@ -19,7 +20,7 @@ Below is a list of some of the new and updated features in Windows 10, version 1 ### Windows Imaging and Configuration Designer (ICD) -In previous versions of the Windows 10 ADK, you had to install additional features for Windows ICD to run. Starting in version 1607, you can install Windows ICD without other ADK features. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) +In previous versions of the Windows 10 Assessment and Deployment Kit (ADK), you had to install additional features for Windows ICD to run. Starting in version 1607, you can install just the configuration designer component independent of the rest of the imaging components. [Install the ADK.](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) Windows ICD now includes simplified workflows for creating provisioning packages: @@ -29,21 +30,54 @@ Windows ICD now includes simplified workflows for creating provisioning packages [Learn more about using provisioning packages in Windows 10.](../deploy/provisioning-packages.md) +### Windows Upgrade Analytics + +Microsoft developed Upgrade Analytics in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Upgrade Analytics was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10. + +With Windows telemetry enabled, Upgrade Analytics collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. + +Use Upgrade Analytics to get: + +- A visual workflow that guides you from pilot to production +- Detailed computer and application inventory +- Powerful computer level search and drill-downs +- Guidance and insights into application and driver compatibility issues, with suggested fixes +- Data driven application rationalization tools +- Application usage information, allowing targeted validation; workflow to track validation progress and decisions +- Data export to commonly used software deployment tools + +The Upgrade Analytics workflow steps you through the discovery and rationalization process until you have a list of computers that are upgrade-ready. + +[Learn more about planning and managing Windows upgrades with Windows Upgrade Analytics.](../deploy/manage-windows-upgrades-with-upgrade-analytics.md) + +## Windows updates + +Windows 10, version 1607, provides administrators with increased control over updates by changing the update deferral increment from weeks to days. Other changes: + +- Quality Updates can be deferred up to 30 days and paused for 35 days +- Feature Updates can be deferred up to 180 days and paused for 60 days +- Update deferrals can be applied to both Current Branch (CB) and Current Branch for Business (CBB) +- Drivers can be excluded from udpates + ## Security +### Credential Guard and Device Guard + +Isolated User Mode is now included with Hyper-V so you don't have to install it separately. + ### Windows Hello for Business -When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name in Windows 10, version 1607. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name in Windows 10, version 1607. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. Additional changes for Windows Hello in Windows 10, version 1607: -- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. -- Group Policy for managing Windows Hello for Business are now available for both **User Configuration** and **Computer Configuration**. -- Users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser. +- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. +- Group Policy settings for managing Windows Hello for Business are now available for both **User Configuration** and **Computer Configuration**. + [Learn more about Windows Hello for Business.](../keep-secure/manage-identity-verification-using-microsoft-passport.md) -### VPN +### VPN - The VPN client can integrate with the Conditional Access Framework, a cloud-pased policy engine built into Azure Active Directory, to provide a device compliance option for remote clients. - The VPN client can integrate with Windows Information Protection (WIP) policy to provide additional security. [Learn more about Windows Information Protection](../keep-secure/protect-enterprise-data-using-edp.md), previously known as Enterprise Data Protection. @@ -51,7 +85,31 @@ Additional changes for Windows Hello in Windows 10, version 1607: - Microsoft Intune: *VPN Profile (Windows 10 Desktop and Mobile and later)* policy template includes support for native VPN plug-ins. -  +### Windows Information Protection (WIP), formerly known as enterprise data protection (EDP) +With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. + +Windows Information Protection (WIP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. WIP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. + +- [Create a Windows Information Protection (WIP) policy](https://technet.microsoft.com/itpro/windows/keep-secure/overview-create-wip-policy) +- [General guidance and best practices for Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/guidance-and-best-practices-wip) + +[Learn more about Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip) + +### Windows Defender +Several new features and management options have been added to Windows Defender in Windows 10, version 1607. + +- [Windows Defender Offline in Windows 10](../keep-secure/windows-defender-offline.md) can be run directly from within Windows, without having to create bootable media. +- [Use PowerShell cmdlets for Windows Defender](../keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md) to configure options and run scans. +- [Enable the Block at First Sight feature in Windows 10](../keep-secure/windows-defender-block-at-first-sight.md) to leverage the Windows Defender cloud for near-instant protection against new malware. +- [Configure enhanced notifications for Windows Defender in Windows 10](../keep-secure/windows-defender-enhanced-notifications.md) to see more informaiton about threat detections and removal. +- [Run a Windows Defender scan from the command line](../keep-secure/run-cmd-scan-windows-defender-for-windows-10.md). +- [Detect and block Potentially Unwanted Applications with Windows Defender](../keep-secure/enable-pua-windows-defender-for-windows-10.md) during download and install times. + +### Windows Defender Advanced Threat Protection (ATP) +With the growing threat from more sophisticated targeted attacks, a new security solution is imperative in securing an increasingly complex network ecosystem. Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service, built into Windows 10 that enables enterprise customers detect, investigate, and respond to advanced threats on their networks. + +[Learn more about Windows Defender Advanced Threat Protection (ATP)](../keep-secure/windows-defender-advanced-threat-protection.md). + ## Management ### Use Remote Desktop Connection for PCs joined to Azure Active Directory @@ -71,6 +129,23 @@ Numerous settings have been added to the Windows 10 CSPs to expand MDM capabilit Windows 10, Version 1607, introduces shared PC mode, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Education, and Enterprise. [Learn how to set up a shared or guest PC.](../manage/set-up-shared-or-guest-pc.md) +### Application Virtualization (App-V) for Windows 10 + +Application Virtualization (App-V) enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points, including the Windows Store, and interact with them as if they were installed locally. + +With the release of Windows 10, version 1607, App-V is included with the Windows 10 for Enterprise edition. If you are new to Windows 10 and App-V or if you're upgrading from a previous version of App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. + +[Learn how to deliver virtual applications with App-V.](../manage/appv-getting-started.md) + +### User Experience Virtualization (UE-V) for Windows 10 + +Many users customize their settings for Windows and for specific applications. Customizable Windows settings include Windows Store appearance, language, background picture, font size, and accent colors. Customizable application settings include language, appearance, behavior, and user interface options. + +With User Experience Virtualization (UE-V), you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to. + +With the release of Windows 10, version 1607, UE-V is included with the Windows 10 for Enterprise edition. If you are new to Windows 10 and EU-V or upgrading from a previous version of UE-V, you’ll need to download, activate, and install server- and client-side components to start synchronizing user-customized settings across devices. + +[Learn how to synchronize user-customized settings with UE-V.](../manage/uev-for-windows.md) ## Learn more diff --git a/windows/whats-new/windows-spotlight.md b/windows/whats-new/windows-spotlight.md index af6bd8ed19..15caeeb2a9 100644 --- a/windows/whats-new/windows-spotlight.md +++ b/windows/whats-new/windows-spotlight.md @@ -7,71 +7,10 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: jdeckerMS +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/windows-spotlight --- # Windows Spotlight on the lock screen -**Applies to** - -- Windows 10 - -Windows Spotlight is an option for the lock screen background that displays different background images and occasionally offers suggestions on the lock screen. Windows Spotlight is available in all desktop editions of Windows 10. - -For managed devices running Windows 10 Enterprise and Windows 10 Education, enterprise administrators can configure a mobile device management (MDM) or Group Policy setting to prevent users from using the Windows Spotlight background. For managed devices running Windows 10 Pro, version 1607, administrators can disable suggestions for third party apps. - -## What does Windows Spotlight include? - - -- **Background image** - - The Windows Spotlight displays a new image on the lock screen each day. The initial background image is included during installation. Additional images are downloaded on ongoing basis. - - ![lock screen image](images/lockscreen.png) - -- **Feature suggestions, fun facts, tips** - - The lock screen background will occasionally suggest Windows 10 features that the user hasn't tried yet, such as **Snap assist**. - -## How do you turn off Windows spotlight locally? - - -To turn off Windows Spotlight locally, go to **Settings** > **Personalization** > **Lock screen** > **Background** > **Windows spotlight** > select a different lock screen background - -![personalization background](images/spotlight.png) - -## How do you disable Windows Spotlight for managed devices? - - -Windows 10, version 1607, provides three new Group Policy settings to help you manage Spotlight on employees' computers. - -**Windows 10 Pro, Enterprise, and Education** - -- **User Configuration\Administrative Templates\Windows Components\Cloud Content\Do not suggest third-party content in Windows spotlight** enables enterprises to restrict suggestions to Microsoft apps and services. - -**Windows 10 Enterprise and Education** - -* **User Configuration\Administrative Templates\Windows Components\Cloud Content\Turn off all Windows Spotlight features** enables enterprises to completely disable all Spotlight features in a single setting. -* **User Configuration\Administrative Templates\Windows Components\Cloud Content\Configure Spotlight on lock screen** specifically controls the use of the dynamic Spotlight image on the lock screen, and can be enabled or disabled. (The Group Policy setting **Enterprise Spotlight** does not work in Windows 10, version 1607.) - -Windows Spotlight is enabled by default. Administrators can replace Windows Spotlight with a selected image using the Group Policy setting **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**. - -![lockscreen policy details](images/lockscreenpolicy.png) - -Pay attention to the checkbox in **Options**. In addition to providing the path to the lock screen image, administrators can choose to allow or **Turn off fun facts, tips, tricks, and more on lock screen**. If the checkbox is not selected, users will see the lock screen image that is defined in the policy setting, and will also see occasional messages, such as the example in the following image. - -![fun facts](images/funfacts.png) - -## Related topics - - -[Manage Windows 10 Start layout options](../manage/windows-10-start-layout-options-and-policies.md) - -  - -  - - - - - +This topic has been redirected. \ No newline at end of file diff --git a/windows/whats-new/windows-store-for-business-overview.md b/windows/whats-new/windows-store-for-business-overview.md index e1934201c2..abb7c7f8f3 100644 --- a/windows/whats-new/windows-store-for-business-overview.md +++ b/windows/whats-new/windows-store-for-business-overview.md @@ -6,281 +6,6 @@ ms.prod: w10 ms.pagetype: store, mobile ms.mktglfcycl: manage ms.sitesec: library +redirect_url: https://technet.microsoft.com/itpro/windows/manage/windows-store-for-business-overview author: TrudyHa --- - -# Windows Store for Business overview - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -With the new Windows Store for Business, organizations can make volume purchases of Windows apps. The Store for Business provides app purchases based on organizational identity, flexible distribution options, and the ability to reclaim or re-use licenses. Organizations can also use the Store for Business to create a private store for their employees that includes apps from the Store, as well private Line-of-Business (LOB) apps. - -## Features - - -Organizations of any size can benefit from using the Store for Business provides: - -- **Scales to fit the size of your business** - For smaller businesses, with Azure AD accounts and Windows 10 devices, you can quickly have an end-to-end process for acquiring and distributing content using the Store for Business. For larger businesses, all the capabilities of the Store for Businessare available to you, or you can integrate the Store for Businesswith management tools, for greater control over access to apps and app updates. You can use existing work or school accounts. - -- **Bulk app acquisition** - Acquire apps in volume from the Store for Business. - -- **Private store** - Curate a private store for your business that’s easily available from any Windows 10 device. - -- **Flexible distribution options** - Flexible options for distributing content and apps to your employee devices: - - - Distribute through Store for Business services. You can assign apps to individual employees, or make apps available to all employees in your private store. - - - Use a management tool from Microsoft, or a 3rd-party tool for advanced distribution and management functions, or for managing images. - - - Offline licensing model allows you to distribute apps without connecting to Store services, and for managing images. - -- **Line-of-business apps** - Privately add and distribute your internal line-of-business apps using any of the distribution options. - -- **App license management**: Admins can reclaim and reuse app licenses. Online and offline licenses allow you to customize how you decide to deploy apps. - -- **Up-to-date apps** - The Store for Business manages the update process for apps with online licenses. Apps are automatically updated so you are always current with the most recent software updates and product features. Store for Business apps also uninstall cleanly, without leaving behind extra files, for times when you need to switch apps for specific employees. - -## Prerequisites - - -You'll need this software to work with the Store for Business. - -### Required - -- IT Pros that are administering Store for Business need a browser compatible with Store for Business running on a PC or mobile device. Supported browsers include: Internet Explorer 10 or later, Microsoft Edge, or current versions of Chrome or Firefox. - -- Employees using apps from Store for Business need Windows 10, version 1511 running on a PC or mobile device. - -Microsoft Azure Active Directory (AD) accounts for your employees: - -- Admins need Azure AD accounts to sign up for the Store for Business, and then to sign in, get apps, distribute apps, and manage app licenses. - -- Employees need Azure AD account when they access Store for Business content from Windows devices. - -- If you use a management tool to distribute and manage online-licensed apps, all employees will need an Azure AD account - -- For offline-licensed apps, Azure AD accounts are not required for employees. - -For more information on Azure AD, see [About Office 365 and Azure Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](http://go.microsoft.com/fwlink/p/?LinkId=708611). - -### Optional - -While not required, you can use a management tool to distribute and manage apps. Using a management tool allows you to distribute content, scope app availability, and control when app updates are installed. This might make sense for larger organizations that already use a management tool. A couple of things to note about management tools: - -- Need to integrate with Windows 10 management framework and Azure AD. - -- Need to sync with the Store for Business inventory to distribute apps. - -## How does the Store for Business work? - - -### Sign up! - -The first step for getting your organization started with the Store for Business is signing up. To sign up for the Business store, you need an Azure AD account and you must be a Global Administrator for your organization. - -For more information, see [Sign up for the Store for Business](../manage/sign-up-windows-store-for-business.md). - -### Set up - -After your admin signs up for the Store for Business, they can assign roles to other employees in your company. The admin needs Azure AD User Admin permissions to assign WSFB roles. These are the roles and their permissions. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PermissionAccount settingsAcquire appsDistribute appsDevice Guard signing

    Admin

    X

    X

    X

    Purchaser

    X

    X

    Device Guard signer

    X

    - -  - -In some cases, admins will need to add Azure Active Directory (AD) accounts for their employees. For more information, see [Manage user accounts and groups](../manage/manage-users-and-groups-windows-store-for-business.md). - -Also, if your organization plans to use a management tool, you’ll need to configure your management tool to sync with the Store for Business. - -### Get apps and content - -Once signed in to the Store for Business, you can browse and search for all products in the Store for Business catalog. Some apps are free, and some apps charge a price. We're continuing to add more paid apps to the Store for Business. Check back if you don't see the app that you're looking for. Currently, you can pay for apps with a credit card. We'll be adding more payment options over time. - -**App types** -- These app types are supported in the Store for Business: - -- Universal Windows Platform apps - -- Universal Windows apps, by device: Phone, Surface Hub, IOT devices , HoloLens - -Apps purchased from the Store for Business only work on Windows 10 devices. - -Line-of-business (LOB) apps are also supported via the Business store. You can invite IT developers or ISVs to be LOB publishers for your organization. This allows them to submit apps via the developer center that are only available to your organization. These apps can be distributed using the distribution methods discussed in this topic. For more information, see Working with Line-of-Business apps. - -**App licensing model** - -The Business store supports two options to license apps: online and offline. **Online** licensing is the default licensing model and is similar to the Windows Store. Online licensed apps require users and devices to connect to the Store for Business service to acquire an app and its license. **Offline** licensing is a new licensing option for Windows 10. With offline licenses, organizations can cache apps and their licenses to deploy within their network. ISVs or devs can opt-in their apps for offline licensing when they submit them to the developer center. - -For more information, see [Apps in the Store for Business](../manage/apps-in-windows-store-for-business.md#licensing-model). - -### Distribute apps and content - -App distribution is handled through two channels, either through the Store for Business, or using a management tool. You can use either or both distribution methods in your organization. - -**Using the Store for Business** – Distribution options for the Store for Business: - -- Email link – After purchasing an app, admins can send employees a link in an email message. Employees can click the link to install the app. - -- Curate private store for all employees – A private store can include content you’ve purchased from the Store, and your line-of-business apps that you’ve submitted to the Store for Business. Apps in your private store are available to all of your employees. They can browse the private store and install apps when needed. - -- To use the options above users must be signed in with an Azure AD account on a Windows 10 device. - -**Using a management tool** – For larger organizations that might want a greater level of control over how apps are distributed and managed, a management tools provides other distribution options: - -- Scoped content distribution – Ability to scope content distribution to specific groups of employees. - -- Install apps for employees – Employees are not responsible for installing apps. Management tool installs apps for employees. - -Management tools can synchronize content that has been acquired in the Store for Business. If an offline application has been purchased this will also include the app package, license and metadata for the app (like, icons, count, or localized product descriptions). Using the metadata, management tools can enable portals or apps as a destination for employees to acquire apps. - -For more information, see [Distribute apps to your employees from the Store for Business](../manage/distribute-apps-to-your-employees-windows-store-for-business.md). - -### Manage Store for Business settings and content - -Once you are signed up with the Business store and have purchased apps, Admins can manage Store for Business settings and inventory. - -**Manage Store for Business settings** - -- Assign and change roles for employees or groups - -- Device Guard signing - -- Register a management server to deploy and install content - -- Manage relationships with LOB publishers - -- Manage offline licenses - -- Update the name of your private store - -**Manage inventory** - -- Assign app licenses to employees - -- Reclaim and reassign app licenses - -- Manage app updates for all apps, or customize updates for each app. Online apps will automatically update from the Store. Offline apps can be updated using a management server. - -- Download apps for offline installs - -For more information, see [Manage settings in the Store for Business](../manage/manage-settings-windows-store-for-business.md) and [Manage apps](../manage/manage-apps-windows-store-for-business-overview.md). - -## Supported markets - - -Store for Business is currently available in these markets. - -|Country or locale|Paid apps|Free apps| -|-----------------|---------|---------| -|Argentina|X|X| -|Australia|X|X| -|Austria|X|X| -|Belgium (Dutch, French)|X|X| -|Brazil| |X| -|Canada (English, French)|X|X| -|Chile|X|X| -|Columbia|X|X| -|Croatia|X|X| -|Czech Republic|X|X| -|Denmark|X|X| -|Finland|X|X| -|France|X|X| -|Germany|X|X| -|Greece|X|X| -|Hong Kong SAR|X|X| -|Hungary|X|X| -|India| |X| -|Indonesia|X|X| -|Ireland|X|X| -|Italy|X|X| -|Japan|X|X| -|Malaysia|X|X| -|Mexico|X|X| -|Netherlands|X|X| -|New Zealand|X|X| -|Norway|X|X| -|Philippines|X|X| -|Poland|X|X| -|Portugal|X|X| -|Romania|X|X| -|Russia| |X| -|Singapore|X|X| -|Slovakia|X|X| -|South Africa|X|X| -|Spain|X|X| -|Sweden|X|X| -|Switzerland (French, German)|X|X| -|Taiwan| |X| -|Thailand|X|X| -|Turkey|X|X| -|Ukraine| |X| -|United Kingdom|X|X| -|United States|X|X| -|Vietnam|X|X| - -## ISVs and the Store for Business - - -Developers in your organization, or ISVs can create content specific to your organization. In the Store for Business, we call these app line-of-business (LOB) apps, and the devs that create them are LOB publishers. The process looks like this: - -- Admin invites devs to be LOB publishers for your organization. These devs can be internal devs, or external ISVs. - -- LOB publishers accept the invitation, develop apps, and submits the app to the Windows Dev Center. LOB publishers use Enterprise associations when submitting the app to make the app exclusive to your organization. - -- Admin adds the app to Store for Business inventory. - -Once the app is in inventory, admins can choose how to distribute the app. ISVs creating apps through the dev center can make their apps available in the Store for Business. ISVs can opt-in their apps to make them available for offline licensing. Apps purchased in the Store for Business will work only on Windows 10. - -For more information on line-of-business apps, see [Working with Line-of-Business apps](../manage/working-with-line-of-business-apps.md). - -  - -  - - - - - diff --git a/windows/whats-new/windows-update-for-business.md b/windows/whats-new/windows-update-for-business.md index 24ae371549..4b69cf6ecd 100644 --- a/windows/whats-new/windows-update-for-business.md +++ b/windows/whats-new/windows-update-for-business.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: TrudyHa +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in Windows Update for Business? @@ -20,13 +21,13 @@ Windows Update for Business enables information technology administrators to kee ## Benefits of Windows Update for Business -By using [Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: +By using [Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: - **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). - **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient. -- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=699281). +- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](https://go.microsoft.com/fwlink/p/?LinkId=699281). Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) and [System Center Configuration Manager](http://technet.microsoft.com/library/gg682129.aspx).